Out-of-distribution Detection with Implicit Outlier Transformation
Authors: Qizhou Wang
Junjie Ye
Feng Liu
Quanyu Dai
Marcus Kalander
Tongliang Liu
Jianye HAO
Bo Han
Venue: ICLR 2023 poster (2023)
Keywords: out-of-distribution detection

Abstract: Outlier exposure (OE) is powerful in out-of-distribution (OOD) detection, enhancing detection capability via model fine-tuning with surrogate OOD data. However, surrogate data typically deviate from test OOD data. Thus, the performance of OE when facing unseen OOD data, can be weaken. To address this issue, we propose a novel OE-based approach that makes the model perform well for unseen OOD situations, even for unseen OOD cases. It leads to a min-max learning scheme---searching to synthesize OOD data that leads to worst judgments and learning from such OOD data for the uniform performance in OOD detection. In our realization, these worst OOD data are synthesized by transforming original surrogate ones, where the associated transform functions are learned implicitly based on our novel insight that model perturbation leads to data transformation. Our methodology offers an efficient way of synthesizing OOD data, which can further benefit the detection model, besides the surrogate OOD data. We conduct extensive experiments under various OOD detection setups, demonstrating the effectiveness of our method against its advanced counterparts. 

Published as a conference paper at ICLR 2023
OUT-OF-DISTRIBUTION DETECTION WITH IMPLICIT OUTLIER TRANSFORMATION
Qizhou Wang' Junjie Ye
Feng Liu?
Quanyu Dai
Mareus Kalander²
Tongliang Liu Jianye Hao
Bo Han
'Hong Kong Baptist University
Huuawii Noah's Ark Lab
'The University of Melbourne
*Sydney AI Centre, The University of Sydney
[sszwwang, bhanmlJ @ www.:h.bb.uuuu.. edu.hk
fengliu.mi (e@ggmlllcoom tongliang. lig..lluuu @iii@syluuie sydney..dd.ua.
[eeuujjie4, daiquanyu, warcus.kalandee haojianye) @ @huawei.com
ABSTRACT
Outlier exposure ing detection capability via model fine-tuning with surrogate OOD data. However, surrogate data typically deviate from test OOD data. Thus, the performance OE, when facing unseen OOD data, can be weakened. To address this issue, we propose a novel OF-based approach that makes the model perform well for un- seen OOD situations, even for unseen OOD cases. It leads to synthesize OOD data that leads to worst judgments and learning from such OOD data for uniform performance in OOD detection. In our realization, these worst OOD data are synthesized by transforming original surro- gate ones. Specifically, the associated transform functions are learned implicitly based on our novel insight that model perturbation leads to data transformation. Our methodology offers an efficient way of synthesizing OOD data, which can further benefit the detection model, besides the surrogate OOD data. We conduct extensive experiments under various OOD detection setups, demonstrating the ef- fectiveness of our method against its advanced counterparts. The code is publicly available at: ggihub.com/gzzhouuang//ae
eutierexp (OE) is powerful in out-of-distributie (OOD) detection, enhanc-
min-max learning
INTRODUCTION
Deep learning systems in the open world often encounter out-of-distribution (OOD) data whose label space disjoint with that of the in-distribution (ID) samples. For many safety-critical applications, deep models should make reliable predictions for ID data, while OOD cases (Bulusu et al., 2020) should be reported anomalies. It leads the well-known OOD detection problem (Lee et al. 2018c Fang et al. 2022), which has attracted intensive attention in reliable machine learning.
OOD detection remains non-trivial since deep models can be over-confident when facing OOD data (Nguyen et al. 2015 Bendale & Boult 2016), and many efforts have been made in pursuing reliable detection models Yang et al., [021: (aalehi al. 202T). Building upon discriminative models, existing OOD detection methods can generally be attributed to two categories, namely, post- hoc approaches and fine-tuning approaches. The post-hoc approaches assume well-trained model on ID data with its fixed parameters, using model responses to devise various scoring functions to indicate ID and OOD cases (Hendrycks & Gimpel| [007]] [iang et al., 2018 Lee al., 2018c] Liu et al.] 2020 Sun et al.) [021] 2022, Wang al. 2022). By contrast, the fine-tuning methods allow the target model to further adjusted, boosting its detection capability by regularization (Lec
et al.] 2018a 8a Hendrycks
al. 2019 Tack et al. 2020 Mohseni al. 2020 Sehwag et al. 2021
Chen et al. 2021 Du et al. 20 Ming et al. 2022] Bitterwolf et al. (022). Typically, fine-tuning
approaches benefit from explicit knowledge unknowns during training and thus generally reveal
reliable performance across various real-world situations (Yang et al. 2002))
For the fine-tuning approaches, outlier exposure (OE) (Hendrycks et al. 2019) is among the most potent ones, engaging surrogate OOD data during training to discern ID and OOD patterns. By mak-
1 Corresponddecce Bo Han (bhanml@comp.hrg www.pph.hhhhhcc.p and Junjie Ye (yejunjic4 @ huawei.com).

---

Published as a conference paper at ICLR 2023
surrogate
surrogate
surrogate
test
test
(a) OB
(b) DRO
(c) DOE
Comparison between OE, DRO, and DOE. Black boxes indicate support sets for surro- gate/test OOD data. Intensities of color indicate the coverage of learning schemes deeper colored region indicates the associated model can make more reliable detection therein. As we can see, OE directly makes the model learn from surrogate OOD data, largely deviating from test OOD situa- tions. DRO further makes the model perform uniformly well regarding sub-populations, and the model can excel in the support set of the surrogate case. Moreover, DOE makes the model learn from additional OOD data besides surrogate cases, covering wider OOD situations (exceeding the support set) than that of OE and DRO. Thus, OOD detection capability increases from left right.
Figure 1:
ing these surrogate OOD data with low-confident predictions, OE explicitly enables the detection model to learn knowledge for effective OOD detection. A caveat is that one can hardly know what kind of OOD data will be encountered when the model is deployed. Thus, the distribution gap exists between surrogate (training-tinn) and unseen (test-time) OOD cases. Basically, this distribution gap harmful for OOD detection since one can hardly ensure the model performance when facing OOD data that largely deviate from the surrogate OOD data Yang et al. 2021 Dong et al. 2020).
Addressing the OOD distribution gap issue is essential but challenging for OE. Several works are related to this problem, typically shrinking the gap by making the model learn from additional OOD data. For example, Lee et al.] (2018a) synthesize OOD data that the model will make mistakes by generative models, and the synthetic data learned by the detection model for low confidence predictions. However, synthesizing unseen is intractable in general (Du et al.) 2022). meaning that corresponding data may not fully benefit OE training. Instead, Zhang et al. (2023) mixup ID and surrogate OOD data to expand the coverage of OOD cases; and Du et al. (2022) sample OOD data from the low-likelihood region of the class-con distribution in the low- dindeensiional feature space. However, linear interpolation in the former can hardly cover diverse OOD situations, and feature space data generation in the latter may fail to fully benefit the underlying feature extractors. Hence, there is still a long way to go to address the OOD distribution gap issue in OF.
To overcome the above drawbacks, we suggest simple yet powerful way access extra OOD data, where we transform available surrogate data into new OOD data that further benefit our detection models. The key insight is that model perturbation implicitly leads to data transformation, and the detection models can learn from such implicit data by model updating after its perturbation. The associated transform functions are free from tedious manual designs (Zhang et al.) 2023 Huang al. 2023) and complex generative models (Lee et al. 2018h) while remaining flexible for syn- thetic OOD data that deviate from original data. Here, two factors support the effectiveness of our data synthesis: 1) implicit data follow different distribution from that of the original one (cf., Theo- rem[] [ and 2) the discrepancy between original and transformed data distributions can be very large, given that our detection model is deep enough (cf., Lemma D. It indicates that one can effectively synthesize extra OOD data that are largely different from the original ones. Then, we can learn from such data further benefit the detection model.
Accordingly, we propose proach built upon our implicit data transformation. The iesaributionaalaanostti reflects our ulti- mate goal of making the detection models perform uniformly well with respect to various unseen OOD distributions, accessing only ID and surrogate OOD data during training. In DOE, we measure the model performance in OOD detection by the worst OOD regret (WOR) regarding candidate set of OOD distributions (cf., Definition 2 leading to min-max learning scheme as in equation 6 Then, based plicit OOD data that lead to large WOR via model perturbation and 2) learning from such data for uniform detection power for the detection model.
crrributiionllgggostti Outlier Exposure (DOE), novel OE-based ap-
systematic way of implicit data synthesis, iterate between 1) searching im-
2

