Analyzing and Improving Generative Adversarial Training for Generative Modeling and Out-of-Distribution Detection
Authors: Xuwang Yin
Shiying li
Gustavo Rohde
Venue:  (2021)
Keywords: Adversarial Training
Generative Modeling
Out-of-Distribution Detection
GANs
Generative adversarial networks

Abstract: Generative adversarial training (GAT) is a recently introduced adversarial defense method. Previous works have focused on empirical evaluations of its application to training robust predictive models. In this paper we focus on theoretical understanding of the GAT method and extending its application to generative modeling and out-of-distribution detection. We analyze the optimal solutions of the maximin formulation employed by the GAT objective, and make a comparative analysis of the minimax formulation employed by GANs. We use theoretical analysis and 2D simulations to understand the convergence property of the training algorithm. Based on these results, we develop an unconstrained GAT algorithm, and conduct comprehensive evaluations of the algorithm's application to image generation and adversarial out-of-distribution detection. Our results suggest that generative adversarial training is a promising new direction for the above applications.

Under review as a conference paper at ICLR 2021
ANALYZING AND IMPROVING GENERATIVE ADVER- SARIAL TRAINING FOR GENERATIVE MODELING AND OUT- OUT-OF-DISTTN DF-DISTRIIUTIO DETECTION
Anonymous authors Paper under double-blind review
ABSTRACT
Generative adversarial training (GAT) is recently introduced adversarial defense method. Previous works have focused on empirical evaluations of its application training robust predictive models. In this paper we focus on theoretical under- standing of the GAT method and extending its application to generative modeling and -fitt--diitiiuutiin detection. We analyze the optimal solutions of the maximin formulation employed by the GAT objective, and make comparative analysis of the minimax formulation employed by GANs. We use theoretical analysis and 2D simulations to understand the convergence property of the training algorithm. Based on these results, we develop an unconstrained GAT algorithm, and con- duct comprchensive evaluations of the algorithm''s 's application to image generation and adversarial out-of- distiiiiibttion detection. Our results suggest that generative adversarial training is promising new direction for the above applications.
INTRODUCTION
Generative adversarial training (GAT) (Yin al. 2020) a recently introduced defense mechanism that could be used for adversarial example detection and robust classification. The defense consists of a committee of detectors (binary discriminators), with each one trained to discriminate natural data of a particular class from adversarial examples perturbed from data of other classes. Like most other work in the area of robust machine learning, the defense is specially designed for defending against conntconntr adversaries adversaries that are constrained to perturb the data up to certain amount as measured by some norm. The defense's robustness is achieved by training each detector model against adversarial examples produced by the norm-constrained PGD attack (Madry ct al. 2017).
Existing work: training and evaluating robust predictive models A detector trained with GAT has strong interpretability - an unbounded attack that maximizes the detector's 's output results in images that resemble the target class data this suggests the detector has learned the target class data distribution. However, all previous works (Yin et al., 2020) Tramer et al. (0200) focus on the empirical evaluations of GAT's application to training robust predictive models; a theoretical understanding of why this training method causes the detector to learn the data distribution is missing.
This work: thcoretical understanding, improved training algorithm, and extended applica- tions In order to better understand the GAT method, we first analyze the optimal solutions of the training objective. We start with a maximin formulation (eq. (5)) of the objective. and try connect it with the minimax formulation (eq. (T) that is employed by GANs (Goodfellow et al. 2014). We find that the differences between solutions of these two formulations become immediately clear when we take a game-theory perspective. We then use theoretical analysis and 2D simulations to understand the convergence property of the GAT training algorithm. Building upon these theoretical and experimental insights, we develop an unconstrained GAT algorithm, and apply it to the tasks of generative modeling and distribubttn detection. We find the maximin- based generative model to be more stable to train than its minimax counterpart (GANs), and at the same time more flexible as does not have a fixed generator and can transform arbitrary inputs to the target distribution data, which might be particularly useful for certain applications (e.g., face manipulation). The model

---

Under review as a conference paper at ICLR 2021
trained with the unconstrained GAT algorithm also outperforms several state-of-the methods the task of adversarial ditt--i-istribttionn detection. In summary, our key contributions are:
We analyze the optimal solutions of the GAT objective and convergence property of the training algorithm. We discuss the implications of these results on improved training of robust predictive models, generative modeling, and out-of-distribution detection.
We develop unconstrained generative adversarial training algorithm. We conduct comprehensive evaluation of the algorithm's 's application to image generation and adversarial duttrf--istributiin detection.
Our comparative analysis of the maximin and minimax problem clarifies misconceptions and provides new insights into how they could be utilized to solve different problems.
RELATED WORK AND BACKGROUND
Generative adversarial networks (GANs) The GANs framework (Goodfellow al. 2014) learns a generator function G and a discriminator function D by solving the following minimax problem
min max (D) Exx-pa [log [xx) + Ez-p, [log(1 D(G(=))))
The generator G implicitly defines a distribution Pg by mapping a prior distribution ps from low- dimensional latent space C Rº to the high-dimensional data space X' C RRd, : - [0, 1] is function that discriminates the target data distribution Pdata from the generated distribution Py. The minimax problem is solved by alternating between the optimization of D and optimization of G; under certain conditions, the alternating training procedure converges to a solution where Py matches
Pdata Shannon divergence zero), and outputs 2
1 on support of Pdata-
Generative adversarial training (GAT) The GAT method Yin et al. 2020) is designed for training adversarial examples detection and robust classification models. a K class classification problem, the robust detection/Clasiification system consists of K base detectors, with each one trained by minimizing the following objective
L(D) = -Ex<p [log D(x)] - Exx-- log(1 - max D(z'))) E'EB(rre)
(2)
In the above objective. pk: is k-th class's data distribution, p-* the mixture distribution of all other 1 classes: p- K-I Σi=1....K.fft Pt. and B(x, c) is neighborhood of x: {x' E X ||ar 1 æl12 S
e). The objective is characterized by inner maximization problem and an outer minimization problem; when the inner maximization is perfectly solved and D achieves a vanishing loss, D becomes perfectly robust model capable of separating data Pk. from any e-constrained adversarial examples perturbed from data of p-k- A committee of detectors then provides a complete solution for detecting any adversarial example perturbed from an arbitrary class. Objective 2 solved using alternating gradient method (Al (Algorithm[I, [T). with the first step crafting adversarial examples by solving the inner maximization, and the second step improving the D) model on these adversarial examples.
Clearly, the detector's robustness depends on how well the inner maximization is solved. Despite the fact that D is highly non-coneave function when it's parameterized by deep neural network, Madry let al.) (2017) showed that the inner problem could be reasonably solved using projected gradient descent (PGD attack) first-order method that employs the following iterative gradient update rule (at initialization x0 <- x, we consider T.2-based attack)
log D(x*)
i+1 Proj(x' +
| log D(=t)
where À is some step size, and Proj j is the operation of projecting onto the feasible set B(z, e). The normalized steepest ascent rule inside the Proj function, was introduced for dealing with the issue of vanishing gradient when optimizing with the cross-entropy loss (Kolter & Madry 2019). The PGD attack also employs random restarting to improve its effectiveness. The idea that for a input x, first generate set of randomized inputs by uniformly sampling from B(x, e), perform PGD attack each of them, and use the most effective one as the actual attack.
review of related work dut-of-distributiin detection in provided in Appendix A
2

---

Under review as a conference paper at ICLR 2021
Algorithm 1 GAT Detector Training Method (The Maximin Problem Solver)
y........ , am from ps, and m samples { ..... z.a") from p-k- 2: Compute adversarial examples (4),.... Hmm] by solving ma(x3) D(x") for each x;
1: Sample minibatch samples {
3: Train the detector by minimizing 1 mm [- log () log(1 D(a (single step).
4: Return to step 1.
THEORETICAL RESULTS
In this section we first reformulate objective into maximin problem, and then analyze the optimal solutions of the maximin problem and convergence property of Algorithm [ We then discuss the optimal solution of the corresponding minimax formulation and the differences between the solutions of these two formulations. The popular generative modeling approach of GANs learns a data distribution by solving the minimax problem, but there seems be misconception about the differences between solutions of these two problems, and result, false impression that the GANs algorithm could solve the maximin problem (Goodfellow) (2016), section 5.1.1). Our analysis of optimal solutions is based game-theory interpretation of these problems, and the differences between these solutions are immediately clear under such an analysis.
3.1 THE MAXIMIN PROBLEM
In this section we provide an analysis of the optimal solutions of objective equivalent to minimizing log(1 D), hence eq. (2) is equivalent to
Maximizing D is
L(D) = Exxpp [log D(x)] Exoppel min log(1 - D(z)))) e'EB(a,e)
(4)
For the convenience of analysis, instead of using e-balls imposed on individual data samples, we use the notion of common perturbation space: The perturbation space S is subspace of the data space X, and allows mass of p- to be moved to any location S. A new distribution px can be obtained by transporting the mass of p_ to appropriate locations in via transformation function T' : S S. Utilizing the technique of random variable transformation, we can write the density function of pt as left panel is schematic illustration of
function of p-x: Pe (y) [S P- (z)() T(z)) Figure I this phenomenon. Let M (S) be the set distributions attainable by applying such transformations to the support of p-k- With the notation of perturbation space, the inner problem in eq. (4) could then be interpreted as determining the distribution in Mt (S) that causes the highest (expected) loss of the D function. Assuming B(x = S, the interplay of the D model and the adversary can be formulated as a maximin problem:
max min U(D,pt) = Exapp [log D(x)] + Exnp, [log(1 D(x)))- D (8)
(5)
Seenario
Scenatio 2
Scemario
s
Supplpe) $
Supp(pu) m Supplpe) 7.5 and Supp(pu) of
Figure 1: Left panel: distribution pt is obtained by applying transformation T to the support of P-k- Right panel: three scenarios to consider when analyzing problem[3] Red distribution represents p-k and blue distribution represents pk- The data space X' is represented by the whole space inside the square, and the perturbation space S is represented by the gray area.
Optimal solutions A convenient way of analyzing the above problem is to consider it two-player game: player 1 first presents different configurations, then for each D, player determines a perturbed distribution pf that minimizes U under the considered D. Then over all combinations of

