Unknown-Aware Deep Neural Network
Authors: Lei Cao
Yizhou Yan
Samuel Madden
Elke Rundensteiner
Venue:  (2020)
Keywords: unknown
rejection
CNN
product relationship

Abstract: An important property of image classification systems in the real world is that they both accurately classify objects from target classes (``knowns'') and safely reject unknown objects (``unknowns'') that belong to classes not present in the training data. Unfortunately, although the strong generalization ability of existing CNNs ensures their accuracy when classifying known objects, it also causes them to often assign an unknown to a target class with high confidence. As a result, simply using low-confidence detections as a way to detect unknowns does not work well. In this work, we propose an Unknown-aware Deep Neural Network (UDN for short) to solve this challenging problem. The key idea of UDN is to enhance existing CNNs to support a product operation that models the product relationship among the features produced by convolutional layers. This way, missing a single key feature of a target class will greatly reduce the probability of assigning an object to this class. UDN uses a learned ensemble of these product operations, which allows it to balance the contradictory requirements of accurately classifying known objects and correctly rejecting unknowns. To further improve the performance of UDN at detecting unknowns, we propose an information-theoretic regularization strategy that incorporates the objective of rejecting unknowns into the learning process of UDN. We experiment on benchmark image datasets including MNIST, CIFAR-10, CIFAR-100, and SVHN, adding unknowns by injecting one dataset into another. Our results demonstrate that UDN significantly outperforms state-of-the-art methods at rejecting unknowns by 25 percentage points improvement in accuracy, while still preserving the classification accuracy. 

Under review as a conference paper at ICLR 2020
NNKNOWN-AWARE DEEP NEURAL NETWORK
A Annyymous authors
Paper under double-blind review
ABSTRACT
An important property of image classificat ion systems in the real world is that they both accurately classify objects from target classes ("knowns") and safely reject unknown objects ("unknowns") that belong to classes not present in the training data. Unfortunatcly, although the strong generalization ability of existing CNNs ensures their accuracy when classifying known objects, it also causes them to often assign an unknown to target class with high way to
confidence. As result, simply using low-confidence delections detect unknowns does not work well. this work, we propose an Unknown- aware Deep Neural Network (UDN for short) to solve this challenging problem. The key idea of UDN is to enhance existing CNNs to support a product operation that models the product relationship among the features produced by convolutional layers. This way, missing a single key feature of target class will greatly reduce the probability of assigning an object to this class. UDN uses a learned ensemble of these product operations, which allows it to balance the contradictory requirements of accurately classifying known objects and correctly rejecting unknowns. To further improve the performance of UDN at detecting unknowns, we propose an information-theorer regularization strategy that incorporates the objective of rejecting unknowns into the learning process of UDN. We experiment on benchmark image datasets including MNIST, CLFAR-10, CIFAR-100 and SVHN, adding unknowns by injecting one dataset into another. Our results demonstrate that UDN consistently outperforms tfah--of-tho-art methods at rejecting unknowns- up to 20 point gains in accuracy, while still preserving the classification accuracy.
1 INTRODUCTION
Motivation. In recent years, Convolutional Neural Networks (CNN) have been used with great success for a rich variety classification problems, particularly when dealing with high dimensional, complex data such images or time series (Goodfellow et al. 2016 A CNN classifier (Krizhevsky et al. 2012) typically classifies test objects as one of the target classes supplied in the training that all testing objects belong to one of the target classes. However, this assumption rarely true in real-world deployments of CNN classifiers. Consider for example, an autonomous car or healthcare system: it is extremely likely that the system will be exposed to objects that were not in its training set. We call such objects "unknowns".
In this, state-of-the-art classifiers make the implicit assumption
Clearly, blindly assigning these unknowns into one of the target classes degrades the prediction accuracy. Worst yet, can lead to serious safety concerns. For example, in a collaboration with a top hospital in the US (name removed due to anonymity), we have been developing soizure detector that classifies patients into different types of seizures based on EEG signals collected during the clinical observation of 4,000 patients. The detector was trained based on 6 types of seizures observed in the training data. However, when deployed, the CNN classifier may encounter patients who have types of seizures that do not exist in the training data because they are rare or even unknown by the medical community. Misclassifying these patients into the existing types of scizures brings serious risks and potential harm due to the potential for mistreatment of these patients. Ideally, in this case, the unknowns would be recognized and rejected by the classifier.

