A Functional Perspective on Multi-Layer Out-of-Distribution Detection
Authors: Eduardo Dadalto Câmara Gomes
Pierre Colombo
Guillaume Staerman
Nathan Noiry
Pablo Piantanida
Venue: Submitted to ICLR 2023 (2023)
Keywords: Out-of-distribution detection
Deep Learning
Safety AI

Abstract: A crucial component for implementing reliable classifiers is detecting examples far from the reference (training) distribution, referred to as out-of-distribution (OOD) samples. A key feature of OOD detection is to exploit the network by extracting statistical patterns and relationships through the pre-trained multi-layer classifier. Despite achieving solid results, state-of-the-art methods require either additional OOD examples, expensive computation of gradients, or are tightened to a particular architecture, limiting their applications. This work adopts an original approach based on a functional view of the network that exploits the sample's trajectories through the various layers and their statistical dependencies. In this new framework, OOD detection translates into detecting samples whose trajectories differ from the typical behavior characterized by the training set. Our method significantly decreases the OOD detection error of classifiers trained on ImageNet and outperforms the state-of-the-art methods on average AUROC and TNR at 95% TPR. We demonstrate that the functional signature left by a sample in a network carries relevant information for OOD detection. 

A FUNCTIONAL PERSPECTIVE ON MULTI-LAYER OUT-OF-DISTRIBUTION DETECTION
Anonymout monyymosso.. authors
Paper under double-blind review
ABSTRACT
A crucial component for implementing reliable classifiers is detecting examples far from the reference (training) distribution, referred to out-of-distribution (OOD) samples. A key feature of OOD detection is to exploit the network by extracting statistical patterns and relationships through the pre-trained multi-layer classifier. Despite achieving solid results, state-of-the-ar methods require either additional OOD examples, expensive computation of gradients, are tightened to a particular architecture, limiting their applications. This work adopts an origi- nal approach based on a functional view of the network that exploits the sample's s trajectories through the various layers and their statistical dependencies. In this new framework, OOD detection translates into detecting samples whose trajecto- ries differ from the typical behavior characterized by the training set. Our method significantly decreases the OOD detection error of classifiers trained on ImageNet and outperforms the state-of the-art methods on average AUROC and TNR at 95% TPR. We demonstrate that the functional signature left by a sample in a network carries relevant information for OOD detection.
INTRODUCTION
The ability of a Deep Neural Network (DNN) to generalize to new data is mainly restricted to pri- orly known concepts in the training dataset. In real-world scenarios, Machine Learning (ML) mod- els may encounter Out-Of-Dii Of-Distribution (OOD) samples, such as data belonging to novel concepts (classes) (Pimentel et al., 2014), abnormal samples (Tishby & Zaslavsky, 2015), even carefully crafted attacks designed to exploit the model (Szegedy et al., 2013). The behavior of ML systems on unseen data is of great concern for safety-critical applications (Amodei et al., 2016b;a), such as medical diagnosis in healthcare (Subbaswamy & Saria, 2020), autonomous vehicle control in trans- portation (Bojarski al., 2016), among others. To address safety issues arising from the presence of OOD samples, a successful line of work aims at augmenting ML models with an OOD binary detec- tor to distinguish between abnormal and in-distribution examples (Hendrycks & Gimpel, 2017). An analogy to the detector is the human body's 's immune system, with the task of differentiating between antigens and the body itself.
Distinguishing OOD samples is challenging. Some previous works developed detectors by combin- ing scores at the various layers of the multi-layer pre-trained classifier (Sastry & Oore, 2020; Lee et al., 2018; Gomes al., 2022; Huang et al., 2021). These detectors require either held-out OOD dataset (e.g., adversarially generated or OOD data) or ad-hoc methods to linearly combine OOD scores computed each layer embedding tightened to a particular architecture. A key observation is that existing aggregation techniques overlook the sequential nature of the underlying problem and, thus, limit the discriminative power of those methods. Indeed, input sample passes consecutively through each layer and generates a highly correlated signature that can be statistically characterized. Our observations in this work motivate the statement that:
The input's 's trajectory through a network is key for discriminating typical from atypical samples.
In this paper, we introduce a significant change of perspective. Instead of looking at each layer score independently, we cast the scores into sequential representation that captures the statistical trajec- tory of an input sample through the various layers a multi-layer neural network. To this end, we adopt functional point of view by considering the sequential representation curves parametrized

---

Trajectory Extraction
OOD Score Computation
SN
Projection
U
U
Logee-wae Wib-
100
g( s,
Figure 1: The left-hand side of the figure shows the feature extraction process of deep neural network classifier f. The mapping of the hidden representations an input sample into a functional representation is given by a function ø. The functional representation of a sample encodes valuable information for OOD detection. The right hand side of the figure shows how our method computes the OOD score s of sample during test time. A projection of the sample's 's trajectory into the training reference trajectory i7 is computed. Finally, a threshold y is set to obtain a binary discriminator
by each layer. Consequently, redefine OOD detection as detecting samples whose trajectories are abnormal (or atypical) compared to reference trajectories characterized by the training set. Our method, which requires little parameter tuning and, perhaps more importantly, no additional OOD or synthetic data, can identify OOD samples from their trajectories. Furthermore, we show that typ- ical multivariate detection methods fail detect OOD patterns, which may manifest in an isolated fashion by shifting in magnitude or overall shape. Figure summarizes our method.
Contributions. This work presents a new principle and unsupervised method for detecting OOD samples that do not require OOD (or extra) data and brings novel insights into the problem of OOD detection. Our main contributions can be summarized as follows.
1. A novel problem formulation. We reformulate the problem of OOD detection through a functional perspective that effectively captures the statistical dependencies of an input sample's path across a multi-layer neural classifier. Moreover, we propose map from the multivariate feature space (at each layer) to a functional space that relies on the probability weighted projection of the test sample onto the class conditional training prototypes at the layer. It is computationally efficient and straightforward to implement.
2. Computing OOD scores from trajectories. We compute the inner product between the test trajectory and the average training trajectories to measure the similarity of the input w.r.t the training set. Low similarity indicates that the test sample likely sampled from OOD,
3. Empirical evaluation. We validate the value of the proposed method using mid-size OOD detection benchmark on ImageNet- 1k. We obtain competitive results, demonstrating an average ROC gain of 3.7% across three architectures and four OOD datasets. We release our code anonymized online.
2 RELATED WORKS
This section briefly discusses prior work in OOD detection, highlighting confidence-baser and feature-based methods without special training as they resonate the most with our work. An- other thread of research relies on re-training for learning representations adapted to OOD detection (Mohseni et al., 2020; Bitterwolf et al.; Mahmood et al., 2021), either through contrastive training (Hendrycks et al., 2019; Winkens et al., 2020; Sehwag et al., 2021), regularization (Lee et al., 2021; Nandy et al., 2021; Hein et al., 2019; Du et al., 2022), generative (Schlegl et al., 2017; ood, 2019; Xiao et al.; Ren et al.; Zhang et al., 2021), or ensemble (Vyas et al., 2018; Choi & Jang, 2018) based approaches. Related subfields are open set recognition (Geng al., 2021), novelty detection (Pi-
2