---

Under review as a conference paper at ICLR 2021
Table 1: Optimal solutions for the three scenarios in Figure !
Scenario
Optimal solution (D"-
Supp(pa) S
D' outputs for Supp(pu) and & à/ for Supp(pe): Pi its distributed locations where outputs 1
Supp(pa) n 8
D' outputs for Supp(pw) and for St pi can be arbitrary distribation M'
Supp(rs) nS * 8.
1 (by definition, Js For Supp(ps) outside S, D outpots for (upp(ps) inside S, D' outputs Ig 1J Ph
D)
and Supplys] E
and for other places inside S, D' outputs & oi pt has its mass distributed to locations where D' outputs a.
(D, D..)), player I chooses the combination (D, pP) that gives the highest U value. By analyzing both players' best strategies for playing the game, could derive the optimal solutions (Table 1 for the three scenarios depicted ddeppiees in Figure 1 From a game--playig perspective, the claims in Table can be verified by assuming a different D configuration than the claimed one, and show that there always exists a Pt that results in a lower U value than the U value that could be achieved with the claimed D configuration. Mathematical derivations of these optimal solutions are included in Appendix [D]
A discussion about scenario 2 result and its implication for training robust models in provided in Appendix B
3.2 THE MAXIMIN PROBLEM SOLVER
The method (Algorithm T for training adversarial-rouust detector is in fact a solver (assuming B(x, e) = S) for the maximin problemp maximizing D(x) is equivalent to minimizing log( (1 - (())
(step 2), and minimizing the loss equivalent to maximizing U (step 3). Algorithm [ has the following convergence property:
Proposition 1. If step 2 always perfectly solves the inner problem (i.e., the mass of Pt is always moved to the location(s) where D has the largest output(s)), and step 3's updates happen in D's function space, and each update is sufficiently small, then the algorithm converges to the optimal solution of D.
Proof. We consider scenario in Figure 1 Let & = maxs), Supp D, A = f= { Supp(pk):
D(x) = a.. and 3 == maXsupp(pa) D, B = {x E Supp(ps) D(x) = 3}. We focus on the case of > a, 3 > 3. other cases can be proved using similar argument. Recall that in Algorithm I step solves the inner minimization by moving mass of p to locations where D has the largest outputs, and step 3 updates D by decreasing its outputs on Pt and increasing its outputs on Px- We further assume when mass of p-k is moved multiple locations with equal D outputs, the algorithm doesn't t have a preference over locations (i.c., mass of p-k will be uniformly distributed to these locations). Algorithm I can be interpreted as a finite state machine that constantly switches between the following three states:
State a > B. Step 2 moves the mass of p- to A, and step 3 decreases a while increases 3; the algorithm switches to state or state
State 2: a < 3. Step 2 moves the mass of p-x to B, and step 3 maintains a while decreases 3 (Appendix F.I): the algorithm switches to state I or state 3.
State 3: a B. Step 2 moves the mass of p AU B, step decreases a. Because of non-zero densities of B's points on Pk. if 3 is decreased, the decreased amount is always lower than that of a the algorithm switches state
In particular, step 3 in state and state 2 always results in decrease of max a., B}} (but 9 cannot be decreased to below $. Appendix D). and step 3 in state always results in an decrease of a. The algorithm converges to the D solution of < 1.33
Practical considerations The above proof relies on the assumption that step 2 always perfectly solves the inner minimization (i.e., mass of p-x is always moved to the location(s) where D has the
In scenario 2 and 3, D doesn't need be defined X' (S Supp(pe)).
4

---

Under review as a conference paper at ICLR 2021
largest output(s)). In practice, gradient-basee search procedure (see eq. (3) step 2 is unlikely able to reach the global maxima when is highly non-concave function.
This issue with gradient-basee baseed search is alleviated by the alternating optimization procedure: if at step 2 samples of p- are stuck at local maxima, step immediately decreases D outputs on these samples. In other words, local maxima are constantly being eliminated. We can clearly observe this pattern in a 2D simulation of the algorithm (Figure
However, it appears local maxima elimination cannot solve all the issues. As illustrated in Figure Figure[[[), the maximin solver could converge to solution where D has > outputs on places other than Supp(ps). Inspecting the gradient vector field in Figure b)), we find that by starting from p- and following the gradient of D. pr is always "trapped" to Supp(p*). As result, other local maxima lost the chance of being visited by pt, and cannot eliminated.
The above observation points out straightforward solution: use P-k that is distributed in the entire data space, as opposed one that is concentrated in subspace. For instance, when we use a uniform distribution in the data space p-k. in multiple experiments we consistently obtained D solutions with no local maxima and global maxima Supp(ps) (Figure and Figure 5 The mathematical proof that when p- is uniform distribution we can always get such D) solution is provided in Appendix M (Note however the use of uniform distribution not a prerequisite here; any "well distributed" data should work just well.) The fact that these D solutions don't 't have local maxima also means we can translate an arbitrary data point out of Supp(ps) to Supp(px) by performing gradient ascent D.
05
0.5
33200
63
63
6.3
3.891
03
63
64-
2.895
01-
-0.
04052
-0.1
54902
-0.1
14
-4
0,850
-03
-05
-03
(a) initial positions
(b) maximin solution 1
(c) maximin solution
(d) minimax solution
Figure 2: Plots of contours and gradient vector fields of the D functions (gradient vectors are normalized have the unit length). (a) The initial positions of p-x and pk. (b) The solution obtained by the maximin problem solver. (c) The solution obtained by the maximin problem solver when a uniform distribution in the data space. (d) The solution obtained by the minimax problem solver.
3.3 THE MINIMAX PROBLEM
Algorithm 2 Minimax Problem Solver
1:
Initialize +- p-k.
2: repeat
Train the detector by maximizing Ex~pa [log D(=)] + Ex-pe [log(1 D(x))] (until converge).
For each sample æ E pe. update value X v log(1
log! D(
5: until p: convergences pk
The corresponding minimax game minp, maxD (DD.pt) PP) has reversed rule: player first presents different P:S, then for each Pt. player determines a DP' that maximizes U under the considered pt- Then over all the combinations of (p:, DPc), player chooses the combination that gives the least U value. The solution of the game is analyzed in Goodfellow et al. (0114) Goodfellow (2016): : the opti- mal strategy for player is to choose a D such that U measures the Sensen-Shannen divergence (JSD); Ps ). and optimal
U(D", Pt) = - log( 4) + 2 JSD(p: Pk) (the actual solution of D is D* put
arg minp... (S) JSD(p, || px). When Supp(px) C S (corresponding to scenario 1 in Figure 1]. Pt matches ps (JSD is zero), and D' outputs z Supp(pk). A solver (Algorithm 2 for the minimax problem is readily available by removing the "generator" from GANs' training algorithm. It is straightforward to apply GANs algorithm's convergence property to Algorithm if each step pt is updated with sufficiently
strategy for player is to choose a P. that minimizes the JSD:
5

---

Under review as a conference paper at ICLR 2021
small step of X, and D is trained to reach its optimum, then pt converges Pk- In Figure 2 d) and Figure we provide 2D simulation results of this algorithm.
3.4 THE DIFFERENCE
There are a few differences between the solutions of the maximin problem and minimax problem.
First, both D output 1/2 for Supp(ps). But while D in the maximin problem outputs 1 on S Sppp(px). D in the minimax game doesn't I need to be defined on S Supp(pı) (Goodfellow al. 2014). In other words, D in the minimax problem has unpredictable values between O and in most of the data space. We can observe this phenomenon in Figure [6] The intuition here is that in the maximin game, pł decided in the second move, with the knowledge of the current value; to prevent P from taking this advantage, the best strategy for player 1 is to specify D outputs for the entire perturbation space. In the minimax game, on the contrary. D is decided in the second move, with the knowledge of pt, hence the player does not need to worry about D outputs outside the supports of pt and Pk-
Another difference, which also be observed from Figure 2 is that in the minimax game, pi exactly matches ps. while in the maximin game, mass of pł can be any place where D" outputs 2'
Overall find these two formulations giving rise to different applications. The minimax formulation, which is the formulation used by GANs, is perfect for learning a generator that produces a distribution that exactly matches the target data distribution. The discriminator (the D model), because of its undefined behavior in most of the data space, may not be very useful. The maximin problem, if well solved (Figure ()), gives D)) function that models a characteristic function of the data distribution, and could be used to solve problems that require this feature (Section
Algorithm 3 Unconstrained Generative Adversarial Training
1: for K' in [0. 1,..., N do
2: for number of training iterations do
3: Sample minibatch samples (#i,...;Ty, from pa. and samples ( @mm from p-k-
4:
For each sample R; in {#1,..., .......,,n, }m), compute the perturbed sample a by performing K steps v Iog((1- D(af))
normalized steepest descent 2//+1 + at -1 1ox()=-(22t)) (at initialization zP +- it).
5: Update 1 by maximizing 1 Em [log ((x,) + log (1 - D(* (single step).
6: end for
7:
end for
4 APPLICATIONS
In Figure 2|c c) we show when p- is uniformly distributed in the data space the maximin problem solver gives us a D function that has no local maxima and global maxima at the support of pu. This D function is very useful - we can identify at least two important applications:
Application 1: -istr--distribution (OOD) detection The global maxima are at Supp(px)
means any inputs that have lower D outputs can be correctly identified as OOD inputs.
Application 2: generative modeling New samples of pk can be generated by first random sampling from the data space and then translating them to the support of pı by performing gradient ascent on D.
For practical applications, we have to deal with spaces of high dimensionality. We first find that with uniform noise as the p dataset, we are unable to obtain D model that is useful for detecting real OOD data (Appendix H.I This leads us to consider using a large, diverse, real image dataset, specially ImageNet, as the p- dataset. Our ablation study in Appendix H. confirms that larger and more diverse dataset leads to better OOD detection performances. We further use data augmentation to increase the dataset's diversity. Given these strategies, data of p- could still be very sparse in high dimensional space. In order to cover more space, we consider imposing large perturbations on
p- & data.

---

Under review as a conference paper at ICLR 2021
Unconstrained training To facilitate the training of a large (potentially unlimited) perturbation. we propose Algorithm [] an unconstrained generative adversarial training algorithm. Because of the steepest descent update rule (Line 4 in Algorithm [] note there is no Proj j operation here), for a given K, the perturbation imposed on each sample has a size that is always S XK; hence the algorithm can be thought as gradually increasing the perturbation limit. We found this incremental training technique necessary for training models in high dimensional space - a phenomenon also observed by Yin al. (2020), According to the analysis in Section 3.2, the step size À should be set to sufficiently small value in order for step 4 to coverage to local maxima and step 5 to eliminate these local maxima. We observed that training is stable as long as À is bellow a certain threshold. and this threshold is related to input size and D's architecture. In the algorithm we start K from O, which means that at the first stage D is trained to discriminate between pe and p-x; this is not critical, but we found this pre-training causes following optimizations to converge faster.
EXPERIMENTS
In this section we evaluate our method on the task of generative modeling and out-of-distribttion detection. Following Kurach et al. (2018), we evaluate our method on CIFAR-10 (Krizhevsky et al.
2009). CelebA-HQ- 128 (Karras et al. (017). and LSUN Bedroom- 128 (Yu et al., 2015). Details of
model training, data preprocessing, and dataset statistics are provided in Appendix G
OOD detection evaluation For each one of the above three datasets, we use multiple OOD datasets (see Table G) to test D model's 's OOD detection performances. We further assume OOD inputs remain OOD under small Lor-norm perturbations. Under this assumption, we consider the problem of detecting adversarial OOD inputs - OOD inputs that are adversarially perturbed to cause the detection to fail, and evaluate our method under this challenging scenario. We also observe that increasing K in Algorithm 3 leads to changes in D performances on OOD and adversarial OOD detection. To study this phenomenon, we evaluate D models trained with different K's using OOD inputs under various levels of perturbations. We use Outlier Exposure (OE, [Hendrycks et al. (2018) as the baseline method. The idea of OE is to use an auxiliary OOD dataset of large amount of diverse data to train the OOD detector. Because also use large-scale, diverse dataset (ImageNet) as the p- dataset, the OE approach can be thought of a special case of Algorithm 3 when we fix K to K O. We use area under the receiver operating characteristic curve (AUROC) as the performance metric (details of how AUROC and adversarial AUROC are computed are in Appendix G
Generative modeling evaluation We generate new py samples by starting from some seed images and performing gradient ascent on D (Appendix G provides more details on generation). Due to the similarity between the studied approach and GANs (the former solves the maximin problem while the latter solves the minimax problem), we focus on comparison with GANs. Kurach et al. (0188) a large-scale study on the effects of various regularization and normalization techniques on GANs, and we compare our results with the best results obtained in their work.
5.1 RESULTS
OOD detection results Table 2 the average OOD detection performances of our method (see Appendix for the complete results on individual OOD datasets). For each dataset, we train multiple D models with different Kss, and test models under various levels of perturbations 2 (e-test, measured by L norm). We can observe general pattern across all the datasets: training with a larger K causes model performance on lower to decrease, phenomenon that is also observed in other adversarial training scenarios (Madry et al., 2017 Tsipras et al., 2018). The baseline method (K models) becomes completely ineffective when models are exposed to adversarial OOD inputs.
On CelebA-HQ- 128 and Bedroom- 128 datasets our method obtains strong performances on detecting both OOD and adversarial OOD inputs. Performance on CIFAR- 10 dataset is relatively low. Con- sidering the small size (4.6MB disk space) of the default ResNet-CIFAR architecutre, we replaced it with ResNet18 8 which is a much larger model in terms of disk space (43MB), B), but only observed marginal improvements on OOD and adversarial OOD detection (Appendix H.2)
ee values based on http://hhthhhhh.co////aaaaaaaaa/

