Input Complexity and Out-of-distribution Detection with Likelihood-based Generative Models
Authors: Joan Serrà
David Álvarez
Vicenç Gómez
Olga Slizovskaia
José F. Núñez
Jordi Luque
Venue:  (2020)
Keywords: OOD
generative models
likelihood

Abstract: Likelihood-based generative models are a promising resource to detect out-of-distribution (OOD) inputs which could compromise the robustness or reliability of a machine learning system. However, likelihoods derived from such models have been shown to be problematic for detecting certain types of inputs that significantly differ from training data. In this paper, we pose that this problem is due to the excessive influence that input complexity has in generative models' likelihoods. We report a set of experiments supporting this hypothesis, and use an estimate of input complexity to derive an efficient and parameter-free OOD score, which can be seen as a likelihood-ratio, akin to Bayesian model comparison. We find such score to perform comparably to, or even better than, existing OOD detection approaches under a wide range of data sets, models, model sizes, and complexity estimates.

Published as a conference paper at ICLR 2020
INPUT COMPLEXITY AND OUT-OF-DISTRIBUTION DETECTION WITH LIKELIHOOD-BASED GENERATIVE MODELS
Joan Serràt2, David 2 Vicenç Gómez', Olga Slizovskaia José Núñez', and Jordi Luque"
Dolby Laboratories, Barcelona, Spain
Telefónica Research, Barcelona, Spain
3 Universitat Politèenica de Catalunya. Barcelona, Spain
4 Universitat Pompeu Fabra, Barcelona, Spain
joan. serra (eneaaddlllpp dolby com, vicen. www.eemmeeeeeee.e edu
ABSTRACT
Likelihood-base generative models are a promising resource detect out-of- distribution (OOD) inputs which could compromise the robustness or reliability machine learning system. However, likelihoods derived from such models have been shown to be problematic for detecting certain types of inputs that sig- nificantly differ from training data. In this paper, we pose that this problem is due to the excessive influence that input complexity has in generative models' likelihoods. We report a set of experiments supporting this hypothesis, and use estimate of input complexity score, which can be seen as a likelihood-ratio, akin to Bayesian model compari- son. We find such score to perform comparably to, even better than, existing OOD detection approaches under a wide range of data sets, models, model sizes, and complexity estimates.
derive efficient and parameter-free OOD
INTRODUCTION
Assessing whether input data is novel or significantly different than the one used in training is critical for real-world machine learning applications. Such data are known as out-of-distribution (OOD) inputs, and detecting them should facilitate safe and reliable model operation. This is particularly necessary for deep neural network classifiers, which can be easily fooled by OOD data (Nguyen al., 2015). Several approaches have been proposed for OOD detection top of within neural network classifier (Hendrycks & Gimpel, 2017; Lakshminarayanan et al., 2017: Liang et al., 2018; Lee al., 2018). Nonetheless, OOD detection is not limited to classification tasks to labeled data sets. Two examples of that are novelty detection from an unlabeled data set and next-frame prediction from video sequences.
A rather obvious strategy to perform OOD detection in the absence of labels (and even in the pres- ence of them) learn density model M that approximates the true distribution p (X) of training inputs x X' (Bishop, 1994). Then. if such approximation is good enough, that is, p(x|M) = p" (x), OOD inputs should yield a low likelihood under model M. With complex data like audio images, this strategy was long thought to be unattainable due to the difficulty of learning sufficiently good model. However, with current approaches, we start having generative models that are able to learn good approximations of the density conveyed by those complex data. Autoregressive and invertible models such as PixeICNN+ (Salimans et al., 2017) and Glow (Kingma & Dhariwal, 2018) perform well in this regard and, in addition, approximate p(x|MM with arbitrary accuracy.
Recent works, however, have shown that likelihoods derived from generative models fail to distin- guish between training data and some OOD input types (Choi et al., 2018; Nalisnick et al., 2019a; Hendrycks et al., 2019). This occurs for different likelihood-based generative models, and even when inputs unrelated training data have totally different semanties. For instance, when

---

Published as a conference paper at ICLR 2020
Normalized empirical KDF
CIFAR 1O (Triin)
CIFARIO (Test)
TrafficSign (Tesi)
SVIIN (Tesi)
0.0
0.1
0.2
0.3
0.4
0.5
0.6
p(XIM)
Figure 1: Likelihoods from Glow model trained on CIFARIO. Qualitatively similar results are obtained for other generative models and data sets (see also results in Choi al., 2018; Nalisnick et al., 2019a).
trained on CIFARIO, generative models report higher likelihoods for SVHN than for CIFARIO itself (Fig. I; data descriptions are available in Appendix A). Intriguingly, this behavior is not consistent across data sets, as other ones correctly tend to produce likelihoods lower than the ones of the train- ing data (see the example of TrafficSign in Fig. 1). A number of explanations have been suggested for the root cause of this behavior (Choi et al., 2018; Nalisnick al., 2019a; Ren et al., 2019) but, to date, full understanding of the phenomenon remains elusive.
In this paper, we shed light to the above phenomenon, showing that likelihoods computed from generative models exhibit a strong bias towards the complexity of the corresponding inputs. We find that qualitatively complex images tend to produce the lowest likelihoods, and that simple images always yield the highest ones. In fact, we show clear negative correlation between quantitative estimates of complexity and the likelihood of generative models. In the second part of the paper, we propose to leverage such estimates of complexity to detect OOD inputs. To do so, we introduce widely-applicabee OOD score for individual inputs that corresponds, conceptually, to a likelihood- ratio test statistic. We show that such score turns likelihood-based generative models into practical and effective OOD detectors, with performances comparable to, or even better than the state-of-the- art. We base our experiments on an extensive collection of alternatives, including a pool of 12 data sets, two piccptuulll-ddiferee generative models, increasing model sizes, and three variants of complexity estimates.
2 COMPLEXITY BIAS IN LIKELIHOOD-BASED GENERATIVE MODELS
From on, shall consider the log- likeliied of an input given model M: (x(() loga P(I.M). Following common practice in evaluating generative models, negative log- liceliisssoodds -eM will be expressed in bits per dimension (Theis al., 2016), where dimension corresponds to the total size of x (we resize all images to 3x32x32 pixels). Note that the qualitative behavior of loglliielssoods is the same as likelihoods: ideally, OOD inputs should have a low lM. while in-distribution data should have larger tm-
Most literature compares likelihoods of a given model for few data sets. However, if we consider several different data sets at once and study their likelihoods, we can get some insight. In Fig. 2, we show the log-likeling likeelioooood distributions for the considered data sets (Appendix A). computed with a Glow model trained on CIFARIO. We observe that the data set with a higher log-likelihood is Constant, data set of constant-color images, followed by Omniglot, MNIST, and FashionMNIST; all of those featuring gray-scale images with large presence of empty black background. On the other side of the spectrum, we observe that the data set with a lower log-likelihood Noise, data set of uniform random images, followed by TrafficSign and ImnylmageNet; both featuring colorful images with non-trive non-trivial background. Such ordering is perhaps more clear by looking at the average log- liglliielihood of each data set (Appendix D). If we think about the visual complexity of the images in those data sets, it would seem that log- likeliihsoo tend to grow when images become simpler and with less information or content.
2

