Multiscale Score Matching for Out-of-Distribution Detection
Authors: Ahsan Mahmood
Junier Oliva
Martin Andreas Styner
Venue: ICLR 2021 Poster (2021)
Keywords: out-of-distribution detection
score matching
deep learning
outlier detection

Abstract: We present a new methodology for detecting out-of-distribution (OOD) images by utilizing norms of the score estimates at multiple noise scales. A score is defined to be the gradient of the log density with respect to the input data. Our methodology is completely unsupervised and follows a straight forward training scheme. First, we train a deep network to estimate scores for $L$ levels of noise. Once trained, we calculate the noisy score estimates for $N$ in-distribution samples and take the L2-norms across the input dimensions (resulting in an $N$x$L$ matrix). Then we train an auxiliary model (such as a Gaussian Mixture Model) to learn the in-distribution spatial regions in this $L$-dimensional space. This auxiliary model can now be used to identify points that reside outside the learned space. Despite its simplicity, our experiments show that this methodology significantly outperforms the state-of-the-art in detecting out-of-distribution images. For example, our method can effectively separate CIFAR-10 (inlier) and SVHN (OOD) images, a setting which has been previously shown to be difficult for deep likelihood models.

Published as a conference paper at ICLR 2021
MULTISCALE SCORE MATCHING DISTRIBUTION DETECTION
FOR OUT-OF-
Ahsan Mahmood, Junier Oliva, Martin Styner Department of Computer Science University of North Carolina Chapel Hill {amahmood, joliva, styner]@cs catneerressuunceeee.. www. edu
ABSTRACT
We present new methodology for detecting out-of-distribution (OOD) images by utilizing norms of the score estimates at multiple noise scales. A score is defined to the gradient the log density with respect to the input data. Our methodology is completely unsupervised and follows straight forward training scheme. First, we train a deep network to estimate scores for L levels of noise. Once trained, we calculate the noisy score estimates for N in-distribution samples and take the L2- norms across the input dimensions (resulting in an NxL matrix). Then we train an auxiliary model (such as a Gaussian Mixture Model) learn the in-distribution spatial regions in this L-dimensional space. This auxiliary model can now be used to identify points that reside outside the learned space, Despite its simplicity. our experiments show that this methodology significantly outperforms the state- of-the-art detecting outttf-distribution images. For example, our method can effectively separate CIFAR-10 10 (inlier) and SVHN (OOD) images, setting which has been previously shown be difficult for deep likelihood models. We make our code and results publicly available on Github
INTRODUCTION
Modern neural networks do not tend to generalize well to out-of-distribution samples. This phe- nomenon has been observed in both classifier networks (Hendrycks & Gimpel (2017 Nguyen al. (2055) Szegedy et al. (2013) and deep likelihood models (Nalisnick et al. (2018); Hendrycks et al. 20188; Ren et al. (2019) 9)). This certainly has implications for Al safety (Amodei et al. (2016)), as models need be aware of uncertainty when presented with unseen examples. Moreover, an out-of- distribution detector can be applied as an anomaly detector. Ultimately, our research is motivated by the need for sensitive outlier detector that be used in medical setting. Particularly, to identify atypical morphometry in early brain development. This requires a method that is gener- alizable highly variable, high resolution, unlabeled real-world data while being sensitive enough to detect an unspecified, heterogeneous set of atypicalities. To that end, we propose multiscale score matching effectively detect out-of-distribution samples.
want
Hyvärinen (2055) introduced score matching as a method to learn the parameters of a non- normalized probability density model, where score is defined as the gradient of the log density with respect to the data. Conceptually, score is a vector field that points in the direction where the log density grows the most. The authors mention the possibility of matching scores via non- parametric model but circumvent this by using gradients of the score estimate itself. However, Vincent (201T) later showed that the objective function of denoising autoencoder (DAF) is equiv- alent to matching the score of a non- non-parametric Parzen density estimator of the data. Thus, DAEs provide a methodology for learning score estimates via the objective:
E E (1))
[|] (ō) V log do (T|z)]
2
Here 36 (x( is the score network being trained to estimate the true score V. log Panaa (x). and ao (z) f (am It should be noted that the score of the estimator only matches
https://githube www..///.w....a/aaa...ome

---

Published as a conference paper at ICLR 2021
the true score when the noise perturbation is minimal ie (z) (zna(z). Recently, Song & Ermon (2019) employed multiple noise levels to develop a deep generative model based on score matching, called Noise Conditioned Score Network (NCSN). Let {o, be positive geometric sequence that satisfies T =
dz-1 > 1. NCSN is a conditional network, so(x, o), trained to jointly estimate scores for various levels of noise o such that Vo E Yor so(2 or) = Va log 9o (xx). In practice, the network is explicitly provided a one-hot vector denoting the noise level used to per- turb the data. The network is then trained via denoising score matching loss. They choose their noise distribution to be (i o² I); therefore V log 90 (i/x)- = -( xx/0)/ Thus the objective function is:
L
|1 0.)
1 - x
(oss
2 Razue (a))))an(())
(2)
L ==1
Song & Ermon (2019) set X(o.)) = o² after empirically observing that [100(22 0)l2 x 1. We similarly scaled score norms for all our experiments. Our work directly utilizes the training objective proposed by 'Snng& & Ermon (2019) i.e. we use an NCSN as our score estimator. However, we use the score outputs for out-of-distribution (OOD) detection rather than for generative modeling. We demonstrate how the space of multiscale score estimates can separate in-distribution samples from outliers, outperforming of methods. We also apply our method on real-world medical imaging data of brain MRI scans.
MULTISCALE SCORE ANALYSIS
Consider taking the L2-norm of the score function: ||s(z)]] = || x log p(x)]]
V= p(a) p(a)
Since the data density term appears in the denominator, a high likelihood will correspond to a low norm. Since ofittr-distributiin samples should have low likelihood with respect to the in- distribution log density (i.e. p(x) is small), we can expect them to have high score norms. However, if these outlier points reside in "flat" regions with very small gradients (e.g. in a small local mode), then their score norms can be low despite the point belonging to a low density region. This is our first indicator informing us that a true score norm may not be sufficient for detecting outliers. We empirically validate our intuition by considering score estimates for a relatively simple toy dataset: MNShionMNIST.. Following the denoising score matching objective (Equation 2 we obtain mul- tiple estimates of the true score by using different noise distributions go (ő]z). (z). Like Song & Ermon (2019), we choose the noise distributions to be zero-centered Gaussian scaled according o,, Re- call that the scores for samples perturbed by the lowest a noise should be closest to the true score.
Our analyses show that this alone was inadequate at separating inliers from OOD samples.
Distribution Dew Score Norms
UMAP Embeddings
FM-Train
12
0.20
MNIST
FM-Te-
10
CIPAR11
FashionMiSST
005
MNNTT
0.0
OIARR
Norms
12
(a) ID score estimates from model trained FashionMNIST (FM)
(b) UMAP visualization of 10-dimensional score estimates from a model trained on MNSSI
Figure 1: Visualizing the need for a multiscale analysis. In (a), we plot the scores corresponding to the lowest sigma estimate. (b), we plot the UMAP embedding the 10 dimensional vectors of score norms. Here we see a better separation between NaST and MNIST when using estimates from multiple scales rather than the one that corresponds to the true score only.
We trained a score network (p oL) on FashionMNIST and used it to estimate scores of Fash- ionMNIST (x ~ DFM) MNIST (x ~ Dar) and CIFAR-10 (z Dc) test sets. Figure Ia shows the distribution of the score norms corresponding to the lowest noise level used. Note that CIFAR- 10 samples are appropriately given high score by the model. However, the model is unable to
2