---

Under review as a conference paper at ICLR 2021
Table results are based perturbations computed using PGD attacks (Madry al. 2017 of particular combinations of steps and step size. To verify model robustness, we use a testing strategy that is widely adopted in the ML security community: steps and step size to test model robustness. Appendix [ shows that the worst results obtained with grid search are only marginally lower than reported ones in Table
PGD attacks of different combinations of
In Table and and Table we report standard and adversarial OOD detection performances of our method and several state-of-the-e methods. As is discussed earlier, there is a trade-off between standard and adversarial OOD detection performance as we increase K in Algorithm 3 For this reason, we have included the performances our model trained with different Ks (K and K 5.) Our method uses the ResNet18 architecture and 800 Million Tiny Images (Torralba et al. 2008 as the p-* dataset
- this combination gives the best performance; data of other settings are provided in Appendix H.2 (We note methods in Tabel + that rely on axuliary data also use the 800 Million Tiny Images.) It is observed from Table that state-of-the th-the- OOD detection methods achieves strong performances on the standard OOD detection task. However, in the adversarial OOD detection task, even tiny perturbation of 0.01 could cause non-robust models (OE and our method with K = 0) to fail. Meanwhile, our method with K 5 outperforms several satt-off-the-ae methods on SVHN and CIFAR- 100 in this task.
Table 2:
detection performances (see Appendix P for expanded results)
(a) CIFAR-10
(c) HQQ-A-
(d) Bedroom- 128
D model
model
1 model
e-lest
K
=
K =5
c-test
= 0)
K' 20
= 40
c-lest
K
= 20
K = 40
0.0
01974
0.910
01860
0.0
1,000
1.000
1,000
0.0
0.996
0.996
0.930
0.784
0.998
0.976
2.0
0.000
0.519
0.613
10.0
0.000
0.964
0.988
10.0
0.000
0.815
0.837
Table 3: Standard OOD detection performances (AUROC scores) when the in in-distribution dataset is CIFAR-10 and OOD samples are not perturbed. Performance data is collected from referenced papers in the table; when there is discrepancy we use the best reported result. Details about the iSUN, LSUN (resize), and TinylmageNet (resize) datasets can be found at Liang et al. (2017)
OOD dataset (no perturbation)
Method
Uniform
Gaussian
SVHN
CIFAR- 100
iSUN
LSUNNresizz)
TinyImageNet (resize)
Softmax (Hendrycks & Gimpel 2016
96.5
97.5
89.9
86.4
91.0
91.0
91.0
ODIN [Lang ot al 2017
99
100
96.7
87.5
94.0
94.1
94.0
Mahulansoos
2018
100
N/A
99.1
88.2
99.7
OE Henddycks si ai 2018
98.7
99.3
98.8
95.3
98.5
98.
N/A
Gram Malrices (Sastry Oore
2019
N/A
99.5
79.0
99.9
Energy-based ef
N/A
N/A
99.4
NIA
99.33
99.39
N/A
Likelihood ratios Mo
2019
N/A
N/A
88.8
N/A
N/A
N/A
N/A
WAIC (Choi ef al 2013
100
100
100
NIA
N/A
N/A
95.6
CCU Kgvike & Holn
2019
100
N/A
97.1
93.0
N/A
N/A
N/A
ACET Heem ai 2019
99.7
N/A
92.4
90.7
N/A
N/A
N/A
GOOD Billewwnl ct 2020
99.5
N/A
97.1
92.9
N/A
N/A
N/A
Ours (A
99.5
99.8 8
99.6
94.1
99.5
99.5
Ours (K = 5)
09.6
99.9
97.4
91.5
98.5
98.9
96.2
Image generation results In Figure 3 shows samples generated by our method. In general we find our results to be more recognizable than GANs' results Figure TO, We observed that the quality of generated images could be affected by the type of seed images (Appendix K.2), and increasing K in Algorithm gennrally leads to better generations (Appendix K. In Figure 12 we demonstrate the method's 's application to face retouching. The fact that generated images are not realistic and have various artifacts suggest that the maximin problem is not well solved. This might be due to the model not being exposed to enough p- & data (consider increase the number of iterations in the inner loop of Algorithm or the limitation of model architecture or capacity.
While GANs has various training stability issues, we found Algorithm 3 to be stable ordinary supervised training. The only failure mode (gradient ascent on D results in noisy images) that we observed is caused by À being too large (Appendix[!) [I.
Limitation As our method uses gradient ascent which is susceptible to local maxima to generate samples, it tends to produce similar samples if the seed samples not diverse enough. In practice,
8

---

Under review as a conference paper at ICLR 2021
Table 4: Adversarial OOD detection performances (AUROC scores) when the in-distribution dataset is CIFAR-10, 10. Performance data of methods other than ours is collected from Bitterwolf et al. (020). The results of our method are based on an PGD attack of steps 100 and step size 0.002. We also used the full datasets to run the test, as opposed to 1000 samples per dataset as used by Bitterwolf et al. (2020). For results using 1000 samples and under different attack configurations including one with random restarts see Table 30
OOD datasct (with an L perturbation of 0.01)
Method
Uniform Noise
Gaussian Noise
SVHN
CIFAR-100
OE (Hendryeks et al.
2018
75.7
N/A
11.0
CCU [Memnke Hem
2019
14.8
23.3
ACET Hem el | 2019
98.9
N/A
88.0
74.5
GOOD
Bitterwoll et 2020
99.5
N/A
58.9
54.7
Ours (K
97.8
7.1
Ours (K
99.0
99.1
91.8
81.8
due to the numerical algorithm or mini-batch training, we are more likely to get solution that has local maxima. In that case, by performing gradient ascent on D seed samples that are not diverse enough could be trapped in the same local maximum point. This is likey the case in Figure where we find several face images that quite similar each other. On the other hand, in the less likely situation where the D solution has no local maxima (e.g., Figure[[b) and Figure((c)) all the seed samples could be concentrated in a few maxima points on support of the pk distribution. While the problem in the latter case seems more severe, it could be mitigated by properly constraining the number of steps and step size when performing gradient ascent on D)
Uncurated samples generated by our method; GANs results is in Figure 10 Seed images used generated these results in Figure The training time for models used produce these generations are in Table 7
Figure 3:
6 CONCLUSIONS AND FUTURE WORK
In this paper analyzed the optimal solutions of the GAT training objective and the convergence property of the training algorithm. The analysis optimal solutions justifies the application of the GAT method to training robust predictive models. We made comparative analysis of the maximin formulation and minimax formulation that are respectively employed by GAT and GANs. Guided by these theoretical results, we designed unconstrained GAT algorithm, and evaluated it on the task of image generation and adversarial out-of-distribution detection. The competitive performance and training stability of the algorithm suggest that the studied approach could serve new tool for content creation, although we believe its performance could be further improved by optimizing hyperparameters and model architectures. Out-of-ddittibuttio detection results indicate that an OOD detection model's robustness could be improved by training the model against an adversary equipped with large-scale, diverse OOD data. The future work includes scaling up the training for larger images and high-capacity models, and extending the method's application to sequential and tabular data.

---

Under review as a conference paper at ICLR 2021
REFERENCES
Vahdat Abdelzad, Krzysztof Czarnecki, Rick Salay. Taylor Denounden, Sachin Vernekar, and Buu Phan. Detecting out-o--distriuttion inputs in deep neural networks using an early-layer output. arXiv preprint arXiv: 10307, 2019.
Julian Bitterwolf, Alexander Meinke, and Matthias Hein. Certifiably adversarially robust detection of out-of-distribution data. Advances in Neural Information Processing Systems, 33, 2020.
Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe. Convex optimization. Cambridge university press, 2004.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv: 1096, 2018.
Wenhu Chen, Yilin Shen, Hongxia Jin, and William Wang. A variational dirichlet framework for out-of-distribution detection. arXiv preprint arXiv:1811.07308 2018.
Hyunsun Choi, Eric Jang, and Alexander A Alemi Waic, but why? generative ensembles for robust anomaly detection. arXiv preprint axXiv:1810000132220000 2018.
Erik Daxberger and José Miguel HernándezzLobato. Bayesian variational autoencoders for unsuper- vised out-o-ddistributin detection. arXiv preprint arXiv:1912.05660 2019.
Terrance Veies and Graham W Taylor. Learning confidence for out-of-distribttion detection in neural networks. arXiv preprint arXiv:1802.04866 2018.
Laurent Dinh, Jascha Dicck-iik,t,in,, and Samy Bengio. Density estimation using real nvp. arXiv preprint Ar0iv: 100.000000000803,, 2016.
Izhak Golan and Ran El- Yaniv. Deep anomaly detection using geometric transformations. In Advances in Neural Information Processing Systems, pp. 9758 9769, 2018.
Ian Goodfellow. Nips 2016 tutorial: Generative adversarial networks.
arXiv preprint
arXiv:1701.00166) 2016.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural informa- tion processing systems, pp. 2672-2680, 2014.
Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high- confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 41-50, 2019.
Dan Hendrycks and Kevin Gimpel. baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv preprint arXiv: 1610.02 2016.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 1812 2.0660666 2018.
Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In Advances in Neural Information Processing Systems, pp. 18663-16674, 2019.
Yujia Huang, Sihui Dai, Tan Nguyen, Richard G Baraniuk, and Anima Anandkumar. Out-of- distribution detection using neural rendering generative models. arXiv preprint arXiv: 1907.4457 2019.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.10196, 2017.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4401-4410, 2019.
10

---

Under review as a conference paper at ICLR 2021
Diederik P Kingma. Fast gradient-bused inference with continuous latent variable models in auxiliary form. arXiv preprint arXiv: 1ao:::33007333 2013.
Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. In Advances in neural information processing systems, pp. 10215-10224, 2018.
Polina Kirichenko, Pavel Izmailov, and Andrew Gordon Wilson. Why normalizing flows fail to detect out-of-distributtin data. Advances in neural information processing systems, 33, 2020.
Zico Kolter and Aleksander Madry. Adversarial robustness theory and practice, 2019. URL htttps://ddveree
Jernej Kos, lan Fischer, and Dawn Song. Adversarial examples for generative models. In 2018 ieee security and privacy workshops (spw), pp. 36-42. IEEE, 2018.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
Karol Kurach, Mario Lucic, Xiaohua Zhai, Marcin Michalski, and Sylvain Gelly, A large-scale study on regularization and normalization in gans. arXiv preprint arXiv: /807.04770 2018.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-callbrateed classifiers for detecting out-of-distribution samples. arXiv preprint arXiv: /71 2017.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distributtin samples and adversarial attacks. In Advances in Neural Information Processing Systems, pp- 7167-7177, 2018.
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint arXiv:1706.02665 2017.
Weitang Liu, Xiaoyun Wang, John Owens, and Sharon Yixuan Li. mhergy-based -itor--distriutiion detection. Advances in Neural Information Processing Systems, 33, 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 1xxivv/700 1706.06083, 2017.
Andrey Malinin and Mark Gales. Predictive uncertainty estimation via prior networks. In Advances in Neural Information Processing Systems, pp. 7047-7058, 2018.
Suvojit Manna. dalbaa-- (github repository), 2020. URL https:://tttttu
com/ suvo http://www1.11000/0//////o----00
Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't know. arXiv preprint arXiv:1909. 12180, 2019.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan, Do deep generative models know what they don't 't know? arXiv preprint arXiv:1810.09136, 2018. 2018.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, and Balaji Lakshminarayanan. Detecting out-of-distribution inputs to deep generative models using a test for typicality. arXiv preprint arXiv: (00:::/906602994.. 02994, 5, 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
J Neumann. Zur theorie der gesellschaftsspiele. Mathematische annalen, (00(1):955320)) 1928.
Aaron van den Oord, Nal Kalchbrenner, and Koray Kavukcuoglu. Pixel recurrent neural networks. arXiv preprini 1601 .06799, 2016.
Pedregosa. G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Pretten- hofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Coumapeaau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2832 2011.
11