---

Published as a conference paper at ICLR 2020
Normalized empirical KDE
CI (Trin)
CIFARI00 100 (Tes)
CIFARIO (Test)
CalebA (Test)
Constant (Test)
FaceSerub (Test)
Ornniglol (Test)
TinyImageNel (Test)
MNIST (Test)
TraffioSign (Test)
FishionMNIST (Test)
Noise (Test)
SVHN (Test)
-10
-8
-6
-2
CM
Figure 2: Log-likelihoods from a Glow model trained CIFARIO. Qualitatively similar results obtained for PixcICNN+ model and when training with FashionMNIST.
Normalized empirical KDE
CIFARIO (Test)
Puoling 1
Pooling
Pooling
Pooling
Puoling
Paoling 32
-10
-2
PM
Figure 3: Pooled-image log-likelihoods obtained from a Glow model trained on CIFAR1O. Qualita- tively similar results obtained for PixeICNN+ model.
To further confirm the previous observation, we design controlled experiment where we can set different decreasing levels image complexity. We train generative model with some data set, as before, but now compute likelihoods of progressively simpler inputs. Such inputs are obtained by average-pooling the uniform random Noise images by factors of 1, 2, 4, 8, 16, and 32, and re-scaling back the images to the original size by nearest- neighbor up-sampling. Intuitively, noise image with a pooling size of 1 (no pooling) has the highest complexity, while a noise image with a pooling of 32 (constant-color image) has the lowest complexity. Pooling factors from 2 to 16 then account for intermediate, decreasing levels of complexity. The result of the experiment is a progressive growing of the log-likelihood ÉM (Fig. 3). Given that the only difference between data is the pooling factor, we can infer that image complexity plays a major role in generative models' likelihoods.
Until now, have consciously avoided quantitative definition of complexity. However, further study the observed phenomenon, and despite the difficulty in quantifying the multiple aspects that affect the complexity of an input (cf. Lloyd, 2001), we have adopt one. A sensible choice would be to exploit the notion of Kolmogorov complexity (Kolmogorov, 1963) which, unfortunately, is non- computable. In such cases, we have to deal with it by calculating an upper bound using a lossless compression algorithm (Cover & Thomas, 2006). Given a set of inputs x coded with the same bit depth, the normalized size of their compressed versions, L(x) (in bits per dimension), can be considered reasonable estimate of their complexity. That is, given the same coding depth, highly complex input will require more bits per dimension, while a less complex one will be compressed with fewer bits per dimension. For images, (Appendix C). For other data types such as audio or text, other lossless compressors should be available to produce similar estimate.
use PNG, JPEG2000. or FLIF compressors
3

---

Published as a conference paper at ICLR 2020
8
CIFARIO (Train)
CIFARIO (Test)
6
Constant (Test)
Omniglot (Test)
MINIST (Test)
5
FashionMNIST (Test)
1(x
SVHN (Test)
4-
CIFARJOO
CelebA (Test)
3-
FaceSerub (Test)
TinyImageNer (Tost)
2-
TrafficSign (Test)
Noise (Test)
0
0.25
0.5
0.75
P(xlM)
Figure 4: Normalized compressed lengths using PNG compressor with respect likelihoods of a PixeICN++ model trained on CIFARIO (for visualization purposes we here employ a sample of 200 images per data set). Similar results are obtained for Glow model and other compressors.
If we study the relation between generative models' likelihoods and our complexity estimates, we observe that there is clear negative correlation (Fig. 4). Considering all data sets, we find Pearson's correlation coefficients below -0.75 for models trained on FashionMNIST, and below -0.9 for models trained on CIFARIO, independently of the compressor used (Appendix D). Such significant correlations, all of them with infinitesimal p-values, indicate that likelihood- highly influenced by the complexity of the input image, and that this concept accounts for most of their variance. In fact, such strong correlations suggest that may replace the computed likelihood values for the negative of the complexity estimate and obtain almost the same result (Appendix D). This implies that, in terms of detecting OOD inputs, complexity estimate would perform well (or bad) as the likelihoods computed from our generative models.
measures
TESTING OUT-OF-DISTRIBUTION INPUTS
3.1 DEFINITION
As complexity seems account for most of the variability in generative models' likelihoods, propose to compensate for it when testing for possible OOD inputs. Given that both negative log- likelihoods -ÉM(x) (x) and the complexity estimate L(x) are expressed in bits per dimension (Sec. 2), we can express our OOD score as subtraction between the two:
S(x) -x
Notice that, since negative log-likelihoods, the higher the S, the more OOD the input will be (see below).
3.2 INTERPRETATION: OCCAM'S RAZOR AND THE OUT-OF-DISTRIBUTIOO PROBLEM
Interestingly, S can be interpreted as likelihood-ratio test statistic. For that, we take the point of view Bayesian model comparison or minimum description length principle (MacKay, 2003). We can think of compressor My universal model, adjusted for all possible inputs and gen- eral enough so that it is not biased towards a particular type of data semantics. Considering the probabilistic model associated with the size of the output produced by the lossless compressor,
4

