FROB: Few-shot ROBust Model for Classification with Out-of-Distribution Detection
Authors: Nikolaos Dionelis
Mehrdad Yaghoobi
Sotirios A. Tsaftaris
Venue: ICLR 2022 Submitted (2022)
Keywords: Classification and Out-of-Distribution Detection
Confidence Prediction
Few-Shot Out-of-Distribution Detection
Outlier Exposure
Robustness

Abstract: Nowadays, classification and Out-of-Distribution (OoD) detection in the few-shot setting remain challenging aims mainly due to rarity and the limited samples in the few-shot setting, and because of adversarial attacks. Accomplishing these aims is important for critical systems in safety, security, and defence. In parallel, OoD detection is challenging since deep neural network classifiers set high confidence to OoD samples away from the training data. To address such limitations, we propose the Few-shot ROBust (FROB) model for classification and few-shot OoD detection. We devise a methodology for improved robustness and reliable confidence prediction for few-shot OoD detection. We generate the support boundary of the normal class distribution and combine it with few-shot Outlier Exposure (OE). We propose a self-supervised learning few-shot confidence boundary methodology based on generative and discriminative models, including classification. The main contribution of FROB is the combination of the generated boundary in a self-supervised learning manner and the imposition of low confidence at this learned boundary. FROB implicitly generates strong adversarial samples on the boundary and forces samples from OoD, including our boundary, to be less confident by the classifier. FROB achieves generalization to unseen anomalies and adversarial attacks, with applicability to unknown, in the wild, test sets that do not correlate to the training datasets. To improve robustness, FROB redesigns and streamlines OE to work even for zero-shots. By including our learned boundary, FROB effectively reduces the threshold linked to the model’s few-shot robustness, and maintains the OoD performance approximately constant and independent of the number of few-shot samples. The few-shot robustness analysis evaluation of FROB on different image sets and on One-Class Classification (OCC) data shows that FROB achieves competitive state-of-the-art performance and outperforms benchmarks in terms of robustness to the outlier OoD few-shot sample population and variability.

Under review as a conference paper at ICLR 2022
FROB: FEW-SHOT ROBUST MODEL FOR CLASSIFICA- TION WITH OUT-OF-DISTRIBUTION DETECTION
Anonymous authors
Paper under double-blind review
ABSTRACT
Nowadays, classification and cut-of-Distributionn (OoD) detection in the few-shot setting remain challenging aims mainly due to rarity and the limited samples in the few-shot setting, and because of adversarial attacks. Accomplishing these aims is important for critical systems in safety, security, and defence. In parallel, OoD detection is challenging since deep neural network classifiers set high confidence to OoD samples away from the training data. To address such limitations, we pro- pose the Few-shot ROBust (FROB) model for classification and few-shot OoD de- tection. We devise methodology for improved robustness and reliable confidence prediction for few-shot OoD detection. We generate the support boundary of the normal class distribution and combine it with few-shot Outlier Exposure (OE). We propose a self-supervised learning few-shot confidence boundary methodol- ogy based on generative and discriminative models, including classification. The main contribution of FROB is the combination of the generated boundary in self- supervised learning manner and the imposition of low confidence this learned boundary. FROB implicitly generates strong adversarial samples on the boundary and forces samples from OoD, including our boundary, to be less confident by the classifier. FROB achieves generalization to unseen anomalies and adversarial attacks, with applicability to unknown, the wild, test sets that do not correlate to the training datasets. To improve robustness, FROB redesigns and streamlines OE to work even for zero-shots. By including our learned boundary, FROB effectively reduces the threshold linked to the model's 's few-shot robustness, and maintains the OoD performance approximately constant and independent of the number of few- shot samples. The few-shot robustness analysis evaluation of FROB different image sets and on One-Class Classification (OCC) data shows that FROB achieves competitive state-of-the-arr performance and outperforms benchmarks in terms of robustness to the outlier OoD few-shot sample population and variability.
INTRODUCTION
In real-world settings, it is crucial to robustly perform classification and OoD detection with high levels of confidence. The problem of detecting whether sample is in-distribution, from the training distribution, or Ool is critical for adversarial attacks. This is crucial nowadays in many applications in safety, security, and defence. However, deep neural networks produce overconfident predictions and do not distinguish in- and quu-of-dattaddittiiution Adversarial examples, when small modifica- tions of the input appear, can change the classifier decision. is an important property of classifier to address such limitations with high level of confidence, and provide robustness guarantees for neu- ral networks. parallel, OoD detection is challenging aim since classifiers set high confidence to OoD samples away from the training data. The state-of-art models are overconfident in their predic- tions, and not distinguish in- and OoD. The setting that our proposed Few-shot ROBust (FROB) model addresses is robust few-shot sure (OE). To address rarity and the limited samples in the few-shot setting, we aim at reducing the number of the few-shots of the OoD samples, while maintaining accurate and robust performance.
(OoD) detection and few-shot Outlier Expo-
Diverse data are available today in large quantities. Deep learning magnifies the difficulty of dis- tinguishing OoD from in-distribution. It is possible use such data to improve OoD detection by training detectors with auxiliary outlier sets (Hendrycks et al., 2019). OE enables detectors to gen- eralize to detect unseen OoD samples with improved robustness and performance. Models trained

---

Under review as a conference paper at ICLR 2022
with different outliers can detect unmodelled data and improve OoD detection by learning cues for whether inputs are unmodelled. By exposing models to different OoD, the complement of the sup- port of the normal class distribution is modelled and the detection of new types of anomalies is enabled. OE improves the calibration of deep neural network classifiers in the setting where a frac- tion of the data is OoD, addressing the problem of classifiers being overconfident when applied to OoD (Bitterwolf et al., 2020). Aiming at solving the few-shot robustness problem with classification and OoD detection, the contribution of our FROB methodology is the development of an integrated robust framework for self-supervised few-shot negative data augmentation on the distribution con- fidence boundary, combined with few-shot OE, for improved OoD detection. The combination of the generated boundary in self-supervised learning way and the imposition of low confidence at this learned boundary is the main contribution of FROB, which greatly and decisively improves ro- bustness for few-shot OoD detection. To address the rarity of relevant outliers during training using OoD samples, we propose to use even few-shots to improve the OoD detection performance. FROB achieves significantly better robustness and resilience to few-shot OoD detection, while maintaining competitive in-distribution accuracy. FROB achieves generalization to unseen anomalies, with ap- plicability to new, in the wild, test sets that do not correlate to the training sets. FROB's evaluation on different sets, CIFAR-IO. 10, SVHN, CIFAR-IO0, and low-frequency noise, using cross-dataset and One-Class Classification (OCC) evaluations, shows that our self-supervised model with few-shot OE on the confidence boundary and few-shot adaptation improves the few-shot OoD detection perfor- mance and outperforms benchmarks. The robustness performance analysis of FROB the number of few-shots and to outlier variation shows that it is robust to few-shots and outperforms baselines.
2 OUR PROPOSED FEW-SHOT ROBUSTNESS (FROB) METHODOLOGY
We propose FROB for few-shot OoD detection and classification using discriminative and generative models. We devise methodology for improved robustness and reliable confidence prediction, to force low confidence close and away from the data. To improve robustness, FROB generates strong adversarial samples on the boundary close to the normal class. It finds the boundary of the normal class, and it combines the self-supervised learning few-shot boundary with robustness loss.
Flowchart of FROB. Fig. 1 shows the flowehart of FROB which uses a discriminative model for classification and OoD detection. FROB also uses generator for the OoD samples and the learned boundary. generates low-confidence samples and performs active negative training with the gen- erated OoD samples on the boundary. It performs self-supervised learning negative sampling of confidence boundary samples via the generation of strong and specifically adversarial OoD. It trains classifiers and generators to robustly classify as less confident samples and out of the boundary.
Our proposed loss. We denote the normal class data by x where x; are the labeled data with class labels ya. Our proposed loss of the discriminative model which is minimized during training is
N log
exp(F (x,))
1 M
M log 1
exp(f k=1 exp (fx
arg min,
(I)
k= (x)()x(x))
m=1
where f()) is the Convolutional Neural Network (CNN) discriminative model for multi-class clas- sification with K classes. Our loss has terms and hyper-parameter. The 2 losses operate on different samples for positive and negative training, respectively. The first loss is the cross-entropy between yi and the predictions, softmax (fx))x(((x))) the CNN is followed by the normalized exponential to obtain the probability over the classes. Our robustness loss forces f(.) to accurately detect out- liers, in addition to classification. It operates on the few-shot OE samples, Z. It is weighted by the hyper-parameter X. l is a class index. For the in-distribution, N is the batch size and i is the batch data sampling index. For the OoD, M is the batch size and m the batch data sampling index.
FROB then trains a generator to generate low-confidence samples on the normal class boundary. Our algorithm includes these learned low-confidence samples in the training to improve the performance in the few-shot setting. Instead of using a large OE set, which constitutes an ad hoc choice of outliers to model the complement of the support of the normal class distribution, FROB performs learned negative data augmentation and self-supervised learning, to model the boundary of the support of the normal class distribution. We train a CNN deep neural network generator and denote it by Ozz), where O refers OoD samples and are latent space samples from standard Gaussian distribution.
2

---

Under review as a conference paper at ICLR 2022
FROB Model Training
Active Negative Training with FS-O(2) and FS-OE
Robust Multi-Class Classification Sho- OoD Detection
Multi-Class Classification model
Boundary Generator, FS-O(z)
Few-Shot Outlier Exposure, FS-OE
Training set, Normal class data
Figure 1: FROB training with learned negative sampling, FS-O(z), and few-shot outliers, FS-OE.
Our proposed optimization of maximizing dispersion subject to being on the boundary is given by
2z 2,112
arg mino
N 2,
O0(z) O
(2)
(
+
max 1=1.2.....
+ v mminn_-...... ((0(() -xyl22
- - (x)
where using (2), we penalize the probability that Ozz) have higher confidence than the normal class. We hence make (zz) have lower probability than
2019; Ren al., 2021).
FROB includes the learned low-confidence samples in the training by performing (1) with the self- generated few-shot boundary, Ozz), in addition to Z. Our self-supervised learning mechanism to calibrate confidence in unforeseen scenarios is (2) followed by (1). FROB performs boundary data augmentation in a learnable self-supers supevvueeee learning manner. It introduces self gelf-geen boundary samples, and sets them as OoD to better perform few-shot OoD detection. This learned boundary has strong and adversarial anomalies close the distribution support and near high probability normal class samples. FROB introduces optimal, relevant, and useful anomalies to more accurately detect few-shots of OoD (Wang et al., 2020a;b). It detects OoD robustly, by generating strong adversarial OoD samples and helpful task-specific anomalies. A property of our nested optimization, where the inner optimization is (zz) in (2) and the outer one is cross-entropy with negative training in (1), is that if optimum is reached for the inner one, optimum will also be reached for the outer.
FROB addresses the few-shots problem by performing negative data augmentation in a well-sampled manner the support boundary of the normal class. It performs OoD sample description and char- acterization, not allowing space between the normal class and our self-generated anomalies. FROB addresses the question of what Ool samples introduce robustly detect few-shots of data. FROB introduces self-supervised learning and learned data aug- mentation using the Deep Tigstest Data Description algorithm of (2) followed by (1), and our self- eeff-generated confidence boundary in (2) is robust to mode collapse (Dionelis et al., 2020b;a). By performing scattering, FROB achieves diversity using the ratio of distances in the latent and data spaces rather than maximum entropy (von Kügelgen et al., 2021; Dieng et al., 2019). Our framework uses data space point-set distances (Dionelis al., 2020b;a; Jalal et al., 2017: Jordan al., 2019).
model for negative training, to
Inference. The Anomaly Score (AS) of FROB for any queried test sample, x, during inference is
(x)()i(X))
AS(
max 1=1,2.... K
Σ k=1 exp (x))
where if the AS is smaller than threshold r, i.c AS < T, X is OoD. Otherwise, X is in-distribution.
3 RELATED WORK ON CLASSIFICATION WITH OoD DETECTION
Outlier Exposure. The OE method trains detectors with outliers to improve the OoD performance to detect unseen anomalies (Hendrycks et al., 2019). Using auxiliary sets, disjoint from train and test data, models learn better representations for OoD detection. Confidence Enhancing Data Aug- mentation (CEDA), Adversarial Confidence Enhancing Training (ACET), and Guaranteed OoD De- tection (GOOD) tackle the problem of classifiers being overconfident OoD samples (Bitterwolf

---

Under review as a conference paper at ICLR 2022
et al., 2020; Hein et al., 2019). Their aim is to force low confidence in l2 -nom ball around each OoD sample where the prediction confidence is max.= Pk (x)
-nrm for the output Klllass softmax (Sensoy et al., 2018; Hariharan & Girshick, 2017; Jeong & Kim, 2020). CEDA employs point- robustness (Bastani et al., 2016; Rosenfeld et al., 2020). GOOD finds worst-case Ool detection guarantees. The models are trained OE sets, using the 80 Million Tiny Images reduced by the normal class. Disjoint distributions are used for positive and negative training, but the OoD samples for OE are chosen in an ad hoc way. In contrast, FROB performs learned negative data augmentation on the boundary of the normal class to streamline and redesign few-shot OE (and zero-shot OE).
Human prior. GOOD defines the normal class, then filters out from the 80 Million Tiny Images. This filtering-utt process of normality from the OE set is human- -emaandeeendent. This modified dataset set as anomalies. Next, GOOD learns the normal class and sets low confidence to these OoD. This process is data-dependent, not automatic, and feature-dependent (Dionelis et al., 2021; Sohn et al., 2021). In contrast, FROB eliminates the need for feature extraction and human intervention which is the aim of Deep Learning, as these do not scale. This filtering-out process is not practical and cannot be used in real-world scenarios as anomalies are not confined in finite closed sets (Sensoy et al., 2020). FROB avoids feature-, application-, and Kataset-dependee boundary data augmentation obviates memorization, scalability, and data diversity problems arising from memory replay and prioritized experience replay (Zaheer et al., 2020; Pourreza al., 2021).
processes. Our self-supervised
Learned OoD samples. The Confidence- Calibrrtte Classifier (CCC) uses a GAN to create samples out of, but close to the normal class (Lee al., 2018a). FROB substantially differs from CCC, as CCC finds threshold and not the boundary. CCC uses the OE set, Uyy), where the labels follow a Uniform distribution, to compute this threshold. This is limiting as the threshold depends on U U(y),, which is an ad hoc choice of outliers. In contrast, FROB finds the confidence boundary and does not use (y) to find this boundary. FROB streamlines OE and sho- outliers. Our boundary is not a function of (y), as Uyy) is not necessary (Sohn et al., 2021). For negative training, CCC defines a eloseness metric (KI. divergence), and then penalizes this metric (Zaheer et al., 2020; Asokan & Seelamantula, 2020; Dionelis et al., 2021). CCC suffers from mode collapse as it does not perform scattering for diversity. The models in Lee et al. (2018a); Vernekar et al. (2019;bb and Wang et al. (2018) perform confidence-aware classification. Self-Supervised outlier Detection (SSD) creates OoD samples in the Mahalanobis metric (Sehwag et al., 2021). It is not a classifier, as it performs OoD detection with OE FROB achieves fast inference with (3), in contrast to Tack al. (2020) which is slow during inference (Goldberger et al., 2005). Tack et al. (2020) does not address issues arising from detecting with nearest neighbors while using a different composite loss for training.
4 EVALUATION AND RESULTS
We evaluate FROB trained on different sets, CIFAR-10, SVHN, CIFAR-1O0, 80 Million Tiny Im- ages, Uniform noise, and low-frequency noise, and we report the Area Under the Receiver Operating Characteristic Curve (AUROC), the Adversarial AUROC (AAUROC), and the Guaranteed AUROC (GAUROC) which uses le- -norm perturbations for the OoD (Bitterwolf et al., 2020; Croce & Hein, 2020). For the evaluation of FROB, test different combinations of normal class sets, OF datasets, few-shot outliers (FS-OE), the generated boundary (FS-O(z)). and test sets, in an alternating man- ner. We examine the generalization performance of FROB to few-shots of unseen new OoD samples at the dataset level, Out-of- -Datss-- anomalies. To examine the robustness to the number of few-shot samples, we decrease the number of few-shots by dividing them by two. We perform uniform sam- pling for choosing the few-shots, and we examine the variation of the dependent variable, AUROC, to changes of the independent variable, the provided number of few-shots of OoD (FS-OE). In this way, we evaluate the robustness of FROB to the number of few-shots. We also examine the Failure Point of our proposed FROB algorithm and of benchmarks; we define this Break Point as the number of few-shots from which the performance in AUROC decreases and then eventually falls to 0.5.
Datasets. For normal class, we use CIFAR-IU 10 and SVHN. For OE, we use S0 Million Tiny Images, SVHN, and CIFAR- 100. For few-shot, we use CIFAR-10, CIFAR-100, SVHN and Low-Frequency Noise (LFN). We evaluate FROB on CIFAR- 100, SVHN CIFAR-10, LFN, and Uniform noise.
Benchmarks. We compare FROB to benchmarks. Having access to large OE sets is not represen- tative of the few-shot OoD detection setting. We compare FROB to GOOD, CEDA, ACET, and OE (Bitterwolf et al., 2020; Hein al., 2019; Hendrycks et al., 2019). We also compare FROB to
4

---

Under review as a conference paper at ICLR 2022
GEOM, GOAD, DROCC, Hierarchical Transformation- DisartiiinDssiiiiaatinggg Generator (HTD), Support Vector Data Description (SVDD), and Patch SVDD (PaSVDD) in the few-shot setting using One- Class Classification (OCC) (Sheynin et al., 2021). GOOD and Hendrycks et al. (2019) use the 80 Million Tiny Images for OE. FROB outperforms baselines in the few-shot Ool detection setting.
Ablation Study. We test FROB for: (i) with OE, and without (w/o) FS-OE and FZ-O (ii) with (w/) FS-OE and w/o Oz) (iii) w/ FS-OE and FS-O(z), and (iv) w/ FS-OE, FS-O(z), and OE.
4.1 FROB PERFORMANCE ANALYSIS COMPARED TO BENCHMARKS
Overview. We evaluate the benchmarks using OE and compare them to FROB and its OoD perfor- mance. We analyse the performance of baselines, CEDA, OE model, ACET, and GOOD, using 80 Million Tiny Images for OE, as well as the performance of CCC using OE SVHN or CIFAR-10. We compare them to FROB, using the 80 Million Tiny Images for OE. FROB without using our self-supervised generated distribution boundary shows similar behavior to the benchmarks, and out- performs them in all the examined AUC-type metries in Table 1. Table shows the results of FROB without few-shot boundary samples, when the normal class is SVHN and CIFAR-10, using the OE set 80 Million Tiny Images, evaluated on different test sets AUROC. FROB without Ozz) outper- forms benchmarks. Taking into account this FROB model behavior, we examine the performance of FROB without the boundary Ozz) to variable number of few-shot outliers in Figs. and 2. Without the generated Ozz), the AUROC performance decreases as the number of few-shots decreases, and is not robust and suitable for few-shot OoD detection, for few-shots less than approximately S00. Then, examine the performance of FROB with the self-learned Oz)). in Figs. 4 and 5. Sec. 4.2 shows that (zz) is effective and that FROB is robust, even to a very small number of few-shots.
4.1.1 FROB PERFORMANCE ANALYSIS USING OE
First, we examine the performance of benchmarks, CEDA, OE, ACET, and GOOD, when setting (a) SVHN and (b) CIFAR-10 as the normal class, with OE 80 Million Tiny Images, tested on different sets, CIFAR-100, CIFAR-10, SVHN, and Uniform noise, in AUROC, AAUROC, and GAUROC. We examine the performance of CCC using CIFAR-10 for OE, tested Uniform noise. We compare the performance of benchmarks to that of FROB without Ozz). Our algorithm, when setting SVHN as the normal class, on average outperforms the baselines CCC, CEDA, OE, and ACET, in AAUROC and GAUROC, and yields competitive results in AUROC. FROB shows comparable performance to GOOD Table 1. This also shown in Table in the Appendix. When setting CIFAR-10 as the normal class, FROB on average outperforms the benchmarks CEDA, OE, ACET, and GOOD in AUC-type metrics, according to Table and also to Table 4 in the Appendix. Table I, as well as Tables 3 and 4 in the Appendix, present the performance of FROB without using our self-generated boundary samples, (z)) They, together with Table 6, show that FROB outperforms benchmarks.
4.1.2 COMPARISON OF FROB WITH BENCHMARKS
Analysis of FROB without O(z) by reducing the few-shot outliers. Fig. 2 shows the performance of FROBInit for normal CIFAR-10 10 without Oz), using variable number of Outlier Set SVHN few- shots, tested on different sets. The FROBInit performance decreases with reducing number of SVHN few-shots, A low AUROC of 0.5 is reached for approximately 800 few-shots for CIFAR-I00, in Table 5 in the Appendix. Fig. 2 shows that the benchmarks in Table 1, as well as in Tables 3 and 4 in the Appendix, do not achieve a robust performance for decreasing few-shots, their performance is reduced with decreasing number of few-shots, yield steep decline for few-shots less than 1830 samples, and have Failure Break Point at approximately 800 few-shots for the test set CIFAR-100 (AUROC 0.51). The performance of FROBInit, without (z)) decreases fast and relatively sharp below 1 1830 samples, when testing on low-frequency noise in Fig. 2, where for few-shots less than 1800, the modeling eиror covering the full complement of the support of the normal class is high.
Fig. 3 and Table 5 show the performance of FROBInit in GAUROC for normal CIFAR-I0 without Ozz), with variable number of FS SVHN. The GAUROC performance of FROB shows that when the few-shots originate from the test set, SVHN, a less steep decrease is observed compared to when the few-shots and the test samples are from different sets, low-frequency noise. The rate of decrease of GAUROC below 1800 samples is small when the OE and the test samples are from the same set. The GAUROC performance of FROB without Ozz), for the test set CIFAR-100, is
5

---

Under review as a conference paper at ICLR 2022
Table 1: Performance of benchmarks with 80 Million Tiny Images in AUROC, AAUROC, and
GAUROC (Bitterwolf et al., 2020). Comparison to FROBInit without Ozz) FROBInit refers to FROB O C10 to CIFAR-IO, 10, C100 CIFAR-100, 80M to Million Tiny Images, and to Uniform noise.
NORMAL MODEL
OUTLIER
TEST DATA
AUROC
AAUROC GAUROC
SVHN
FROBINIT
80M
C10, C100, UN
0.995
0.995
0.979
SVHN CCC
C10
C10. UN
1.000
0.000
0.000
SVHN
CEDA
80M
C10, C100, UN
0.999
0.773
0.000
SVHN OE
80M
C10, C100, UN
1.000
0.736
0.000
SVHN
ACET
80M
C10, C100, UN
0.999
0.984
0.000
SVHN
GOOD
80M
C10, C100, UN
0.998
0.987
0.984
C10
FROBINIT
80M
SVHN, C100, UN
0.860
0.860
0.718
C10
CCC
SVHN
SVHN, UN
0.570
0.000
0.000
C10
CEDA
80M
SVHN, C100, UN
0.957
0.427
0.000
C10
OE
80M
SVHN, C100, UN
0.962
0.522
0.000
C10
ACET
80M
SVHN, C100, UN
0.957
0.871
0.000
C10
GOOD
80M
SVHN, C100, UN
0.817
0.709
0.700
performance of
Ofz),
performance for CIFAR-10, O(z),
SVHN samples
samples
1.0
0.9
0.3
0.8
9.8
0.7
8.7
AUROC
0.6
0.5
0.5
0.5
0.4
0.3
1980
2000
3000
4300
5960
8800
7600
1038
2000
5030
4000
5000
8800
7000
FS SVIN (camplen
FS SVHN (samples
Figure 2: OoD performance of FROBInit in AU- ROC, for normal class CIFAR-10, w/o (z)) and w/ few-shots of variable number from SVHN,
Figure 3: Performance of FROBInit in GAU- ROC for normal CIFAR-10 w/o Ozz) and w/ variable number of FS samples from SVHN.
low. FROBInit achieves better performance than the benchmarks in the FS OoD detection setting (Table 1). FROBInit with only few-shots, the OoD performance rapidly decreases for FS of 1800 samples, and tends to a Break Point of approximately 800 shots for normal CIFAR-10. 10. It shows more robust behavior at reducing the number of FS when the Outlier Set and test are the same.
Using reduced number of 80 Million. Table 6 in the Appendix shows the performance of InOB using the 80 Million Tiny Images for Outlier Dataset with all available data and for reduced number of samples, few-shots of it (FS). We evaluate FROBInit without the boundary, Ozz), on different test sets, CIFAR-I0, CIFAR- -00, SVHN, low-frequency noise, uniform noise, and 80 Million Tiny Images. We set SVHN and CIFAR-10 the normal classes. The performance of FROB slightly decreases, AUC-type metrics, when 73257 samples from Million Tiny Images are used as the chosen Outlier Calibration Set, instead of the 50 million total training samples, during training.
Using various Outlier Sets. Table 7, in the Appendix, shows the performance of FROBInit trained on normal CIFAR-10 with the Outlier Datasets -all data- of SVHN, CIFAR- and 80 Million Tiny Images 73257 samples, without our Ozz), tested on different sets AUC-type metrics. FROB, using SVHN for Outlier Dataset, achieves higher AUROC compared to using the OE sets 80 Million Tiny Images and CIFAR- 100. FROBInit achieves higher GAUROC with the Outlier Dataset set SVHN, i.e. average 0.69, and 80 Million Tiny Images, average 0.66, compared to when using CIFAR-100.

---

Under review as a conference paper at ICLR 2022
and PS variable SVIN samplex
end neratle CIAA8-1 surppher
1.0
1,00
AURO
8.50
1800
1908
2002
280
400
500
500
1000
1200
1483
1290
1900
2000
Figure 4: FROB for normal C10 with O(z)
Figure 5: FROB performance in AUROC for normal class SVHN w/ O(z) and FS C10.
and FS SVHN, in AUROC and GAUROC.
Table 2: Mean OCC performance of FROB w/ Ozz), w/ 80 FS OCC C10 (Sheynin et al., 2021).
NORMAL
MODEL
O(z)
TEST DATA
AUROC
C10: OCC FROB
W/
C1O: OCC
0.784
C10: OCC FROB W/ OUTLIER SVHN
W/
C10: OCC
0.802
C10: OCC HTD (SHEYNIN AL.,, 2021)
W/O
C10: OCC
0.756
C10: OCC GEOM (WHICH > GOAD)
W/O
C10: OCC
0.735
C10: OCC SVDD PASVDD, DROCC)
w/O
C10: OCC
0.608
4.2 EFFECTIVENESS OF OUR PROPOSED CONFIDENCE BOUNDARY
Efficacy and effectiveness of learned boundary. We evaluate FROB with the generated boundary. Ozz), and few-shot outliers. Fig. and Table 8 in the Appendix, show the performance of FROB trained on normal class CIFAR- 10 with (zz) and few-shots from SVHN in decreasing number. We evaluate the performance of FROB on the test sets CIFAR-100, SVHN, and low-frequency noise. Compared to Fig. 2, when we use Ozz), the performance increases, showing robustness even for a very small number of few-shots, even for zero-shots. We have experimentally demonstrated the effectiveness of (z), in Fig. 4. We have demonstrated the improvement in AUROC, when Ozz) is used, compared to when it is not used. FROB using few-shot data outperforms benchmarks and improves robustness to the number of few-shots, pushing down the phase transition point (Fig. 4).
FROB robustness to number of few-shots. With decreasing few-shot samples, the performance of FROB in AUROC is robust and approximately independent of the FS number of samples, till approx- imately zero-shots. FROB achieves robustness using the boundary O(z) as the performance is ap- proximately independent of the FS samples for the test sets, CIFAR-100, SVHN, and low-frequency noise. The component of FROB with the highest benefit is (z)) FROB achieves robustness to the number few-shot samples, and this is the main contribution of this paper. As the number of few-shots decreases, the performance of FROB does not decrease. When the few-shots are from the test set, Fig. 4 (and Table 8 in Appendix) shows that using the learned boundary, Ozz), is effective and robust in the few-shot OoD detection setting. FROB with the self refereeeerted boundary samples, Ozz), achieves better performance than the benchmarks in the few-shot OoD detection setting.
Existing methodologies sensitive to number of few-shots. Current methodologies are not robust to a small number of few-shots as they perform negative training by including OoD samples randomly somewhere in the data space, allowing a lot of unfilled space between the OoD and the normal class (Bitterwolf et al., 2020; Hendrycks et al., 2019). They need 50 million outliers, to model the complement of the support of the normal class distribution. They use irrelevant conservative OoD samples and do not model the support boundary of the normal class distribution. Instead, FROB the boundary, requiring 50 million outliers. FROB redesigns
leams OoD samples generated and streamlines OE, to work even for zero-shots. Our negative data augmentation creates the tightest possible OoD samples that close possible the support of the normal class distribution.

---

Under review as a conference paper at ICLR 2022
AD performancs of CIFAR-10, with Ojz),
variable SVHN samples
and winh FS vartale CIPAR-43 sarppics
CBFAR-93 LOW-FRE NOISE
1,00
1.49
0.00
0.50
0.70
GAUROO
0.80
GAUROC
0.50
9.40
0.30
3.20
3.10
3,00
200
420
030
1380 1400
1660
1933
2000
838
1823
1700
1400
1030
200
FS PSCCABB-1 cwmealales
Figure 6: FROB performance in GAUROC for normal CIFAR- w/ Ozz) and variable number of OE SVHN, tested the unseen sets CIFAR- 100 and low frequency noise, using OE 80M.
Figure 7: OoD performance of FROB for normal SVHN in GAUROC using the boundary, O(z), and variable number of FS-OE CIFAR- 10, tested on CIFAR- 100,, CIFAR- 10, and Uniform noise.
4.2.1 OoD DETECTION PERFORMANCE OF FROB WHEN FS DATA ARE FROM TEST SET
FROB improves the AUROC and the GAUROC, when the few-shots and the OoD test samples originate from the same set. In addition to improving both the AUROC and the GAUROC when the few-shot outliers originate from the test set, shown in Figs. and 2, our proposed FROB model also improves the AUROC performance, when the few-shots and the OoD test samples originate from different sets. These results for FROB are also presented in Tables and 5 in the Appendix.
Tables 10 and 11 in the Appendix show that FROB (i) improves both the AUROC and the GAUROC when the few-shots and the OoD test samples originate from the same set, and (ii) enhances the AUROC when the few-shots and the OoD test samples originate from different sets, i.e. CIFAR-100 and low frequency noise. When using the learned boundary Ozz) and FS, as well as the 80 Million Tiny Images, the performance of FROB in GAUROC improves, according to Tables 7-10 in the Appendix for Ozz) 1830, 915, 100, and 80 samples, respectively. When using the same Outlier Dataset and test set. SVHN, without the 80 Million Tiny Images set, FROB achieves comparable high value in GAUROC, 0.98 in Fig. 4, compared to when using 80 Million Tiny Images, 0.97.
FROB outperforming baselines. FROB with Ozz) achieves AUROC of 0.92 for normal CIFAR- 10, SVHN 1830 samples, and test set Uniform noise in Table 8 in the Appendix. It is effective and outperforms benchmarks. FROB outperforms Lee et al. (2018a) for normal CIFAR-10, when the Outlier Dataset is SVHN, CCC yields an AUROC of 0.14 for Uniform noise. CCC does not have few-shot capability, FS functionality. It does test CIFAR- 100 (small domain gap CIFAR-1O).
Fig. 4 shows the performance of FROB in GAUROC for normal CIFAR-10 with O(z), using a variable number of FS data SVHN, tested on SVHN. We evaluate FROB with O(z), by reducing the number of few-shot outliers. The GAUROC performance shows that when the few-shots originate from the test set, SVHN, a less steep decrease is achieved compared to when the few-shots and the test samples are from different sets, i.e. SVHN and low- low-frqquency noise. The rate of decrease of the GAUROC of FROB below 1830 samples is smaller when the few-shots are from the test dataset.
Figure 5, together with Table 14 and Figure 7 in the Appendix, show the performance of FROB using Oz), the normal class SVHN, and variable number of FS CIFAR-I0 samples. In Figures and 7, compared to Figure 4, we show that FROB achieves better performance for normal class SVHN compared to for normal CIFAR-10 in all AUC-type metries on the unseen test dataset CIFAR-100.
4.3 PERFORMANCE OF FROB ON USEEN, IN THE WILD, DATASETS
We evaluate FROB using OoD test samples from unseen, in the wild, sets. Importantly, we evaluate FROB on test samples that are neither from the normal class nor from the few-shot data (or from Outlier Dataset). In Figs. 2 and 4, we show the performance of FROB in the few-shot setting, for the normal CIFAR-10 with few-shot outliers from SVHN tested on the unknown sets of CIFAR-10 10 and low-frequency noise. Fig. 4 shows that the OoD detection performance of FROB in the few-shot setting is robust, tested on the new sets of CIFAR- --00 and low frequency noise. FROB has a robust performance in AUROC with reduced number of SVHN few-shots, till approximately zero-shots.
8

---

Under review as a conference paper at ICLR 2022
According to Table 8 in the Appendix, the GAUROC performance of FROB depends the un- known test set and obtains low values for SVHN 80 few-shots, approximately 0.07 on CIFAR-100, 100, 0.25 low frequency noise, and 0.02 Uniform noise. We use effective Outlier Set, 80 Million Tiny Images, to improve the GAUROC of FROB in the few-shot setting to obtain Table 9: for SVHN 80 few-shots, 0.43 CIFAR-100, 0.95 on low frequency noise, and 0.79 Uniform noise.
Effect of domain, normal class. The performance of FROB with the boundary in AUROC depends on the normal class. In Table 14 and Fig. 5, the performance of FROB with (z) is higher for normal SVHN than for CIFAR-10 10, as presented in Fig. 4 and Table 8. For zero-shots, using the CIFAR-100 test set, the AUROC 0.87 when the normal class is CIFAR- 10 compared to 0.95 when the normal class is SVHN. Figs. 5 and 7 show that FROB is robust and effective for normal SVHN, for Outlier Set CIFAR-I0, 10, on seen and unseen sets. FROB with (z)) is not sensitive to the number of few-shots in Figs. 4-7 in the FS Ool) detection setting when we have Ool sample complexity constraints.
4.3.1 FROB PERFORMANCE WITH O(z) IN GAUROC USING 80 MILLION TINY IMAGES
To improve the performance of FROB with the learned boundary in GAUROC, we use the 80 Million Tiny Images for OE Fig. 6 and Table 9 both show that the performance of FROB, in GAUROC, improves for normal CIFAR-10 with (zz) and variable number of OE SVHN, tested on the unseen sets CIFAR- 100 and low frequency noise. In the few-shot OoD detection setting, for decreasing few-shots till approximately 80. FROB achieves mean value of approximately 0.88 in GAUROC, tested on low frequency noise. FROB with the OE Million Tiny Images set and the learned Ozz) reduces the threshold linked to the model's few-shot robustness. Tables 10- in the Appendix show the performance of FROB with Ozz). in GAUROC (and AUROC), when the OE 80 Million Tiny Images in reduced number (73257) is used and few-shots from 1 1830 80 are used. The performance of FROB in GAUROC increases with OE 80 Million Tiny Images, compared to without this set.
4.4 EVALUATION OF FROB USING OCC COMPARED TO BENCHMARKS
We evaluate FROB using OCC for each CIFAR-IO class. We report the mean performance of FROB and compare FROB to benchmarks, HTD, GEOM, GOAD, DROCC, SVDD, and PaSVDD, in the few-shot OE setting of 80 samples (Sheynin et al., 2021). FROB outperforms benchmarks in Table 2, and in Table 15 in the Appendix. Tables 2 and 15 show the performance of FROB in the OCC setting, when normality is a CIFAR-10 class. FROB using the self-learned boundary outperforms baselines in the few-shot OoD detection task, when we have budget constraints and OoD sampling complexity limitations. The improvement of our proposed FROB model, using OE SVHN, in mean AUROC is 2.3%, when compared to without using OE SVHN in Table 2, and in Table 15 in the Appendix.
CONCLUSION
We have proposed FROB which uses the generated support boundary of the normal data distribution for few-shot OoD detection. FROB tackles the few-shot problem using classification with OoD de- tection. The contribution of FROB is the combination of the generated boundary in self-supervised learning manner and the imposition of low confidence at this learned boundary. To improve robust- ness, FROB generates strong adversarial samples on the boundary, and forces samples from OoD and on the boundary to be less confident. By including the self- celf-produced boundary, FROB reduces the threshold linked to the model's few-shot robustness. FROB redesigns, restructures, and stream- lines OE to work even for zero-shots. It robustly performs classification and few-shot Ool) detection with a high level of reliability real-world applications, in the wild. FROB maintains the OoD per- formance approximately constant, independent of the few-shot number. The performance of FROB with the self-supervised learning boundary is robust and effective, as the performance is approxi- mately stable as the few-shot outliers decrease in number, while the performance of FROB without Ozz) decreases as the few-shots decrease. The evaluation of FROB, on many sets, shows that it is effective, achieves competitive state-of ofate-of-the-art the-art performance, and outperforms benchmarks in the few-shot OoD detection setting in AUC-type metrics. In the future, in addition to confidence and the class, FROB will also output important regions and bounding boxes around abnormal objects.

---

Under review as a conference paper at ICLR 2022
REFERENCES
S. Asokan and C. Seclamantula. Teaching a GAN What Not to Learn. In Proc. Neural Information Processing Systems (NeurIPS), 2020. Online: htpps///axivvorr//d//210...
O. Bastani, Y. Ioannou, L. Lampropoulos, D. Vytiniotis, A. Nori, and A. Criminisi. Measuring neu- ral net robustness with constraints. In Proc. Neural Information Processing Systems (NeurIPS), 2016. Online: https://axxxv.rr//dd//// 600p://wwww.rr////000.0000000000 605.07......
J. Bitterwolf, A. Meinke, and M. Hein. Certifiably adversarially robust detection of out-of- distribution data. In Proc. Advances Neural Information Processing Systems (NeurIPS), vol- ume 33, pp. 16085- 6095, 2020. Online: http://ssw...ppaoooo////o//////0
J. Bitterwolf, A. Meinke, M. Augustin, and M. Hein. Revisiting Out-of-Distribution Detection: Simple Baseline Surprisingly Effective. Workshop. Uncertainty and Robustness in Deep Learning, ICML, 2021. Online: http://www.gatsby..dd..
Online: http:///o....cccccccccoc/lllllle pappppppsss/pppp10101aaaarr.r..p
J. Bitton and Z. Papakipos. AugLy: A data augmentations library for audio, image, text, and video. 1rXiv:180k 905.09501 [cs.CV], 2021. Online:
J. Chen, Li, X. Wu, Y. Liang, and S. Jha. ATOM: Robustifying Duttof-distribution Detection Using Outlier Mining. In Proc. European Conference on Machine Learning (ECML), 2021. Online:
15200.pdf..
F. Croce and M. Hein. Reliable evaluation of adversarial robusiness with an ensemble of diverse parameter-free attacks. In Proc. ICMI, 2020. Online:
E. Cubuk, B. Zoph, D. Mané, V. Vasudevan, and Q. Le. AutoAugment: Learning Augmentation Policies from Data. arXiv:1800 8888005501111 2018.
Z. Dai, Z. Yang, Yang, W. Cohen, and R. Salakhutdinov. Good semi-supervised learning that requires a bad GAN. In Proc. Advances in Neural Information Processing Systems (NeurIPS), pages 6510-6520, 2017. Online: https://arxivoor//////1........ 705.09....................
A. Dieng, F. Ruiz, D. Blei, and M. Titsias. Prescribed Generative Adversarial Networks. 1XXiv19100.0402. 2019. Online: http::/aaiivoorr////1111.....
N. Dionelis, M. Yaghoobi, and S. Tsaftaris. Tail of Distribution GAN (TailGAN): Generative- Adversarial- Network-Ban Based Boundary Formation. In Proc. IEEE Sensor Signal Processing for Defence (SSPD), 2020a.
Online:
N. Dionelis, M. Yaghoobi, and S. Tsaftaris. Boundary of Distribution Support Generator (BDSG): Sample Generation on the Boundary. In Proc. IEEE International Conference on Image Process- ing (ICIP), 2020b.
Online: https://axixxorrhh/t///10.....99 .0w.0000.999.....
N. Dionelis, M. Yaghoobi, and S. Tsaftaris. OMASGAN: Out-of-Distribution Minimum Anomaly Score GAN for Sumple Generation on the Boundary. arXiv preprint, 2021.
J. Goldberger, S. Roweis, G. Hinton, and R. Salakhutdinov. Neighbourhood components analysis. In Proc. Advances in Neural Information Processing Systems (NeurIPS), pages 513-520, Cam- bridge, MA, MIT Press, 2005. Online: https://www.es.toot
binton/absps/nca.pdtt
I. Goodfellow, Abudiet-bbdiee M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative Adversarial Nets. In Proc. Advances in Neural Information Processing Systems (NIPS), pp. 2672 2680. Montréal, Canada, 2014.
10

---

Under review as a conference paper at ICLR 2022
B. Hariharan and R. Girshick. Low-shot visual recognition by shrinking and hallucinating features. In Proc. IEEE International Conference on Computer Vision (ICCV), 2017.
Online: https://axxiv.orgpddt wwtp:///p////o.....000 008.000668..... 19.
Online: http::/hoome.hharce wtwpshnnnin/ooooossssppp....
M. Hein, M. Andriushchenko, and J. Bitterwolf. Why ReLU networks yield high-confidence predic- fions far away from the training data and how miligale the problem. In Proc. Conference on Computer Vision and Pattern Recognition (CVPR). volume 33, pp. 16085-16095, 2019.
Online: https://axxiv.org/ddf// httpp/////.....22... 12.05720.pdff.
D. Hendrycks, M. Mazeika, and T. Dietterich. Deep anomaly detection with outlier exposure. In Proc. International Conference on Learning Representations (ICLR), 2019. Online: httpss//ppeneeeeee.ee///////yyyy
A. Jalal, A. lyass, C. Daskalakis, and Dimakis. The robust manifold defense: Adversarial training using generative models. arXiv: 1712.0999....... 2017. Online: https://anniv.org//f///17 19f.pdd........
Y. Jang, T. Zhao, S. Hong. and H. Lee. Adversarial defense via learning generate diverse attacks.
In Proc. ICCV, 2019. Online: https:/icceexploreiice http://ppw.....ccooooo////a////a
Jeong and H. Kim. OOD-MAML: Meta-learning for few-shot out-of-distribbttio detection and classification. In Proc. Advances in Neural Information Processing Systems (NeurIPS), 33, 2020.
S. Jha, S. Raj, S. Fernandes, K. Jha, S. Jha, B. Jalaian, G. Verma, and A. Swami. Atributioo-based confidence metric for deep neural networks. In Proc. Advances in Neural Information Processing Systems (NeurIPS), pp. 1826-1 1837, 2019. Online:
Paper.pdff
A. Aalcoeur-Martinean The relativistic discriminator: key element missing from standard GAN. In Proc. ICLR, 2019. Online: http://aaxxiooo//pdpt/e 1 1807 807.00734.ppf.
M. Jordan, N. Manoj. N. Manoj, S. Goel, and A. Dimakis. Quantifying perceptual distortion of adversarial examples. Online:
2019.
R. Kaur, S. Jha, A. Roy, S. Park, O. Sokolsky, and I. Lee. Detecting OoDs as datapoints with High Uncertainty. Workshop ICML, Uncertainty and Robustness in Deep Learning. 2021a.
Online: https//aaxxiv.org//d///1000/ pttps///...00.000oppppp Stt.ro/eeeeneee221lSsseeetttttte /Sssshuuueeutttiireeeeeeeee-a-/
Online:
R. Kaur, S. Jha, A. Roy, O. Sokolsky, and Lee. Are all outliers alike? On Understanding the Diversity of Outliers for Detecting OODs. 1XXv:2103311228 [cs.LG], 2021b.
Online:
pdf.
Kirichenko, Izmailov, and A. Wilson. Distribution Data. In Proc. NeurIPS, 2020. Online:
Why Normalizing Flows Fail to Detect Out-of-
A. Krizhevsky. Learning multiple layers of features from tiny images. 2009.
Y. LeCun, C. Cortes, and C. Burges. The MNIST database of handwritten digits. 1998.
K. Lee, K. Lee, H. Lee, and J. Shin. Training confidence-culibrated classifiers for detecting out-of- distribution samples. In Proc. ICLR, 2018a. Online: https://axxiv.rrg/dfff 1..09///......2.pp...
K. Lee, K. Lee, H. Lee, and J. Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attakk. Proc. NeurIPS, pages 7167-7177, 2018b. Online: https://arxiv.org/prr
807. 0007.0388..pm
J. Liu. Z. Lin, S. Padhy, D. Tran, T. Bedrax- Weiss, and B. Lakshminarayanan. Simple and principled uncertainty estimation with deterministic deep learning via distance awareness. arXiv:2006. 10108, 2020. Online: https://arxiv.or///f//aaa 10100..df.

---

Under review as a conference paper at ICLR 2022
Q. Mao, H. Lee, H. Tseng, S. Ma, and M. Yang. Mode seeking generative adversarial networks for diverse image synthesis. In Proc. CVPR, 2019. Online: https://arxv.oorg/pd///// httppp/d/.......58..pp.p... pdff.
A. Meinke, Bitterwolf, and M. Hein. Provably Robust Detection of Out-of-distribution Data (almost) free. Workshop, Uncertainty and Robustness in Deep Learning, ICML, 2021. Online: http:///iaeellccccccce/////////t
Online:
J. Moon, J. Kim, Y. Shin, and S. Hwang. Confidence-aware learning for deep neural networks. In Proc. International Conference on Machine Learning (ICML), 2020.
Online: https://arxiv.org/ddffra 100.000....8........
I.. Munoz-Gonzaler, B. Pfitzner, M. Russo, J. Carnerero-Cano, and E. Lupu. Poisoning attacks with generative adversarial nets. arXiv: www.1190607775. 2019. Online: http:://aaiii.orr//d////066.... Online: http://ogearrvooww.aer//ommt///o
E. Nalisnick, A. Matsukawa, Y. Teh, D. Gorur, and B. Lakshminarayanan. Do Deep Generutive Models Know What They Don't I Know? In Proc. International Conference on Learning Represen- tations (ICLR), 2019. Online: https://axxiv.or//dff/// 110.09116....f
Y. Netzer, Wang, Coates, Bissacco, B. Wu, and Ng. Reading digits in natural images with unsupervised feature learning. In Workshop, NeurIPS, 2011.
M. Pourreza, B. Mohammadi, M. Khaki, S. Bouindour, H. Snoussi, and M. Sabokrou. G2D: Gen-
erate Detect Anomaly. In Proc. IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 2003-2012, 2021. Online: http://aariv.oo///o////66..11
Raghuram, V. Chandrasekaran, S. Jha, and S. Banerjee. General Framework For Detecting Anomalous Inputs to DNN Classifiers. In Proc. International Conference on Machine Learning
(ICML), 2021.
Online: https:/arrivvorrhhd22001..511
S. Raj. Towards Robust Artificial Intelligence Systems. PhD Doctoral Thesis, University of Central Florida, 2020. Online: http://wwwwwaateeeeceee///////te Online:
J. Ren, S. Fort, J. Liu, A. Roy, S. Padhy, and B. Lakshminarayanan. A Simple Fix Mahalanobis Distance for Improving Near-OOD Detection. In Proc. ICML, 2021. Online: http://arriv.or/horr210......0.0
T. Robinson. Few-Shot Learning for Defence and Security. In Proc. Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications II, SPIE, vol. 11413, pp. 93-106, 2020.
Online: htt.rrffccccii.sssttto////1//222 sh.rh...
http:///www..ppguuuuoooooooooore 443 1413///411//
E. Rosenfeld, E. Winston, Ravikumar, and Kolter. Certified robustness to label-flipping attacks via randomized smoothing, In Proc. International Conference Machine Learning (ICML), 2020.
Online: https//aariv.orrhhof//00....... ofd.
M. Sabokrou, M. Khalooei, M. Fathy, and E. Adeli. Adversarially Learned One-Class Classifier for Novelty Detection. In Proc. IEÉE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 3379-3388, Salt Lake City, UT, USA, DOI: (0.1109/CVR.20188.000 Online: httpss/fieeexplore.eeee http:///eeeeppp....ee...uuueeeet org//documen/857745544
2018
T. Salimans, I. Goodfellow, W. Zaremba, V. Cheung, A. Radford, and X. Chen. Improved techniques for training GANs. arXiv: 00498. 2016. Online: http:///axxiv.org/ddf//loc
V. Sehwag, M. Chiang, and P. Mittal. SSD: unified framework for 2tt.a////..600034988
outlier detection.
In Proc. International Conference on Learning Representations (ICLR), 2021.
Online: http:://opmmevveeewe///d/ddddddd
12

---

Under review as a conference paper at ICLR 2022
M. Sensoy, L. Kaplan, and M. Kandemir. Evidential Deep Learning Quantify Classification Uncertainty. In Proc. Neural Information Processing Systems (NeurIPS), 2018.
Online: https://axxiv.org/ddd//// http://aawii.rrr////////00000010 0at.////0000000...111
M. Sensoy, L. Kaplan, F. Cerutti, and M. Saleki. Uncertainty-aware deep classifiers using generative models. In Proc. AAAI Conference on Artificial Intelligence, 2020.
Online:
S. Sheynin, S. Benaim, and I.. Wolf. A Hierarchical Transformation TransfomaatinnDDisrriiniiii Generative Model for Few Shot Anomaly Detection Generative models multi-class classification. In Proc. IEEE International Conference on Computer Vision (ICCV), 2021. Online: http:://axxxvorr//pd/22222 1453: 14535.pdf.
Online: https//shellysshennnngghbbbubbb wtt.gitiiii..oS//S/peeeeemayaaa
K. Sohn, C. Li, J. Yoon, M. Jin, and T. Pfister. Learning and evaluating representations for deep
one-class classification. In Proc. ICLR, 2021.
Online: https///axxiv.or/ppdfree 1.02578. pdf.
Online: http://ai.googllblolg.oooo httpeccchooocomm20000//////rreen /tt///isooerrnngaanoaaoooooooooo
with-seef.htmm.
K. Sricharan and A. Srivastava. Building robust classifiers through generation of confident out of distribution examples. uxXv:1181.00025 2018. Online:
Y. Sung, S. Pei, S. Hsieh, and C. Lu. Difference-Seeknn GAN Unseen Sample Generation. In Proc. Eighth International Conference on Learning Representations (ICLR), Virtual Conference, Formerly Addis Ababa, Ethiopia, 2020. Online:
J. Tack, S. Mo, J. Jeong, and J. Shin. CSI: Novelty detection via contrastive learning on distribu- tionally shifted instances. In Proc. Neural Information Processing Systems (NeurIPS), 2020. Online: https://axxiv.or/pdff/0000 0811 17..
J. van Amersfoort, L. Smith, Y. Tch, and Y. Gal. Uncertainty estimation using single deep deter- ministic neural network. Proc. International Conference on Machine Learning (ICML), 2020. Online:
S. Vernekar, A. Gaurav, V. Abdelzad, T. Denouden, R. Salay, and K. Czarnecki. Oud-of-distribution detection classifiers via generation. arXiv:1910.04241, 2019a. Online: http://arrivorr//p///990002222.
S. Vernekar, A. Gaurav, V. Abdelzad, T. Denouden, R. Salay, and K. Czarnecki. Analysis of confident-classifer for oul-of-distribution detection. arXiv: 1904: 12220, 2019b.
Online: https://arxiv.org/ppaea http///f///////...1 1904. 12220.........
von Küigelgen, Y. Sharma, L. Gresele, W. Brendel, B. Schölkopf, M. Besserve, and F. Lo- catello. Self-Supervised Learning with Data Augmentations Provably Isolates Content from Style. atXiv:2106.04611 2021. Online: https://aaxii.orr//p///110.0..00
K. Wang, P. Vicol, F. Triantafillou, C. Liu, and R. Zemel. Out-of-distribution Detection in Few-shot Classification. Submitted ICLR, 2020a.
Online: http:://oguuaavvweweerrrr/ulluls Online: http:///oopueeeee...eee/////d//a
K. Wang, P. Vicol, E. Triantafillou, and R. Zemel. Few-shot
Detection. Work-
shop ICML, Uncertainty and Robustness in Deep Learning, 2020b. Online: http://www.gatsby..c uukk//
W. Wang, A. Wang. A. Tamar, X. Chen, and P. Abbeel. Safer Classification by Synthesis. MrXii:1711.0853440 [c). 2018.
Online: https://arxxx.org/ddff// 11855.44........
M. Zaheer, J. Lee, M. Astrid, and S. Lee. Old is Gold: Redefining the Adversarially Learned One- Class Classifier Training Paradigm. In Proc. IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 14171-14181 Seattle, DOI: 10. 10.1199CCPP4226000000044444 2020.
Online: http:///eeccllr....e.eooooouuoap
13

---

Under review as a conference paper at ICLR 2022
APPENDIX
EVALUATION TABLES
The main Tables used for the evaluation of our proposed FROB model are:
Table OoD performance of benchmarks Outlier Dataset 80 Million Tiny Images AUROC, AAUROC, and GAUROC. Comparison to FROB w/o the self- learning boundary, (z).
C10 refers to CIFAR-IO, 10, C100 to CIFAR-100, 100, 80M Million Tiny Images, and UN to Uniform Noise.
NORMAL
MODEL
(zz)
OUTLIER TEST DATA
AUROC
AAUROC GAUROC
SVHN
CCC
W/O
C10
C10
0.999
0.000
0.000
SVHN
CCC
w/o
C10
UN
1.000
0.000
0.000
SVHN
CEDA
W/O
80M
C100
0.999
0.639
0.000
SVHN
CEDA
W/O
80M
C10
0.999
0.687
0.000
SVHN
CEDA
W/O
80M
UN
0.999
0.993
0.000
MEAN
CEDA
W/O
80M
0.999
0.773
0.000
SVHN OE
W/O
8OM
C100
1.000
0.602
0.000
SVHN OE
W/O
80M
C10
1.000
0.625
0.000
SVHN OE
W/O
80M
UN
1.000
0.982
0.000
MEAN OE
W/O
80M
1.000
0.736
0.000
SVHN ACET
W/O
80M
C100
1.000
0.994
0.000
SVHN ACET
w/O
80M
C10
1.000
0.995
0.000
SVHN
ACET
w/O
80M
UN
0.999
0.963
0.000
MEAN
ACET
W/O
80M
0.999
0.984
0.000
SVHN
GOOD w/o
80M
C100
0.996
0.977
0.973
SVHN
GOOD
W/O
80M
C10
0.997
0.984
0.981
SVHN
GOOD
w/O
80M
UN
1.00
0.999
0.998
MEAN
GOOD
W/O
80M
0.998
0.987
0.984
SVHN
FROBINIT W/O
80M
C100
0.993
0.993
0.975
SVHN
FROBINIT W/O
80M
C10
0.995
0.995
0.979
SVHN
FROBINIT W/O
80M
UN
0.997
0.997
0.984
MEAN
FROBINIT W/O
80M
0.995
0.995
0.979
14

---

Under review as a conference paper at ICLR 2022
Table 4: OoD performance benchmarks with 80 Million Tiny Images for Outlier Set, evaluated on different sets in AUROC, AAUROC, and GAUROC. Comparison with FROBInit without (w/o) the boundary samples, Ozz), well with FROB with (w/) Ozz) boundary. Here, in this Table, C10 refers CIFAR-IO, C100 to CIFAR-IO0 100, 80M 80 Million Tiny Images, and UN Uniform Noise.
NORMAL
MODEL
O(z)
OUTLIER
TEST
AUROC
AAUROC GAUROC
C10
CCC
W/O
SVHN
SVHN
0.999
0.000
0.000
C10
CCC
W/O
SVHN
UN
0.141
0.000
0.000
C10
CEDA
W/O
80M
C100
0.918
0.319
0.000
C10
CEDA
W/O
80M
SVHN
0.979
0.257
0.000
C10
CEDA
W/O
80M
UN
0.973
0.705
0.00
MEAN
CEDA
W/O
80M
0.957
0.427
0.000
C10
OE
W/O
80M
C100
0.924
0.110
0.000
C10
OE
W/O
80M
SVHN
0.976
0.70
0.000
C10
OE
W/O
80M
UN
0.987
0.757
0.000
MEAN
OE
W/O
80M
0.962
0.522
0.000
C10
ACET
W/O
80M
C100
0.907
0.745
0.000
C10
ACET
W/O
80M
SVHN
0.966
0.880
0.000
C1O
ACET
W/O
80M
UN
0.997
0.989
0.000
MEAN
ACET
w/O
80M
0.957
0.871
0.000
C10
GOOD
w/O
80M
C100
0.700
0.547
0.542
C10
GOOD
W/O
80M
SVHN
0.757
0.589
0.569
C10
GOOD w/O
80M
UN
0.995
0.992
0.990
MEAN
GOOD
W/O
80M
0.817
0.709
0.700
C10
FROBINIT W/O
80M
C100
0.760
0.760
0.560
C10
FROBINIT W/O
80M
SVHN
0.836
0.836
0.648
C10
FROBINIT W/O
8OM
UN
0.985
0.985
0.945
MEAN
FROBINIT W/O
80M
0.860
0.860
0.718
15

---

Under review as a conference paper at ICLR 2022
Table 5: Robustness sensitivity analysis of FROBInit the number of Outlier Datasets and FS samples. OoD detection performance of FROBInit using FS outliers of variable number and an Outlier Set, evaluated on various sets in AUROC, AAURÓC, and GAUROC. C10 refers to CIFAR-1O, C100 CIFAR- 100, 80M to 80 Million Tiny Images, UN Uniform Noise, and LFN Low Frequency Noise.
NORMAL MODEL
O(z)
OUTLIER, FS
TEST
AUROC
AAUROC
GAUROC
C10
FROBINIT w/o
SVHN:73257
C100
0.829
0.829
0.153
C1O
FROBINIT W/O
SVHN: 3660
C100
0.651
0.651
0.108
C10
FROBINIT W/o
SVHN: 1830
C100
0.614
0.614
0.161
C10
FROBINIT W/O
SVHN: 915
C100
0.512
0.512
0.290
C10
FROBINIT W/O
SVHN: 600
C100
0.328
0.328
0.082
C1O
FROBINIT W/O
SVHN: 400
C100
0.401
0.401
0.098
C10
FROBINIT W/O
SVHN: 200
C100
0.420
0.420
0.106
C10
FROBINIT W/O
SVHN: 100
C100
0.394
0.394
0.002
C10
FROBINIT W/O
SVHN:
C100
0.381
0.381
0.000
C10
FROBINIT w/o
SVHN:73257
SVHN
0.998
0.998
0.990
C10
FROBINIT W/O
SVHN: 7325
SVHN
0.993
0.993
0,960
C10
FROBINIT w/o
SVHN: 3660
SVHN
0.953
0.953
0.923
C10
FROBINIT W/O
SVHN: 1830
SVHN
0.972
0.972
0.909
C10
FROBINIT w/O
SVHN: 915
SVHN
0.824
0.824
0.706
C10
FROBINIT w/O
SVHN: 600
SVHN
0.812
0.812
0.701
C1O
FROBINIT W/O
SVHN: 400
SVHN
0.820
0.820
0.705
C10
FROBINIT w/O
SVHN: 200
SVHN
0.810
0.810
0.702
C10
FROBINIT W/O
SVHN: 100
SVHN
0.798
0.798
0.668
C10
FROBINIT w/O
SVHN:
SVHN
0.781
0.781
0.001
C10
FROBINIT w/O
SVHN:73257
LFN
0.991
0.991
0.934
C10
FROBINIT w/O
SVHN: 7325
LFN
0.992
0.992
0.884
C10
FROBINIT w/O
SVHN: 3660
LFN
0.956
0.956
0.868
C10
FROBINIT W/O
SVHN: 1830
LFN
0.984
0.984
0.890
C10
FROBINIT W/O
SVHN: 915
LFN
0.715
0.715
0.494
C10
FROBINIT w/O
SVHN: 600
LFN
0.702
0.702
0.401
C10
FROBINIT w/O
SVHN: 400
LFN
0.746
0.746
0.426
C10
FROBINIT W/O
SVHN: 200
LEN
0.781
0.781
0.467
C10
FROBINIT w/O
SVHN: 100
LFN
0.717
0.717
0.002
C10
FROBINIT w/O
SVHN: 0
LFN
0.657
0.657
0.000
C10
FROBINIT w/O
SVHN: 915
C100
0.512
0.512
0.209
C10
FROBINIT W/O
SVHN: 915
SVHN
0.824
0.824
0.706
C10
FROBINIT W/O
SVHN: 915
LFN
0.715
0.715
0.494
C1O
FROBINIT W/O
SVHN: 915
UN
0.811
0.811
0.555
16

---

Under review as a conference paper at ICLR 2022
Table OoD performance of FROBInit w/o Ozz) and w/ the Outlier Set 80 Million Tiny Images.
NORMAL MODEL (z)
OUTLIER
TEST
AUROC
AAUROC
GAUROC
SVHN
FROBINIT W/O
80M
C100
0.993
0.993
0.975
SVHN
FROBINIT W/O
80M
C10
0.995
0.995
0.979
SVHN
FROBINIT W/O
80M
LFN
0.963
0.963
0.791
SVHN
FROBINIT W/O
8OM
UN
0.997
0.997
0.984
SVHN
FROBINIT W/O
80M
80M
0.994
0.994
0.979
MEAN FROBINIT W/O
80M
0.988
0.988
0.942
SVHN FROBINIT w/O
80M: 73257
C100
0.992
0.992
0.976
SVHN FROBINIT W/O
80M: 73257
C10
0.994
0.994
0.982
SVHN
FROBINIT W/O
80M: 73257
LFN
0.958
0.958
0.763
SVHN
FROBINIT w/o
80M: 73257
UN
0.996
0.996
0.983
SVHN
FROBINIT W/O
80M: 73257
80M
0.993
0.993
0.987
MEAN
FROBINIT W/O
80M: 73257
0.987
0.987
0.938
C10
FROBINIT w/O
80M
C100
0.760
0.760
0.560
C10
FROBINIT W/O
80M
SVHN
0.838
0.838
0.648
C10
FROBINIT w/O
80M
LFN
0.900
0.900
0.820
C10
FROBINIT W/O
80M
UN
0.985
0.985
0.945
C1O
FROBINIT w/O
80M
80M
0.820
0.820
0.647
MEAN
FROBINIT w/O
80M
0.861
0.861
0.724
C10
FROBINIT w/O
80M: 73257
C100
0.776
0.776
0.644
C10
FROBINIT W/O
80M: 73257
SVHN
0.801
0.801
0.556
C10
FROBINIT W/O
80M: 73257
LFN
0.885
0.885
0.555
C10
FROBINIT w/O
80M: 73257
UN
0.869
0.869
0.849
C10
FROBINIT W/O
80M: 73257
80M
0.838
0.838
0.699
MEAN
FROBINIT w/o
80M: 73257
0.834
0.834
0.661
Table 7: Performance of FROBInit w/ the Outlier Dataset -all data- and w/o using our Ozz).
NORMAL MODEL O
OUTLIER
TEST
AUROC
AAUROC
GAUROC
C10
FROBINIT W/O
SVHN
C100
0.829
0.829
0.153
C10
FROBINIT w/O
SVHN
SVHN
0.998
0.998
0.990
C10
FROBINIT W/O
SVHN
LFN
0.992
0.992
0.924
MEAN
FROBINIT W/O
SVHN
0.940
0.940
0.689
C10
FROBINIT W/O
80M: 73257
C100
0.776
0.776
0.644
C10
FROBINIT W/O
80M: 73257
SVHN
0.801
0.801
0.556
C1O
FROBINIT W/O
80M: 73257
LFN
0.885
0.885
0.555
C1O
FROBINIT W/O
80M: 73257
UN
0.869
0.869
0.849
C10
FROBINIT W/O
80M: 73257
80M
0.838
0.838
0.699
MEAN
FROBINIT W/O
80M: 73257
0.834
0.834
0.661
17

---

Under review as a conference paper at ICLR 2022
Table 8: OoD detection performance of FROB trained the normal class with OE set, using few-shots, and using boundary samples, (zz, tested on different sets in AUROC, AAUROC, and GAUROC. We demonstrate FROB's efficacy and efficiency in Sec. 4.2. Here, "w/ O" means with our learned OoD, O(z), while "w/o O" refers to without our self-generate anomalies, Ozz). Here, C10 refers CIFAR-IO, C100 to SIFAR-100, UN to Uniform Noise, and LFN to Low Frequency Noise.
NORMAL
MODEL
(
OUTLIER, FS
TEST
AUROC
AAUROC
GAUROC
C10
FROB
W/
SVHN: 1830
C100
0.815
0.815
0.128
C10
FROB W/
SVHN: 1830
SVHN
0.997
0.997
0.990
C10
FROB
W/
SVHN: 1830
LFN
0.985
0.985
0.642
C10
FROB
W/
SVHN: 1830
UN
0.915
0.915
0.001
C10
FROB
W/
SVHN: 915
C100
0.834
0.834
0.124
C10
FROB
W/
SVHN: 915
SVHN
0.995
0.995
0.984
C10
FROB
W/
SVHN: 915
LFN
0.986
0.986
0.713
C10
FROB
W/
SVHN: 915
UN
0.699
0.699
0.002
C10
FROB
W/
SVHN: 732
C100
0.829
0.829
0.100
C10
FROB
W/
SVHN: 732
SVHN
0.995
0.995
0.981
C10
FROB
W/
SVHN: 732
LFN
0.992
0.992
0.756
C10
FROB
W/
SVHN: 732
UN
0.805
0.805
0.005
C10
FROB
W/
SVHN: 457
C100
0.827
0.827
0.107
C10
FROB
W/
SVHN: 457
SVHN
0.997
0.997
0.982
C10
FROB
W/
SVHN: 457
LFN
0.995
0.995
0.889
C10
FROB
W/
SVHN: 457
UN
0.914
0.914
0.018
C10
FROB
W/
SVHN: 100
C100
0.846
0.846
0.060
C10
FROB
SVHN: 100
SVHN
0.996
0.996
0.950
C10
FROB
W/
SVHN: 100
LFN
0.991
0.991
0.128
C10
FROB
W/
SVHN: 100
UN
0.949
0.949
0.090
C10
FROB
W/
SVHN: 80
C100
0.837
0.837
0.070
C10
FROB
W/
SVHN: 80
SVHN
0.995
0.995
0.928
C10
FROB
W/
SVHN: 80
LFN
0.981
0.981
0.254
C1O
FROB
W/
SVHN: 80
UN
0.907
0.907
0.020
C10
FROB W/
SVHN: O
C100
0.865
0.865
0.003
C1O
FROB
W/
SVHN: O
SVHN
0.895
0.895
0.023
C10
FROB
W/
SVHN:
LFN
0.924
0.924
0.000
C10
FROB
W/
SVHN: O
UN
0.887
0.887
0.000
18

---

Under review as a conference paper at ICLR 2022
Table 9: OoD performance FROB using an Outlier Set, using few-shots and our boundary, Ozz), tested on different sets in AUROC, AAUROC, and GAUROC, where "w/ O" means with our
learned cumpliiitly-generaaee OoD samples, Ozz). this Table, C10 refers to CIFAR-IO, C100 CIFAR- 100, 80M to 80 Million Tiny Images, UN to Uniform Noise, and LFN to Low Frequency Noise.
NORMAL MODEL O(z)
OUTLIER, FS
TEST
AU
AAU ROC
GAU ROC
DATA
ROC
C10
FROB
80M: 73257, SVHN: 1830
C100
0.850
0.850
0.585
C10
FROB W/
80M: 73257, SVHN: 1830
SVHN
0.994
0.994
0.972
C10
FROB W/
80M: 73257, SVHN: 1830
LFN
0.997
0.997
0.987
C10
FROB
W/
80M: 73257,
SVHN: 1830
UN
0.967
0.967
0.865
C10
FROB
W/
80M: 73257,
SVHN: 915
C100
0.759
0.759
0.090
C10
FROB
W/
80M: 73257,
SVHN: 915
SVHN
0.993
0.993
0.333
C10
FROB
W/
80M: 73257,
SVHN: 915
LFN
0.993
0.993
0.040
C10
FROB
80M: 73257,
SVHN: 915
UN
0.434
0.434
0.010
C10
FROB
W/
80M: 73257,
SVHN: 732
C100
0.715
0.715
0.010
C1O
FROB
80M: 73257,
SVHN: 732
SVHN
0.990
0.990
0.010
C10
FROB
W/
80M: 73257,
SVHN: 732
LFN
0.869
0.869
0.010
C10
FROB
W/
80M: 73257,
SVHN: 732
UN
0.988
0.988
0.010
C10
FROB W/
80M: 73257,
SVHN: 457
C100
0.827
0.827
0.397
C10
FROB W/
80M: 73257,
SVHN: 457
SVHN
0.997
0.997
0.807
C10
FROB W/
80M: 73257,
SVHN: 457
LFN
0.997
0.997
0.841
C10
FROB
W/
80M: 73257,
SVHN: 457
UN
0.914
0.914
0.842
C10
FROB W/
80M: 73257,
SVHN: 100
C100
0.744
0.744
0.427
C10
FROB
W/
80M: 73257,
SVHN: 100
SVHN
0.992
0.992
0.896
C10
FROB
W/
80M: 73257,
SVHN: 100
LFN
0.985
0.985
0.912
C10
FROB
W/
80M: 73257,
SVHN: 100
UN
0.934
0.934
0.911
C10
FROB W/
80M: 73257,
SVHN: 80
C100
0.772
0.772
0,425
C10
FROB W/
80M: 73257,
SVHN: 80
SVHN
0.981
0.981
0.922
C1O
FROB W/
80M: 73257,
SVHN: 80
LFN
0.990
0.990
0.951
C10
FROB W/
8OM: 73257,
SVHN: 80
UN
0.901
0.901
0.788
C1O
FROB W/
80M: 73257,
SVHN: 0
C100
0.864
0.864
0.312
C10
FROB W/
80M: 73257,
SVHN: 0
SVHN
0.927
0.927
0.601
C10
FROB W/
80M: 73257,
SVHN: 0
LFN
0.891
0.891
0.301
C1O
FROB
W/
80M: 73257,
SVHN: 0 UN
0.865
0.865
0.212
19

---

Under review as a conference paper at ICLR 2022
Table 10: OoD performance of FROB with an Outlier Set, using 1830 few-shots and our Ozz).
tested on different sets in AUROC, AAUROC, and GAUROC. We compare to FROBInit w/o O
C10 refers CIFAR-IO, C100 to CIFAR-100, 80M Million Tiny Images, and UN Uniform Noise.
NORMAL
O(z)
OUTLIER OUTLIER, FS
TEST
AUROC
AAUROC
GAUROC
C10
W/
NONE
SVHN: 1830
C100
0.815
0.815
0.128
C1O
W/
NONE SVHN: 1830
SVHN
0.997
0.997
0.990
C10
W/
NONE
SVHN: 1830
LFN
0.985
0.985
0.642
C10
W/
NONE
SVHN: 1830
UN
0.915
0.915
0.010
C10
W/O
NONE
SVHN: 1830
C100
0.546
0.546
0.238
C10
W/O
NONE
SVHN: 1830
SVHN
0.847
0.847
0.728
C10
W/O
NONE
SVHN: 1830
LFN
0.742
0.742
0.528
C10
W/O
NONE
SVHN: 1830
UN
0.834
0.834
0.586
C10
W/
80M
SVHN: 1830
C100
0.825
0.825
0.570
C10
W/
80M
SVHN: 1830
SVHN
0.994
0.994
0.980
C10
W/
80M
SVHN: 1830
LFN
0.995
0.995
0.992
C10
W/
80M
SVHN: 1830
UN
0.863
0.863
0.800
C10
W/O
80M
SVHN: 1830
C100
0.725
0.725
0.129
C10
W/O
80M
SVHN: 1830
SVHN
0.983
0.983
0.970
C1O
W/O
80M
SVHN: 1830
LFN
0.985
0.985
0.699
C10
W/O
80M
SVHN: 1830
UN
0.838
0.838
0.100
Table 11: Performance of FROB trained normal CIFAR-10 10 using Outlier Set, using few-shots
(FS) and learned boundary samples, Ozz), evaluated AUROC, AAUROC, and GAUROC.
NORMAL O(z)
OUTLIER OUTLIER, FS
TEST
AUROC
AAUROC
GAUROC
C10
W/
NONE
SVHN: 915
C100
0.834
0.834
0.124
C1O
W/
NONE
SVHN: 915
SVHN
0.995
0.995
0.984
C10
W/
NONE
SVHN: 915
LFN
0.986
0.986
0.713
C10
W/
NONE
SVHN: 915
UN
0.699
0.699
0.020
C10
W/O
NONE
SVHN: 915
C100
0.512
0.512
0.209
C10
W/O
NONE
SVHN: 915
SVHN
0.824
0.824
0.706
C10
w/O
NONE
SVHN: 915
LFN
0.715
0.715
0.494
C10
w/O
NONE
SVHN: 915
UN
0.811
0.811
0.555
C10
W/
80M
SVHN: 915
C100
0.744
0.744
0.413
C10
W/
80M
SVHN: 915
SVHN
0.988
0.988
0.969
C10
W/
80M
SVHN: 915
LFN
0.990
0.990
0.935
C10
W/
80M
SVHN: 915
UN
0.612
0.612
0.224
C10
W/O
80M
SVHN: 915
C100
0.722
0.722
0.554
C1O
W/O
80M
SVHN: 915
SVHN
0.988
0.988
0.969
C1O
W/O
80M
SVHN: 915
LFN
0.988
0.988
0.974
C10
W/O
80M
SVHN: 915
UN
0.743
0.743
0.655
20

---

Under review as a conference paper at ICLR 2022
Table 12: OoD performance of FROB trained with O(z), SVHN 100 few-shots, and Outlier Set.
NORMAL
MODEL O
OUTLIER, FS
TEST
AUROC
AAUROC
GAUROC
C10
FROB W/
SVHN: 100
C100
0.846
0.846
0.060
C10
FROB W/
SVHN: 100
SVHN
0.996
0.996
0.950
C10
FROB
W/
SVHN: 100
LFN
0.991
0.991
0.128
C10
FROB W/
SVHN: 100
UN
0.949
0.949
0.090
C10
FROB
W/
80M:73257,
C100
0.744
0.744
0.427
SVHN:
C10
FROB W/
80M:73257,
SVHN
0.975
0.975
0.896
SVHN:100
C10
FROB
W/
80M:73257.
LFN
0.985
0.985
0.912
SVHN:100
C10
FROB
80M:73257,
UN
0.934
0.934
0.911
SVHN:100
C10
FROB W/
80M:73257
C100
0.846
0.846
0.010
C10
FROB
W/
80M: 73257
SVHN
0.872
0.872
0.050
C10
FROB
W/
80M:73257
LFN
0.900
0.900
0.005
C10
FROB
W/
80M:73257
UN
0.873
0.873
0.005
C10
FROB W/
C100 & SVHN:100
C100
0.740
0.740
0.452
C10
FROB W/
C100 & SVHN:100
SVHN
0.978
0.978
0.913
C10
FROB W/
C100 & SVHN:100
LFN
0.990
0.990
0.959
C10
FROB
C100 & SVHN:100
UN
0.887
0.887
0.857
Table 13: Ool performance of FROB trained with O 80 SVHN few-shots, and Outlier Set.
NORMAL
((2)
AUROC
AAUROC
GAUROC
C10
FROB
SVHN: 80
C100
0.837
0.837
0.070
C10
FROB W/
SVHN: 80
SVHN
0.995
0.995
0.928
C10
FROB
W/
SVHN: 80
LFN
0.981
0.981
0.254
C10
FROB
W/
SVHN: 80
UN
0.907
0.907
0.020
C10
FROB W/
80M:73257, SVHN:80
C100
0.765
0.765
0.345
C10
FROB
W/
80M:73257, SVHN:80
SVHN
0.981
0.981
0.904
C10
FROB
W/
80M:73257, SVHN:80
LFN
0.990
0.990
0.929
C10
FROB
W/
80M:73257, SVHN:80
UN
0.781
0.781
0.179
C10
FROB W/
80M: 73257
C100
0.846
0.846
0.010
C10
FROB W/ 80M: 73257
SVHN
0.872
0.872
0.050
C10
FROB
W/
80M: 73257
LFN
0.900
0.900
0.005
C1O
FROB
W/
80M: 73257
UN
0.873
0.873
0.005
21

---

Under review as a conference paper at ICLR 2022
Table 14: OoD detection performance of FROB trained on normal SVHN using an Outlier Dataset, few-shot outliers, and the self- self-generated boundary samples, OZz), evaluated on different sets in AUROC, AAUROC, and GAUROC. In this Table, "w/ O" means using the learned samples O(z).
NORMAL
MODEL
((z)
OUTLIER, FS
TEST
AUROC
AAUROC GAUROC
SVHN
FROB
W/
C10: 600
C100
0.991
0.991
0.956
SVHN
FROB W/
C10: 600
C10
0.996
0.996
0.982
SVHN
FROB
W/
C10: 600
LFN
0.914
0.914
0.381
SVHN
FROB
W/
C10: 600
UN
1.000
1.000
0.998
SVHN
FROB
W/
C10: 400
C100
0.989
0.989
0.930
SVHN
FROB
W/
C10: 400
C10
0.994
0.994
0.964
SVHN
FROB
W/
C10: 400
LFN
0.923
0.923
0.375
SVHN
FROB
W/
C10: 400
UN
0.997
0.997
0.978
SVHN
FROB W/
C10: 200
C100
0.990
0.990
0.941
SVHN
FROB W/
C10: 200
C10
0.996
0.996
0.967
SVHN
FROB W/
C10: 200
LFN
0.947
0.947
0.573
SVHN
FROB
W/
C10: 200
UN
0.999
0.999
0.998
SVHN
FROB W/
C10:
C100
0.967
0.967
0.911
SVHN
FROB W/
C10: 80
C10
0.991
0.991
0.951
SVHN
FROB W/
C10: 80
LFN
0.951
0.951
0.597
SVHN
FROB W/
C10: 80
UN
0.989
0.989
0.967
SVHN
FROB W/
C10:
C100
0.951
0.951
0.000
SVHN
FROB W/
C10:
C10
0.958
0.958
0.000
SVHN
FROB W/
C10:
LFN
0.961
0.961
0.000
SVHN
FROB
W/
C10:
UN
0.975
0.975
0.000
Table 15: OoD performance of FROB with the boundary, O(z), in AUROC using One-Class Classification (OCC) and FS so CIFAR-10 OCC anomalies. Comparison with benchmarks in this 80 few-shot setting (Sheynin al., 2021). FWODS refers to FROB with (w/) Outlier Dataset SVHN.
NORMAL DROCC GEOM
GOAD
HTD
SVDD
PASVDD
FROB
FWOES
PLANE
0.790
0.699
0.521
0.748
0.609
0.340
0.811
0.867
CAR
0.432
0.853
0.592
0.880
0.601
0.638
0.862
0.861
BIRD
0.682
0.608
0.507
0.624
0.446
0.400
0.721
0.707
CAT
0.557
0.629
0.538
0.601
0.587
0.549
0.748
0.787
DEER
0.572
0.563
0.627
0.501
0.563
0.500
0.742
0.727
DOG
0.644
0.765
0.525
0.784
0.609
0.482
0.771
0.782
FROG
0.509
0.699
0.515
0.753
0.585
0.570
0.826
0.884
HORSE
0.476
0.799
0.521
0.823
0.609
0.567
0.792
0.815
SHIP
0.770
0.840
0.704
0.874
0.748
0.440
0.826
0.792
TRUCK
0.424
0.834
0.697
0.812
0.721
0.612
0.744
0.799
MEAN
0.585
0.735
0.562
0.756
0.608
0.510
0.784
0.802
22


Reviews:
[{"review_id": "ql4HrYu7sgk", "reviewer": "Reviewer_r838", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n - The proposed method achieves new SOTA results for OOD detection\n - The use of a generator for class boundary confidence training is novel/interesting\n\nWeaknesses:\n - The paper is quite difficult to read. Many lines are repeated in slightly varied ways; 20% of the lines could be removed to enhance clarity and to be more concise.\n - The proposed method is not well described in the main text. Specifically, equation 1 appears incorrect, as the numerator in term 2 is a vector of class logits \"f(Z_m)\". The model and training setup for O(z) is hard to follow and also appears incorrect as well. Equation 2 term 1 has \"j!=i\" yet i does not appear in the equation. z_j is not defined, is it the feature representation of the j-th outlier? The intuition of terms 2 and 3 is unclear, more details on exactly what each of the 3 terms are providing to the O model would increase clarity significantly.\n - Two of the primary metrics, AAUROC and GAUROC, are not defined. Both of those metrics are designed around adversarial perturbations, which is not clear how it applies to this work.\n- Table 1 has misreported metrics. Cifar10 with OE outperforms FROB on each individual dataset when looking at table 4 in the appendix.\n- The outlier dataset size appears to be randomly selected/cherry picked. How did the authors choose the 1830 SVHN examples or 73257 80M examples? \n- The final results of using various Outlier datasets are very strange. The results in table 12, C10 vs. C100 are non-intuitive to me. Why is it that using 100 SVHN examples gives the exact same AUC as 70k examples from 80M?\n- The main discussion of the results has several pointers to large appendix tables, making comparison of results difficult and must remind the authors appendix reading is supposed to be optional, where the main text is self-supported.\n- Finally, the overall results are not a fair comparison between methods. Specifically, how does OE perform when it only accesses the same number of outlier examples as FROB? Without data like this, I cannot evaluate the efficacy of FROB.\n\nAdditionally, the paper often uses 80M tiny images dataset, which has been retracted by the original creators.\n\nPost rebuttal:\nI do not feel as though many of my concerns have been addressed, and I will be keeping my original score.\n- I still don't understand the model and training setup for O(z). I do not even know if O(z) is an MLP or CNN.\n- The focus on AAUROC and GAUROC is misplaced. Hein's work with these metrics is somewhat related, but I do not think they are appropriate for evaluation with FROB.\n- Too much information is being used from the appendix as primary reference material\n- It still seems normal outlier exposure is a better choice on average than FROB, that is, I am still not sure what the guidelines are for choosing FROB over OE.\n- 80 Million Tiny Images is inappropriate to develop new algorithms with. Other conferences (NuerIPS) will desk reject any papers using this dataset.", "summary_of_the_paper": "This paper introduces a Few-shot OOD classification model, named FROB. Using self-supervised learning and generative model for enhanced confidence on class boundary, they achieve SOTA results compared to other similar OOD detection methods.", "summary_of_the_review": "While this paper offers an interesting angle into OOD detection with few shot examples, several flaws regarding writing/methodology/results must be addressed before this work is ready for publication.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "UTfKswe9pVl", "reviewer": "Reviewer_94aV", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper is generally well-written and well-structured. The experimental results are sufficient. ", "summary_of_the_paper": "This paper focuses on classification and Out-of-Distribution (OoD) detection in the few-shot setting. They propose the Few-shot ROBust (FROB) model for classification and few-shot OoD detection. ", "summary_of_the_review": "Generating low-confidence samples from random vectors is a common practice. All the terms in Eqn. (2), which is the key component of the proposed method, are trivial. The technical novelty and contribution of the proposed method is somewhat weak. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "TBvxvjMoSCc", "reviewer": "Reviewer_qcc7", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is generally well written and addresses an important issue of OoD detection combined with few-shot scenario.\nThe task is definitely very practical, of importance to the ML community, and with real world applications.\n\nThe proposed loss function. The only novel aspect would be the second term minimizing the softmax predictions for OoD samples. It would be good to compare it to existing, very similar loss functions in the OoD community such as [1, 2] where the intention is to penalize high softmax scores for OoD samples. What is the differentiating factor here?\n\nGeneration of adversarial examples. I am lacking here a deeper comparison to existing methods utilizing adversarial examples in a similar fashion (as close to border negatives) [3,4]. It is possible that the proposed approach is significantly different, however lack of comparisons and description does not allow to assess that.\n\nIn the reference section I am also missing a general discussion on adversarial methods and open-set approaches.\n\nSince the authors pursue the few-shot OoD task, I believe it would be crucial to underline the difference from few-shot open-set classification/recognition (such as [2]). Quick scholar search shows multiple papers in the topic that I believe to be of high relevance here. They also establish benchmark datasets to be the datasets from few-shot classification such as miniImageNet, CUB or tinyImageNet rather than CIFAR-10 and SVHN which are good as a proof of concept, but require a more modern and difficult dataset to back them up. \n\nThe experiments and ablation studies seem interesting and well thought, however I am lacking some deeper explanation between non-obvious numbers present in the paper describing chosen amount of training data (e.g., 915, 1830, 73257). There might be an easy explanation there, but without it they seem quite random. \n\n[1] Dhamija, Akshay Raj, Manuel Günther, and Terrance E. Boult. \"Reducing network agnostophobia.\" Proceedings of the 32nd International Conference on Neural Information Processing Systems. 2018.\n\n[2] Liu, Bo, et al. \"Few-shot open-set recognition using meta-learning.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.\n\n[3] Kim, Jaehyung, Jongheon Jeong, and Jinwoo Shin. \"M2m: Imbalanced classification via major-to-minor translation.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.\n\n[4] Kozerawski, Jedrzej, et al. \"BLT: Balancing Long-Tailed Datasets with Adversarially-Perturbed Images.\" Proceedings of the Asian Conference on Computer Vision. 2020.", "summary_of_the_paper": "The paper addresses an important issue of Out-of-Distribution detection in a few-shot setting. The authors propose to generate negative samples in an adversarial way to increase the OoD performance. Additionally they augment the loss function with additional term for OoD samples. They perform experiments of 2 benchmark datasets: CIFAR-10 and SVHN.", "summary_of_the_review": "The paper touches interesting problem and proposes a valid solution, however lack of comparison with adversarial and few-shot open-set methods raises some questions as to novelty and quality of the experimental results. Additionally, experiments on more modern datasets should be performed, since CIFAR-10 and SVHN are quite simple.\n\nPost-rebuttal: The lack of deeper discussion on related work, the lack of comparisons and modern datasets still causes me to keep my initial score. I believe more work needs to be done in order for it to be accepted. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "9Gww1a-lFZ", "reviewer": "Reviewer_1PDU", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths: the proposed method provides an improved version of outlier exposure (OE) method, by combining the self-generated boundary with the general outliers like 80M tiny images. \n\nWeakness:\n1. The main method is not clear to me, in particular, \n\nIn Eq (1), it is not clear which class is the f(Z_m) in the second term refers to. \nIn Eq (2), it is not explained what are i and j.\n\n2. The results are not clearly presented.\n\nIn Figure 2, the curve for CIFAR-100 starts from a AUROC number below 0.5, i.e. when there is no outlier exposure, the model trained on CIFAR10 cannot distinguish between CIFAR-10 test and CIFAR-100 test. That’s strange because the current SOTA AUROC based on a wide resnet model is already around 0.95 [1]. Similarly, the current SOTA AUROC for SVHN is at least 0.91 (see Table 7 in [2]), while the value indicated in Figure 2 is only around 0.6. \n\n[1] Hongjie Zhang, Ang Li, Jie Guo, and Yanwen Guo. Hybrid models for open set recognition. European Conference on Computer Vision, 2020.\n[2] Hendrycks, Dan, Mantas Mazeika, and Thomas Dietterich. \"Deep anomaly detection with outlier exposure.\" arXiv preprint arXiv:1812.04606 (2018).)\n\n3. The usage of the term few-shot is not well suited.\n\nThe paper claimed their method is for few-shot OE. But the results show that \"The FROB performance decreases with reducing number of SVHN fewshots. A small AUROC of 0.5 is reached for approximately 800 few-shots for CIFAR-100..\",  “for few-shots less than 1800, the modeling error of OE covering the full complement of the support of the normal class is high”. In my opinion, 800/ 1800 images for training should no longer be called as few-shot. \n\n4. The conclusion needs to be adjusted.\n\nI found the mean AUROC value in Table 4 for FROB was computed wrongly. It seems that OE, CEDA, and ACET all have higher mean AUROC than FROB. Also, in particular for near-OOD benchmark CIFAR-10 vs CIFAR-100, FROB only has 0.76 AUROC, much lower compared with 0.924 for OE.\n\n5. The effect of adding the generated boundary points O(Z) is not clear. \n\nIn Table 2, it would be good if you can provide OCC {FROB, FROB W/ OE SVHN} {w/ O(z), w/o O(z)} for direct study the effect of OE and O(z). \n\n", "summary_of_the_paper": "The paper proposes to generate the support boundary of the normal class distribution and combine it with few-shot Outlier Exposure (OE) to improve the OOD detection performance. The proposed method is evaluated at multiple benchmark datasets, and is compared with a few baseline methods. ", "summary_of_the_review": "The paper proposes an interesting method for combining generated OOD that is customized to the training data with the general natural outlier images for outlier exposure. However, the paper needs to be further polished such that the method and results can be clearly presented. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes few-shot robust (FROB) model for classification and few-shot OOD detection. While the paper has some interesting contributions, all the reviewers felt that the current version falls short of the ICLR acceptance threshold and the consensus decision was to reject. I encourage the authors to revise the paper based on the reviewers' feedback and resubmit to a different venue.

As Reviewer r838 pointed out, that this paper uses TinyImages dataset which has been since retracted. I appreciate that prior work used TinyImages, but please see "Why it is important to withdraw the dataset" https://groups.csail.mit.edu/vision/TinyImages/ and consider not using the TinyImages dataset for future revisions.
Decision: Reject