---

mentel et al., 2014), anomaly detection (Chandola al., 2009; Chalapathy & Chawla, 2019), outlier detection (Hodge & Austin, 2004), and adversarial attacks detection (Akhtar & Mian, 2018).
Confidence-based OOD detection. A natural measure of uncertainty of sample's ' label is the classification model's softmax output. Hendrycks & Gimpel (2017) observed that the maximum of the softmax output could be used samples. Hein et al. (2019) observed that it may still assign overconfident values to OOD examples. Liang et al. (2018 8) and Hsu al. (2020) propose re-scaling the softmax response with temperature value and a pre-processing technique that further separates in- from rut-of-distribution examples. Liu et al. (2020) proposes an energy-based OOD detection score by replacing the softmax confidence score with the free energy function. Sun & Li (2022) proposes sparsification of the classification layer weights to improve OOD detection by regularizing predictions.
discriminative score between in-distribution and OOD
Feature-based OOD detection. This line of research focuses on exploring latent representations for OOD detection. For instance, Haroush et al. (2021) considers using statistical tests, Sastry & Oore (2020) rely higher-order Grams matrices, Quintanilha et al. (2019) uses mean and standard deviation within feature maps, Sun et al. (2021) proposes clipping the activations to boost OOD detection performance, while recent work Huang et al. (2021) also explores the gradient space. Normalizing and residual flows to estimate the probability distribution of the feature space were proposed in Kirichenko et al. and Zisselman & Tamar (2020). Lin et al. (2021) rely on networks with multiple classifiers and introduces a dynamic OOD detection method which selects the index of the layer in test time to compute the score from. Sun al. (2022) proposes non-parametric nearest-neighbo based on the Euclidean distance for OOD detection. Perhaps one of the most widely used techniques relies on the Gaussian mixture assumption for the hidden representations and the Mahalanobis distance (Lee et al., 2018; Ren et al., 2021) or further information geometry tools (Gomes et al., 2022). Efforts toward combining multiple features to improve performance were previously explored (Lee et al., 2018; Sastry & Oore, 2020; Gomes et al., 2022). The strategy relies heavily upon having additional data for tuning the detector or focusing on specific model architectures, which are limiting factors in real-world applications.
3 PRELIMINARIES
We start by recalling the general setting of the OOD detection problem from a mathematical point of view (Section 3.1). Then, in Section 3.2, we motivate method through simple yet clarifying illustrative example showcasing the limitation of previous works and how we approach the problem.
3.1 BACKGROUND
Let (X,Y) be a random variable valued in a space X' x y with unknown probability density function (pdf) pxy and probability distribution PxY. Here, X C Rd represents the covariate space and y= (1, (I....,C'} C'} corresponds to the labels attached to elements from X. The training dataset Sy = ((a,, 3 is defined as independent and identically distributed (i.i.d) realizations of Pxy From this formulation, detecting OOD samples boils down to building a binary rule X + {0, 1} through a soft scoring function 8 X + and a threshold 7 E R. Namely, a new observation E X is then considered in-distribution, i.e., generated by PxY. when g(x) 0 and as OOD when g g(x) = 1. Finding this rule from X' can become intractable when the dimension is large. Thus, previous work rely on multi-layer pre-trained classifier fo X - y defined as:
f.(:) = h fr o fL-10- ..... f.(),,
with 2 layers, where Se Rede- - Rdde is the f-th layer of the multi-layer neural classifier,
de denotes the dimension of the latent space induced by the f-th layer (do = d), and h indicates the classifier that outputs the logits. We also define z; = (fe o ....o fi)(z) as the latent vectorial representation at the &-th layer for an input sample x. We will refer to the logits ø1+1 and h as fL+1 to homogenize notation. It is worth emphasizing that the trajectory of (21, ,2, 21+1) corresponding to a test input To dependent random variables whose joint distribution strongly depends on the underlying distribution of the input.
Therefore, the design of function g(.) is typically based on the three key steps:
3

---

Towin
best see
Places Techhrme
Held-out. IND
(Nsturalttt
Feature Score 2
Held-out 00D
1.0
0.6
Linear D.B.
0.4
Store
0.6
Unreliable
8
-0.2
3 19
Feature Score
3
5
9
11
13
(a) Example of a mispecified model in toy example in 2D caused by fitting with held-out OOD dataset.
(b) Trajectory of data through a net- work with 25% and 75% percentile bounds.
(c) Correlation between layers training scores in network, high- lighting structure in the trajectories.
Figure 2: Figure 2a summarizes the limitation of supervised methods for aggregating layer scores that rely held-out OOD or pseudo-OOD data. It biases the decision boundary (D.B) that doesn't generalize well to other types of OOD data. We observed that in-distribution and OOD data have disparate trajectories through network (Fig. 2b), specially on the last five features. These features correlated in sequential fashion, observed in Fig. 2c.
(i) A similarity measure d(:;) ;.)) (e.g., Cosine similarity, Mahalanobis distance, etc.) between sample and a population is applied at each layer to measure the similarity (or dissimilarity) test input vo at the ê-th layer z,,0 = (fe o fi) w.r.t the population of the training examples observed at the same layer { = (Je a..... fi)())
Sw}. The layer-wise score obtained mapped the real line collecting the OOD scores.
iiii
Lastly, threshold is chosen to build the final decision function.
fundamental ingredient remains step (ii):
How to consistently leverage the information collected from multiple layers outputs an unsupervised way. i.e., without resorting to OOD Rreudo-OOD examples?
3.2 FROM INDEPENDENT MULTI-LAYER SCORES TO A SEQUENTIAL PERSPECTIVE OF OOD DETECTION
Previous multi-feature OOD detection works treat step (ii) supervised learning problem (Lee et al., 2018; Gomes et al., 2022) for which the solution is a linear binary classifier. The objective to find linear combination of the scores obtained at each layer that will sufficiently separate in-distribution from OOD samples. A held-out OOD dataset is collected from true (or pseudo- generated) OOD samples. The linear soft novelty score function 8a writes:
(a Σ az (xni (ffe.... (z) t Sx))
The shortcomings of this method are the need for extra data or ad-hoc parameters, which results in decision boundaries that underfit the problem and fail capture certain types of OOD samples. To illustrate this phenomenon, we designed toy example (see Figure 2a) where scores are extracted from two features fitting linear discriminator on held-out -i-distribution (IND) and OOD samples. As consequence, areas of unreliable predictions where OOD samples cannot be detected due to the misspecification of the linear model arise. One could simply introduce non-linear discrimi- nator that better captures the geometry of the data for this 2D toy example. However, it becomes challenging as we move to higher dimensions with limited data.
By reformulating the problem from functional data point of view, can identify trends and typicality in trajectories extracted by the network from the input. Figure 2b shows the dispersion of trajectories coming from the in in-distribution and OOD samples. These patterns multiple latent representations and aligned on a time-series series- like object. We observed that trajectories coming from OOD samples exhibit different shape when compared to typical trajectories from
extracted from
4

---

training data. Thus, to determine if an instance belongs to in in-distribution, we test if the observed path is similar to the functional trajectory reference extracted from the training set.
4 FUNCTIONAL OUT-OF-DISTRIBUTI
DETECTION
This section presents our OOD detection framework, which applies to any pre-trained multi-layer neural network with requirements for OOD samples. We describe method through two key steps: functional representation of the input sample (see Section 4.1) and test time OOD score computation (see Section 4.2).
4.1 TOWARDS A FUNCTIONAL. REPRESENTATION
The first step obtain an univariate functional representation of the data from the multivariate hidden representations is to reduce each feature map to a scalar value. To do so, we first compute the class-condition training population prototypes defined by:
N
Pey = Ng
Σ
Z8,6
(1)
1=1
where N, [zz M/ y, Vi (I..N))} S l L + and žz, oJeo.... oz)
Given an input example, we compute the probability weighted scalar projection between its features (including the logits) and the training class conditional prototypes, resulting in L + 1 scalar scores:
de(a; = Σ (y(xx) projur.y 28
Σ o (x)]l=e |cos (4 (ze, Mey)),
where Mr = (Mey y E y}, I-I| is the fn-norm, L (.,-) :) is the angle between two vectors, and dy(a; So) is the softmax function on the logits fa()) of class y. Hence, our layer-wise scores rely on the notions of vector length and angle between vectors, which can be generalized to any re-dimensional inner product space without imposing any geometrical constraints.
It is worth emphasizing that our layer score has some advantages compared to the class conditional Gaussian model first introduced in Lee al. (2018) and the Gram matrix based-method introduced in Sastry & Oore (2020). Our layer score encompasses broader class of distributions as we do not suppose an specific underlying probability distribution. We avoid computing covariance matrices, which are often ill-conditioned for latent representations of DNNs. Since we do not store covariance matrices, our functional approach has negligible overhead regarding memory requirements. Also, method can be applied to any vector-based hidden representation, not being restricted to matrix- based representations as in Sastry & Oore (2020). Thus, our approach applies to a broader range of models, including transformers.
By computing the scalar projection at each layer, we define a following functional neural- representation extraction function given by Eq. 3. Thus, can map samples from the repre- sentation to a functional space while retaining information on the typicality of the sample w.r.t the training dataset.
Φ: -X-RRA x + [di (i;
(3)
(ax; M1411]
We apply é to the training input क; to obtain the representation of the training sample across the network u, <(æ;). We consider the related vectors u,, V [1 N] curves parameter- ized by the layers of the network. We build training dataset U = {u, from these func- tional representations that will be useful for detecting OOD samples during test time. We then rescale the training set trajectories w.r. the maximum value found at each coordinate to obtain layer-wise scores the same scaling for each coordinate. Hence, for E {1,..., I 1), let max (4f) = maax Ui,,, max, U, L1,++]] we can compute a reference trajectory à for the entire
L.
Other metrics measure the similarity of an input w.r.t. the population of examples can also be used.
5