---

Published as a conference paper at ICLR 2020
have
M() = 2(x)
and, correspondingly,
[(x) = - log2 M(x)
(2)
In Bayesian model comparison, we are interested in comparing the posterior probabilities of differ- ent models in light of data X. In our setting, the trained generative model M is 'simpler' version of the universal model Mo, targeted to specific semanties or data type. With it, one aims to ap- proximate the marginal likelihood (or model evidence) for X, which integrates out all model parameters:
M( =
( p(x)ee
This integral is intractable, but current generative models can approximate p(x with arbitrary accuracy (Kingma & Dhariwal, 2018). Choosing between another model is then reduced to simple likelihood ratio:
log2 p(Molx) loge p(M
M(x(MM))(MM)) Mpx
(3)
For uniform priors p(M)) p(M) = 1/2, this ratio is reduced to S(x) = - loga M( + logg ((x
which, using Eq. for the last term, becomes Eq. 1.
The ratio S accommodates the Occam's razor principle. Consider simple inputs that can be easily compressed by Mo using few bits, and that are present in the training of M. These cases have high probability under Mo. effectively correcting the abnormal high likelihood given by the learned model M.. The same effect will occur with complex inputs that are not present in the training data. In these cases, both likelihoods will be low, but the universal lossless compressor Ma will predict those better than the learned model M. The two situations will lead to large values of S. In contrast, inputs that belong to the data used to train the generative model M will always be better predicted by M than by Mo. resulting lower values of S.
3.3 USING IN PRACTICE
Given training set X' of in-distribution samples and the corresponding scores S(x) for each x X, we foresee a number of strategies to perform OOD detection in practice for new instances z. The first and more straightforward one is This can be useful to monitor the top-k, potentially more problematic instances z in a new set of unlabeled data Z. The second strategy to interpret S(z) as the corresponding Bayes factor in Eq. 3, and directly assign Z to be OOD for S(z) > O, or in-distribution otherwise (cf. MacKay, 2003). The decision is then taken with stronger evidence for higher absolute values of S(z). A third strategy is to consider the empirical or null distribution of S for the full training set, S(X)) We could then choose an appropriate quantile as threshold, adopting the notion of frequentist hypothesis testing (see for instance Nalisnick et al., 2019b). Finally, if ground truth OOD data y is available, fourth strategy is to optimize a threshold value for 5z)). Using X' and ) we can choose a threshold that targets& a desired percentage of false positives negatives.
S(z) as it just as score, perform OOD ranking.
The choice specific strategy will depend on the characteristics the particular application under consideration. In this work, prefer to keep evaluation generic and to not adopt any specific thresholding strategy (that is, we use S directly, as a score). This also allows us to compare with the majority of reported values from the existing literature, which use the AUROC measure (see below).
RELATED WORKS
Ren et al. (2019) have recently proposed the use of likelihood-ratio tests for OOD detection. They posit that "background statistics" (for instance, the number zeros in the background of MNIST- like images) are the source of abnormal likelihoods, and propose exploit them by learning background model which is trained on random surrogates of input data. Such surrogates are gener- ated according Bernoulli distribution, and an 1.2 regularization term is added to the background
5

---

Published as a conference paper at ICLR 2020
model, which implies that the approach has two syper-parameters. Moreover, both the background model and the model trained using in-distribution data need to capture the background information equally well. In contrast to their method, our method does not require additional training nor extra conditions on specific background model for every type of training data.
Choi et al. (2018) and Nalisnick et al. (2019h) suggest that typicality is the culprit for likelihood- based generative models not being able to detect OOD inputs. While Choi et al. (2018) do not explicitly address typicality, their estimate of the Watanabe-Akaike information criterion using en- sembles of generative models performs well in practice. Nalisnick et al. (2019b) propose an explicit test for typicality employing a Monte Carlo estimate of the empirical entropy, which limits their approach to batches of inputs of the same type.
The works of Høst-Madsen al. (2019) and Sabeti & Høst-Madsen (2019) combine the concepts of typicality and minimum description length to perform novelty detection. Although concepts are similar to the ones employed here, their focus mainly on bit sequences. They consider atypical se- quences those that can be described (coded) with fewer bits in itself rather than using the (optimum) code for typical sequences. We find their implementation to rely on strong parametric assumptions. which makes it difficult to generalize to generative or other machine learning models.
number of methods have been proposed to perform OOD detection under classification-bass framework (Hendrycks& & Gimpel, 2017: Lakshminarayanal et al., 2017; Liang et al., 2018; Alemi et al., 2018; Lee et al., 2018; Hendrycks et al., 2019). Although achieving promising results, these methods do not generally apply to the more general case of non-labeled or self-supervised data. The method of Hendrycks et al. (2019) extends to such cases by leveraging generative models, but nonetheless makes use of auxiliary, outlier data learn to distinguish OOD inputs.
5 RESULTS
We now study how S performs on the OOD detection task. For that, we train a generative model M on the train partition of a given data set and compute scores for such partition and the test partition of a different data set. With both sets of scores, we then calculate the area under the receiver oper- ating characteristic curve (AUROC), which is common evaluation measure for the OOD detection task (Hendrycks et al., 2019) and for classification tasks in general. Note that AUROC represents a good performance summary across different score thresholds (Fawcett, 2005).
First of all, we want to assess the improvement of S over log-likelihoods alone (-EM). When con- sidering likelihoods from generative models trained on CIFAR1O, the problematic results reported by previous works become clearly apparent (Table 1). The unintuitive higher likelihoods for SVHN observed in Sec. now translate into a poor AUROC below 0.1. This not only happens for SVHN, but also for Constant, Omniglot, MNIST, and FashionMNIST data sets, for which we observed consistently higher likelihoods than CIFARIO in Sec. 2. Likelihoods for the other data sets yield AUROCs above the random baseline of 0.5, but none above 0.67. The only exception is the Noise data set, which is perfectly distinguishable from CIFAR 10 using likelihood alone. For completeness, include the AUROC values when trying to perform OOD with the test partition of CI We see those are close to the ideal value of 0.5, showing that, as expected, the reported measures do not generally consider those samples to be OOD.
We now look at the AUROCS obtained with S (Table 1). We see that, not only results are reversed for less complex datasets like MNIST or SVHN, but also that all AUROCS for the rest of the data sets improve as well. The only exception to the last assertion among all studied combinations is the combination of TinylmageNet with PixeICNN++ and FLIF (see Appendix for other combina- tions). In general, we obtain AUROCS above 0.7, with many of them approaching 0.9 or 1. Thus, we can conclude that clearly improves over likelihoods alone in the OOD detection task, and that S is able to revert the situation with intuitively less complex data sets that were previously yielding a low AUROC.
We also study how the training set, the choice of compressoorgeeneratie model, the size of the model affects the performance of S (Appendix D). In terms of models and compressors, we do not observe large difference between the considered combinations, except for few isolated cases whose investigation we defer for future work. In terms of model size, we do observe a tendency to provide better discrimination with increasing size. In terms of data sets, find the OOD detection