---

Published as a conference paper at ICLR 2021
distinguish FashionMNIIST from MNIST, giving MNIST roughly the same scores as in in-distribution samples. Though far from ideal, this result is still a considerable improvement on existing likeli- hood methods, which have been shown to assign higher likelihoods to OOD samples (Nalisnick) et al. (2018)) Our next line of inquiry was to utilize multiple noise levels. That is instead of simply considering SPM (I, LL), analyze the T-ddimeniional space ( 01 IIl ,.... || +I)ll] for I (DPM, DM, Dc). Our observations showed that datasets did tend to be separable in the L- dimensional space of score norms, Figure Ib visualizes the UMAP embeddings of scores calculated via a network trained to estimate L 10 scales of as, with the lowest a being the same as one in Figure la
2.1
SCALES AND NEIGHBORHOODS
Original Density
Perturbed Densities
Zoomee
Irieet
0
0
6319
Low-Strsity Dubler
0373
300/3
00.10.0
Mode
Probobilty Devoty
0:25
2:20
0.00
200.00
0.75
300/5
6479
0435
20079
0.00
20030
Figure 2: A toy GMM to visualize our analysis. We annotate the three regions of interest we will be exploring. Further, we show the Gaussian perturbed versions of the original distribution with (L)ow, (M)edium, and (H)igh noise levels, along with plot zoomed into the local-mode outliers. Note the effect of different scales on this region: only the largest scale results in a gradient in the direction of the inliers.
2D Score Norms
00-30.00
0.00
0.5
3.50
6.5
0.20
625
63 LIT -00000
02-0.10
Figure 3: In (a) observe that Low-Density outliers have comparatively high gradient norms for both a and as However at this scale, Local-Mode points still have very small norms, causing them to be tightly packed around the in-distribution points. In (b) we see that Local-Mode outliers achieve a gradient signal only when sufficiently high scale is used, oH 20.
To our knowledge multiscale score analysis has not been explored in the context of OOD detection. In this section, we present an analysis in order to give an intuition for why multiple scales can be beneficial. Consider the toy distribution shown in Figure 2 We have three regions of interest: an inlier region with high density centered around = 10, an outlier region with low density around
x = 30, and a second outlier region with a local mode centered around x 50. Recall that adding Gaussian noise to a distribution is equivalent to convolving it with the Gaussian distribution. This not only allows us to visualize perturbations of our toy distribution, but also analytically compute the score estimates given any o, Initially with no perturbation, both point in the low-density region and one very close to (or at) the local-mode will have small gradients. As we perturb the samples smooth the original density, causing it to widen. The relative change in density at each point is dependent on neighboring modes. A large scale perturbation will proportionally take a larger neighborhood into account at each point of the convolution. Therefore, sufficiently large scale,
3

---

Published as a conference paper at ICLR 2021
nearby outlier points gain context from in in-distribution modes. This results in increased gradient signal in the direction of inliers.
Figure plots the score norms of samples generated from the original density along with markers indicating our key regions. Note how even a small scale perturbation (a = 0.1) is enough to bias the density of the Low-Density outliers towards the nearby in-distribution mode. A medium scale M = 10) Gaussian perturbation is still not wide enough to reach the inlier region from the Local- Mode outlier densities, causing them simply smooth away into flat nothingness. It is only after we perform a large scale (0 20) perturbation that the in-distribution mode gets taken into account, resulting in higher gradient norm. This analysis allows us to intuit that larger noise levels account for a larger neighborhood context. We surmise that given sufficiently large scale, we can capture gradient signals from distant outliers.
It is imperative to note that one large scale is not guaranteed to work for all outliers. Consider outliers close to inlier modes such as the samples between Low-Density outliers and Inliers in Figure 2 0h results in an overlap in the score distribution of inliers and Low-Density outliers. This makes it difficult to differentiate the aforementioned "in-between" outliers from the in-distribution samples. However, this large scale was necessary to get big enough neighborhood context in order to capture the more distant Local-Mode outliers. Therefore, we postulate that a range of scales is necessary for separating outliers. Admittedly, selecting this range according to the dataset is not a trivial problem. In a very recent work, Song & Ermon (2020) outlined some techniques for selecting { for NCSNs from the perspective of generative modelling. Perhaps there is similar analog to OOD detection. We leave such analyses for future work and use the default range for NCSN in all our experiments. However, we observed that our defaults are surprisingly generalizable, evident by the fact that all our experiments in Section 5 were performed with the same scale range. In Section 5.5] we further analyze how varying the scale range effects downstream accuracy and observe that our defaults already provide near optimal performance.
2.2 PROPOSED TRAINING SCHEME
In this work, we propound the inclusion of all noisy score estimates for the task of separating in- and out-of-distribution points, allowing for Multiscale Score Matching Analysis (MSMA). Concretely, given L noise levels, we calculate the L2-norms of per-sample scores for each level, resulting in an L-dimensional vector for each input sample. Motivated by our observations, we posit that in- distribution data points occupy distinct and dense regions the L-dimensional score space. The cluster assumption states that decision boundaries should not pass high density regions, but instead lie in low density regions. This implies that any auxiliary method trained to learn in-distribution regions should be able to identify OOD) data points that reside outside the learned space. Thus, we propose a two step unsupervised training scheme. First, we train a NCSN model sIN(x, a.) estimate scores for inlier samples, given {ar) levels of noise. Once trained, we calculate all L noisy score estimates for the N training samples and take the L2-norms across the input dimensions: [|| ....l?.....Ils auxiliary model (such as Gaussian Mixture Model) on this matrix to learn the spatial regions of in-distribution samples in the I-dimensional space.
o1)) This results in an NxL matrix. We now train an
3 LEARNING CONCENTRATION IN THE SCORE SPACE
We posit that learning the "density" of the inlier data in the L-dimensional score (norm) space sufficient for detecting out-of-distribution samples. The term "density" can be interpreted in a myriad of ways. We primarily focus on models that fall under three related but distinct notions of denseness: spatial clustering, probability density, and nearest (inlier) neighbor graphs. All three allow us to threshold the associated metric to best separate OOD samples.
Spatial clustering is conceptually the closest to our canonical understanding of denseness: points are tightly packed under some metric (usually Euclidean distance), Ideally OOD data should not occupy the same cluster as the inliers. We train Gaussian Mixture Models (GMMs) to learn clusters in the inlier data. GMMs work under the assumption that the data is composed of k- k-components whose shapes can be described by a (multivariate) Gaussian distribution. Thus for a given datum, we can calculate the joint probability of belonging to any of the k-components.
4

---

Published as a conference paper at ICLR 2021
Probability density estimation techniques aim learn the underlying probability density function Pdota(z) which describes the population. Normalizing flows are a family of flexible methods that can learn tractable density functions (Papamakarios et al. (2019)). They transform complex distri- butions into a simpler one (such as a Gaussian) through a series of invertible, differential mappings. The simpler base distribution then be used to infer the density of given sample. We Masked Autoregressive Flows introduced by Papamakarios et al. (2017), which allows us to use neural net- works as the transformation functions. Once trained, we can use the likelihood of the inliers to determine a threshold after which samples will be considered outliers.
Finally, we consider building k-nearest neighbor (k-NN) graphs to allow for yet another threshold- ing metric. Conceptually, the idea is to sort all samples according to distances to their k-closest (inlier) neighbor. Presumably, samples from the same distribution as the inliers will have very short distances to training data points. Despite its simplicity, this method works surprisingly well. Practi- cally, k-NN distances can be computed quickly compute by using efficient data structures (such as KD Trees).
RELATED WORK
Hendrycks & Gimpel (017)) should be commended for creating an OOD baseline and establishing an experimental test-bed which has served as a template for all OOD work since. Their purported method was thresholding of softmax probabilities of a well-trained classifier. Their results have since been beaten by more recent work. Liang et al. (2017) propose ODIN as a post-hoc method that utilizes pretrained network to reliably separate OOD samples from the inlier distribution. They achieve this via i) perturbing the input image in the gradient direction of the highest (inlier) softmax probability and ii) scaling the temperature of the softmax outputs of the network for the best OOD separation. They follow the setting from Hendrycks & Gimpel (017)) and show very promising results for the time. However, ODIN heavily depends careful tuming of its hyperparameters
De Vries & Taylor (2018) train their networks to predict confidence estimates in addition to softmax probabilities, which can then be used to threshold outliers. They show significant improvements over Hendrycks & Gimpel (017) and some improvements over ODIN. Another concurrent work by Lee et al. (2018) jointly trained GAN alongside the classifier network to generate 'realistic' OOD examples, requiring an additional OOD set during training time. The final trained network is also unable to generalize other unseen datasets. It is important note that our method trained completely unsupervised while the baselines are not, potentially giving them additional information about the idiosyncrasies of the inlier distribution.
Ren et al. (2019) proposed to jointly train deep likelihood models alongside a "background" likeli- hood model that learns the population level background statistics, taking the ratio of the two result- ing likelihoods to produce "contrastive score". They saw very good results for grayscale images (FashionMnist vs MNIST) and saw a considerable improvement in separating CIFAR and SVHN compared to Nalisnick et al.] (2018). Some prior work has indeed used gradients of the log likeli- hoods for OOD but they do not frame it in the context of score matching. Grathwohl et al. (2020) posits that a discriminative model can be reinterpreted as joint energy (negative loglikelihood) based model (JEM). One of their evaluation experiments used the energy norms (which they dub 'Approximate Mass JEM') for OOD detection. Even though they saw improvements over only ing log- liglliiklisoods their reported AUCs did not beat ODIN or other competitors. Peculiarly, they also observed that for tractable likelihood models, scores were anti-correlated with the model's 's like- lihood and that neither were reliable for OOD detection, Zhai et al. (2016) also used energy (negative log probability) gradient norms, but their experiments were limited intra-dataset anomalies. To our knowledge, no prior work has explicitly used score matching for OOD detection.
5 EXPERIMENTS
In this section we demonstrate MSMA's potential as an effective OOD detector. We first train a NCSN model as score estimator, and then an auxiliary model the score estimates of the training set. Following Liang et al. (2017) and DeVries & Taylor (2018), we use CIFAR-10 and SVHN our "inlier" datasets alongside collection of natural images "outlier" datasets. We
5