---

training dataset defined in equation that will serve global rypical reference compare test trajectories with.
ui
(4)
N
max(u)
4.2 COMPUTING THE OOD SCORE AT TEST TIME
At inference time, we first re-seale the test sample's trajectory as we did with the training reference x(x) d(z)/ max (44 Then, we compute similarity score w.r. this typical reference that will be our OOD score. We choose as metric also the scalar projection of the test vector to the training reference. practical terms, boils down to the inner product between the test sample's trajectory and the training set's typical reference trajectory since the norm of the average trajectory is constant for test samples. Mathematically, our scoring function s : + R writes:
L+1
s(;; ú = (o(z)) ú)
Σ k(
(5)
which is bounded by Cauchy-Schwartz's inequality, From this OOD score, we can derive binary classifier by fixing a threshold y E I::
g(z;s,)) {
1, if s(x) Sy
(6)
0, otherwise,
where g(x) means that the input sample is classified as being out-of-distribution Please refer to Appendix (see Section A. l for further details on the algorithm.
5 EXPERIMENTAL SETTING
This section describes the experimental setting, including the datasets used, the pre-trained DNN architectures, the evaluation metrics, and other essential information. We open-source our code in petts::/githhee htt.:aaww.ccoooooooaaaaaetttt//e oooddd--ooooooo-oooooooooooooooo wtw.:o//yooooorjjjto.ooooooo
5.1 DATASETS
We set as in-distribution dataset ImageNet-lk (= (= Deng et al., 2009) for all of our ex- periments, which is a challenging mid-size and realistic dataset that have been incorporated recently to OOD detection. It contains around 1.28M training samples and 50,000 test samples belonging 1000 different classes. For the dut-o--distributtin datasets, we take the same dataset splits intro- duced by Huang & Li (2021). The iNaturalist (Horn et al., 2017) dataset contains over 5,000 species of plant and animals. We consider split with 10,000 test samples with concepts from 110 classes different from the in-distribution ones. The Sun (Xiao et al., 2010) dataset is scene dataset of 397 categories. We considered split with 10,000 randomly sampled test examples belonging to 50 categories. The Places365 (Zhou et al., 2017) is also scenes dataset with 365 different concepts. We also considered a random split with 10,000 samples from 50 disjoint categories. For the DTD Textures (Cimpoi al., 2014) dataset composed of textural patterns. We considered all of the 5,640 available test samples. Note that there a few overlaps between the semantics classes from this dataset and ImageNet. We decided keep the entire dataset in order to be comparable with Huang et al. (2021). We provide study case on this in Section 6.
5.2 MODELS
We ran experiments with three models of different architectures. DenseNet-121 (Huang et al., 2017) pre-trained on ILSVRC-2012 with 8M parameters and test set top-1 accuracy of 74.43%. We reduced the intermediate representations from the transition blocks with an max pooling operation obtaining final vector with dimension equal to the number of channels of each output. The dimensions are 128, 256, 512, and 1024, respectively. We resize input images to 224x 224 pixels. A BiT-S-101 (Kolesnikov et al., 2020) model based ResNetv2-100 architecture with top-1 test set

---

test set
2.5
Tostures
Tree Rostive Rate
0.8
0.6
Teddurs
Deastyy
2,0
0.6
1.5
0.4
auc-0.79
0.2
Proch: Proj. mucmd.
Ours, auc-0.97
0.5
Features
Score
Palse Positive Rate
(a) Functional trajectories.
(b) OOD score histogram.
(c) ROC curve.
Functional representation with 5 and 95% quantiles, histogram and ROC curve for our OOD score on DenseNet-121 model with Textures as OOD dataset.
Figure 3:
accuracy of 77.41% and 44.5M parameters. We extract features from the outputs layers 4 and the penultimate layer, obtaining representations with sizes 256, 512, 1024, and 2048, respectively after max pooling. We resize input images to 480x480, We also ran experiments with a Vision Transformer (ViT-B-16; Dosovitskiy et al., 2021), which is trained on the ILSVRC2012 dataset with 82.64% top-1 test accuracy and 70M parameters. We take the output's class tokens for layers I to 13 and the encoder's output as latent representations, totaling 14 features of dimension 768 each. We resize images to 224 224. We download the DenseNet and Vision Transformer weights from PyTorch (Paszke al., 2019) hub and the weights of Big Transfer from Kolesnikov et al. (2020). All models are trained from scratch on ImageNet-Ik lk.
5.3 EVALUATION METRICS
We evaluate the methods in terms of ROC and TNR. The Area Under The Receiving Operation Curve (ROC) is the Area Under the curve representing the true negative rate against the false positive rate when considering a varying threshold. It measures how well can the OOD score distinguish between out- and in-distribution data in threshold-indeepedeen manner. The True Negative Rate at 95% True Positive Rate (TNR at 95% TPR or TNR for short) is threshold-dependen metric that provides the detector's 's performance in reasonable choice of threshold. It measures the accuracy in detecting OOD samples when the accuracy of detecting in-distribution samples is fixed at 95%. For both measures, higher is better.
5.4 BASELINES' PERPAR
For ODIN (Liang et al., 2018), we set the temperature to 1000 and the noise magnitude to zero. We take a temperature equal to one for Energy (Liu et al., 2020). We set the temperature to one for GradNorm (GradN. for short; Huang et al., 2021). 1). For Mahalanobis (Maha. for short; Lee al., 2018), we take only the scores the outputs of the penultimate layer of the network. The MSP (Hendrycks & Gimpel, 2017) does not have any hyperparameters. For ReAct (Sun et al., 2021), compute the activation clipping threshold with percentile equals to 90. For KNN (Sun et al., 2022) set as hyperparameters 1% and k 10. Our method hyperparameter free.
RESULTS AND DISCUSSION
We report our main results in Table 1, which includes the performance for the three model architec- tures, four OOD datasets, and seven detection methods. Our results are across the board consistent and on average superior to previous methods, obtaining an AUROC 90% on average (see Table I). We also ran experiments on CIFAR-10 benchmark, showing that our method also achieves great performance for the small image datasets. Results are delegated to the Appendix (see Section A.4).
Multivariate OOD Scores is Not Enough. Even though well-known multivariate novelty (or anomaly) detection techniques, such as One-class SVM (Cortes & Vapnik, 1995), Isolation Forest (Liu et al., 2008), Extended Isolation Forest (Hariri et al., 2021), Local Outlier Factor (LOF; Breunig et al., 2000), k-NN approaches (Fix & Hodges, 1989) and distance-based approaches (Mahalanobis, 1936) adapted various scenarios, they showed to be inefficient for integrating layers' informa-

---

Table 1: Comparison against post-hoc state-of-the tice-oftthe-arr methods for OOD detection on the ImageNet benchmark. M+Ours stands for using the Mahalanobis distance-based layer score with our proposed unsupervised score aggregation algorithm based on trajectory similarity. Values are percentage.
iNaturalist
SUN
Places
Textures
Average
TAR
ROC
TNR
ROC
TNR
RCC
TNB
ROC
TNR
ROC
MSP
35.9
87.9
28.8
81.9
21.3
79.3
21.9
77.5
27.0
81.7
ODIN
29.3
86.7
36.7
86.8
26.0
82.7
24.1
79.3
29.0
83.9
Energy
27.2
BITS 101
Mahalanobis
16.5
78.3
13.2
74.5
10.5
69.6
86.6
97.3
31.7
79.9
GradNorm
86.0
55.2
88.2
39.0
ReAct
46.2
88.9
10.7
65.9
7.0
62.0
8.5
65.8
18.1
70.7
KNN
39.7
88.9
22.1
77.5
20.6
75.9
54.1
89.7
34.
83.0
Ours
67.0
91.7
59.5
89.4
40.8
82.3
85.1
96.7
63.1
90.0
MSP
50.7
89.1
33.0
81.5
30.8
81.1
32.9
79.2
36.9
82.7
60.4
92.8
45,2
87.0
40.3
85.1
45.3
47.8
DenseNet 121
Energy
60.3
92.7
48.0
87.4
42.2
85.2
47.9
85.4
49.6
87.7
Mahalanobis
3.5
59.7
4.8
57.0
4.6
54.8
54.4
88.3
16.8
64.9
GmdNorm
73.3
93.4
59.1
88.8
48.0
84.1
56.7
87.7
59.3
88.5
ReAct
68.8
93.9
51.3
89.6
44.5
86.6
48.
87.6
53.2
89.4
KNN
57.1
33.2
83.6
79.6
65.7
92.8
68.0
92.1
$2.4
87.3
88.3
92.4
ReAct+Ours
80.4
96.4
62.2
91.8
52.3
88.0
81.8
96.5
69.2
93.2
MSP
48.5
88.2
33.5
80.9
31.3
80.4
39.8
83.0
38.3
83.1
ODIN
49.9
86.0
31.5
75.2
33.7
76.5
42,6
81.2
39.4
79.7
Energy
35.9
79.2
27.2
70.2
VITBB 16
Mahalanobis
81.2
96.0
40.7
85.3
40.0
84.2
46.3
87.5
52.1
88.2
GradNorm
91.2
41.5
85.3
38.3
83.4
48.
ReAct
33.4
85.5
26.9
78.8
25.6
77.3
42.2
84.5
32.0
81.5
KNN
41.0
88.9
17.8
79.4
18.2
77.7
44.0
87.8
30.3
83.4
Ours
58.6
93.3
32.2
82.1
31.5
80.7
56.7
91.1
44.7
86.8
M+Ours
32.6
81.4
tion. A hypothesis that explains this failure is the important sequential dependence pattern ticed in the in-distribution layer-wise scores. Table shows the performance a few unsupervised aggregation methods based multivariate OOD detection paradigm. We tried typical methods: evaluating the Euclidean and Mahalanobis distance w.r.t the training set Gaussian representation, fitting an Isolation Forest, and One-class SVM on training trajectory vectors. We compare the results with the performance of taking only the penultimate layer scores, and we observe that the standard multivariate aggregation fails to improve the scores for DenseNet-121.
Table 2: The first rows show single-layer baselines where Pemultimate layer is our layer score on the penultimate layer outputs. The subsequent rows show the performance of other unsupervised multivariate aggregation methods and our method. We ran experiments with a DenseNet- 121 model.
iNaturalist
SUN
Places
Textures
Average
TNR
ROC
TNR
ROC
TNR
ROC
TNR
ROC
TNR.
ROC
Grad Norm
73.3
93.4
59.1
88.8
48.0
84.1
56.7
87.7
59.3
88.5
Penultimate layer (Ours)
78.9
95.2
61.9
90.0
51.6
86.0
68.8
90.7
65.3
90.5
Euclidian distance
63.7
88.8
53.6
84.8
40.8
78.4
83.5
95.6
60.4
86.9
Mahalanobis distance
40.1
82.8
26.6
74.5
20.8
69.4
73.5
93.5
40.3
80.1
Isolation Forest
60.3
87.6
46.9
82.6
36.3
76.7
81.0
95.3
56.1
85.6
One Class SVM
64.2
89.0
54.0
85.0
41.2
78.6
83.8
95.7
87.0
Trajectory Proj. (Ours)
65.7
92.8
68.0
92.1
52.4
87.3
88.3
97.5
68.6
92.4
Qualitative Evaluation of the Functional Dataset. The test in-distribution trajectories follow a well-defined trend very similar to the training distribution (see Figure 3a). While the OOD trajec- tories manifest mainly as shape and magnitude anomalies (w.r.t. the taxonomy of Hubert et al., 2015). These characteristics reflects the histogram of our detection score (see Figure 3b). The in-distribution histogram is generally symmetric, while the histogram for the OOD data is typically skewed and has smaller average. Please refer the Appendix A.5 for additional similar figures.
8