---

Published as a conference paper at ICLR 2020
Table AUROC values using negative log-likeliiee le-likkliihod L&M and the proposed score for Glow and PixcICNN+ models trained on CIFARIO using the FLIF compressor. Results for models trained on FashionMNIST and other compressors are available Appendix
Data set
Glow
PixeICNN+
LMM
S
LM
S
Constant
0.024
1.000
0.006
1.000
Omniglot
0.001
1.000
0.001
1.000
MNIST
0.001
1.000
0.002
1.000
FashionMNIST
0.010
1.000
0.013
1.000
SVHN
0.083
0.950
0.083
0.929
CIFAR100
0.582
0.736
0.526
0.535
CelebA
0.621
0.863
0.624
0.776
FaceScrub
0.646
0.859
0.643
0.760
TinylmageNet
0.663
0.716
0.642
0.589
TrafficSign
0.609
0.931
0.599
0.870
Noise
1.000
1.000
1.000
1.000
CIFARIO (test)
0.564
0.618
0,506
0.514
task to be easier with FashionMNIST than with CIFARIO. We assume that this is due to the ease of the generative model learn and approximate the density conveyed by the data. A similar but less marked trend also observed for compressors, with better compressors yielding slightly improved AUROCs than other, in principle, less powerful ones. takeaway from all these observations would be that using larger generative models and better compressors will yield more reliable S and better AUROC. The conducted experiments support that, but more in-depth analysis should be carried out to further confirm this hypothesis.
Finally, we want assess how compares to previous approaches in the literature. For that, we compile number of reported AUROCs for both classifier- and generative-bart approaches and compare them with Note that classifier-based approaches, as mentioned in Sec. are less appli- cable than generative-base ones. In addition, as they exploit label information, they might have an advantage over generative-beue approaches in terms of performance (some also exploit external or outlier data; Sec. 4).
observe that competitive with both classifier- and existing generative-base approaches (Table 2). When training with FashionMNIST, S achieves the best scores among all considered approaches. The results with further test sets are also encouraging, with almost all AUROCs ap- proaching 1 (Appendix D). When training with CIFAR10, S achieves similar or better performance than existing approaches. Noticeably, within generative- based approaches, S is only outperformed in two occasions by the same approach, WAIC, which ensembles of generative models (Sec. 4).
On the one hand, it would be interesting to see how S could perform when using ensembles of models and compressors to produce better estimates of ((M and L, respectively. On the other hand, however, the use of a single generative model together with a single fast compression library makes an efficient alternative compared WAIC and some other existing approaches. noting that many existing approaches have a number of hyper parre--rrrmeterss that need to be tuned, sometimes with the help of outlier or additional data. contrast, S a parameter-free measure, which makes it easy to use and deploy.
also worth
CONCLUSION
We illustrate fundamental insight with regard to the use of generative models' likelihoods for the task of detecting OOD data. We show that input complexity has strong effect in those likelihoods, and pose that is the main culprit for the puzzling results using generative models' likelihoods for OOD detection. In addition, show that an estimate of input complexity be used com-

---

Published as a conference paper at ICLR 2020
Table 2: Comparison of AUROC values for the OOD detection task. Results reported by the original references except (a) by Ren et al. (2019), (b) by Lee et al. (2018), and (c) by Choi et al. (2018). Results for Typicality test correspond to using batches of samples of the same type.
Trained on:
FashionMNIST
CIFARIO
OOD data:
MNIST Omniglot
SVHN CelebA CIFARI00
Classifier-basel approaches
ODIN (Liang et al., 2018)ab
0.697
0.966
VIB (Alemi et al., 2018)
0.941
0.943
0.528
0.735
Mahalanobis (Lee et al., 2018)
0.986
0.991
Outlier exposure (Hendrycks et al., 2019)
0.984
0.933
Generative-bused approuches
WAIC (Choi et al., 2018)
0.766
0.796
1.000
0.997
Outlier exposure (Hendrycks et al., 2019)
0.758
0.685
Typicality test (Nalisnick et al., 2019b)
0.140
0,420
Likelihood-rail (Ren al., 2019)
0.997
0.912
using Glow and FLIF (ours)
0.998
1.000
0,950
0.863
0.736
S using PixeICNN+ and FLIF (ours)
0.967
1.000
0.929
0.776
0.535
pensate standard negative log-likelihoods in order to produce an efficient and reliable OOD score. We also offer interpretation of score likelihood-ratio akin Bayesian model compar- ison. Such score performs comparably to, even better than several state-of-the-at approaches, with results that are consistent across range data sets, models, model sizes, and compression al- gorithms. The proposed score has no and compression algorithm, which makes it easy to employ variety of practical problems and situations.
besides the definition of generative model
ACKNOWLEDGMENT
We thank Ilias Leontiadis and Santi Pascual for useful discussions the beginning of this project. Vicenç Gómez is supported by the Ramon Cajal program RYC-2015-18878 (AE//IIEEICO/FSE.EE)) This project has been partially funded by "la Caixa" Foundation (ID 100010434) under agreement LCF/PR/PR ( 10009 and by the EU's Horizon 2020 research and innovation program under grant agreement No 871793. This reflects only the authors' view and the Commission is not responsible for any use that may be made of the information it contains.
REFERENCES
A. A. Alemi, I. Fischer, and J. V. Dillon. Uncertainty in the variational information bottleneck. In Uncertainty in Deep Learning Workshop, UAI, 2018.
C. M. Bishop. Novelty detection and neural network validation. IEEE Proceedings Vision, Image and Signal Processing. (11(4)2177222) 1994.
H. Choi, E. Jang, and A. A. Alemi. WAIC, but why? Generative ensembles for robust anomaly detection. ArXiv, 1810.01392, 2018.
Cover and A. Thomas. Elements of informmatiin theory. Wiley-Interscience, Hoboken, USA, 2nd edition, 2006.
Deng, W. Dong, R. Socher, L.J. Li, K. Li, and L. Fei-Fei. Imagenet: large-scale hierarchical image database. In IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 248- 255, 2009.
T. Fawcett. An introduction ROC analysis. Pattern Recognition Letters, 27:861-877 2005.
8

