Classification and Uncertainty Quantification of Corrupted Data using Semi-Supervised Autoencoders
Authors: Philipp Joppich
Sebastian Dorn
Oliver De Candido
Wolfgang Utschick
Jakob Knollmüller
Venue: ICLR 2022 Submitted (2022)

Abstract: Parametric and non-parametric classifiers often have to deal with real-world data, where corruptions like noise, occlusions, and blur are unavoidable – posing significant challenges. We present a probabilistic approach to classify strongly corrupted data and quantify uncertainty, despite the model only having been trained with uncorrupted data. A semi-supervised autoencoder trained on uncorrupted data is the underlying architecture. We use the decoding part as a generative model for realistic data and extend it by convolutions, masking, and additive Gaussian noise to describe imperfections. This constitutes a statistical inference task in terms of the optimal latent space activations of the underlying uncorrupted datum. We solve this problem approximately with Metric Gaussian Variational Inference (MGVI). The supervision of the autoencoder’s latent space allows us to classify corrupted data directly under uncertainty with the statistically inferred latent space activations. Furthermore, we demonstrate that the model uncertainty strongly depends on whether the classification is correct or wrong, setting a basis for a statistical "lie detector" of the classification. Independent of that, we show that the generative model can optimally restore the uncorrupted datum by decoding the inferred latent space activations.

Under review as a conference paper at ICLR 2022
CLASSIFICATION AND UNCERTAINTY QUANTIFICATION OF CORRUPTED DATA USING SEMI- SUPERVISED AUTOENCODERS
Anonymous authors Paper under double-blind review
ABSTRACT
Parametric and non-parametric classifiers often have to deal with real-world data, where corruttions like noise, occlusions, and blur unavoidable posing signifi- cant challenges. We present a probabilistic approach to classify strongly corrupted data and quantify uncertainty, despite the model only having been trained with uncorrupted data. A semi-supervised autoencoder trained on uncorrupted data is the underlying architecture. We use the decoding part as a generative model for realistic data and extend it by convolutions, masking, and additive Gaussian noise describe imperfections. This constitutes a statistical inference task in terms of the optimal latent space activations of the underlying uncorrupted datum. We solve this problem approximately with Metric Gaussian Variational Inference (MGVI). The supervision of the autoencoder's 's latent space allows us to classify corrupted data directly under uncertainty with the statistically inferred latent space activa- demonstrate that the model uncertainty strongly depends
tions. Furthermore, on whether the classification is correct or wrong, setting a basis for a statistical "lie detector" of the classification. Independent of that, show that the generative model can optimally restore the uncorrupted datum by decoding the inferred latent space activations.
INTRODUCTION AND MOTIVATION
Many real-world applications of data-driven classifiers, e.g., neural networks, involve corruptions that pose significant challenges to the pretrained classifiers. Often, the corruption must previously be included, and thus already be known, during the process of training. For instance, noise (e.g., due to sensor imperfections) and convolutions (e.g., due to lens flares unfocused images) are inevitable in image processing systems and may occur spontaneously and irregularly. The same holds for masking, which may occur when foreign object occludes the actual object of interest (e.g., water droplets or dirt or scratches on the camera lens).
Hence, we aim to answer the following question in this paper: How can we classify corrupted data with a parametric classifier trained exclusively on uncorrupted data? As classifying corrupted data naturally demands measure of uncertainty for validation (corruption may, in the worst case, lead to a total loss of information), we include both model uncertainty 8m and reconstruction uncertainty 8, in the classification. We refer to 6,, as the model's confidence the classification itself. In contrast, we refer to 8, as the confidence of the process on reconstructing the latent space activations given some corrupted datum. An overview of the proposed method is illustrated Figure
2 CLASSIFICATION AND UNCERTAINTY QUANTIFICATION OF CORRUPTED DATA
2.1 METHODOLOGY OVERVIEW AND RELATED WORK
To address the challenge of classification and uncertainty quantification of corrupted data, we propose the following core approach, illustrated in Figure 2

---

Under review as a conference paper at ICLR 2022
d = mCa +n
H. + o & (())
8m 8r
g(H)
4
4
10
LEE
0 0122 65889
0 0123456700
Figure I: From left to right: Ground truth image æ in the data space, corrupted image d in the data space (random masking m, Gaussian blur C. additive white Gaussian noise nt), posterior mean H in the latent space with reconstruction uncertainty ö,, model uncertainty 5., and the restored image g(Z) (decoded posterior mean) in the data space. We have included the encoding of the uncorrupted data f(x) (illustrated by the shaded white bars in the third column). Top row: data sample from the MNIST-dataset (ground truth label: 4), Bottom row: data sample from the Fashion-MNiiST-ataaee (ground truth label: 2 (pullover)). We can classify d using the posterior mean H as the autoencoder's latent space is supervised (note the highlighted max. activation responsible for classification). We able to classify and quantify model uncertainty 8,, with the Mahalanobis -iitobnn-dd in the latent space (note the highlighted min. activation responsible for classification). Strong overlapping for the Fashion-MNIST-eee -xappe of the 1 error bars of 6, across different classes indicates that reliable and confident classification is possible due to heavy corruption.
L In the first step, we train semi-supervisce autoencoder (Le et al. 2018) that is: (a) capable of classifying the input data with its latent space activations h, and (b) capable of decoding the (supervised) latent space activations to generate to the input. Except for these two constraints (a) and (b), we do not impose any further restrictions on the autoencoder and train it as standard feedforward neural network.
data, targeting it to be identical
2 In the second step, we decouple the decoder g from the autoencoder and treat the decoder as a fixed generative function g. Neither retraining nor further modifying of is done in the following steps.
3 In the third step, we include g in an ADDITIVE WHITE GAUSSIAN NOISE (AWGN) channel- model d mC + This AWGN channel model additionally involves heavy corruption like convolution C' and masking m.
4 In the final step, we approximate the posterior probability distribution P(h|d) in the latent space, and derive the mean and standard deviation, corresponding optimally some uncorrupted datum g(h), given the corrupted datum d. Due to supervision at the latent space, this reconstruction enables a direct classification of d including model and reconstruction uncertainty quantification, even though the decoding function was trained on uncorrupted data.
We use a set of samples H. from the approximate posterior probability distribution determine the sampling mean mean H) = H as well as the set's 's reconstruction uncertainty o, with the sampling standard deviation std(()) Samples are statistically inferred by METRIC GAUSSIAN VARIATIONAL.
INFERENCE (MGVI) (Knolmüülerr & Enβlin 2020).
In addition to reconstruction uncertainty 8,,, we determine the model uncertainty by calculating the MAIIALANOBIS-
(M-distance) (De Maesschalck et al.) 2000) in the latent space represen- tation, slightly different to Lee et al. (2018). For details of our implementation, see Algorithm 2 in the appendix. We here distinguish between reconstruction uncertainty 8, and model uncertainty 8m to evaluate the confidence of the process of inferring h and to evaluate the confidence of the classification given by the supervised latent space, respectively.
2

---

Under review as a conference paper at ICLR 2022
[784]
[764]
[764]
[512]
[512]
[208]
[206]]
[128]
[10]]
[128]
g(A)
P(hid
VARIATIONAL INFERENCE
N B2 R
Figure Concept visualization: Steps involved in classifying corrupted data and quantifying uncertainty of the reconstruction, as described in Section The arrow from d to P(h d)) graphically illustrates the process of statistically inferring the latent space activations from corrupted data d using MGVI. H includes all samples drawn from the posterior distribution in the latent space. Subsequently, the sampling mean and sampling standard deviation are determined from H to classify corrupted data samples and quantify their reconstruction uncertainty. Model uncertainty is determined via the Mahalanobis distance in the latent space. We do not depict convolution C' and masking m in the figure above for simplicity.
Similarly to our approach, Böhm al. (2019) and Böhm & Seljak (2020) have shown that the reconstruction of the latent space by posterior inference and by using generative models ((Adler & Oktem 2018). (Seljak & Yu 2019). (Wu al. 2018 for corrupted datum can lead to an optimal image restoration with uncertainty quantification. These methods do, however, not focus on classifying the corrupted datum in the latent space, nor using supervised autoencoder structures.
In the field of quantifying uncertainties of classifications there exist several methods. Predominantly BAYESIAN NEURAL NETWORKS (BNNs) including neural network ensembling ((Depeweg et al. 1995), PPearee al. 2020g) and MONTE CARLO-dropout (MC dropout) (Gal & 2017). (Naal
Ghahramani 2016) have lately shown success. More recently, EVIDENTIAL DEEP LEARNING
(Sensoy et al. 2018) was introduced yet another probabilistic method quantify classification
uncertainty. The latter two methods will be compared to our method in Section 3
Finally, various methods to perform image restoration exist in the literature (see (Dong et al. 2012). (Lehtinen et al. 2018). (Mao et al. 20166), (Mao et al. 2016b). (Zoran & Weiss] 201 Similar the well-known denoising autoencoder (Vincent al. 2008), almost all methods require prior knowledge of the corruption to be included in the training data. We argue that these methods lack flexibility, as they deal with one specific type of corruption. Once the model trained, one cannot include other corruption types without retraining.
Moreover, many methods focus either classification or eliminating corruption, but none of the named approaches combine both.
2.2 GENERATIVE MODEL AND BAYESIAN INFERENCE WITH NEURAL NETWORKS
The first step of our method to train semi-supervised autoencoder. The autoencoder involves the encoding function f (mapping data E RR to the latent space representation with activations E R² E N) as well as the decoding function g (mapping to the data space representation Rd E N.p >> 2). Parameters of f R² + R and g R= RD optimized via combination two loss terms Lyf (representing reconstruction loss in the data space) and L.j (representing classification loss in the latent space):
LSAE = Lat (g( (x)), x) + C,((()) = Cas x) + (h()
(1)
where j denotes the number of dimensions h that are supervised, i.c., h = [h..... hy]. The number of classes to be classified equals j. After normalizing all data samples (i.e., pixel values range
3

---

Under review as a conference paper at ICLR 2022
in between [0. 1)), use the corresponding cross-entropy for each respective loss term penalize false classifications in the latent space and inaccurate reconstructions in the data space. The binary cross-entropy represents the reconstruction loss, while we use the sparse categorical cross-entropy on integer labels = [0. 1, 1,...... 9] to represent the classification loss. Note that for training, we process the latent space activations h through the softmax-function before feeding them to the sparse categorical cross-entropy. However, the softmax-functin is not included as an activation function in our neural network. We minimize the general loss function Equation I using Adam optimizer
(Kingma & Ba 2015
Once the training procedure has converged, we decouple the decoding function g from the autoencoder and extend it to model different types of corruption (this is necessary as the decoder is trained on uncorrupted data). Without loss of generality, we use an AWGN model including the nonlinearity g()), which additionally involves masking m and convolution C' on g:
d= mCghh) + n.
In the data space, additive white Gaussian noise, n E Rp ~ (D,, E..) is applied to the decoded latent space signal g(h), which yields the corrupted data d E IRP. Note for the implementation of h = Ag + Mh, the reparametrization trick Kingma & Welling (2014) is applied
In addition to AWGN, we include corruptions of masking m and convolutions C, which are both linear operations. See the Appendix A for details on the implementation of n, m and C.
Since we are interested in reconstructing the latent space activation h from d alongside uncertainty quantification, the goal is to determine the posterior distribution P(hld) x P)dth))(h)) The log- log-probability distribution reads
1 2 (d- "I (d-mCg(h)) + (aal))++(""""")) (h"Er/'h) + const.,
-ln P(hld)
(3)
where (.)T denotes the matrix transpose. Since we are finally interested in the analytically intractable
mean of h. (h) P(hid) =f h dddh,, we approximately determine mean and variance of P(hdd by applying MGVI. Similar to other variational inference methods (Kingma & Welling 2014).. Kucukelbir et al. (017)), MGVI approximates the distribution by a simper, but tractable distribution from within variational family, Q(h). The parameters of Q(h), i.e., mean 1j and covariance A, are obtained by the minimization of the variational lower bound. The size of a full variational covariance scales quadratically with the number of latent variables. Taking these limitations into account, employ MGVI, which locally approximates the target distribution using the inverse Fisher metric as an uncertainty estimate around the variational mean v). for which optimize. The approximation is represented by an ensemble of samples H {h1, hg,................... h with h, RR, which we use for our analysis. (.) refers to the inferred sample. We here call H. the posterior mean and 8, the posterior standard deviation, or, the reconstruction uncertainty.
2.3 CLASSIFICATION AND UNCERTAINTY QUANTIFICATION
The supervision of the latent space allows us to classify the input d in straightforward manner by evaluating the sampling mean and sampling standard deviation of the set H. While the sampling mean of the set mean (H) H gives the class of the most likely classification, the sampling standard deviation reflects the reconstruction uncertainty 8, of the latent space posterior distribution. 8, depends the type and magnitude of the corruption well as the prior probability distribution include in the channel model (Equation (3b) We visualize this dependency with various experiments, Figure 4 and Figure 10
The straightforward classification does not yet provide information about the model uncertainty on the classification. Since we are additionally interested in the uncertainty of the model, 5m we evaluate the M-distance of all samples in H. to all class conditional distributions in the latent space. The closest class conditional distribution to a single sample h, corresponds to the most likely class. The absolute value of the M-distance to the closest class conditional distribution serves as measure of the
'Tsst accuracy of [98, 6%; 89, 4%] on the encoding function f with [MNIST; Fashion-
En = (((()))) En AA" Σn E x E ~ NO, T), & R² pa = mean( v.)), /46 R.
4

---

Under review as a conference paper at ICLR 2022
D0
bmg
G3
7
8pn
Sing Amg
6mg
-5
10
PC-1
Figure 3: Illustration of the latent space structure a semi sumii-sueereieed autoencoder and the M- distance classifier based MNIST. For this visualization, the 10-dimensional latent space activations are mapped to a wwo-dimensional subspace using a Principal Component (PC) analysis (Wold al. 1987). For arbitrary corrupted datum d, the inferred posterior mean H in the latent space is marked accordingly. To classify H. the M-distance is computed to every cluster the latent space obtain dm, for all classes. The shortest distance arg (6m) serves as the classification. In this concrete example, the given posterior mean H would likely be classified to digit 1, The absolute value of 8n reflects at the same time the model uncertainty w.r.t. each class in the latent space.
model uncertainty 8m In this work, all class conditional distributions in the latent space assumed to follow multivariate Gaussian distributions with covariance Σ; and mean μ4: We determine the parameters of these class conditional distributions by passing the uncorrupted data samples from an independent (i.e., independent of training and testing) dataset Xvaa (see Section 3 through the encoder f. This method is an implementation slightly different to Lee et al. (2018), 8), where was shown that the Mahalanobis metric is not only accurate classifier in this context but also reliable out-of-distte di-ssribbutiin detector reflecting the model uncertainty. Lee et al. (2018) uses tied covariance matrices instead of individual covariance matrices for each class conditional distribution, as done in our method.
Concretely, we calculate the M-distance of all samples in H. to all class-conditional clusters C₁ within the latent space, each characterized by μcc, and Σc, for K-classes. We then determine sampling mean 8n and sampling standard deviation 8, of the M-distances of all samples. This way, we can represent reconstruction uncertainty by the sampling standard deviation (resulting directly from the shape of the inferred posterior distribution) and model uncertainty by the absolute value of the M-distance. For graphical illustration, refer to Figure 3 The pscudo-code is given in Algorithm in the appendix.
2.4 SUMMARY AND LIMITATIONS
We summarize our proposed methodology (Algorithm) I to classify a corrupted datum including uncertainty quantification, which requires the following input addition to d:
m, C: Without loss of generality, here we assume corruption by masking and convolution represented by m and C in the AWGN channel-model, written in Equation (2). The convolution C can be determined with methods proposed by, c.g., Herbel et al. (2018). 10 Hu & de Haan| (2006) and Schlecht al. (2006), occlusion m can be modeled by, e.g.. Li al. (2013) and Rosales & Sclaroff (1998). E Noise covariance matrix. Noise is drawn from Gaussian distribution with covariance Σ,, and mean M4, = D and applied additively to the data Various methods exist to extract E, given (e.g. (Gravel et al. 2004), (Liu et al. 2012), (Russo) 2003)). Σx: Sampling covariance matrix of all (uncorrupted) latent space activations processed by the encoding function f. We use the assumption that autoencoder represent an inherent, uub-dimensional structure of the data in its latent space and assume this sub-dimensional structure to sufficiently follow a multivariate Gaussian probability distribution.
5

---

Under review as a conference paper at ICLR 2022
Algorithm 1: Classification and Uncertainty Quantification of Corrupted Data
Input: Decoder R -> RP; corrupted datum d: noise covariance Σn E RPXP; corruption
models m and C; latent space covariance Σn R=*=
Output: Classification Zd. reconstruction uncertainty ö,, model uncertainty om: reconstruction of uncorrupted datum gH)
Decouple decoder from semi-supervised autoencoder, pretrained on uncorrupted data
Define data model, = mCg(h) +
Approximate P(t(d) with MGVI and store samples in H. = {h1, ha,....,hu, h
Determine the sampling mean of H. (i.e., H) and classify datum directly via M-distance obtain du
Quantify reconstruction uncertainty with sampling standard deviation from H Quantify model uncertainty using M-distance in the latent space
Generate reconstruction of uncorrupted datum g
3 EXPERIMENTS
To experimentally validate our method of classifying corrupted data with supervised autoencoder trained on uncorrupted data, we conduct several experiment: on the MNIST [LeCun 1998) and the Fashion-MNIST (Xiao et al.] 2017) dataset (both MIT-licenses, /https:
owwnspurussssse.. org/ various corruptions types and magnitudes and perform a comparison to MC dropout (Gal & Ghahramani] 2016) and EDL (Sensoy et al. 2018). The following architecture is used for the supervised autoencoder (we the same architecture for both datasets); A feedforward neural network is built with dimensions 78410) 512(1) 256
licenses / /MIT). We evaluate the performance
128(3) 10f4) - 128(5) 256 57 784 where layers {0} - {2) and [4] - (7)
use the SeLU activation function (Klambauer et al., (017), layer {3} linear and layer {8) sigmoid activations. Note that in our case, for simplicity, the number latent space dimensions is equal to the number of supervised classes although neural network with the architecture above on two different datasets, MNIST and Fashion-MNIST.
holds generally. For experiments, we train the
We split each dataset into three subsets, Train (48 10 samples, used for training). Xest (10 10 samples, used for testing and experiments) and Xval (12 10x samples, used for determining Σg. and Ee, ... Σe We use Tensorflow-Kert http: / www. wwwche org hwtpr///lieeeeseeeeeeeeee /LaieeeesIIIIC LIICICECEEEE 2 0) to implement the neural networks and the MGVI implementttinnnonn of NIFTy (Selig et al. 2013) (General Public License, version 3.0, https: /
(Chollet et al., (013) (Apache License, version 2.0,
gnu. http:p/swwww..ooo....//.//e/////
en html) 1) to perform the inference.
3.1 CLASSIFICATION
We visualize experiments (1) (3) in Figure 4 In the first experiment (1), we classify data from an independent test set of the MNIST-dataset corrupted by different noise levels with the proposed method. We compare the accuracy of our method the baseline of processing corrupted data through the encoder of the pretrained autoencoder. We show that we significantly improve the accuracy of classifying corrupted data in comparison to the straightforward classification by f(d). For the second experiment (2), we use the same data samples as for (1) with the exception that we now additionally corrupt the data with window masking (see Appendix for visualization and details) a constant noise level of a = 0.1. Again, we compare the accuracy of our method to the baseline of processing the same data samples through the encoder.
In the third experiment (3), we corrupt the data by convolving them with a Gaussian blur kernel with filter size of 7 and different magnitudes 7 a constant noise level of 0.1.
Experiments (1), (2), and (3) lead to the following conclusions:
The reconstruction uncertainty 8 6 of correct classifications is approximately equivalent to 5 Syate of wrong classifications. thus independent of the classification.
*Code he found here.

---

Under review as a conference paper at ICLR 2022
(2)
(3)
ACC*
6,
ACC
8,
ACC
6,
1.5
ACC, ,CC,
0.8
0.5
Random
0.6
6y
0.4
0.5
Orpate
0.3
0.2
0.5
0.2
0.01
0.1
10
2
10
12
10-1
10
level
Masking level
Convolution level
ACC
4CC
6m
ACC
ACC,
0.8
15
0.8
ACC,
Random
0.6
10
0.6
10
Boog Rep
Smpuks
0.4
0.1
0.2
5
0.2
5
8.01
10
8
10
12
11
10-1
011
10"
10'
Noise level c
Masking level
Convolation level
Figure 4: Accuracy and uncertainty (reconstruction uncertainty 8, and model uncertainty 8.m) of classifications of data samples the MNIST dataset (for Fashion-MNIST see Figure [0 in the Appendix(A) at different noise levels (left column), different masking levels (middle column), and different convolution levels (right column) exploiting the supervised latent space structure (top row) and the M-distance (bottom row) as classifying features.
,CC, serves as the baseline and is the accuracy of the plain encoding function f classifying corrupted data. ACC, corresponds to the accuracy of the method proposed in Section 2.1 Additionally,
distinguish between uncertainties of correct classifications 8, 8 Ô OmTrue and of Talse classifications Orealen 8mpsten
The M-distance and thus 8m strongly depends on the quality of the classification; 8, depends on the the level of corruption and is independent of the classification result. The plot was generated with 1000 test samples for each data point (accordingly corrupted). The standard deviation is averaged over all 1000 samples.
Opposed to ò,. the model uncertainty 8m strongly depends on the correct/wrong clas- sification of the corrupted datum: 8n is significantly and consistently higher for false classifications than for true classifications. This delta in the model uncertainty corresponds to our method's concept of capturing the class conditional distribution density with the M-distance: For wrong classifications, the M-distance is larger because the corrupted sample is dissimilar to samples from its underlying class conditional distribution. This feature sets the basis for statistical "lie detector" (see section 3.2) of classification and thus allows the possibility of various applications: One could pass data of high reconstruction uncertainty to further processing methods, as the process of inference in this case likely faulty. Moreover, it is possible to pass detected false classifications with high model uncertainties to human verification. Fields of application could be the validation of neural networks in, e.g., medical imaging and other safety-critical applications.
Classifying corrupted data through the decoder (rather than the encoder) with suitable channel model considering the corruption significantly improves the model's accuracy without the necessity of retraining the autoencoder. Only for very low noise levels, the direct processing of the corrupted data through ff performs better than our method. We observe a slight loss of accuracy in the process of inference.
Both uncertainties 8, and 6, rise with increasing levels of corruption, expected. Also, the absolute value of the reconstruction uncertainty 8, correlates inversely with the corre- sponding accuracy across all three experiments.
7

---

Under review as a conference paper at ICLR 2022
3.2 DETECTION OF FALSE CLASSIHICATIONS
Finally, in the experiment (4) (see Figure 5). motivated by the results of experiments so far, we validate the model uncertainty of our method by introducing the uncertainty based Receiver Operating Characteristics (U-ROC) curve of detecting false classifications with the M-distance. We evaluate the binary classification task of the two classes "The neural network correctly classifies a corrupted datum" (POSITIVE CLASS) and "The neural network falsely classifies a corrupted datum" (NEGATIVE CLASS). Based on the model uncertainty of our method, we aim to predict the two classes without further knowledge, providing the initially proposed "lie detector". The U-ROC curve is built from the TRUE POSITIVE RATE and the FALSE POSITIVE RATE.
We detect a false classification if the minimum M-distance of reconstructed sample in the latent space is above some threshold value. On the contrary, we detect a correct classification if the minimum M-distance is below the threshold. These threshold values vary for the plot depicted in Figure [ between and 12, being confident at 0 and uncertain at 12. We show by Figure [ that the model uncertainty of our methodology truly reflects the confidence on specific classification, verifying that high model uncertainty correlates with false classifications.
We compare our U-ROC curve with the U-ROC curve of the MC dropout method (Gal & Ghahramani 2016) and with the U-ROC curve of EDL (Sensoy et al. 2018), feeding all methods with the identical input of a datum corrupted by noise at a 0.1, 0.5, 1.0.. Kindly note that this comparison uses the optimized neural network architectures presented in the respective publications, which is different from our simplistic proof-of-concep architecture: Both EDL and MC dropout use the LeNet (Leeun) ct al. 1998) with custom modification $ while we use a significantly simpler feedforward neural network, see Figure 2 Note that our method is not limited to feedforward neural networks and applicable to convolutional neural networks, as well. MC dropout exploits weight-dropout in a neural network to achieve statistically varying outputs of their classifying neural network at the same input over several forward passes. They argue that overlapping output samples indicate high uncertainty in the classification we use the number of overlapping samples as the metric for detecting false classifications (applying 50 repetitions per sample). On the contrary, EDL trains the neural network to learn parameters of a Dirichlet distribution, instead of softmax probabilities. By replacing the standard output of a classification network (softmax) with the parameters of Dirichlet density, EDL represents the predictions of the neural network as a distribution over possible softmax outputs, rather than the point estimate of a softmax output. The output of EDL equals the range of the possible entropies. i.c., [0, lo0( To create the U-ROC curve of EDL, we thus use different thresholds ranging from ( to 1.
We make the following conclusions from experiment (4), Figure 5
Our method seems to outperform MC dropout and EDL detect false classifications given the same data samples at the input for a 0.1 and a = 0.5. One reason for this might be that the M-distance serves as a reliable diitt--dittiibuttinn detector, exploiting the inherent latent space structure of uncorrupted data as a reference, as opposed to MC dropout and EDL. For a = 1.0, both EDL and our method outperform MC dropout, while the AUC of EDL is largest. Here, it should be noted that EDL cannot classify the corrupted data at this noise level (accuracy: 8.9%), resulting in only few samples to test the cases of TRUE POSITIVES and FALSE POSITIVES.
All three methods provide reliable results for detecting false classifications for low noise levels.
The model uncertainty 8m truly reflects the confidence of the classification, i.c., high value of 5,, correlates empirically with a higher probability of false classification.
U-ROC curve combined with the accuracy indicates that EDL seems to overestimate un- certainties, leading to very robust U-ROC curve for high noise levels, but simultaneously leading presence of data corruption to severe drop in the accuracy of the model.
MC dropout: dropout is applied hefore the last fully connected inner-product layer 'EDL: LeNet trained to learn parameters of Dirichlet distribution, instead of softmax probabilities
8

---

Under review as a conference paper at ICLR 2022
U-ROC-Curve a = 0.1
U-ROC-Curve = 0.5
99 gg3s S0S
True Positive Rate
0.8
True Posätive Rate
0.8
0.6
0.6
0.4
0.4
METHOD
ACC
AUC
0.2
Method
0.862
0.904
00
0.1
MC dropout
0.915
0.745
0.2
0.4
0.6
0.8
0.2
0.4
0.6
0.8
EDL
0,666
0.746
False Positive Rate
False Positive Rate
Our Method
0.753
0.881
0.5
MC dropout
0.755
0.555
U-ROC-Curyy 1.0
EDI.
0.125
0.717
Our Method
0,580
0.828
Thue Positive Rate
0.8
1.0
MC dropout
0.570
0.472
Our method
EDL
0.089
0.885
0.6
MC dropout
0.4
EDL
Random
u.2
0
0.2
0.6 0.8 False Positive Rate
0.4
Figure 5: Uncertainty based Receiver Operator Characteristics (U-ROC) of the proposed identifier of false classifications for different noise levels of our method in comparison with MC dropout and with EDI. In this experiment, the formulation of the e.g. "TRUE NEGATIVE" case would be: Based on the uncertainty value, the sample is correctly detected as false classification the "lie detector" works. Samples are taken from the MNIST-dataset. Top left: corrupted datum at a = 0.1. Bottom left: corrupted datum at 1.0. The irregularity in the U-ROC-Cure of the dropout model is due to the stochastic nature MC dropout, Bottom right: Evaluation of Accuracy (ACC) for all given noise values a and the Area under the Curve (AUC) for all U-ROCs.
4 SUMMARY AND FUTURE RESEARCH
We present novel approach to classify heavily corrupted data with parametric classifiers trained on uncorrupted data. As we build our procedure on a probabilistic architecture, we quantify both classification and model uncertainty, allowing for reliable detection of false classifications. We see our method as a highly flexible template that can be applied to any generative neural network to improve performance supervised encoded space, it can classify the data directly. We have shown that the M-distance can independently be used to classify data. Limitations of our method include that the corruption type needs to be modeled.
corrupted data significantly. If the generative neural network comes with
Future research is planned more realistic, real-time, and complex scenarios with strong corruptions, c.g., medical imaging, autonomous driving, or astronomy. Here, potential applications of our method could be image segmentation and object detection via bounding boxes. The method described in Section 2.1 can provide uncertainties of the bounding box and thus of the position of the detected object. This might be useful, e.g., if the object of interest is occluded. A typical situation would be car visually blocking pedestrians at crossing.
5 ACKNOWLEDGEMENTS
Anonymous.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Jonas Adler and Ozan Öktem. Deep Bayesian Inversion. CoRR, abs/1811.05910,, 2018. URL
http://arxiv/ org/ abs/1811.0591
Vanessa Böhm and Uros Seljak. Probabilistic Auto-Encoder. CoRR, abs/220009000 2020. URL
https://arxiv: wwwpg///./0/...././/// 05479
Vanessa Böhm, Francois Lanusse, and Uros Seljak. Uncertainty Quantification with Generative
Models. NeurlPS, 4th workshop on Bayesian Deep Learning, 2019. doi: arXiv:1910, 1.11::1910.00466 URL
https://arxiv/ wttp:/ivv.rrg///////////
François Chollet et al. Keras, https::/keras..i 2015.
Roy De Maesschalck, Delphine Jouan-Rimbaud, and Desire L Massart. The Mahalanobis Distance. Chemometrics and Intelligent Laboratory Systems, 50(1):1-18, 2000. ISSN 0169-7439.
Stefan Depeweg, Jose-Miguel Hemnandez-Lobato, Finale Volei-Velez. and Steffen Udluft. Decom- position of Uncertainty in Bayesian deep Learning for Efficient and Risk-Sensitive Learning. In International Conference on Machine Learning, pp. 1 1184-1192 PMLR, 2017. ISBN 2640-3498.
Weisheng Dong, Lei Zhang, Guangming Shi, and Xin Li. Nonlocally Centralized Sparse Represen- tation for Image Restoration. IEEE Transactions Image Processing, 1244):1620-1630, 2012. ISSN 1057-7149.
Brion Douglas. Code Evidential Deep Learning to Quantify Classification Uncertainty, 2021. URL
Yarin Gal and Zoubin Ghahramani. Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learning. 2016.
Pierre Gravel, Gilles Beaudoin, and Jacques A De Guise. A method for modeling noise in medical images. IEEE Transactions on medical imaging, 23(10):1221-1232. 2004.
Jörg Herbel, Tomasz Kacprzak, Adam Amara, Alexandre Refregier, and Aurelien Lucchi. Fast point spread function modeling with deep learning. Journal of Cosmology and Astroparticle Physics, 201 2018(00) 2018. ISSN 1475-7516.
H. Hu and G. de Haan. Low Cost Robust Blur Estimator. In 2006 International Conference Image Processing, pp. 617-620, 2006. doi: 10. 1011009911222200312111111
Diederik P. Kingma and Jimmy Ba. Adam: A Method for Stochastic Optimization. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URLhttp
/laaxiv.org//eee abs/ wwaaas/1100 1112111111.0 6980
Diederik P. Kingma and Max Welling. Auto-Encoding Variational Bayes. Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference Learning Representations, ICLR 20/4 Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http:
7/ wa..iv.org/abs//3333 6114
Günter Klambauer, Thomas Unterthiner, Andreas Mayr, and Sepp Hochreiter. Self-Normalizing Neural Networks. In Advances in Neural Information Processing Systems, pp. 971-980, 2017.
Jakob Knollmüller and Torsten Enßlin. Metric Gaussian Variational Inference. arXiv pre-print server, 2020. doi: arxiv:1901 1033.
11033
Alp Kucukelbir, Dustin Tran, Rajesh Ranganath, Andrew Gelman, and David M Blei. Automatic Differentiation Variational Inference. The Journal of Machine Learning Research, 1814):330-474 2017. ISSN 1532-4435.
Lei Le. Andrew Patterson, and Martha White. Supervised Autoencoders: Improving Generalization Performance with Unsupervised Regularizers. In Advances in Neural Information Processing Systems, pp. 107-117, 2018.
10

---

Under review as a conference paper at ICLR 2022
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11))2278-2) 2324,, 1998. doi: 10.1109/5.72671.
Yann LeCun. The MNIST database of Handwritten Digits. http://ann. lecun. com/exdb/mnist/, 1998.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A Simple Unified Framework for Detect- ing out-of-Distrbuttion Samples and Adversarial Attacks. In Advances in Neural Information Processing Systems, pp. 7167-7177, 2018.
Jaakko Lehtinen, Jacob Munkberg, Jon Hasselgren, Samuli Laine, Tero Karras, Miika Aittala, and Timo Aila. Noise2Noise: Learning Image Restoration without Clean Data. In Jennifer G. Dy and Andreas Krause (eds.). Proceedings of the 35th International Conference on Machine Learning, ICMI. 2018, Stockholmsmüsssun Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pp. 2971-2980. PMIR, 2018. URL h //proceedings..o mlr prwsspssppp....... v00 1ete0t//eettii in ha..ea..n................m.mmmm.
Bo Li, Wenze Hu, Tianfu Wu, and Song- Chgn Zhu. Modeling occlusion by discriminative and- or structures. Pruceedings of the IEEE International Conference on Computer Vision, pp- 2560-2567, 2013.
Xinhao Liu, Masayuki Tanaka, and Masatoshi Okutomi. Noise Level Estimation Using Weak Textured Patches of Single Noisy Image. In 2012 19th IEEE International Conference on Image Processing, pp. 665-668 JEEE, 2012. ISBN 1467325333.
Xiao-Jiao Mao, Chunhua Shen, and Yu-Bin Yang. Image Restoration Using Very Deep Con- volutional Encoder-Decoder Networks with Symmetric Skip Connections. In Daniel D. Lee, Masashi Sugiyama, Ulrike von Luxburg, Isabelle Guyon, and Roman Garnett (eds.), Advances Neural Information Processing Systems 29: Annual Conference on Neu- ral Information Processing Systems 2016, December 5-10, 2016, Barcelona, Spain, pp. 2802-2810, 2016a. URL
neurips wwtpppppr/...////// 20166/0shhhhh (111779999166666 (1c Abst html
Xiao Jiao Mao, Chunhua Shen, and Yu Bin Yang. Image Restoration Using Convolutional Auto- encoders with Symmetric Skip Connections. CoRR, abs/1606.08921, 2016b. URL ht
arxiv.
Radford M Neal. Bayesian Learning for Neural Networks. Springer, 1995.
Chanwoo Park. Code: Dropout as a Bayesian Approximation, 2019. URL https
com httpbb.coocpppaaacc 02. 0.35000co0tE5eea2222200000222220
/tt.ob//aaater///mm ipynb
Tim Pearce, Felix Leibfried, and Alexandra Brintrup. Uncertainty in Neural Networks: Approximately Bayesian Ensembling. In Silvia Chiappa and Roberto Calandra (eds.), The 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, 26-28 August 2020, Online [Palermo. Sicily, Italy], volume 108 of Proceedings of Machine Learning Research, pp. 234 244. PMLR, 2020. htt::tt::///rceeeilile
m axzess/v088 http:/eeaaeeeaaaaaeeee html
Romer Rosales and Stan Sclaroff. Improved Tracking of Multiple Humans with Trajectory Prediction and Occlusion Modeling. Technical report, Boston University Computer Science Department, 1998.
Fabrizio Russo. A Method for Estimation and Filtering of Gaussian Noise in Images. IEEE Transactions Instrumentation and Measurement, 52(4): (((4):1148111) 148-1154, 2003. ISSN 0018-9456.
Joseph Schlecht, Kobus Barnard, and Barry Pryor. Statistical Inference of Biological Structure and Point Spread Functions in 3D Microscopy. In Third International Symposium on 3D Data Processing, Visualization, and Transmission (3DPVT'06), pp. 373-380, 2006. doi:
3DPPVT.2006.331.
Marco Selig, Michael R Bell, Henrik Junklewitz, Niels Oppermann, Martin Reinecke, Maksim Greiner, Carlos Pachajoa, and Torsten A Enßlin. NIFTY-Numerts Information Field Theory-A versatile PYTHON library for signal inference. Astronomy & Astrophysics, 554:A26, 2013. ISSN 0004-6361.
11

---

Under review as a conference paper at ICLR 2022
Uros Seljak and Byeonghee Yu. Posterior Inference Unchained with EL_ CoRR, 2019. URL arxiv. orq/ abs 13501.04550
Murat Sensoy, Lance Kaplan, and Melih Kandemir. Evidential Deep Learning to Quantify Classifi- cation Uncertainty. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 31, Curran As- sociates, Inc., 2018. URL ptppppppp//p neurips httprr/pp..cccapppp////////L21. 3391220000A400G11111122222022020
Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoine Manzagol. Extracting and composing robust features with denoising autoencoders. Inproceedings of the 25th International Conference Machine learning, pp. 1096-1103, 2008.
Svante Wold, Kim Esbensen, and Paul Geladi. Principal Component Analysis. Chemometrics and Intelligent Laboratory Systems, 2(1-3):37-52, 1987. ISSN 0169-7439.
Ga Wu, Justin Domke, and Scott Sanner. Conditional Inference in Pre-trained Variational Autoen- coders via Cross-coding. CoRR, abs/1805.07785, 2018. URL http:///arxiv.org//abb
1805.07785
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: A Novel Image Dataset for Bench- marking Machine Learning Algorithms. arXiv preprint 17Xiv:1708.0777,,2222 2017.
Daniel Zoran and Yair Weiss. From learning models of natural image patches to whole image restoration. In 2011 International Conference Computer Vision, pp. 479-486, 2011. doi: 11009//CC.2211.61626666222
12

---

Under review as a conference paper at ICLR 2022
A
APPENDIX
A.1
CORRUPTION LAYOUT
Here visualize the effect of the different corruptions, i.e., convolution Gaussian blur C, Figure 8 masking m (Figure Figure(9). and noise n, (Figure(6). We evaluate the effect of different corruption levels on accuracy and confidence, where
a corresponds to the standard deviation of the Gaussian distribution from which noise is drawn, i.e., E, I (I E Rexp is the identity matrix)
3 corresponds to the number columns and rows of pixels set to O, counted from outside inside (i.e., 3 0 means no masking, 3 14 means full image is masked), see figure Figure 7
7 corresponds to the standard deviation of the Gaussian blur kernel with filter size of x pixels.
Note that to the experiments conducted the effect on convolution (Figure 4 right), we added noise at 0.1 For visualization purposes, we do not add noise for Figure
a = 0.01
a = 0.1
a ==
a 10
4
Figure 6: Exemplary visualization of corruption through noise. Experiments cover the entire noise range from 0.01 a 10.
B = 3
β 6
B 9
B = 12
Figure 7: Exemplary visualization isolated masking. Experiments cover the entire masking range from 8 to 14 and additional noise at 0.1. The experiment layout of masking adopted from
7 1
7 1.5
?/ 2
10
4
Figure 8: Exemplary visualization of corruption through convolution. Experiments cover the entire convolution range from 7 0.1 to = 10.
13

---

Under review as a conference paper at ICLR 2022
0. = 3
0.1,3 6
0.1, 9
0.1, 12
Figure 9: Exemplary visualization of different masking levels applied in experiments with additive noise a 0.1 on top. Experiments cover the entire masking range from 3 = 0 to 3 = 14.
A.2 DETERMINATION OF THE MAHALANOBIS-DISTANCE
In addition to the methodology outlined in Section 2.3
present with Algorithm 2 the pseudo-
code of calculating the M-distance of the inferred latent space samples H to determine the model uncertainty 6
Algorithm Classification and Model Uncertainty by Mahalanobis Distance
Input: Set posterior samples H {hr..... hn Pky..., MK; Ec....., Eex Output: Label of Classified Class y. model uncertainty 8m
for n 4- to N: for < to K:
6m [1)n V [hnn Me) E6 1T
D(n} 6 mm
argmin (mmaa (D))
6m
mcan (D)
return 8m.
14

---

Under review as a conference paper at ICLR 2022
A.3 EXPERIMENTS ON FASHION- MNNIST DATA
Finally, we show in Figure 10 the results of the identical experiment layout of Figure with Fashion- MNIST data. Note that trained the neural network with the identical architecture for MNIST data. Besides the general loss in the accuracy due to the retraining of the identical neural network on the more complex Fashion-MNNI MNIST dataset, the results are mostly coherent to Figure 4 In column row 1, we observe that the accuracy does not further decrease for 3 = 8 through 8 = IO. We assume that this is due the nature of the Mishion-MNIST dataset, where the window mask does not take away much information for the affected pixels: Classes such as T-shirt/top, Pullover, Dress, and Coat all usually exhibit the same structure in the affected area of the image.
(3)
ACC
ACCA
6,
ACC*
ACC;
ACC,
0.8
1.5
0.8
Random
0.6
0.6
0.6
6r
0.4
0.4
0.4
Bryate
Brewe
0.2
0.5
0.2
0.2
0.5
8.01
0
0.1
10
10
12
14
10"
10
Noise lovel a
Masking level |
Comvolution level
ACC
6m
ACC
8m
ACC
6m
ACC;
ACC,
0.8
15
0.8
Random
0.6
0.6
6mpus
6m
0.1
10
0.4
10
0.2
0.2
0.2
8.01
0.1
10
10
10"
Noise level
Masking level 0
Convolution
Figure 10: Accuracy and uncertainty (reconstruction uncertainty 8, and model uncertainty 8m) of classifications of data samples the Fashion- dataset (for MNIST see Figure 4 at different noise levels (left column), different masking levels (middle column). and different convolution levels (right column) exploiting the supervised latent space structure (top row) and the M-distance (bottom row) classifying features.
ACC, serves as the baseline and is the accuracy of the plain encoding function f classifying corrupted data. ACC, corresponds to the accuracy of the method proposed in Section 2.1 Additionally, distinguish between uncertainties of correct classifications 8 ÖmTru and of false classifications
8 m
A.4 EXPERIMENT LAYOUT FOR U-ROC CURVE
We the following threshold range for the displayed methods:
The range for U-ROC-Curve of Mahalanobis-Distance [0, 12]
The range for U-ROC-Curve of overlapping samples of MC dropout-model: [0, 50]
The range for the U-ROC-Curve for EDL: [0. 1].
Noise is applied = 00.1: 0.5; 1.0] without further corruption. The AUC calculated using the
trapezoidal rule. Implementation is inspired by Park (009) for MC dropout and by Douglas (2021) for EDL..
15


Reviews:
[{"review_id": "tBWQIk_b2tV", "reviewer": "Reviewer_Hjos", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n1. This paper proposed a novel approach to classify heavily corrupted data with parametric classifiers trained on uncorrupted data.\n2. The proposed method can quantify both classification and model uncertainty, allowing for reliable detection of false classifications. \n3. The authors show that the M-distance can independently be used to classify data.\n\nWeakness:\n1. It lacks extensive empirical validation in real-world datasets.\n2. Some important baselines are missing.\n3. An ablation study is missing.\n", "summary_of_the_paper": "This paper presents a novel approach to classify heavily corrupted data with parametric classifiers trained on uncorrupted data. The proposed method can quantify both classification and model uncertainty, allowing for reliable detection of false classifications. ", "summary_of_the_review": "As this paper did not conduct the theoretical analysis, and the proposed method is some combination of some existing methods, I would expect more extensive empirical analysis in the experiments.\n1. Add more complex datasets, such as CIFAR10, CIFAR100. Note that MNIST and Fashion-MNIST are more like a toy dataset.\n2. As Sec3.1 focuses on classification experiments, it is better to add some baselines related to corrupted data classification.\n3. An ablation study is necessary since the proposed method is a combination of some existing methods.\n\nSome other issues:\n1. The motivation about the M-distance is not clear, why it can be used as model uncertainty to detect OOD.\n\n\n\n\n\n\n\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "hmaABNsqwyW", "reviewer": "Reviewer_SCcY", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros,\n\nThis paper proposes a novel approach that classifies corrupted data.\n\nCons,\n\nThe proposed method is not justified well. The algorithm is a combination of existing methods. For the algorithm, the authors should discuss why each part should be there and what will happen when we replace each part with other techniques. \n\nThis paper is related to Bayesian deep learning, deep Bayesian learning, adversarial attack, adversarial training, calibration, among others. A more comprehensive literature survey is required. \n\nThe experiment section is weak. The experiments provide comparisons only to MC dropout (2016) and EDL (2018). There are more recent algorithms. Moreover, experiments only with MNIST with a single neural net structure are not enough to validate the proposed algorithm. ", "summary_of_the_paper": "This paper proposes a false classification detection method. The proposed method first trains an autoencoder using uncorrupted data to obtain a decoder to define a generative model. The generative model is then exploited for quantifying the uncertainty of the model. Using MGVI, the generative model infers the posterior distribution of the corresponding latent vector for each data. The latent space can explain the model uncertainty, which can be measured by the Mahalanobis distance. From experiments, it is shown that the proposed method can detect corrupted data more accurately compared to MC dropout and EDL for MNIST dataset. \n", "summary_of_the_review": "Overall, this paper provides a heuristic algorithm without any theoretical justification. Then, the experiment section should be very strong to be published. However, the experiment section of this work is not good enough. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "gSXoowaQrVe", "reviewer": "Reviewer_hL2w", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The major concern I have is about the applicability of the method, given the limited experiments provided. In Section 3.1, the proposed method is tested on fairly simple data sets (MNIST and Fashion MNIST) and the baseline method used also relies on the encoding function to classify the input samples. Since the proposed method implies a major modification to commonly used networks for classification (e.g., ResNet), I believe that the authors should make an effort to support the applicability of the proposed technology on more complex data sets, such as CIFAR100 and ImageNet. There, it will be interesting to compare the proposed method to the following baseline: (i) apply an off-the-shelf method for image restoration that also quantifies uncertainty (e.g., using a variant of [1] that also relies on VAE), and (ii) feed the recovered image to a standard classifier to predict the unknown label (can possibly be used to assess prediction uncertainty as well). As far as I understand, the authors estimate the parameters of the corruption model (noise covariance, $m$, and $C$), so it is possible to apply a restoration algorithm given this information.  \n\n[1] Edupuganti V, Mardani M, Vasanawala S, Pauly J. Uncertainty Quantification in Deep MRI Reconstruction. IEEE Trans Med Imaging. 2021 Jan;40(1):239-250.\t\t\n\nIn Section 3.2 (detecting false classification), there are various competitive techniques developed for selective classification, see, e.g., [2], which are not discussed at all. Please compare the performance of the proposed approach to such selective classification methods, and use more complex data sets than MNIST.\n\t\t\t\t\t\t\n[2] Geifman, Yonatan, and Ran El-Yaniv. \"Selectivenet: A deep neural network with an integrated reject option.\" International Conference on Machine Learning. PMLR, 2019.\n", "summary_of_the_paper": "This paper presents a method that simultaneously classifies corrupted data and quantifies uncertainty, despite the model being fitted only on uncorrupted data. The idea is to fit a semi-supervised autoencoder. Then, the encoded representation $h$ is fed into a decoder $g$, and the output $g(h)$ is augmented with various perturbations (additive noise, blur, and masking), resulting in a corrupted image $d$. Lastly, the method of MGVI is used to estimate $P(h \\mid d)$, which is then used both to classify $d$ and to estimate the uncertainty. In experiments, the authors show the advantage of this method over baseline methods.\n", "summary_of_the_review": "The paper presents an interesting application of VAE to the task of image classification with corrupted data. The ability to quantify the uncertainty is important, however, in its current form, the paper only presents a proof-of-concept rather than a technology that can be deployed in real-world applications.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "YZ6H6wOIPlK", "reviewer": "Reviewer_kh1g", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "1) If we have access to the clean training data, another intuitive way is to augment the clean data with corrupted data. How does this heuristic method perform compared with the proposed method? Some references on data augmentation: [1] [2]\n\n2) For the loss of semi-supervised autoencoder (formula 1), do the two losses have the same magnitude? Will it benefit us if we add a parameter to the trade-off between the reconstruction and classification?\n\n3) Since the experiments in this paper focus on simple datasets (e.g., MNIST and Fashion-MNIST), so it is not clear whether the proposed method will be computationally efficient for a large-scale dataset such as ImageNet. Will it introduce significant computational overhead to approximate the posterior probability distribution and calculate the M-distance when latent code is in a much larger dimension?\n\n4) Algorithm 1 is not clear: for example, the input includes the corrupted datum d, however, inside the algorithm, it will create the d again. It is confusing how this algorithm will work during test time when only corrupted data is given. Also, when the test data comes in an online matter (not in a batch), will this method still work?\n\n\nRef:\n[1] Hendrycks, Dan, et al. \"The many faces of robustness: A critical analysis of out-of-distribution generalization.\" Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021.\n\n[2] Hendrycks, Dan, et al. \"Augmix: A simple data processing method to improve robustness and uncertainty.\" arXiv preprint arXiv:1912.02781 (2019).", "summary_of_the_paper": "This paper proposes a framework that tries to classify corrupted data while using models trained merely on clean data. Additionally, this framework also quantifies the classification uncertainty by using the Mahalanobis-distance.", "summary_of_the_review": "Given the concerns I have listed above, I suggest “5: marginally below the acceptance threshold”.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper introduces a method for classifying corrupted data and quantifying uncertainty by training semi-supervised autoencoders only on clean (uncorrupted) data.

Pro:  The approach is novel utilizing metric Gaussian variational inference.

Cons: More thorough experiments are needed:  (1) extensive experiments on more complex data, (2) ablation study, (3) comparison to additional baselines.

Summary:  The paper introduces a novel method, however experiments are limited.
Decision: Reject