---

Published as a conference paper at ICLR 2023
DOE is related to distributionally robust optimization (DRO) (Rahimian & Mehrotra, 2019), which similarly learns from the worst-case distributions. Their conceptual comparison is summarized in Figure Therein, DRO considers close- close-world world setting, striving for uniform performance regarding various data distributions in the support (Sagawa et al. 2020). However, it fails the open-word OOD settings that require detecting unseen data (ct., Section which is the part of the test support that is disjoint with the surrogate one in Figure [(b] By contrast, our data transformation offers an effective approach learning from unseen data, considering the region's 's uniform performance beyond the support. Thus, DOE can mitigate the distribution gap issue to some extent, reflected by the smaller disjoint region than the DRO case in Figure [(c]
We conduct extensive experiments in Section 5 on widely used benchmark datasets, verifying the effectiveness of our method with respect to wide range of different OOD detection setups. For common OOD detection, our DOE reduces the average FPR95 by 7.26%, 20.30%. and 13.97% compared with the original OE on CIFAR-10, CIFAR- 100, and ImageNet datasets. For hard OOD detection, DOE reduces the FPR95 by 7.45%, 7.75%, and 4.09% compared with advanced methods regarding various hard OOD datasets.
PRELIMINARY
Let X' C Rdd denote the input space and y = (1....,, the label space. We consider the ID distribution DID defined over X' x y and the OOD distribution DOOD defined over X. In general, the OOD distribution DOOD defined as an irrelevant distribution whose label set has no intersection with y (Yang al. 2021), which is unseen during training and should not be predicted by the model.
2.1 SOFTMAX SCORING
Building upon the model h H:X - RC with logit outputs, our goal is to utilize the scoring function X IR in discerning test-time inputs given by DιD from that of DooD- Typically, if the score value s (xx) is greater than a threshold r E IR, the associated input æ E X' is taken as an ID case, otherwise OOD case. A representative scoring function in the literature is the maximum softmax prediction (MSP) (Hendrycks & Gimpel| 2017), following
SMSP (x;; h) max softmax; h(x),
where softmax; (.) denotes the k-th element of softmax output. Since the true labels of OOD are not in the label space, the model will return lower scores for them than ID cases in expectation.
2.2 OUTLIER EXPOSURE
Unfortunately, for a normally trained model f(-), MSP may make over-confident predictions for some OOD data (Liu et al. 2020), which is detrimental in effective OOD detection. To this end, OE (Hendrycks et al. 2019) boosts the detection capability by making the model h(-) learn from the surrogate OOD distribution Doo. with the associated learning objective of the form:
[(h) = EDm [(EE(((()))) + +AEEpam (( (h(x))),
Coelh;Dus)
(oo();
where À is the trade-off parameter, (ce(-) the cross-entropy loss, and loE(.) is defined by Kullback- divergence to the uniform distribution, which can be written as (on(h():) Ex so fttmax CC. Basically, the OE loss foz(.) plays the role of regularization, mak- ing the model learn from surrogate OOD data with low confident predictions. Since the model can see some OOD data during training, OE typically reveals reliable performance in OOD detection.
Note that since we know nothing about unseen during training, the surrogate distribution DooD is largely different from the real one DOoD in general. Then, the difference between surrogate and unseen OOD data leads to the OOD distribution gap between training- (i.e., DooD) and test-time (i.e.. DooD) situations. When deployed, the model inherits this data bias, potentially making over- confident predictions for unseen OOD data that differ from the surrogate ones.
3

---

Published as a conference paper at ICLR 2023
3 OOD SYNTHESIS
The OOD distribution gap issue stems from our insufficient knowledge about (test-time) unseen OOD data. Therefore, a direct approach is to give the model access extra OOD data via data synthesis, doing our best to fill the distribution gap between training- and test-time situations.
When it comes data synthesis, direct approach is utilize generative models (Lee et al., 201 8a), while generating unseen is intractable in general (Du et al. 2022). Therefore, MixOE (Zhang et al. 2023 mixup ID and surrogate OOD to expand the coverage of various OOD situations, and VOS (Du et al. 2022) generates additional OOD in the embedding space with respect to low-likelihood ID re- gions. However, the former relies on manually designed synthesizing procedures, which can hardly cover diverse OOD situations. The latter generates OOD in low-dimensional space, which relies on specific assumptions for ID distribution (e.g., a mixture of Gaussian) and hardly benefits the underlying feature extractors to learn meaningful OOD patterns.
3.1 MODEL PERTURBATION FOR DATA SYNTHESIS
Considering previous drawbacks in OOD synthesis, we suggest a new way to access additional OOD data, which is simple yet powerful. Overall, we transform the available surrogate OOD data to synthesize new data that can further benefit our model. The associated transform function is parasitic on our detection model, which is learnable without auxiliary deep models or manual designs.
The key insight is that perturbing model parameters have the same impact as transforming data, where specific model perturbations indicate specific transform functions. For the beneficial data of our interest (e.g., the worst OOD data), we can implicitly get them access by finding the correspond- ing model perturbation. Updating the detection model thereafter, can learn from the transformed data (i.e., the beneficial ones) instead of the original inputs. Now, we formalize our intuition.
We study the piecewise affine ReLU network model (Arora al. 2018). covering large group of deep models with ReLU activations, fully connected layers, convolutional layers, residual layers, etc. Here, we consider the recursive definition of I--layer ReL.U network, following
h (w((1))))
for 1 I,...,L, L,
(3)
where Wi() TR is the I-th layer weights and h 11 max (0, 1) the ReLU activation. We have z(1 x the model input and z(L) h(x)) the model output. If necessary, we write hw in place of with the joint form of weights W (W()) } that contains all trainable parameters.
Our discussion is on a specific form of model perturbation named multiplicative perturbation. Definition (Multiplicative Perturbation (Petzka et al. (202])). For a L-layer ReLU network h()), its 1-th layer is multiplicatively perturbed if WU) changed into
W aA
(4)
where a O is the perturbation strength and A R.--1xm-- is the perturbation matrix. Fur- thermore, the model h(-)) is multiplicatively perturbed if all its layers are multiplicatively perturbed.
Now, we link the multiplicative perturbation of the I-th layer data transformation in the associated embedding space, summarized by the following proposition.
Proposition Considering the data distribution D and the multiplicative perturbation regarding the 1-th layer of a ReLU network. Then, measuring in the feature space, multiplicative perturbation is equivalent to data transformation. Further, the transformed data follows a new distribution D' that is different from D if the eigenvalues of !!) are greater than 0.
Therefore, model perturbation offers an alternative way to modify data and their distribution implic- itly. Now, we generalize Proposition I for the multiplicative perturbation of the model, showing that it can modify the data distribution in the original input space.
Theorem 1. Considering the data distribution D and an L-layer ReLU network. Measuring in the input space X' C Rd, multiplicative perturbation of the model is equivalent data transformatton in the input space following distribution D'. Then, D' and D are different if the eigenvalues of A()) are greater than 0 and W (.. for 1 1,..., To.
4

---

Published as a conference paper at ICLR 2023
The proof of the above theorem directly leads to the following lemma, indicating that our data- synthesizing approach can benefit from the layer-wise architectures deep models.
Lemma 1. Considering a L-layer ReLU network with the multiplicative perturbation {AT } and the associated transformed distribution Dr, Then, there exists a L+ 1-layer ReLU network with the multipicaative perturbation {A
(A1+)) [=+1 and the associated transformed distribution PL41 such that the difference between 1/ and no smaller than the difference between D', and D.
All the above proofs be found in Appendix A revealing that model perturbation leads to data transformation. There are two points worth emphasizing. First, the distribution of transformed data can be very different from that of the original data under the mild condition of non-negative eigenvalues. Further, the corresponding transform function is complex enough with fayer-wise non- linearity, where deep models induce strong forms of transformations (regarding distributions).
DISTRIBUTIONAL-GGNOO
OUTLIER EXPOSURE
Our data synthesis scheme allows the model h(-) to learn from additional OOD data besides the surrogate ones. Recalling that, we aim for the model to perform uniformly well for various unseen OOD data. Then, a critical issue is what kinds of synthesized OOD can benefit our model the most.
To begin with, we measure the detection capability by the worst-case OOD performance of the detection model, leading to the following definition of the worst OOD regret (WOR).
Definition (Worst OOD Regret). For the detection model h(-), its worst OOD regret
[oo(h: D) inf NEW Loe(N'; DD)
WOR(h)- = sup DoOD
(5)
where DOoD denotes the set of all OOD distributions and H is the hypothesis space.
Minimizing the WOR upper bounds the uniform performance of the detection model for the OOD cases. Therefore, synthetic OOD data that lead to WOR are of our interest, and learning from such data can benefit our model the most. Note that we can also measure the detection capability by the risk, i.c., Deon Cor h; D). while find that our regret-based measurement is better since it further considers the fitting power of the model when facing extremely large space of unseen data.
4.1 LEARNING OBJECTIVE
The WOR measures the worst OOD regret with respect to the worst OOD distribution, suitable for perturbation-best based data transformation that lead to new data distributions (cf., Theorem []. Therefore, to empirically upper-bound the WOR, one can first find the model perturbation that Ieads to large OOD regret and then update model parameters after its perturbation. Here, implicit assumption is that the associated data given by model perturbation (with surrogate OOD inputs) are valid OOD cases. is reasonable since the WOR in equation does involve any term make the associated data close to ID data in either semantics or stylish.
Then, propose OE-based method for uniformly well OOD detection, namely, Distributional- agnostic Outlier Exposure (DOE). is formalized by a min-max learning problem, namely,
Look DID, DoOD) = Ler(hw; DwD++
X max P|I
Lor DOOD) - min Los Low(hw DoOD) W
(6)
Noxe(hw:Diboo
where WORp(hw: Doon) ) is a perturbation-basee realization for the WOR calculation. Several points therein require our attention. First, ID data remain the same during training and testing, and the distribution gap occurs only for OOD cases. Therefore, WOR is applied only to the surrogate OOD data, and the original risk (ce(hw: DIv) is applied for the ID data. Furthermore, implicit data transformation to search for the worst OOD distribution, substituting the search space of distribution DooD by the search space of the perturbation, i.e., {P: ||||| S 1). Here, adopt
adopt the
5