---

Published as a conference paper at ICLR 2020
D. Hendrycks and K. Gimpel. A baseline for detecting misclassified and -istiiititiittiionnn exam- ples in neural networks. In Proc. of the Int. Conf. on Learning Representations (ICLR), 2017.
D. Hendrycks, M. Mazeika, and T. G. Dietterich. Deep anomaly detection with outlier exposure. In Proc. of the Int. Conf. on Learning Representations (ICLR), 2019.
A. Høst-Madsen, E. Sabeti, and C. Walton. Data Discovery and Anomaly Detection Using Atypi- cality: Theory. IEEE Trans. on Information Theory, In press, 2019.
D. P. Kingma and P. Dhariwal. Glow: generative flow with invertible 1xl convolutions. In S. Ben- gio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa- Biaa-B, and R. Garnett (eds.), Advances in Neural Information Processing Systems (NeurlPS), volume 31, pp. 10215-10224. Curran As- sociates, Inc., 2018.
A. N. Kolmogorov. On tables of random numbers. Sankhya Ser. A, 25:369-375, 1963. 1963.
A. Krizhevsky. Learning multiple layers of features from liny images. MSc Thesis, University of Toronto, Toronto, Canada, 2009.
B. Lake, R. Salakhutdinov, and Tenenbaum. Human-level concept learning through probabilistic program induction. Science, 350: 1332-1338, 2015.
B. Lakshminarayanan, A. Pritzel, and C. Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallac, R. Fer- gus, S. Vishwanatan, and R. Garnett (eds.), Advances in Neural Information Processing Systems (NeurIPS), pp. -432-6413. Curran Associates, Inc., 2017.
Y. LeCun, C. Cortes, and C. C. Burges. The MNIST database of handwritten digits. 2010. URL http:/ /tt///yaaannaa//aa//aaaeeeaa lecun. lewun.
com/ e exdb/mmrt /mt/st/ni......mm///mmm/m//..../
K. Lee, K. Lee, H. Lee, and J. Shin. A simple unified framework for detecting samples and adversarial attacks. S. Bengio, Wallach, H. Larochelle, K. Grauman, N. Cesa- Bianchi, and R. Garnett (eds.), Advances in Neural Information Processing Systems (NeurIPS), pp. 7167-7177. Curran Associates, Inc., 2018
Liang Y. Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In Proc. of the Int. Conf. on Learning Representations (ICLR), 2018.
Z. Liu, P. Luo, X. Wang, and X. Tang. Deep learning face attributes in the wild. In Proc. of Int. Conf. on Computer Vision (ICCV), pp. 3730-3738, 2015.
S. Lloyd. Measures of complexity: nonexhaustive list. IEEE Control Systems Magazine, 21(4): 7-8, 2001.
D. J. C. MacKay. Information theory, inference and learning algorithms. Cambridge University Press, Cambridge, UK, 2003.
E. Nalisnick, A. Matsukawa, Y. W. Teh, D. Gorur, and B. Lakshminarayanan. Do deep generative models know what they don't know? In Proc. of the Int. Conf. on Learning Representations (ICLR), 2019a.
E. Nalisnick, A. Matsukawa, Y. W. Teh, and B. Lakshminarayanan. Detecting out-of-distribution inputs to deep generative models using test for typicality. ArXiv, 1906.02994, 2019b.
Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng. Reading digits in natural images with unsupervised feature learning. NIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
H. W. Ng and S. Winkler. data-driven approach cleaning large face dataset. Proc. of the IEEE Inf. Conf. on Image Processing (ICIP), pp. 343-347, 2014.
A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks are easily fooled: high confidence predictions for unrecognizable images. In Proc. of the IEEE Conf. on Computer Vision and Pattern Recognition (CVPR), pp. 427-436, 2015.

---

Published as a conference paper at ICLR 2020
A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and A. Lerer. Automatic differentiation in PyTorch. In NIPS Workshop on The Future of Gradient- based Machine Learning Software & Techniques (NIPS-Autodiif) 2017.
Ren, P. Liu, E. Fertig, J. Snoek, R. Poplin, M. DePristo, V. Dillon, and B. Lakshmi- narayanan. Likelihood ratios for out-of-distribution detection. In Advances in Neural Information Processing Systems (NeurIPS), in press. Curran Associates, Inc., 2019.
E. Sabeti and Høst-Madsen. Data discovery and anomaly detection using atypicality for real- valued data. Entropy, 21(3):219, 2019.
T. Salimans, A. Karpaty, X. Chen, and D. Kingma. PixeICNN++: improving the PixelCNN with discretized logistic mixture likelihood and other modifications. In Proc. of the Int. Conf. on Learning Representations (ICLR), 2017.
Stallkamp, M. Schlipsing, Salmen, and C. Igel. The german traffic sign recognition benchmark: A multi-class classification competition. In The 2011 International Joint Conference on Neural Networks, pp. 1453-1460 1460, 2011.
Theis, A. Van den Oord, and M. Bethge. A note on the evaluation of generative models. In Proc. of the Int. Conf. Learning Representations (ICLR), 2016.
H. Xiao, K. Rasul, and R. Vollgraf. Fashion-MNIST: novel image dataset for benchmarking machine learning algorithms. ArXiv, 1708.07747, 2017.
10

