Improving and Assessing Anomaly Detectors for Large-Scale Settings
Authors: Dan Hendrycks
Steven Basart
Mantas Mazeika
Andy Zou
Joseph Kwon
Mohammadreza Mostajabi
Jacob Steinhardt
Venue: ICLR 2022 Submitted (2022)
Keywords: anomaly
ood
distribution shift
out-of-distribution

Abstract: Detecting out-of-distribution examples is important for safety-critical machine learning applications such as detecting novel biological phenomena and self-driving cars. However, existing research mainly focuses on simple small-scale settings. To set the stage for more realistic out-of-distribution detection, we depart from small-scale settings and explore large-scale multiclass and multi-label settings with high-resolution images and thousands of classes. To make future work in real-world settings possible, we create new benchmarks for three large-scale settings. To test ImageNet multiclass anomaly detectors, we introduce a new dataset of anomalous species. We leverage ImageNet-22K to evaluate PASCAL VOC and COCO multilabel anomaly detectors. Third, we introduce a new benchmark for anomaly segmentation by introducing a segmentation benchmark with road anomalies. We conduct extensive experiments in these more realistic settings for out-of-distribution detection and find that a surprisingly simple detector based on the maximum logit outperforms prior methods in all the large-scale multi-class, multi-label, and segmentation tasks, establishing a simple new baseline for future work.

Under review as a conference paper at ICLR 2022
IMPROVING AND ASSESSING ANOMALY DETECTORS FOR LARGE-SCALE SETTINGS
Anonymous authors Paper under double-blind review
ABSTRACT
Detecting distribbuuii examples is important for safety-critica machine learning applications such as detecting novel biological phenomena and self-driving cars. However, existing research mainly focuses on simple amall-scale settings. To set the stage for more realistic out-of-distribution detection, we depart from small-scale settings and explore large-scale multiclass and multi-label settings with high-resolution images and thousands classes. To make future work in real-world settings possible, create new benchmarks for three large-scale settings. To test ImageNet multiclass anomaly detectors, we introduce new dataset of anoma- lous species. We leverage ImageNet-21K to evaluate PASCAL VOC and COCO multilabel anomaly detectors. Third, we introduce new benchmark for anomaly segmentation by introducing segmentation benchmark with road anomalies. We conduct extensive experiments in these more realistic settings for out-of- diittr-diittiittionn detection and find that a surprisingly simple detector based on the maximum logit outperforms prior methods in all the large-scale multi-class, multi-label, and seg- mentation tasks, establishing a simple new baseline for future work.
INTRODUCTION
Out-of-distribution (OOD) detection is a valuable tool for developing safe and reliable machine learning (ML) systems. Detecting anomalous inputs allows systems to initiate conservative fallback policy or defer human judgment. As an important component of ML Safety (Hendrycks et [021]. OOD detection is important for safety-critical applications such as self-driving cars and detecting novel microorganisms. Accordingly, research on out-of dui-tf-diitribution detection has rich history spanning several decades (Schölkopf et al.) 1999 Breunig et al., 2000 Emmott et al. 2015). Recent
work leverages deep neural representations for of detection in complex domains, such image data (Hendrycks & Gimpel| 2017 Lee et al. 2018a; Mohseni et al. 22200 Hendrycks
jtt al. 2019b). However, these works still primarily use small-scale datasets with low-resolution images and few classes. As the community moves towards more realistic, large-scale settings, strong baselines and high-quality benchmarks are imperative for future progress.
Large-scale datasets such as ImageNet (Deng al. 2009 and Places365 (Zhou al. 2017) present unique challenges not seen in small-scale settings, such as plethora of fine-grained object classes. We demonstrate that the maximum softmax probability (MSP) detector, state-of-the-arr method for small-scale problems, does not scale well to these challenging conditions. Through extensive experiments, identify a detector based on the maximum logit (MaxLogit) that greatly outperforms the MSP and other strong baselines in large-scale multi-class anomaly segmentation. To facilitate further research in this setting, also collect a new offt--iiiitiittiinn test dataset suitable for models trained on highly diverse datasets. Shown in Figure 2 our Species dataset contains diverse, anomalous species that do not overlap ImageNet-21 which has approximately twenty two thousand classes. Species avoids data lcakage and enables a stricter evaluation methodology for ImageNet-21 models. Using Species to conduct more controlled experiments without train-test overlap, we find that contrary to prior claims (Fort et al. 2021 Koner et al. 2021) Vision Transformers (Dosovitskiy et al. 2021a) pre-trained on ImageNet-22 21 are not substantially better at out-of-distribution detection.
of multi-label data, the MSP detector cannot naturally be applied in the first place, as it requires softmax probabilities. To enable research into the multi-label setting for anomaly detection, contribute multi-label experimental setup and explore various
Moreover, in the common real-world

---

Under review as a conference paper at ICLR 2022
Small Scale (Previous Work)
Large Scale Multi-label
In-Distribution
Out-of-Distriuution
Bat, Mit, Person
Large Scale Multiclass
Large Scale Segmentation
Figure 1: We scale up out-of-distributig detection to scale multi-class datasets with thousands of classes, multi-label datasets with complex scenes, and anomaly segmentation in driving environ- ments. We introduce new benchmarks for all three settings. In all of these settings, we find that an OOD detector based on the maximum logit outperforms previous methods, establishing a strong and versatile baseline for future work on large-scale OOD detection. The Nottom-right shows scene from our new anomaly segmentation benchmark and the predicted anomaly using a state-of-ther tf-ttrrrrt detector.
methods on large-scale multi-labe datasets. We find that the MaxLogit detector from our investigation into the large-scale multi-class setting generalizes well to multi-label data and again outperforms all other baselines.
In addition to focusing on small-scale datasets, most existing benchmarks for anomaly detection treat entire images as anomalies. In practice, an image could be anomalous in localized regions while being in-distribution elsewhere. Knowing which regions of an image are anomalous could allow for safer handling of unfamiliar objects this task is difficult, though, simply cutting and pasting anomalous objects into images introduces various unnatural giveaway cues such as edge effects, mismatched orientation, and lighting, all of which trivialize the task of anomaly segmentation (Blum al. 2019)
case of self-driving cars. Creating benchmark for
To overcome these issues, we utilize a simulated driving environment to create the novel StreetHazards dataset for anomaly segmentation. Using the Unreal Engine and the open-source CARLA simulation environment (Dosovitskiy et al., 2017), we insert diverse array of foreign objects into driving scenes and re-render the scenes with these novel objects. This enables integration of the foreign objects into their surrounding context with correct lighting and orientation, sidestepping giveaway cues.
To complement the StreetHazards dataset, we convert the BDDI00K semantic segmentation dataset (Yu et al. 2018) into an anomaly segmentation dataset, which we call BDD-Anomaly. By leveraging the large scale of BDD100K, we reserve infrequent object classes to be anomalies. We combine this dataset with StreetHazards to form the Combined Anomalous Object Segmentation (CAOS) benchmark. The CAOS benchmark improves over previous evaluations for anomaly segmentation in driving scenes by evaluating detectors on realistic and diverse anomalies. We evaluate several baselines on the CAOS benchmark and discuss problems with porting existing approaches from earlier formulations of cutt-o-ddisribbution detection.
Despite its simplicity, we find that the MaxLogit detector outperforms all baselines on Species, our multi-class benchmark. and CAOS. In each of these three settings, discuss why MaxLogit provides superior performance, and we show that these gains are hidden one looks at scall-scale problems alone. The code for experiments and the Species and CAOS datasets available at [ annnnmii zed] Our new baseline combined with Species and CAOS benchmarks pave the way for future research large-scale aut-of-distribution detection.
2

---

Under review as a conference paper at ICLR 2022
Anomalous Species Dataset
The Species aut-of-distributio dataset is designed for large-scale anomaly detectors pretrained on datasets as diverse as ImageNet-2IK. When models are pretrained on ImageNet-211 many previous OOD detection datasets may overlap with the pretraining set, resulting in erroneous evaluations. To rectify this, Species is comprised of hundreds of anomalous species that are disjoint from ImageNet-211 classes and enables the evaluation of cutting edge models.
Figure 2:
RELATED WORK
Detection. A recent line of work leverages deep neural rep- resentations from multi-class classifiers perform out-of-distribution (OOD) detection on high- dimensional data, including images, text, and speech data. Hendrycks & Gimpel (201)) formulate the task and propose the simple baseline of using the maximum softmax probability of the classi- fier on input to gauge whether the input is out-of-distribution In particular, they formulate the task as distinguishing between examples from an in-distribution dataset and various OOD datasets. Importantly, entire images are treated as out-of-distribution.
Multi-Class
Continuing this line of work, Lee al. (218a)) propose improve the neural representation of the classifier to better separate OOD examples. They use generative adversarial networks to produce near- distribution examples and induce uniform posteriors on these synthetic OOD examples. [Hendrycks et al. (2019b) observe that outliers often easy obtain in large quantity from diverse, realistic datasets and demonstrate that OOD detectors trained on these outliers generalize to unseen classes of anomalies. Other work investigates improving the anomaly detectors themselves given fixed classifier (DeVries & Taylor] 2018: [iang et al.) 2018). However, as Hseneryykks et al. (2019b) observe, many of these works tune hyperparameters on particular type of anomaly that is also seen at test time, so their evaluation setting is more lenient. In this paper, all anomalies seen at test time come from entirely unseen categories and are tuned on in any way. Hence, we do compare to techniques such as ODIN (Liang et al., 2018). Additionally, in a point of departure from prior work, we focus primarily on large-scale images and datasets with many classes.
Recent work has suggested that stronger representations from Vision Transformers pre-trained on ImageNet-21 K can make diisttibibiitnn detection trivial (Fort et al., 2021| Koner et al. (002). They evaluate models on detecting CIFAR-10 10 when fine-tuned on CIFAR-100 vice versa, using models pretrained on ImageNet-2IK. However, over 1,000 classes ImageNet-21K overlap with CIFAR-10, so it is still unclear how Vision Transformers perform at detecting entirely unseen OOD categories. We create a new OOD test dataset of anomalous species to investigate how well Vision Transformers perform in controlled OOD detection settings without data leakage and overlap. We find that Vision Transformers pre- pre-trained on ImageNet-22 are far from solving OOD detection in large-scale settings.
3

---

Under review as a conference paper at ICLR 2022
FPR95 1
AUROC
AUPR
Dm
MSP
Veiis MaxLogit
MSP
DeVries MaxLogit
MSP
DeVries MaxLogit
ImageNet
44.2
46.0
35.8
84.6
76.9
87.2
38.2
30.5
45.8
Places365
52.6
85.8
36.6
76.0
31.1
85.8
8.2
2.0
19.2
Table 1: Multi-class out-of-distribution detection results using the maximum softmax probability (MSP) baseline (Hendrycks & Gimpel 2017), the confidence branch detector of VeVisss & Taylor (2018). and our maximum logit baseline. All values are percentages and average across five out-of- distribution test datasets. Full results on individual OOD test datasets are in the Appendix.
Anomaly Segmentation. Several prior works explore segmenting anomalous image regions. One line of work uses the WildDash dataset (Zendel et al. 2018), which contains numerous annotated driving scenes in conditions such as snow, fog, and rain. The WildDash test set contains fifteen "negative images" from different domains for which the goal is to mark the entire image as out-of- distribution. Thus, while the task is segmentation, the anomalies do not exist as objects within an otherwise in-distribution scene. This setting is similar to that explored by Hendryykk & Gimpel (2017), in which whole images from other datasets serve
examples.
To approach anomaly segmentation on WildDash, Krešo et al. (208)) train on multiple semantic segmentation domains and treat regions of images from the WildDash driving dataset as out-of- distribution if they are segmented as regions from different domains, i.e. indoor classes. [Bevandi et al. (2018) use ILSVRC 2012 images and train their network to segment the entirety of these images as out-of- distributii....
In medical anomaly segmentation and product fault detection, anomalies are regions of otherwise in-distribution images. [aur et al. (2019) segment anomalous regions in brain MRIs using pixel- wise reconstruction loss. Similarly, Haselmann et al. (018)) perform product fault detection using pixel-wise reconstruction loss and introduce an expansive dataset for segmentation of product faults. In these relatively simple domains, reconstruction- based approaches work well. In contrast to medical anomaly segmentation and fault detection, we consider complex images from street scenes. These images have high variability in scene layout and lighting, and hence are less amenable to reconstruction based techniques.
The two works closest to our own are the Lost and Found (Pinggera et al.. 2016) and Fishyscapes (Blum et al.] 2019) datasets. The Lost and Found dataset consists of real images in a driving environment with small road hazards. The images were collected to mirror the Cityscapes dataset (Cordts et al. (016)) but are only collected from one city and so have less diversity. The dataset contains 35 unique anomalous objects, and methods are allowed to train on many of these. For Lost and Found, only nine unique objects are truly unseen at test time. Crucially, this is different evaluation setting from our own, where anomalous objects are not revealed at training time, so their dataset is not directly comparable. Nevertheless, the BDD-Anomaly dataset fills several gaps in Lost and Found. First, the images are more diverse, because they are sourced from a more recent and comprehensive semantic segmentation dataset. Second, the anomalies are not restricted small, sparse road hazards. Concretely, anomalous regions in Lost and Found take up 0. 1 % of the image on average, whereas anomalous regions in the BDD-Anomaly dataset are larger and fill 0.83% of the image on average. Finally, although the BDD-Anomaly dataset treats three categories as anomalous, compared to Lost and Found it has far more unique anomalous objects.
The Fishyscapes benchmark for anomaly segmentation consists of cut-and-paste anomalies from out-of-distribution domains. This is problematic, because the anomalies stand out as clearly unnatural in context. For instance, the orientation of anomalous objects is unnatural, and the lighting of the cut-and-paste patch differs from the lighting in the original image, providing an unnatural cue to anomaly detectors that would not exist for real anomalies. Figure 7 shows an example of these inconsistencies. Techniques for detecting image manipulation (Zhou et al. 2018 Johnson & Farid 2005) are competent at detecting artificial image elements of this kind. Our StreetHazards dataset overcomes these issues by leveraging a simulated driving environment to naturally insert anomalous 3D models into scene rather than overlaying 2D images. These anomalies are integrated into the scene with proper lighting and orientation, mimicking real- world anomalies and making them significantly more difficult to detect.
4

---

Under review as a conference paper at ICLR 2022
Dissimilar Classes (Small Scale)
Similar Classes (Large Scale)
100
100
CIFAR-10 Classifier
80
ImageNet Classifier
80
Confidence (%)
Confidence (%)
60
60
40
40
20
0
Airplane
Automobile
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Tench
Goldfish
Irish Terrer
Norfolk Terrer
Norwich Terrier
Candle
Figure 3: Small-scale datasets such CIFAR-10 have relatively disjoint classes, but larger-scale datasets including ImageNet- IK have several classes with high visual similarity to other classes. This implies that large-scale classifiers disperse probability mass among several classes. If the prediction confidence is used for out-of-distribution detection, then images which have similarities to other classes will often wrongly be deemed out-of-distribution due to low and dispersed confidence. This motivates our MaxLogit out-of -f-sttirbitttoonn detector.
3 MULTI-CLASS PREDICTION FOR OOD DETECTION
Problem with existing baselines. Existing baselines for anomaly detection work well in small-scale settings. However, in more realistic settings image classification networks are of- ten tasked with distinguishing hundreds thousands of classes, possibly with subtle differences. This is problematic for the maximum softmax probability (MSP) baseline (Hendrycks & Gim- pel 2017p, which uses the negative maximum softmax probability as the anomaly score, or max; exp fIr)x/ Σ, exp f(x); = max; p(y = k IT, where fxx is the unnormalized logits of classifier f on input z. Classifiers tend have higher confidence on in-distribution examples than outto--distribution examples, enabling OOD detection. Assuming single-model evaluation and no access other anomalies or test-time adaptation, the MSP attains state-of-the-an anomaly detection performance in small-scale settings. However, we show that the MSP is problematic for realistic in-distribution datasets with many classes, such as ImageNet and Places365 (Zhou et al. 2017). Probability mass can be dispersed among visually similar classes, Consequently, a classifier may produce a low confidence prediction for an in-distribution image, not because the image is unfamiliar, but because the object's exact class is difficult to determine. To circumvent this problem, we propose using the negative of the maximum unnormalized logit for anomaly score max; (2) which call MaxLogit. Since the logits are unnormalized, they are not affected by the number of classes and can serve as better bascline for large-scale out-of-distribution detection.
shown Figure 3
The Species Nut-Or-Distributian Dataset. To enable controlled experiments and high-quality evaluations of anomaly detectors in large-scale settings, we create the Species dataset, new out- of-distribution test dataset that has no overlapping classes with 21. The Species dataset comprised images scraped from the iNaturalist website and contains hundreds of anomalous species grouped into seven high-level categories: Plants, Microorganisms, Amphibians, Protozoa, Fungi, Arachnids, and Insects. Example images from the Species dataset are in Figure 2
Setup. To evaluate the MSP baseline out-of-distribution detector and the MaxLogit detector, we use ImageNet-21K as the in-distribution dataset Din- To obtain representations for anomaly detection, we models trained on ImageNet-2IK-PP
cleaned version of ImageNet-21K with train/val split (Ridnik et al. 202 We evaluate a TResNet-M. ViT-B-16, and Mixer-B-16 (Ridiik et al. 2021b Dosovitskiy et al. 2021bb Tolstikhin et al. (2221), and the validation split is used for obtaining in-distribution scores. For distrr-iitti test datasets Dom, we use categories from the Species dataset, all of which are unseen during training. Results for these experiments are in Table 2 We
5

---

detection Under review as a conference paper at ICLR 2022
ResNet
VIT
MLP Mixer
Dm
Diest out Plants
MSP
MaxLogit
MSP
MaxLogit
MSP
MaxLogit
80.3
87.8
78.2
84.8
80.3
85.0
ImageNet-21K
Microorganisms
77.4
83.4
71.1
82.4
74.4
86.0
Amphibians
41.8
48.6
41.9
48.8
44.4
51.7
Protozoa
70.7
80.4
69.3
80.9
68.0
77.7
Fungi
66.4
77.4
64.7
76.1
64.1
76.9
Arachnids
46.9
56.7
46.6
56.8
48.9
58.8
Insects
47.6
56.4
48.0
54.6
48.6
53.8
Mean
61.6
70.1
60.0
69.2
61.2
70.0
Table Results on Species. Models and the processed version ImageNet-2IK (ImageNet-21K) K-PP) are from Ridnik et al. (2011a). A All values are percent AUROC. Species enables evaluating anomaly de- tectors trained on ImageNet-2IK: and evades class overlap issues present prior work. Using Species to conduct more controlled experiments without class overlap issues, we find that contrary to recent claims (Fort al. ) simply scaling up Vision Transformers does not make OOD detection trivial.
also use ImageNet- IK and Places365 as in-distribution datasets Dm, for which we use pretrained ResNet-50 models and use several out-of-distribution datasets Dout Full results with ImageNet and Places365 as in-distribution are in the Appendix.
Metrics. To evaluate ouitt--disttibuttin detectors in large-scale settings, use three standard metrics of detection performance: area under the ROC curve (AUROC), false positive rate at 95% recall (FPR95), and area under the precision-recat curve (AUPR). The AUROC and AUPR are important metrics, because they give holistic measure of performance when the cutoff for detecting anomalies is not a priori obvious or when we want to represent the performance method across several different cutoffs.
The AUROC can be thought of as the probability that an anomalous example is given a higher score than an ordinary example. Thus, higher score better, and an uninformative detector has a AUROC of 50%. AUPR provides a metric more attuned to class imbalances, which is relevant in anomaly and failure detection, when the number of anomalies or failures may be relatively small. Last, the FPR95 metric consists of measuring the false positive rate at 95%. Since these measures are correlated, we occasionally solely present the AUROC for brevity and preserve space.
Results. Results on Species are shown in Table Results with ImageNet- 1 K and Places365 as in-distribution datasets in Table We find that the proposed MaxLogit method outperforms the maximum softmax probability baseline on all out-o--distribution test datasets Dout- This holds true for all three models trained on Im The MSP baseline is much better than random and is has similar performance for all three model classes. This suggests that contrary to recent claims, (Fort al. 202I) simply scaling up Vision Transformers does not make OOD detection trivial.
4 MULTI-LABEL PREDICTION FOR OOD DETECTION
Current work on out-of-distribution detection primarily considers multi-class or unsupervised settings. Yet as classifiers become more useful realistic settings, the multi-label formulation becomes increasingly natural. To investigate out-of-distribution detection in multi-label settings, we provide baseline and evaluation setup.
Setup. For multi label classification we use PASCAL VOC (Everingham et al. 2009) and MS- COCO (Lin et al., 2014) as in-distribution data. To evaluate anomaly detectors for these in-distribution datasets, we use 20 out- -iitii--istiibuutin classes from ImageNet-21K. These classes have no overlap with ImageNet-1K: PASCAL VOC, or MS-COCO. The 20 classes are chosen not to overlap with ImageNet-IK IK since the multi-label classifiers models are pre-trained ImageNet- IK. We list the class WordNet IDs in the Appendix.
Methods. For experiments, we use ResNet-101 backbone architecture pre-trained on ImageNet-1K IK. We replace the final layer with 2 fully connected layers and apply the logistic sigmoid freeze the batch normalization parameters due
function for multi-labe prediction. During training to an insufficient number of images for proper mean and variance estimation. We train each model for 50 epochs using the Adam optimizer (Kingma & Ba 2014) with hyperparameter values 10-1 and

---

Under review as a conference paper at ICLR 2022
iForest
LOF
Dropout 97.2
LogitAvg
MSP
MaxLogit
FPR95
98.6
84.0
98.2
82.3
35.6
PASCAL VOC AUROC
46.3
68.4
49.2
47.9
74.2
90.9
AUPR
37.1
58.4
45.3
41.3
65.5
81.2
FPR95
95.6
78.4
93.3
94.5
81.8
40,4
COCO
AUROC
41.4
70.2
58.0
55.5
70.7
90.3
AUPR
63.7
82.0
76.3
74.0
82.9
94.0
Table 3: Multi-label out-of-distributtion detection comparison of the Isolation Forest (iForest), Local Outlier Factor (LOF), Dropout, logit average, maximum softmax probability, and maximum logit anomaly detectors PASCAL VOC and MS-COCO. The same network architecture is used for all three detectors. All results shown are percentages.
10-5 for 31 and 32 respectively. For data augmentation we use standard resizing, random crops, and random flips to obtain images of size 256 x 256 x 3. As a result of this training procedure, the mAP of the ResNet- 101 on PASCAL VOC is 89.11% and 72.0% for MS-COCO
As there has been little work on out-of-distribution detection in multilabel settings, we include comparisons to classic anomaly detectors for general settings. Isolation Forest, denoted by iForest, works by randomly partitioning the space into half spaces to form a decision tree. The score is determined by how close a point is to the root of the tree. The local outlier factor (LOF) (Breunig) et al. a (0000) computes local density ratio between every element and its neighbors. We set the number of neighbors as 20, iForest and LOF are both computed on features from the penultimate layer of the networks. MSP denotes a natural extension of the maximum softmax probability detector in the multi-label setting, obtained by taking the sigmoid of each output score fzz; and computing max, (f(x).) Alternatively, one average the logit values, denoted by LogitAvg. These serve as our baseline detectors for multi-lahel OOD detection. We compare these baselines to the MaxLogir detector that introduce in Section As in the multi-class case, the MaxLogit anomaly score for multi-label classification is max; (T).
Results. Results are shown in Table 3 We find that MaxLogit obtains the highest performance in all cases. MaxLogit bears similarity to the MSP baseline (Hendrycks & Gimpel] 2017) but is naturally applicable multi-label problems. These results establish the MaxLogit as an effective and natural baseline for large-scale multi-label problems. Further, the evaluation setup enables future work in -f-iiiiriiuutinn detection with multi-label datasets.
THE CAOS BENCHMARK
The Combined Anomalous Object Segmentation (CAOS) benchmark is comprised two comple- mentary datasets for evaluating anomaly segmentation systems diverse, realistic anomalies. First the StreetHazards dataset, which leverages simulation to provide a large variety of anomalous objects realistically inserted into driving scenes. Second is the BDD-Anomaly dataset, which consists of real images taken from the BDD100K dataset (Yu et al.] 2018). StreetHazzards contains a highly diverse array of anomalies; -DDD-Anomaly contains anomalies in real-world images. Together, these datasets allow researchers to judge techniques on their ability to segment diverse anomalies as well as anomalies in real images. All images have 720 X 1280 resolution.
The StreetHaazrds Dataset. StreetHazards is an anomaly segmentation dataset that leverages simulation to provide diverse, realistically-inseetedd anomalous objects. To create the StreetHazards dataset, we use the Unreal Engine along with the CARLA simulation environment (Dosovitskiy et al. 2017). From several months of development and testing including customization of the Unreal Engine and CARLA, we can insert foreign entities into scene while having them be properly integrated. Unlike previous work, this avoids the issues of inconsistent chromatic aberration, inconsistent lighting, edge effects, and other simple cues that object is anomalous. Additionally, using a simulated environment allows us to dynamically insert diverse anomalous objects in any location and have them render properly with changes to lighting and weather including time of day, cloudy skies, and rain.
We use 3 towns from CARLA for training, from which we collect RGB images and their respective semantic segmentation maps serve training data for semantic segmentation models. We generate a validation set from the fourth town. Finally, we reserve the fifth and sixth town as our test set. We insert anomalies taken from the Digimation Model Bank Library and semantic ShapeNet
7

---

Under review as a conference paper at ICLR 2022
Examples and Predictions for Our StreetHazards Dataset
Input
MSP
MaxLogit Autoencoder
Figure 4: A sample of anomalous scenes from the CAOS benchmark with model predictions and anomaly scores. The anomaly scores are thresholded to the top 10% of values for visualization. GT ground truth, the autoencoder model based on the spatial autoencoder used Baur al. (2019) MSP is the maximum softmax probability baseline (Hendrycks & Gimpel 2017). and Max the method we propose as a new baseline for large-scale settings. Compared baselines, the MaxLogit detector places lower scores on in-distribution image regions, including object outlines, while also doing a better job of highlighting anomalous objects.
(ShapeNetSem)) (Savva et al. 2015) into the test set in order evaluate methods for out-of-distribution detection. In total, we use 250 unique anomaly models of diverse types. There are 12 classes used for training: background, road, street lines, traffic signs, sidewalk, pedestrian, vehicle, building, wall, pole, fence, and vegetation. The thirteenth class is the anomaly class that is only used at test time, We collect 5, 5,125 image and semantic segmentation ground truth pairs for training, 1,031 pairs without anomalies for validation, and 1,500 test pairs with anomalies.
The BDD-Anomaly Dataset. BDD-Anomaly is anomaly segmentation dataset with real images in diverse conditions. We source BDD-Anomaly from BDD100K (Yu et al. 2018). large-scale semantic segmentation dataset with diverse driving conditions. The original data consists in 7,000 images for training and 1,000 for validation. There are 18 original classes. We choose motorcycle, train, and bicycle as the anomalous object classes and remove all images with these objects from the training and validation sets. This yields 6,280 training pairs, 910 validation pairs without anomalies, and 810 testing pairs with anomalous objects.
5.1 EXPERIMENTS
Evaluation. In anomaly segmentation experiments, each pixel is treated as a prediction, resulting in many predictions to evaluate. To fit these in memory, compute the metrics on each image and average over the images to obtain final values.
Methods. Our first baseline is pixel-wise Maximum Softmax Probability (MSP). Introduced by Hendrycks & Gimpel (2017) for multi-class out-of--distrbution detection, we directly port this baseline anomaly segmentation. Alternttvvly., the background class might serve anomaly detector, because it contains everything not in the other classes. To test this hypothesis, "Background" uses the posterior probability of the background class the anomaly score. The Dropout method
8

---

Under review as a conference paper at ICLR 2022
MSP
Branch
Background
Dropout 79.4
AE
MaxLogit
FPR95
33.7
68.4
69.0
91.7
26.5
StreetHazards
AUROC
87.7
65.7
58.6
69.9
66.1
89.3
AUPR
6.6
1.5
4.5
7.5
2.2
10.6
FPR95
24.5
25.6
40.1
16.6
74.1
14.0
BDD-Anomaly AUROC
87.7
85.6
69.7
90.8
64.0
92.6
AUPR
3.7
3.9
1.1
4.3
0.7
5.4
Table 4: Results on the CAOS benchmark. AUPR low across the board due to the large class imbalance, but all methods perform substantially better than chance. MaxLogit obtains the best performance. All results are percentages.
obtain an epistemic uncertainty estimate. Following Kendall et al. 2015), we compute the pixel-wise posterior variance over multiple dropout masks and average across all classes, which serves as the anomaly score. We also experiment with an autoencoder baseline similar to Baur et al. (2019); Haselmann et al. (2018) where pixel-wise reconstruction loss used as the anomaly score. This method is called AE, The "Branch" method direct port of the confidence branch detector from Deiesss & Taylor 2018) pixel-wise prediction. Finally, we use the MaxLogit method described in earlier sections independently on each pixel.
leverages MC Dropout (Gal Ghahramani 2016)
For all of the baselines except the autoencoder, we train PSPNet (Zhao et al. 2017) decoder with ResNet-101 encoder (He et al. 2013) for 20 epochs. We train both the encoder and decoder using SGD with momentum of 0.9, learning rate of 2 x 10-2, and learning rate decay of 10-4. For AE, we use a 4-layer U-Net (Ronneberger et al. 2013)) with a spatial latent code as in Baur et al. (2019). The U-Net also uses batch norm and is trained for 10 epochs. Results in Table
Results and Analysis. Maxl outperforms all other methods across the board by substantial mar- gin. The intuitive baseline of using the posterior for the background class detect anomalies per- forms poorly, which suggests that the background class may not align with rare visual features. Even though reconstruction-ben based scores succeed in prod- uet fault segmentation, we find that the AE method performs poorly on the CAOS benchmark, which may be due to the more complex domain. AUPR for all methods is low, indicating that the large class imbalance presents serious challenge. However, the substantial improvements with the MaxLoggi method suggest that progress on this task is possible and there is much room for improvement. A comparison with other datasets is in Figure (Pinggera
Method
MSP
MaxLogit
FS Lost and Found Road Anomaly
87.0%
92.0%
73.8%
78.0%
Figure 5: Auxiliary analysis of the MSP and the MaxL AUROCs using prior less com- prehensive anomaly segmentation datasets.
et al. 2016 Blum et al. 2019 Jung et al. 2021).
In Figure we see that both MaxLogit and MSP have many false positives, they assign high anomaly scores to semantic boundaries, a problem also observed in the recent works of (Blum et al. 2019 Angus 2019). However, the problem is less severe with MaxLogit. A potential explanation for this is that even when the prediction confidence dips at semantic boundaries, the maximum logit can remain the same 'hand-off' procedure between the classes. Thus, MaxLogit provides a natural mechanism to combat semantic boundary artifacts that could be further explored in future work.
CONCLUSION
We scaled distr-iiitiiittonnn detection settings with thousands of classes and high-resolution images. We identified an issue faced by existing baselines when scaling to these settings and proposed the maximum logit detector as a natural solution. We introduced the Species dataset enable more controlled experiments without class overlap and also investigated using multi-label classifiers for OOD detection, establishing an experimental setup for this previously unexplored setting. Finally, we introduced the CAOS benchmark for anomaly segmentation, consisting of diverse, naturally-integrated anomalous objects in driving scenes. Baseline methods on the CAOS benchmark substantially im- prove random guessing but are still lacking, indicating potential for future work. Interestingly, the MaxLogit detector also provides consistent and sigmificant gains in the multi-label and anomaly segmentation settings, thereby establishing it new baseline in place of the maximum softmax prob-

---

Under review as a conference paper at ICLR 2022
ability baseline large-scale OOD detection problems. In all, hope that contributions will detection for real-world safety-critical environments.
enable further research on
REFERENCES
Matt Angus. Towards pixel-level ood detection for semantic segmentation, 2019.
Christoph Baur, Benedikt Wiestler, Shadi Albarqouni, and Nassir Navab. Deep autoencoding models for unsupervised anomaly segmentation in brain images. Lecture Notes in Computer Science, pp. 161-169, 2019. ISSN 1-11-3349. doi: 10. 10.1007/978-3-40 111199788--0--11111 11000-11723-8166
Petra Bevandić, Ivan Krešo, Marin Oršić, and Siniša Segvić. Discriminative out-of-distribution detection for semantic segmentation, 2018.
Hermann Blum, Paul-Edouard Sarlin, Juan Nieto, Roland Siegwart, and Cesar Cadena. The fishyscapes benchmark: Measuring blind spots in semantic segmentation, 2019.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density- based local outliers. In ACM sigmod record, volume 29, pp. 93-104, ACM, 2000.
M. Cimpoi, S. Maji, I. Kokkinos, S. Mohamed, and A. Vedaldi. Describing textures in the wild. In Computer Vision and Pattern Recognition, 2014.
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. In Proc. of the IEEE Conference on Computer Vision and Puttern Recognition (CVPR), 2016.
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Hierarchical Image Database. In CVPR09, 2009.
Terrance DeVries and Graham W Taylor. Learning confidence for out-of-distribution detection in 2018.
neural networks. arXiv preprint
Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. CARLA: An open urban driving simulator. In Proceedings of the 1st Annual Conference on Robot Learning. pp. 1-16, 2017.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale.
ArXiv, abs/2010. 1929, 2021a.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021b. URL URL htttts:://oeerriii.ee.. htte:/fooummid=xicbbeet
Andrew Emmott, Shubhomoy Das, Thomas Dietterich, Alan Fern, and Weng-Keen Wong. A meta-analysis of the anomaly detection problem, 2015.
Mark Everingham, Luc Van Gool, Christopher K. I. Williams, John M. Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. International Journal of Computer Vision, 88: 303-338, 2009.
Stanislav Fort, Jie Ren. and Balaji Lakshminarayanan. Exploring the limits of out-of-distribution detection. arXiv preprint 21t::21000000004, 2021.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model
uncertainty in deep learning. International Conference Machine Learning, 2016.
10

---

Under review as a conference paper at ICLR 2022
Matthias Haselmann, Dieter P Gruber, and Paul Tabatabai. Anomaly detection using deep learning based image completion. In 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), pp. 1237-1242. IEEE, 2018.
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CVPR, 2015.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. ICLR, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. Proceedings of the International Conference on Learning Representations, 2019a.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In International Conference Learning Representations, 2019b.
Dan Hendryeks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In NewrIPS, 2019c.
Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt. Unsolved problems in mi safery, ArXiv, abs/2109. 13916, 2021.
Micah K Johnson and Hany Farid. Exposing digital forgeries by detecting inconsistencies in lighting. In Proceedings of the 7th workshop on Multimedia and security, pp. 1-10, 2005.
Sanghun Jung, Jungsoo Lee, Daehoon Gwak, Sungha Choi, and Jaegul Choo. Standardized max logits: A simple yet effective approach for identifying unexpected road obstacles in urban-scene segmentation. ArXiv, abs/2107. 1264,, 2021.
Alex Kendall, Vijay Badrinarayanan, and Roberto Cipolla. Bayesian segnet: Model uncertainty in deep convolutional encoder-decoder architectures for scene understanding. ArXiv, abs/1511.0266 2015.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. ICLR, 2014.
Rajat Koner, Poulami Sinhamahapatra, Karsten Roscher, Stephan Günnemann, and Volker Tresp. Oodformer: Outtof-distribbttion detection transformer. ArXiv, 2021.
Ivan Krešo, Marin Oršić, Petra Bevandić, and Siniša Šegvić. Robust semantic segmentation with ladder-densenet models, 2018.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibratee classifiers for detecting out-tf-distribution samples. International Conference Learning Representations, 2018a
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. ArXiv, 8 807//887, 2018b.
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection neural networks. International Conference on Learning Representations, 2018.
Tsung-Yr Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Dollar. Microsoft COCO: Common objects in context. ECCV, 2014.
Sina Mohseni, Mandar Pitale, Jbs Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable dutti--distiibutiin detection. In AAAI, 2020.
Peter Pinggera, Sebastian Ramos, Stefan K. Gchrig, Uwe Franke, Carsten Rother, and Rudolf
Mester. Lost and found: Detecting small road hazards for self-driving vehicles. 2016 IEFF/RS/ International Conference on Intelligent Robots and Systems (IROS), pp. 1099-1106. 2016.
Ridnik, Emanuel Ben-Baruch. Asaf Noy, and Lihi Zelnik-Mann Manor. Imagenet-22 21k pretraining for the
masses. ArXiv, abs/2 12221044.992 10972, 2021a.
11

---

Under review as a conference paper at ICLR 2022
Tal Ridnik, Hussam Lawen, Asaf Noy, Emanuel Ben Baruch, Gilad Sharir, and Itamar Friedman. Tresnet: High performance gpu spu-dedicated architecture. In Proceedings of the IEEE/CVE Winter Conference Applications of Computer Vision, pp. 1400-1409, 2021b. 2021bb.
Olaf Ronneberger. Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. Medical Image Computing and Computer-Assisted Intervention MICCA/ 2015. pp. 2015. ISSN 1611-3349. doi: (0.1007/978-3-319-2240 --319-24574-4. -__
Manolis Savva, Angel X. Chang, and Pat Hanrahan. Semantically-Enriceee Eerriherd 3D Models for Common- sense Knowledge. CVPR 2015 Workshop on F'unctionality, Physics, Intentionality and Causality, 2015.
Bernhard Schölkopf, Robert Williamson, Alex Smola, John Shawe- Shawe-Taylor, and John Platt. Support vector method for novelty detection. In Proceedings of the 12th International Conference Neural Information Processing Systems, N9PS'99, pp. 582-588, Cambridge, MA, USA, 1999, MIT Press.
Ilya Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Un- terthiner, Jessica Yung, Daniel Keysers, Jakob Uszkoreit, Mario Lucic, et al. Mlp-mixer: An all-mlp architecture for vision. arXiv preprint arXiv:2005001601, 2021.
Fisher Yu, Yinda Zhang, Shuran Song, Ari Seff, and Jianxiong Xiao. LSUN: construction of large-scale image dataset using deep learning with humans in the loop. CoRR, 2015.
Fisher Yu, Wenqi Xian, Yingying Chen, Fangchen Liu, Mike Liao, Vashisht Madhavan, and Trevor Darrell. BDD 100K: A diverse driving video database with scalable annotation tooling. CoRR,
2018.
Oliver Zendel, Katrin Honauer, Markus Murschitz, Daniel Steininger, and Gustavo Fernan- dez Dominguez. Wilddash-creating hazard-aware benchmarks. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 402-416, 2018.
Hengshuang Zhao, Jianping Shi, Xiaojuan Qi, Xiaogang Wang, and Jiaya Jia. Pyramid scene parsing network. 2017 IEEE Conference Computer Vision and Pattern Recognition (CVPR), pp- 6230-6239, 2017.
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. PAMI, 2017.
Peng Zhou, Xintong Han, Vlad I Morariu, and Larry S Davis. Learning rich features for image manipulation detection. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 1053-1061, 2018
12

---

Under review as a conference paper at ICLR 2022
A
APPENDIX
FPR95 1
AUROC
AUPR
Di
Drest
B
M
D
K
B
M
D
K
B
M
D
K
Gaussian
2
0
4
100
100
97
98
93
98
55
79
ImageNet
Rademacher
21
4
15
89
98
93
29
70
62
54
Blobs
26
32
72
8
80
79
37
99
25
17
7
93
Textures
68
56
59
80
87
76
85
25
36
16
48
LSUN
66
63
59
60
75
77
76
79
21
22
19
38
Places365
64
59
72
79
79
79
32
24
46
Mean
41.3
35.8
46
36.1
85.2
87.2
76.9
88.7
37
45.8
30.5
59.7
Gaussian
10
6
71
12
93
96
35
93
16
24
2
16
Places365
Rademacher
20
10
91
89
93
10
100
15.9
1.6
88
Blobs
59
6
88
27
72
98
15
93
5
41
2
31
Textures
86
72
87
74
65
79
43
79
11
1
12
Places69
88
89
92
91
61
64
52
65
6
3
6
Mcan
53
36.6
85.8
40.9
76
85.8
31.1
85.8
8
19.2
2
30.5
Table 5: B is for the maximum softmax probability baseline, M is for maximum logit, D is for the method in DeViss & Taylor (2018). and is our own KL method described below. Both M and K ours. Results are ImageNet and Places365, All values are percentages and are rounded that 99.95 rounds to 100.
B FULL MULTICLASS OOD DETECTION RESULTS
Datasets. To evaluate the MSP baseline out-of -iit----dittiuution detector and the MaxLogit detector, we use the ImageNet- 1K object recognition dataset and Places365 scene recognition dataset as in-distribution datasets Din- We use several -itto---iitribution test datasets Dauts all of which are unseen during training. The first out-of-distribution dataset is Gaussian noise, where each example's pixels are i.i.d. sampled from (0 0.5) and clipped to be contained within [-1,1]. Another type of test-time noise is Rademacher noise, in which each pixel is i..dd sampled from 2 Bernoulli(0.5) 1. ie. each pixel is or -1 with equal probability. Blob examples are more structured than noise; they algorithmically generated blob images. Meanwhile, Textures is dataset consisting in images of describable textures (Cimpoi et al. 2014). When evaluating the ImageNet-Il KK detector, we use LSUN images, scene recognition dataset (Yu et al. 2015).. Our final D is Places69, scene classification dataset that does not share classes with Places365. In all, we evaluate against out-of-distribution examples spanning synthetic and realistic images.
KL Matching Method. To verify our intuitions that led us to develop the MaxLogit detector, we developed less convenient but similarly powerful technique applicable for the multiclass setting. Recall that some classes tend to be predicted with low confidence and others high confidence. The shape of predicted posterior distributions is often class dependent.
We capture the typical shape of each class's posterior distribution and form posterior distribution templates for each class. During test time, the network's 's softmax posterior distribution is compared to these templates and anomaly score is generated. More concretely, distributions dg, one for each class. We write d₂ = Ex,xx, (p(y]=')] where & = argmax, p(y = x²)) Then for new test input x, we calculate the anomaly score ming KL[p(y x) da) rather than the MSP baseline max ply = k r). Note that we utilize the validation dataset, but our KL matching method does not require the validation dataset's labels. That said, KL matching method is less convenient than our MaxLogit technique, and the two perform similarly. Since this technique requires more data than MaxLogit, we opt to simply use the MaxLogit in the main paper.
compute i different
Results. Observe that the proposed MaxLogit method outperforms the maximum softmax probabil-
ity baseline for all three metrics on both ImageNet and Places365. These results were computed using
ResNet-50 trained either ImageNet- 1K or Places365. In the case of Places365. the AUROC improvement is over 10%. We note that the utility the maximum logit could not be appreciated as easily in previous work's small-scale settings. For example, using the small-scale CIFAR-10 setup of
13

---

Under review as a conference paper at ICLR 2022
Hendrycks et al. Hendrycks al. (019a), the MSP attains average AUROC of 90.08% while the maximum logit attains 90.22%, a minor 1.14% difference. However, in a large-scale setting, the difference be over 10% on individual Dour datasets. We not claiming that utilizing the maxi- mum logit is a mathematically innovative formulation, only that serves as a consistently powerful baseline for large-scale settings that went unappreciated in small-scale settings. In consequence, suggest using the maximum logit as new baseline for large-scale multi-class out-of-distribttion detection.
Overview of Other Detection Methods. There are other techniques in out-of-distribution detection which require other assumptions such as more training data. For instance, Hendrycks et al. (2019a);
Mohseni et al. (2020) use additional training data labeled as out-of-distributinn and the MaxLogi technique can be naturally extended should such data be available. [Heddryeks al. (2019c) use rotation prediction and self- supervseee learning, but we found that scaling this to the ImageNet multiclass setting did not produce strong results. The MSP baseline trained with auxiliary rotation prediction has AUROC of 59.15 %6, and with MaxLogit it attains 73.6% AUROC, over a 10% absolute improvement with MaxLogit. Nonetheless this technique did not straightforwardly scale, as the network is better without auxiliary rotation prediction. Likewise, [Lee et al. (2018b) propose to use Mahalanobis distances, but in scaling this to 1000 classes, we consistently encountered NaN errors due to high condition numbers. This shows the importance of ensuring that out-of-distributin techniques can scale.
ODIN Liang al. (2018) assumes that, for each OOD example source, can tune hyperparameters for detection. For this reason we do not evaluate with ODIN in the rest of the paper. However, for thoroughness, evaluate it here. ODIN uses temperature scaling and adds epsilon perturbation to the input in order to separate the softmax posteriors between in- and out-of-distribution images; these hyperparameters following Deies & Taylor 2018). Then, MaxLogit combined with ODIN results in an FPR95 of 33.6, an AUROC of 88.8 and an AUPR of 51.3 on ImageNet. On Places365, the FPR95 35.3, the AUROC is 86.5, and the AUPR 24.2. Consequently, techniques built with different assumptions can integrate well with MaxLogit. We do not train ImageNet-21 models from scratch with these methods due to limited compute.
C MULTI-LABEL OUT-OF-DISTRIBUTTI DATASET LIST
For multi-label classification experiments, we choose the following classes from ImageNet-21K serve out-of-distribution data: dolphin (n02069412), deer (102431122), bat (n02139199), rhino (n02392434), raccoon (n02508213), octopus (n01970164) 64), giant clam (n01959492). leech (n01937909), Venus fly- trap (n12782915), cherry tree (n12641413), Japanese cherry blossoms (n (11249317), red wood (n (n12285512). sunflower (n1 1978771), croissant (07691655), stick cinnamon (n07814390), cotton (n12176953), rice (n12126084) sugar cane (n12132956), bamboo (n12147226), and tumeric (n (n12356395). These classes were hand-chosen that they distinct from VOC and COCO classes.
ROC Curve of VOC Vs. ImageNet
1.0
True Positive Rate
0.6
0.4
MaxLogit
LOF
Random
0.0
0.0
0.2
0.4
0.6
0.8
1.0
D OOD SEGMENTATION
False Positive Rate
We cover methods used in the paper in more depth and the modifications necessary to make the methods work with OOD detection in semantic segmentation. We use to denote the function typically a neural network, x is the input image, and yi. is the prediction for pixel j. We will denote the output probability distribution per pixel P and locations i, j as the location of the
Figure ROC curve with VOC as (Din) and non-overlapping ImageNet classes as (D Curves correspond to an uninfor- mative "Random" detector, Local Outlier Factor, and the MaxLogit detector.
14