---

Published as a conference paper at ICLR 2021
retrieve the natural image from ODIN's publicly available GitHub repo This helps maintain fair comparison (e.g. it ensures we test on the same random crops as ODIN). We will denote Liang et al. (2117) ODIN and Veies & Taylor (2018) as Confidence in our tables. We also distinguish between CIFAR and SVHN and compare our results to the state-of-the-art. Additionally, we report results for FaSHionMNIST vs MNIST in Section[A.6
5.1 DATASETS AND EVALUATION METRICS
We consider CIFAR-I0 Krizhevsky et al. (2009) and SVHN Netzer et al. (2011)) as our inlier (2017): TinyIma-
datasets. For out-of-distribution datasets, we choose the same as Liang geNe LSUN (Yu et al. (015)), iSUN (Xu et al. (2015). Similar to Vriesss & Taylor (2018). in our main experiments we report only resized versions of LSUN and TinylmageNer. We also leave out the synthetic Uniform and Gaussian noise samples from our main experiments
performed extremely well in all of those experiments. We refer the reader to A.4 for the full report including all datasets. Lastly following Veies & Taylor (2018), consider All Images: combination of all non-symthetic OOD datasets outlined above (including cropped versions). Note that this col- lection effectively requires single threshold for all datasets, thus arguably reflecting real world distiii-ittiittionnn setting. To measure thresholding performance we use the metries established by previous baselines (Hendrycks & Gimpel (2017). Liang et al. (2017)) FPR at 95% TPR is the False Positive Rate (FPR) when the True Positive Rate (TPR) is 95%. Detection Error is the min- imum possible misclassification probability over all thresholds. AUROC Area Under the ROC Curve. AUPR is Area Under the Precision Recall Curve. More details are given in A.3
5.2 COMPARISON AGAINST PREVIOUS OOD METHODS
We compare our work against Confidence Thresholding (DeVries & Taylor (018)) and ODIN (Liang et al. (2017). For all experiments we report the results for the in-distribution tesisel vs datasets. Note that All Images is a version of All Images where both ODIN and Confidence Thresholding perform input preprocessing. Particularly, they perturb the samples in the direction the softmax gradient of the classifier: I = x - ggnn--alogS,,(rrr then perform a grid search over ranges, selecting the value that achieves best separation 1000 samples randomly held for each out-of-distribution set. ODIN performs an additional search over T' ranges, while Confidence Thresholding uses a default of T 1000. We do not perform any such input modification. Note that ODIN uses input thresholding for individual OOD datsets as well, while Confidence Thresholding does not. Finally, for the sake of brevity we only report FPR (95% % TPR) and AUROC. All other metric comparisons are available in the appendix A.4)
the
They
Dataset
OOD
GMM
Flow
KD Tree
ODIN
Confidence
Dataset
MSMA
MSMA
MSMA
Tiny ImageNet
0.0/ 100.0
0.0 100.0
0.0/100.0
1.8 99.6
L.UUN
0.0 / 100.0
0.0 100.0
0.0 100.0
0.8 / 99.8
SVHN
iSUN
0.0/ 100.0
0.0 100.0
0.0 100.0
1.0/ 99.8
All Images
0.0/ 100.0
0.0 100.0
0.0 100.0
99,2
All Images*
/9.2
4.1 49.2
Tiny ImageNet
0.0 / 100.0
0.0 100.0
0.39
9.5
18.4/97.0
LSUN
0.0/ 100.0
0.0 100.0
0.6
99.2
16.4/97.5
CIFAR- 10
iSUN
0.0 100.0
0.0 100.0
9949
/8.8
16.3 / 97.5
All Images
0.0 / 100.0
0.0 100.0
99.9
19.2 /9.2 97.1 11.2 98.0
All Images*
7.8/98.4
Table 1: Comparing our auxiliary methods against existing state-of-the-art.
FPR (95% TPR)
(Lower is better)/ AUROC (Higher is better). MSMA methods unequivocally outperform previ- ous work in all tests, with KD Trees only slightly worse than GMM and Flow variants.

---

Published as a conference paper at ICLR 2021
5.3 SEPARATING 10 FROM SVHN
Since this setting (CIFAR-10 as in-distribution and SVHN as out-of-disttibution) is not considered in the testbed used by ODIN or Confidence Thresholding, consider these results separately and evaluate them in the context of likelihood methods. This experiment has recently gained attention following Nalisnick et al. (2018) showing how deep generative models are particularly inept at separating high dimensional complex datasets such as these two. We describe our results for each auxiliary model T Here we note that all three methods definitively outperform the previous state of the art (see Table 3) with KD-Trees preforming the best. Likelihood Ratios Ren et al.] (2019) JEM (Grathwohl al. p are two unsupervised methods that have tackled this problem and have reported current oate-of-the-art results. Table 3 summarizes the results that were reported by these papers. Both report AUROCs, with Ren et al. 2019) additionally reporting AUPR((n)) and FPR at 80% TPR. Since each method proposes different detection function, also provide them for reference.
Auxiliary Method
FPR (95% TPR)
Detection Error
AUROC
AUPR
AUPR Out
In
f
GMM
11.4
8.1
95.5
91.9
96.9
Flow
8.6
6.8
96.7
93.4
97.7
KD Tree
4.1
4.5
99.1
99.1
99.2
Table 2: Comparison of auxiliary models tasked to separate CIFAR-10 (inlier) and SVHN (out-of- distribution). & indicates lower values are better and f indicates higher values are better.
Detection
Model
FPR AUROC
AUPR
AUPR
Function
(80% TPR)
In
Out
1
(ar, or.
KD Tree MSMA
0.7
99.1
99.1
99.2
log (u(())
Likelihood Ratios
6.6
93.0
88.1
pa, (ir)
log p
JEM
67.0
Blog p(x)
Approx. Mass JEM
83.0
Table 3: Comparison with a multitude of likelihood- blase models at separating CIFAR-10 (in- distribution) from SVHN (out-of-distribution)). work. All values are shown percentages. J. indicates lower values are better and indicates higher values are better. Note that since Likelihood Ratios report FPR 80 % TPR, we report the same.
represent metrics that were not reported by the
5.4 AGE BASED OOD FROM BRAIN MRI SCANS
0OD Age (Years)
FPR (95% TPR)
Detection Error
AUROC
AUPR
AUPR Out
J
Baseline( Hendrycks Gimpel
(217 MSMA
1
0.0
0.0
100,0 79.99 99.9
100,0 / 99.9
100,0 / 19.99
2
41.9 / 0.6
20.1 1.0
64.8 / 99.7
70.3 / 99.5
77.6 / 99.9
4
45.0 / 23.7
15.8 9.2
80.0 96.1
81.1 / 93.8
84.8 97.9
6
44.9 30.5
18.7
81.5 / 95.0
80.7 / 19.22
86.6 / 96.8
Table 4: MSMA-GMM trained on multiscale score estimates tasked to separate the brain scans of different age groups In-distribution samples are 9-11 years of age. All values are shown in percentages. I indicates lower values are better and t indicates higher values are better. Keep in mind that the baseline was trained to classify year olds.
In this section we report our method's performance on a real world dataset. Here the task to detect brain Magnetic Resonance Images (MRIs) from pediatric subjects age (1 years) that is younger than the inlier data (9 11 years of age). We expect visible differences in image contrast and local brain morphometry between the brains of toddler and adolescent. As