---

Published as a conference paper at ICLR 2020
APPENDIX
A DATA SETS
In our experiments, we employ well-known, publicly-availabl data sets. addition those, and to facilitate a better understanding of the problem, we develop another two self-created sets of synthetic images: Noise and Constant images. The Noise data set is created by uniformly randomly sampling tensor of xx32x32 and quantizing the result to 8 bits. The Constant data set is created similarly, but using tensor of x and repeating the values along the last two dimensions to obtain a size of 3232x3. The complete list of data sets is available in Table 3. In the case of data sets with different variations, such as CelebA or FaceScrub, which have both plain and aligned versions of the faces, select the aligned versions. Note that, for models trained CIFARIO, it is important to notice the overlap of certain classes between that and other sets, namely Tiny ImagNeee and CIFAR (they overlap, for instance, in classes of certain animals vehicles). Therefore, strictly speaking, such data sets are not entirely OOD, at least semantically.
Table 3: Summary of the considered data sets.
Data set
Original size
Num. classes
Num. images
Constant (Synthetic)
3 3x32x32
40,000
Omniglot (Lake et al., 2015)
x 105x 105
1,623
32,460
MNIST (LeCun et al., 2010)
xx28 x28
10
70,000
FashionMNIST (Xiao et al., 2017)
1x28x28
10
70,000
SVHN (Netzer et al., 2011)
3x 32x32
10
99,289
CIFAR 10 (Krizhevsky, 2009)
3x32x32
10
60,000
CIFAR 100 (Krizhevsky, 2009)
3x32x32
100
60,000
CelebA (Liu et al., 2015)
3x178x215
10,177
182,732
FaceScrub (Ng & Winkler, 2014)
3x300x300
530
91,712
TinylmageNet (Deng et al., 2009)
3x64x64
200
100,000
TrafficSign (Stallkamp et al., 2011)
3x32x32
43
51,839
Noise (Synthetic)
3x32x32
1
40,000
In order to split the data between train, validation, and test, we follow two simple rules: (1) if the data contains some predefined train and test splits, we respect them and create validation split using a random 10% of the training data; (2) if no predefined splits are available, we create them by randomly assigming 80% of the data the train split and 10% both validation and test splits. In order to create consistent input sizes for the generative models, we work with 3-channel images of size 32x32. For those data sets which do not match this configuration, we follow classic bi-linear resizing strategy and, to simulate the three color components from gray-scale image, we triplicate the channel dimension.
B MODELS AND TRAINING
The results of this paper are obtained using two generative models of different nature: one autore- gressive model and one invertible model. As autoregressive model we choose PixeICNN+ (Sali- mans et al., 2017). which has been shown to obtain very good results in terms of likelihood for image data. As invertible model we choose Glow (Kingma Dhariwal, 2018), which also capable of inferring exact log-likeli ligelikess using large stacks of bijective transformations. We implement the Glow model using the default configuration of the original implementation! except that we zero- pad and do not use ActNorm inside the coupling network. The model has 3 blocks of 32 flows, using an affine coupling with an squeezing factor of 2. As for PixeICNN++, we set 5 residual blocks per
httpp:://oo thub. com/openai i

---

Published as a conference paper at ICLR 2020
stage, with 80 filters and 10 logistic components in the mixture. The non-linearity of the residual layers corresponds to an exponential linear unit".
We train both Glow and PixeICNN+ using the Adam optimizer with initial learning rate of 10 We reduce this initial value by a factor of 1/5 every time that the validation loss does not decrease during 5 consecutive epochs. The training finishes when the learning rate is reduced by factor of 1/100. The batch size of both models is set to 50. The final model weights are the ones yielding the best validation loss. The likelihoods obtained in validation with both Glow and PixeICNN+ match the ones reported in the literature for CIFARIO (Kingma & Dhariwal, 2018; Salimans et al., 2017). We also make sure that the generated images are of comparable quality to the ones shown in those references.
We use PyTorch version 1.2.0 (Paszke al., 2017). All models have been trained with a single NVIDIA GeForce GTX 1080Ti GPU. Training takes some hours under that setting.
C COMPRESSORS AND COMPLEXITY ESTIMATE
We explore three different options to compress input images. As a mandatory condition, they need to provide lossless compression. The first format that consider is PNG, and old-classic format which globally used and well-known. We use OpenCV² to compress from raw Numpy matri- ces, with compression set to the maximum possible level. The second format that consider is JPEG2000. Although not as globally known as the previous one, it is a more modern format with several new generation features such progressive decoding. Again, we use the default OpenCV implementation to obtain the size of an image using this compression algorithm. The third for- mat that we consider is FLIF, the most modern algorithm of the list. According to its website*. promises to generate up to 53% smaller files than JPEG2000. We use the publicly-availabe com- pressor implementation in their website. We do not include header sizes in the measurement of the resulting bits per dimension.
To compute our complexity estimate L(x), we compress the input x with one of the compressors C above. With that, we obtain string of bits Cxx). The length of it, |C(x). is normalized by the size or dimensionality of x, which we denote by d, to obtain the complexity estimate:
|C(x)
(xx)
We also experimented with an improved version of L,
L'(x) min (x) Lx)x)....)
where Li corresponds to different compression schemes. This forces S to work always with the best compressor for every x. our case, as FLIF was almost always the best compressor, we did not observe clear difference between using L or L'. However, in cases where it is not clear which compressor to use or cases in which we do not have a clear best/winner, L' could be of use.
D ADDITIONAL RESULTS
The additional results mentioned in the main paper are the following:
In Table 4, we report the average log-likelihood f. for every data set. We sort data sets from highest lowest likelikelioood
In Table 5, report the global Pearson's 's correlation coefficient for different models, train sets, and compressors. Due to the large sample size, Scipy version 1.2.1 reports a p-value of 0 in all cases.
In Table 6, we report the AUROC values obtained from likelioossoods fM-- complexity estimates I., simple two-tail test T taking into account lower and higher log-likelisoods, T MI - fm), and the proposed score S.
htt hhttps://flif.ingg
12

---

Published as a conference paper at ICLR 2020
In Table 7, report the AUROC values obtained from S across different Glow model sizes, using a PNG compressor.
In Table 8, we report the AUROC values obtained from S across different data sets, models, and compressors.
Table 4: Average log-likelihoods from PixelCNN+ model trained CIFARIO.
Data set
PM
Constant (Test)
0.25
Omniglot (Test)
-0.43
MNIST (Test)
-0.55
FaSHionMNIST (Test)
-0.83
SVHN (Test)
-119
CIFARIO (Train)
2.20
CIFAR10 (Test)
-221
CIFARI00 (Test)
-2.27
CelebA (Test)
-242
FaceScrub (Test)
-244
TinylmageNet (Test)
-2.51
TrafficSign (Test)
-2.1
Noise (Test)
8.22
Table 5: Pearson's 's correlation coefficient between normalized compressed length, using different compressors, and model likelihood. All correlations are statistically significant (see text).
Model
Trained with
Compressor
PNG
JPEG2000
FLIF
Glow
FashionMNIST
00.7
0075
0.77
PixeICNN+
FashionMNIST
0.77
-0.77
-0.78
Glow
CIFAR10
0.94
-0.90
-090
PixeICNN+
CIFAR10
0.96
-0.94
-0.94
13