---

Honeycombed
Honeycamb
Reference trajectory
000
OSD
600
0.7
Honeycomb (0.61)
Stripes (0.83)
0.6
Cobwebbed (0.89)
Striped
Zobra/Tiger
Scome
0.5
Cobwebbed
Spider
600
1
2
Feature
(a) A few examples from the Textures sharing se- mantic overlap with ImageNet classes.
(b) Trajectories of the leftmost examples of Fig. 4a and their OOD scores in parenthesis.
Figure 4: Study case on OOD detection of individual samples for our method on classes of semantic overlap between the ImageNet and Textures datasets. The badge on each image on Fig. 4a shows the label given by our OOD binary discriminator. We set as threshold the score value with 95% TPR.
Study Case. There are few overlaps in terms of the semantics of class names in the Textures and ImageNet datasets. particular, "honeycombed"
Textures versus "honeycomb" in ImageNet, "stripes" vs. "zebra", "tteer"..tigerr, and "tiger cat",, and "cobwebbed" vs. "spider web". We showed that our method decreases the false negatives this OOD benchmark. In order to better understand how method can discriminate where baselines often fail, we designed simple study case. Take the Honeycombed vs. Honeycomb, for instance (the first row Fig. 4a shows four examples this partition and a couple of examples from ImageNet). The honeycomb from ImageNet references natural honeycombs, usually found in nature, while honeycombed have a wider definition attached artificial patterns. In this class, the Energy baseline makes 108 false negative mistakes, while we only make 20 mistakes. We noticed that some of our mistakes are aligned with real examples of honeycombs (e.g., the second example from the first row), whilst confidently classify other patterns correctly as OOD. For the Spider webs class, most examples from Textures are visually closer to ImageNet. For the striped case (middle row), our method flags only 16 examples as being in-distribution, but we noticed an average higher score for the trajectories in Fig. 4b. Note that, for the animal classes, the context and head are essential features for classifying them. Overall, the study shows that scores are aligned with the semantic proximity between testing samples and the training set.
Potential Shortcomings of our Method. We believe this work is only the first step in paving the way for efficient post-score aggregation as we have tackled an open and challenging problem of combining multi-layer information. However, believe there is room for improvement since metric lives in the inner product space, which is specific case for more general structures found in Hilbert spaces that might contain more adequate metrics. Another concern that may arise is that, from practical point of view, current third-party MI. services often restrict the practitioner from accessing the intermediate outputs of the model in production. Nonetheless, the service provider has access to this information and could leverage it to deliver OOD detection as service, for instance.
CONCLUSION
In this work, we introduced an original approach OOD detection based a functional view of the pre-trained multi-layer neural network that leverages the sample's trajectories through the lay- ers. We shifted the problem from multivariate functional perspective way. Our method detects samples whose trajectories differ from the typical behavior characterized by the training set. The key ingredient relies on the statistical dependencies of the scores extracted at each layer, using purely self-supervised algorithm. Beyond the novelty and practical advantages of the algorithm, our results establish the value of using a functional approach as an unsupervised technique to combine multiple scores, which offers exciting alternative usual single-layer de- tection methods. We hope this work will be a first step to pave a new way for future research to enhance the safety of AI systems.
simple yet original

---

REFERENCES
Out-of-distribttion detection in classifiers via generation. In Neural Information Processing Systems (NeurIPS 2019), Safety and Robustness Decision Making Workshop, 12/2019 2019.
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks deep learning in computer vision: A survey. CoRR, 00//8801.00553, 2018. URL
00553.
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Con- crete problems in ai safety. arXiv preprint arXiv: 2016a.
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Concrete problems in AI safery. CoRR, 10os/6606.06665, 2016b.
Julian Bitterwolf, Alexander Meinke, and Matthias Hein. Certifiably adversarially robust detection of dut-oo-diitributtinn data. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin (eds.), Advances Neural Information Processing Systems, pp. 16085-16095. Curran Associates, Inc.
Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars. arXiv preprint arXiv: 1604.07316 2016.
Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng. and Jörg Sander. Lof: Identifying density- based local outliers. 29(2), 2000. ISSN 0163-5808.
Raghavendra Chalapathy and Sanjay Chawla. Deep learning for anomaly detection: A survey.
CoRR, abs/1901 hbs/1900.03407, 2019. URL htt.ttttp////t/// otggabs/////oooooooroo.../....er 1901 03407.
Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey, 41(3), 2009. ISSN 0360-0300.
Hyun-Jac Choi and Eric Jang. Generative ensembles for robust anomaly detection. 1b..01910. 2018.
ArXiv,
M. Cimpoi, S. Maji, I. Kokkinos, S. Mohamed, and A. Vedaldi. Describing textures in the wild. In Proceedings of the IEEE Conf. Computer Vision and Pattern Recognition (CVPR), 2014.
Corinna Cortes and Vladimir Vapnik. Support-vector networks. Machine learning, 20(3):273-297, 1995.
J. Deng, W. Dong, R. Socher, L.J. Li, K. Li, and L.. Fei-Fei. ImageNet: A Large-Scale Hierarchical Image Database. CVPR09, 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x16 words: Transformers for image recognition scale. ArXiv, abs/2010.11929 2021.
Xuefeng Du, Zhaoning Wang. Mu Cai, and Yixuan Li. Vos: Learning what you don't ion't know by virtual outlier synthesis. ArXiv, abs/2202.01 197, 2022.
Rainer Dyckerhoff and Pavlo Mozharovskyi. Exact computation of the halfspace depth, 2014. URL https: / arxiv. org/ hwgg/bb///ee 6927.
Evelyn Fix and J. Hodges. Discriminatory analysis. nonparametric discrimination: Consistency properties. International Statistical Review Revue Internationale de Statistique, 57(3):238-247, 1989. ISSN 03067734, 17515823.
Chuanxing Geng. Sheng-Jun Huang. and Songcan Chen. Recent advances in open recognition: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(10):3614-3 --311,,, oct 2021. doi: 10. 202.0.....209999....
10

---

Eduardo Dadalto Camara Gomes, Florence Alberge, Pierre Duhamel, and Pablo Piantanida. Igeood: An information geometry approach to dustif-distribution detection. In International Conference on Learning Representations, 2022.
Sahand Hariri, Matias Carrasco Kind, and Robert J. Brunner. Extended isolation forest. JEEE Transactions Knowledge and Data Engineering, 13:1479-1489, 2021.
Matan Haroush, Tzviel Frostig, Ruth Heller, and Daniel Soudry. A statistical framework for efficient out of distribution detection in deep neural networks, 2021.
Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high- confidence predictions far away from the training data and how to mitigate the problem. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 41-50, 2019.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and outtof-distributiin examples in neural networks. In International Conference on Learning Representations, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In International Conference on Learning Representations, 2019.
Victoria Hodge and Jim Austin. A survey of outlier detection methodologies. 22(2), 2004. ISSN 0269-2821.
Grant Van Horn, Oisin Mac Aodha, Yang Song, Alexander Shepard, Hartwig Adam, Pietro Perona, and Serge J. Belongie. The inaturalist challenge 2017 dataset. ArXiv, abs/ 707.77777.762200 2017.
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of- distribution image without learning from out-of-distribution data. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10948-10955 2020.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q. Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Puttern Recognition (CVPR), pp. 2261-2269, 2017. doi: 10. 10.11.//22.
Rui Huang and Yixuan Li. Mos: Towards scaling -iitt--diittibttion detection for large semantic space. 2021 IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp- 9715-8715,
Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distribu- tional shifts in the wild. ArXiv, abs/21 10.00218, 2021.
M. Hubert, P.J. Rousseeuw, and Pieter Segaert. Multivariate functional outlier detection. Sta- ristical Methods and Applications, 24(2):177-202, 2015. ISSN 1613-98IX. doi: 10.1007/ $10260-015-0097-8.
Polina Kirichenko, Pavel Izmailov, and Andrew G Wilson. Why normalizing flows fail to detect out- of-distribution data. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, pp.
Curran Associates, Inc.
Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. In ECCV, 2020.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting out-of-distributin samples and adversarial attacks. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Resa-Bianchi, and R. Garnett (eds.), Advances Neural Information Processing Systems 3/, pp. 7167-7177. Curran Associates, Inc., 2018
Saehyung Lee, Changhwa Park, Hyungyu Lee, Jihun Yi, Jonghyun Lee, and Sungroh Yoon. Remov- ing undesirable feature contributions using -iistri-ittiittoonn data. In International Conference on Learning Representations, 2021.
Shiyu Liang. Yixuan Li, and R. Srikant. Enhancing the reliability of out-of--istributioo image detection in neural networks. In International Conference Learning Representations, 2018.
11

---

Ziqian Lin, Sreya Dutta Roy, and Yixuan Li. Mood: Multi-level outoo--diisributiinn detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 Eighth IEEE Interna- tional Conference on Data Mining, pp. 413-422, 2008. doi: 10. 10.1109/CCDM22088.11
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy Energy-based out- dif-iiitiiittiion detec- tion. Advances in Neural Information Processing Systems, 2020.
Prasanta Chandra Mahalanobis. On the generalized distance in statisties. Proceedings of the Na- tional Institute of Sciences (Calcutta). 2:49-55, 1936.
Ahsan Mahmood, Junier Oliva, and Martin Styner. Multiscale score matching for out-of offdiitribtttonn detection, 2021.
Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. Proceedings of the AAAI Conference on Artificial Intelligence, 34(04):5216-522) Apr. 2020. doi: 10. Nb.1609/aaiivv44iin v34104.5966..
Jay Nandy, Wynne Hsu, and Mong Li Lee. Towards maximizing the representation gap between in-domain & aatoof-distributin examples, 2021.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary Detito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems 32, pp. 8024-8035. Curran Associates, Inc., 2019.
Marco AF Pimentel, David A Clifton, Lei Clifton, and Lionel Tarassenko. A review of novelty detection. Signal processing, 99:215-244 2014.
Igor M. Quintamilha, Roberto de M. E. Filho, José Lezama, Mauricio Delbracio, and Leonardo O. Nunes. Detecting diist--diiti samples using low-order deep features statistics, 2019.
Jie Ren, Peter J. Liu, Emily Fertig, Jasper Snock, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distiibttion detection. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d' d'Alché-Buce E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems. Curran Associates, Inc.
Jie Ren, Stanislav Fort, Jeremiah Liu, Abhijit Guha Roy, Shreyas Padhy, and Balaji Lakshmi- narayanan. A simple fix to mahalanobis distance for improving near-ood detection. arXiv preprint arXiv:2106.00022, 2021.
Chandramouli Shama Sastry and Sageev Oore. Detecting -iditriiibutui examples with Gram matrices. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Con- ference on Machine Learning, volume 119 Proceedings of Machine Learning Research, pp. 8491-8501. PMLR, 13-18 Jul 2020.
Thomas Schlegl, Philipp Seeböck, Sebastian M. Waldstein, Ursula Schmidt-Erfurth, and Georg Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery, 2017.
Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self- self-supervised outlier detection. ArXiv, abs/2103.12051 2021.
Adarsh Subbaswamy and Suchi Saria. From development to deployment: dataset shift, causality, and shift-stable models in health ai. Biostaristics, 21(2):345-355 April 2020. ISSN 1465-4644. doi: 10. 10.1099/biisstatiiiic//k////
Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of- distrributioon detection. In European Conference on Computer Vision, 2022.
12

---

Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribttion detection with rectified activa- tions. In NeurlPS, 2021.
Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In ICML, 2022.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv::312.611 2013.
Naftali Tishby and Noga Zaslavsky. Deep learning and the information bottleneck principle. In 2015 ieee information theory workshop (inw), pp. 1-5. IEEE, 2015.
Apoorv Vyas, Nataraj Jammalamadaka, Xia Zhu, Dipankar Das, Bharat Kaul, and Theodore L. Willke. Out-of-distribution detection using ensemble of self supervised leave-out classifiers. pp. 560-574, 2018.
Jim Winkens, Rudy Bunel, Abhijit Guha Roy, Robert Stanforth, Vivek Natarajan, Joseph R. Led- sam, Patricia MacWilliams, Pushmeet Kohli, Alan Karthikesalingam, Simon A. A. Kohl, tay- lan. cemgil, S. M. Ali Eslami, and Olaf Ronneberger. Contrastive training for improved out-of- distribution detection. ArXiv, abs/2007 .05666,,,566 2020.
Xiao, J. Hays, K. A. Ehinger, A. Oliva, and A. Torralba. Sun database: Large-scale scene recog- nition from abbey to zoo. In 2010 IEEE Computer Society Conference Computer Vision and Patlern Recognition, pp. 3485-3492, 2010. doi: 10. 1009/C/P.2000..5555
Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: An out-of-distribution detection score for variational auto-encoder. In Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and Lin (eds.), Advances in Neural Information Processing Systems, pp. 20685-20696. Curran Associates, Inc.
Yufeng Zhang, Wanwei Liu, Zhenbang Chen, Ji Wang, Zhiming Liu, Kenli Li, and Hongmei Wei. Out-of-disti detection with distance guarantee in deep generative models, 2021.
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 mil- lion image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2017.
Ev Zisselman and Aviv Tamar. Deep residual flow for out of distribution detection. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
13

---

A APPENDIX
A.1 ALGORITHM AND COMPUTATIONAL DETAILS
This section introduces further details the computation algorithm and resources. Algorithms and 2 describe how to extract the neural functional representations from the samples and compute the OOD score from test samples, respectively. Note that emphasize the "functional represen- tations". because the global behavior of the trajectory matters. In very basic terms, the method can look into the past and future of the series, contrary "sequential point of view" which restricted to the past of the series only, not globally on the trajectory.
Algorithm 1: Neural functional representation extraction algorithm computed offline.
Input Training dataset Sx {(r;; (1) ) and pre-trained DNN f = SL+1 o... /1- Output: Reference trajectory u. scaling vector max (4), and neural functional trajectory extraction function o(:; (Me, y and & (1,..., L 1})).
// Training dataset feature extraction L+ (I,..., do Zt,i f (fr....o f1)( for E ydoo do
for E
Me, t
Ei= Zz,i // Class conditional features prototypes N,
1
end
end
for
i {l,.... N do // Functional trajectory extractor o(-)
us + [d1 (Mi Vy dLi(((LLL (MLtIg! Vy y))
end
{ max (U) Imax Ui, max, U1,++1]
= N Σ max((()
return max (L). o6: (uey: y y and e E {l...., L L+ 1}})
Algorithm 2: nut-of-distribution score computation online.
Input : Test sample øo. the DNN / = fL+1 o o... o S1, reference trajectory ū, scaling vector max (24), and neural functional trajectory extraction function
E y and f e [1...., ++ 1}}).
Output: Test sample's OOD score s(xo).
for E {1,..... L + 13 do 2r.0 t (Je 0 f2)
end
uo Z0: {ue, y y and & (l...., L 13))
Uo + max((]]
uu
s(xo) Tap Di=1 ūo
return s(xo)
A. COMPUTING RESOURCES
We run our experiments on internal cluster. Since use pre-trained popular models, it was not necessary to retrain the deep models. Thus, our results should be reproducible with a single GPU. Since dealing with ImageNet datasets (approximately 150GB), large storage capacity is expected. We save the features in memory to speed up downstream analysis of the algorithm, which may occupy around 200GB of storage.
14