---

Published as a conference paper at ICLR 2021
year
year
year
year (Inlier)
Figure 4:
Note the change in image contrast, brain size and brain matter structure as the child grows. Each age is increasingly difficult distinguish from our inliers.
child grows, their brain matures and the corresponding scans appear more like the prototypical adult brain. This provides an interesting gradation of samples being considered out-of-distribution with respect age. We employ 3500 high resolution T1 "weehigt MR images obtained through the NIH large scale ABCD study (Casey et al. (2018)), which represent data from the general adolescent population (9-11 years of age). This implies that our in-distribution dataset will have high variation. After standard preprocessing, we extracted for each dataset three mid-axial slices and resized them to be 90x 10 pixels, resulting in ~11k axial images (10k training, testing). For our outlier data, employ MRI datasets of children aged 1, 2, 4 and years (500 each) from the UNC EBDS database Stephens et al. (2020); Gilmore et al. (2020) Our methodology was effectively able to dittof-distribution. Table reports the results for GMMs trained for this task. As expected, the separation performance decreases as age increases. Note that we kept the same hyperparameters for our auxiliary methods as the previous experiments despite this being higher resolution scenario. We also note that our Flow model and KD Tree perform equally as well and refer the reader to A.5 Following Liang et al. (2017) Deeies & Taylor (2018), we compare our results to the baseline methodology proposed by Hendryeks & Gimpel (2017). We trained standard ResNet-50 (He et al. (2016)) classify between inliers and year olds and tested its performance on unseen outliers. We observed that MSMA generally outperforms the baseline. Note that the baseline classifier is biased towards the ouitt--distiiuutinn detection task since it was trained to separate year olds, wheres MSMA is trained completely unsupervised. Lastly, in Section A.7 we also report results of f-AnoGAN Schlegl et al. (2019) applied on this out-of-distribution task.
identify younger age groups
5.5 HYPERPARAMETER ANALYSIS
Varying
Varying
100
AUC-ROC
AUC-ROC
80
60
Flow
Varying T. from to 20
(b) Varying on from 0.5 10
Figure 5: Analysis of the effect of hyperparameters and I. on MSMA's aut-of-distribution detec- tion performance. We observe that the defaults a = 1.0 and I, 10 perform the best, with a slight variance in performance when we deviate from them.
We performed experiments to analyze how sensitive MSMA is to two main hyperparameters utilized in NCSN; the number of noise levels (L) and the largest scale used (α We opted out of varying the smallest noise scale and kept it the same across experiments (a = 0.01). Our rationale is that noise perturbations to images at such small scale imperceptible to the human eye and are adequate to give an estimate the true score. For all experiments, we train on CIFAR-10 and
evaluate the All Images dataset described in Section 5.1 and plot AUROC in Figure 5 In order
8

---

Published as a conference paper at ICLR 2021
to reduce GPU memory usage and computation time, we had to reduce the batch size from 128 to 64, which is why we see a performance dip from the main experiment in Section 5.2 same hyperparameters for our auxiliary models in the main experiment.
We keep the
For the number of scales L, we test the values 1, 3. 10, 15, and 20, with 0H fixed at the default value (0H 1) Recall that we follow the original NCSN schema by (Song & Ermon 2019), and utilizes a geometric sequence of sigma scales from Ø to o with L steps (endpoint inclusive). Thus, changing L changes the intermediate noise scales. Our results in Figure 5a show that MSMA is optimal near the default (L- 10). Increasing L does not significantly vary the performance, while small values such as L = 3 are not be adequate at providing enough intermediate scales. Note that L = 1 is the degenerate case where only the largest noise scale is used. This highlights the need for a range of scales as argued in Section 2.1 and empirically shows that simply using one large scale is not enough. Figure 5b plots the affect of varying the largest noise scale H.. We test the values 0.5, 1.0, 2.0 and 10, with the default number of scales I, = 10. Again, we observe that our default 0H =1 1 performs the best and we do not notice any improvement form varying it. Considering how images are rescaled to [0.1] before they are passed to the network, we posit that 0F = 1.0 already introduces large noise and increasing it further seems to degrade results varying degrees.
Lastly, we would like to emphasize that all our main distri--dtiiittionnn experiments in Section were performed with the same default hyperparameters, without any tuning. Despite this disadvan- tage, MSMA still outperforms its competitors ODIN (Liang et al. (207)), Confidence Thresholding (DeVries & Taylor (2018)), and Likelihood Ratios (Ren et al. (2019). ) all of which need some fine-tuning of hyperparameters. Recognize that tuning requires apriori knowledge of the type of out-of-distribution samples the user expects. From the analysis in this section and our main exper- iment, we can confidently advocate the use of our defaults as they seem to generalize well across datasets and do not require such apriori knowledge. Admittedly, if the form of anomalies are known at training time then it would indeed be possible to tune MSMA's hyperparameters to fit particular need. However, we leave such an analysis for future work as it starts to encroach the domain of anomaly detection whereas the work presented in this paper is mainly concerned with introducing MSMA as a performant, casy to implement, and generalizable out-of-distribttion detector.
DISCUSSION AND CONCLUSION
We introduced a methodology based on multiscale score matching and showed that it outperformed state-of-the-art methods, with minimal hyperparameter tuning. Our methodology is easy to im- plement, completely unsupervised and generalizable to many OOD tasks. Even though we only reported two metrics in the main comparison, we emphasize that we outperform previous state-of- the-art in every metric for all benchmark experiments. Next, it is noteworthy that in our real-world experiment, the brain MR images are unlabeled. Since our model is trained completely unsuper- vised, we have to make very few inductive biases pertaining to the data.
Note that plan apply our method to high resolution 3D MRIs, which can reach upto 256x256x256. Consider how likelihood methods such as Glow Kingma & Dhariwal (2018) al- ready struggle identify out-of-distribbttonn samples for lower resolution 21) images Nalisnicc let al. (018)). It is unclear whether they would preform adequately at this task when they are scaled up to the dimensionality of 3D MRIs. Furthermore, there is evidence that deep likelihood models are difficult to train in such high resolution regimes (Papamakarios) (2019)), especially given low sample sizes. Our model's 's objective function is based on denoising (autoencoding), and can be easily extended to any network architecture. For example, our preliminary results show that MSMA was able to achieve similar performance to Section [5.4 when applied their full 3D MRI counter- parts by utilizing a publicly available 3D U-Net (Zhou et al. (2019)). We plan to explore these high resolution scenarios as our next future direction.
Our excellent results highlight the possibility of using MSMA as fast, general purpose anomaly detector which could be used for tasks ranging from detection of medical pathologies to data cleans- ing and fault detection. From an application perspective, we plan to apply this methodology to the task of detecting images of atypically maturing children from a database of typical inliers. Lastly, our observations have uncovered peculiar phenomenon exhibited by multiscale score estimates, warranting a closer look to understand the theoretical underpinnings of the relationship between low density points and their gradient estimates.

---

Published as a conference paper at ICLR 2021
ACKNOWLEDGMENTS
We would like to thank the UNC Early Brain Development Study (PI John Gilmore) and the Adoles- cent Brain Cognitive Development (ABCD) Study (https://bbcdstudy.orgg held in the NIMH Data Archive (NDA). The ABCD data repository grows and changes over time. The ABCD data used in this report came from DOI 10. 10.15154/1505209 (v2.1). Other funding was provided through NIH grants HID053000, MH070890, MH1 1944, HD079124, EBO21391, and MH1 15046.
REFERENCES
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Con- crete problems in ai safety. arXiv preprint 1606.06660 2016.
BJ Casey, Tariq Cannonier, May Conley, Alexandra O Cohen, Deanna M Barch, Mary M Heitzeg, Mary E Soules, Theresa Teslovich, Danielle V Dellarco, Hugh Garavan, et al. The adolescent brain cognitive development (abed) study: imaging acquisition across 21 sites. Developmental cognitive neuroscience, 32:43 54, 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255, Icee, 2009.
Terrance DeVsies and Graham W. Taylor. Learning confidence for out-of -iittf-distribution detection in neural networks, 2018
John H Gilmore, Benjamin Langworthy, Jessica B Girault, Jason Fine, Shaili C Jha, Sun Hyung Kim, Emil Cornea, and Martin Styner. Individual Variation of Human Cortical Structure Is Established in the First Year of Life. Biological psychiatry. Cognitive neuroscience and neuroimaging, June 2020.
Will Grathwohl, Kuan-Chich Wang, Jorn-Henrik Jacobsen, D. Duvenaud, Mohammad Norouzi, and Kevin Swersky. Your classifier is secretly energy based model and you should treat it like one. ArXiv, abs/1912.032633, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and patter recognition, pp- 770-778, 2016.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and examples in neural networks. In 5th International Conference on Learning Representations, ICLR 2017 Conference Track Proceedings. International Conference on Learning Representations, ICI.R, oct 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 1812 04606, 2018.
Aapo Hyvärinen. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6(Apr):695-709, 2005.
Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible Ixl convolutions. In Advances in neural information processing systems, pp. 10215-10224, 2018.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence--cllibraeed classifiers for detecting out-of-distributtio samples. In 6th International Conference on Learning Repre- sentations, ICLR 2018 Conference Track Proceedings. International Conference on Learning Representations, ICLR, 2018.
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing The Reliability of fut-of-distrrbution Image Detection in Neural Networks. 6th International Conference on Learning Representattonss, ICLR 2018 Conference Track Proceedings, jun 2017. URL http: axxiv. abwpg/////////.////////// 02.690
10

---

Published as a conference paper at ICLR 2021
Antonio Matosevic, Eliisabet Hein, and Francesco Nuzzo. Reproducibility generrtteeee modeling by estimating gradients of the data distribution. 2019.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know?, 2018.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confi- dence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 427-434-666 2015.
George Papamakarios. Neural density estimation and likelihood-free inference. arXiv preprint arXiv:1910.13233, 2019.
George Papamakarios, Theo Pavlakou, and lain Murray. Masked autoregressive flow for density estimation. Advances in Neural Information Processing Systems, pp. 2338-2347, 2017.
George Papamakarios, Eric Nalisnick, Danilo Jimenez Rezende, Shakir Mohamed, and Balaji Lak- shminarayanan. Normalizing flows for probabilistic modeling and inference. arXiv preprint arXiv:19/2.02272. 2019.
J. Ren, Peter J. Liu, E. Fertig, Jasper Snoek, Ryan Poplin, Mark A. DePristo, Joshua V. Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. In NeurIPS, 2019.
Thomas Schlegl, Philipp Seehöck, Sehastian M Waldstein, Georg Langs, and Ursula Schmidt- Erfurth. f-anogan: Fast unsupervised anomaly detection with generative adversarial networks. Medical image analysis, 54:30-44, 2019.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In Advances in Neural Information Processing Systems, pp. 11918-11930, 2019.
Yang Song and Stefano Ermon. Improved techniques for training score-based generative models. arXiv preprint arXiv:2006.0900 09011,, 2020.
Rebecca L Stephens, Benjamin W Langworthy, Sarah J Short, Jessica B Girault, Martin Styner, and John Gilmore. White Matter Development from Birth to 6 Years of Age: A Longitudinal Study. Cerebral cortex (New York, N.Y. 1991). 7:7456, June 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6 2013.
Pascal Vincent. A connection between score matching and denoising autoencoders. Neural compu- 2011.
tation,
Pingmei Xu, Krista Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsoureing saliency with webcam based eye tracking. arXiv preprint 1rX4v:1504.06755, 2015.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 03365, 2015.
Shuangfei Zhai, Yu Cheng, W. Lu, and Zhongfei Zhang. Deep structured energy based models for anomaly detection. ICML, 2016.
Zongwei Zhou, Vatsal Sodha, Md Mahfuzur Rahman Siddiquee, Ruibin Feng, Nima Tajbakhsh, Michael B Gotway, and Jianming Liang- Models genesis: Generic autodidactic models for 3d medical image analysis. International Conference on Medical Image Computing and Computer-Assister Intervention. pp. 384-393. Springer, 2019.
11

---

Published as a conference paper at ICLR 2021
A APPENDIX
A.1 DATASET DETAILS
All the datsets considered are described below.
CIFAR-10: The CIFAR-10 dataset (Krizhevsky et al. (2009) consists of 60,000 32x32 colour im- ages in 10 classes, such as horse, automobile, cat etc. There are 50,000 training images and 10,000 test images.
SVHN:
The Street View Housing Numbers (SVHN) dataset (Netzer et al. (2011) consists of 32x32 images depicting house numbers ranging from 0 through 9. We use the official splits: 73,257 digits for training. 26,032 digits for testing.
Tiny ImagNee::et:: This datase is a subset of the ImageNet dataset (Deng et al. 2009 ). The test set has 10,000 images with 50 samples for each of the 200 classes. [iing et al. (2117) created two 32x32 pixel versions of this dataset: TinyImageNer (crop) which contains random crops of the original test samples and TinylmagNeet (resize) which contains downscaled test images.
LSUN:
The Large Scene UNderstanding (LSUN) produced by (Yu et al. (2015) consists of 10,000 test images belonging to one of 10 different scene classes such as bedroom, kitchen etc. Liang et al. (2017) created two 32x32 pixel versions of this dataset as well: a randomly cropped LSUN (crop) and downsampled LSUN (resize).
iSUN: This dataset was procured by (Xu al. (015)) and subsample of the SUN image database. We use 32x32 pixel downscaled versions of the original 8,925 test images.
Uniform: This dataset consists of 10,000 synthetically generated 32x32 RGB images produced by sampling each pixel from an i.i.d uniform distribution in the range [0.1].
These are 10,000 synthetic 32x32 RGB images where each pixel sampled from an i.i.d Gaussian distribution centered at 0.5 with a standard deviation of 1. The pixel values are clipped to be within [0. 1] to keep the values within the expected range of (normalized) images.
Gaussian:
Following Deiess & Taylor (2018), this dataset is combination of all non-synthetic OOD datasets outlined above: TinylmageNer (crop), TinylmageNer (resize), LSUN (crop), LSUN (resize) and iSUN. Therefore this contains 48,925 images from a variety of data distributions. Note that this collection effectively requires a single threshold for all datasets, thus arguably reflecting a real world ofdistribbutiin setting.
All Images:
A.2 EXPERIMENTAL DETAILS
We use the NCSN model provided by Song & Ermon (2019). In particular, we use the Tensorflow implementation provided through NeurlPS reproducibilty challenge submission, Matosevic et al. (019). The model architecture used is a RefineNet with 128 filters. The batch size also fixed to 128. We train for 200k iterations using the Adam optimizer. Following [Song & Ermon (2019). we use L = 10 standard deviations for our Gaussian noise perturbation such that {a.]== is a geometric sequence with 0 1 and i 0.01. We use the same hyperparameters for training on both CIFAR and SVHN. For our experiment on brain MRI images (Section (544) we trained model with 64 filters and batch size of 32 due to memory constraints caused by the higher resolution images. For the baseline network in SectionB.4] we used the standard ResNet50 available in Keras and added global average pooling layer followed by dense layer of 1024 nodes followed by a softmax layer with binary output. We trained for 10 epochs using Adam with default learning rate and momentum. For unseen classes, we follow Hendrycks al. (2018) and pick the maximum prediction probability as our outlier score. Since the network was trained to classify one year olds, we report the 1 year metrics using the logits corresponding to the outlier class only in lieu of taking the max across both classes.
We train our auxiliary models on the same training set that was used to train the NCSN model, thereby circumventing the need for separate held out tuning set. For our Gaussian Mixture Models, we mean normalize the data and perform a grid search over the number of components (ranging
12

---

Published as a conference paper at ICLR 2021
from 2 to 20), using 10-fold cross validation. Our normalizing flow model is constructed with MAF using two hidden layers with 128 units each, and a Standard Normal as the base distribution. It is trained for 1000 epochs with batch size of 128. Finally for nearest neighbor model, train a KD Tree to store (k=Se-ne neighbor distances the in-distribution training set. We keep the same hyperparameter settings for all experiments.
Note that Section 5.2 as ODIN and Confidence Thresholding were trained with a number dif- ferent architectures, report the ones that performed the best for each respective method. Specifi- cally, we use the results of VGGI3 for Confidence Thresholding and DenseNet-BC for ODIN.
A.3 EVALUATION METRIC DETAILS
To measure thresholding performance we use the metrics established by previous baselines (Hendrycks & Gimpel (017), Liang et al. (2017)) These include:
This is the False Positive Rate (FPR) when the True Positive Rate (TPR) is 95%. This metric can be interpreted as the probability of misclassifying an outlier sample to be in- distribution when the TPR is high as 95%. Let TP, FP, TN, and FN represent true positives, false positives, true negatives and false negatives respectively. FPR=FPI(FP+TN)) TPR=TP/(FN+TP),
FPR at 95% TPR:
Detection Error:
This measures the minimum possible misclassification probability over all thresh- olds. Practically this can be calculated as min; 0.5(1 - TPR) + 0.5FPR, where it is assumed that we have an equal probability of seeing both positive and negative examples the test set.
This measures area under (AU) the Receiver Operating Curve (ROC) which plots the re- lationship between FPR and TPR. It commonly interpreted as the probability of a positive sample (in-distribution) having a higher score than negative sample fout-of-distributinn It is threshold independent, summary metric.
AUROC:
Area Under the Precision Recall Curve (AUPR) is another threshold independent metric that considers the PR curve, which plots Precision(= TP(TP+FP) ) versus Recall(= TP/(TP+NN) ) AnPR-In and AUPR-Out consider the in-distribution samples and positive class, respectively. This helps take mismatch in sample sizes into account.
AUPR:
samples the
A.4 COMPLETE RESULTS FOR EXPERIMENTS IN SECTION5.2
In-distribution
OOD
GMM
Flow
KD
ODIN
Confidence
Dataset
Dataset
Tree
TinylmageNet
0.0
0.0
0.0
1.8
LSUN
0.0
0.0
0.0
0.8
SVHN
iSUN
0.0
0.0
1.0
Images
0.0
0.0
0.0
4.3
All Images*
8.6
4.1
TinylmageNet
0.0
0.0
0.3
7.5
18.4
LSUN
0.0
0.0
0.6
3.8
16.4
CIFAR-10
ISUN
0.0
0.0
6.3
16.3
All Images
0.0
0.0
0.4
19.2
All Images*
7.8
11.2
Table 5: Results for FPR (95% TPR). Lower values are better.
13

---

Published as a conference paper at ICLR 2021
In-distribution
OOD
GMM
Flow
ODIN (DenseNet)
Confidence (VGG13)
Dataset
Dataset
Tree
TinyImageNet
100.0
100.0
100.0
99.6
LSUN
100.0
100.0
100.0
99.8
SVHN
iSUN
100.0
100.0
100.0
99.8
All Images
100.0
100.0
100.0
99.2
All Images*
97.2
99.2
TinylmageNet
100.0
100.0
99.9
98.5
97.0
LSUN
100.0
100.0
99.9
99.2
97.5
CIFAR-10
iSUN
100.0
100.0
99.9
98.8
97.5
All Images
100.0
100.0
99.9
97.1
All Images*
98.4
98.0
Table 6: Results for AUROC. Higher values are better. All three auxiliary methods perform better
than baselines.
In-distribution
OOD
GMM
Flow
KD
ODIN (DenseNet)
Confidence (VGG13)
Dataset
Dataset
Tree
TinylmageNet
0.0
0.0
0.1
3.1
LSUN
0.0
0.0
0.1
2.0
SVHN
SSUN
0.0
0.0
0.1
2.2
Images
0.0
0.0
4,6
All Images*
6.8
4.5
TinylmageNet
0.0
0.0
1.0
6.3
9.4
LSUN
0.0
0.1
1.5
4.4
8.3
CIFAR-10
iSUN
0.0
0.0
6.7
8.5
All Images
0.0
0.0
1.2
9.1
All Images*
6.0
6.9
Table 7: Results for Detection Error. Lower values are better.
In-distribution
OOD
GMM
Flow
KD
ODIN (DenseNet)
Confidence (VGG13)
Dataset
Dataset
Tree
TinyImageNet
100.0
100.0
100.0
99.8
LSUN
100.0
100.0
100.0
99.9
SVHN
iSUN
100.0
100.0
100.0
99.9
All Images
100.0
100.0
100.0
98.5
All Images*
92.5
98.6
TinylmageNet
100.0
100.0
99.9
98.6
97.3
LSUN
100.0
100.0
99.8
99.3
97.8
CIFAR-10
iSUN
100.0
100.0
99.9
98.9
98.0
All Images
100.0
100.0
99.9
92.0
All Images*
95.3
94.5
Table 8: Results for AUPR In with In-distribution as positive class. Higher values are better
In-distribution
OOD
GMM
Flow
KD
ODIN (DenseNet)
Confidence (VGG13)
Dataset
Dataset
Tree
TinylmageNet
100.0
100.0
99.9
99.1
LSUN
100.0
100.0
99.9
99.6
SVHN
iSUN
100.0
100.0
99.9
99.5
Images
100.0
100.0
99.9
99.6
Images*
98.6
99.5
TinyImageNet
100.0
100.0
99.9
98.5
96.9
LSUN
100.0
100.0
99.9
99.2
97.2
CIFAR-10
iSUN
100.0
100.0
99.9
98.8
96.9
All Images
100.0
100.0
99.9
99.3
All Images*
99.6
99.5
Table 9: Results for AUPR Out with Out-of- fut-of-Distributtion as positive class. Higher values are better
14

---

Published as a conference paper at ICLR 2021
OOD
FPR (95% TPR)
Detection Error
AUROC
AUPR
AUPR
Dataset
Dataset
In
Out
CIFAR
8.6
6.9
97.6
92.3
99.2
TinyImageNe (c)
0.0
0.0
100.0
100.0
100.0
TinyImageNet (r)
0.0
0.0
100.0
100.0
100.0
LSUN (c)
0.0
0.0
100.0
100.0
100.0
SVHN
LSUN (T)
0.0
100.0
100.0
100.0
iSUN
0.0
0.0
100.0
100.0
100.0
Uniform
0.0
0.0
100.0
100.0
100,0
Gaussian
0.0
0.0
100.0
100,0
100,0
All Images
0.0
0.0
100.0
100.0
100.0
SVHN
11.4
8.1
95.5
91.9
96.9
TinyImageNet (c)
0.0
0,0
100.0
100.0
100.0
TinylmageNet (t)
0.0
0.0
100.0
100.0
100,0
LSÜN (c)
0.0
0.0
100.0
100.0
100.0
CIFAR-10
LSUN (r)
0.0
0.0
100.0
100.0
100.0
iSUN
0.0
0.0
100.0
100.0
100.0
Uniform
0.0
0.0
100.0
100.0
100.0
Gaussian
0.0
0.0
100.0
100.0
100.0
All Images
0.0
100.0
100.0
100.0
Table 10: Full results for GMM experiments. indicates lower values are better and indicates higher values are better. (c) and (r) indicated cropped and resized versions respectively
OOD
FPR (95% TPR)
Detection Error
AUROC
AUPR
AUPR
Dataset
Dataset
In
Out
CIFAR
10.4
6.9
97.0
88.3
99.0
TinyImageNet (c) TinyImagNNet (r)
0.0
0.1
100.0
100.0
100.0
0.0
0.1
100.0
100.0
100.0
LSUN (c)
0.0
0.1
100.0
100.0
100.0
SVHN
LSUN (r)
100.0
100.0
100.0
iSUN
0.0
0.1
100.0
100.0
100.0
Uniform
0.0
0.0
100.0
100.0
100.0
Gaussian
0.0
0.0
100.0
100.0
100.0
All Images
0.0
100.0
100.0
100.0
SVHN
8.6
6.8
96.7
93.4
97.7
TinyImageNet (c)
0.0
0.0
100.0
100.0
100.0
TinylmageNet (t)
0.0
0.0
100.0
100.0
100,0
LSUN (c)
0.0
0.0
100.0
100.0
100.0
CIFAR-10
S.U (r)
0.0
100.0
100.0
100.0
iSUN
0.0
0.0
100.0
100.0
100.0
Uniform
0.0
0.0
100.0
100.0
100.0
Gaussian
0.0
0.0
100.0
100.0
100.0
All Images
0.0
100.0
100.0
100.0
Table 11: Full results for our Flow model experiments. J. indicates lower values better and indicates higher values are better. (c) and (r) indicated cropped and resized versions respectively
15

---

Published as a conference paper at ICLR 2021
OOD
FPR (95% TPR)
Detection Error
AUROC
AUPR
AUPR
Dataset
Dataset
+
CIFAR
8.5
6.6
97.6
92.5
99.1
TinyImageNet (c)
0.0
100.0
100.0
100.0
TinyImageNet (r)
0.0
100.0
100.0
100.0
LSUN (c)
0.0
0.1
100.0
100.0
100.0
SVHN
LSUN (r)
0.0
0.1
100.0
100.0
100.0
iSUN
0.0
0.1
100.0
100.0
100.0
Uniform
100.0
100.0
100.0
Gaussian
0.0
0.0
100.0
100.0
100.0
All Images
0.0
0.1
100.0
100.0
100.0
SVHN
4.1
4.5
99.1
99.0
99.2
TinyImageNer (c)
0.5
1.4
99.9
99.8
99.9
TinyImageNee (r)
0.3
1.0
99.9
99.9
99.9
LSUN (c)
0.2
0.9
99.9
99.9
100.0
CIFAR-10
LSUN (1)
0.6
1.5
99.9
99.8
99.9
iSUN
0.4
1.2
99.9
99.9
99.9
Uniform
0.0
100.0
100.0
100.0
Gaussian
0.0
0.0
100.0
100.0
100.0
All Images
0.4
1.2
99.9
100.0
99.7
Table 12: Full results for our KD Tree model experiments. J indicates lower values are better and f indicates higher values better. (c) and (r) indicated cropped and resized versions respectively
A.5 PERFORMANCE ON BRAIN MRI
Auxiliary Method
OOD Age (Years)
FPR
Detection Eror
AUROC
AUPR
AUPR
(95% TPR)
In
Out t
t
0.2
0.4
99.9
99.9
99.9
2
0.6
1.0
99.7
99.5
99,9
GMM
23.7
9.2
96.1
93.8
97.9
30.5
95.0
92.2
96.8
0.2
0.3
99.9
99.9
99.9
2
0.6
1.3
99.7
99.4
99.9
Flow
4
12.2
8.4
97.3
94.6
98.8
28.9
94.3
88.7
97.5
2.5
2.6
99.3
98.2
99.7
2
3.6
3.1
98.9
96.2
99.6
KD Tree
18.6
10.7
95.7
91.0
98.0
39.2
14.9
91.6
84.2
95.8
Table 13: Comparison of all auxiliary models tasked to separate the brain of different age groups. In-distribution samples are 9-11 years of age. All values are shown in percentages. + indicates lower values are better and indicates higher values better.
16

---

Published as a conference paper at ICLR 2021
A.6 SEPARATING FASHION-MNT FROM MNIST
| summarizes the results for our FashionMNIST (inlier) and MNIST outlier experiments. We report the metrics the original We observe that our results (with default hyperparameters) are not as good as their colored image counter parts. However, we are able to beat ODIN and raw likelihoods, While may possible tune the hyperprameters like Likelihood Ratios, we leave that analysis for future work. Furthermore, we tried to run Likelihood Ratios using the provided code but were unable to reproduce the results presented in the original paper. Thus, we compare against their reported metrics for completeness but cannot make conclusions about their validity.
FPR (80% TPR)
AUROC
AUPR In
Method
1
MSMA GMM
27.02
82.56
77.37
Flow
31.84
82.05
80.82
KD Tree
43.27
69.32
58.43
ODIN
43.20
75.20
76.30
Likelihood
100.00
8.90
32.00
Likelihond Ratios
0.10
99.40
99.30
(tuned)
Table 14: Comparison of auxiliary models tasked to separate CIFAR-10 (inlier) and SVHN (out-of-
distribution). | indicates lower values are better and f indicates higher values are better.
A.7 PERFORMANCE OF F-ANOGAN ON BRAIN MRI
We also compared our methodology to f-AnoGAN due its promising results as an anomaly de- tector and its popularity in the medical community. We use the hyperparameters suggested in the original paper and trained till convergence. Our results show that f-AnoGAN does not outperform MSMA in any experiment, and is unable to match the classifier baseline reported in Section 5.4 However, we acknowledge that is a fast method, both in terms training and inference, and may be useful for some cases where pixel-wise anomalies are required (a current limitation of MSMA).
OOD Age (Years)
FPR (95% TPR)
Detection Error
AUROC
AUPR In
AUPR
Out
t
94.0
24.1
72.4
80.2
62.2
62.7
13.8
90.6
92.5
87.0
60.9
19.0
87.9
88.9
85.8
74.6
76.4
72.4
Table 15: Our results show that f-AnoGAN is unable match the performance of MSMA for this task. In fact, under some metrics such as FPR at 95% TPR, it exhibits very poor performance as an anomaly detector.
17


Reviews:
[{"review_id": "tX5fX0b2N4", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: \nThey proposed a new  method  of OOD detection, MSMA which uses a new generative model [NCSN] and a 2nd phase of fitting a simple density model on the vector of likelihoods at the various scales.\nThey showed empirically good results on standard OOD image datasets (CIFAR10 vs OOD, SVHN vs OOD etc.).  They were  able to achieve perfect separation at most settings, and much improved results for CIFAR10 vs SVHN compared to previous unsupervised methods\nThey showed interesting application for detecting OOD in medical  images where the inliears are scans for 9-11 years of  age, and OOD  are <9 years of age. \n\nStrength:\nMSMA is straightforward, and clearly described.  Since it’s based on a fairly well tested generative model, the part of getting multi-scale likelihood from  NCSN should be fairly robust, and reproducible. \nApplication on medical images is novel, could potentially benefit the ICLR audience if the dataset is released.\n\nConcerns:\n#1 Robustness of method (i.e. sensitivity to hyperparameters) \nMSMA introduces an auxiliary model, which introduces extra hyperparameters, e.g. number of components in GMMs.  \nAlso, as the authors pointed out, choosing different noise scales for NCSN gives vastly different  results in terms of OOD detection. \nIn the multi-scale case, there is a high degree of freedom in how to choose the various noise scales.  \nIn Figure 1b, even in the multi-scale case MNIST and FashionMNIST seemed to have overlapping score vectors. It would be good if thorough results for this pair are included in the experiment section.  \nA.2 presents somewhat contradicting descriptions to Section 2.1. A.2 states that all experiments are done with the largest noise scale of 10, whereas in S2.1 they said it’s only effective at a noise scale of 20. \nThis raises the concern of how applicable this method is to domains not studied in [NCSN].  E.g., on non-image OOD tasks e.g. those in [SEBM]. How would one choose the scale schedule in general?  \nUnlike Flows, VAEs,  and GANs where likelihood can be used to do model selection (e.g. using AIS), it’s unclear how to do model selection with NCSN.  This makes me wonder if the range of hyperparameters used  for  the auxiliary models is generally applicable, in the case that the base NCSN model is trained with very different hyperparameters.  \n\n#2 A somewhat restricted coverage of existing methods\nBoth in the introduction and conclusion the authors emphasize how MSMA is developed  with the application of medical image OOD  detection in mind.  They dismiss comparison to density methods by saying they cannot be used with their high-resolution images. This is simply not true. [Glow] can easily learn images at 256x256, whereas the images here are only 110x90.  Also, another very popular family of methods for OOD detection in medical images are those related to [fAnoGAN]. GANs are more than capable of learning images of these scales.  \n\nProviding a new and meaningful application of OOD detection such as the MRI dataset provided here is a good contribution, but it seems to me that the authors did not attempt to compare to other methods, but only tried to show MSMA somewhat works.  \n\n#3 Incomplete understanding of the method\nSection 2 tries to provide some intuition about the effectiveness of the method. However, the analysis is quite brief.  Here I try to list a few questions:\n Most of the reasoning of how the  “score” is  intuitively useful is  based on how the “density” appears in the denominator.  This makes me wonder if the numerator (“gradient of the density”) is of any importance, or maybe we can improve the method if that term is removed. One obvious thing to compare to here is just train a Flow, or VAE at different noise scales and compare to them.\nFigure 2 and  section 2.1 kind of explains why a large noise scale is useful, but not why using multiple scale is useful.  Why not show using a single best scale in the experiment section?  \nFigure 2 uses the construction of a local-model outlier to justify why large-scale is needed, but does this construction really translate to the real  world scenario?   Is it possible to show the  difference in prediction on the real datasets when using different scales, much  like in the toy setting?  If so, this method can also be  useful for selecting the local-mode outliers in the image  setting, which could inspire new applications\n\nMinor comments:\nIn Section 5.4. “ … is not tackled by classifier based OOD detectors … “, this is wrong.  [Lee] and many works after does study this.  \nTable 2 caption is not describing Table 2\n\nOverall, the method is simple and effective on the CIFAR10 benchmark.  It’s possible that this method is a worthy contribution. However, I’m not sure about how generally applicable this method is because I don’t see experiments in different settings, ablations studies, and/or adequate understanding of why MSMA is better than other unsupervised methods.  For the MRI task, the author  did not compare  to relevant  baselines. Lastly, the authors show no intention in open sourcing their code/dataset, which undermines the value of an empirical study.   \n\nReferences:\n[NCSN] Song, Yang, and Stefano Ermon. \"Generative modeling by estimating gradients of the data distribution.\" Advances in Neural Information Processing Systems. 2019.\n[SEBM] Shuangfei Zhai, Yu Cheng, W. Lu, and Zhongfei Zhang. Deep structured energy based models for anomaly detection. In ICML, 2016.\n[Glow] Kingma, Durk P., and Prafulla Dhariwal. \"Glow: Generative flow with invertible 1x1 convolutions.\" Advances in neural information processing systems. 2018.\n[LikelihoodRatio] J. Ren, Peter J. Liu, E. Fertig, Jasper Snoek, Ryan Poplin, Mark A. DePristo, Joshua V. Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. In NeurIPS, 2019.\n[fAnoGAN] Schlegl, Thomas, et al. \"f-anogan: Fast unsupervised anomaly detection with generative adversarial networks.\" Medical image analysis 54 (2019): 30-44.\n[Lee] Lee, Kimin, et al. \"A simple unified framework for detecting out-of-distribution samples and adversarial attacks.\" Advances in Neural Information Processing Systems. 2018.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "lDMeG7QJ2P5", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper apply multi scale score estimates to out-of-distribution detection. They demonstrate the usefulness of multi scale estimates and adopt auxiliary model to identify outlier data. The proposed method is evaluated on two different settings and is effective for out-of-distribution detection.\n\nStrength:\n+ The motivation of the proposed method is clear. The proposed method makes sense.\n+ The proposed method is quite simple. Seems easy to implement.\n\nWeakness:\n1. The writing of the paper needs further improvement. This paper is based on denoting auto encoder and Noise Conditioned Score Network. But the introduction of these important works is not very clear. \n\n2. The novelty of the method is marginal. They apply previous multi scale score estimate method on out-of-distribution detection settings. Such application is trivial.\n\n3. Experiment settings in the paper is quite simple. The proposed method is not rigorously studied in complex datasets. The improvement of previous works for separating SVNH and MNIST is not signifiant. The method doesn't compare with previous works when applying on brain scan images.\n\n4. Important theoretically analysis is missing. The proposed method has several important hyper parameters: number of scales, sigma value for each scale, etc. Real data distribution could be very complex, in this case, how to select these parameters? Discussions about how to the effect of these parameters are missing. \n\n-------\n\nUpdate after rebuttal:\n\nI appreciate the efforts of providing a hyper parameter study. Thanks for the clarification about dataset used in the paper.  \nI would like to increase my rating from 4 to 5.  Since the proposed method is somewhat ad-hoc (shared concern among other reviewers), either experimental or theoretic analysis is important to understand when and why it works. However, I don't think these analysis are sufficient in current form. ", "extra_scores": {}, "extra_text": {}}, {"review_id": "gZEraxKlusv", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Thank you for the clarifications.\nI did not change my rating, since I am unclear how the proposed method compares to SOTA beyond CIFAR-10/SVHN.\nTable 14 suggests that Likelihood Ratios is considerably better than the proposed method.\nFurthermore, neither in Table 1, nor in Section 5.4, I can find any results of the Likelihood Ratio method.\n----\nThe paper addresses the problem of detecting out-of-distribution (OOD) samples at test time, i.e. samples which belong to a class for which there was no training data.\nFor that purpose the authors propose to represent each sample x using $||s(x,\\sigma_1)||, ..., ||s(x,\\sigma_L)||$, where $s(x,\\sigma) =  \\nabla_x \\log q_{\\sigma}(x)$, and $q_{\\sigma}$ is the the original model probability $p(x)$ + gaussian noise with variance $\\sigma^2$. They call this L-dimensional space the score norm space.\nThe authors experimentally show that OOD samples tend to be rather distinct from in-distribution samples in the score norm space.\nThey exploit this, and propose to train either a Gaussian Mixture Model, Autoregressive Flow, or k-nearest neighbor model with the training data's score norm space representation.\n\nStrong points:\n- On CIFAR-10/SVHN they show that their method performs better than the Likelihood Ratios methods from (Ren et al 2019).\n- On several other baseline datasets they show that their method performs better than Confidence Thresholding (DeVries & Taylor, 2018) and ODIN (Liang et al 2017).\n\n\nUnclear/Weak points:\n\n- The proposed method is quite ad-hoc. Therefore, it would be helpful to include some experimental/theoretic analysis of why the method works, and when it does not work.\nThe authors try to provide some intuition in Section 2.1, though the explanation seems confusing to me:\non page 2, the authors argue that a small value of $p(x)$ is not a good method to detect outlier samples (referring to Nalisnick et al 2018), \nbut the Toy example in Section 2.1, page 3, discusses how their method can detect samples for which $p(x)$ is low. \n\n- The experimental results would be more convincing if their method were compared to a recent method like Likelihood Ratios (Ren et al 2019) also on other datasets than CIFAR-10/SVHN.\nFor example, (Ren et al 2019) also showed results for FashionMNIST/MNIST.\n\n- How sensitive is the method to the choice of L and other hyperparameters?\n\n\nMinor:\n- In the reference list the authors should at least add the conference name to each publication. \n- \"has been observe\" -> - \"has been observed\"\n- \"other unseen datasets It is important\" -> \"other unseen datasets. It is important\"\n- \"loglikelihoods\" -> \"log-likelihoods\"", "extra_scores": {}, "extra_text": {}}, {"review_id": "ZPivueMgy-S", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 9, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "#### Summary:\nThe authors leveraged and repurposed Noise Conditioned Score Network (NCSN) that was originally introduced by Song & Ermon (2019) for generative modeling to be used for detection out-of-distribution (OOD) images. The authors unfold the intuition and rationale behind score matching followed by the equivalence of denoising autoencoder (DAE) to derive NCSN as a score estimator and provide an analysis to demonstrate the value of multiscale score analysis. In an experimental analysis on SVHN and CIFAR datasets they demonstrate superiority of their method (MSMA) over previously reported findings in the literature using state-of-the-art models (ODIN, JEM, Likelihood Ratios) on OOD task.\n\n##########################################################################\n#### Reasons for score: \nI vote for accepting. While the objective foundation of the methodology is adapted from previous work, I find the repurposing of it for fast and effective OOD detection novel and meaningful. The authors have structured and communicated their findings remarkably and provided a well designed experimental evidence to support the methodology for the detection of OOD images task. \n \n##########################################################################\n#### Pros: \n \n1. The paper addresses a relevant issue of OOD images detection using norms of score estimates and is highly relevant to the ICLR community. \n \n2.  The multiscale score analysis was very well done and very well communicated. The visualizations captured very well the essence of the findings and were well highlighted in in the discussion. It was clear, useful and it well justified the following method development.   \n \n3. This paper provides comprehensive experiments, well related to the scientific context, to show the effectiveness of the proposed method. The additional performance metrics in the appendix provide a well complementary supprot. \n \n##########################################################################\n#### Major comment: \nWhile the paper is overall very well written, structured and communicated, I found the final discussion and conclusion quite lacking. 1) The claim that autoencoding taks better suits deep CNNs should be a bit more elaborated/ demonstrated. 2) The sentence on the “peculiar phenomenon exhibited by multiscale score estimates” is also not fully clear. It would be better if the authors explicitly mention to which phenomenon they relate. 3) I would find it important to add to the discussion a paragraph on the paper limitations, for example, any limitations the datasets present, limitations on the applied comparisons, limitations of the method application or others. 4) While the authors mentioned their plan to apply the methodology on a specific task, I think the discussion on future directions quite lacking. Are there other potential next steps that can be done on top of the proposed method? The analysis on range of scales mentioned in the end of section 2.1 could be an example of that. 5) As a minor suggestion, the authors may consider to relate to any wider impact of their work.\n\n#### Minor comments:\n\nAt two points in the manuscript the authors mentioned a future application of the method to identify atypical morphometry in early brain development. Since this experimental analysis was not actually done, I found it quite distracting and out of the scope of this paper. I would therefore suggest removing it from both introduction and discussion. \nSection 5.3, I would suggest to briefly mention what preprocessing was done on *_all_images_.\n \n##########################################################################\n#### Questions during rebuttal period: \n \nPlease address and above comments.\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: There seems to be some disagreement between Reviewers, with some borderline scores and some very good scores. After careful consideration of both reviews and answers, and after reading the updated version of the paper with some detail, I believe the approach is valuable. The use of scores for detecting out-of-distribution data is very novel and presents a number of opportunities for further research, both theoretically and empirically. Overall, my recommendation is to ACCEPT the paper. As a brief summary, I highlight below some pros and cons that arose during the review and meta-review processes.

Pros:
- Straightforward method. "Trivial application".
- Novel application to medical images.
- Robustness of default hyper-parameters.
- Future open sourcing of the code and model checkpoints.
- Topic highly relevant to the ICLR community.
- Well-written paper + relatively good visualizations.

Cons:
- Lack of comparison with other existing approaches.
- Intuition/explanation/motivation on why the method works could be improved.
- Effect of hyper-parameters could be further discussed/analyzed.
- Concerns about applicability of the approach.

Decision: Accept (Poster)