---

Published as a conference paper at ICLR 2020
Table 6: AUROC values using negative log-likelihood -LM. the complexity measure L, simple two-tail test T (see text), and our score for Glow and PixeICNN+ models trained on CIFARIO and using PNG compressor. Qualitatively similar results were obtained for FashionMNIST and other compressors.
Data
Glow
PixcICNN+
EM
T
S
-(M
L
Constant
0.024
0.000
0.963
1.000
0.006
0.000
0.987
1.000
Omniglot
0.001
0.000
0.999
1.000
0.001
0.000
0.995
1.000
MNIST
0.001
0.000
0.998
1.000
0.002
0.000
0.992
1.000
FNSSI
0.010
0.003
0.987
1.000
0.013
0.003
0.966
1.000
SVHN
0.083
0.077
0.845
0.950
0.083
0.077
0.832
0.929
CIFAR100
0.582
0.483
0.576
0.736
0.526
0.483
0.540
0.535
CelebA
0.621
0.414
0.458
0.863
0.624
0.414
0.414
0.776
FaceScrub
0.646
0.452
0.472
0.859
0.643
0.452
0.425
0.760
TinylmageNet
0.663
0.548
0.585
0.716
0.642
0.548
0.544
0.589
TrafficSign
0.609
0.356
0.689
0.931
0.599
0.357
0.657
0.870
Noise
1.000
1.000
1.000
1.000
1.000
1.000
1.000
1.000
Table 7: AUROC values for S using Glow model trained on CIFARIO and PNG compressor. Results for different, increasing sizes of the model (blocks flow steps). Qualitatively similar results are obtained for other compressors.
Data set
2x 16
3x16
3x32
Constant
1.000
1.000
1.000
Omniglot
1.000
1.000
1.000
MNIST
1.000
1.000
1.000
FaShionMNIST
0.997
0.998
1.000
SVHN
0.765
0.783
0.950
CIFAR100
0.641
0.685
0.736
CelebA
0.741
0.794
0.863
FaceScrub
0.697
0.755
0,859
TinylmageNet
0.664
0.715
0.716
TrafficSign
0.946
0.957
0.931
Noise
1.000
1,000
1.000
14

---

Published as a conference paper at ICLR 2020
Table 8: Comparison of AUROC values for the proposed OOD score S using different compressors:
Glow and PixeICNN+ models trained on FashionMNIST (top) and CIFARIO (bottom).
Data set
Glow
PixeICNN+
PNG
JPEG2000
FLIF
PNG
JPEG2000
FLIF
Constant
1.000
1.000
1.000
1.000
1.000
1.000
Omniglot
1.000
1,000
1,000
1.000
1.000
1.000
MNIST
0.841
0.493
0.997
0.821
0.687
0.967
SVHN
1.000
1.000
1.000
1.000
1.000
1.000
CIFARIO
1.000
1.000
1.000
0.998
1.000
1 1.000
CIFARI00
1.000
1,000
1.000
0.997
1.000
1.000
CelebA
1.000
1.000
1.000
1.000
1.000
1 1,000
FaceScrub
1.000
1.000
1.000
1.000
1.000
1.000
TinylmageNet
1.000
1.000
1.000
1.000
1.000
1. 1.000
TraffieSign
1.000
1,000
1.000
1.000
1.000
1,000
Noise
1.000
1.000
1.000
1.000
1.000
1.000
Constant
1.000
1.000
1.000
1. 1.000
1.000
1 1.000
Omniglot
1.000
0.994
1.000
1.000
0.997
1.000
MNIST
1.000
0.996
1.000
1.000
0.995
1.000
FaSHionMNIST
0.998
0.998
1.000
0.998
0.995
1.000
SVHN
0.787
0.974
0.950
0.787
0.965
0,929
CIFAR100
0.683
0.757
0.736
0.583
0.514
0.535
CelebA
0.794
0.701
0.863
0.756
0.640
0.776
FaceScrub
0.750
0.797
0.859
0.710
0.704
0,760
TinylmageNet
0.710
0.875
0.716
0.657
0.735
0,589
TrafficSign
0.953
0.955
0.931
0.916
0.840
0.870
Noise
1.000
1,000
1.000
1.000
1.000
1.000
15