---

Under review as a conference paper at ICLR 2021
Marco AF Pimentel, David A Clifton, Lei Clifton, and Lionel Tarassenko. A review of novelty detection. Signal Processing, 99:215-249, 2014.
Igor M Quintanilha, Roberto de ME Filho, José Lezama, Mauricio Delbracio, and Leonardo O Nunes. Detecting out-of-distribution samples using low-order deep features statistics. 2018.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-o--distribution detection. In Advances in Neural Information Processing Systems, pp. 14707-14718, 2019.
Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approximate inference deep generative models. arXiv preprint arXiv:1401.4003 2014.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211-252 2015.
Tim Salimans, Andrej Karpathy, Chen, and Diederik Kingma. Pixelcnn++: implementation with discretized logistic mixture. ICLR.
pixelenn
Chandramouli Shama Sastry and Sageev Oore. Detecting out-of-distribution examples with in- distribution examples and gram matrices. arXiv preprint urXiv: 12510, 2019.
Vikash Sehwag, Arjun Nitin Bhagoji, Liwei Song, Chawin Sitawarin, Daniel Cullina, Mung Chiang. and Prateek Mittal. Better the devil you know: An analysis of evasion attacks using out-of- distribution adversarial examples. arXiv preprint arXiv:
2019.
Joan Serrà, David Álvarez, Vicenç Gómez, Olga Slizovskaia, José F Núñezz and Jordi Luque. Input complexity and out-of -fiisiiibitttiiionnnn detection with fikelihood-baxee generative models. arXiv preprint arXiv: 1480, 2019.
Alireza Shafaei, Mark Schmidt, and James J Little. Does your model know the digit 6 is not cat? a less biased evaluation of" outlier" detectors. 2018.
Gabi Shalev, Yossi Adi, and Joseph Keshet. Out-of-distributtion detection using multiple semantic label representations. In Advances in Neural Information Processing Systems, pp. 7375-7385, 2018.
Jiaming Song, Yang Song, and Stefano Ermon. Unsupervised out-of-distribution detection with batch normalization. arXiv preprint arXiv:1910.09115, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6111 2013.
Antonio Torralba, Rob Fergus, and William T Freeman. 80 million tiny images: A large data set for nonparametric object and scene recognition. IEEE transactions on pattern analysis and machine intelligence, 30(1 19158-999811970 2008.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.08347 2020.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustmess may be odds with accuracy. arXiv preprint /805. 2018.
Sachin Vernekar, Ashish Gaurav, Vahdat Abdelzad, Taylor Denouden, Rick Salay, and Krzysztof Czar- necki. Out-of-distributtin detection in classifiers via generation. arXiv preprint 1xXiv:1910.04::: 2019.
Xuwang Yin, Soheil Kolouri, and Gustavo K Rohde. Gat: Generative adversarial training for
adversarial example detection and robust classification. In International Conference on Learning Representations, 2020. URL htttttps://pperevviiii www.:nee/eeeeeee wttt:/forumiiio wtw.orrmmmmssseeeppA.....
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a sarge-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: / 506 03366. 2015.
12

---

Under review as a conference paper at ICLR 2021
Qing Yu and Kiyoharu Aizawa. Unsupervised out-of-distribution detection by maximum classifier discrepancy. In Proceedings of the IEEE International Conference on Computer Vision, pp. 9518-95266 2019.
Han Zhang, Tao Xu, Hongsheng Li, Shaoting Zhang, Xiaogang Wang, Xiaolei Huang, and Dimitris N Metaxas. Stackgan++: Realistic image synthesis with stacked generative adversarial networks. IEEE transactions on pattern analysis and machine intelligence, 1948)1194-1196,, 2018.
13

---

Under review as a conference paper at ICLR 2021
A RELATED WORK ON OUT-OF-DISTRIBUTION DETECTION
Out-of-distributie (OOD) detection, also known as novelty defection, or anomaly detection, deals with the problem of identifying novel, or unusual, data from within a dataset. OOD detection has gained much research attention due to its practical importance in safety-critical applications and changeling nature. A comprchensive review of classical OOD detection methods can be found at Pimentel et al. (2014).
A recent surge of research interests in this topic is due to the emergence of deep generative models. Such models (specifically explicit density models {Goodfellow (0166) estimate the generative probability density function of the data, and should serve as an ideal candidate for OOD detection.
However, it was observed (Kirichenko et al.) 2020. Nalisnick et al. 2018 Shafaei et al. 2018
Hendrycks et al. 2018)) that several state-of-the-an art deep generative models, including Glow (Kingmal & Dhariwal|2200 2001 2018). PixeICNN (Oord et al. 2016), PixeICNN++ (Salimans et al.), VAEs (Kingma 2013 Rezende al.) 2014), and Re flow model (Dinh et al.] (016] tend to assign higher likelihood to OOD inputs than they do to in-distribution inputs. Despite this challenge, several recent
works (Ren et al., 2019 Choi et al.] [0088] Nalisnick et al. 2019 Kirichenko al. 2020 Serra et al.,
2019: Song et al.
2019; Huang et al. 2019 Daxberger & Hernández-Lobato 2019 investigated the
issue and successfully applied deep generative models to OOD detection.
There is also a plethora of OOD detection methods (Hendrycks & Gimpel 2016 Lee et al. Liang al.
2018 8
2017: Sastry & Oore 2019 Quintanilha al. 2018] Abdelzad al. 2019 Chen
et al. 2018 8
Malinin & Gales| 2018 8) that make use of statistics computed from the predictions or
intermediate activations of standard classifiers train on in-distribution data. To name few, [ee et al.) (2018) fit class conditional Gaussian distributions using multiple levels of activations of the classifier, and use Mahalanobis distance to compute confidence scores to identify OOD inputs. The ODIN method (Liang al.] (0177) improves the effectiveness of softmax score based detection approach by using temperature scaling and adding small perturbations to the input. (Sastry& & Oore (2019) make use of gram matrices computed from the classifier's ' intermediate activations to identify OOD inputs.
Another branch of work utilize various alternative training strategies (Liu et al., 2020 Lee et al. 2017 Hendrycks et al.] (2188: 2019 [ Vries & Taylor 2018 (Shalev al. 2018 Vernekar et al.
2019 Yu & Aizawa 2019] Golan & Yaniv- 2018). A notable example is the Outlier Exposure (OE) method developed by (Hendrycks et al. 2018). OE works by training the OOD detector against a large, diverse out- -idto-ff-iittiutiinn dataset, and has been widely adopted as a baseline method.
While methods based on generative models and standard classifiers yield high performances naturally-occuringg OOD inputs, several such methods have been shown (Meinke & Hein 2019 Bitterwoff al. 2020) to be vulnerable to adversarial manipulation of the OOD inputs. This should come as no surprise as both generative models and standard classifiers themselves are vulnerable to adversarial attacks (Kos et al.
2018 Szegedy al. 2013). Given the above limitation of current approaches, recent trend considers the worst-case scenario for OOD detection (Hein et al. 2019
Sehwag et al. 2019 Meinke Hein| 2019 Bitterwolf al.) 2020). The Adversarial Conhdeecee Enhanced Training (ACET) method proposed by Hein et al. (2019) use adversarial training Madry
cet al. (2017) on OOD inputs to improve detection robustness. Meinke & Hein (2019) uses a
density estimator to provide guarantees on the maximal confidence around L ball for uniform noise.
Bitterwolf et al. (2020) use interval- -ooo--boudrrddreee propagation (IBP) to certificate worst case guarantees for general OOD inputs under - threat model. In the same spirit as Hein al. (2019), our detection method employs adversarial training on OOD inputs to induce robustness. The difference is that method uses the GAT' objective with optimal solution which naturally solves the robust OOD detection problem, while the optimal solution of the objective used by Hein et al. (2019), which is essentially multiple class classification objective with an extra term on OOD inputs, is unclear.
B MAXIMIN AND MINIMAX PROBLEMS IN GAME THEORY
In game theory, two-player zero-sum game is mathematical representation of situation in which one player's 's gain is balanced by another player's ss loss. Such a game is described by its functffunttion function : IRP+9 + IR, which represents the amount of payment that one player (player makes to the
14

---

Under review as a conference paper at ICLR 2021
other player (player 2). The goal of player 1 is to choose a strategy u E R2 such that the payoff is minimized, while the goal of player 2 is to choose a strategy u E R2 such that the payoff is maximized. The best strategies for both players, and the resulting payoff, depending on the order of play, could be solved via min, max, [u, v) or max, min, J (u, v).
In the minimax game min, maxg, player 1 makes the first move. Player 2, after learning that player 1 has made the move u, will choose a v to maximize fu, v), which results in a payoff of max, [u, v). Player 1, who is informed of player 2's strategy, will choose u such that the worse case payoff max. [u, v) is minimized, which results in a payoff of min, max, f'U,, v).
In the maximin game max, ming, the order of play is reversed. Player 2 makes the first move, and then player 1 minimizes the payoff by choosing u = arg min, f(u, v). Player 2 knows that player 1 will follow this strategy and will choose a such that the worse case payoff min, f(u, v) is maximized, which results in payoff of max, min, (u, v).
The payoff min, max; f(, v) is always greater or equal to max, min,, f(u, v). This difference can be intuitively understood as the result of player 2's extra knowledge gained by taking the second move. According to the minimax theorem (Neumann] 1928), when / is a continuous function that is concave-convex (i.e., for each v, f'u, v) is convex function of u, and for each u. [(u, v) is concave function of u)), these two quantities are equal. We refer the reader to [Boyd et al. (2004) ($5.4.3, $ 110.3.4) for more details on this topic.
C A DEMONSTRATION ON HOW TO SOLVE MAXIMIN PROBLEM
Without game theory interpolation, in Table 5 we present minimal example demonstrating how to solve a maximin problem max, min, f'u v), with f 12ety + R, u E IR, and u E IRs. In this example, has three values uo. 21, U2, and has two values: vo. Ut. To solve the maximin problem we first solve the inner minimization for each value of e. As an example, when we fix v to Ug. we solve the inner problem by choosing the u that when combined with to. yields the lowest value. We do the same computation for 01 and we have solved the inner problem. We then move forward to the outer problem by choosing from the above two solutions (red boxes) the one with the highest value (the green box).
Table 5: A minimal example demonstrating how to solve a maximin problem. The solutions for the inner problem for each value of are labeled red, and the final solution is highlighted as green.
4kp
81
M2
My
02
1/
Mo.
17g)
[Mo, Us]
[wa. 01)
Moo M2)
[11.
Aus.
Mus m))
fla. m3)
D MATHEMATICAL ANALYSIS OF OPTIMAL SOLUTIONS OF THE MAXIMIN PROBLEM
Recall that the support of Pe can be any subset of the pertubation space S and that U((D,p:)
J PP (x) log D(x))dxx+ + (x(x) log(1 - -D(x))) For convenience, we define the contour set inside S of D at a as CD == fx E S D(x) = a). the region of Supp(ps) that is outside of S as Oko := Supp(pk) \. S and the region of Supp(pk) that is in S as Qui == Supp(pk) S. Note that Supp(pk) = Sho U Sak. For fixed D and let o2 = max D and as = maxs D. It is easy to check that U is minimized when Supp(p.) lies in the contour set C.D. Let p be distribution such that Supp(p?) C C..- By direct computation we have that
/ pa(x) log D(x)dr + /
U(D,Pt)
Jan pz(x) log D(x)da + log(1 as)
< // (1)gloga)) + 1// pc)(log + +lo((1 as)
Bci + log
1
S + Bbi log
1 1 3ks
1 3Ks
15

---

Under review as a conference paper at ICLR 2021
where Be = -Sn., Pa. Note here we have used the fact the the function f(y) lo + blog(1 v) achieves its maximum at y ___ It is not difficult to that the above inequality becomes an equality when
Okk
I E Uko
D(x)
as
x E Qu
(6)
S ag
x E S Supp(pk)
where o% = 1 and os
Bes 14:8s
Note that D does not need to be defined outside S U Supp(pu).
Scenario 1 Here we deal with the case when is large enough such that Supp(ps) C S, in which case Skk = 0, Ss: Supp(p*) and as = 2. Hence by the above analysis one can check that U achieves its optimum when D = as 2 on Supp(px) and D S 2 on 8 Supp(px). In summary, the maximin problem achieves its optimum when D outputs less equal on samples outside the support of рk but S.
the support of pk and and values
Scenario 2 Here deal with the when is small enough such that the S n Supp(pk) 0, in which case 22 = (upp(p:). S4 = and aş = 0. Hence U achieves its optimum when D on Supp(ps) and D 0 on S. In summary, the maximin problem achieves its optimum when D outputs 1 on the support of Pa. and zero on the the perturbation space S.
Scenario 3 Here we deal with the case when S Supp(pk) + 0 and Supp(ps) & S. In summary, the maximin problem achieves its optimum when D outputs on the set of samples inside the the set of samples that are in the
support of pk but outside of the perturbation space S and T+
Bus
intersection of the support of pa and S and values less or equal to
Sc. on S.
1+92s
Remark
The first two cases can be seen the special cases of the third one.
E SCENARIO 2 DISCUSSION
robust machine learning literature, it's common to consider very small value for e. For instance, one of the most commonly used limit for training _ robust models is = 8//255 (L norm). A perturbation space characterized by a small limit can be thought as a semantic- -ennamtti-preseviigg space: translating sample inside the space doesn't 't change the sample's underlying label/class membership. small perturbation limit corresponds to scenario 2, which is also the focus of Yin et al. (2020). We define robust models models that output consistent predictions for inputs under semantic- preserving transformations. In this sense, the optimal D for scenario 2 is a robust detector, as it always outputs for the perturbation space. However, the limitation of training against small is obvious: because optimal D's outputs outside S Supp(Px) are unspecified, any cemantic-preservvee operation that has a perturbation that goes beyond S can result in high D output, thereby fools the detection. The above analysis suggests that for predictive models based on the generative adversarial training method, their robustness can improved by training against a larger perturbation space.
F ALGORITHM CONVERGENCE
F.1 STEP 3 ALWAYS DECREASE 8
We assume when B, D has single global maximum point (i.e., |B] 1).
Lemma 1. If < 3 and 1, Algorithm aaways decreases B3.
Proof. Let == maxsupp(ps) ) D. C = fa E Supp(ps) : D(x) < 3), and 7 == maxc D. (Same as the proof for Proposition we consider the case of 3,7 > }.) Going back to Algorithm 1, step moves mass of p- to B. Since B has only one element, the mass is concentrated on this single point. Step 3's optimization causes y to increase and to decrease. The intuition here is that step 3's update is small enough, these two values will meet in an intermediate point. Let the resulting values
16

---

Under review as a conference paper at ICLR 2021
be "1 and 31. If step 3's update on D is sufficiently small such that Y -Y y then have max m [1, m1 < 3 the maximum value of D on Supp(ps) has decreased.
F.2
THE EFFECTS OF ALTERNATING OPTIMIZATION
0.513
0.133
-0.133
0..133
05132
01
3.5322
0.1
05132
01
05131 -11
05131
-0.
05131
-03
0.519 -03
0.139 -0.3
0.0130
0.5129
05129
0.5129
-0.5
-0.3
-0.1
0.3
0.3
0.5
-0.5 -0.3
-0.1
0.1
033 0.5
-0.5
-0.3
-0.
011
0.3
0.5
(a) at initialization
(b) step updates ps
(c) step 3 updates
0.5
0.134
8.5
0.13
0.5
0.51M
0.113
0.3
0.3
0.5133
0.132
0.5132
-3
0.5130 -03
-03
-05
-03
-05
-03
-0.5
-03
(d) step 2 updates Pt.
(e) step updates D
(f) step 2 updates ps
Figure 4: The results of Pt and D in the first few iterations of 2D simulation of Algorithm 1 Step solves the inner minimization, causes support pt (red points) to be concentrated in local maxima points. Step update D by increasing its outputs the support of pı and decreasing its outputs on the support of Pt. causes local maxima to be suppressed.
17

---

Under review as a conference paper at ICLR 2021
F.3
MORE 2D SIMULATION RESULTS
0,300
069
04992
04922
0/935
04900
64477
0.09
E43350
15.
-43
05
04
03
03
33
E50900
649300
549900
648900
64000
2.887
0.030
125
48
033
-3
01
03
33
Figure 5: Solutions obtained by the maximin problem solver (Algorithm with different initializa-
tions of D. First row are results when p- is at bottom left (see Figure 2). and second row are results when p- are uniform distributions.
16
10
10
03
08 33
33
08 13
-8
31
-03
-2
04 -13
02 -13
00 -15
000
Figure 6: Solutions obtained by the minimax problem solver (Algorithm with different initial- izations of D. Note that in cases Pr (red distribution) matches ps (blue distribution), but D has unpredictable outputs on X Supp(pk). The initial position of the red distribution is in bottom left corner (see Figure 4 a)).
18

---

Under review as a conference paper at ICLR 2021
G EXPERIMENTAL SETUP
Model training We use Algorithm to train D models. Depending on the studied dataset, Ps is to one of the above three datasets, but we always use ImageNet (with data augmentation) as the p-k dataset (images are resized to 32 x 32 x 3 or 128 x 128 x 3 depending on dataset resolution).
We also use the same D architectures and batch size as Kurach al. (2018) (see Appendix G for more details of D architectures).
Following Yin et al. (2020). we use a pretrained D model to bootstrap optimization: for CIFAR-10 the D model is pretrained on the CIFAR-10 classification task, and for other datasets it is pretrained on the ImageNet classification task (Russakovsky et al., 2015). For all the datasets, the 7) update step in Algorithm 3 is performed using SGD optimizer with momentum of 0.9. The learning rate of the optimizer for CIFAR-10 datast is 0.0005, for CelebA-HQ-128 is 0.001, and for Bedroom- is 0.0025, The À value is set to 0.1 for CIFAR-I0, 10, and 0.6 for CelebA-HQ-I and Bedroom- 1itroom--12.. For all the trainings we use a batch size of 64, same as Kurach et al. (2018). The training follows standard supervised training, and doesn't use any regularization normalization.
Dataset preprocessing and statistics CelebA-HQ-128 dataset is downloaded from Manna (2020) The Bedroom- dataset is created from the corresponding LSUN dataset by center cropping the images using a square and then resizing to 128 128. CIFAR-10 10 has 60K training images and 10K test images. We manually split CelebA-HQ- 128 into a training split of 27K images and a test split of 3K images, and Bedroom-128 into training split of 300K images and a test split of 3K images.
Detector architecture Following Kurach et al. (2018), we use tow network architecture for the experiments. For CIFAR-10 10 task Table 7a). The architecture has 4 customized ResBlocks and takes 4.6MB disk space. For other 128 x 128 3 datasets, we the "ResNet19 discriminator" architecture (Kurach al. (2018) Table 5a). The architecture has 6 customized ResBlocks and takes 60MB disk space
the "ResNet-CIFAR architecture (Kurach al. (2018)
Image generation details We generate a new sample of p& by starting from some seed sample and performing gradient ascent on D using the update rule in eq. (3). In this case, the seed sample supposed to be out of the distribution of ps. When using the update rule in eq. (3), we need to specify the step size X, the number of steps, and for the Proj operation. We use the following configurations for generation:
For CIFAR- 10 generation (Figure B(a), Figure and Figure 16). we use step size 0.1, steps 200, and e 15.
For CelehA-HQ-1128 generation (Figure 3)) Figure 14 and Figure 17 we use step size 1.2,
steps 100, and 40.
For CelebA-HQ-1228 generation (Figure Cc., Figure 15 and Figure steps 400, and ε = 70.
18 we step size 0.8,
We note different configurations could lead to different generation results.
AUROC computation AUROC is metric that measures discriminative model's ability to separate two sets of data. To compute the AUROC score of a trained D model for a given p&: and POOD dataset, first use the D model to get the logit outputs of samples of these two datasets, and then use seikit-learn (Pedregosa et al. 2011)'s "sklearn.metre wwt.mmmtttticccccc.oo function to compute the score (with samples in Pk- labeled as 1s and samples PooD labeled as Os). We always the test splits of the POoD and pt datasets to do the above calculation.
Adversarial AUROC computation To compute the adversarial AUROC score of model for a given POOD and P& dataset, we first compute an adversarial OOD dataset POoD by taking samples from POoD and performing T,2- PDG attack (adrry et al. 2017) against the 1 model. We then compute the Adversarial AUROC score by computing the AUROC score on the POoD and Pk datasets. Same as the AUROC computation, we always use the test splits of the POoD and Pa to do the above calculation.
19

---

Under review as a conference paper at ICLR 2021
Table 6: In-distribution dataset and corresponding out-of-distribution datasets (images of OOD datasets are resized to the image size of the corresponding in-distribution dataset)
In-distribution dataset (ps)
distribtin datasets (PoOD)
Caussian noise, Uniform moise. SVHN (Netzer et al. 2011]. CIEAR-II 100 Krizhevsky al. 2009
CIFAR-10
ImageNet, CelebA, HIQ 128. Bedrom 128
Gaussian noise, Uniform noise, SVIIN, CIFAR-100,
CelebA-HQ-128
ImageNer, CIFAR- 10, Redroom- 128
Gaussian noise, Uniform noise, SVHN, CIFAR-100, ImageNet, CokeA-HQ-122, CIFAR-10
Bedroom- 128
Table Model training time.
Model
Training Time
CIFAR-I0 model CelebA-HQ-123 128 K 80 model
days hours 2080Ti GPU)
days 12 hours (2 2080TI GPUs)
Bedroom- 128 K 55 model
days 15 hours (2 20280Ti GPUs)
Table 8: FID scores
CIFAR-
CELEBA-HQ-IE 128
LSUN- WEW---EEROO--E 128
Our method
60.79
83.01
56.86
GANs (Kurach et al. 2018
22.7
24.7
40.4
20

---

Under review as a conference paper at ICLR 2021
H ABLATION STUDY
H.1 UNIFORM NOISE AND DATA DIVERSITY
In this ablation study, use CIFAR-10 class 0 data as the target data distribution dataset pk. and train models with different p- datasets.
observed in Table and 12 that when p-k uniform noise, the models only developed capability for identifying uniform noise and Gaussian noise OOD inputs. This result seems to contradict the mathematical analysis in Appendix M which says that with a uniform distribution as p- D function useful for detecting any kind of OOD inputs could be obtained. According to the manifold hypothesis, real image data lic on lower-dimensional manifolds embedded within the high-dimensional space. While in contrast, the uniform noise is highly concentrated on the surface of the unit d-cube in a high dimensional space [0, 1] Our conjecture that due to these geometry properties, in terms of Euclidean distance, real image data is close to each other while uniform noise live far away from the real data. As a result, uniform noise is much less data efficient than real data for training OOD detection models, and much larger number of inner iterations and K value in Algorithm may be needed to reach a satisfying detection performance.
For real image data experiments, we respectively CIFAR-I0 10 data from class to class 9 as the p-k dataset. ImageNet is a considerably much larger and more diverse dataset than the CIFAR-10 10 dataset, and it seen from Table 9 and Table I0 that the model training against Imagenet performs much better on OOD and adversarial OOD detection than the model trained against the CIFAR- 10 subset.
ImageNet and CIFAR-10 subset consisting of
Table 9: Average OOD performance (AUROC scores) on CIFAR10 class data. (p)- CIFAR-10
class 0, and P-A ImageNet).
model
é-test
K 0
K = 15
25
0.0
0.9940
0.9872
0,9758
1.0
0.1352
0.9330
0.9325
2.0
0.0084
0.6863
0.8284
Table 10: Average OOD detection performance (AUROC scores) on CIFAR-10 class 0 data. (Pi- CIFAR- 10 class 0, and p- = CIFAR-10 class class 9).
D model
e-test
K 0
K 15
K 25
0.0
0.9790
0.9699
0.9477
1.0
0.0985
0.8612
0.8732
2.0
0.0004
0.5023
0.6979
Table 11: OOD detection performance (AUROC scores) of K 0 model on CIFAR-10 class data (p& CIFAR- 10 class 0, and p-k uniform noise).
c-test
Gaussian noise
Uniform noise
ImageNet
Bedroom
SVHN
CelebAHQ
CIFAR100
0.0
1.0000
1.0000
0.5859
0.5791
0.5801 0.5141
0.5235 0.4510
0.5499 0.4816
0.6884
1.0
1.0000
1.0000
0.5161
0.5028
0.6379
"The volume of the unit d-cube shrunk hy some small epsilon in each dimension is given by V = (1 - 26)*. This quantity quickly approaches 0 as increases.
21

---

Under review as a conference paper at ICLR 2021
Table 12: OOD detection performance (AUROC scores) of K model on CIFAR-IO class 0 data. (PA = CIFAR-II 10 class 0, and p-k uniform noise).
e-test
Gaussian noise
Uniform noise
ImageNet
Bedroom
SVHN
CelebAHQ
CIFAR100
0.0
1.0000
1.0000
0.5772
0.5760
0.5711 0.5043
0.5139 0.4406
0.5435 0.4738
0.6831
1.0
1.0000
1.0000
0.5063
0.4984
0.6319
H.2
EFFECTS MODEL CAPACITY
Table 13: Adversarial OOD detection performances (AUROC scores) of our method trained with different model architectures and p-6 datasets. The in-distribution dataset is CIFAR-10. The definition of R can be found at pattps:// /tte:://gtthbae com wttp:///ao////////oooooooooo row.aa/esbbuutteeeeeooo
OOD dataset (with an L perturbation of 0.01)
Method
Uniform Noise
Gaussian Noise
SVHN
CIFAR-100
ResNet-CIFAR, p-1 = Imagenet (K = 5) ResNet-CIFAR, p. 800 Million Tiny Images (K = 5)
100
100
89,2
74.0
99.9
99.9
90.8
78.4
ResNet18, = 800 Million Tiny Images (K = 5)
99.0
99.1
91.8
81.8
Table 14:
Standard OOD detection performances (AUROC scores) of our method trained with different model architectures and p- datasets. The in-distribution dataset is CIFAR-10.
OOD dataset (no perturbation)
Method
Uniform Noise
Gaussian Noise
SVHN
CIFAR- 100
ResNet-CIFAR, p- Imagenet (K 5)
100
100
96.1
87.0
ResNet-CIFAR, p. 800 Million Tiny Images (K 5)
100
100
97.0
89.1
ResNet18, p- = 800 Million Tiny Images (K
99.6
100
97.4
91.5
I FAILURE MODE DIAGNOSIS
We observe that in Algorithm 3 if À set a large value, the algorithm fails learn D that is useful for image generation. In this section we discuss the training dynamics of the case of an appropriate À value and the case of being too large.
X is small enough In Algorithm 3 as we increase K, Pt gradually converges to ps- In this process becomes increasingly difficulty for the model to differentiate these two distributions. This phenomenon can be observed in Figure 7 the training loss (binary cross-entropy loss) of the D model becomes larger and larger (left subfigure), and eventually these two distributions become indistinguishable (AUROC ao 0.5. middle subfigure). From the right subfigure performance on p- vs. Pk is also affected by the increase in K value.
see that D's
is too large The failure mode caused by À being too large is easy identify (Figure 8) the training loss quickly decreases to 0 as K increases (left subfigure), Pt and p& become perfectly separable (middle subfigure), and D model becomes unable to separate p- from (right subfigure).
In general, with a small enough À value, an increase of sample quality could be expected after model trained with larger K. This the case when À is 0. 1, but not when it is 0.6 (Figure 9h.
22

---

Under review as a conference paper at ICLR 2021
1.0
1.0
AUI on originl DOD dota
0.
0.8
training loss
54
K-
--10
on
2.6
K 10
20
30
K- 30
0.2
2500
5000
7500
10000
12500 15000
2500
5000
10000
12500
15000
2500
5000
30000 12500 15000
Figure 7: CIFAR-IO training curves of X = 0.1. Left: training loss curves, middle: AUROC curves (Pt vs. Pk), and right: AUC curves (p-x vs. Pk).
1.0
AUC on orgginal DOD data
0.8
8.
training 1025
0.2
0.6
2530
20000
iteration
iteration
iteration
Figure 8: CIFAR-10 10 training curves of failed training instance (A 0.6).
(a) A = 0.1
(b) A = 0.6
Figure 9: Generated samples after training with an increasing sequence of K values (K 0, 1,2). Sample quality improved when = 0.1, but didn't when 0.6.
23

---

Under review as a conference paper at ICLR 2021
J EXPANDED OOD RESULTS
J.1 CIFAR-10
Table 15: The performances of CIFAR-I0 K 25 model under PGD attacks of different combina- tions of steps and step size. The perturbation limit is 2.0 (I2² norm). Each entry is computed using 500 positive samples and 500 negative samples.
ImageNet
stop
step
stop sinc
step
s0eps
steps
200
116745
0,7194
0:9678
0.5192
0.6722
0.6717
0.6988
0.7000
0.9084
0.9673
0.9672
0.3167
0.5239
0.6032
0.3670
0.5181
0OD duraset: Bedroom-1E
OOD dasaset SVIN
OOD dumset: CalebA HQQ
step size
step size
stop sine
slogs
0.3
stags
2.0
0.5291
0.5631
015284
0.5368
0.5575
0.5625
03312
0.5277
0.5192
0.5333
0.534
1000
0.5307
0,5430
0.5494
0.5531
0.5589
1000
0.3653
0. 0.5623
0,5624
0,5642
0.5653
OOD dstaset: CIFAR-100
0.5
0.05
0.4312
0.4340
0.4388
0.4299
0.4309
Table 16: OOD detection performances of the CIFAR-10 = 0 model on individual datasets. Each entry in this table and the following two tables is computed using 3000 positive samples and 3000 negative samples. When test O, perturbations are computed using PGD attacks of steps 200 and step size 0.5.
c-test
Gaussian noise
Uniform noise
ImageNet
Bedroom
CelebA-HQ
CIFAR-100
meun
0.0
1.0000
0,9992
0.9905
0.9908
0.9956
0.9953
0.8475
0.9741
1.0
0.0000
0.0372
0.0001
0.0000
0.0000
0.0000
0.0001
0.0053
2.0
0.0000
0.0000
0.0000
0.0000
0.0000
0.0000
0.0000
0.0000
Table 17: OOD detection performances of the CIFAR- 10 K 15 model on individual datasets
Gaussian Uniform noise
ImageNet
Bedroom
SVHN
CelebA-HQ
CIFAR-100
0.0
0.9911
1,0000
0.8593
0.9247
0.9182
0.8731
0.8036
0.9100
1.0
0.9218
1.0000
0.6918
0.7712
0.7590
0.7264
0.6156
0.7837
0.4065
0.4485
0.4451
0.3503
Table 18: OOD detection performances of the CIFAR- 10 K = 25 model on individual datasets
Gaussian Uniform noise
ImageNet
Bedroom
SVHN
CelebA-HQ
CIFAR-100
0.0
0.8993
0.9998
0.8138
0.8725
0,8721
0.8248
0.7411
0.8605
1.0
0.8310
0.9943
0.6943
0.7470
0.7510
0.7171
0.7632 0.6075
2.0
0.6845
0.9712
0.5178
0.5414
0.5660
0.5723
0.4811
0.6131
24

---

Under review as a conference paper at ICLR 2021
J.2 CIFAR- 10 CLASS 0
Table 19: OOD detection performances of the CIFAR-10 0 model on individual datasets. Each entry in this table and the following two tables is computed using 1000 positive samples (the test set only has 1000 samples) and 1000 negative samples. PGD attack setting follows the CIFAR-10 experiment.
c-lest
Gaussian noise
Uniform noise
ImageNet
Bedroom
CelebA-HQ
meen
0.0
1.0000
1,0000
0.9917
0.9888
0.9903
0.9996
0.9880
0.9940
1.0
0.0046
0,9100
0.0034
0.0007
0.0006
0.0167
0.0107
0.1352
2.0
0.0000
0.0588
0.0000
0.0000
0.0000
0.0000
0.0000
0.0084
Table 20: OOD detection performances of the CIFAR- 10 K 15 model on individual datasets
Gaussian Uniform noise
ImageNet
Bedroom
SVHN
CelebA-HQ
CIFAR-100
0.0
0.9983
1,0000
0.9779
0.9819
0,9833
0.9999
0.9687
0.9872
1.0
0.9537
0.9999
0.9054
0.9055
0.8920
0.9974
0.8769
0.9330
0.6183
0.4486
0.9495
0.5763
Table 21: OOD detection performances of the CIFAR-10 K = 25 model on individual datasets
Gaussiun Uniform noise
ImageNet
Bedroom
SVHN
CelebA-HQ
CIFAR-100
0.0
0.9761
1,0000
0.9644
0.9680
0.9698
0.9998
0.9527
0.9758
1.0
0.9071
0.9963
0.9150
0.9146
0.9073
0.9979
0.8894
0.9325
2.0
0.7770
0.9787
0.7990
0.7802
0.7275
0.9841
0.7526
0.8284
25

---

Under review as a conference paper at ICLR 2021
J.3 GELEBA-HQ-12
Table 22: The performances of CelebA-HQ-128 K 40 model under PGD attacks of different combinations of steps and step size. The perturbation limit is c = 10 (L² norm). Each entry is computed using 500 positive samples and 500 negative samples.
Gunssian
datroet:
000 ImageNet
stpp
stop
stop
8.0
2,0
1,0
s9eps
8.0
2.0
1,0
0.5
8.0
1,0
0.5
100
0.9980
0.5960
0,9580
0.9980
0.9950
100
1,0000
1,0000
1.0000
1.0000
1,0000
100
0.9933
0.5922
0.9920
0,9923
0.9929
200
0 1.9930
0.5980
0,9580
0.9980
0.9980
200
1,0000
1,0000
1.000
1.0000
1,0000
200
0.9931
0.9920
0.9918
0.9520
0.9923
0.9930
119980
0.9880
1,000
1,0000
1,0000
0.9917
0.9920
000 Bedroom-125
dorauct:
CIFAR-10
stop stze
step
stop 5022
steps
2,0
stps
steps
1.0
100
0.9951
0.9943
0.9793
0.9938
0.9767
0.9820
OOD dataset: CIFAR- 100
step
steps
100)
0.9799
0.9788
0.9784
0.9765
0.9788
200
0.9794
0.9753
0.9745
0,9750
0,9764
Table 23: OOD detection performances of the CelebA-HQ-128 = 0 model on individual datasets. Each entry in this table and the following two tables is computed using 3000 positive samples and 3000 negative samples. When test e > 0, perturbations are computed using PGD attacks steps 200 and step size 2.0.
6-test
CIFAR-10
Gaussian noise
Uniform noise
ImageNet
Bedroom
SVHN
CIFAR-100
0.0
1,0000
1.0000
1.0000
0.9999
1.0000
1.0000
1.0000
1,0000
5.0
0,0000
0.0000
0.0048
0.0004
0.0000
0.0000
0.0000
0.0008
10.0
0,0000
0.0000
0.0000
0,0000
0.0000
0.0000
0.0000
0.0000
Table 24: OOD detection performances of the CelebA-HQ-122
128 K = 20 model individual datasets
CIFAR-10
Gaussiun noise
Uniform
ImageNet
Bedroom
SVHN
CIFAR-100
mean
0.0
0.9999
1.0000
1.0000
1.0000
1,0000
1.0000
0.9999
1.0000
5.0 0.9974
1.0000
1.0000
0.9988
0.9993
0.9965
0.9959
0.9983
10.0
0.9459
0.9903
0.9996
0.9805
0.9809
0.9190
0.9291
0.9636
Table 25: OOD detection performances of the CelebA-HQ-128 K
40 model on individual datasets
CIFAR-10
Gaussiun noise
Uniform noise
ImageNet
Bedroom
SVHN
CIFAR-100
mean
0.9999
1 1,0000
0.9999
1.0000
0.9999
0.9998
0.9999
5.0
0.9978
0.9997
1.0000
0.9990
0.9992
0.9968
0.9961
0.9984
10.0
0.9829
0.9958
0.9999
0.9925
0.9927
0.9744
0.9744
0.9875
26

---

Under review as a conference paper at ICLR 2021
J.4
BEDROOM- 128
Table 26:
The performances of Bedroom K 40 model under PGD attacks of different combinations of steps and step size. The perturbation limit is 10 (I2 norm). Each entry is computed using 500 positive samples and 500 negative samples.
DOD dataset Guussian moise
OOD datuset: Unitorm noise
000 dotasct: ImageNet
Step size
step size
stop size
steps
8.0
4,0
2,0
1.0
scps
3.0
2.0
1.0
0.5
steps
8.0
2.0
1.0
0.5
0,9190
0.9733
0.783
0:0795
0,8297
0.8333
0.844
200
0.392
0.8490
0.8899
0.8871
0.9091
200
0.9790
0.9799
0.777
09781
0.9789
200
0.8326
0.8269
0,8285
0.8330
08382
300
0.552
0.8437
0.5167
0,8549
0.8762
500
0.9789
0.9778
0.774
0.7755
0.9779
500
0.8318
0.8250
0.8257
0.6280
0.8315
00D ditsect CIFAR-10
0OD dotasct: SVHN
OGD datsett CdelA-HQ
size
step size
stp size
Maps
8.0
4.0
2.0
1.0
0.5
<tpp
8.0
4.0
2.0
1.0
0.5
steps
8.0
4,0
2.0
1.0
0.5
100
0.7433
0.7264
0.2388
0. 7480
0.7636
100
0.7856
0. 0,7798
0.7889
0.8002
0.8162
100
0.9033
0 1.9019
0. 0,9042
0.9081
0.9134
200
0.7367
0.7222
0.7267
0.7356
0,3470
200
0. 7.7800
0.7711
0.7766
0.7864
0. 2.7997
200
0.5020
0. 8.9996
0.9015
0,9042
0.9078
500
0.7338
0,7176
0.7205
0.7250
0.7315
500
0.7756
0
0.7700
0.7759
0.7836
500
0.9013
0.5984
0,8993
0,9011
0.9033
step size
steps
8.0
4.0
2.0
1.0
0.5
0.8062
0.8216
0.7954
0.7869
0.7946
500
0.7918
0.7778
0.7804
0.7855
0,7915
Table 27: OOD detection performances of the Bedroom- 128 K = 0 model on individual datasets. Each entry this table and the following two tables computed using 3000 positive samples and 3000 negative samples. When test 0, perturbations are computed using PGD attacks of steps 200 and step size 2.0.
c-test
CIFAR-10
Gaussian noise
Uniform noise
ImageNet
SVHN
CelebA-HQ
CIFAR-101
mean
0.0
1.0000
1.0000
1.0000
0.9713
1.0000
0.9999
1.0000
0,9959
5.0
0.0000
0.0000
0.0010
0.0002
0.0000
0.0000
0.0000
0.0002
10.0
0.0000
0.0000
0.0000
0.0000
0.0000
0.0000
0.0000
0.0000
Table 28: OOD detection performances of the Bedroom- 120 K 20 model on individual datasets
CIFAR-10
Gaussian noise
Uniform noise
ImageNet
SVHN
CelebA-HQ
CIFAR-100
mean
0.0
0,9959
1,0000
1.0000
0.9892
0.9955
0.9990
0.9946
0.9963
5.0
0,9604
0.999
1.0000
0.9569
0.9634
0.9900
0.9623
0.9760
10.0
0.6834
0.9085
0.9984
0.7888
0.7061
0.8937
0.7251
0.8148
Table 29: OOD detection performances of the Bedroom- 128 K 40 model individual datasets
CIFAR-10
Gaussian noise
Uniform noise
ImageNet
SVHN
CelebA-HQ
CIFAR-I00
0.0
0.9525
0.9932
0.9993
0.9593
0.9474
0.9824
0.9578
0.9703
5.0
0.8986
0.9649
0.9967
0.9267
0.8995
0.9650
0.9114
0.9376
0.7274
0.8642
0.9749
0.8417
0.7740
0.9112
0.7651
0.8369
27

---

Under review as a conference paper at ICLR 2021
K
EXPANDED GENERATION RESULTS
Figure 10: Samples generated by GANs (Kurach et al. 2018 results of our method are in Figure
(a) CIFAR- 10 seed images
(b) CelebA-HoE HQ-128 seed images
(c) LSUN- BEDROOM seed images
Figure 11: Seed images used to generated samples in Figure 3 Seed images for CIFAR-10 and
Bedroom-128 188 generated by applying Gaussian blur random images from ImageNet test
Seed images for CelebA-HQ-122 are generated by VAE model (Kingma 2013 Rezende et al. 2014) trained on the CelebA-HQ- 128 dataset.
Face retouching results. Top row are original images from the CelebA-HQ-123 test set, and bottom row are enhanced images. The strength of retouching could be increased by performing more steps gradient ascent on D.
Figure 12:
28

---

Under review as a conference paper at ICLR 2021
K.1 IMAGE GENERATION ABLATION STUDY: EFFECT K
Generated by 15 model
(b) Generated K 25 model
Generated by 40 model
Figure 13: Samples generated by CIFAR-10 10 models trained with different Ks. These generations all use the seed images in Figure 11 a).
(a) Generated by 20 model
(b) Generated by K 40 model
(c) Generated by 80 model
Figure 14: Samples generated CelebA-HQ- models trained with different Ks. These genera- tions all use the seed images in Figure b).
B
(a) Generated by K 20 model
(b) Generated by K 40 model
(c) Generated by 55 model
Figure 15: Samples generated by Bedroom- 128 models trained with different Ks. These generations all use the seed images in Figure c)...
29

---

Under review as a conference paper at ICLR 2021
K.2
IMAGE GENERATION ABLATION STUDY: EFFECT DIFFERENT TYPES OF SEED IMAGES
8 90
34
(a) Seed images
(b) Generated by K 40 model
Figure 16: Samples generated by the CIFAR-I0 K = 40 model using seed images on the left. Seed images are from OOD datasets (Table
0 210
6 8
(a) Seed images
(b) Generated by K 55 model
Figure 17: Samples generated by the CelebA-HH-122 K
80 model using seed images on the left.
Seed images random samples of OOD datasets (Table 6
30

---

Under review as a conference paper at ICLR 2021
CBB
21068 8
Seed images
(b) Generated by K 55 model
Figure 18:
Samples generated by the Bedroom- 128 K Seed images are random samples OOD datasets (Table 6).
55 model using seed images on the left.
31

---

Under review as a conference paper at ICLR 2021
L 256 x 256 RESOLUTION GENERATION
Figure 19: Uncurated 256 256 generation results in the dataset.
32

---

Under review as a conference paper at ICLR 2021
Figure 20: Uncurated 256 x 256 generation results in the Bedroom256 dataset. The state-of the-art results on this dataset can found Figure of Karras et al. (2019).
33

---

Under review as a conference paper at ICLR 2021
Figure 21: Uncurated x generation results the ImageNet Dog 256 dataset. The state- of-the-art results on this dataset can be found at Brock et al. (2018), although their results of resolution 128 x 128 and at the same time class-conditional Unconditional generation results on this dataset can be found at Zhang et al. (018).
34

---

Under review as a conference paper at ICLR 2021
M PROOF OF ALGORITHM I CONVERGENCE PROPERTY
k is a uniform distribution over the space X', Supp(pe)), In this section we provide a proof that when p- converges to D solution with no local maxima and global maxima at support of pk.
Algorithm 1
To recap Algorithm[ | in each iteration step samples points from Pk and p-k, step 2 solves the inner maximization by moving samples of p-& to locations where D has the maximum outputs, and step solves the outer minimization by increasing D outputs on pI: samples (maximizing Ex [log (x))))
and decreasing outputs on p-k samples (maximizing Ex [log - D(z)]]. Step is implemented by performing gradient ascent on D, using initial samples of p-k as starting points. Given that D could be a non-concave function during the course of Algorithm | execution, samples of p-* could
be stuck in local maxima points in X' Supp(ps). We now show that due to this gradient-based search method used by step 2, Algorithm has the following convergence property:
Proposition 2. When p-k is a uniform distribution over the space X \ Supp(ps). Algorithm converges to a D solution with no local maxima and global maxima at support of pk-
Proof. We assume that D has enough capacity such that step 3's update of D in Supp(px) does not affect D's outputs in X's \ Supp(ps). We assume that the environment in which Algorithm 1 is simulated has a numeric limit of c (e.g., c = 10-12) such that X' \ Supp(ps) is a finite set. (This assumption is valid when the algorithm runs on computer.) Since X \ Supp(pu) is a finite set, we consider the case where P- is a discrete uniform distribution. This distribution has non-zero probability any point in X', \ Supp(pe).
We first prove that any local maximum point in X²), (upp((p)) can be eliminated by running Algorithm 1 for sufficient and finite number of iterations. To proceed, we first state the condition under which a local maximum point will be climinated: a local maximum point q in X' \ Supp(ps) will be eliminated if via one or more iterations of the algorithm a sufficient number of p-k samples reach q. When this condition is satisfied, the cumulative effects of step 3 cause the local maximum to disappear by decreasing (4)) to a sufficiently small value.
We next show that the above condition is always satisfied when Algorithm runs for finite number of iterations. Let be the set of points in X') (upp((())) that reach when performing gradient ascent on D in step 2. U is non-empty when sufficiently small step size is used for performing the gradient ascent, as it at least contains the point q itself when a step size of 0 is used. For U is non-empty, a sufficient number of p- samples could fall on U and subsequently reach q if enough samplings of P-k are done via step 1.
For given D, the set of local maxima points in X') \ Supp(pk) is finite set. However, as new local maxima are constantly being created due to D's update in each iteration, it is possible that this set will never be empty. We now prove that in finite iterations of the algorithm this set actually goes to empty. Let Qe be the set of local maxima points of D in X' Supp(pk) in iteration f. We have shown in the first proof that all the elements of 2, are going to be reached by p-& samples in a finite number of iterations, hence if Q, is non-empty as f + co, D values in X' \ Supp(ps) will be decreased by an 2 amount for an infinite number of times, which contradicts our assumption that D a finite function in the finite set of X Supp(pk).
We note that the above convergence property holds for any random initialization of D. However, uniform distribution is not necessary condition here; any p- distribution that has non-zero density everywhere in the data space will suffice. For a particular or particular type of initialization of D, its local maxima points could follow some pattern, and hence the assumption on p-a could be relaxed. However, in practice whether or not p- distribution is sufficient for a given D can be difficult to measure.
35

---

Under review as a conference paper at ICLR 2021
N EXTENDED ADVERSARIAL OOD DETECTION RESULTS
Table 30: The performance (AUROC scores) of CIFAR-10 K 5 model (the in- di-dstriibution dataset CIFAR-10) under attacks of different configurations. Following Bitterwolf al. (2020) used 1000 samples for both in-distribution data and OOD data. Similarly, we used 5 random restarts to enhance the default attack, but the performance decrease is negligible.
OOD dataset (with an 1 perturbation of 0.01)
PGD attack steps, step size
Uniform Noise
Gaussian Noise
SVHN
CIFAR-100
100, 0.002 (default for Table
98.69
99.32
91.48
82.41
100, 0.002 (5 random restarts)
98.69
99.31
91.45
82.39
500, 0.002
98.69
99.31
91.47
82.40
500, 0.005
98.70
99.32
91.48
82.43
500, 0.01
98.71
99.39
91.57
82.61
1000, 0.001
98.69
99.31
91.47
82.40
Table Adversarial OOD detection performances (AUROC scores) when in-distribution dataset is SVHN. Performance data of methods other than ours is collected from Bitterwolf et al. (2020). The results of our method are based on an PGD attack of steps 100 and step size 0.005. For results under different attack configurations including with random restarts see Table 32 Our SVHN model was trained with 800 Million Tiny Images dataset as the p-& dataset and used the ResNet18 architecture.
OOD dataset (with an L perturbation of 0.03)
Method
Uniform Noise
Gaussian Noise
CIFAR-10
CIFAR 100
OE Hendrycks et al., 2018
98.2
N/A
62.5
60.2
CCU MMinke Hem
2019)
100
N/A
56.8
52.5
ACET (Hein ct al. 2019
96.3
N/A
99.5
99.4
GOOD Bitterwolf et al. 2020
99.9
N/A
98.4
97.7
Ours (K 45)
100
99.7
99.7
99.4
Table 32: The performance (AUROC scores) of SVHN K 45 model (the in-distribution dataset is SVHN) under attacks of different configurations. Following [ollowingBBittewoolfl samples for both in-distribution data and OOD data. Similarly, we used random restarts to enhance the default attack, but the performance decrease is negligible.
Bitterwoll et al. (0200) used 1000
OOD dataset (with an L perturbation of 0.03)
PGD attack steps, step size
Uniform Noise
Gaussian Noise
CIFAR-10
CIFAR- 100
500, 0.002 100, 0.005
100
99.84
99.78
99.53
100
99.85
99.78
99.54
100, 0.005 (5 random restarts)
100
99.85
99.78
99.54
500, 0.005
100
99.85
99.78
99.54
500, 0.01
100
99.86
99.79
99.55
1000, 0.001
100
99.84
99.78
99.53
36


Reviews:
[{"review_id": "iAkiqxK2V2x", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper the authors provide a theoretical and empirical analysis of the Generative Adversarial Training method (GAT) which is used to train models for OOD and adversarial example detection.\n\nThe GAT method is analyzed from a game theoretical prespective, focusing on the differences with GAN training, which are sometime conflated with it in the literature. The authors show that GAT and GAN have different training problems (maximin vs minimax) which have different optimal solutions.\n\nThe authors also propose a variant of GAT called Unconstraned GAT, which replaces the PGD attack in the inner optimization loop with an unconstrained steepest ascent update. They propose this training algorithm for both OOD detection, adversarial OOD detection and generative sampling.\nThey discuss the sensitivity of the proposed algorithm on the step size, which seems to critically depend on the model architecture and dataset. Experiments are performed on standard image datasets, using ImageNet as a source of known OOD examples.\n\nOverall the work is interesting, however I find some issues:\n- The key point of the theoretical anaysis comparing GAT with GAN is only made at the end. It would be better to mention in the introduction at a high level why GAT is preferable to GAN.\n- Maximin and minimax are terms specific to game theory which a typical ML researcher might not be familiar with. They should be defined, possibly first in an intuitive way and then formally.\n- The proposed algorithm seem quite sensitive on the step size. This might limit its practical applicability (minor issue: the step size is denoted as lambda in the text and gamma in the algorithm box).\n- The proposed generative sampling procedure will likely return a mode of the distribution rather than an unbiased sample. You would need to use an SGLD-like algorithm in order get unbiased samples.\n\nEDIT:\n\nThe revision addressed my concerns, I'm raising my evaluation to 7.", "extra_scores": {}, "extra_text": {}}, {"review_id": "V8qV1CmkgiR", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**1. Summary and contributions: Briefly summarize the paper and its contributions**\nThis work analyzed the optimal solutions for the Generative adversarial training (GAT) and the convergence property of the training algorithm. This work also compared the minimax and maximin games, both theoretically, and empirically, with the help of a nice 2D toy example. This work also developed an unconstrained version of GAT, and evaluated it on image generation and out of distribution detection tasks. \n\n##########################################################################\n\n**2. Strengths: Describe the strengths of the work. Typical criteria include: soundness of the claims (theoretical grounding, empirical evaluation), significance and novelty of the contribution, and relevance to the community.**\n\nI found the theoretical analysis to be interesting, and I especially like the 2D toy experiment in Figure 2, it strongly and clearly justified the importance of using a uniformly distributed p_(-k) distribution. \n\nI also liked the thorough discussion of the distinction between the minimax and maximin games. \n\nThe paper has interesting ideas and a lot of content, it also introduced adversarial OOD samples, which are all very interesting to me. \n\n##########################################################################\n\n**3. Weaknesses: Explain the limitations of this work along the same axes as above.**\n\nMemorization: \nI think optimizing the D approach is problematic in terms of memorization, there’s nothing stopping the model to memorize the data, especially in the high dimensional space which makes the mass distribution to be very sparse. \n\nIn the Celeb A results in the middle of Figure 3, notice how the images (4,1), (4,3) look almost exactly the same, and they are also very similar to (1,3), (3,1) and (3,4).  \n\nIn figure 2b and 2c, notice how the distribution all collapses to 1 point, I wonder whether this is one perspective or intuition on this problem. \n\nUnverified claim: \nAt the bottom of page 7, “These results suggest that with a high capacity model and proper training, a robust OOD detection system is within reach.” where these results referred to reducing the data complexity. I think the results in this paper are not enough to make this claim. The authors’ logic here is that, if their model performs better on a simple dataset, then it implies the problem is insufficient model capacity. The assumption here is that the model can scale, which is completely unverified. Just because a model works well on MNSIT does not imply it is even possible to scale this model on ImageNet. An unverified claim like this is always a warning sign as it may mislead the readers and community. \n\nLack of ablation study: \nI really liked the toy experiments in Figure 2, which justified the use of uniform distribution in the data space. However this only provides intuition for the higher dimensional cases, it is still necessary to conduct an ablation study to verify this is indeed the case for higher-dimensional cases, for scientific rigor.  \n\nUnfair comparison: \nFor image generation results, the authors’ method was compared with GANs, and the motivation is that both of the methods are trained adversarially. However, the generators of GANs never got to see the real data during train time. Here authors are optimizing D, which is trained on real data, thus I don’t think it is fair to compare with GANs.  \n\nWeak baseline for OOD (outlier exposure) and insufficient comparison:\nOutlier exposure is no longer the state of the art OOD detection methods and there are so many other methods that perform better than outlier exposure on CIFAR10, for example, see Detecting Out-of-Distribution Examples with Gram Matrices: https://arxiv.org/abs/1912.12510 \n \nLack of Related Work section: \nThis paper does not have a related work section. The related works are very briefly discussed in the introduction, but I think that is far from enough. I understand there is a page limit, but even putting a related work section in the appendix would be very helpful for readers to get a more complete understanding of where this work stands. \n\nUnclear writings: See section 4.\n\n ##########################################################################\n\n**4. Clarity: Is the paper well written?**\nTypos: \nAt the top of page 3: as a results -> as a result\nBottom of page 8: a OOD -> an OOD\n\nAmbiguity: \n“elementary mass” was not defined before being used, it’d be helpful to the readers to briefly define what “elementary mass” means in this specific context. \n\n“In order to cause more local maxima to be eliminated” could be worded better. \n\n##########################################################################\n\n**5. Reasons for score**\nIn conclusion, the ideas are very interesting but I think there is a lot more work to be done before this paper could be accepted. \n", "extra_scores": {}, "extra_text": {}}, {"review_id": "O62PxY7-hqV", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors investigated generative adversarial training (GAT) and made two main contributions: 1) theoretically analyzed its maxmin objective and compared  with the minmax formulation used by GANs, and 2) applied GAT to OOD detection and generative models. Extensive experiments were performed for evaluating the proposed algorithm.\n\n############################\n\nStrong points:\n\n. The authors analyzed the maxmin formulation of GAT theoretically by deriving the optimal solutions under different scenarios, and also showed the conditions under which the algorithm converges to the optimal solution.\n\n. The authors pointed out the difference between the maxmin formulation and the minmax formulation used by GANs, and extended GAT for two applications: OOD detection and generative models.\n\n. Extensive experiments were performed for evaluating the proposed algorithm.\n\n############################\n\nWeak points:\n\n. In Section 3.1, for the convenience of analysis, the authors transformed equation (4) to (5). Are these two optimization problems equivalent? Seems not. Please add brief explanation.\n\n. Algorithm 1 is claimed to solve equation (5). However, in Step 2 the maximization is still over B(x,\\epsilon). It seems that Algorithm 1 is to solve equation (4). Please explain.\n\n. Section 3.2: a practical consideration is that Step 2 cannot be perfectly solved and the authors thus proposed to use a p_{-k} that is uniformly distributed in the data space. The authors claimed that  such condition always results in no maxima and global maxima at Supp(p_k). Can this conclusion be theoretically proved? One potential limitation is that using a p_{-k} that is uniformly distributed could lead to a long training time for achieving a satisfactory performance especially in high dimensional.\n\n. OOD detection is an active area and there are a lot of papers regarding this. In experiment, the authors mainly focused on evaluating the proposed algorithm, and did not compare it with any other OOD detection methods, e.g., log-likelihood based and likelihood ratio based. Although K = 0 can be thought of as exposing to outliers, the resulting algorithm is still under GAT framework. As OOD detection is suggested as a main application of GAT, it is important to compare it with state-of-the-art.\n\n. It is hard to compare the quality of generation by only observing the generated images. It's better to show some quantitative comparison by using, e.g, FID score, which is commonly adopted for evaluating GANs. \n\n####################\nSome typos:\n\n. In equation (3), should be \\lambda.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper conducts a theoretical and empirical analysis of the Generative Adversarial Training method (GAT). Although many comments have been addressed in the rebuttal, the reviewers still have few (but important) concerns, including the memorization effects and the lack of comparisons. 
Decision: Reject