---

Published as a conference paper at ICLR 2023
fixed threshold of since change the perturbation strength via the parameter Finally, we adopt the additive perturbation W + aP which is easier to implement than the multiplicative counterpart, and they are equivalent when assuming P WA.
4.2 REALIZATION
We consider stochastic realization of DOE, where ID and OOD mini-batcher are randomly sam- pled in each iteration, denoted by Bu and BOOD. respectively. The overall DOE algorithm is sum- marized in Appendix B Here, we emphasize several vital points.
Regret Estimation. The exact regret computation is hard since we need to find the optimal risk for each candidate perturbation. As its effective estimation, following (Arjovsky et al. [019 Agarwal & Zhang 2022), we calculate the norm of the gradients with respect to the risk LoE, namely,
WCRa(hw; BooD = |/Vol=11oor((1 hw+ar; BooD) |
Intuitively, a large value of the gradient norm indicates that the current model is far from optimal, and thus the corresponding regret should be large. It leads to efficient indicator of regret.
Perturbation Estimation. The gradient ascent employed to find the proper perturbation for the max operation in equation 6 In each step, the perturbation is updated by
P VPWOBo(hw+aP? BoOD),
with P initialized to O. We further normalize P using PNORM NORM(P) to satisfy the norm constraint. By default, we employ one step of gradient update as an efficient estimation for its value, which can be taken the solution for the first-order Taylor approximated model.
Stable Estimation. Equation g is calculated for the mini-batch of OOD samples, biased from the exact solution of P that leads to the worst regret regarding the whole training sample. To mitigate the gap, for the resultant PNORM, we adopt its moving average across training steps, namely,
MA - (1 - PMA + 3NOORM.
where B E (0, 1] is the smoothing strength. Overall, a smaller 3 indicates that we take the average for wider range of steps, leading to more stable estimation of the perturbation.
Scoring Function. After training, we adopt the MaxLogit scoring (Hendrycks et al. 2022) in OOD detection, which is better than the MSP scoring when facing large semantic spaces. It is of the form:
SML (æ: h) = max (x))
(10)
where (-) denotes the k-th element of the logit output. general, a large value of sML(;; indicates the high confidence of the associated æ to be ID case.
EXPERIMENTS
This section conducts extensive experiments in OOD detection. In Section 5.1
we verify the su- periority of our DOE against state-of-the-ar methods on both the CIFAR (Krizhevsky & Hinton 2009) and the ImageNet (Deng et al. 2009) benchmarks. In Section 5.2] we demonstrate the effectiveness of our method for hard OOD detection. In Section [5.3] we further conduct an ab- lation study to understand our learning mechanism in depth. The code publicly available at:
githbb.com4rzhouwang/tto
We compare our DOE with advanced methods OOD detection. For post-hoc approaches, we consider MSP (Hendrycks & Gimpel, (017). ODIN (Liang et al.) 2018). Maha- lanobis (Lee et al., 2018c), Free Energy (Liu et al.) 2020), ReAct (Sun et al. 2021), 1), and KNN (Sun) et al. 2022); for fine-tuning approaches, consider OE (Hendrycks al. 2019), CSI (Tack et al. 2020 SSD+ (Sehwag et al. 2021), MixOE (Zhang et al. 2023). and VOS Du et al.) 2022).
Baseline Methods.
Evaluation Metrics. The OOD detection performance of detection model is evaluated via two representative metrics, which are both pnreshod-independee positive rate of OOD data when the true positive rate of ID data is at 95% (FPR95); and the
(Davis & Goadrich (006):: the false

---

Published as a conference paper at ICLR 2023
Table Comparison in OOD detection on the CIFAR and ImageNet benchmarks. (or indicates smaller (or larger) values are preferred; bold font indicates the best results in a column.
CIFAR-10
CIFAR-100 100
ImageNet
Methods
FPR95 +
AUROCT T
FPR95 + AUROCT
FPR95
AUROCT
Post-hoc Approaches
MSP
53.77
88.40
76.73
76.24
75.32
76.96
ODIN
42,80
88.69
63.25
75.72
77.43
71.04
Mahalanobis
34.98
93.21
65.57
78.03
86.50
58.78
Free Energy
37.77
88.27
71.56
78.51
71.14
79.50
ReAct
58.22
82.21
69.94
78.21
70.31
81.42
KNN
34.56
93.43
50.24
86.73
64.75
80.91
Fine- taee-tuning Approaches
OE
12.41
97.85
45.68
87.61
73.80
78.90
CSI
17.39
96.87
83.72
65.94
86.80
65.54
SSD+
14.84
97.36
56.65
87.38
64.55
77.46
MixOE
13.55
97.59
52.04
86.46
74.36
77.28
VOS
31.55
91.56
73.43
79.98
87.87
61.36
DOE
5.15
98.78
25.38
93.97
59.83
83.54
under the receiver operating characteristic curve (AUROC), which can be viewed the probability of the ID case having greater score than that of the OOD case.
Pre-training Setups. For the CIFAR benchmarks, we employ the WRN-40-2 (Zaoruyko & Ko- modakis 2016) as the backbone model following (Liu et al. (020). The models have been trained for 200 epochs via empirical risk minimization, with a batch size 64, momentum 0.9, and initial learning rate 0.1. The learning rate is divided by 10 after 100 and 150 epochs. For the ImageNet, we employ ResNet-50 (He et al. 2016) with well-trained parameters downloaded from the Py Torch repository following (Sun al. 2021).
DOE Setups. Hapar-parameters are chosen based on the OOD detection performance on validation datasets, which are separated from ID and surrogate OOD data. For the CIFAR benchmarks, DOE run for 10 epochs with an initial learning rate of 0.01 and the cosine decay (Loshchilov & Hutter 2017). The batch size is 128 for ID cases and 256 for OOD cases. The number of warm-up epochs is set to 5. is and 8 is 0.6. For the ImageNet dataset, DOE is run for epochs with an initial learning of 0.0001 and cosine decay. The batch sizes 64 for both ID and surrogate OOD cases. The number of warm-up epochs is 2. A 1 and 9 is 0.1. For both the CIFAR and the ImageNet benchmarks, is uniformly sampled from {le le 1e 1e 4] in each training step, which allows covering a wider range of OOD situations than assigning fixed values. Furthermore, the perturbation step is fixed be
Surrogate OOD datasets. For the CIFAR benchmarks, we adopt the ImnylmageNet dataset (Le & Yang 2015) as the surrogate OOD dataset for training. the ImageNet dataset, we employ ImageNet-221 K-P dataset (Ridnik et al.) 2021), which makes invalid classes cleansing and image resizing compared with the original ImageNet-21K (Deng et 2009).
5.1 COMMON OOD DETECTION
We begin with our main experiments on the CIFAR and ImageNet benchmarks. Model perfor-
mance is tested on several common OOD datasets widely adopted in the literature (Sun al.
2022
For the CIFAR cases, we employed Texture (Cimpoi
al. 2014), SVHN (Netzer al. 201
Places365 (Zhou et al. 2018), LSUN-Crop Yuu et al. (2015), and iSUN (Xu et al. 2015); for the Im- ageNet case, we employed iNaturalist (Hom et al. 2018). SUN (Xu et al. 2015). Places365 (Zhou
al. 2018), and Texture (Cimpoi et al. 2014). In Table report the average performance (i.e.,
FPR95 and AUROC) regarding the OOD datasets mentioned above. Please refer to Tables and in Appendix for the detailed results.
CIFAR Benchmarks. Overall, the fine-tuning methods can lead to effective OOD detection that they (e.g., OE and DOE) generally demonstrate better results than most of the post-hoc approaches

---

Published as a conference paper at ICLR 2023
Table 2: Comparison of DOE and advanced methods hard OOD detection. (or indicates
smaller (or larger) values are preferred; bold font indicates the best results in a column.
LSUN-Fix
ImageNet ImageNet-Resinn Resize
CIFAR- 100
Methods
FPR95 4
AUROC1
FPR95 + AUROCT
FPR95 +
AUROCT 1
KNN
25.76
95.00
40.65
86.30
64.50
86.32
OF
10.45
98.33
14.95
97.78
53.55
90.40
CSI
34.85
91.72
33.30
90.50
45.64
87.64
SSD+
23.95
95.74
53.52
84.00
46.87
90.50
DOE
3.00
99.15
7.20
98.55
41.55
91.85
(e.g.. Mahalanobis and KNN). Furthermore, compared with the OE-based methods (i.e., OE and MixOE), other fine-tuning methods only show comparable, even inferior, performance in OOD de- tection. Therefore, the OF-based methods that utilize surrogate OOD remain hard to beat among state-of-the-art methods, even with its inherent OOD distribution gap issue.
Further, the DOE's improvement in OOD detection is notable compared to OE and MixOE, with 7.26 and 8.40 better results on the CIFAR-10 dataset, and with 20.30 and 26.66 better results on the CIFAR-100 dataset. Note that the Line-mmaeNNet dataset is adopted as the surrogate OOD data, which largely different from the considered test OOD datasets. Thus, we emphasize that the improvement of our method is due to our novel distributional-rouue learning scheme. mitigating the OOD distribution gap between the surrogate and the unseen OOD cases.
We emphasize that the improvement of our DOE compared with that of OE is not dominated by our specific choice of scoring strategy. To verify this, we con- duct experiments with OE and DOE and
1.0
SVHN
Densily
0.2
CIFAR
Density
then employ the MaxLogit scoring after model training. Figure illustrates the scoring densities with (a) OE and (b) DOE on the CIFAR-100 dataset, where sider two test-time OOD datasets, namely, Texture and S SVHN. Compared with that of OE, the overlap regions of DOE between the ID (i.e., CIFAR-10) and the OOD (i.e.. Texture and SVHN) distributions are re- duced. reveals that even with the same scoring function (i.c., MaxLogit), DOE can still improve the model's detection capability compared with the original OE. Therefore, we state that the key reason for our improved performance is our novel learning strategy, learning from extra OOD data that can benefit the model. Please refer to Appendix C for their detailed comparison.
0.1
0.0
0.0
10 MaxLogit
20
30
10
20
30
MaxLogit
(a) OE
(b) DOE
Figure 2: The scoring densities of OE and DOE CIFAR-100 dataset, where the MaxLogit is employed.
ImageNet Benchmark. Huang & Li (2021) show that many advanced methods developed on the CIFAR benchmarks can hardly work for the ImageNet dataset due to its large semantic space with about 1 classes. Therefore, Table [ also compares the results of DOE with advanced methods ImageNet. As we can see, similar to the cases with CIFAR benchmarks, the fine-tuning approaches generally reveal superior results compared with the post-hoc approaches, and DOE remains effective in showing the best detection performance in expectation. Overall, Table demoosttrats the effec- tiveness of DOE across widely adopted experimental settings, revealing the power of our implicit data search scheme and distributional robust learning scheme.
5.2 HARD OOD DETECTION
Besides the above test OOD datasets, we also consider hard OOD scenarios (Tack al. 2020), of which the test OOD data are very similar to that the ID cases in style. Following the common setup (Sun et al. 2022) with the CIFAR-10 dataset being the ID case, evaluate our DOE three hard OOD datasets, namely, LSUN-Fix Yuu et al., 2013), ImageNet-Resize (Deng et al. 2009), and CIFAR-100 Note that data in Rmageeet-Ressze (1000 classes) with the semantic space
8

---

Published as a conference paper at ICLR 2023
Effectiveness of implicit data transformation and distributional robust learning. & (or 1) indicates smaller (or larger) values are preferred; a bold font indicates the best results in a row.
Table 3:
Implicit Data Transformation
Distributional Robust Learning
DOE
OE
All-ones
Gaussian
Uniform
x
WD
AT
FPR95 J AUROC
38.30
32.78
32.50
46.93 89.17
42.85
45.24 90.45
25,38 93.97
45.68
92.67
91.25
91.55
90.51
87.61
tiny- Imy-emmeeNet (200 classes) are removed. We compare our DOE with several works reported to perform well in hard OOD detection, including KNN, OE, CSI, and SSD+, where the results are summarized in Table 2 As we can see, our DOE can beat these advanced methods across all the considered datasets, even for the challenging CIFAR-10 versus CIFAR-100 setting. To some extent, it may indicate that our implicit data synthesis can even cover some hard OOD cases, and thus our DOE can lead improved performance in hard OOD detection.
5.3 ABLATION STUDY
Our proposal claims two key contributions. The first one is the implicit data transformation via model perturbation, and the second one is the distributional robust learning scheme regarding WOR. Here, we design a series of experiments to demonstrate their respective power.
Implicit Data Transformation. In Section data transformation. Here, we verify that other realizations (besides searching for WOR) can also benefit the model with additional OOD data. We employ perturbation with fixed values of ones (all- ones) and two types of random noise, namely, Gaussian noise with O mean and I covariance matrix (Gaussian) and uniform noise over the interval [-1, 1] (Uniform) (cf., Appendix B We summarize their results on CIFAR-100 in Table 3 (Implicit Data Transformation), Compared to MSP and OE without model perturbation, all the forms of perturbation can lead to improved detection, indicating that our implicit data transformation is general to benefit the model with additional OOD data.
demonstrate that model perturbation can lead to
Distributional Robust Learning. In Section 4 we employ the implicit data transformation for uniform performance in OOD detection. As mentioned in Section I DRO (Rahimian & Mehrotra, 2019) also focuses on distributional robustness. Here, we conduct experiments with two realizations of DRO, with x² divergence (x²) (Hashimoto et al., 2018) and Wasserstein distance (WD) (woon jet al. 2020) (cf., Appendix B). We also consider the adversarial training (AT) (Madry al. 2018b) as baseline method, which can also be interpreted from the lens of DRO.
We summarize the related experiments on CIFAR-100 in Table 3 (Distributiona Robust Learning). For two traditional BRO-based methods (i.e., x2 and WD), they mainly consider the cases where the support of the test OOD data is a subset of the surrogate case, This close-world setup fails in OOD detection, and thus they reveal unsatisfactory results. Though AT also makes data transformation, its transformation is limited to additive noise, which can hardly cover the diversity of unseen data. In contrast, our DOE can search for complex transform functions that exploit unseen, having large improvements compared to all other robust learning methods.
6 CONCLUSION
Our proposal makes two key contributions. The first is the implicit data transformation for OOD synthesis, based on our novel insight that model perturbation leads to data transformation. Synthetic data follow a diverse distribution compared original ones, rendering the target model to learn from unseen data. The second contribution is distributional-robur learning method, building upon min-max optimization scheme in searching for the worst regret. We demonstrate that learning from the worst regret in OOD detection can demonstrate better results than the risk-based counterpart. Accordingly, we propose DOE to mitigate the OOD distribution gap issue inherent in OE-based methods, where the extensive experiments verify our effectiveness. Our two contributions may not be limited to the OOD detection field. We will explore their usage scenarios in other areas, such as OOD generalization, adversarial training, and distributionally robust optimization.

---

Published as a conference paper at ICLR 2023
7 ACKNOWLEDGMENTS
QZW and BH were supported by NSFC Young Scientists Fund No. 62006202, Guangdong Basic and Applied Basic Research Foundation No. 2022A151501 1652, RGC Early Career Scheme No. 22200720, RGC Research Matching Grant Scheme No. RMGS20221 102, No. RMGS20221306 and No. RMGS20221309 BH was also supported by CAAl-Huawei MindSpore Open Fund and HKBU CSD Departmental Incentive Grant. TLL was partially supported by Australian Research Council Projects IC- (C-190100031, S.P-2201005222 DP-220102121, and F1-220100318.
8 ETHIC STATEMENT
This paper does not raise any ethical concerns. This study does not involve any human subjects, practices to data releases, potentially harmful insights, methodologies and applications, poten- tial conflicts of interest and sponsorship, bbscriiination/bia/faiinaa concerns, privacy and security issues, legal compliance, and research integrity issues.
REPRODUCIBILITY STATEMENT
The experimental setups for training and evaluation as well as the super-parameters are described in detail in Section[5] and the experiments all conducted using public datasets. The code is publicly available at: guthubbommgizttovvaa///e
REFERENCES
Alckh Agarwal and Tong Zhang. Minimax regret optimization for robust machine learning under distribution shift. In COLT, 2022.
Martin Arjovsky, Léon Bottou, Ishaan Guirajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint 1rXiv:190.002899 2019.
Raman Arora, Amitabh Basu, Poorya Mianjy, and Anirbit Mukherjee. Understanding deep neural networks with rectified linear units. In ICLR, 2018.
Abhijit Bendale and Terrance E. Boult. Towards open set deep networks. In 2VPR,0016.
2016.
Julian Bitterwolf, Alexander Meinke, Maximilian Augustin, and Matthias Hein. Breaking down out-of-dine out-of-distribution detection: Many methods based on OOD training data estimate a combination of the same core quantities. ICML., 2022.
Saikiran Bulusu, Bhavya Kailkhura, Bo Li, P Varshney, and Dawn Song. Anomalous instance detection deep learning: A survey. Technical report, Lawrence Livermore National Lab., 2020.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. ATOM: robustifying out-of-
distribution detection using outlerr mining. In ECML, 2021.
Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. De- scribing textures in the wild. In CVPR, 2014.
Jesse Davis and Mark Goadrich. The relationship between precision-recall and ROC curves. In ICML, 2006.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
Jiahua Dong, Yang Cong, Gan Sun, Bineng Zhong, and Xiaowei Xu. What can be transferred: Unsupervised domain adaptation for endoscopic lesions segmentation. In CVPR, 2020.
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. VOS: learning what you don't know by virtual outlier synthesis. In ICLR, 2022.
10

---

Published as a conference paper at ICLR 2023
Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is out-of-distribution detection learnable? In NewrIPS, 2022.
Tatsunori Hashimoto, Megha Srivastava, Hongseok Namkoong, and Percy Liang. Fairness without demographics in repeated loss minimization. In ICML, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, 2016.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and -ittof--ditrrbutiin examples in neural networks. In ICLR, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019.
Dan Hendrycks, Steven Basart, Mantas Mazeika, Andy Zou, Joseph Kwon, Mohammadreza Mosta- jabi, Jacob Steinhardt, and Dawn Song. Scaling out-of--ditribution detection for real-world set- tings. In ICML, 2022.
Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alexander Shepard, Hartwig Adam, Pietro Perona, and Serge J. Belongie. The inaturalist species classification and detection dataset. In CVPR, 2018.
Rui Huang and Yixuan Li. MOS: towards scaling out-of-distribution detection for large semantic space. In CVPR, 2021.
Zhuo Huang, Xiaobo Xia, Li Shen, Bo Han, Mingming Gong, Chen Gong, and Tongliang Liu. Harnessing -aitof-distribution examples via augmenting content and style. In ICLR, 2023.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Tech- nical Report TR- 2009, University of Toronto, 2009.
David Krueger, Ethan Caballero, Ceer--Henrik Jacobsen, Amy Zhang, Jonathan Binas, Dinghuai Zhang, Remi Le Priol, and Aaron Courville. Out-of-distribatioo generalization via risk extrapo- lation. In ICML, 2021.
Yongchan Kwon, Wonyoung Kim, Joong-Ho Won, and Myunghee Cho Paik. Principled learning method for wasserstein distributionally robust optimization with local perturbations. In ICML, 2020.
Ya and Xuan Yang. Tiny imagenet visual recognition challenge. CS 23/N, 7(7):3, 2015.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-caiibrated classifiers for detecting out-of-distributiio samples. In ICLR, 2018a.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibratee classifiers for detecting out-of cattoo-diisributtio samples. In ICLR, 2018b.
Kimin Lee, Kihok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurlPS, 2018c.
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In ICLR, 2018.
Weitang Liu, Xiaoyun Wang, John D Owens, and Yixuan Li. Energy-based out-of-distribution detection. In NeurIPS, 2020.
Ilya Loshchilov and Frank Hutter. SGDR: stochastic gradient descent with warm restarts. ICLR, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018a.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018b.