---

Under review as a conference paper at ICLR 2020
In this work, we focus this important problem, describing deep neural network that not only accurately classifies test objects into known target classes, but also correctly rejects unknowns.
State-of-the-Al Art. In a typical CNN, the output of the last fully connected layer is fed into softmax layer to generate class probability in [0, 1] for each target class. An object will then be assigned to the class with the maximal probability. Intuitively, unknowns would be detected by leveraging this confidence, as was done in [Beddaee & Boult (2016); [Hnddrycks & Gimpel (2017); Liang et al. (2018). Since unknowns should not exhibit as many leatures of a target class versus known objects, the CNN should report lower confidence. In prior work (Bendale & Boult 2016 Hendrycks & Gimpell 2017 Liang et al.) 2018). the maximal probability or the largest value in the input vector to the softmax layer (maximal weighted sum) is used as confidence to detect unknowns. In particular, an object will be rejected as an unknown if its confidence is smaller than a predetermined cutoff threshold ct.
However, shown in our experiments (Sec. 5), these state-of-the-art methods are not particularly effective at rejecting unknowns. This is because CNNs achieve high classification accuracy by providing strong ability to generalize, allowing it to overcome the gap bet ween the training and testing data (Goodfellow et al., 2016). Unfortunately, this strength here is also a weakness, because it increases the chance of erroneously assigning an unknown to some target class even if it is quite different from the training objects in any target class. More specifically, the maximal probability (or maximal weighted sum) in CNN is computed by the weighted sum operation on the multiple features produced by the convolutional layers. Because of this sum operation, an unknown can be classified a target class with high confidence even if it matches some key features of a target class only by chance. Therefore, the requirements of accurately classifying the knowns and correctly rejecting the unknowns conflict with each other.
Proposed Approach and Contributions. In this work we propose an Unknown-aware Deep Neural Network (UDN for short) to overcome this problem.
The key intuition of UDN to modify the CNN to use a product operation which models the product relationship among the features produced by the convolutional layers. This way, similar to the product rule in probability theory (Stroock] 2010), if just one feature indicative of a largel class is not matched, the probability of assigning an object to this class is greatly reduced. Since an unknown is unlikely to match most of the features of a target class, the unknown to target class with high confidence is reduced. Therefore,
chance of assigning the confidence produced by UDN should more effectively detect unknowns than the typical maximal probability/ celliityymmxxin maaxmmal weighted sum produced by classical CNNs. In UDN, the product operations are learned as a set of product relationship (PR) subnets leveraging the hierarchical nature of the binary tree structure. The strong bias of the classification decisions made via the product operations and the generalization ability introduced by the ensemble nature of multiple PR subsets together balance the contradictory requirements of accurately classifying known objects and correctly rejecting unknowns.
In addition, we propose an information-theoreet porates the objective of unknown rejection into the learning process of UDN. This further improves the accuracy of UDN at rejecting unknowns by cnlarging the confidence gap between unknown and known objects. We then show that the final loss function of UDN is fully differentiable. Therefore, UDN can be learned by following the common practice of back-propagation in deep neural networks.
regularization strategy that actively incor-
We demonstrate the effectiveness of UDN using a rich variety of benchmark datasets including MNIST, 10, CIFAR- 100, and SVHN, UDN outperforms the state-of-thees the-art up to 20 points in the accuracy of unknown rejection while preserving the accuracy of the underlying CNN at classifying objects from the target classes.
RELATED WORK
Cut-oofDDstributiin Detection. In Bendale & Boult (016)). CNNs were adapted to discover unknowns by adding one additional unknown class to the softmax layer. This
2

---

Under review as a conference paper at ICLR 2020
method, called OpenMax, measures the distance between the maximal weighted sum vector produced for a test object and the mean maximal weighted sum vectors of the target classes that this test object is most likely assigned to. This distance is translated to probability by the OpenMax layer. A testing object will be assigned to the unknown class if this probability is larger than a pre-defined cutoff threshold. Similarly, Malininn & Gales (2018) detects -ut-of-distribution objects by parameterizing a prior distribution over predictive distributions, so called Prior Networks (PNs); while Hendrycks & Gimpel (2017) directly uses softmax probabilities to detect
objects.
ODIN (Liang et al. 2018) detects unknowns using a two-pass inference strategy. That is, each test image goes through the inference stage twice. During the second inference round, each input is perturbed based on the gradient of its loss acquired in the first inference. The goal is to make the maximal probability produced by softmax more effective at separating unknowns. One problem with ODIN is that it introduces two extra hyper-paramcters to control the level of perturbation, which are hard to tune.
As shown in experiments, our UDN method siguificantly outperforms OpenMax and ODIN, because UDN uses the maximal path probability as confidence confidence measure, which as the product of multiple probabilities w.r.t. a set of nodes, is more effective in rejecting unknowns than using maximal weighted sum or maximal probability as confidence measure.
MC-Dropout (Gal & Ghahramani 2016 uses Bayesian model to reason about model approximate Bayesian
uncertainty by casting dropout training in deep neural networks inference in deep Gaussian processcs. It then rejects a testing object as unknown if the uncertainty about this object is large. As shown in experiments, MC-Dropout in many cases outperforms OpenMax and ODIN in rejecting unknowns, although is still worse than our UDN. Further, it scarifies the accuracy of classifying the known classes.
In Liu et al. (2018) and Vyas et al. 2018), methods were proposed to detect the objects that do not belong known classes in a "clean" training dataset. However, these methods rely on a "contaminated" training set that contains a fraction of unknowns, i.e., that were not in the original clean training data. In other words, they solve the problem of rejocting "known unknowns", while our UDN instead focuses on the problem of rejecting "unknown unknowns". Our UDN does not require any labeled unknowns in training.
Deep Outlier Detection. Methods in Perera & Patel (2018) Erfani et al. (016) Ruff
et al. (2018); Nguyen & Vien (2018): [cchleg et al. (2017): Zhai al. (2016) : Chen et al.
(2017 Zong et al. [2018:: ; Hendrycks et al. [2019] use representation learning of deep neural
networks to enhance the classical unsupervised outlier detection methods such as one-class
classification (Schölkopf et al. 2001; Manevitz & Yousef 2002 Tax & Duin 2004) and
neighbor-basee methods (Brunigg et al. 2000 Knorr & Ng. 1998 Ramaswamy et al.] 2000
Bay & Schwabacher] 2003). ). However, unlike our work which tocuses on enhancing the CNNs to reject the unknown objects during the inference process, these outlier detect ion methods do not take the classification objective into consideration. Instead, these methods detect outliers from given dataset as the objects that significantly deviate from the majority of
this dataset (Aggarwal 2017). without using any labeled outliers or normal objects.
Deep Neural Decision Forest. Similar to the deep neural decision forest (DNDF) [Kontschicder et al., 2015),, nodes in UDN at the final FC layers are connocted to the split nodes of multiple trees. However, UDN is different from DNDF in several important ways. First,, conceptually UDN corresponds to a variation of CNN model by replacing the softmax layer with tree structures such that. the CNN can model the product relationship among the features learned by CNN, while DNDF instead enhances a random forest classifier with the feature learning ability of CNN. Second, UDN incorporates the objective of unknown rejection into the learning process, while DNDF only considers the classification of known classes. Third, DNDF estimates both the decision node paramotrizations 0 and the Icaf prodictions æ by using a two-step optimization strategy, where 0 and я are updated alternatively to minimize the log-loss, while UDN is fully differentiable and therefore can be optimized in one step. Forth, in DNDF different trees share the FC layers (except the final FC layer) of the CNNs, while UDN divides all FC layers into m independent components,
3

---

Under review as a conference paper at ICLR 2020
each of which is connected to individual tree. This ensures independence among the trees and improves the classification accuracy because of the excellent generalization capability.
AN UNKNOWN-AWARE DEEP NEURAL NETWORK
In this soction, we first introduce the structure of unknown-aware deep neural network (UDN). Next, we show how UDN distinguishes unknown from known objects. A regularization strategy introduced in Sec. further improve the accuracy of UDN rejecting unknowns.
Convolutional Modules
Deep CNN with parameters 0
PR
Fully Connected Layers
Fully Connected Layers
PR₂
1.
13
22
d
d1
1121
15
16
117
2124
71
21
11
15
16
4
18
21
22
27
22
Figure 1: UDN Architecture.
3.1
UDN: NETWORK STRUCTURE
As depicted in Fig. [ UDN is composed of the convolutional module and M independent product relationship (PR) submets, where M corresponds to a user definable hyper-parameter.
PR Subnet. The PR subnet is designed to model the product relationship among the features produced by the convolutional layers. Each PR subnet contains one fully connected (FC) component connected to binary tree structure. Within each individual tree T, each split node of T' is connected to one output node of the final layer of the FC component. The mapping between the FC output nodes and the split nodes can be arbitrary. Any FC output node can be connected to the root node of the tree. The set of split nodes of T is denoted as N. The of leaf nodes is denoted as L.
Each split node E N converts the output æ; of the FC node it consumes data from into value in the [0, 1] range by applying the sigmoid function (2;), where (x;) = (1 + --1
Each Icaf node 1 E L is parameterized using C-dimensional probability distribution ni where C denotes the number of classes. One element कद. of क, w.r.t. the ith class is computed as the softmax output of be learned parameter wt:
elo
.ं softmar(w()
ΣS "d
Product Relationship. Next, we show how a PR subnet models the product relationship using the path probubilily (*(x)) defined in Eq. 2 where x denotes an input object and /
denotes a path from the root node a leaf node l.
(r(x) II d(x,) nEEN;
(2)
In Eq. 2 Mi denotes the set of split nodes on the path from root to a leaf I. Given a node n, Ni. d(æ;) (2:) if the left child of n, is included in this path. Otherwise, d(x,)
1 - (z;). For example, as shown in Fig. [ on the path of nn > R12 + nis + las d12 w.r.t.
n12 is set as (2, 2), because n12 is connected to its right child mi5 this path.
4

---

Under review as a conference paper at ICLR 2020
Therefore, d(z;) indicates the probability that input will be routed from node ny down to the next node on path I. Accordingly, (z(z) models the probability of input æ reaching leaf 1, ie., the probability of path I.
Since the d(z;) of each split n, corresponds to the output z; produced by the FC node w.r.t. ni, essentially the path probability fx(x) is jointly determined by the output of multiple FC nodes. Therefore, (*( successfully models the product relationship among the features produced by CNN. The existence of one FC node that leads to small d(x;)) will make the probability of the whole path small.
Prediction. At each leaf node I of T, PR subnet. produces prediction for a given input object a using Eq. 3
P Σ (x)
(3)
In Eq. ( L), and Tly denotes the probability that leaf / believes an input sample belongs to class (x) denotes the path probability of I. Generally speaking, the prediction is given by the probability produced the leaf node weighted by the probability of input reaching leaf 1.
Finally, as an ensemble of set of PR subnets PR = (PRI,.... PRa), UDN produces prediction for an input by averaging the output of cach subnet, i.c.:
PR
PpR[v|=] = PR
Prn, [vlo,
(4)
Similar to the typical ensemble structures like random forest HHo 1995). multiple PR subnets results in good generalization performance in classifying objects from target classes, even each individual PR subnet could be overfit to the training examples.
the ensemble of
Note when we setup the network structure of UDN, the mapping between the FC output nodes and the split nodes of the binary troe is arbitrary. The parameters w.r.t. each node is learned in an end-to-end fashion through back propagation. In the training process that minimizes the loss, the important features for a known class will be automatically learned and mapped to the split nodes on the samn path. In other words, we do not have to group features explicitly. Instead, the grouping of the features is learned automatically. Fig. [ shows the final results of the training. For example, since nodes f11, f12, and f16 are not the same path, these nodes are not considered to correspond to the key features of any class.
3.2 UDN: UNKNOWN REIECTION
Max Path. Based on the above architecture, given a testing object x, each PR subnet in UDN produces a probability distribution μı(x) over each path from the root to leaf L. As shown in Eq. 2 the probability of a path is computed as the product of the probabilities (d(x,)) produced by all split nodes on that path. Given an object x, given path will have an extremely small probability if x: does not. fit the features represented by the split nodes on this path (hence small d(xx)), because the product of multiple small probabilities will diminish quickly. One path will stand out when all its split nodes produce large probabilities on x, marked as bold line Figure ! We call this path the mar path, because it has the maximal probability among all paths.
Since the learned ni on each leaf is invariant w.r.t. input x, essentially is the max path that determines the class of x by Eq. Therefore, the probability of the max path (x() (or max path probability) can be used to measure how confident the classifier is about its classification decision of object æ. The larger the max path probability is, the more confident
5

---

Under review as a conference paper at ICLR 2020
the classifier is about the object. More specially, given object and PR subnet PR, the confidence measured as:
CFrn(a; Q) = max(u(ln E C}
(5)
where mar{ur()) L} denotes the max path probability of subnet PR for the given object x. Since UDN an ensemble of a set of PR subnets, the final confidence object æ is measured
PR
CFFR(() PR
(F;
(6)
Effectiveness of Using Max Path to Reject Unknowns. Intuitively this max path probability can be expected be more effective detecting unknowns than the maximal weighted sum in CNN. Typically an unknown will not get large probability on every split node on the max path, and one low probability node will limit the max path probability because of the product operation used in the computation. In contrast, the maximal weighted sum CNN tends to fall off much more slowly because the score is computed based on the sum operalion (with weights) on multiple features, such that single matching feature can make the score high. This is confirmed in our experiments (Sec. 5.2, Appendix Appendix Ch.
INCORPORATING UNKNOWN REJECTION INTO THE LEARNING PROCESS
4.1 INFORMATION THEORY-BASED RECULARIZATION
To ensure the effectiveness of using the max path probability to reject unknowns, we further incorporate the objective of unknown rejection into the learning process of UDN by introducing regularization. The key idea is to use an information theory-based approach to prevent the generation of a PR subnet whose paths show uniform probability distribution. This ensures that the max path probability of each subnet will be generally much larger than the probabilitics of other paths, making more effective at rejecting unknowns. To achieve this, we penalize the paths whose probability distribution has large entropy and hence close uniform (Pereyra al. 2017).
Given subnet PR with |C] paths, each input E X can use any of L] paths to reach leaf nodes. The entropy the path probability distribution of input x is given by:
H((())) = - -mm(())o(((((()
LEC
We then apply softmax function the probability distribution normalization. The revised entropy of the path probability distribution is given by:
H(p((x))= = -I ((((r)oo((((()))
(8)
IEC
where 41(x) = softmaz((((z))
ezp(a(()) Eiee exptey (n))
is the softmax transformation of (z()).
To penalize the subnet whose path probability distribution is close uniform, we add the entropy w.r.t. each training sample to the log-loss term. Given the training set X' and the output V, the penalized log-loss term one subnet PR is represented as:
x(PR; (x.))EAx))
Σ
-log Pron(Prrlleeeem 0))) + (x(()))))))
(9)
where 3 controls the strength of the penalty and PPR[B|æ, O n] defined in Eq. represents the learned parameters the convolutional layers and FC layers.

---

Under review as a conference paper at ICLR 2020
The total log-loss for the UDN composed of [PR] subnets is then defined as:
PR
((PR;X)))- PRR
I(PR;23))
(10)
4.2 TRAINING A UDN
Training a UDN requires finding a set of parameters θ and that minimize the total log
loss defined in Eq. [0 To minimize Eq. [0] we can independently minimize the penalized loss (Eq. 9) of each individual subnet. In Appendix A we show that the loss function is fully differentiable. As result, we are able employ SGD minimize the loss wr.t. and म, following the common practice of back-propagation in deep neural networks.
5
EXPERIMENTAL EVALUATION
5.1 OVERVIEW OF EXPERIMENTAL SETTING
Datasets. We demonstrate the effectiveness of UDN on several benchmark image datasets. Specifically, we train models on CIFAR-10 (Krizevskyy & Hinton 2009). CIFAR- 100 (Krizhesky) 2009), and SVHN (Ntzerr et al. 2011H datasets. Given a trained model one dataset, we consider examples from other datasets as unknowns when testing the model. In addition, we also sample some classes from the training data unknowns and test these samples on the model trained for the rest of the classes. Due to the lenght constraints we present the results on the CIFAR-100 and SVHN models in Appendix and Appendix
Methodology. We evaluate: (1) CNNs with Weighted-Sum as baseline. The weighted sum score is utilized as the confidence measure; (2) OpenMax (Bendale Boult (016))
(3) ODIN (Liang et al. 2018). (4) Softmar {Hendrycks & Gimpel] (017], and (5) MC-
Dropout (Gal Ghahramani p016:: the state-of-the-art unknown rejection methods de-
scribed in related work (Sec. 2 (6) our UDN model without the regularization term applied to the loss function and (7) DDN-Penalty: our UDN with the regularization term (Eq. 9..
The results show that our UDN and UDN-Penalty siguificantly outperform OpenMax, ODIN, MC-Dropout and Softmax through a variety of unknown rejection experiments, while still preserving the accuracy of classifying objects from target classes.
Experimental Setup. We ran experiments on 4 P100 GPU instances on Google cloud. All models are implemented in Pytorch (Paszke et al. 2017).
Hyper-parameter Scttings. All networks are trained using mini-batches of size 128. The momentum is set to 0.9 for all models. The weighted decays lesting MNIST on models trained for other datasets, we increase its color channel from to 3 by copying the original gray images 3 times.
to 0.0001. When
Evaluation Metric. Following the literature of unknown rejection, we use two metrics to measure the effectiveness of UDN at distinguishing known and unknown images, namely negative rate (TNR) at 95% true positive rate (TPR) and AUROC. TNR at 95% TPR can be interpreted as the probability that an unknown image (negative) is correctly recognized when the TPR is 95%. True positive rate can be computed by TPR TP /TP + FN), where TP and FN denote true positives (knowns are correctly classified as knowns) and false negatives (known images are misclassified as unknowns) respectively. The true negative rate (TNR) can be computed by TNR TN/(F++TN) where FP and TN denote false positives (unknowns misclassified as knowns) and true negatives (unknowns correctly recognized) respectively.
AUROC corresponds to the Area Under the Receiver Operating Characteristic curve, which a threshold independent metric (Davis & Goadrich 2006). . It can be interpreted as the probability that positive example is assigned higher detection score than negative example. In addition, we also measure the accuracy of these methods at classifying the knowns into target classes.
7

---

Under review as a conference paper at ICLR 2020
5.2 CIFAR-10
We lested all approaches on DenseNet (Huang et al. 2017). All methods use the same DenseNet architecture to ODIN (Liang al. 2018). For our UDN and UDN-Penalty, the output is connected to 10 depth-5 trees. Specifically, the output of the convolutional layer broadcast to 10 different sets of FC layers. Each set contains FC layers. The final FC layer with 63 (2(6+1)- 1) hidden nodes is connected to tree. The training time of UDN is 9.4 hours, slightly slower than training a DenseNet model (9.1 hour). For the evaluation of ODIN, directly use the model published by the authors. The temperature parameter and the perturbation magnitude 7 used by ODIN are set to 1000 and 0.0014. We set the drop rate of MC-Dropout as 0.2 and the mumber of forward passes as 100. We set these parameters by the suggestion of the authors or parameter tuning.
Table 1: CIFAR-10 Results (DenseNet).
Methods
TNR (95% TPR)
AUROC
Classilication Accuracy
CIFAR-
CIFAR-
SVHN
MNIST
SVHN
MNIST
100
100
Weighted-Sum (Baseline)
52.25%
54.96%
98.90%
90.33%
91.80%
99.51%
94.26%
Softmax (Headrycks &
Gimpel| 2017)
40.35%
41.64%
76.38%
89.03%
90.54%
96.92%
94.26%
Openkax (Bendale &
51.97%
63.67%
49.56%
90.5-4%
93.28%%
89.73%
94.26%
Boult 2016)
ODIN Liang
2018)
50.8%
49.57%
99.14%
89.80%
91.24%
99.86%
95.19%
MC-Dropout Gal &
Ghahramani
2016)
51.86%
78.73%
99.82%
78.91 9
89.5%
99.94%
93.95%
UDN
54.22%
84.64%
98. 98.98%
92.93%
97.59%
98.82%
95.30%
UDN-Penalty
56.55%
88.09%
99.07%
93.47%
98.719 %
99.77%
94.27%
As shown in Table D in almost all cases UDN and UDN-Penalty outperform Softmax, Weighted-sum, OpenMax, ODIN, and MC-Dropout in rejecting unknowns, without giving up our ability to correctly classify the CIFAR-10 images. Specifically, UDN and UDN-Penalty outperforms other methods up to 10 points in TNR. UDN and UDN-Ponalty also significantly outperform other methods in AUROC. In particular, UDN and UDN-Penalty achieve about 98% AUROC when detecting SVHN as unknowns. This indicates that our methods can effectively separate knowns and unknowns under a wide range of parameter settings.
The performance gain results from our UDN architecture, where the confidence of each image computed as the product of the probabilities produced at the split nodes on the path. This multiplication of probabilitics enlarges the confidence gap, making it able to better reject unknowns than alternate approaches. The only exception that MC-Dropout performs the best rejecting MNIST as unknowns, showing that MC-Dropout is probably good at separating unknowns which are simplistic yet very different from known objects.
In addition, UDN achieves slightly better classification accuracy compared to Softmax, Weighted- -ume, OpenMax, and ODIN that use the classical DenseNet. The classification accuracy of MC-Dropout is worse than other methods because of the Bayesian inference.
Our UDN-Penalty outperforms UDN in rejecting unknowns in all cases. This is because by introducing regularization to penalize path probability distributions that have large entropy, UDN-Penalty leads to larger maximal path probabilities for inlicrs. At the same time, its classification accuracy decreases slightly, because the regularization introduces overfitting (Szegedy et al. 2016). However, this is effectively alleviated because of the ensemble of the PR subnets. Therefore, the drop in classification accuracy very small.
CONCLUSION
In this work, we proposed an augmentation to CNNs, UDN, which effectively rejects unknown objects that do not belong to any class seen in the training data. UDN achieves this by replacing softmax layer in traditional CNNs with a novel tree ensemble that takes the product of feature values, balancing the contradictory requirements of accurately classifying knowns and correctly rejecting unknowns in one network structure. A regularization strategy is proposed for UDN to further enhance its unknown rejection capacity.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Charu C. Aggarwal. Outlier Analysis: Second Edition. Springer, 2017.
Stephen D. Bay and Mark Schwabacher. Mining distance-based outliers in near linear time with randomization and simple pruning rule. In KDD, pp. 29-38, 2003.
Abhijit Bendale and Terrance E. Boult. Towards open set deep networks. In CVPR, pp. 1563-1572, 2016.
Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and Jörg Sander. LOF: identifying density-based local outliers. In SIGMOD, pp. 93 93-104, 2000.
Jinghui Chen, Saket Sathe, Charu C. Aggarwal, and Deepak S. Turaga. Outlier detection with autoencoder ensembles. In SDM, 2017.
Jesse Davis and Mark Goadrich. The relationship between precision-recal and roc curves. In Proceedings of the 23rd international conference on Machine learning, pp. 233 240. ACM, 2006.
Sarah M. Erfani, Sutharshan Rajasegarar, Shanika Karunasekera, and Christopher Leckie. High-dimensional and large-scale anomaly detection using a. linear one-class SVM with deep learning. Pattern Recognition, 58:121-134, 2016.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In TCML, pp. 1050-1059, 2016.
Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, 2016. http:://ww..eepleeemmmooooooo org
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of- distribution examples in neural networks. ICLR, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with http:ppawwrrreee..eeeerrrrr/aaaa
outlier exposure. In ICLR, 2019. URL
Tin Kam Ho. Random decision forests. ICDAR '95, pp. 278-, Washington, DC, USA, 1995. IEEE Computer Society.
Gao Huang, Zhuang Liu, Laurens der Maaten, and Kilian Q. Weinberger. Densely connected convolutional networks. In CVPR, pp. 2261-2269, 2017.
Edwin M. Knorr and Raymond T. Ng. Algorithms for mining distance-basee outliers in large datasets. In VLDBB, pp. 392 392-403, 1998.
Peter Kontschieder, Madalina Fiteran, Antonio Criminisi, and Samuel Rota Bulò. Deep neural decision forests. In ICCV, pp. 1467-1475, 2015.
Alex Krizhevsky. Learning multiple layers of fcatures from tiny images. Technical report, 2009.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. In NIPS, pp. 1106-114 1114, 2012.
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribation image detection in noural networks. In International Conference on Learning Representations, 2018. URL httpss:/oppnreeviett http://pppmneeereeeeeeeerrrrrraa wtt.://oooooomoodddttt
Si Liu, Risheek Garrepalli, Thomas G. Dietterich, Alan Fern, and Dan Hendrycks. Open category detoction with PAC guarantees. In ICML, pp. 3175-3184, 2018.
Andrey Malinin and Mark Gales, Predictive uncertainty estimation via prior networks. In NewrIPS, NIPS'18, pp. 7047-7058, 2018.
9

---

Under review as a conference paper at ICLR 2020
Larry M. Manevitz and Malik Yousef. One-class svms for document classification. J. Mach. Learn. Res., 1:199-154, March 2002. ISSN 1532-4435.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupercised feature learning, volume 2011, pp- 5, 2011.
Minh-Nghia Nguyen and Ngo Anh Vien. Scalable and interpretable one-class svms with deep learning and random fourier features. CoRR, 055/11004.4888 2018.
Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. 2017.
Pramuditha Perera and Vishal M. Patel. Learning deep features for one-class classification. CoRR, abs/ 1///18000005555 2018.
Gabriel Pereyra, George Tucker, Jan Chorowski, Lukasz Kaiser, and GeofTrey Hinton. Regularizing neural networks by penalixing confident output distributions. ar prepriat arxim: 00548 2017.
Sridhar Ramaswany, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In ACM SIGMOD Record, volume 29, pp. 427-438. ACM, 2000.
Lukas Ruff, Nico Görnitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Robert A. Vandermeulen, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In ICML, pp. 4390-4399, 2018.
Thomas Schlegl, Philipp Seeböck, Sebastian M. Waldstein, Ursula Schmidt-Erfurdhe and Georg Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In IPMI, pp. 146-157, 2017.
Bernhard Schölkopf, John C. Platt, John C. Shawe-Taylor Alex J. Smola, and Robert C. Williamson. Estimating the support of a high-dimensional distribution. Newral Comput., 13(7):1443 1471, July 2001. ISSN 0899-7667.
Daniel W. Stroock. Probability Theory: An Analytic View. Cambridge University Press, New York, NY, USA, 2nd edition, 2010.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 2818 2818-2826, 2016.
David M. J. Tax and Robert P. W. Duin. Support vector data description. Mach. Learn., 54 (1):45 66, Jamuary 2004. ISSN 0885-6125.
Apoorv Vyas, Nataraj Jammalamadaka, Xia Zhu, Dipankar Das, Bharat Kaul, and Theodore L. Willke. Out-of-distributiio detection using an ensemble of self supervised leave-out classifiers. In ECCV, pp. 560-574, 2018.
Shuangfei Zhai, Yu Cheng, Weining Lu, and Zhongfei Zhang. Deep structured energy based models for anomaly detection. In ICML, pp. 1100-1109, 2016.
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International Conference on Learning Representations, 2018. URL https //opprroiiew.ne//foom/aaaa
10

---

Under review as a conference paper at ICLR 2020
A LEARNING OF UDN
Learning Decision Nodes by Back-Propag
Given dccision trec, the gradient of the loss L with respect to θ can be decomposed by the chain rule as follows:
aL 00
a n; (z;
(,, = E
(11)
BEN (z;
d0
Here, the derivative of the second part (z;0)) is identical to the back-propagation process of traditional CNN modules and thus omit here. Now let's show how to compute the first part:
0e
OL(O,T;Z.)) (f,
a(-log 0, (H(
(z; 6)
(12)
0 a1-log( Pr (u/p,, 0
((
+ 3 0f.(z;
0fn(x;
where
0( (rrlog 0,=]) =
Σ lec
Myy
0p(((())
(13)
(f 0)
Priyle, 0. (z;
and
Σ 0p((z(0)
Σ m(([() (log(u((z(0))
0zx(2;0)
0f)
IEC
IEC
=- (= 1100)11mmh In; 0))
(14)
IEC
Σ (x; + Σ (x;
LEC..
teC.r
By using the chain rule, we get:
((H()()(()))
((H((()())) Auf(( a(m(()))
(15)
(2;
0(v((((0)) 0(m(x(0) 0f θ))
TEC
where
Σ ((H()(2100))
((u((=10)oo((u((x00))
((1(((())
0(1(x((0))
IEC
IEC
(16)
(1 (ogg((((())))
IEC
and
Σ 00((((00)
Σ (si(1 51) Σ (tst)
lec
TEC
ligt
where
(1(()
81 kEC (x
Learning Prediction Nodes by Back- Back-Propagation
11

---

Under review as a conference paper at ICLR 2020
Given decision tree, the gradient of the Loss L w.r.t. the weights of the prediction nodes (defined in Eq. [] can be decomposed by the chain rule as follows:
aT. dw (O, n; 2.
a n; v) dm
Σ
(17)
mm
owr
where
OL(O, π.; x,
(1 +
(18)
Omly
Pr Pr(ulz, O ml
and
Umty
Tiy (1 Tiyy
y
(19)
Own
Ti:
y +
Therefore,
(T, T m;
A ,; v) Omiy
Own
Dwii
MEY
O n: xr, Omg
O x; v) Omt
(20)
Own
Oity
Own
y
(x θ Ti TT))
(r θ mTy TH Prly O.
[r θ TT)
Table CIFAR-100 Results (DenseNet).
TNR (80% TPR)
AUROC
Classilication Accuracy
Methods
CIFAR-
CIFAR-TO0 CIFAR-
CIFAR- 100
SVHN
SVHN
10
Classes
10
Class
Weighted-Sum
53.70%
74.84%
50.65%
74.54%
81.61%
74.22%
77.1%
(Baseline)
Softmax (Hendrycks
49.95%
60.44%
48.38%
75.61%
81.4%
74.16%
77.1%
& Gimpell (2017)
OpenMax (Bendaee
32.86%
57. 57.23%
30.06%
58.46%
71.59%
57.74%
77.1%
Boult 2016)
ODIN Liang et al.
50.29%
64.99%
49.01%
73.06%
82%
72.89%
77.1%
2018
MC-Dropout Gal &
33.64%
59.57%
31.28%
59.43%
73.09%
58.37%
73.74%
Ghahramani
2016
UDN
59.59%
83.52%
59.21%
79.93%
87.42%
79.67%
76.92%
UDN-Penalty 59.92%
84.55%
59.67%
82.03%
87.59%
81.81%
76.77%
B CIFAR-100 EXPERIMENTS
Similar the CIFAR-10 experiments, all methods use the same DenseNet (Huang et al. 2017] architecture to ODIN (Liang et al. 2018). For our UDN and UDN-Penally, the output connected 10 trees. The depth of each tree is Again, for the evaluation of ODIN, we directly use the model published by the authors. The temperature parameter T and the perturbation magnitude 7) used by ODIN are set to 1000 and 0.0014, as recommended by the authors. We set the drop rate of MC-Dropout number forward passes as 100 as suggested by the authors.
0.2 after parameter tuning and set the
In this set of experiments Moreover, we also randomly pick 10 classes from the CIFAR-100 training data. We then these samples unknowns and test. them the model trained using the rest of the
the images in CIFAR-10 and SVHN the unknowns.
12

---

Under review as a conference paper at ICLR 2020
CIFAR-100 training data. We run this process for 10 times and report the average TNR and AUROC.
As shown in Table 2 our UDN significantly outperform other methods in all cases by at least 9 points in TNR and points in AUROC.
C SVHN EXPERIMENTS
Table 3: SVHN Results (DenseNet).
TNR (95% TPR)
AUROC
Classification Accuracy
Methods
CITAR-
CITAR.
SVHN- CIFAI-
CIFAR-
SVHN-
10
100
Classes
10
100
Class
Weighted-Sum
80.76%
77.83%
60.92%
95.70%
94.64%
92.22%
96.42%
(Baseline)
Softmax (Hendrycks
70.08%
68.82%
19.13%
95.06%
94.51%
90.24%
96.42%
& Gimpell (2017)
OpenMax [Bendale
62.66%
62.845%
33.32%
86.78%
85.65%
59.78%
96.42%
& Boult 2016)
ODIN Liang et al. 2018
79.32%
76.01%
61.56%
94.87%
93.52%
92.11%
96.42%
MC-Dropout (Gal & 2016)
57.41%
55.25%
58.62%
78, 19%
77.24%
79.
92.94%
Ghahramani
UDN
96.33%
92.10%
74.06%
98.96%
98. 15%
94.82%
96.577%
UDN-Penalty
96.50%
92.66%
71.08%
98.94%
98. 22%
95%
96.543%
Same to the CIFAR-100 experiments above, we tested all approaches based on the same DenseNet architecture. For our UDN and UDN-Penalty, the output is connected to 10 trees. The depth of each tree is 4. For ODIN, the temperature parameter T and the perturbation magnitude used by ODIN are set to 1000 and 0.0014 after parameter tuning. We set the drop rate of MC-Dropout as 0.5 and the number of forward passes as 100 as suggested by the authors.
We use the images in CIFAR-10 and CIFAR-100 as the unknowns. At the same time we also randomly pick classes from the SVHN training data and use these samples unknowns. We then test them on the model trained using the rest of the SVHN training data. We run this process for 10 times and report the average TNR. and AUROC
As shown in Table 3 in all cases our UDN outperform other methods in both TNR and AUROC. In particular, UDN outperforms all other methods by at least 12 points in TNR.
D PARAMETER TUNING
In our UDN, The key paremmtesssssrss are the number of PR subnets and the depth of the binary tree. In general, the depth of the tree depends on the number of the classes. The more classes the datasct has, the higher the tree should be. In our experiments, when the depth of the tree is no smaller than 6 and the number of PR subnet is above 10, our method works well in general. When the nunber of classes in the training data is small such as MINIST and CIFAR-10, setting the depth the three as a smaller value such as 4 also works. But larger depth of the tree or more subnets does not harm the effectiveness of our UDN method. Therefore, these parameters are easy to tune.
13


Reviews:
[{"review_id": "rJlN0QoQ5S", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper is about a novel method to detect unknown samples which are of a different class than the trained ones. The idea is to use an output subnet which use a fully connected layer and a binary tree which encode the product relationship instead of the sum currently used in state of the art method (particularly the softmax with low confidence). The binary tree is made of split nodes which are responsible to produce a probability distribution from the root to each leaf. The max path i.e. the path with the largest probabilities determines the class of the input and can be used to measure how confident the classifier is about the classification decision. Combine multiple subnets and the tool obtained is able to do complex predictions and maintain a good generalization performance. The method also uses an information theory based regularization which decrease the probability of having subnets with uniform probability distribution i.e. a large entropy. Experiments on CIFAR-10 and MNIST against CIFAR-100, SVHN show that the method has an improved rejection accuracy while maintaining a good classification accuracy on the test set.\n\nThe topic of the paper is interesting and the approach seems to be solid, however the experiments are not so convincing. They are limited on two very easy datasets and do not show if the method is able to scale when more difficult and more realistic amount of classes are considered (like in CIFAR-100, SVHN or maybe ImageNet). Given that a simple dataset like these require 9 hour of training, it is also not clear how much the method is able to scale computationally and if it is applicable realistically. Moreover the presentation could be improved as figure 1 and its section 2 are complex and not easy to follow at several points. Hence, I’m leaning towards rejecting this paper.\n\nIn particular:\n- It would be interesting to see experiments where the number of classes is higher than the ones in MNIST and CIFAR-10. CIFAR-100 and SVHN would be a good testbed for such case.\n- How is the complexity of the method and how does it scale with the number of training classes?\n- It is stated that the method bring a 25% percentage points in the accuracy of unknown rejection detection, however table 1 shows a large improvement only in the case of SVHN. Hence the claims seems a bit off compared to the measured data. Moreover, using only CIFAR-10 is insufficient to back up the claim.\n- Why the related work section is at the end of the paper? It confuses the reader and would be more useful to be put after the introduction section.\n\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "Sye25E-3FS", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a neural network architecture for image classification, which can more accurately recognize the unknown class that is not presented in the training data than the prior work. The key idea is to organize the features into a binary tree and use the product of probabilities along the paths to the leaf node to predict whether the test image has all the relevant features that should present in known classes. This proposed method is compared to multiple baselines and demonstrates superior results in image classification, especially for correctly predicting the unknown class.\n\nI am not an expert in image classification. Thus I cannot judge based on the novelty of this paper. I vote for acceptance solely based on the clear writing, technical soundness, thorough evaluation and good results. The intuition behind the method that missing a key feature of a particular class should significantly reduce the probability of assigning the input to this class is well captured by the product of probabilities along a path in a binary tree structure. In other words, the proposed method makes sense intuitively and is validated on several datasets. One small concern that I have is that a binary tree explicitly partitions the feature into separated groups. For example, if for a known class, f11, f12 and f16 are the three important features to be present. According to Figure 1, there is no path that connects all these three nodes. Will different partitioning of the features affect the accuracy of the classification, including the unknown class?\n\nTo improve the paper, it would be great to add one more experiment to examine the effect of the ensemble, for example, by varying the number of product relationship module. \n\n-------------------------Update after rebuttal-------------------------\nThanks for your detailed response and the additional experiments. The response addressed my questions and concerns. Thus I will keep my original recommendation of acceptance.", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "ByxRE_5hFH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\nThis paper proposes the unknown-aware deep neural network (UDN), which can be used to discover out-of-distribution samples for neural network classifiers. Its main idea is to introduce PR subnets to model the product relationship instead of the dot product of regular networks, then it can avoid over-fitting. Experimental results demonstrate that UDN can discover unknown samples more precisely than several baselines.\n\nThe problem of learning with out-of-distribution samples is important for real-world applications. The results provided in this paper seem positive. However, I think the main idea is not well explained, and the experiments provided are not sufficient. It’s not clear why introducing this PR subnet forest can help the model avoid overfitting, and why this structure is more beneficial than other simple ensemble structures. I think it’s more helpful to provide additional insights or theoretical analysis. As for the experiments, the contents of images in CIFAR, SVHN, and MNIST are completely different, so under the given setting, the unknown samples are easy to detect. It’s more practical and convincing to split categories in each dataset into two parts to simulate unknowns.\nBelow are some detailed comments:\n-      Can you compare the performance of UDN with Bayesian neural networks, since BNNs are also popular methods to model uncertainty?\n-      How does the hyper-parameters for PR subnets affect the results? \n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes the unknown-aware deep neural network (UDN), which can discover out-of-distribution samples for CNN classifiers. Experiments show that the proposed method has an improved rejection accuracy while maintaining a good classification accuracy on the test set. Three reviewers have split reviews. Reviewer #2 provides positive review for this work, while indicating that he is not an expert in image classification. Reviewer #1 agrees that the topic is interesting, yet the experiment is not so convincing, especially with limited and simple databases. Reviewer #3 shared the similar concern that the experiments are not sufficient. Further, R3 felt that the main idea is not well explained. The ACs concur these major concerns and agree that the paper can not be accepted at its current state.
Decision: Reject