Reviews:
[{"review_id": "SygCwHW0Fr", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "# ==== Summary of the paper ====\n\nThis paper proposes a new criterion for out-of-distribution (OOD) detection for\ngenerative modelling of images (absence of labels). The OOD detection task is defined as follows: given a generative model p(x) trained on some data $X \\sim p^*$ (where $p^*$ is the true unknown data generating distribution), and a test point y, how can we make use of p to detect that y is not drawn from $p^*$ (i.e., out of distribution)? The first natural idea is to use the likelihood (density) given by p, which, by now, is known to be problematic since the likelihood can be high when evaluated on data points from a completely different domain. \n\nThis paper contributes the following results:\n\n1. Show that \"simple\" images (e.g., constant color) tend to give high likelihood, whereas complex images (e.g., noise) tend to give low likelihood. See Figure 2. The paper further quantifies this complexity with the normalized size of the compressed input images, as given by a compression algorithm. The paper shows that there is a negative correlation between the compressed size and the likelihood (models trained on CIFAR 10. See Figure 4).\n\n2. To address this issue with using only the likelihood for OOD detection, the paper proposes a new measure $S(x)$ given by the negative log likelihood minus the normalized compressed size. See Eq 1. The paper connects this measure to Bayesian model selection.\n\nEmpirical results on more than 10 image datasets show that the proposed measure works better than the negative log likelihood in most cases.\n\n# ==== Review ====\n\nThe paper is easy to follow. The finding that simple images tend to give high likelihood is interesting. My concerns are:\n\n1. How much does the conclusion that \"simple images tend to give high likelihood\" depend on the complexity of the model? As far as I can see, only a few models are studied here: Glow and PixelCNN++. What is the quality of the learned models? Do they generate realistic images? What happens if you consider simpler models (say, reduce the number of layers in Glow.)?\n\n2. Given a model p and a test input image y, how exactly do you tell if y is out of distribution? Is there a threshold? If so, what is the threshold? I understand that by AUROC used in Table 1, you vary the threshold. For each value of the threshold, you compute the true positive and false positive rates, and plot the ROC curve. The reported numbers in Table 1 are areas under the curve. Is this correct? But this does not explain how to perform OOD detection given one input image.\n\n3. What is the reason for the poor AUROC in the case of TinyImageNet in Table 1? This is an interesting case since it may suggest that there are other hidden factors (besides the complexity of images) that can affect the OOD detection with the likelihood.\n\n4. Have you tried to run the experiment in Table 1 with a model trained on Constant (simplest images) or Noise (most complex images)?  What happens? Also, why not also include CIFAR10 (used to train the model) in the list of datasets in Table 1?\n\nOverall, my main concerns are with the thoroughness of the experiments, and that the two main contributions (summarized above) may not be enough. I will consider my evaluation again after seeing responses from the authors.\n\n\n# ==== Minor. Did not affect the score ====\n\n* The bottom margin seems off. Please check whether the Latex template is used correctly.\n\n* The paragraph before Section 3: \"... could replace the computed likelihood values for the negative of our complexity estimate ...\" I think it is too soon to make this conclusion. \n\n* The term \"likelihood ratio test\" used in Section 3.2 is very misleading. There is no hypothesis testing there.\n\n* Might be better to briefly describe the meaning of AUROC at the beginning of section 5.\n\n\n\n\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "SkeLO7hqFr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper discusses the inductive biases in generative models that tend to assign higher likelihoods to \"less complex\" images. In particular, a likelihood based generative model (like Glow or PixelCNN++) trained on a particular dataset has significantly higher likelihood for data that have lower compression ratios (e.g  with PNG). The authors propose a simple approach based on the likelihood ratio between a trained model and a \"prior\" model (based on existing compression methods) and demonstrate that this improves unsupervised OOD detection on certain dataset pairs. The idea is quite simple (and surprising it seems to work!), but it seems that better understanding of the proposed method could be achieved.\n\nQuestions:\n\nIf our goal is to perform OOD detection, then higher likelihood for test samples might not be an issue, as we can simply declare samples with higher and lower likelihoods as OOD?\n\nIt would seem that using L(x) might already distinguish some OOD samples from Figure 4? What are the AUC of OOD detection if we had simply used these? \n\nFrom Figure 4, the x axis is p(x|M) and is between zero and one, while L(x) should be -log p(x|M_0). Why would we expect to observe a highly linear correlation between the two (as opposed to linear with p(x|M) and exp(L(x)))? Visually it seems that a lot of the datasets have similar distributions in both cases -- wonder why the proposed S statistic improves OOD empirically? Does this still hold for continuous likelihood models like Glow?\n\nThe performance seems to depend on the \"prior\" chosen (e.g. FLIF seems to have much better performance than PNG); any insights why this is the case?\n\nTable 1: I suppose a reasonable comparison for AUROC is max(current, 1 - current)? If AUROC is very small, we can still obtain good classifiers with flipped predictions.\n\nIt seems strange that the black-and-white images and colored images are compared together (say I train on MNIST and test CIFAR10); it should be quite easy to detect even with existing approaches. I suppose it would be most interesting to see cases where existing approaches fail miserably (like CIFAR10 vs. CIFAR100/TinyImageNet); unfortunately the proposed methods does not seem to improve much for PixelCNN++.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "HygYvt0RFr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper analyzes the peculiar case that deep generative models often assign a higher likelihood to other datasets than they were trained on. The running hypothesis here is, that input complexity plays a central role. Measuring a proxy for input complexity shows that it is tightly anticorrelated with likelihood and therefore seems to describe the trend well. A new OOD detection score is introduced based on these insights.\n\nThe failure of Cifar-10 generative models to detect SVHN as OOD via thresholded likelihood is an interesting question. I also think that the conclusion of this work, that this behavior may be natural and a consequence of likelihood itself, seems very sensible.\n\nThe overall message of the paper is very important and might help to avoid researchers wasting time on improving likelihood models for OOD detection. Instead, it seems a more sensible way to deal with this problem is to consider likelihood ratios.\n\nOne concern is that a formal discussion if the likelihood is supposed to behave the way the authors describe, or if a better model might solve this eventually. I think it is already mentioned that empirically there is no reason to believe a better model would solve this, it would just be nice to have a theoretical statement here as well.\n\nAnother concern is that even though the empirical results look quite promising, it would be good to stress-test the proposed score on more common OOD detection benchmarks against state-of-the-art methods to see if likelihood generative models with the proposed criterion are competitive there.\n\nAll in all, I think this is a great paper, additional theoretical analysis and stronger empirical results would be helpful to increase the significance of the work.\n\n--------------\nPost Rebuttal\n--------------\n\nI would like to thank the authors for their interesting response. \nHowever, I will not change my score as the response did not change my opinion on the need for a more theoretical treatment of the statement, which is a serious (and potentially hard to resolve) shortcoming of the paper in my opinion.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: I have read the paper and the reviews carefully. Despite the numerical scores, I think this paper is above the bar for ICLR, and recommend acceptance.

This paper addresses the now-well-known problem that generative models often assign higher likelihoods to out-of-distribution examples, rendering likelihoods useless for OOD detection. They diagnose this as resulting from differences in compressibility of the input, and propose to compensate for this by comparing the log-likelihood to the description length from a strong image compressor. They show this performs well against a variety of OOD detection methods.

The idea is a natural one, and certainly should have been one of the first things tried in addressing this phenomenon. I'm a little surprised it hasn't been done before, but none of the reviewers or I are aware of a prior reference, so AFAIK it's novel. One reviewer believes the contribution is small; while it's simple, I think the field will benefit from a careful implementation and testing of this approach.

Multiple reviewers raise the concern of whether generative models' bias towards low-complexity inputs is just a matter of needing better generative models. I don't think so: even arbitrarily good generative models will still be limited by the inherent compressibility of an input (e.g. as measured by Kolmogorov complexity).

I'm also not concerned about the lack of an explicit threshold; if one has proposed a good score function, there are many ways one could choose a threshold, depending on the task.

Decision: Accept (Poster)