---

Under review as a conference paper at ICLR 2022
respective pixel in the output. f denotes the ith row and j column of the output.
Confidence Estimation. The method pro- posed in Deeess & Taylor (2018) works by training confidence branch added at the end of the neural network. We denote the network predictions as both and whereby every pixel is assigned a confidence value.
Fishyscapes
b ~ B(0.5)
c: è b+ (1 (1-1) b)
P: P. c (1-cy
The confidence estimation denoted by e is given "hints" during training guide what is learn- ing. The B is a beta distribution and acts as a
StreetHazzrdds
regularizer similar dropout so that the network f does not exclusively rely on the true labels be- ing present. The final loss is modified to include the extra term below:
Figure 7: A comparison of lighting consistency in the Fishyscapes anomaly segmentation benchmark and our new StreetHazards dataset. The arrows point in the manually estimated direction of light on parts of the scene. In Fishyscapes, inconsis- tent lighting allows forensics techniques detect the anomaly (Johnson & Farid (005). Unlike cut- and-paste anomalies, the anomalies in our Street- Hazards dataset are naturally integrated into their environment with proper lighting and orientation, making them more difficult to detect.
log(p:)
P
C.
log(E.)
P
C = Cp + XCe
The reasoning for Le is to encourage the net- work to output confident predictions. Finally À initialized to 0.1 and is updated by a "budget" parameter which set to the default 0.3. The update equation:
A/0.99
Σ c S budget
A/1.01
Σ à budget
This adaptively adjusts the weighting between the two losses and experimentally the update is not sensitive the budget parameter.
Semantic Segmentation BDD Anomalies Dataset List. The BDD100K dataset contains 180 instances of the train class, 4296 instances of the motorcycle class, and 10229 instances of the bicycle class.
StreetHazarrs 3D Models Dataset List. For semantic segmentation experiments, we choose to use the following classes 3D models from Model Bank Library serve cattof-distributionn data: Meta-categories: Animals, Vehicles, Weapons, Appliances, Houschold items (furniture, and kitchen items), Electronics, Instruments, and miscellaneous. The specific animals used are kangaroos, whales, dolphins, cows, lions, frogs, bats, insects, mongooses, scorpions, fish, camels, flamingos, apes, horses, mice, spider, dinosaurs, elephants, moose, shrimps, bats, butterflies, turtles, hippopotamuses, dogs, cats, sheep, seahorse, snail and zebra. The specific vehicles used are military trucks, motorcycles, naval ships, pirate ships, submarines, sailing ships, trolleys, trains, airplanes, helicopters, jets, zeppelin, radar tower, construction vehicles (loaders, dump trucks, bulldozer), farming vehicles (harvester, gantry crane, tractor), fire truck, tank, combat vehicles, and trailers. The specific weapons used are guns, missiles, rocket launchers, and grenades. The appliances used are refrigerators, stoves,
15

---

Under review as a conference paper at ICLR 2022
washing machines, and ovens. The household items used are cabinets, armoire, grandfather clocks, bathtubs, bureaus, night stand, table, bed, bookcase, office desk, glasses (drinking), throne chair, kitchen utensils (knives, forks, spoons), sofa, clothing iron, plates, sewing machine, and dressing mirror. 'he electronics used are computer monitor, computer mouse, hair dryer, The instruments category includes bassoon, clarinet, drums, guitar, violin, harp, and keyboard. The miscellaneous category includes rocket, space capsule, space shuttle, lunar module, glasses (wearable), weight machine, balance beam, bench press, bowling ball and pins, and pens. Several categories and instances were excluded from Model Bank Library due to their occurrence in the simulation environment such as playground equipment and various types of foliage and trees. The sizes of instances used in the dataset might not reflect the actual scale that would otherwise naturally occur. Similarly the location of instances the dataset are not necessarily reflective of where they are likely to occur nature.
16


Reviews:
[{"review_id": "nYrHIx3M-RL", "reviewer": "Reviewer_osoG", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Paper strengths:\n\n+ The paper spots the reliability issue of the maximum softmax probability (MSP) on large-scale datasets.\n\n+ The paper addresses a limited explored problem, large-scale OOD.\n\n+ The paper is well-written and easy to follow. \n\n+ The proposed anomaly MaxLogit score (negative of the maximum unnormalized logit for an anomaly score) leads to good performance for large-scale OOD.\n\n\nPaper weaknesses: \n\n- The MaxLogit score is nowhere formally defined. It's straightforward how is computed but a formal distribution is necessary since it composes a major contribution to the paper. \n\n- It's not clear whether the proposed setup is near- or far-ODD setup. This claim could be well-supported by a corresponding analysis.\n\n- The paper focuses only on the maximum softmax probability metric for the evaluations. However, there are other methodologies such as ODIN (Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks, 2018), Mahalanobis distance (A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks, 2018) or OECC (Outlier Exposure with Confidence Control for Out-of-Distribution Detection, 2021). It is important to include one more baseline for comparisons. \n\n- Multi-label OOD: There is already the setup with ImageNet-1k as out-of-distribution (A benchmark for anomaly segmentation, 2019). It would be more helpful to follow an existing protocol next to the proposed one.\n\n- Small-scale evaluation: it would be useful to see how the proposed metric performs on small-scale evaluations. There is not a single standard evaluation on this setup although approaches from the small-scale evaluation are used, e.g. MSP.\n\n\nImprovements:\n\n- \"In contrast to medical anomaly segmentation and fault detection, we consider complex images from street scenes.\" -> This argument could be reformulated since medical imaging is quite challenging.", "summary_of_the_paper": "The paper presents the negative of the maximum unnormalized logit (MaxLogit) as an anomaly score for out-of-distribution (OOD) detection. Also, it introduces a large-scale setup for ODD. The proposed metric shows promising results compared to the maximum softmax probability (MSP) in the proposed setup (in-distribution ImageNet-1K and out-distribution Places365). For the multi-label experiment, the PASCAL VOC and MS-COCO are in-distribution and ImageNet-22K out-distribution. The proposed MaxLogit works better than in this MSP too. Finally, the proposed metric shows promising results in the  CAOS benchmark.", "summary_of_the_review": "Overall the paper proposes a metric and a large scale setup of out-of-distribution detection. Both contributions are valuable and can be considered novel too. There are few a points to be addressed in the paper structure, as discussed above. The major issue is to add more related approaches in the comparisons. Moreover, the small-scale evaluation would be useful to show the generalization of the proposed metric to different types of setups. Even if MaxLogit does not deliver state-of-the-art results on a small scale, it would still be important to show the results and interpret the outcome.\n\n\nPost-rebuttal: \n\nThe rebuttal showed that there are still changes to be performed in the paper. It would need further work before acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "g5kcDjPY7Xt", "reviewer": "Reviewer_qdA5", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths\n\nS1. Species may be a valuable tool for evaluating OOD detection approaches\n\nS2. StreetHazards is recognized as a valuable tool for evaluating dense outlier detection in several pieces of previous work.\n\nWeaknesses\n\nW1. max-logit has not been compared with its differentiable counterpart (log-sum-exp logit). Previous work shows that logsumexp logit can be interpreted as likelihood of the input [gratwohl00iclr] and that it can be used as a principled criterion for outlier detection [liu20nips]. A comparison with standardized max-logit [jung21iccv] would increase the value of the manuscript.\n\nW2. experimental evaluation leaves to desire:\n- Tables 1 and 2 do not contain recent baselines such as ODIN, generalized ODIN, logsumexp logit, standardized max-logit\n- Table 3: it is unclear why do max-logit and max-sigmoid-logit deliver such different rankings\n- Table 4 does not contain recent baselines, cf. [grcic21visapp] and the references within\n- Figure 5 should report AP and FPR95 (the official benchmark metrics) in order to allow comparison across the leaderboard; it would be a good idea to include these metrics into all other tables since they are also used in Segment Me If You Can. \n\nW3. BDD anomaly has a poor choice of the OOD class since parts of trains can occur on buses and parts of motorcycles can occur on cars. Thus many OOD pixels get very low OOD scores. Such occurences devastate the AP score and cause all approaches to come out equally bad. Thus, Fishyscapes, Segment Me If You Can and Wilddash 2 present better opportunities for dense OOD detection\n\nSuggestions\n- some details are missing or unclear: which Pascal VOC (2007 or 2012?), why does the training use a small batch size so that batchnorm has to be freezed, which batch size has been used, why does Table 2 show per-category results. \n- regarding \"the object’s exact class is difficult to determine\": this problem also arises at semantic borders when performing dense OOD detection [grcic21visapp]\n- it would be a good idea to describe WildDash 2\n\n[jung21iccv] https://arxiv.org/abs/2107.11264\n\n[gratwohl00iclr] https://arxiv.org/pdf/1912.03263.pdf\n\n[liu20nips] https://arxiv.org/pdf/2010.03759.pdf\n\n[grcic21visapp] https://arxiv.org/pdf/2011.11094.pdf", "summary_of_the_paper": "The paper presents a collection of somewhat disjoint contributions to outlier detection. First, the authors propose Species - a novel OOD test dataset. The main advantage of this dataset is being disjoint from ImageNet-22k. Second, the authors propose to detect outliers according to the max-logit criterion. The authors claim that max-logit is especially suitable for OOD detection in multi-label environments. Third, the authors propose two novel datasets for dense outlier detection. StreetHazards is especially interesting since it allows proper rendering of introduced outliers. ", "summary_of_the_review": "Creating datasets requires a lot of hard work. Yet, the weaknesses outweigh advantages. Hence, I must conclude that this manuscript is below ICLR acceptance threshold.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "NGbpo4sQtWK", "reviewer": "Reviewer_9GvF", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths.\n+ Three three large-scale OOD settings are presented, together with datasets for empirical evaluation\n+ A set of experiments is given on all three settings to provide baseline for future work\n+ A anomaly scoring method called MaxLogit, which is a minor variant of the popular method MSP, is introduced, and shows effective performance on the three settings\n\nWeaknesses.\n+ Several key claims of the paper are incorrect. For example, rather than what it is claimed in the paper about small-scale multi-class OOD detection, there have been increasing efforts put on large-scale multi-class settings, such as [1-2], but the paper fully ignores those closely related work; in terms of large-scale anomaly segmentation settings, the datasets and tasks introduced in [3] clearly have more advantageous features (dataset scale, diversity of anomalies, realistic of the settings, etc.) than the proposed one in this work.\n+ All the proposed datasets are created by some simple combination of existing benchmarks, wherein I cannot find any major contributions\n+ The presented method MaxLogit is a trivial variant of the popular method MSP, so no major technical novelties are presented\n+ The competing methods across all three settings are outdated models or simple baselines. Without comparison to recent, state-of-the-art models, it is difficult to evaluate how the presented method advances the area.\n\nReferences\\\n[1]  \"Are out-of-distribution detection methods effective on large-scale datasets?.\" arXiv preprint arXiv:1910.14034 (2019).\\\n[2] \"MOS: Towards Scaling Out-of-distribution Detection for Large Semantic Space.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8710-8719. 2021.\\\n[3] \"SegmentMeIfYouCan: A Benchmark for Anomaly Segmentation.\" arXiv preprint arXiv:2104.14812 (2021).", "summary_of_the_paper": "The work designs three large-scale settings for evaluating out-of-distribution detection and performs empirical evaluation on the settings to establish some baselines for future work.", "summary_of_the_review": "Overall, the paper presents some good empirical results of large-scale OOD detection in three settings, but the work ignores a number of closely related studies and it is weak in terms of both technical novelty and empirical evaluation, thus not good enough for publication at ICLR.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "MQpqNhxXdgH", "reviewer": "Reviewer_Tkux", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n1. This paper is well motivated, which aims to push out-of-distribution (ODD) detection from small-scale settings to large-scale and real-world settings.\n2. This works seems solid, which explores three large-scale settings and introduces two new datasets.\n3. The proposed method (MaxLogit) shows good performance in all settings.  \n\nWeaknesses:\n1. This manuscript is not very well written, some contents of this manuscript are not clearly organized. It would be better to list contributions for three different settings, and introduce datasets and methods/findings more separately.\n2. The proposed method seems simple, but it's still not very clear how it works in three settings. More specific descriptions of the method would be better.", "summary_of_the_paper": "This work explores out-of-distribution (ODD) detection in three large-scale settings: multi-class OOD detection, multi-label OOD detection and anomaly segmentation. To facilitate large-scale experiments, it introduces a novel species dataset and a road anomaly dataset for multi-class OOD detection and anomaly segmentation respectively. It also demonstrates a new setup for multi-label OOD detection. In addition, this work establishes a new baseline via a simple detector based on the maximum logit in all the three large-scale settings.", "summary_of_the_review": "This paper is well motivated and solid, but the writing needs to be improved.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "7DMokPIMIRi", "reviewer": "Reviewer_xNrS", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength:\n1. The paper is well-organized and easy to understand.\n2. Out-of-distribution is a critical problem, the authors establish several large-scale benchmarks on classification and segmentation to facilitate future research.\n3. The proposed MaxLogit is practical and the experiment results on large-scale benchmarks demonstrate its consistent efficacy.\n\nWeakness:\n1. I like the large-scale benchmarks constructed in the paper. But the proposed solution (MaxLogit) is just a simple extension of MSP. I cannot even tell it is a new method even though it can get significantly better results.\n2. One interesting conclusion of the paper is the vision transformer-based method does not make OOD detection (on large-scale benchmarks) trivial. I would like to see more analysis and reasons behind this.\n3. The benchmarks are interesting, but the comparison baselines are not sufficient. Please include more SOTA OOD results like [2, 3] (see more in [1]).\n\n\n[1] Yang, Jingkang, et al. \"Generalized Out-of-Distribution Detection: A Survey.\" arXiv preprint arXiv:2110.11334 (2021).\n[2] Di Biase, Giancarlo, et al. \"Pixel-wise Anomaly Detection in Complex Driving Scenes.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.\n[3] Lis, Krzysztof, et al. \"Detecting the unexpected via image resynthesis.\" Proceedings of the IEEE/CVF International Conference on Computer Vision. 2019.", "summary_of_the_paper": "The authors extend the out-of-distribution (OOD) detection from not-seen in small-scale settings to large-scale multiclass and multi-label ones. They provide large-scale benchmarks for evaluating ODD detectors on classification as well as segmentation. Additionally, they propose a simple yet strong baseline for this practical problem.", "summary_of_the_review": "Overall, the authors study an practical problem at scale. They establish a large scale benchmark and propose a simple yet efficient approach for OOD detection. But they need to study more SOTA baselines. I would like to give an initial positive score and keep tuning during discussion period.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors focus on large scale out-of-distribution (OOD) detection for which they propose three benchmarks with multiclass and multi-label 
high-resolution images. In these settings, they find that a simple extension, using maximum logits (MaxLogit), of a common baseline  maximum softmax probability (MSP), is surprisingly competitive to prior methods.

Five knowledgeable reviewers found the idea of having these novel benchmarks potentially interesting, but highlighted some issues that needs to be taken into account before the paper can be publishable. 

First, reviewers highlighted how the presentation can be better organized (more structure on and stronger overall motivation for the three different contributions) as to present the three ideas in a more cohesive way and more formal in introducing methods (e.g. the MaxLogic and MSP) as to clearly highlight the technical contributions and the differences with other models. 

Second, more baselines need to be introduced and therefore experiments extended. For example, the comparison with another detector, LogSumExpLogit, a relaxation of MaxLogit already used for (small-scale) OOD in the context of generative models. Authors provided in the rebuttal some preliminary experimental results but promised more (for a camera-ready) that could not be evaluated by the reviewers.

Third, the scope of the proposed benchmarks raised some concerns by some reviewers. If not in the motivation behind the task of treating whole objects as anomalies, additional care shall be put into the provided annotations. As one reviewer highlighted a certain percentage of images are mis-annotated. While this percentage is somehow low (3.9%) and should not change the empirical conclusions drawn in the paper, it highlights that the core contributions of the paper might have been rushed.
Decision: Reject