---

Published as a conference paper at ICLR 2023
Yifei Ming, Ying Fan, and Yixuan Li. POEM: out-of-distribution detection with posterior sampling. In ICML,, 2022.
Sina Mohseni, Mandar Pitale, J. B. S. Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. In AAAI, 2020.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Read- ing digits in natural images with unsupervised feature learning. In NeurIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confi- dence predictions for unrecognizable images. In CVPR, 2015.
Henning Petzka, Michael Kamp, Linara Adilova, Cristian Sminchisescu, and Mario Boley. Relative flatness and generalization. In NeurIPS, 2021.
Hamed Rahimian and Sanjay Mehrotra. Distributionally robust optimization: A review. arXiv 2019.
preprint
Tal Ridnik, Emanuel Ben Baruch, Asaf Noy, and Lihi Zelnik. Imagenet-21k pretraining for the masses. In NeurlPS Datasets and Benchmarks, 2021.
Shiori Sagawa, Pang Wei Koh, Tatsunori B Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generaliza- tion. In ICLR, 2020.
Mohammadreza Salehi, Hossein Mirzaei, Dan Hendrycks, Yixuan Li, Mohammad Hossein Ro- hban, and Mohammad Sabokrou. unified survey on anomaly, novelty, open-set, and out-of- distribution detection: Solutions and future challenges. arXiv preprint arXiv:2110.14057, 2021.
Vikash Sehwag, Mung Chiang, and Prateek Mittal. SSD: A unified framework for self-supervised outlier detection. In ICLR, 2021.
Aman Sinha, Hongseok Namkoong, and John C. Duchi. Certifying some distributional robustness with principled adversarial training. In ICLR, 2018.
Yiyou Sun, Chuan Guo, and Yixuan Li. React: out-of-distribution detection with rectified activa- tions. In NeurlPS, 2021.
Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distributioo detection with deep nearest neighbors. In ICML, 2022.
Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. CSI: novelty detection via contrastive learning distributionally shifted instances. In NeurIPS, 2020.
Qizhou Wang, Feng Liu, Yonggang Zhang, Jing Zhang, Chen Gong, Tongliang Liu, and Bo Han. Watermarking for disti--iittiitttion detection. In NeurlPS, 2022.
Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and Jianxiong Xiao. Turkergaze: crowdsourcing saliency with webcam based eye tracking. arXiv preprint 1504:::500.005555 20155
Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: survey, arXiv preprint arXiv:21 10. 10.34 2021.
Fisher Yu, Ari Seff. Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: /506 03366, 2015.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016.
Jingyang Zhang, Nathan Inkawhich, Randolph Linderman, Yiran Chen, and Hai Li. Mixture outlier exposure: Towards dittof--istribution detection in fine-grained environments. In WACV, 2023.
Bolei Zhou, Ágata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: 10 mil- lion image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, (066)1452-144 2018.
12

---

Published as a conference paper at ICLR 2023
A
PROOFS
This section provides the detailed proofs for our theoretical claims in the main text.
A.1 PROOF OF PROPOSITION
Proof. To make the derivation clear, we adopt the equivalent form for our recursive definition of the model in equation 3 following:
A ( (w(l)( h 1=++)(2(1)) w()).
(11)
Then, by multiplicatively perturbing the 1-th layer of the model, we have
h(+1)) (2 + aA4l)) -max (w"I( +aa4)))))))))) x0.0
-max (w()) (1+ 0}
(12)
=h++ (2+
Therefore, measuring in feature space 200, multiplicative perturbation modifies the original features (0)) by an affine transformation I + aA Assuming that the original data are i.i.d drawn from the distribution with the probability density function (pdf) fz (2()), then the transformed data are i..d. drawn from the distribution with the pdf (z(()(2()) = fzw (z() I aA"'
Using the KL-divergence measure the discrepancy between the original feature distribution and the transformed feature distribution, we have
Dz((fz)llfzz)) = 120 (z)1) (x))) log fx0 (2)) fz:0 (z(1i) log + aA
(13)
Without loss of generality, we assume K different eigenvalues for the matrix A0) Then, by the Jordan matrix decomposition, we can write A (()) Therein, J() is of the form:
(((1)
J(x2)
(14)
J(Xa)
(AR))
and J(Ax) is the k-th Jordan block (of size ny x n&) corresponding the k-th eigenvalue of the matrix A0) Then, have T a400) 1 + (()((
[ + JJ Since 70) is an upper triangular matrix, we can write / a00 = II (adx + 1) Accordingly, the eigenvalues of the matrix A0)) are all greater than 0 and 0, we have / aA()) > 1 and Dzı(Jza) ()))))))))) > 0. Therefore, the distributions fz and Jz are different regarding the KL divergence. Thus we complete our proof.
A.2 PROOF OF THEOREM T
Proof. We consider induction proof, justifying that: the multiplicative perturbation with A Re xn: of any layer in/ = 1,.... can be transformed into an equivalent multiplicative perturbation with A0-1) E 1 xm4-1 in the (1 1)-th layer. Moreover, [A([-1)] > 0 if [AAo] > 0. Then, one transform the multiplicative perturbation of the model Since the determinant the equivalent perturbation is greater than 0, by applying Proposition [ we conclude that multiplicative perturbation can lead data transformation the original input space.
equivalent form in the input space.
To find the equivalent perturbation matrix 1(-1) in the (1 - 1)-th layer regarding the original one A00 in the 1-th layer, we solve the following equation:
(t (T + A (W(L-)) w (((()))) (()())))
(15)
13

---

Published as a conference paper at ICLR 2023
If [2(1-1),, * in each dimension, equation 15 can be rewritten as
h (W((-1)) h (Wil-1) ( (1-1)))
(16)
by applying the Taylor Theorem for the right-hand side Then, since the ReLU activation is applied, we solve the equivalent formulation for equation [6] following,
((((1) = (111)) ((--))=-1 A0-1)
(17)
Then, the solution of Al-1)) is W(-1), w((11) with being the Moore-Penrose inverse.
We justify that the multiplicative perturbation the 1-th layer can transformed to that of the
(1 1) layer. Therefore, the equivalent perturbation All-1) and the original perturbation in the (1 1) layer can formulate a joint perturbation A namely, + (1-(1-1), with ((-1))
A = 11l + ((-1)) a1-11 Aa-1)
(18)
Now, we justify that 10-1) can also lead to distributional transformation. If ((11)), = ((I1),,- (Here, we implicitly assume that 74-1 n2-2) and the eigenvalues of the matrix A are all greater than O, then we know that the eigenvalues of the matrix A are all greater than 0. Again, we have T + a ( > 1. Then, the joint perturbation A satisfies:
I + +
(I a aA
+ aA aA
(19)
+ (1-
1 + (1111
(20)
> 1 (a-
(21)
>.
(22)
By induction, the multiplicative perturbation of the model can be approximated by the input trans- formation. By applying Proposition [ we know that x and the perturbation-based transformed counterpart follow the different data distributions. Thus complete our proof.
A.3 PROOF OF LEMMA 1
Proof. For the L + 1-layer ReLU network, we assume its model parameters and the model pertur- bation are the same as that of the corresponding layers for the T--layer ReLU network (except for the
I. 1-th layer). Then, by inspecting equation 20 the perturbation from the L. 1-th layer can make the perturbation matrices for the L + 1-layer network no smaller than that of the L-layer network regarding each layer (including the input space) of the joint multiplicative perturbation. Thus, we complete our proof.
A.4 EXCESS RISK BOUND
We further derive the learning bound of DOE. Here, we make the standard assumptions for our learning problem. First, we assume that the Rademacher Complexity (H) of H. is bounded, i.e. there is a Cn such that (H) < Cn/Vin holding for ReLU models. Further, the CE loss bounded by Ace and Les Lipschitz continuous; the OE loss is bounded by AoE and is LoE Lipschitz continuous. To ease notation, we also define
log 1/5
L.C, 2CL AA
(23)
2
We are now ready to state the upper bound for the worst-case population performance of our DOE. Theorem 2. Given ID and surrogate OOD training sample Sin and Soon. we write the optimal solution hiy arg minkwwg Looe(hw; DID, Doon) and the empirical counterpart as hw arg minkwen Looe(hwi SwD, Soon). Then, under above assumptions, w.p. at least 8, we have
LooE DID Dooo) S LooE(hi (Dy: DiooDo
+ + (A)E(CH, A)/ / ming (Sool]
(24)
where L = max Lees Los} and = max{AcE: AoE).
With the usual adjustments that the equations only hold almost everywhere in parameter space.
14

---

Published as a conference paper at ICLR 2023
Proof. We apply the Rademacher Bound for Lee and Cos, given that w.p. at least have
(Kwe(hw; DrD) - LCB (hw: SiD) S e(CH, LEE, ACF) (SiD
(25)
[oee(w: DOOD) Loe (Aw: SOoD) z <Cr,, LOE, AoE) / VSoool
(26)
for all lww E H. When the hypothesis space H. is large enough, we have
kww = arg min (h: DID) = arg min max. Regretor (hw Doon). (27)
lw kW
bWEH P.IIPISP
Accordingly, by the definition of (eR(Hiy; Dm)), for any > 0, there exists liw such that CcE(hW; DID) s Cce(hw: DTD) + Thus, using LcE(hw; SID) - LCE(ltw; SID), we can write
Caehww; DID) LcE(hwi DID)
-ce((ww; DID) Lc STD) + (en(lii:T)) LCE(hW: DTD)
(28)
SCor(ww; Dm) - Ler(hir; Sin) +
(29)
=Cee(ww; DID) Cce(hw: SiD) + Lce(hw; Sw) Lce(hWi DID) +
(30)
<Cee(wwi DID) - (hw(hwi SID) + Cce(hiv:Su SID) - LCE(hfw DID) +
(31)
2 sup (h: DID) (h; SID) +c.
(32)
keHt
Since equation 25 holds for hw H. and
have
(cr(ww; Dm) S Lcr(hw; Dm)) + 2e(CH, LeE, ACE)/ htll///s. (Sm).
(33)
For any hw E H. also have
Regret a.P a.P (hw; DooD)
sup PiI
2c(Cu, Loe, AOE)
sup PII
Ca SOOD) min Loe CoE(hw- SooD)
(34)
W
v V/SOOD|
2c (CH, LoE, AOE)
sup Pill
Coe(fwwaPe SOOD)
min Lor SOOD)
+
(35)
W
V1SOod|
+ 2e 2e(Cn,, LOB AOE)
sup P:IPPISPP
min Lor(hw= SOOD) (ow(h SoOD)
(36)
W
VISoodl
+ 4e 4e(CH, LOF, AOE)
sup P:IIP|ISP
Coe(hw+aPe DOOD) min Los (hw++ DOOD)
(37)
v /Soool
< sup P:I|PIISP Regret a.P (hw; DooD) + 4e(CH, LOE, AOE)
(38)
V|SOOD!
indicating that
4c(CH, Lor, AOE)
sup Regretor a.P (fw: Doon) PiIlPIISP
<
sup
a.P Regret (hw; DooD)
P:l PiISP
Sooool
(39)
Combining equation 33 and equation
39 we complete our proof.
The theorem states that the empirical solution leads to a promising detection capability in expec- tation, which considers the uniform OOD performance via the WOR. The critical point is that the original surrogate OOD is still very important (i.e., the small sample size of SooD leads to loose excess bound), even if our method can synthesize additional OOD data.
15