---

A.1.2 INFERENCE TIME
In this section, we conduct a time analysis of our algorithm. It is worth noting that most of the calculation burden is done offline. At inference, only a forward pass and feature-wise scores are computed. We conducted practical experiment where we performed live inference and OOD com- putation with three models for the MSP, Energy, Mahalanobis, and Trajectory Projection (ours) methods. The results normalized by the inference time are available in Table 3 below. We reckon that there may exist better computationally efficient implementations of these algorithms. So this remains a naive benchmark of their computational overhead.
Table 3: Batch runtime for OOD detection methods normalized by the time of one forward pass.
Forward pass
MSP
Energy
Mahalanobis
Ours
BiT-S-101
1.00
1.00
1.00
1.21
1.19
DenseNet-122
1.00
1.00
1.01
1.54
1.61
ViT-B-16
1.00
1.01
1.05
2.12
2.15
A.2 LATENT FEATURES
A.2.1
BIT-S-101
We used the outputs of the following features to calculate our scores for the BiT-S-101 model:
[body. blockl, body.block2, body blcck3, body block4, head. flatten]
A.2.2 DENSENET-121
We used the outputs of the following features to calculate scores for the DenseNet-121 model:
[features Peeatures.ttraneee www.sttiinnnnnnnoooooooooooooo pool, features. wtw.:u/ss.rrassnionn.....oo Deatures.transitionn
features.norm5, flatten, classifier]
A.2.3 VIT-B-16
We used the outputs of the following features to calculate our scores for the ViT-B-16 model:
[oncoder. arr.odcc__lycsss.ccodeeeee..__. oroodee:layers..nooeee.....ee
encoder -ayeers..ncodder1ayyr..... encoder
encoder. srcceer..aayrrs..nooeee........
sucoderr.aayers..cccee......
encoder. Lacodeee. 9,
encoder. ancoder.Layers. layer 8,
encoder. www.laa layer 10, encoder. lnyore layer 11,
encoder 1n, getitem_5, headshhead, head]
A.2.4 LNTRA-BLOCK CONVOLUTIONAL LAYERS ABLATION STUDY
0.8
0.0
Ie-distribution Testums
0.8
In-listributionn
In-distribation
Toxtures
Teatures
Trxtures
Seore
Places
0.6
Paccs
Score
Maces
Scote
Haces
0.4
0.2
0.2
30
100
50
100
10
20
30
10
200
30
Feature Index
Foature Lndex
Feature Index
Feature Indox
(a) DenseNet-1e model. (b) Smoothed trajectories.
(c) BiT-S-101 model.
(d) Smoothed trajectories.
Figure 5: Trajectories of scores from every intermediate convolutional layer.
We showed through several benchmarks that taking the outputs each convolutional block for the DenseNet- 121 and BiT-S-101 models is enough to obtain excellent results. We conduct further
15

---

ablation studies to understand the impact of adding the intra-blocks convolutional layers in the tra- jectories. To do so, we extracted the outputs of every intermediate convolutional output of these networks, and we plotted their score trajectories in Figure 5. The resulting trajectories are noisy and would he unfitting to represent the data properly. As a solution, we propose smoothing the curves with a polynomial filter to extract more manageable trajectories. Also, we observe regions of high variance for the in-distribution trajectory inside block for the DenseNet-121 model (see Fig. 5b). A further preprocessing could be simply filtering out these features of high variance that would be unreliable for the downstream task of OOD detection.
A.3 ON THE CENTRALITY OF THE CLASS- CONDITIONLL FEATURES MAPS
In this section, we study whether the mean vectors are suf- ficiently informative for statistically modelling the class- conditional embedding features. From a statistical point of view, the average would be informative if the data is compact. To address this point, we plotted the median and the mean for the coordinates of the feature map and mea- sured their difference in Figure 7. We observed that they almost superpose in most dimensions or are separated by a minor difference, which indicates that the data is compact and central. In addition, we showed in Figure 6 that the
125
Max depth of data points
Depth for the vectors
100
25
8.80
halfspace data depth (Dyckerhoff & Mozharovskyi, 2014) of the mean vector of a given is superior to the maximum depth of a training sample vector of the same class, sug- gesting the average is central or deep in the feature data distribution. From a practical point of view, the clear ad- vantage of using only the mean as a reference are com- putational efficiency, simplicity, and interpretability. We believe that future work directions could be exploring a method that better models the density in the embedding features, especially as more accurate classifiers are devel- oped.
0.81
0.82
0.83
0.84
0.85
Depth
Figure 6: Histogram showing that the halfspace depth of the average vectors for given class is higher than the high- est depth of an embedding feature vec- tor of the same class, demonstrating multivariate centrality.
des
day 2
dm 3
dis
Eas
4m
dm
6m
4'n
4th
dm
6m
1nn
17
4t
dm
6m
Figure 7: Histogram for the 20 first dimensions of the penultimate feature of a DenseNet- 121 for class index 0 of ImageNet. The green line is the average and the red line is the estimated median.
16

---

A.4 RESULTS ON CIFAR-10 10
We ran experiments with a ResNet-18 model trained on CIFAR-10 and evaluate the OOD perfor- mance of few method compared to ours. We extract features from the outputs of blocks 2 to 4, the penultimate layer and logits. The results are displayed in the table below. Our method outperforms comparable state-of-the-ar methods by 2.4% on average AUROC, demonstrating that it is consistent and suitable for OOD detection on small datasets too.
Table 4: CIFAR-10 benchmark results in terms of AUROC based ResNet- 18 model.
MSP
ODIN
Energy
KNN
ReAct
Ours
CIFAR-100
88.0
88.8
89.1
89.8
89.7
89.4
SVHN
91.5
91.9
92.0
94.9
94.6
99.0
LSUN (c)
95.1
98.5
98.9
97.0
97.9
99.8
LSUN (r)
92.2
94.9
95.3
95.8
96.7
99.8
TinylmageNet
89.8
91.1
91.7
92.8
93.8
98.0
Places-365
90.1
92.9
93.2
93.7
94.7
93.6
Textures
88.5
86.4
87.2
94.2
93.4
97.9
Average
90.7
92.1
92.5
94.0
94.4
96.8
17

---

A.5
ADDITIONAL PLOTS, FUNCTIONAL DATASET, HISTOGRAMS AND ROC CURVES
We display additional plots in Figures and for the observed functional data, the histogram of our scores showing separation between in-distribution and OOD data and the ROC curves for all of our experiments.
0.8
Train In test set NNaturaiist
In Score iNaturalist
1.0
2.5
0.8
Scure
0.6
Denalty
Positive
1.5
0.5
0.2
Penul:: Proj. auc =0.9
auc-0.52
0.0
0.0
2.5
0.4
Reatures
Score
False Positive Rate
(a) Trajectories for iNaturalist.
(b) Score histogram for iNaturalist.
(c) ROC curve for iNaturalist.
Train set test set
In Scure
1.0
2.5
SUN
0.8
Scure
Deasity
Positive
0.4
1.0
MSP auc=0.88
0.5
0.2
Penult: Proj.. auc -D
auc=00.91
0.0
0.0
Reatures
Scom
False Positive Rate
(d) Trajectories for SUN.
(e) Score histogram for SUN.
(f) ROC curve for SUN.
Train set In tast set
In Score
1.0
2.5
Places
0.8
Score
0.6
Denpiity
Positive
0.6
2.5
0.4
MSP. auc-0.8t
0.5
Penul:: Proj,, auc-0.85
0.2
0.0
0.0
Ours, aucwO
Features
Score
False Positive Rate
(g) Trajectories for Places.
(h) Score histogram for Places.
(i) ROC curve for Places.
Train In tast set Textures
Scare
2.5
Textures
0.8
Soore
Deasity
Positive
0.6
1.5
0.4
MSP. auc-0.77 79
0.5
Penult, Proj auc=0.8
0.2
Ours, auc=0.97
0.0
0.
Features
Score
False Positive Rate
(j)
Trajectories for Textures.
(k) Score histogram for Textures.
(I) ROC curve for Textures.
Figure 8: Average trajectories, OOD detection score histogram and ROC curve for the Net-
121 model.
18

---

In Scora INaturalast
1.0
0.7
0.8
Score
0.6
Denstty
6
Positivo
0.5
2
0.4
MSP.
0.3
In test set
0.2
Ponull: Proj. auc auc-0.
(Naturalist
auc=0.9
0.2
0.0
1.00
1.25
1.50
1.75
2,00
0.4
0.8
Reatures
Score
Positive Rate
(a) Trajectories for iNaturalist.
(b) Score histogram iNaturalist.
(c) ROC curve iNaturalist.
0.0
Score
1.0
SUN
0.7
0.8
Score
0.6
Density
Posttive
0.6
0.5
0.4
Train sel-
MSP auc=0 82
Peaul: Pruj. =081 Ours, auc-0.87
0.2
SUN
0.0
044 False Positive Rate
Peatures
Score
(d) Trajectories for SUN.
(c) Score histogram for SUN.
(f) ROC curve for SUN.
1.0
4
Places
Posizive Rase
2
Score
0.6
Denstryy
0.6
0.5
0.4
Train set-
MSP auc-0 79
test set
0.2
Penul:: Prej. suc-0.72
Plaoes
Cars, a
1.00
1.25
1.50
1.75
2,00
0.0
0.2
0.4
0.6
0.8
1.0
Features
Scora
False Positive Rate
(g) Trajectories for Places.
(h) Score histogram for Places.
ii) ROC curve for Places.
0.8
In Score Textares
1.0
0.7
0.8
Score
0.6
Density
Positivn
0.3
La test set
0.2
Pezult: Proj., auc =0.9
Curs, auc-0.96
0.0
0.75
1.00
1.25
1.50
1.75
2,00
0.4
Features
Score
False Dositive Rate
(j) Trajectories for Textures.
(k) Score histogram Textures.
(I) ROC curve for Textures.
Figure 9: Average trajectories, OOD detection score histogram and ROC curve for the BiT-S-101 model.
A.6 DATASETS
Figure shows a few examples from the in-distribution and out-of-distribution datasets. We also list below the subsets of classes used for the OOD datasets following Huang Li (2021):
19

---

(a) In-distribution.
(b) Out-of-distribution
Figure 10: Example of data samples from in-distribution (ImageNet) and OOD samples from iNat
uralist, SUN, Places365 and Textures datasets.
A.6.1 INATURALIST
The classes considered for the iNaturalist dataset were:
[Coprosma lucida, Cucurbita foetidissima, Mitella diphylla, Selaginella bigelovii, Texicodendron vernix, Rumex obtusifolius, Ceratophyllum demersum, Straptopus amplexifolius, Portulaca oleracca, Cynodon dactylon, Agave lechuguilla, Pennantia corymbosa, Sapindus saponaria, Prunus serotina, Chendracanthus exasperatus, Sambucus racemosa, Polypodium vulgare, Rhus integrifolia, Noodwardia areolata, Epifagus virginiana, Rubus icaeus, Croton setiger, Mammillaria dioica, Opuntia littoralis, Cercis canadensis, Psidium guajava, Asclepias exaltata, Linaria purpurea, Ferocactus wislizeni, Briza miner, Arbutus menziesii, Corylus americana, Plcopeltis polypodioides, Myoporum lactum, Persea americana, Avena fatua, Blechnum discolor, Physocarpus capitatus, Ungnadia speciosa, Cercocarpus betuloides, Arisaema dracontium, Juniperus californica, Euphorbia prostrats, Leptopteris hymenophylloides, Arum italicum, Raphanus sativus, Myrsine australis, Lupinus stiversii, Pinus echinata, Geum macrophyllumg kipogonum scandens, Echinocereus triglochidiatus, Cupressus macrocarpa, Ulmus trassifclia, Phormium tenax, Aptenia cordifolia, Osmunda claytoniana, Datura wrightii, Solanur. rostratum, Viola acunca, Toxicodendron diversilobum, Viola sororia, Uropappus lindleyi, Veronica chamaedrys, Adenccaulon bicolor, Clintonia uniflora, Cirsium scaricsum, Arum maculatum, Taraxacum officinale officinale, Orthilia secunda, Eryngium yuccifclium, Diodia virginiana, Cuscuta gronovii, sisyrinchium montanum, Letus corniculatus, Lamiur purpureun, Ranunculus repens, Hirschfeldia incana, Phlox divaricata laphamii, Lilium martagon, Clarkia purpurea, Hibiscus moscheutos, Polanisia dodecandra, Fallugia paradoxa, Genothera resea, Proboscidea Louisianica, Packera glabella, Impatiens parviflora, Glaucium flavum, Cirsium andersonis,
Heliopsis helianthoides, Hesperis matronalis, Callirhoe pedata, Crocosmia crocosmiiflora, Calochortus albus, Muttallanthus canadensis, Argemone albiflora, Eriogonum fasciculatum, Pyrrhopappus pauciflerus, Zantedeschia aethiopica, Melilotus officinalis, Peritoma arborea, Sisyrinchium bellum, Lobelia siphilitics, Sorghastrum nutans, Typha domingensis, Rubus laciniatus, Dichelostenna congestum, Chimaphila maculata, Echinocactus texensis]
20

---

A.6.2 SUN
The classes considered for the SUN dataset were:
[badlands, bamboo forest, bayou, betanical garden, canal (natural), canal (urban), catacomb, cavern (indoor), corn field, creek, crevasse, desert (sand), desert (vegetatien), field (oultivated), field (wild), fishpone, forest (broadleaf), forest (needleleat), forest path, forest road, hayfield, ice floe, ice shelf, iceberg, islet, marsh, ocean, orchard, pend, rainforest, rice paddy, river, rock arch, sky, snowfield, swamp, tree farm, trench, vineyard, waterfall (block), waterfall (fan), waterfall (plunge), wave, wheat field, herb garden, putting green, ski slope, topiary garden, vegetable garden, formal garden]
A.6.3 PLACES365
The classes considered for the Places365 dataset were:
(badlanes, bamboo forest, canal (natural), canal (urban), corn field, creek, crevasse, desert (sand), desert (vegetation), desert road, field (sultivated), field (wild), field road, forest (broadleaf), forest path, forest road, formal garden, glacier, grotto, hayfield, ice floe, ice shelf, iceberg, igloo, islet, japanese garden, lagoon, lawn, marsh, ocean, orchard, pond, rainforest, rice paddy, river, rock arch, ski slope, sky, snowfield, swamp, swimming hole, topiary garden, tree farm, trench, tundra, underwater (ocean deep), vegetable garden, waterfall, wave, wheat field]
A.6.4 TEXTURES
The classes considered for the Textures dataset were:
[banded, blotchy, braided, bubbly, bumpy, chequered, cobwebbed, cracked, crosshatched, crystalline, dotted, dibrous, flecked, freckled, frilly, gauzy, grid, grooved, honeycombed, interlaced, knitted, lacelike, lined, marbled, matted, meshed, paisley, perforated, pitted, pleated, polka-dotted, porous, potholed, scaly, smeared, spiralled, sprinkled, stained, stratified, striped, studded, veined, waffled, woven, wrinkled, zigzagged]
21


Reviews:
[{"review_id": "ugZ91iUBXy", "reviewer": "Reviewer_8gLg", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposed a feature-based method to get OOD scores that measures the trajectory similarities between the test data and the training data. The method first gets the per-class feature prototype \\mu_{l,y} at each layer based on training data, and then figures out the reference trajectory by calculating the cosine similarity between the training samples and the prototypes. During the inference time, the authors evaluate the trajectory consistencies of test samples. The experimental results show that the proposed method outperforms the baseline and some recently proposed methods.", "summary_of_the_review": "The paper proposed a feature-based method to get OOD scores that measures the trajectory similarities between the test data and the training data. The method first gets the per-class feature prototype \\mu_{l,y} at each layer based on training data, and then figures out the reference trajectory by calculating the cosine similarity between the training samples and the prototypes. During the inference time, the authors evaluate the trajectory consistencies of test samples. The experimental results show that the proposed method outperforms the baseline and some recently proposed methods. However, this paper does not clearly demonstrate the motivation, making the justification difficult.", "strength_and_weaknesses": "Pros:\n\nThe author examines the OOD samples during the forward pass through a novel and interesting perspective that takes feature trajectory into account. It might be a more discriminative way to see how the network handles ID and OOD inputs.\n\nCons:\n\n1. In this paper, the proposed method uses the class prototype \\mu_{l,\\hat{y}} corresponding to the network predicted label as the reference. But what if the labels predicted by the network are wrong (we know the top-1 accuracy on ILSVRC 2012 is around 80%)? For a misclassified ID sample, should it be considered as OOD data on the wrong class? The authors use hard labels (i.e., argmax(f(x_0))) to obtain reference trajectories for the corresponding category. What about using soft labels to perform weighted sum (\\sum_i {score}_{i}\\cdot d(z_{l,0}, \\mu_{l,i}))? The authors may explore this in their experiments.\n\n2. The authors need to conduct more detailed ablation study. For example, the authors only take the outputs of five stages (body.block1, body.block2, body.block3, body.block4, head.flatten) as latent features. What if the output after each convolutional layer is tracked? Furthermore, I notice that u_0 in Algorithm 2 is already a trajectory similarity between a test sample and the training features. Whether it is necessary to recalculate the similarity between u_{0} and u needs to be explored in the ablation experiment. And it is best for the author to further analyse the reasons for such a design through theory.\n\n3. The paper is unclear that what shape features are used to calculate cosine similarity. If they are (B, C_l, H_l, W_l), does that introduce a lot of computation (numclass\\times(L+1)\\times B\\times C_l\\times H_l\\times W_l)? I think the authors need to report in detail the additional computational burden introduced by the proposed method, both FLOPs and time-consuming. Kindly remind the author that when implementing the code, you can first select the feature prototype of a specific category by torch.gather, and then calculate the cosine similarity through matrix multiplication or einsum to avoid repeated calculation between input features and all categories.\n\n4. In Table 1, the authors do not compare with the SOTA method, and the performance of the method proposed in this paper has not yet reached the level of SOTA (e.g., KNN[1], DICE[2]). I encourage the authors to further optimize the proposed method during rebuttal for more competitive results. I will consider raising the rating of this paper after the results are further improved.\n\n5. The authors say \"State-of-the-art methods treat step (ii) as a supervised learning problem\" in Section 3.2, paragraph 1 which needs some citations to determine which methods do so.\n\nReference\n\n[1] Sun, Y., Ming, Y., Zhu, X., & Li, Y. Out-of-distribution Detection with Deep Nearest Neighbors. In ICML 2022.\n\n[2] Sun, Y., & Li, Y. Dice: Leveraging sparsification for out-of-distribution detection. In ECCV 2022.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "nFQN_o2rQe", "reviewer": "Reviewer_CjT9", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work considers the multi-layer structure of a pre-trained classifier and formulates the information forward from a functional view. Then each test input is transformed into a sequence of layer-wise activations. The authors use the projected distance on the in-class typical direction as the measurement of similarity and propose an OOD detection score by summarizing layer-wise distance. Empirical evaluation shows that the proposed method performs well on four ImageNet benchmarks.", "summary_of_the_review": "I recommend marginal acceptance. My reasons and problems are listed in the Weaknesses section.", "strength_and_weaknesses": "Strength:\n- This work proposes a novel OOD detection method by using a multi-layer pre-trained classifier. \n- The paper is well-written and the technical details are easy to follow.\n- The empirical evidence is significant compared with the baseline methods.\n\nWeakness: \n- The method is derived from a functional point of view. The authors do not discuss the influence of the depth of the pre-trained classifier. If the pre-trained model only has five layers, is it proper to use five-length vectors to approximate functional data?\n- Mood is also a multi-layer OOD detection method and discusses that the image with different data complexity should use feature extractors with different depth. In this work, the authors do not discuss the influence of data complexity and do not compare the proposed method with Mood. Does the summation operation in (8) weaken the sensitivity of the OOD detector?\n- Your results in Table 1 outperform the baseline methods. Comparing with recent progress like KNN with ResNet50 pre-training, the improvement is not significant. Furthermore, if you combine your proposed detector with enhancement methods like ReAct, is it possible to further improve the current performance?\n\nLin, Ziqian, Sreya Dutta Roy, and Yixuan Li. \"Mood: Multi-level out-of-distribution detection.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "mvoPF_ctDe", "reviewer": "Reviewer_5MWe", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies out-of-distribution detection, aiming at making classification models excel at discerning ID and OOD data. It is an important problem for safety-critical applications, and has attracted increasing attention recently. The authors claim that they adopt an original approach based on the functional view of network, which exploits the trajectories through the layers and their statistical dependencies. Specifically, those data whose trajectories differ from ID data are characterized as OOD data. The authors conduct experiments on ImageNet dataset, and the authors claim their superiority over the state-of-the-art methods. ", "summary_of_the_review": "The proposed method discerns ID and OOD data by analyzing the trajectory of model outputs, which is uncovered by much of the previous works. However, there are several issues that may require to be solved, which I think it can improve the clarity and the quality of the paper. ", "strength_and_weaknesses": "Strength: \n\n- *The novelty of this paper is satisfactory*. The key observation of this paper is that existing OOD detection methods largely overlook the sequential nature of the underlying problem and thus limit the discriminative power of those methods. It motivates the authors to explore the trajectories through the layers and their statistical dependencies in OOD scoring. To me, it is a relatively new and reasonable idea, which may contribute to the community. \n\nWeakness:\n\n- *What does it mean for the term \"functional point of view\"*. It seems that the authors want to study the sequential behavior of the model outputs, discerning ID and OOD data by their different trajectory through the network. So, to me, I am not sure why the authors exploit the OOD detection problem in the \"functional point of view“ instead of the \"sequential point of view\". Maybe some references or explanations can be helpful. \n\n- *The adopted methodology in modeling the sequential behavior may require further discussion*. To model the sequential behavior of data, I think it might be a direct choice in using the time-series models such as LSTM. I do not fully understand why the adopted method can model the trajectory of model outputs, and why it can be superior over LSTM.  \n\n- *Are the mean vectors sufficiently informative for the embedding features?*. It seems that the proposed method distinguishes ID and OOD data by measuring the distances of features to the average features regarding each layer. Then, a nature question is that: is the mean vector sufficient to cover the diversity of ID data in the embedding space. Some justifications or illustration may require here. \n\n- *More experimental results may require*. The authors conduct experiments on ImageNet benchmark, which is a challenging OOD detection setting with large semantic space and complex data features. However, to fully justify the superiority of the proposal, I think the authors should conduct more experiments (e.g., CIFAR benchmarks, Hard OOD detection [1]). Also, more advanced methods should be included in comparison [1,2]. \n\n[1] Yiyou Sun, et al. Out-of-distribution Detection with Deep Nearest Neighbors. ICML'22. \n\n[2] Xuefeng Du, et al. VOS: Learning What You Don't Know by Virtual Outlier Synthesis. ICLR'22. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "baFPSqhUzz", "reviewer": "Reviewer_aTaH", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents a functional perspective for out-of-distribution (OOD) detection.  The layer-wise features from a deep neural network are considered a trajectory. The class-wise centroids of the trajectories are computed from the training samples. Given a test trajectory, the similarity with respect to the centroids is estimated as a measure for OOD-ness, i.e., lower similarity indicates an OOD sample. Experiments are conducted by considering Imagenet to be in-distribution and various other datasets, such as iNaturalist, SUN, Places, and Textures, as OOD sets.", "summary_of_the_review": "While the proposed idea of considering feature trajectories is interesting, it requires additional experimental validations to justify the efficacy of the approach. Please address the comments in the weaknesses section. ", "strength_and_weaknesses": "Strengths:\n\n1. Proposed functions perspective for OOD detection is interesting. \n\n2. During the test, the similarity is measured with respect to cluster means ignoring the covariance matrices. This significantly improves the complexity, especially for the Imagenet with 1000 classes. \n\n3. A series of ablation studies are conducted to analyze various aspects of the approach.\n\n4. Authors provide the code to facilitate reproducibility.\n\nWeaknesses:\n\n1. Is considering the centroids alone, without the covariance, reliable to detect OOD samples? Have the authors experimented with a variant where the similarity is computed considering the covariance matrix as in the Mahalabois approach?\n\n2. Authors claim that the state-of-the-art approaches use supervision to train the OOD classifier. This statement is not completely correct as many recent approaches do not consider supervision (OOD samples or pseudo-OODs) during training.\n\n3. In Fig 2 b, it appears that the trajectories across ID and OOD samples are similar at various feature layers. How does this affect the robustness of the approach?\n\n4. Some of the recent state-of-the-art approaches are not compared against, such as\n\ni. Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. ICML, 2022.\nii. Vikash Sehwag, Mung Chiang, and Prateek Mittal. SSD: A unified framework for self-supervised outlier detection. ICLR, 2021.\n\n5. Authors are encouraged to consider a commonly used experimental setup where CIFAR is used in distribution and SVHN, TinyImageNet, and LSUNs are used as OOD. This will help to compare against other state-of-the-art approaches and further justify the efficacy of the approach. \n\n6. The clarity and writeup can be improved\n\ni. Fig 1 is hard to follow given the description at that stage. \nii. In Fig 2 c, the conclusion is not clear. Only the self-correlation is evident from the plot the correlations between the features from other layers are somewhat non-uniform.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject