Detecting Out-of-Distribution Inputs to Deep Generative Models Using Typicality
Authors: Eric Nalisnick
Akihiro Matsukawa
Yee Whye Teh
Balaji Lakshminarayanan
Venue:  (2020)
Keywords: Deep generative models
out-of-distribution detection
safety

Abstract: Recent work has shown that deep generative models can assign higher likelihood to out-of-distribution data sets than to their training data [Nalisnick et al., 2019; Choi et al., 2019].  We posit that this phenomenon is caused by a mismatch between the model's typical set and its areas of high probability density.  In-distribution inputs should reside in the former but not necessarily in the latter, as previous work has presumed [Bishop, 1994].  To determine whether or not inputs reside in the typical set, we propose a statistically principled, easy-to-implement test using the empirical distribution of model likelihoods.  The test is model agnostic and widely applicable, only requiring that the likelihood can be computed or closely approximated.  We report experiments showing that our procedure can successfully detect the out-of-distribution sets in several of the challenging cases reported by Nalisnick et al. [2019].

Under review as a conference paper at ICLR 2020
DETECTING OUT-OF-DISTRIBUTION INPUTS TO DEEP GENERATIVE MODELS USING TYPICALITY
Anonymous authors Paper under double-blind review
ABSTRACT
Recent work has shown that deep generative models can assign higher likeli- hood to out-of-distribution data sets than to their training data (Nalisnick et al., 2019; Choi et al., 2019). We posit that this phenomenon is caused by mis- match between the model's typical set and its areas of high probability density. In-distribution inputs should reside in the former but not necessarily in the latter, previous work has presumed (Bishop, 1994). To determine whether or not inputs reside in the typical set, we propose statistically principled, easy-to-implement test using the empirical distribution of model likelihoods. The test is model ag- nostic and widely applicable, only requiring that the likelihood can be computed or closely approximated. We report experiments showing that our procedure can successfully detect the out-of-distribution sets in several of the challenging cases reported by Nalisnick et al. (2019).
INTRODUCTION
Recent work (Nalisnick et al., 2019; Choi et al., 2019; Shafaei al., 2018) showed that variety of deep generative models fail to distinguish training from -ut-o--distribttion (OOD) data according to the model likelihood. This phenomenon occurs not only when the data sets are similar but also when they have dramatically different underlying semanties. For instance, Glow (Kingma & Dhariwal, 2018), a statc-of-the-at normalizing flow, trained on CIFAR-IU 10 will assign a higher likelihood to SVHN than to its CIFAR-10 training data (Nalisnick al., 2019; Choi et al., 2019). This result is surprising since CIFAR-10 10 contains images of frogs, horses, ships, trucks, etc. and SVHN contains house numbers. A human would be very unlikely confuse the two sets. These findings also troubling from an algorithmic standpoint since higher OOD likelihoods break previously proposed methods for classifier validation (Bishop, 1994) and anomaly detection (Pimentel et al., 2014).
We conjecture that these high OOD likelihoods are evidence of the phenomenon of typicality.' ! Due to concentration of measure, a generative model will draw samples from its typical set (Cover & Thomas, 2012), subset of the model's full support. However, the typical set may not necessarily intersect with regions of high probability density. For example, consider a d-dimensional isotropic Gaussian. Its highest density region is at its mode (the mean) but the typical set resides at distance of Vd from the mode (Vershynin, 2018). Thus point near the mode will have high likelihood while being extremely unlikely to be sampled from the model. We believe that deep generative models exhibit a similar phenomenon since, to return to the CIFAR-10 10 vs SVHN example, Nalisnick et al. (2019) showed that sampling from the model trained on CIFAR-10 never generates SVHN-looking images despite SVHN having higher likelihood.
Based on this insight, we propose that OOD detection should be done by checking if an input resides in the model's typical set, not just in region of high density. Unfortunately it is impossible to analytically derive the regions of typicality for the vast majority of deep generative models. To define a widely applicable and scalable OOD- algorithm, we formulate Shannon (1948)'s entropy-based definition of typicality into a statistical hypothesis test. To ensure that the test is robust
'Choi et al. (2019) also consider typicality as an explanation but ultimately deem it not to be a crucial factor. Nalisnick et al. (2019) implicitly mention typicality in their discussion of the transformed representa- tions' proximity to the mean and explicitly in comment on Open Review: https: /pppnreviiiieeeeeeeee ew. n forum2 i 6-H1 xwNhCeYm vmacCccmmnna.... G=Hkgl.wfvel

---

Under review as a conference paper at ICLR 2020
vd
ava
PROBABILITY DENSITY
Highest Density
TYPCAL Set
PROBABILITY
Samples
VOLUME
(od
DISTANCE FROM MODE
DISTANCE FROM MODE
(a) Gaussian Example
(b) Illustration
(c) Simulation
Figure 1: Typical Sets. Subligure (a) shows the example of Gaussian with its mean located the high-dimensional all-gray image. Subfigure (b) shows how the typical set arises due to the nature of high-dimensional integration. The figure is inspired by Betancourt (2017)'s similar illustration. Subfigure (c) shows our proposed method (Equation 3, higher è implies OOD) applied to a Gaussian simulation. The values have been re-scaled for purposes of visualization.
even in the low-data regime, we employ bootstrap procedure (Efron & Tibshirani, 1994) to set the OOD-decision threshold. In the experiments, we demonstrate that our detection procedure succeeds in many of the challenging cases presented by Nalisnick et al. (2019). In addition to these successes, we also discuss failure modes that reveal drastic variability in OOD detection for the same data set pairs under different generative models. We highlight these cases to inspire future work.
BACKGROUND: TYPICAL SETS
The typical sei of probability distribution is the whose elements have information content sufficiently close to that of the expected information (Shannon, 1948). A formal definition follows.
Definition 2.1 (e, (e.N))TTprin -yypiall Set (Cover Thomas, 2012) For a distribution p(x) with support X, the (trypicl set A [p(x)] X is comprised of all N- N-length sequences that satisfy
H[[(x)] - c
p(z)............. IN) H[[p())] +
N
where [H[p(())] p(x) plogp((x))) ddx and RR is small constant.
When the joint density in Definition 2.1 factorizes, write:
H[p(x)] - S
logg(wx) S H[[p())] +
This is the definition we will use from here forward as we assume both training data and samples from our generative model are identically and independently distributed (i.i.d.). In this factorized form, the middle quantity can be interpreted as an N N-sample empirical entropy: 1/N Σm= lologgi p(æn) = N [p(x)]. The asymptotic equipartition property (AEP) (Cover & Thomas, 2012) states that this estimate will converge the true entropy N co.
To build intuition, let p(x)= = N(O, T²T) and consider its (c. 1)-typical set. Plugging in the relevant quantities to Equation and simplifying, have x E (2 if H [ ||x x1l//o² < where d denotes dimensionality. See Appendix A.I for a complete derivation. The inequality will hold for any choice of if | #112 ovd. In turn, we can geometrically interpret A! N((,, II as an annulus centered at with radius o and whose width is function of (and σ). This is a well-known concentration of measure result often referred to as the Gaussian Annulus Theorem (Vershynin, 2018). Figure ((a) illustrates Gaussian centered on the all gray image (pixel value 128). We show that samples from this model never resemble the all gray image, despite it having the highest probability density, because they drawn from the annulus. In Figure 1(b) we visualize the interplay between density and volume that gives rise to the typical set. The connection between typicality and concentration of measure can be stated formally as:
2

---

Under review as a conference paper at ICLR 2020
Theorem 2.1 Probability of the Typical Set (Cover & Thomas, 2012) For N sufficiently large, the rypical set has probability
P (p(x)) > -.
This result speaks the central role of typical sets in compression: A is efficient representation of X as it is sampled under pxx). Returning to the Gaussian example, we could 'compress' R under ((0, I²I) to just the σV d-radius annulus."
3 A TYPICALITY TEST FOR OOD INPUTS
We next describe our core contribution: a reformulation of Definition 2.1 into scalable goodness- of-fit test to determine if batch of test data was likely drawn from given deep generative model.
3.1 SETTING OF INTEREST: GOODNESS-OF-Fi TESTING FOR DEEP GENERATIVE MODELS
Assume we have generative model p(x; -itwith & denoting the parameters that was trained on data set X {a1. ................................ 2 }. Take x be high-dimensional (d > 500) and N to be sufficiently large (N > 25, 000) so as to enable training a high-capacity neural-networf parametrized model-a so-called 'deep generative model' (DGM). Furthermore, we assume that p(x; 0) has likelihood that can be evaluated either directly or closely approximated via Monte Carlo sampling. Examples of DGMs that meet these specifications include normalizing flows (Tabak & Turner, 2013) such as Glow (Kingma& & Dhariwal, 2018), latent variable models such variational autoencoders (VAEs) (Kingma & Welling, 2014; Rezende et al., 2014), and auto-regressive models such as PixelCNN (van den Oord et al., 2016). We do not consider implicit generative models (Mohamed & Lakshmi- narayanan, 2016) (such as GANs (Goodfellow et al., 201 2014)) due to their likelihood being difficult to even approximate.
The primary focus of this paper is in performing goodness-of-fi (GoF) test (D' Agostino, 1986; Huber-Carol et al., 2012) for p(x; 0). Specifically, given an M-sized batch of test observations = f Ba} (M 2 1), we desire to determine if was sampled (ii.d.) from pe or from some other distribution q * Pg- We assume knowledge of g, thus making our desired GoF test omnibus (Fubank& & LaRiccia, 1992). The vast majority of GoF tests operate via the model's cumu- lative distribution function (CDF) and/or being able compute an empirical distribution function (EDF) (Cramér, 1928; Massey Jr, 1951; Anderson & Darling, 1954; Stephens, 1974). However, the CDFs of DGMs are not available analytically, and numerical approximations are hopelessly slow due to the curse of dimensionality. Likewise, EDFs lose statistical strength exponentially as dimen- sionality grows (Wasserman, 2006). Our goal is to formulate scalable test that does not rely on strong parametric assumptions (e.g. Chen & Xia (2019)) and has better computational properties than kernel-based alternatives (e.g. Liu al. (2016)).
3.2 HYPOTHESIS TEST FOR TYPICALITY
Returning to the results of Nalisnick al. (2019) and Choi et al. (2019), the high-dimensionnllty of natural images (d = 3072 for CIFAR and SVHN) alone is enough to suspect the influence of phenomena akin to the Gaussian Annulus Theorem. Yet there are stronger parallels still: Nalisnick et al. (2019) showed that the all-black image has the highest density of any tested input to their MaSSionMNIST DGM, but this model is never observed to generate all-black images. Thus we are inspired to critique DGMs not via density but via typical set membership:
if X E A. [p(x: 0)] then X ~ p(x;
otherwise X xxp(x;0 0).
(2)
The intuition is that if X is indeed sampled from pe, then with high probability it must reside in the typical set (Theorem 2.1). To determine if X AM [p(x; 0)), we can plug X into Equation
While AN not the smallest high-probabiliity set (Polonik, 1997) and therefore not the most efficient compression, its size is of the same order (Cover & Thomas, 2012). 'The reader may have noticed Theorem 2.1 requires 'N sufficiently large' but in the Gaussian example assumed N = 1. For high-dimensional factorized likelihoods,, log p(x) = Σ log p(x,), and thus we can interpret Definition 2.1 as acting dimension-wer instead of across observations.
3

---

Under review as a conference paper at ICLR 2020
length M sequence and check if the e-bound holds:
1 M Σ
if
logp(mm;: 0) H[p(x;;)) =ês then X A (x(:: 0)),
(3)
where denotes the test statistic. We provide a sanity check for Equation in Subfigure I(c), showing é calculated for the high-dimensional Gaussian example described in Section 2. We see that é achieves its minimum value exactly at Vd-distance from 128.
In Appendix A.2 we show that our test is consistent unless the alternative's typical set is subset of pe s: AM [x)] C AM [p(x: 0)]. This limitation is reasonable and expected given our funda- mental assumption in Equation 2. Since the size the typical set is upper bounded as a function of entropy-log |A [p(x: 0)] < [H[pp(x 0)] +c) (Cover & Thomas, 2012) the model entropy determines the probability of type-1l error: higher entropy implies a larger typical set, a larger set implies more chance of AM [q] S [M)re)) and higher degree of intersection leads to better chance of incorrectly failing to reject Ho Ø ~ Pg. Yet it is not uncommon to sacrifice consistency for generality when testing GoF (e.g. Chi-square vs Kolmogorov-Smirrov tests (Haberman, 1988)).
3.3 IMPLEMENTATION DETAILS
In an ideal setting, could mathematically derive the regions in X' that correspond the typical set (e.g. the Gaussian's 's annulus) and check if 2 resides within that region. Unfortunately. finding these regions is analytically intractable for neurallnetwork-Bee based generative models. A practical implementation of Equation 3 requires computing the entropy H x: 0)] and the threshold
Entropy Estimator The entropy of DGMs is not available in closed-forn and therefore we resort to the following sampling-basd based approximation. Recall from Subsection 2 that the AEP states that the sample entropy will converge to the true entropy as the number of samples grows. Since we have access to the model and can drawn a large number of samples from it, the empirical entropy should be a good approximation for the true model entropy:
s Σ
/ 0(x 0)]xx
H|p(x; 0)]
loggpp(g (f.; 0)
where ig ~ p(x: 9). However, in preliminary experiments (reported in Appendix E.1) we observed markedly better OOD detection when using alternative estimator known as the resubstitution estimator (Beirlant et al., 1997). This estimator uses the training set for calculating the expectation:
px(: 0)] R N RESUB (x( 0)]
log p O).
(5)
N
This approximation should good as well since we assume to be large.
Setting the OOD-Threshold with the Bootstrap Concerning the threshold c, we propose setting its value through simulation-by constructing a bootstrap confidence interval (BCI) (Efron, 1992; Arcones & Gine, 1992) for the null hypothesis Ho X E A [p(; 0)], with the alternative being H1 X É A [p(:; }) In a slight deviation from the tradition procedure for BCI construction, we assume the existence of validation set X' that was held-out from X before training the generative model (just as is usually done for hyperparameter tuning).The This is only to account for the generative model overfitting to the training set. From this validation set, bootstrap sample K 'new' data sets ( of size M and then plug each into Equation 3 in place of X:
1
Σ
AN log pe 0) HREsuB [p(x: 0)] EK
(6)
M
"The hias and variance of the resubstitution estimator are hard to characterize for DGMs. The work of Joe (1989) is related, describing its properties under multivariate kernel density estimators.
4

---

Under review as a conference paper at ICLR 2020
where EK is the estimate for the kth bootstrap sample. All K estimates then form the bootstrap distribution F(c) # E K(eg]- Calculating the a-quantile of F(c), which we denote as ea determines the threshold at which we reject the null hypothesis with confidence-level a (Arcones & Gine, 1992). If we reject the null, then we decide that the sample does not reside in the typical set and therefore is OOD. The complete procedure is summarized in Algorithm 1 in Appendix B. Observe that nearly all of the computation can be performed offline before any test set is received, including all bootstrap simulations. The rejection threshold < depends on particular M and or setting, but these computations can be done parallel across multiple machines. The most expensive test-time operation is obtaining log 0). After this is done, only an (M)) operation to sum the likelihoods is required.
4 RELATED WORK
Goodness-of-Fit Tests As mentioned in Section 3.1, many of the traditional GoF tests are not applicable to the DGMs and high-dimensional data sets that we consider since CDFs and EDFs are both intractable in this setting. Kernelized Stein discrepancy (Chwialkowski et al., 2016; Liu al., 2016) is a proopoodd GoF test that can scale to the DGM regime, and we compare against it in the experiments. Several works have proposed GoF tests based on entropy (Gokhale, 1983; Parzen, 1990)-es e.g. for normal (Vasicek, 1976), uniform (Dudewicz & Van Der Meulen, 1981), and exponential (Crzegorzewski Wirezorkowski, 1999) distributions. However; these tests are derived from maximum entropy results and not motivated from typicality. There are also directed GoF tests such as ones based on likelihood ratios (Neyman & Pearson, 1933; Wilks, 1938) or discrepancies such KL divergence (Noughabi & Arghami, 2013). These tests require q. which may be difficult in many DGM-appropriate scenarios. Yet the recent work of Ren et al. (2019) does apply likelihood ratios to PixeICNNs by constructing q such that it models background process (i.e. some perturbed version of the original data).
explicit definition of
Typical and Minimum Volume Sets We are aware of only two previous works that use notion of typicality for GoF tests or OOD) detection. Sabeti & Hst-Madsen (2019) propose a typicality frame- work based on minimum description length. They deem data as 'atypical' if can be represented in less bits than one would expect under the generative model. While our frameworks share the same conceptual foundation, Sabeti Hst-Madsen (2019)'s implementation relies on strong parametric assumptions and cannot be generalized to deep models (without drastic approximations) Choi et al. (2019), the second work, leverages normalizing flows to test for typicality by transforming the data to a normal distribution and then deeming points outside the annulus to be anomalous. This ap- proach restricts the generative model to be a Gaussian normalizing flow whereas ours is applicable to any generative model with computable likelihood. Our work is also related to the concept of minimum volume (MV) sets (Sager, 1979; Polonik, 1997; Garcia et al., 2003). MV sets have been used for GoF testing (Polonik, 1999; Glazer al., 2012) and to detect outliers (Platt et al., 2001; Scott & Nowak, 2006; Clémençon et al., 2018). However, we are not aware of any work that scales MV-set-based methodologies to the degree required to be applicable DGMs.
Generative Models and Outlier Detection Probabilistic but non-test- techniques have also been widely employed to discover outliers and anomalies (Pimentel et al., 2014). One of the most common is to use a (one-sided) threshold on the density function to classify points as OOD (Bar- nett et al., 1994); this idea is used in Tarassenko (1996), among others. Other work has applied more sophisticated techniques to density function evaluations for instance, Clifton et al. (2014) applies extreme value theory. Yet this work and all others of which we are aware do not identify points with abnormally high density as OOD. Thus they would fail in the settings presented by Nalisnick et al. (2019). As for work focusing on DGMs in particular, most previous work proposes training improvements to make the model more robust. For instance, Hendrycks et al. (2019) show that robustness and uncertainty quantification w.r.t. out- liers can be improved by exposing the model to auxiliary data set (a proxy for OOD data) during training. As for post-training outlier and OOD detection, Choi et al. (2019) proposes using an en- semble of models to compute the Watanabe-Akaike information criterion (WAIC). However, there no rigorous arguments for why WAIC should quantify GoF. Škvára et al. (2018) proposes using a VAE's conditional likelihood as an outlier criterion, finding that this works well only when the hyperparameters can be tuned using anomalous data. As far as we are aware, we are the first to
al. (1995) Bishop (1994), and Parra et al.
5

---

Under review as a conference paper at ICLR 2020
apply hypothesis testing framework to the problem of OOD anomaly detection for DGMs. As mentioned above, Ren et al. (2019) use likelihood ratios, but they do not perform a hypothesis test.
5 EXPERIMENTS
We now evaluate our typicality test's OOD detection abilitics, focusing in particular on the image data set pairs highlighted by Nalisnick et al. (2019). We use the same three generative models as they did Gld-Glow (Kingma & Dhariwal, 2018), PixelCNN (van den Oord et al., 2016), and Rosca et al. (2018)'s VAE architecture- attempting to replicate training and evaluation as closely as possible. See Appendix C for a full description of model architectures and training. See Appendix D for more details on evaluation. We consider the following baselines all statistical tests use a 0.99:
1. t t-test: We apply two-sample students' t-test to check for difference in means in the em- pirical likelihoods. In terms of Equation 3, this baseline will reject for any e > O, and thus we expect it to be overly conservative. Moreover, this test does not have access to validation data and therefore improvements upon it can be attributed to our bootstrap procedure.
2.
Kolmogorov-SS Smi rnov test (KS-test): We apply a two-sample KS-test to the likeli- hood EDFs. This test is stronger than our typicality test since it is checking for equivalence in all moments whereas ours (and the t-test) is restricted to the first moment. In turn, this test has a greater computational complexity-O(an log M) compared (M).
3. Max i mum Mean Di Discrepancy (MMD): : We apply two-sample MMD (Gretton et al., 2012) test to the data directly. Yet we incorporate the generative model by using a Fisher ker- nel (Jaakkola & Haussler, 1999). We also apply the same bootstrap procedure on validation data to construct the test statistic. MMD has greater runtime still at O(N It also requires access to (a subset of) the training data at test-time, which is undesirable.
4. Kernelizee lized Stein Discrepancy (KSD): We apply KSD (Liu et al., 2016) to test for GoF to the generative model and again use Fisher kernel and the bootstrap procedure on vali- dation data. KSD has runtime (d. While we have ignored the construction of the kernel in the runtime analysis, KSD is the most costly since it requires computing three model gradients.
5. Annulus Method: We use a modified version Choi et al. (2019)'s s annulus method applied to Gaussian normalizing flows. Like them, we classify something OOD based on its distance to the sphere with radius vd. This is essentially performing test but via closed-form expres- sions for entropy made available by the Gaussian base distribution. We use the same bootstrap procedure validation data to set the 'slack' variable
We first evaluate our typicality test on grayscale images. We trained a Glow, PixeICNN, and VAE each on the FashionMNIST training split and tested OOD detection using the MNSHionMNIST, MNIST, and NoTMNIST test splits. We use the FashionMNIST test split to evaluate for I error (incorrect rejection of the null) and the MNIST and NotMNIST splits for type- error (incorrect rejection of the alternative). In Figure 2 we show the empirical distribution of likelihoods over each data set for each model. We see the same phenomenon as reported by Nalisnick et al. namlly that the MNIST OOD test set (green) has a higher likelihood than the training set (black). Lower-sided thresholding (Bishop. 1994) would clearly fail to detect the OOD sets. Table reports comparison against baselines, showing the fraction of M- batches classified OOD. The IN-DIST. column reports the value for the FashionMNIST test set and idcally this number should be 0.00; any deviation from zero corresponds to type-I error. Conversely, the MNIST and NOTMNIST columns should be 1.00, and any deviation corresponds to type-Il II error. We see that for M = 2 all tests find it hard to reject the null hypothesis, which is not surprising given the overlap in the histograms in Figure 2. The exceptions are the annulus method for NotMNIST-Gloww (96%), the typicality test for MNIST-PixeICNT (56%), and all methods except KS-test for NotMNIST- VAE. One failure mode for almost all methods is NotMNIST for the PixelCNN. None of the likelihood- based tests can distinguish NoTM as OOD due to the near perfect overlap in histograms shown in Figure 2(b). KSD and especially MMD are able to perform better in this case due to having access to the original feature-space representations (in addition to the generative model). Yet, surprisingly, KSD and MMD perform comparatively poorly for MNIST, especially at M 10 and M 25. The
Grayscale Images
We could not replicate the performance of WAIC reported by Choi et al. (2019). See Appendix F.2.

---

Under review as a conference paper at ICLR 2020
Normelizedd Histoggrn em
MECTTET Porker
Normalized Histagran
MAST-TEST
MASTTEST
03311
INEMESS
C.00
SSNNINNNSSS--MMM TRANN Fesl ian MNSTTTT
Seeelleeeee Hatoggr
0130
NoEMNIST-TEE TEST
0330
22002
Mot Moremaa Moummalli
0:30
C2005
0130
-241
-3000
-3500
-2000
-3000
-1089
-000
-X03
-1530
-2830
-3500
-2006
-244
-3900
-3500
-1000 log
-2000
-2009
log
12
(a) Glow Log-Likelihoode
(b) PixelCNN Log-Likelihoods
(c) VAE Log-Likelihoods
Figure 2: Empirical Distribution of Likelihoods. The above figure shows the histogram of log- likelihoods for FaSHionMNIST (train, test), MNIST (test), and NotMNIST (test) for the (a) Glow, (b) PixelCNN, and (c) VAE.
Table I: Grayscale Images: Fraction of M M-Sized Batches Classified as OOD. The in-distribution column reflects type-I enror and the MNIST and NotMNIST columns reflect II. M = 25
M= 2
M 10
MATHOD
IN-DIST.
MNIST
NorMNIST IN-DIST.
MNIST
NorMNIST
IN-DIST.
MNIST
NOTMNIST
Glow Trained FashionMNIST
Typicality Test
0.02
0.14__10
0.08
0.021.02 02
1.00
0.691
0.01
1.001.00
1.00
T-Tost
0.01
0.08=.c
0.06=
0.01
1.00=000
0.67s.01
0.01
1.00=.00
0.992.00
KS- Test
0.00 on
0.
0.001 on
0.01
1.00
0.61
0.001.00
1. 1.001.00
0.98...1
Max Mean Dis.
0.055.02
0.17
0.04 oz
0.02:..2
0.63=.12
0.37
0.045.04
1.00:.0
1.00
Kern. Stein Dis.
0.05=.06
0.16=.14
0.01
0.01#.01
0.21=.11
0.01s.00
0.02#.05
0.76s.21
0.00+.00
Annulus Methou
0.01
0.00..co
0.9
0.022.00
0.00=..
1.00s.m
0.03s.u
0.00s.00
1.00
PiselCNN Trained on FoshionMNIST
Ty picaliity Test
0.033=.01
0.56=.18
0.001
0.04=.02
1.00=.00
0.05s.03
1.00=.00
T-Test
0.01=:00
0.23=.co
0.00= on
0.01=.00
1.00=.00
0.00s. 00
0.02=.00
1. 1.00=.00
0.00s.00
Tes-
0.00
c.
0.00=
0.022.00
1.00
0.00s
0.04g.0
1.00
0.01
Max Mcan Dis.
0.02=.00
0.05= 01
0.36=
0.05=.02
0.27=.06
1. 1.00=.00
0.06#.04
0.59
1.00s.00
Kern. Stein Dis.
0.01
0.05=
0.08
0.022.01
14
0.61
0.05 oz
0.70
0.90
VAE Trained on FashionMNIST
Typicality Test
1.03
0.37..05
0.99..00
0.04
0.94_.oz
1.00
0.041.m
0.96..m
1.00
T-Test
(1011
0.200..o
0.99:.u uu
0.02
0.
1.00s.m
0.025.00
0.96:.u
1.00
KS-Test
0.00=.00
0.00=.co
0.00=.00
0.02s.00
1.00=.0
1.00=.00
1.00s:00
Mas Mean Dis
0.033..u
0.16
0.73:..1
0.033...
0.41=.:8
1.00s.0
0.01
0.64:.us
1.00
Kemn Stein
0.04s..0
0.05=.1
0.71=.00
0.11s.04
0.17=.01
1.00=.00
0.06s.04
0.37s.03
1.00s.00
annulus method was unable to detect MNIST, which we found surprising given its close relationship to our typicality test, which does perform well. Yet Choi et al. (2019) note that Gaussian normalizing flows do not necessarily make the latent space normally distributed, and our typicality test may be able to use information from the volume element that is not available to the annulus method.
Natural Images We next turn to data sets of natural images in particular SVHN CIFAR-10 10, and ImageNet. We train Glow SVHN, CIFAR-10 10, and ImageNet and use the non-training sets for OOD evaluation. We found using MMD and KSD to be too expensive to make OOD decisions in an online system. Table reports the fraction of M-sized batches classified as OOD. We see that our method (first row, bolded) is able to easily detect the OOD sets for SVHN, rejecting size-two batches the rate of 98%+ while having only 1% I error. Performance on the IIF-R-I0-traiied model is good as well with 42%+ of OOD batches detected at M = 2 and 100% at M = 10 (type-I error 1% in both cases). The hardest case Glow trained on ImageNet: the KS-test performed best at M = 25 with 89%, followed by the t- and typicality tests at 72% and 74% respectively. The annulus method again had varying performance, being conspicuously inferior at detecting SVHN for the CIFAR and ImageNet models while having the best performance ImageNet for the CIFAR model. We report additional results in Appendix E.3 for our method, showing performance for all M E [1, 150) and when using CIFAR- 100
OOD set.
Lastly, we report two challenging cases worthy of note and further attention. Figure 3(a) shows method applied to Glow when trained on CIFAR-10, 10, tested 100. The y-axis again shows fraction of batches reported as OOD and the r-axis the batch size M. Even at M = 150 our method classifies only ~ 20% of batches OOD, Yet this result is not surprising given that CIFAR-
7

---

Under review as a conference paper at ICLR 2020
Table 2: Natural Images: Fraction of M-Sized Batches Classified as OOD.
M M
M
M
METHOD
SVHN
CIFAR-I0
IMAGENET
SVHN
CIFAR-10
IMAGRNET
SVHN
CIFAR-10
IMAGRNET
Glas Trained
SVHN
Typicality Test
0.011.00
0.98
1.00_.m .0
1.00 n0
1.001 on
1.00
0.021.00
1.00
1.001.c0
t-Test
0.00=.00
0:95=.00
1.00=.00
0.04
1.00::00
1.00
0.03+.00
1.00=.00
1.00+:00
KS-Test
0.00
0.00=.00
0.00=.00
0.08-000
1.00= 00
1.00=:00
0.03++00
1.00=.00
1.00+.00
Annulus Method
0.02s.01
0.70z.05
1.00=.00 00
0.02=
1.00s 00
1.00
0.00s 00
1.00 00
1.00
Glow Trained on CZFAR-10
Typicality Test
0.422.m
0.01==.0
0.64=.04
1.00
0.01+:01 01
1.00=.00
1.00+:00
0.01#.01
1.00+:00
1-Test
0.44=.01
0.01=.00
0 6665= 00
1.00=.00
0.02+.00
1.00
1.00# 20
0.02+.00
1.00+:00
KS-Test
0.00g
0.00 0.00
0.00g.00 00
1.00
0.01::00 00
0.98
1.00 00
0.01#:00
1.00+:00
Annulus Method
0.001.ux
0.02_..0 .o
0.87__.s 0s
0.19
0.031.00
1.00
0.35
0.041.00
1.001.00
Glow Trained on ImageNet
Typleality Test
0.78=.05
0.02=.01
0.01= 00
1.00 00
0.20++.0 06
0.01=:01
1. 1.00 20
0.74+.00 DG
0.01+:01
1-Test
0.76g
0.02g.00
0.0 00
1.00
0.181.01
0.01::00
1.001 00
0.724.01
0.014:00
KS-Test
0.00=.0.
0.00=000
0.00=.00
1.00=:00
0.01+:00
1.00+:00
0.89+.01
0.02+.00
Annulus Method
0. 0.00= n0
0.03 no
0.02g 01
0.02 02
0.152.04 04
0.02
0.162 04
0.574.12
0.022.c0
10 is subset of CIFAR-100, which means that our test's subset assumptions for consistency violated. More interesting is the case of Glow trained on CelebA, tested on CIFAR-10 and CIFAR- 100. Figure 3(b) shows the histogram of log-likelihoods: all distributions peak at nearly the same value. The distribution of e observed during the bootstrap procedure (M = 200) is shown in Figure ((c), with the red and black dotted lines denoting computed using the whole set. We see that for the OOD set is even less than the in-distribution's s, meaning that it would be impossible to reliably reject the OOD data while not rejecting the in-distribution test set as well. Interestingly, PixeICNN and VAE do not have as dramatic of an overlap in likelihoods-a phenomenon that can also be observed in Figure --wiich implies that the ability to detect OOD sets does not only depend on the data involved but the models as well. Some models may have likelihood functions that are reliably discriminative, and this presents an intriguing area for future work.
fraction Batches Clezziffed as
06.
ID: CIFARIO-TEST
COD: CIFARI0O-TEST
Mormallzed Hilctorram
01000
GERPATEST
0.000
OOD: CIFAR-10 Boctstrap Dist.
ID: CelobA
DEFRID TOST
26-
01000
2.-
100002
0.004
0.000
01002
40-
120
120
340
0/003
0.000
300
(M)
log p(x)
(a) Glow: CIFARIO vs CIFARI00
(b) Glow: CelebA vs CIFARs
(c) Bootstrap Dist. (M = 2000
Figure 3: Challenging Cases: CIFAR- vs CIFAR- 100, CelebA vs CIFAR's. s.
DISCUSSION AND CONCLUSIONS
We have presented a derived from the concept of typical sets. In the experiments we showed that the proposed test is especially well-suited to DGMs, identifying the OOD set for SVHN vs CIFAR-10 vs ImageNet (Nalisnick et al., 2019) with high accuracy (while maintaining < 1% type-I error). this work we used the null hypothesis Ho X E AAM, which was necessary since we assumed access to only one training data set. One avenue for future work is use auxiliary data sets (Hendrycks et al.,
and computationally efficient statistical test for OOD inputs
2019) to construct a test statistic for the null Ho : X & A as would be proper for safety-critical applications. In our experiments we also noticed two cases- PixelCNN trained on FashionMNIST.. tested on NotMNIST and Glow trained on CelebA, tested on CIFAR- in which the empirical distri- butions of in- and distribution produced by DGMs has a fundamental limitation that is seemingly worse than what was reported by Nalisnick al. (2019).
likelihoods matched near perfectly. Thus use of the likelihood
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Theodore W Anderson and Donald A Darling. A Test of Goodness of Fit. Journal of the American statistical association, 49(268):765-66, 1954.
Miguel A Arcones and Evarist Gine. On the Bootstrap of U and V Statistics. The Annals of Statistics, pp. 655 655,674, 1992.
V. Barnett, P.S.V. V. Barnett, and T. Lewis. Outliers in Statistical Data. Wiley Series in Probability and Statistics. Wiley, 1994.
Jan Beirlant, Edward Dudewicz, Lászłó Györfi, and Edward C Van der Meulen. Nonparametric En- tropy Estimation: An Overview. International Journal of Mathematical and Statistical Sciences, 6(1):17-39, 1997.
Michael Betancourt. A Conceptual Introduction to Hamiltonian Monte Carlo. ArXiv e-print, 2017.
Christopher M Bishop. Novelty Detection and Neural Network Validation. IEE Proceedings- Vision, Image and Signal processing, 141(4):217-222, 1994.
Mikoaj Bikowski, Dougal J. Sutherland, Michael Arbel, and Arthur Gretton. Demystifying MMD GANs. In International Conference on Learning Representations (ICLR), 2018.
Hao Chen and Yin Xia. A Nonparametric Normality Test for High-dimensional Data. ArXiv e- Prints, 2019.
Hyunsun Choi, Eric Jang, and Alexander Alemi. WAIC, but Why?: Generative Ensembles for Robust Anomaly Detection. ArXiv e-Print arXiv:1810.01392s3, 2019.
Kacper Chwialkowski, Heiko Strathmann, and Arthur Gretton. A Kernel Test of Goodness of Fit. In International Conference on Machine Learning, pp. 2606-2615, 2016.
Stephan Clémençon, Albert Thomas, et al. Mass Volume Curves and Anomaly Ranking, Electronic Journal of Statistics, 12(2):2806-28) 2018.
David A Clifton, Lei Clifton, Samuel Hugueny, and Lionel Tarassenko. Extending the Generalised Pareto Distribution for Novelty Detection in High-Dimensional Spaces. Journal of Signal Pro- cessing Systems, 74(3):323-335 2014.
Thomas M Cover and Joy A Thomas. Elements of Information Theory. John Wiley & Sons, 2012.
Harald Cramér. On the Composition of Elementary Ertors. Scandinavian Actuarial Journal, 1928 (1):13-74,, 1928.
Przeniyslaw Crzegorzewski and Robert Wirezorkowski. Entropy- Based Goodness-of-Fi Test for Exponentiality. Communications Statistics Theory and Methods, 28(5):1 183-1202, 1999.
Ralph B D' Agostino. Goodness-of Techniques, volume 68. CRC press, 1986.
Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density Estimation Using Real NVP. In International Conference Learning Representations (ICLR), 2017.
Edward J Dudewicz and Edward C Van Der Meulen. Entropy- -ased Tests Uniformity. Journal of the American Statistical Association, 76(376):967-774, 1981.
Bradley Efron. Bootstrap Methods: Another Look at the Jackknife. In Breakthroughs in statistics, pp. 569-593. Springer, 1992.
Bradley Efron and Robert J Tibshirani. An Introduction to the Bootstrap. CRC press, 1994.
RL Eubank and VN LaRiccia. Asymptotic Comparison of Cramer-von Mises and Nonparametric Function Estimation Techniques for Testing Goodness-of-Fi The Annals of Statistics, 20(4): 2071-2086, 1992.

---

Under review as a conference paper at ICLR 2020
Javier Nuñez Garcia, Zoltan Kutalik, Kwang-Hyun Cho, and Olaf Wolkenhauer. Level Sets and Minimum Volume Sets of Probability Density Functions. International Journal of Approximate Reasoning, 34(1):25-44) 2003.
Assaf Glazer, Michael Lindenbaum, and Shaul Markovitch. Learning High-Density Regions for Generalized Kolmogorov-Smirnov Test in High-Dimensional Data. In Advances in Neural Information Processing Systems. pp. 728-736, 2012.
D.V. Gokhale. On Entropy-Based Goodness-off of-Fii Tests. Computational Statistics & Data Analysis, 1:157 165, 1983.
lan Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aäron Courville, and Yoshua Bengio. Generative Adversarial Nets. In Advances in Neural Infor- mation Processing Systems (NeurIPS), 2014.
Arthur Gretton, Karsten M Borgwardt, Malte Rasch, Bernhard Schölkopf, and Alexander Smola. A Kernel Two-Sample Test. Journal of Machine Learning Research, 13(Mar):723-773, 2012.
Shelby J Haberman. A Warning the Use of Chi- Chi-Squared Statisties with Frequency Tables with Small Expected Cell Counts. Journal of the American Statistical Association, 83(402):555-560 1988.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep Anomaly Detection with Outlier Exposure. In International Conference on Learning Representatiins (ICLR), 2019.
Catherine Huber-Carol, Narayanaswamy Balakrishnan, M Nikulin, and Mesbah. Gfodness-of-Fi Tests and Model Validity. Springer Science & Business Media, 2012.
Tommi Jaakkola and David Haussler. Exploiting Generative Models in Discriminative Classifiers. In Advances in Neural Information Processing Systems, pp. 487-493, 1999.
Harry Joe. Estimation of Entropy and Other Functionals of Multivariate Density. Annals of the Institute of Statistical Mathematics, ([(4):683-67,, 1989.
Diederik P. Kingma and Prafulla Dhariwal. Glow: Generative Flow with Invertible Ixl Convolu- tions. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
Diederik P Kingma and Max Welling, Auto-Encoding Variational Bayes. International Conference on Learning Representations (ICLR), 2014.
Qiang Liu, Jason Lee, and Michael Jordan. A Kernelized Stein Discrepancy for Goodness-of-Fit Tests. International Conference on Machine Learning, pp. 276-284, 2016.
Frank Massey Jr. The Kolmogorov-S Smiinoo Test for Goodness of Fit. Journal of the American Statistical Association, 46(253):68-78, 1951.
Shakir Mohamed and Balaji Lakshminarayanan. Learning Implicit Generative Models. ArXiv e-Print, 2016.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do Deep Generative Models Know What They Don't Know? In International Conference on Learning Representations (ICI.), 2019.
Jerzy Neyman and Egon Sharpe Pearson. On the Problem of the Most Efficient Tests of Statistical Hypotheses. Philosophical Transactions of the Royal Society of London, Series 231(694-006); 289-337, 1933.
Hadi Alizadeh Noughabi and Naser Reza Arghami. General Treatment of Goodness-of-Fit Tests Based on Kullback-Lein Information. Journal of Statistical Computation and Simulation, 83
(8):1556-1569 2013.
Lucas Parra, Gustavo Deco, and Stefan Miesbach. Statistical Independence and Novelty Detection with Information Preserving Nonlinear Maps. Neural Computation, 8(2):260-269, 1996.
10

---

Under review as a conference paper at ICLR 2020
Emanuel Parzen. Goodness of Fit Tests and Entropy. Technical report, Texas A&M University, Department of Statistics, 1990.
Marco AF Pimentel, David A Clifton, Lei Clifton, and Lionel Tarassenko. A Review of Novelty Detection. Signal Processing, 99:215-249, 2014.
John Platt, John Shawe- Taylor, Alex Smola, Robert C Williamson, et al. Estimating the Support of a High-Dimensional Distribution. Neural Computation, 2001.
Wolfgang Polonik. Minimum Volume Sets and Generalized Quantile Processes. Stochastic Pro- cesses and Their Applications, 69(1))1-24, 1997.
Wolfgang Polonik. Concentration and Goodness-of-Fit in Higher Dimensions: (Asymptotically) Distribution-Fret Methods. The Annals of Statistics,, 27(4):1210-122) 1999.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A DePristo, Joshua V Dillon, and Balaji Lakshminarayanan. Likelihood Ratios for Out-of-Distribution Detection, In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Danilo Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic Backpropagation and Approxi- mate Inference in Deep Generative Models. In Proceedings of the 31st International Conference on Machine Learning (ICML), pp. 1278-1286, 2014.
Mihaela Rosca, Balaji Lakshminarayanan, and Shakir Mohamed. Distribution Matching in Varia- tional Inference. ArXiv e-Print arXiv: /802.06847, 2018.
Elyas Sabeti and Anders Hst-Madsen. Data Discovery and Anomaly Detection Using Atypicality for Value Data. Entropy, 21(3), 2019.
Thomas W Sager. An Iterative Method for Estimating a Multivariate Mode and Isopleth. Journal of the American Statistical Association, 74(366a):329-333 1979.
Clayton D Scott and Robert Nowak. Learning Minimum Volume Sets. Journal of Machine
Learning Research, 7(Apr):665-70) 2006.
Alireza Shafaei, Mark Schmidt, and James J Little. Does Your Model Know the Digit 6 Is Not a Cat? A Less Biased Evaluation of "Outlier" Detectors. ArXiv e- e-Print 180.004909 2018.
Claude Elwood Shannon. A Mathematical Theory of Communication. Bell System Technical Jour- nal, 27(3):379 423. 1948.
Vít Škvára, Tomáš Pevný, and Václav Šmídl. Are Generative Deep Models for Novelty Detection Truly Better? KDD Workshop on Outlier Detection De-Constructed (ODD v5.0). 2018.
Michael A Stephens. EDF Statistics for Goodness of Fit and Some Comparisons. Journal of the American Statistical Association, (9(34)):300-73, 1974.
EG Tabak and Cristina V Turner. A Family of Nonparametric Density Estimation Algorithms. Communications on Pure and Applied Mathematics, 1662))145-164, 2013.
Tarassenko, P Hayton, N Cerneaz, and M Brady. Novelty Detection for the Identification of Masses in Mammograms. In 1995 Fourth International Conference on Artificial Neural Networks, pp. 442-447. IET, 1995.
Aäron den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et al. Condi- tional Image Generation with Pixel CNN Decoders. In Advances in Neural Information Process- ing Systems (NeurIPS), 2016.
Oldrich Vasicek. A Test for Normality Based on Sample Entropy. Journal of the Royal Statistical Society: Series B (Methodological). 38(1):54-555 59, 1976.
Roman Vershynin. High-Dimensionts Probability: An Introduction with Applications in Data Sci- ence, volume 47. Cambridge University Press, 2018
Larry Wasserman. All of Nonparametric Statistics. Springer Science & Business Media, 2006.
Samuel S Wilks. The Large-Sample Distribution of the Likelihood Ratio for Testing Composite Hypotheses. The Annals of Mathematical Statistics, 91):600-6, 1938.
11

---

Under review as a conference paper at ICLR 2020
A THEORETICAL PROPERTIES
A.1 CONNECTION BETWEEN ENTROPY AND GAUSSIAN ANNULUS
For the sake of completeness, we make explicit the connection between Definition 2.1 and the Gaus- sian annulus example. Plugging in the spherical Gaussian's 's entropy and density function into Equa- tion 1, we have:
<> dlog σ + d (1 + log 2n) dlogo o
1ll2
log 2n
Σ N
2
20²
n
n 2
n
For N I, we see that any point x that satisfies ||x
pl12 ovd guarantees the bound for any e:
(ovd)2 σ² 2
o²d
2 2
(8)
o²
Recalling Figure ((a), / is exactly the radius of the annulus which the Gaussian's mass con- centrates. Of course as grows, points further from or nearer to the mean than a a are included as typical. The behavior for finite N is harder to characterize, the definition is essential testing the e-bound for the average squared norm. Yet we know that for large samples + co.
1
D. - 1
E
d
N
which again allows the bound to hold for any
A.2 CONSISTENCY OF THE TEST
Below we show that the test presented in Section 3.2 is consistent unless A [x(x)] S A [p(x; [p(x; 0))
Proposition A.1 Po
When X p(x; 0), the test statistic
M Σ
log p (m: 0) HH[pH: 0)] = 2+ as + oo.
M
m=1
Proof: The result follows directly from the AEP (Cover & Thomas, 2012). Alternatvely, as 00, M MM log pggp(a.. @m: 0) -Ellog (x;; 0)). We then have
-Ellog (x: 0)] [x;: 0)] = KLD [r([ 0)lx(( 0)] 0.
Proposition A.2 Po + When X g(x) such that p(x; 0) + g(x) and (M(x()) g A [p(x; 0)}, the test staristic
M Σ ==
log p(mmi 0) Hlp((;; 00 as + 40. oo.
M
Proof (By Contradiction): As M + xc, To Em= lomm 0) - -E, plo 0)). Assume
that ([looop(;; 0)] [x]p( 0)] = 0 and that A [g(x)) I A [p(x; 0)). Then from Definition
2.1 we have
H[p(x)) - Egglog ((:: 0)]
H p x)] + c,
which implies that A [x) S AA [p(x; 0)] for sufficiently large M. This contradicts our assump- tion that A.M (x(x)) g A. 0)xx0)) and therefore (og [loggo(; 0)) Hpp(x: 0)] 0.
12

---

Under review as a conference paper at ICLR 2020
Algorithm A Bootstrap Test for Typicality
Input: Training data X, validation data X', trained model p(x: 0), number of bootstrap samples K, significance level a, M-sized batch of possibly OOD inputs X.
Offline prior to deployment
1. Compute [p(x;; [)] 0)]= E log p(z,; 0).
2. Sample M-sized data sets from X' using bootstrap resampling.
3. For all & E K):
Compute é
=1
Em= logp(ak, 0) - f [x(x; 0]] (Equation 6)
M
4. Set e -euuatiiteF((ee...mmm (e.g. a .99)
Online during deployment
If
m== logp(mm) - p(x;
p(x: 0) > >
Return X out-of-distributiin
Else:
Return
X is in-distribation
B ALGORITHMIC IMPLEMENTATION
The pseudocode of the procedure is described in Algorithm 1.
C GENERATIVE MODEL DETAILS
Glow Our Glow (Kingma & Dhariwal, 2018) implementation was derived from OpenAl's open source repository and modified following the specifications in Appendix of Nalisnick et al. (2019). All versions were trained with RMSProp, batch size of 32, with a learning rate of 1 x 10-5 for 100k steps and decayed by a factor of after 80k and 90k steps. All priors were chosen to be standard Normal distributions. We follow Nalisnick et al. (2019)'s zero-initialization strategy (last coupling layer set to zero) and turn did not apply any normalization. Similarly, our convolu- tional layers were initialized by sampling from the same truncated Normal distribution (Nalisnick et al., 2019). For our FashionMNIST experiment, Glow had two blocks ers (ACLs) (Dinh et al., 2017). The spatial dimension was only squeezed between blocks. For the SVHN, CIFAR-10, and ImageNet models, we used three blocks of ACLs with multi-scale factorization occurring between each block. All ACL transformations used three-layer highway network. 200 hidden units were used for fashionMNIST and 400 for all other data sets.
affine coupling lay-
PixeICNN We trained a GatedPixeICNN (van den Oord et al., 2016) using Adam (1 x 10-4 ini- tial learning rate, decayed by 1/3 at steps 80k and 90k, 100k total steps) for FaSH and RMSProp (1 x 10 initial learning rate, decayed by 1/3 at steps 120k. 180k, and 195k, 200k total steps) for other data sets. The FashionMNIST network had 5 gated layers (32 features) and 256-sized skip connection. All other networks used 15 gated layers (128 features) and 1024-sized skip connection
Variational Autoencoder We used the convolutional decoder VAE (Kingma & Welling, 2014) variant described by Rosca al. (2018). For Fashion MNIST, the decoder contained three convo- lutional layers with filter sizes 32, 32, and 256 and stides of 2, 2, and 1. Training was done again via RMSProp (I 10-4 initial learning rate, decay, 200k total steps). For all other models, followed the specifications in Rosca et al. (2018) Appendix K.
'https:// com/o l
13

---

Under review as a conference paper at ICLR 2020
D EXPERIMENTAL DETAILS
MMD and KSD Kernels We found that MMD and KSD only had good performance when using the Fisher kernel (Jaakkola & Haussler, 1999): k( 2t,) (Va log p(z;; 0))² Va log p(æ;; 0). All other kernels attempted required substantial tuning to the scale parameters and did not want to assume access to enough data to perform this tuning, The ineffectiveness of MMD on pixel- space has been noted previously (Bikowski al., 2018). Furthermore, we found the memory cost of implementing the traditional Fisher kernel to be quite costly for Glow, each vector having 2million+ elements. Hence in the experiments we use the kernel modified such that the derivative taken w.r.t.
the input (making it the likelihood score): k' k'; 2z)) (V æ. log p(z;;; 0))² V Va, log p(z 0).
Data Set Splits and Bootstrap Re-Samples For each data set we used the canonical train-test splits. To construct the validation set and perform bootstrapping, we extracted 5, 000 samples from = 50 data sets to calculate F(e). We didn't find using K 50 markedly change performance. We then extracted another 5, 000 samples from the test split, divided them into M-sized batches, and classified each other as OOD not according the various tests. We repeated this whole process 10 times, randomizing the instances in the validation and testing splits, in order to compute the means and standard deviations that are reported Tables and 2.
the test split and bootstrap sampled (with replacement)
a-Levll In preliminary experiments, we did not find a notable difference in type-ll error when using a 0.95 vs 0.99. Using the latter slightly improved type-I error and thus we used that value for all experiments and all methods.
E ADDITIONAL RESULTS
E. COMPARING ENTROPY ESTIMATORS
In the tables below, we report results comparing the two entropy estimators considered-the Monte Carlo approximation with samples from the model (Equation 4) vs the resubstitution estimator (Equation 5). We see that the samples-based estimator performs better in only setting, Fash- ionMNIST vs MNIST at M = 2. In all other cases, the resubstitution estimator performs equally well or better. In fact, the samples-bssed estimator could detect NotMNIST OOD at all, hav- ing 0% even at M = 10 and M = 25. This inferior performance is mostly due to the distribution of likelihoods being more diffuse when computed with samples. We suspect improvements the generative models that enable them to better capture the true generative process will in turn improve the MC sample-based based estimator.
Table 3: Grayscale Images: Fraction of M-Sized Batches Classified OOD. The in-distribution column reflects type-I error and the MNIST and NotMNIST columns reflect type-II.
M
METHOD
IN-D.ST.
MNIST
NOTMNIST DIST.
MNIST
NorMNIST IN-DIST.
MNIST NoTMNIST
Giow Trained FusSiomMNISS
Ty Typcaliity Test Data
0.0 0.
0.
0.08
0.02+.22
1.00..00
0.69 1:
0.01+.c0
1.00=.00
1.00
Typicality Test w/ Samples
0. 0.
0.44
0.00
0.
1.00
0.00
0.06
1.00
0.001
Table 4: Natural Images: Fraction of M -Sziee Batches Classified as O0D.
M = 2
M 10
M 25
METHOD
SVHN
CIFAR-10
IN-DIST.
SVHN
CIFAR-10
IN-DIST.
SVHN
CIFAR-10
DN-D
Glow Trained on ImageNer
Typicality Test w/ Data
0.78+ 26
0. 022...
0.01+ 00
1.00
0.20+.00
0.01+
1.00=.00
0. 0.74+.66
0.01=:01
Typicality Test Samples
1.02::00
0.01 00
1.00 00
0.16s.06
0.01:
1.00=00
0.73 de
0.01:001
E.2 REPLICATION OF WAIC RESULTS
14

---

Under review as a conference paper at ICLR 2020
www.
We did not include WAIC because the results of Choi et al. (2019). The figure to the right shows a WAIC histogram for CIFAR-I0 (blue) vs SVHN (OOD, orange) computed using our Glow implementation (ensemble size 5). We attempted reproduce Choi et al.'s Figure 3, which shows SVHN having lower and more dispersed scores than CIFAR-10. We did observe this: all SVHN WAIC scores overlap with or are higher than SIFAR-10's meaning that SVHN can not be distinguished as the OOD set. Two differences between our Glow implementation and theirs were that they use Adam (vs RMSprop) and early stopping on a validation set. We found neither difference affected results.
not able to replicate
bod Husggamn
030073
CIFAR-10
0200214
020011
200 S0w.rtinteees- 1i0ch 4210 -863 2010
WAIC Score
E.3 VARYING M FOR GLOW
Figure reports results for our typicality test on Glow, varying M from [1, 150). Table 2's results subset of these. We also report evaluations using CIFAR- 100 as OOD set.
Frachon of Batchei Claccmes 0013
Fraction of Batches Classifeed as 00D
Frection of Betches Classiffed as 00D
1.
-0
10
ID: SVHN-TEST
ID: SVHN-TEST
ID: SVHN-
06
OOD: CIFARIO-TEST
08
OOD: CIFARLOO-TEST
0.-
OOD: ImageNet-TEST
02-
02
02
00-
00
0.
100
16c
120
20
324 (M)
340
Batch Size (M)
Batch Size (M)
Batch Size
(a) SVHN Train, CIFAR10 Test
(b) SVHN Train, CIFAR100 Test
(c) SVHN Train, ImageNet Test
Practon of Batcness Clacstied 26 0DD
Fraction of Batches Clssiried as 000
Fraction of Betches Clessified es 00D
CIFARIO-TEST
CIFARIO
CIFARIO-TEST ImageNet-TEST
0.-
08-
CIFARLOG-TEST
06-
06-
ax-
04-
00-
:0
1ic
120
150 340
Batch
Size (M)
Batch
(d) CIFAR10 Train, SVHN Test
(c) CIFARIO Train, CIFAR100 Test (f) CIFARIO Train, ImageNet Test
Fraction of Batchas Clastheed 00D
Fraction of Batches Classifeed 00D
Fradion Batches Classifred 000
10.
10.
ID: ImageNet- TEST
ID: ImageNet-TEST
DD: ImageNettTEST
COD: SVHN-TEST
OOD: CIFAR1O-TEST
OOD: CIFAR100-TEST
06.
06
64-
04
04-
02-
0.-
02-
00-
1000
120
160
120
300
380
Batch Size [M)
Batch Size (M)
Batch Size (M)
(g) ImageNet Train, SVHN Test
(h) ImageNet Train, CIFARIO Test
ImageNet Train, CIFAR100 Test
Figure 4: Natural Image 00D Detection for Glow. The above plots show the fraction of Mizized batches rejected for three Glow models trained on SVHN CIFAR-10, 10, and ImageNet. The OOD distribution data sets these three training sets as well as CIFAR-100.
15


Reviews:
[{"review_id": "rJe18aQpKH", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Thanks for the authors for your detailed reviews.\n\nMy major concerns about the proposed method are whether \"the typicality set\" could be faithfully applied in the small data regime. The authors point me to the interesting Figure 4, which shows that it basically achieves converged performance when $m = 50$ or smaller numbers for some problems. I think this experiment is a strong support for the proposed method. \n\nHowever, I don't agree that the M=1 Gaussian case acts as a strong support for the method. As I said, for some other wired distribution, it is difficult to interpret what the M=1 Typicality set becomes. \n\nThe authors also clarify the difference between different baselines. \n\nOverall, I will increase my score to \"Weak Accept\".\n\n##########################\n\nRecent works have shown that out-of-distribution samples can have higher likelihoods than in-distribution samples for some generative models. To explain this phenomenon and to tackle the problem for OOD detection, this paper adopts \"typical sets\" for identifying in-distribution samples. Specifically, a \"typical set\" is a set of examples whose expected log likelihood approximate the model's entropy. For a Gaussian distribution, the paper finds that a single point typical set locates exactly in the \\sqrt{d} radius, which is usually favored over the high-likelihood origin. Then the paper uses the \"typical set\" to perform OOD for a batch of examples. Empirically they demonstrate competitive performance over MNIST and natural image tasks. \n\nTypical set seems natural for out-of-distribution detection. An important property is that, if one draws a large number of independent samples from the distribution, it is very likely that these samples belong to the typical set (basically Theorem 2.1).  However,  for small n, this property doesn't hold anymore, which leaves here a questionmark whether \"Typical set\" can be used for OOD detection in small n regime. As the author argues, for Gaussian distribution when n=1 the typical locations are those \\sqrt{d} radius points. But this doesn't justify the \"Typical set\". If the distribution is some non-Gaussian wired distribution, the typical locations doesn't seem to make sense at all.\n\nFollowing the previous argument above, the Typical set method requires to perform OOD for a batch of examples. In contrast, the Annulus method can be directly applied to one single test example. \n\nEmpirically, the Typically set doesn't demonstrate obvious advantages compared to the baselines. For both MNIST and natural image tasks, it seems that all methods behave similarly. For comparing such big tables, I would recommend adding a column showing the average ranks among all methods. Beyond that, standard OOD tasks usually evaluate methods using AUROC and AUPR (Hendrycks and Gimpel, 2017). Is it possible to also include such metrics ?\n\nTheorem 2.1 is confusing. It is beneficial to define what P is, and verbally state what the theorem conveys. ", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}, {"review_id": "HJep8WdqtH", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "I've read the authors' rebuttal and other reviews; I'd like to keep my score as is. My main concerns are the novelty of the work, the theoretical soundness of the method for small data settings and its robustness in settings with model misspecification. \n\n#################################\n\nThe paper proposes a new approach based on the notion of typical set in probability and tackles the challenging problem of detecting OOD using deep generative models. The main claim of the paper is that assigning high likelihood to OOD samples in DGMs is due to the mismatch between model’s typical set and its high probability density areas. \n\nI liked the idea of proposing a hypothesis testing approach for finding OOD samples generated from a model; however, my main concern is that the approach has some major practical limitation that the authors have also rightly mentioned in their discussion. It seems that even with a hypothesis testing tool for OOD detection, the model capacity and other properties of the model are more fundamental and critical for OOD detection in DGMs. In other words, how this tool can be useful in practice if the models are misspecified and how robust is the tool with respect to model properties. This major limitation has not been addressed in the experiments. \n\nThis paper, does a good job in finding the OOD data points if the likelihood histograms do not overlap using the typicality notion. However, this idea had already been proposed and explored in Choi. et al. 2019 (although for a flow-based model). This makes the technical novelty of the work less significant. \n\nOverall, I think the paper needs some improvement in terms of discussing the robustness of the test with respect to model properties; otherwise, it is just another typicality set explanation of why DGMs may produce high likelihood values for OOD samples which has already been mentioned in previous work. ", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "B1gx24IkqS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper is concerned with how to determine whether a set of data points are from a given distribution. It uses the so-called typical set to transform the problem to determining whether the data points lie in the typical set of the given distribution. It proposes a statistical test using the empirical distribution of model likelihoods to determine whether inputs lie in the typical set if the considered model. \n\nThe motivation of the work is very clear, and the paper is well organized. The basic idea of using the typical set to check whether given data points are from a given distribution seems sensible, as guaranteed by Theorem 2.1.\n\nMy concern is about the performance of the proposed method compared to alternatives. First, a standard approach to the considered problems seems to be the two-sample tests (or its approximations or variations), so it would be desirable to compare the typical set-based approach with the two-sample test approaches theoretically. In particular, given that you have to allow some error when using typical sets, what is exactly the advantage of the proposed approach?  Second, according to the empirical results (Section 5), the proposed method does not seem to clearly outperform alternatives such as KS-test. In this case, a better justification of the reliability of the proposed approach would be helpful.\n\nI acknowledge I read the authors' response and other reviews and would like to keep my original rating. (I agree that the t-Test and KS-test were probably first used by the authors, but at the same time it is natural to adopt them; that is why I considered them as baselines.)", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper tackles the problem of detecting out of distribution (OoD) samples. To this end, the authors propose a new approach based on typical sets, i.e. sets of samples whose expected log likelihood approximate the model's entropy. The idea is then to rely on statistical testing using the empirical distribution of model likelihoods in order to determine whether samples lie in the typical set of the considered model. Experiments are provided where the proposed approach show competitive performance on MNIST and natural image tasks.

This work has major drawbacks: novelty, theoretical soundness, and robustness in settings with model misspecification. Using the typicality notion has already been explored in Choi. et al. 2019 (for flow-based model), which dampers the novelty of this work. The conditions under which the typicality notion can be used are also not clear, e.g. in the small data regime. Finally, the current experiments are lacking a characterization of robustness to model misspecification. Given these limitations, I recommend to reject this paper.

Decision: Reject