---

Published as a conference paper at ICLR 2023
Algorithm 1 Distribution-agnossic Outlier Exposure (DOE).
Input: ID and OOD samples from DID and DOOD resp:
PMA = 0:
for ns num_step do
Sample BID and BooD from ID and surrogate OOD, resp;
P 0;
if ns num warm then for nр = to numppert do
WORo BooD) ooo +ap; BooD) P VrWORG(hW BooD);
end for
PMA (1 B) PMA + 3 NORM(P):
W + W - -r- Vw [Cee(hw; BID) + ACos (aw+ Boon]];
else
W + W - 1r- Vw (her(hw; BD)) + ACon Boo
end if end for Output: detection model hw)-).
B ALGORITHM DESIGNS
We summarize details of algorithm designs for a set related learning schemes.
B. DISTRIBUTIONAL ROBUSTNESS AND DISTRIBUTION GAP
Overall, to demonstrate why our distributiinal-robustt learning scheme can mitigate the OOD distri- bution gap, consider the following situations: (1) the true OOD distribution contains all the different OOD situations; and (2) the capacity of implicit data transformation is large enough.
For the first situation, we assume that the true OOD distribution contains all the different OOD situ- ations, i.e., all samples with labels out of the considered label space. It is a reasonable consideration since we do not know what kinds of OOD data will be encountered during the test, and thus all the different OOD situations can be encountered. In this case, the surrogate and the (associated) implicit OOD data are subsets of the true OOD distribution since they not have overlapped semanties with the ID) distribution. Then, compared with OE that learns only from surrogate OOD data, our DOE can further benefit from implicit OOD data. It can enlarge the coverage of OOD situations since implicit data follows new data distributions over the surrogate OOD distribution (ef., Theorem D}.
For the second situation, we assume that the capacity implicit data transformation is large enough to cover sufficiently many OOD cases. This is also reasonable assumption since the transforma- tion's 's capacity can benefit from layer-wise architectures (cf., Lemma [. and deep models (which contain many layers) typically adopted in OOD detection. Accordingly. although know precisely what is the true OOD distribution, we can upper-bound the worst OOD performance guarantee uniform performance of the model under various test situations (cf., Theorem (2) When the capacity is large enough (covering many test OOD situations), DOE performs well under these unseen test OOD data, thus mitigating the OOD distribution gap.
do not
B.2 DOE
Algorithm [ summarizes a stochastic realization of our DOE. The overall algorithm run for num_step steps, with num_warm epochs of warm-up in employing the original OE. Then, in each training step, we first calculate the perturbation P regarding the OOD mini-batch for num-pert steps, and the normalized results used to update the moving average PMA- With the resultant perturbation PMA for the OE loss, we update the model via one step of mini-batch gradient descent. After training, apply the MaxLogit scoring in discerning IDD and OOD cases.
16

---

Published as a conference paper at ICLR 2023
B.3 WORST BASED DOE
Our proposed DOE searches for the model perturbation that leads to WOR, which is the worst regret- based realization. In our main text, we state its superior the risk-based counterpart in Section 4 with the experimental verification in Section 5.3 For integrity, we further describe the realization of the worst risk-based DOE, named DOE-risk.
Similar to our proposed DOE, DOE-risk can also be formalized by a min-max learning problem:
(ho: Dw, Poon) Leu(hw: Dw) +
max Lou +aP++ Doo) P:I IS1
(40)
Then, for its stochastic realization, one step gradient ascent employed for the perturbation with respect to the mini-batch, namely,
P P- All other parts follow the realization of the original DOE, After training, we also employ the MaxLogit scoring discerning ID and OOD data.
BoOD).
(41)
B.4 IMPROVED OE WITH PREDEFINED PERTURBATION
We consider several implicit data transformations with the predefined perturbations in Section 5.3 Here, we briefly summarize their realizations.
All-ones Matrices. For the perturbation matrices with fixed values, we employ the simple all-ones
matrices, namely, Pons { } with 7()) E 1 for = 1,..., being the all-ones
matrix. Then, the associated learning objective can be written as:
Lo (hw: DID. DooD) = LeE(hw; Dι)) + ACon(hw+aPuu DoOD)-
(42)
Gaussian Noise. When adopting Gaussian noise for random perturbation, we have Pgau (N with the elements drawn from Gaussian distribution with 0 mean and 1 standard de- viation. Then, the associated learning objective is of the form
gar DID DOOD) = Ccr(hw; Dw) + XCor DooD).
(43)
adopt uniform noise for random perturbation, which we denote by Puni (/ The elements of (+) drawn from the uniform noise over the interval
Uniform Noise. Similarly,
[-1, 1]. Then, the associated learning objective is
Lo (hw; DID DooD) Lcr(hw; Dw) + ACon(hW DOOD).
(44)
B.5 DRO
The distirbutionally robust optimization (DRO) (Rahimian & Mehrotra 2019) a traditional tech- nique to make the model perform uniformly well. In OE, one utilize DRO by replacing the original OE risk in equation 2 with its distributional robust counterpart, namely,
DRR (l:; Dw, DooD) LcR(h; DID) A sup Diao (ooo)
Lor(h; DOOD),
(45)
O (); Poop)
where U4 ((DD) is the ambiguity set. Basically, u( ((Don)) constrains the difference between the surrogate OOD distribution DOOD and its worst counterpart Doop- In expectation, equation 45 makes the training procedure cover a wide range potential test OOD distributions in (((D) guaranteeing its uniform performance by bounding the worst OOD risk derived by D
The ambiguity set u(D)oo) is defined by {D* (D* < p} with Divy(-) the f-
divergence and p the constraint. For the worst OOD distribution that leads to the worst OOD risk, a weighting- based searching scheme can be derived for the empirical counterpart of equation 45 following the form of re-weighted empirical risk, namely,
sup Σ plon(M(x)) s.t. p E (pl poppe E A and Dj (p||1) S p).
(46)
17

---

Published as a conference paper at ICLR 2023
However, due to this equivalent re- we-igittinng scheme, DRO actually assumes that the support of test- time OOD data is among that of the training situation. This assumption is violated in OOD detection since the surrogate OOD data can be largely different from the unseen situations, i.c. their support sets can be greatly different. Therefore, traditional DRO cannot lead to much improved results compared with original OE, which we demonstrate by the experimental results in Section [.3 Note that some DRO methods (Krueger et al. (202]) try to search for worst distributions that go beyond the support of training data. However, they rely on more than one training domain, which is not directly applicable in OOD detection.
-dviivegeeece DRO. Hashimoto al. (2018) define the ambiguity set by the x2 divergence, given dP
by Dx²(P112 = 5 form of the sub uub-populations, i.c., DOOD EkE(K] ag Then, can derive the dual form of the C (h; DOOD) in equation 46 with respect to the x² divergence, namely,
-
dQ. They assume that data distribution can be written as the joint
inf (2(1/amin 1)² + 1)1/2 WER
(EDgco max (foe(h(x)) -, mn, ) =
(47)
where Omin = ming ag.. Then, Hashimoto et al. suggest that for deep models that rely on stochastic gradient descent, can utilize the dual objective in equation 47, leading to the learning objective of the form:
C (h; DID, DoOD) = Lce(h; DI)) AIE Doo
max (foE(H(z)) 77, 0]3]
(48)
where 7) is treated as a hyperparameter. Overall, equation 48 ignores all data points that suffer less than lellelss of loss values, while large loss above 1) are upweighted due to the square operation.
Wasserstein DRO. The ambiguity set with the Wasserstein distance has also attracted much atten- tion in the literature. Specifically, Wasserstein distance is given by
W.(PQQ) ( inf U (ils--iird ((r/0)):)))) 1/-
(49)
(EE((..)
However, the direct calculation for the Wasserstein DRO is intractable, and Kwon et al. (2020) propose a simple learning method that leads to its effective approximation. Specifically, if the loss function differentiable and its gradient Holder continuous, one can optimize the following
surrogate objective as an effective approximation for the optimal solution of Wasserstein DRO:
CWDRO DID, DooD) (ce(h; DID) + x (Coe(h; DOOD) + E (o (50)
Please refer to (woon et al. 2020 for an in in-tepth discussion.
B.6 AT
Adversarial training (AT) Madry et al. 20 8a) directly modifies input features that lead to increased risk, which can also be interpreted from the lens of distributional robust learning (Sinha al. 2018). For OE, one can modify features for surrogate OOD data by adding adversarial noise, namely,
6p + Proj 55 + KS ssign (V&, (on( + 6,)))].
(51)
where x controls the magnitude of the perturbation, Pro j is the clipping operation for the valid 6p- and si sign is the signum function. Equation iterates for several steps and op is typically initialized by random noise.
Applying the adversarial noise for surrogate OOD data, the resultant learning objective is
C^T(h; DID, DooD) = LeF (h; Dm) + XE [fon(h(x 6p))
(52)
AT can be viewed as direct way of data transformation. However, as demonstrated in Section 5.3 the associated transformation function is simpler than our DOE, Therefore, the performance of AT inferior to our DOE.
18

---

Published as a conference paper at ICLR 2023
Table Comparison of DOE and advanced methods on CIFAR-10 dataset. (or indicates smaller (or larger) values are preferred; shaded row of results indicate the best method in previous post-hoc fine- -unnnui methods; and bold font indicates the best result in a column.
Mehhd
TPR55 AUROC
SVIN
TPR35
LSUN
AUROC
IPR35
ISUN
AUROC
TPRSS
Tesure
AUROC
TPR55
Place3365
AUROC
TPR35
Averuge
AUROC
ID ACC
Post-los: Approeec
MSP
65.60
81.23
23.05
96.74
56.55
89.50
61.45
87.47
62.20
86.95
53.77
88.40
94.28
ODEN
55.30
93:65
8.55
98.45
36.35
92.66
54.00
84.34
59.20
84.33
42.80
88.69
94.28
Mahalanobis
8.35
98.00
45.15
92.50
37.15
11,80
97.92
71.45
83.65
31.95
93.21
94,28
Faery
tuning Approach
SSD+
35.96
95.28
98.34
25.00
97,36
95.46
Mix0C
22.35
99.68
7.55
96.65
96.75
96.68
13.55
97.59
96.79
VOS
35.20
93.65
85.05
88.09
Table 5: Comparison of DOE and advanced methods on the CIFAR- 100 dataset. & (or 1) indicates smaller (or larger) values preferred; shaded row of results indicate the best method in post-hoc (or fine-tur tuning) methods; and a bold font indicates the best results in the column.
Methed
SVIN
AUROC
TPR55
LSUN
AUROC
TPRS5
AUROC
TPRSS
Tequre
AURUC
1PR95
Place
AL
TPR95
AURUC
Post-box: Approssc
MSP
$0.50
75.19
51.25
87.93
85.35
73.45
83.40
71.94
82.75
72.05
76.73
76.24
73.98
ODEN
70.25
72.57
63.38
76.55
60.25
74.33
60.31
76.95
61.61
77.72
63.25
75.72
73.98
Mahalanobs
58.45
86.56
99.80
52.40
34.70
92.95
48.40
90.13
80.50
65.14
65.57
75.03
73.99
Free Energy
39.70
75.09
16.90
96.95
86.45
75.20
82:75
73.75
82.00
73.55
71.35
75.51
73.96
ReAct
79.10
81:25
8.50
98.45
92.55
64.78
85.30
75.55
85.25
72:47
69.94
78.21
73.98
KNN
49.25
35.06
31.96
93.11
37.11
91:85
48.30
87.95
84.15
71.95
50.24
85.24
73.98
Fine tuning Appmaach
C FURTHER EXPERIMENTS
This section provides further experiments to demonstrate the effectiveness of our proposal.
C.I CIFAR BENCHMARKS
We first summarize the main experiments in Table 4 on CIFAR benchmarks for the common OOD detection. A brief version also be found in Table i the main text. Overall, our DOE reveals superior performance on average regarding both the evaluation metrics of FPR95 and AUROC. However, when it comes to individual test-time OOD) datasets, situations (c.g., KNN on OOD dataset Places365 and ID dataset CIFAR- 100), We emphasize that it does not challenge the generality of our proposal since DOE has demonstrated stable improvements for the original OE Here, the interesting point is that if we can further benefit the OE from the latest progress in OOD scoring, one can further improve the performance of our method effective OOD detection, which requires our future study.
DOE may not work best in all
Now, we compare OE and DOE on CIFAR benchmarks with five individual trails in Table where we report the mean results and the standard deviation. As we can see, our DOE not only leads to improved average performance in OOD detection, and the results are more stable than that of the original OE The superiority of DOE in stability may lie in the fact that the target model can learn from more data than the OE case, further demonstrating the effectiveness of our proposal.
Also, we compare the performance of OE and DOE when using the MSP scoring and the MaxLogit scoring, of which the experiments are summarized Table 7 Regarding both the cases with differ- scoring functions, strating that our proposal can genuinely mitigate the OOD distribution gap issue in OOD detec- tion. Further, comparing the results across different scoring strategies, observe that using the
DOE always achieve superior performance than that of the OE, demon-
19

---

Published as a conference paper at ICLR 2023
Table 6: Comparison of DOE and OE on CIFAR benchmarks with individual trails. (or 1) indicates smaller (or larger) values are preferred; and bold font indicates the best results in the corresponding column.
SVHN
LSUN
iSUN
Texture
Places365
Method
FPR95 L AUROCT FPR95
AUROCT 1
FPR95
AUROCT
FPR95
AUROCT
FPR95 J
AUROCT
CIFAR-10
2.911
99.34
0.461L
99.8011
9.05.1
98.451
18.081
96,911
28,02.1
95.011
OE
0.60
0.08
0.13
0.03
1,56
0.20
0.88
0.11
0.68
0.08
2.66+t:
99.41=
0.15+
99.91=t
1.26
99,48-
7.40=
98.32-
15.42=
96.33-
DOE
0.01
0.01
0.01
0.04
0.27
0.02
0.03
CIFAR-100
55.48=
86.99=
12.28:
86,76
44,38-t
88.54+
47,57+t
86.93+
65.05:
80.83-
OE
1.46
0.99
0.95
0.19
2.75
1.42
0.21
1.27
0.23
28.47
95.45
5,27.1
98,51
22.28:1
96.36.1
40.00.1
91.3411
50.70
88.42
DOE
0.10
0.54
0.03
Table Comparison of DOE and OE on CIFAR and ImageNet benchmarks with the MSP scoring and the MaxLogit scoring. (or 1) indicates smaller (or larger) values are preferred: and a bold font indicates the best results in the corresponding column.
CIFAR-10
CIFAR 100
ImageNet
Method
MasLogit
MSF
MixLogii
MSP
MaxLaga
AUROC1
FPR95
AUROC
DE
11.07
97.98
12.41
97.35
35.95
92.42
45.68
83.61
71.25
79.18
73.30 68.20
78.90
DOR
5.15
98.78
738
98.46
25.38
93.97
30.50
92.75
99,83
K3.54
80.83
MaxLogit scoring leads to better results than using the MSP scoring. Therefore, we choose the MaxLogit scoring our DOE.
C.2 IMAGENET BENCHMARKS
Table lists the detailed experiments on the ImageNet benchmark. Overall, our DOE achieves superior performance average against all the considered baselines. Further, for the cases with iNaturalist and Places365, which are believed to be the challenging OOD datasets on the ImageNet situation, DOE also achieve considerable improvements against all other advanced methods. It demonstrates that our DOE can also work well for challenging detection scenarios with extremely large semantic space and complex data patterns.
C.3 TRAINING FROM SCRATCH WITH DOE
This section further considers the training setup of training from scratch, where mainly focus on the detection performance of OE and DOE CIFAR benchmarks. Specifically, the models are trained for 150 epochs for OE and DOE via stochastic gra- dient descent. We fix the learning rate to
Table 9: Comparison of OE and DOE when training from scratch CIFAR benchmarks.
CIFAR-10
CIFAR-100
from scratch
FPR95
AUROC
FPR95
AUROC
15.46
95.77
46.02
88.14
be 0.1, divided by 10 per 30 epochs. For DOE, the warmup epochs are set to be 90. All other hyperparameters follow the same setup in Section 5 We summarize the experimental results in Table As we can see, our DOE
DOE
5.85
98.52
26.47
93.16
can still improve OF by a large margin, revealing that our method general applying for the setup of training from scratch.
C.4 WORST OOD REGRET AND WORST OOD RISK
Another issue related to distributional robustness our definition of the OOD distribution. is defined by the OOD regret Los (h; D) inf Cor D), where we claim its superiority than its risk counterpart, i.e., Los(h; (h; D) (cf., Appendix B).
20

---

Published as a conference paper at ICLR 2023
Table Comparison DOE and advanced methods on ImageNet dataset. (or f) indicates smaller (or larger) values are preferred; a shaded row of results indicate the best method in post-hoc (or fine- tuning) methods; and bold font indicates the best results in the corresponding column.
Method
PPR05 AUROLT
Naturalia
FPRSS
SUN
AURECC
FPRUS 1 ROX.
Places65
FPR05
Texture
AUROL
PPRSS AUREX
Average
ACC
Post Appreach
MSP
72.96
77.22
74.24
76.89
17.51
70.15
78.55
15.32
76.96
74.55
ODIN
63.85
77.78
89-58
61.80
58,00
67:37
67.87
71.80
77.43
71.04
74.55
Mahulaashis
95.50
68.55
45.33
99.50
44.65
55.80
00.50
74.55
Eneny
77:50
77.33
tunting Appcoach
76.55
73.801
MixOC
80.51
74.30
7662
79.81
84.33
69.20
74.36
77.28
24.62
vas
94.83
$7.09
98.72
38.50
87.75
65.65
70.20
83.62
87.57
63.36
74.43
DOF
35.87
85.00
8033
76.26
67.84
X308
34.67
88.90
50.33
K355
75.00
Table 10 summarizes the results the CIFAR-I00
dataset in comparison between searching for the worst
Table 10: Roubst learning with worst
OOD regret (DOE-regret) and the worst OOD risk (DOE- risk). Therein, both realizations can improve results com- pared with the original OF However, the regret-based DOE reveal better results than the risk-based one, with 4.59 further improvement in FPR95, Here, the worst regret can better indicate the worst OOD distribution than the risk counterpart, and thus the DOE-regret, as employed in Algorithm results in To
OOD regret and worst OOD risk.
Methods
DOE-regret
DOE-risk
FPR95 J AUROCT
25.74 94.25
30.33
94.01
demonstrates superior
C.5 EFFECT OF HYPEE-PPRRMETTE
We study the effect of cryper-parameert on the final performance of our DOE, where we consider the trade-off parameter X, the perturbation strength a, the smoothing strength 3, the perturbation steps num-pert, and the warm-up epochs num_wa rm. We also study the case of sub-model perturbation, where the model perturbation only applied to a part of the whole model. All the above experiments conducted on the CIFAR- 100 dataset.
As one can see from the Tables II our DOE is pretty robust to different choices of the hyper- parameters (i.e., A, B, num.perrt and num_warm), and the results are superior to the OE across most of the duce improved results in effective OOD detection, reflecting that all the introduced typer-parameetes are useful in our proposed DOE. In Table [3] we further demonstrate that randomly selected a (from the candidates) reveals superior performance than assigning fixed values. Note that random selec- tion can cover a wider range of OOD situations than that fixed values. Then, since the model can learn from more implicit OOD data, the capability of the model OOD detection is better than the case with fixed values.
parameter settings. However, proper choice of the hyper-parameters can truly in-
Finally, we show the experimental results with sub-model perturbation in Table 16 where only a part of the model is perturbed in our DOE. Here, we separate the WRN-40-2 into 3 blocks, following the block structure (Zagoruyko Komodakis 2016). As we can see, perturbing the whole model can reveal superior performance than the cases with sub-model perturbation. It can be explained by our Lemma I in that perturbing the whole model can benefit the data transformation from the layer-wise structure of deep models most. Then, with the more flexible form of transform function, perturbing the whole model can reveal better results than the cases with sub-model perturbation since the model can learn from more diverse (implicit) OOD data.
21

---

Published as a conference paper at ICLR 2023
Table 11: DOE on
Table 12:
DOE on Table 13: DOE on
Table 14: DOE on
CIFAR-100 with vari-
CIFAR-100 with vari-
CIFAR-100 1-0 with vari-
CIFAR-100 with vari-
ous X.
ous B.
ous num pert.
ous num wa rm.
ALROC
FPR95
AUROC
FPR95
AUROC
AUROC
41.43
90.82
0.1
23.52
94.48
25.59
94,50
94.09
0.5
32.35
93.66
2
25.21
93.94
1.0
25
93.77
0.3
23.12
94,47
26.75
94,22
24.81
94.03
23,90
94.41
25.37
94.41
2,0
25.52
94.35
0.5
24.79
94.25
24.62
94.83
5
25.50
94.11
0.6
25.11
94.22
25.37
94.40
3,0
26.04
94.31
24.60
94.38
26.02
94.49
25
94.32
0.8
28.12
93.71
25.80
94,15
29.01
94.07
25.99 96
94.28
36.05
92.19
4,3
26.35
94.23
1.0
27.25
93.77
24.54
94.88
10
35.33
92.89
Table 15: DOE CIFAR-100 with various
Table 16: DOE on CIFAR-100 with sub-model perturbation.
candidate
AUROC
(le
$3.20
86.49
[le 2
27.29
94.04
Perturbed Block
FPR95
AUROC
[1e-a]
31.75
93.71
[1e-4]
Black
35.76
93,82
[le 1. 2)
36.14
91.21
Block 3
32.50
93.54
[le le
28.56
94.17
Block 1-2
27.29
94.06
[le le
34.35
93.49
Block 2-3
(le le 2
2 le
27.59
94.20
Block and Block
28.07
94,04
Whole
22


Reviews:
[{"review_id": "kH8-hUMGlfJ", "reviewer": "Reviewer_r8Mp", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The submission proposes a potential improvement over the popular and effective outlier exposure (OE) method of Hendrycks et al. (2019). While existing works have explored improving the diversity of surrogate outliers in the input space (by synthesizing artificial examples/applying MixUp/resampling) and in the feature space (by perturbing feature representations of surrogate outliers), the proposed method involves perturbing the weights of the neural network instead to generate features corresponding to a new synthesized data distribution of surrogate outliers. The perturbation at each iteration of training is computed by gradient ascent to maximize a gradient-norm penalty, inspired from Arjovsky et al. (2019). \n\nExperiments suggest that the proposed method outperforms other OE-based approaches.", "summary_of_the_review": "While the theoretical discussion involves significant departure from practical implementation (many assumptions that are going to be un-met in practice), and there is some lack of clarity about how fairly the method is empirically compared to baselines, the general idea is intuitive, well-executed, and appears to work well enough that my overall recommendation at this time is to Accept.", "strength_and_weaknesses": "The key idea in the submission, that of using parameter-perturbation to simulate data-perturbation in the context of outlier-synthesis, is novel (to my knowledge). The results indicate effectiveness and potential superiority over alternatives. The method seems well-designed and implemented overall.\n\nThere are a few things that aren’t clear to me, and I hope the authors can clarify these:\n\n  1. From Algorithm 1 and the description in Section 5, it appears that the method is strictly applied in a fine-tuning sense, i.e. once a network is trained with the classification loss, further fine-tuning training is performed with the DOE loss. It is unclear to me if the OE, MixOE, VOS baselines are also trained similarly. In the original papers, they do not appear to require a fine-tuning setup (except when pre-training with ImageNet-classification is performed, which does not seem the case for CIFAR in this submission). \n\n  2. It is not obvious to me how the regret formulation connects precisely to Eq. 7. My understanding is that the gradient-norm approximation is used whenever the regret-formulation is referred to in experiments. Without a clear relation between WOR and the gradient-norm variant, Table 4 is hard to interpret: if DOE-regret doesn’t actually clearly correspond to the gradient-norm approximation, the comparison between gradient-norm and DOE-risk might suggest something else.\n\n  3. In Appendix A.1, in Eq. 13, it looks like the inequality det(A+B) >= det(A) + det(B) is being used. This is generally not true, and only holds with conditions upon A and B. The statement of Minkowski’s inequality suggests that this is true when A and B are both positive semi-definite. (Potential typos: (a) After Eq. 14, it says v, which should probably be z. (b) In A.3, some of the (L+1)s should probably be L.)\n\nOther comments:\n\n  — Figure 1 contrasts DRO and DOE as performing interpolation and interpolation+extrapolation. REx (Krueger et al., 2021) shows how DRO might be modified to change constraints for coefficients lying in [0, 1] to lying anywhere, but summing to 1, which enable an extrapolation-variant for DRO.\n\n  — The writing has plenty of grammatical issues, which can be fixed by getting the draft proof-read, or using a grammar-fixing software (there are free alternatives available).", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "c5qi15_hIuI", "reviewer": "Reviewer_UUPv", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a solution to the OOD detection problem. Starting from approaches that train the model on auxiliary data, the authors suggest that the distribution of auxiliary data used for training might differ from that to be encountered in practice limiting the detection capabilities. As such the authors proposed to diverse the ood data using implicit transformation via perturbing the model parameters. \nBased on ReLU networks, the method uses the perturbation with to the worse regret, gradient approximation is used to limit the search space. Theoretical aspects are well supported. The method shows significant improvements over existing works on several OOD benchmarks.\n ", "summary_of_the_review": "The paper proposed an important solution to the OOD detection tackling the distribution gap between auxiliary ood data and real one. \nThe method is supported with theoretical and empirical evidence. ", "strength_and_weaknesses": "Strengths:\n1) A solution tackling the distribution gap between used auxiliary ood data and that encountered in practice. \n2)The method is supported with theoretical evidence.  \n3) Good results. \nWeakness:\n1) Some closely related works are missing e.g., [1], [2] & [3].\n2) Since the proposed perturbation are parameters based, it is not well discussed to which layers are the perturbations applied or the role of the used architecture. Not sure why Wide ResNet is used for Cifar experiments while ResNet 50 for ImageNet.\n\n\n\n\n[1] Chen, Jiefeng, et al. \"Atom: Robustifying out-of-distribution detection using outlier mining.\" Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, Cham, 2021.\n[2] Ming, Yifei, Ying Fan, and Yixuan Li. \"Poem: Out-of-distribution detection with posterior sampling.\" International Conference on Machine Learning. PMLR, 2022.\n[3] Bitterwolf, Julian, et al. \"Breaking Down Out-of-Distribution Detection: Many Methods Based on OOD Training Data Estimate a Combination of the Same Core Quantities.\" International Conference on Machine Learning. PMLR, 2022.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "9Pq95VZpIpv", "reviewer": "Reviewer_tVEd", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper introduces an outlier exposure(OE)-enhanced method for OOD detection, which searches for model perturbation options to transform a set of given outlier data to its transformed version. It shows through experiments on commonly used benchmarks that this approach is better than OE and a number of other similar approaches.", "summary_of_the_review": "The overall idea is interesting, but its theoretical and empirical support have some major issues. Some key statements are unjustified. Overall, the paper may benefit from another round of major revision.", "strength_and_weaknesses": "The strengths of the work include:\n- The key idea of implicit outlier transformation is interesting. Synthesizing model perturbation and the outlier exposure to create a set of outliers of different distributions is new. It is similar to a combination of deep ensemble and OE, but it has an explicit searching for model parameters more suitable for the OOD detection task.\n- Theoretical results are given to support that the resulting transformed outliers has a different distribution from its original distribution.\n- The method is extensively evaluated against both fine-tuning and post-hoc approaches on commonly used benchmarks.\n- The paper is well written and easy to follow.\n\nHowever, the paper also has a number of limitations:\n- The proposed method significantly complicate the OE method. The effective performance of the method relies heavily on a large set of parameter searching and training (pre-training) tricks. This largely limits its real-life applications.\n- Compared to OE, the proposed method uses a different OOD scoring function, MaxLogit vs MSP in OE. As mentioned in the paper, MaxLogit is much better than MSP, so it is not clear the actual improvement of the proposed implicit OE method gained over the OE method. The paper shows a small set of results of comparing OE and the proposed method using the same scoring function MaxLogit and MSP, but the experiments are limited to only a few experiment cases there. It would be more straightforward by directly using MaxLogit in the OE baseline on all the datasets. This concern substantially weakens my confidence on the proposed method.\n- The presented theoretical results have some points there, but they are not that relevant in the sense that although the method can produce a different distribution from the original distribution, it is not clear whether the resulting distribution is closer to the true distribution of OOD data than the original distribution. in other words, both of the original distribution and the transformed distribution play a similar role wrt ID data; they are both surrogate OOD data only: OOD distribution vs. its shifted version.\n- The statement \"It means that for target data of our interest, we can implicitly get them access via finding the corresponding model perturbation. Then, by updating the detection model thereafter, it can learn from the transformed data (i.e., the target ones) instead of original inputs.\" is an unjustified over-claim. As discussed in the above point, the transformed data is still a set of outliers, some shifted version of the original outliers, which are not the target OOD data in the test data. \n- I wonder whether this would affect the classification accuracy. The empirical results show that the method does not. It would be good to elaborate the reasons in the paper.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster