Label Smoothed Embedding Hypothesis for Out-of-Distribution Detection
Authors: Dara Bahri
Heinrich Jiang
Yi Tay
Donald Metzler
Venue: ICLR 2022 Submitted (2022)
Keywords: deep k-nn
label smoothing
out-of-distribution detection
robustness

Abstract: Detecting out-of-distribution (OOD) examples is critical in many applications. We propose an unsupervised method to detect OOD samples using a $k$-NN density estimate with respect to a classification model's intermediate activations on in-distribution samples. We leverage a recent insight about label smoothing, which we call the {\it Label Smoothed Embedding Hypothesis}, and show that one of the implications is that the $k$-NN density estimator performs better as an OOD detection method both theoretically and empirically when the model is trained with label smoothing. Finally, we show that our proposal outperforms many OOD baselines and we also provide new finite-sample high-probability statistical results for $k$-NN density estimation's ability to detect OOD examples.

Under review as a conference paper at ICLR 2022
LABEL SMOOTHED EMBEDDING HYPOTHESIS FOR OUT-OF-DISTRIBUTION DETECTION
Anonymous authors Paper under double-bling review
ABSTRACT
Detecting off-iistibbution (OOD) examples is critical in many applications. We propose an unsupervised method to detect OOD samples using k-NN density estimate with respect to classification model's 's intermediate activations on in- distribution samples. We leverage a recent insight about label smoothing, which we call the Label Smoothed Embedding Hlypothesis, and show that one of the implications is that the k-NN density estimator performs better as OOD detection method both theoretically and empirically when the model is trained with label smoothing. Finally, we show that our proposal outperforms many OOD baselines and we also provide new finie-sample high-probability statistical results for k-NN density estimation's s ability to detect OOD examples.
INTRODUCTION
Identifying out-of-distribution examples has a wide range of applications in machine learning includ- ing fraud detection in credit cards (Awoyemi et al., 2017) and insurance claims (Bhowmik, 2011), fault detection and diagnosis in critical systems (Zhao et al., 2013), segmentations in medical imaging to find abnormalities (Prastawa al., 2004), network intrusion detection (Zhang & Zulkernine, 2006), patient monitoring and alerting Hauskrecht et al. (2013), counter-terrorism (Skillicorn, 2008) and anti-money laundering (Labib et al., 2020).
Out-of-distributin detection is highly related to the classical line of work in anomaly and outlier detection. Such methods include density- (Ester et al., 1996), one-class SVM (Schölkopf et al., 2001), and isolation forest (Liu et al., 2008). However, these classical methods often aren't 't immediately practical on large and possibly high-dimensional modern datasets.
More recently, Hendrycks & Gimpel (2016) proposed simple baseline for detecting out-of- distribution examples by using a neural network's s softmax predictions, which has motivated many works since then that leverage deep learning (Lakshminarayanan et al., 2016; Liang et al., 2017: Lee et al.. 2017). However, the majority of the works still ultimately use the neural network's 's softmax predictions which suffers from the following weakness. The uncertainty in the softmax function cannot distinguish between the following situations: (1) the example is actually in-distribution but there is high uncertainty in its predictions and (2) the example is actually out of distribution. This is largely because the softmax probabilities sum to and thus must assign the probability weights accordingly. This has motivated recent explorations in estimating conformal sets for neural networks (Park et al., 2019; Angelopoulos et al., 2020) which can distinguish between the two cases.
In this paper, we circumvent the above-mentioned weakness by avoiding using the softmax probabili- ties altogether. To this end, we approach OOD detection with an alternative paradigm we leverage the intermediate embeddings of the neural network and nearest neighbors. Our intuition backed by recent work in which the effectiveness of using nearest-neighhor based methods these embeddings have been demonstrated on a range of problems such as uncertainty estimation (Jiang et al., 2018), adversarial robustness (Papernot & McDaniel, 2018), and noisy labels (Bahri al., 2020).
In this work, we explore using k-NN density estimation to detect OOD examples by computing its density the embedding layers. To this end, it's worth noting that k-NN density estimation is unsupervised technique, which makes it very different from the aforementioned deep N--N work (Bahri al., 2020) which leverages the label information of the nearest neighbors. One key intuition

---

Under review as a conference paper at ICLR 2022
here is that low k-NN density examples might be OOD candidates as it implies that these examples are far from the training examples in the embedding space.
In order for density estimation to be effective on the intermediate embeddings. the data must have good clusterability (Ackerman & Ben-David, 2009), meaning that examples in the same class should be close together in distance in the embeddings, while examples not in the same class should be far apart. While much work has been done for the specific problem of clustering deep learning embeddings (Xie et al., 2016a; Hershey al., 2016) many of these ideas are applicable density estimation.
In this paper, we training the neural network on a soft label obtained by taking weighted average between the original one-hot encoded label and the uniform distribution over labels. We leverage a key insight about the effect of label smoothing on the embeddings (Müller et al., 2019): training with label smoothing has the effect of contracting the intermediate activations of the examples within the same class to be closer together at faster rate relative to examples in different classes. This results in embeddings that have better clusterability. We call this the Label Smoothed Embedding Hypothesis, which we define below.
much simpler but effective approach of label smoothing, which involves
Hypothesis (Labell Smoothed Embedding Hypothesis (Müller al., 2019)). Training with label smoothing contracts the intermediate embeddings of the examples in neural network, where examples within the same class move closer towards each other distance at a faster rate than examples in different classes.
We refer interested readers to Müller al. (2019) for 2D visualizations of this effect on the model's penultimate layer. We will later portray the same phenomenon using k-NN density estimation.
We summarize our contributions follows:
(1) We propose new procedure that uses label smoothing along with aggregating the k-NN density estimator across various intermediate representations obtain an OOD score.
(2) We show number of new theoretical results for the k-NN density estimator in the context of OOD detection, including guarantees on the recall and precision of identifying OOD examples, the preservation of the ranking w.r.t. the true density, and a result that provides intuition for why the Label Smoothed Embedding Hypothesis improves the N-NN based OOD score.
(3) We experimentally validate the effectiveness of our method and the benefits of label smoothing on benchmark image classification datasets, comparing against recent baselines, including one that uses A-NN in different way, well as classical alternatives to the k-NN but applied in the same way. The comparison against these ablative models highlight the discriminative power of the k-NN density estimator for OOD detection.
(4) We conduct ablations to study the performance impact of the three syper-parameters of our method (1) the amount of label smoothing, (2) which intermediate layers to use, and (3) number of neighbors k.
2
ALGORITHM
We start by defining the foundational quantity in our method.
Definition 1. Define the k-NN radius of x E TR: D
Tx( = inf > 0: Xn k}.
When X is implicit, we drop it from the notation for brevity.
Our method goes as follows: upon training classification neural network sample Xin from some distribution fin the intermediate representations of X should be close together (in the Euclidean sense), possibly clustered by class label. Meanwhile, out-of-distribution points should be further away from the training manifold- that is, Tı (z (.)) > T& (g. ( X,,) for Zin ~ fin Zom ~ fout- where 9i maps the input space the output of the i-th layer of the trained model. Thus, for fixed
2

---

Under review as a conference paper at ICLR 2022
So Cesta meses.LL
Falk on MUST
MA-57
SAM
SYM
LASredus OMNET 2N17 wol (rab HNBBa)
Likrecke
Fartic OPMI Each-
SONAA L.
LAbTaski Danten SINET, Aert 2012 KNNSS
Cartie M82T SPMCC 2mbh22 1...5
2003 Net 2.
CANDA
CANPA
CHEIG. cisTi 10 fariic Melae
Fambe MBR1 OPESS al AN5TL 21133
5940 GINAA MENETLIN
CAST 21.5
Fashie HE3T
WAN
000 staii
000 GABE
000 CalA
COO CUNAR
Figure 1: Distributions of the 1-NN radius distance for each of three layers well test statistic, which aggregates over all layers. "Depth" refers to the layer index with respect to the logits layer. Thus, 0 means logits, means the layer right before logits, so on and forth. The first two (last two) columns correspond to the dataset pairing Fashion MNIST - KMNIST (SVHN - CelebA) with and without label smoothing. The Fashion MNIST pairing uses a layer feedforward neural network while SVHN uses the convolutional LeNet5. Blue represents samples from the test split of the dataset used to train the model and are therefore inliers. Red represents the -iitrii-ditiiittioonn samples. Consider the cases of no label smoothing. We see that there is separability between in and out points at each layer, generally more so at deeper (carlier) layers of the network. This motivates our use of k-NN distance for OOD detection. There is, however, non-trivial overlap. Now observe the cases with a 0. smoothing. The 1-NN radii shrink, indicating a "contraction" towards the points. The contraction is, however, higher for
training manifold for both in and ID points than for OOD points. This motivates the use of label smoothing in our method.
layer i, we propose the following statistic:
Txxx) Th (x)())) Q(Xm: 9:) : E2wJark (a(()): Q(Xmn 9t)
Since Q depends on unknown fin we estimate it using cross-validation:
(Xin, 9t) = X
Σ
rx(o)(t): \ (x))) = X
1
Σ
(kt1(a (x
N
Letting 7; be our statistic using Q we now aggregate across M layers to form our final statistic:
1 M
((x)
1(x).
M
We one-sided threshold rule on f. namely, if T > t we predict out-of-distribute otherwise we do not. With key quantities now defined, we use the k--N radius to substantiate (1) the claim that in and -ut-of-distributtin points different distances away from the training points and (2)
3

---

Under review as a conference paper at ICLR 2022
Hypothesis 1, that label smoothing causes in-distribution points to contract to the training points faster than OOD ones. This provides the grounding for why a statistic based on the k-NN radius using a label smoothed model is powerful discriminator. Figure 2 shows the distribution of 1-NN distances for three layers as well as our proposed aggregate statistic on two dataset pairs. Across layers and datasets, see some separability between in and outti--distributtinn points. Label smoothing has the effect of shrinking these distances for both in/out classes but the effect is larger for in points, making the distributions even more separable and thereby improving the performance of our method.
3 THEORETICAL RESULTS
In this section, we provide statistical guarantees for using the k--N radius as method for out of distribution detection.
this, we assume that the features of the data lie on compact support X' C TR and that examples are drawn i.i.d. from this. We assume that there exists density function f: IRd R corresponding to the distribution the feature space. This density function can serve as proxy for how much an example is out of distribution. The difficulty is that this underlying density function is unknown in practice. Fortunately, we can show that the k-NN radius method approximates the information conveyed by f based finite sample drawn from f- For the theory, we define an out of distribution example as an example where x & X. Thus, f(x) = for such examples.
3.1 OUT OF DISTRIBUTION DETECTION HIGH RECALL RESULT
In this section, we give result about identifying out of distribution examples based on the k-NN radius with perfect recall if we were to use a particular threshold. That is, any example that is indeed out of distribution (i.e. has 0 density) will have k-NN radius above that threshold. We also give guarantee that the false-positives (i.c. those examples with k-NN radius higher than that quantity which were not out-of-distribution examples) were of low-density to begin with. Our results hold with high- geh-probbbbility uniformly across all of IRd, As we will see, as n grows and k/n + O, we find that the K-NN radius method using the specified threshold is able to identify which examples are in-distribution vs out-of- -istrrbbiit
Our result requires smoothness assumption on the density function shown below. This smoothness assumption ensures a relationship between the density of a point and the probability mass of balls around that point which is used in the proofs.
Assumption (Smoothness). f is ß-Holder continuous for some 0 < <B Le. 1f(x) f(x') Cgfæ - x'13.
We now give our result below.
Theorem 1. Suppose that Assumption I holds and that <8 and 2 2 -log(2/52 we choose
d n.
1/(3+d)
8/(3+d)
k 2CB n Ud
A 15
k
n2 U.-
then the following holds uniformly for all Rdd with probability at least 1 - 8: (1) of f(x) 0. then Fk rx(x) 2 r. (2) (x) 2 r, then f(x) S X.
In words, it says that the set of points E Rd satisfying rx(x)) Z (((+)) is guaranteed to contain all of the outliers and does not contain any points whose density exceeds cutoff (i.e. f=) 2 (k(n))/(B-d)) These quantities all go as k/n -> 0 and thus with enough samples, asymptotically are able to distinguish between out-of-distribution and in-distribution examples.
We can assume the following condition on the boundary smoothness of the density as done in recent analysis of k-NN density estimation (Zhao & Lai, 2020).
Assumption 2 (Boundary smoothness). There exists 0 < 1) < 1 such that for any > 0, ʃ satisfies
P(f(z) < S C,t",
where TP represents the distribution of in-distribution examples during evaluation.
4

---

Under review as a conference paper at ICLR 2022
Then, Theorem has the following consequence the precision and recall of the K--N density based out of distribution detection method.
Corollary 1. Suppose that Assumptions and hold and that 8 < 1 and 2 -log(2/6)2. d d'oog Then if we choose
1/18+d)
k 2C va
F
then the following holds with probability least 1 6. Let us classify an example E TRd as out of distribution (x)) 2 and in-distribution otherwise. Then, this classifier will identify all of the out-of-distribbutin examples (perfect recall) and falsely identify in-distribution examples as out-of of-distributton with probability (error in precision)
3/(0+d)
5 5.C, C. C3 C2f(840).
AS
Vd
3.2 RANKING PRESERVATION RESULT
We next give the following result saying that the gap density between two points is large enough, then their rankings will be preserved w.r.t. the k-NN radius.
Theorem 2. Suppose that Assumption I holds and that < 8 < and 2 2 loo(220))2 d log Define Csn == 16 log(2/8)) (2/ / logon. Then there exists a constant C depending on f such that the following holds with probability least 1 ô uniformly for all pairs of points I1, 22 R2.
f(11) > f(z2) + Ex,30 where
Co. (vk + (k/n))//d
Ek,n := C
then, we have ra(21) < Tx(21))
We note that as n, k + oc, k/n - O, and logn/ n/ - O, we have that Ck,n - 0 and thus asymptotically, the k-NN radius preserves the ranking by density in the case of non-ties.
3.3 PERFORMANCE UNDER LABEL SMOOTHING EMBEDDING HYPOTIEESIS
In this section, we provide some theoretical intuition behind why the observed label smoothing embedding hypothesis can lead to better performance for the k-NN density-based approach on embeddings learned with label smoothing. We make an assumption that our in-distribution has convex X' Rdd as its support with uniformly lower bounded density and that applying label smoothing has the effect of contracting the space Id in the following way: for points in X' the contraction with respect to point of origin 2n the interior of X' so that points X move closer to the origin and for outlier points, they move closer to the boundary of X. We ensure that the former happens faster rate than the latter and show the following guarantee, which says that under certain regularity conditions the density and X, we have that the ratio of the k-NN distance between an -ff-rii-ittiitiionn point and an in-distribution point increases after this mapping. This suggest that under such transformations such ones induced by what's implied by the label smoothed embedding hypothesis, the N-NN distance becomes a better score at separating the in-distribution examples from the out-of-distribution examples.
Proposition 1 (Improvement of k-NN OOD with Label Smoothed Embedding Hypothesis). Let has convex and bounded support X C Rd and let Ti be an interior point of and additionally assume that there exists To, Co 0 such that for all 0 < <, and X, we have Voll B (z, r) O X)) < Co (ol, r)) holds (to ensure that X's boundaries have regularity and are full dimensional)
and that {xx) No for all E X for some No > 0. Define mapping à Rdd - Bdd such that x(x) = "iin= (x - -Ta) Ta if E X and otherwise, Φ(x) "/out (x Proj otherwise, for some
Proj (x) (Projx(2> denotes the projection of x onto the boundary of convex set X)). We see that & contracts the points where points in X' contract at a faster rate than
Yin "oout
those outside of X. Suppose our training set consists of n examples Xin) drawn from f. and denote by of X ((n)) the image of those examples w.r.t. 6.
5

---

Under review as a conference paper at ICLR 2022
Let 0 < 8 < 1 and min 0 and i satisfies
2 1og((2/2/)) - dlogg S S 200000000 200004 vu
(Zome (Zoue= -Tin
V/nn
-mmón
V/n
and n is sufficiently large depending on f. Then with probability at least 1 - 5. the following holds uniformly among all mmin > O, choices of Iin E & (in-distribution example) and zon such that d(xr X) 2 Tmin (ous-io-distiiiuttion example with margin). The sollowing holds.
((( (11)) T&k (e((( Φ (m))
TT X(n))
Tk TT ((n))
where Te A) denotes the K-NN distance of x w.r.t. datasel A.
4
EXPERIMENTS
4.1 SETUP
We validate our method on MNIST (LeCun et al., 1998), Fashion MNIST (Xiao et al., 2017). SVHN (cropped to 32x32x3) (Netzer et al., 201 1). CIFARIO (32x32x3) (Krizhevsky al., 2009), and CelebA (32x32x3) (Liu et al., 2015). In CelebA, we train against the binary label "smiling". We train models the train split of each of these datasets, and then test OOD binary classification performance for a variety of OOD datasets, while always keeping the in-distribution to be the test split of the dataset used for training. Thus, dataset pairing denoted "A + B" means that the classification model is trained on A's train and is evaluated for OOD detection using A's test as in-distribution points and B's test as out-of-distribution points. In addition to the aforementioned, we form OOD datasets by corrupting the in-distribution test sets by flipping images left and right (HFlip) as well as up and down (VFlip) and we also use the validation split of ImageNet (32x32x3). the test splits of KMNIST (28x28x1), EMNIST digits (28x28x1). 1), and Omniglot (32x32x3). All datasets are available as Tensorflow Datasets ! We measure the OOD detectors' ROC-AUC, sample-weighting to ensure balance between in and out-of-distribution samples (since they can have different sizes). For MNIST and Fashion MNIST, we train a 3-layer ReLU-activated DNN, with 256 units per layer, for 20 epochs. For SVHN, CIFAR10, 10, and CelebA, we train the convolutional LeNet5 (LeCun et al., 2015) for 10 epochs. We use 128 batch size and Adam optimizer with default learning rate 0.001 throughout. All methods were implemented in TensorFlow and trained a cloud environment. We estimate we used a total of 10k CPU hours for all of our experiments. For baabeddding-bssee methods, we aggregate over 3 layers for the DNN and dense layers for LeNet5, including the logits. For our method, we always use Euclidean distance between embeddings, k = 1 and label smoothing a = 0.1. These could likely be tuned for better performance in the presence of a validation OOD dataset sufficiently similar to the unknown test set. We do not do this since we assume the absence of such dataset.
4.2 BASELINES
We validate our method against the following recent baselines:
Control. We use the model's maximum softmax confidence, as suggested by Hendrycks & Gimpel (2016). The lower the confidence, the more likely the example is to be OOD.
Robust Deep k-NN. This method, proposed in Papernot & McDaniel (2018) leverages k-NN for a query input as follows: it computes the label distribution of the query point's nearest training points for each layer and then computes a agyeragggeeateed p-vauee-base non-conformity score against a held-out calibration set. Queries that have high disagreement, or impurity, in their nearest neighbor label set are suspected to be OOD. We use 10% of the training set for calibration, k = 50, and cosine similarity, described in the paper.
DeConf. Hsu et al. (2020) improves over the popular method ODIN (Liang et al., 2017) by freeing it from the needs of tuning decomposition" derived from the model's penultimate layer, and a modified method for perturbing inputs optimally for OOD detection using Seas--in-GGraden--eeee of the cosine similarity variant described in the paper. We searched the perturbation hyperparameter e
OOD data. It consists of components learned "confidence
strategy. We use the "h" branch
'ttpps:/ wwtp://wwwssrfffo.ooo httt:://ww..enorrrooooor//aaaaae

---

Under review as a conference paper at ICLR 2022
Dataset
Control
k--N (0.1 LS)
I--N (no LS)
DeConf
Robust K-NN
SVM
Isolation Forest
Train/In: MNIST
EMNIST
0.835
0.950
0.966
0.693
0.875
0.794
0.346
MNIST
0.838
0.968
0.954
0.747
0,904
0.569
0.655
KMNIST
0.882
0.984
0.985
0.746
0.923
0.756
0.358
HFlip
0.852
0.914
0.871
0.706
0.847
0,568
0,559
VFlip
0.833
0,883
0.840
0.684
0.812
0.537
0.599
Train/In: Fashion MNIST
EMNIST
0.551
0.993
0.983
0.670
0.756
0.881
0.170
HFlip
0.557
0.730
0.698
0.581
0.608
0.616
0,443
VFlip
0.642
0.915
0.875
0.704
0.774
0.700
0.442
KMNIST
0.673
0.989
0.962
0.759
0.814
0.818
0.268
MNIST
0.697
0,997
0.969
0.837
0.854
0.782
0.338
Train/In: SVHN
CelebA
0.785
0.906
0.857
0.682
0.887
0.702
0.261
CIFARIO
0,821
0.855
0.722
0.693
0.873
0,564
0.423
CIFAR100
0.820
0.876
0.755
0.682
0.878
0.585
0.385
ImageNet
0.825
0.852
0.723
0.693
0.876
0.560
0,416
Omniglot
0.685
0.977
0.958
0.521
0.861
0.884
0.093
HFlip
0.737
0.683
0.580
0.667
0.746
0.504
0.554
VFlip
0.674
0.648
0.573
0.604
0.686
0.515
0.533
Train/In: CIFARIO
CelebA 0.570
0.780
0.764
0.521
0.637
0.657
0.387
CIFAR100
0.633
0.598
0.573
0.584
0.615
0.485
0.514
HFlip
0.503
0.512
0,513
0.502
0.512
0.500
0,502
VFlip 0.645
0.594
0,580
0.583
0.616
0.471
0,531
ImageNet
0.639
0.588
0.562
0.583
0.620
0.448
0.562
Omniglot
0.356
0.960
0.980
0.462
0.587
0.954
0.064
SVHN
0.725
0.381
0.384
0.584
0.635
0.323
0.677
Train/In: CelebA
HFlip 0.501
0.504
0.503
0.500
0.501
0.501
0.498
VFlip
0.459
0.738
0.696
0.354
0.481
0.610
0.277
CIFAR100
0.639
0.689
0.607
0.535
0.652
0.418
0.426
CIFAR10
0.638
0.692
0.605
0.529
0.642
0.422
0,431
ImageNet 0.647
0,684
0.598
0.535
0.648
0.412
0,436
Omniglot 0.586
0.910
0.899
0.480
0.654
0.573
0.079
SVHN
0.612
0.520
0.441
0.539
0.586
0.411
0.546
Table 1: ROC-AUC for different methods and dataset pairings. The datasets enclosed by double set, while the datasets listed beneath them
lines represent the training and in-distribution used as OOD. Each entry was run 5 times. The standard errors are quite small, with median of 0.0071. Entries within two standard errors of the max are bolded. We see that label smoothing almost always improves the performance of our method and that the method is competitive across variety of datasets.
over the range listed in the paper, but found that it never helped OOD in our setting. We thus reports numbers for = 0.
SVM. We learn a one-class SVM (Schölkopf et al., 1999) on the intermediate embedding layers and then aggregate the outlier scores across layers in the same way we propose in our method. We use an RBF kernel.
Isolation Forest. This is similar SVM, but uses an isolation forest (Liu et al., 2008) with 100 estimators at each layer.
4.3 RESULTS
Our main results are shown in Table We observe that label smoothing nearly always improved method, denoted k-NN, and that the method is competitive, outperforming the rest the most

---

Under review as a conference paper at ICLR 2022
Impact of k
Impact of Label Smoothing
00503
00000
ROC-AUC
0.8
ROC-AUC
2.8
2.0
2.-
0.4
Fashion MNIST ->> MNIST. 0.1 LS
0.5
SVIN -> CelebA
Fashion MNIST -> MNIST, no LS
SVHN CIFAR1O
02
SVHN -IFARIO, 0.1 LS
CelebA -> VFlip
SVHN -> -IFARO,. no LS
Hflip
0.2
20
30
40
30
K
LS alpha
Figure 2: Left: Impact of k on ROC-AUC. We observe that performance is mostly stable across
range of k. We do see slight degradation with larger k. and so we recommend users a default of = 1. Right: Impact of on ROC-AUC for four dataset pairings. Note that the x-axis is log-scale and the y-axis is zoomed in. We generally see that performance improves with larger a until it reaches a critical point, after which it declines. While this critical point is model and data dependent, see that blithely selecting a fixed value like 0.1 results in reasonable performance.
Depth (from logits)
Depth (from logits)
OOD
LS
0
-2
0OD
LS
0
-1
-3
Train/In: CelebA
Train/In:
FashionMnist
CIFAR 100
0.0
0.472
0.722
0.638
0.583
EMNIST
0.0
0.970
0.984
0.976
0.1
0.565
0.755
0.692
0.560
0.1
0.973
0.993
0.994
CIFARIO
0.0
0.474
0.717
0.641
0,606
KMNIST
0.0
0.927
0.963
0.970
0.1
0.566
0.760
0.699
0.583
0.1
0.973
0.986
0.988
ImageNet
0.0
0.475
0.709
0.622
0.583
0.1
0.566
0.750
0.682
0.566
MNIST
0.0
0.958
0.966
0.957
Omniglot
0.0 0.586
0.959
0.964
0.993
0.1
0.992
0.996
0.992
0.1
0.658
0.956
0.959
0.990
We observe the ROC-AUC of our method using only a single layer at a time, for Fashion MNIST and CelebA, with and without label smoothing. We find that label smoothing usually helps every layer on its own, and that the penultimate layer (depth -1) often outperforms the rest on these datasets.
Figure 3:
number of dataset pairs. SVM, Isolation Forest serve as key ablative models, since they leverage the same intermediate layer representations as method and their layer-level scores are combined in the same way. Interestingly, we see that the k-NN consistently outperforms them, revealing the discriminative power of the k-NN radius distance. Robust k-NN also uses the same layer embeddings and k-NN, but in a different manner. Crucially, it performs OOD detection by means of the nearest training example neighbors' class label distribution. Given that we outperform Robust k--N more often than not, we might conjecture that the distance has more discriminative power for OOD detection than class label distribution. We were surprised that DeConf routinely did worse than the simple control, despite having implementing the method following the paper closely.
4.4 ABLATIONS
In this section, we study the impact of three factors on our method's performance: (1) the number of neighbors, k. (2) the amount of label smoothing a, and (3) the intermediate layers used.
Impact of k. In Figure 2 we plot the impact of l on OOD detection for two dataset pairings: MNIST ++ Fashion MNIST and SVHN + CIFARIO 10 with and without label smoothing. We see that larger degrades ROC-AUC monotonically, but the effect is rather small. We thus recommend default of =. A: = 1 has the added benefit of being more efficient in most implementations of masex large-scale neirest-neighhor lookup systems.
Impact of Label Smoothing a. We now consider the effect of label smoothing amount a on ROC- AUC in Figure 2. We see, interestingly, that performance mostly increases monotonically with larger
8

---

Under review as a conference paper at ICLR 2022
until it reaches critical point, after which it declines monotonically. While this optimal point may be data and model dependent and thus hard to estimate, we' 've found that selecting a fixed value like 0.1 works well in most cases.
Impact of Intermediate Layer. Our method aggregates k--N distance scores across intermediate layers. We depict the effect of different choices of single layer Fashion MNIST and CelebA in Figure 3. We find that label smoothing generally boosts performance for each layer individually and that while no single layer is always optimal, the penultimate layer performs fairly well across the datasets.
5 RELATED WORK
out-of-Distribution Detection. OOD detection has classically been studied under names such as outlier, anomaly, or novelty detection. One line of work are density- based methods: Ester et al. (1996) presents a density-based clustering algorithm which is also an outlier detection algorithm by identifying noise points which are points whose e-neighborhood has fewer than a certain number of points. Breunig et al. (2000); Kriegel et al. (2009) propose local outlier scores based on the degree to which how isolated the datapoint is with respect to its neighborhood via density estimation. Another line of work uses k-NN density estimates (Ramaswamy et al., 2000; Angiulli & Pizzuti, 2002; Hautamaki et al., 2004; Dang et al., 2015). We use the k-NN density estimator, but use it in conjunction with the embeddings of neural network trained with label smoothing. Other classical approaches include the one-class SVM (Schölkopf et al., 2001; Chen et al., 2001), isolation forest (Liu et al., 2008). slew of recent methods have been proposed for OOD. We refer interested readers to survey.
Label Smoothing. Label smoothing has received much attention lately; we give a brief review here. It has been shown to improve model calibration (and therefore the generation quality of auto- regressive sequence models like machine translation) but has been seen hurt teacher-to-student knowledge distillation (Pereyra et al., 2017: Xie et al., 2016b; Chorowski & Jaitly, 2016; Gao et al., 2020; Lukasik et al., 2020b; Müller et al., 2019). Müller et al. (2019) show visually that label smoothing encourages the penultimate layer representations of the training examples from the same class to group in tight clusters. Lukasik et al. (2020a) shows that label smoothing makes models more robust label noise in the training data (to level competitive with noisy label correction methods), and, furthermore, smoothing the teacher is beneficial when distilling from noisy data, Chen et al. (2020) corroborates the benefits of smoothing for noisy labels and provides theoretical framework wherein the optimal smoothing parameter can be identified. LS has been seen to hurt performance on sparse distributions (Meister et al., 2020) and decrease robustness to adversarial attacks (Zantedeschi et al., 2017). Yuan et al. (2020) casts knowledge distillation (KD) as a type of learned label smoothing regularization, showing that part of KD's success stems from its ability to regularize soft labels in the same way as LS. They then propose Teacher-free KD that achieves comparable performance to normal KD with a superior teacher.
k-NN Density Estimation Theory. Statistical guarantees for K-NN density estimation has had a long history (Fukunaga & Hostetler, 1973; Devroye & Wagner, 1977; Mack, 1983; Buturovié, 1993; Biau et al., 201 1; Kung et al., 2012). Most works focus on showing convergence guarantees under metrics like L2 risk or are asymptotic. Dasgupta & Kpotufe (2014) provided the first finite- sample uniform rates, which to our knowledge the strongest result so far. Our analysis uses similar techniques, which they also borrow from Chaudhuri & Dasgupta (2010); however our results are for the application of OOD detection whereas Dasgupta & Kpotufe (2014)'s goal was mode estimation. As result, our results hold with high probability uniformly in the input space, while having finite-sample guarantees and provide new theoretical insights into the use of k-NN for OOD detection.
6 CONCLUSION
In this work put forward the Label Smoothing Embedding Hypothesis and proposed deep k-NN density-based method for out-of-distribution detection that leverages the separability of intermediate layer embeddings and showed how label smoothing the model improves our method.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Margareta Ackerman and Shai Ben-David. Clusterability: theoretical study. In Artificial intelligence and statistics, pp. 1-8. PMLR, 2009,
Anastasios Angelopoulos, Stephen Bates, Jitendra Malik, and Michael Jordan. Uncertainty sets for image classifiers using conformal prediction. arXiv preprint arXiv:2009. 14193, 2020.
Fabrizio Angiulli and Clara Pizzuti. Fast outlier detection in high dimensional spaces. In European conference on principles of data mining and knowledge discovery, pp. 15-27. Springer, 2002.
John Awoyemi, Adebayo O Adetunmbi, and Samuel Oluwadare. Credit card fraud detection using machine learning techniques: A comparative analysis. In 2017 International Conference on Computing Networking and Informatics (ICCNI), pp. 1-9. IEEE, 2017.
Dara Bahri, Heinrich Jiang, and Maya Gupta. Deep k-nn for noisy labels. International Conference Machine Learning, pp. 540-550. PMLR, 2020.
Rekha Bhowmik. Detecting auto insurance fraud by data mining techniques. Journal of Emerging Trends in Computing and Information Sciences, 2(4):156-1622 2011.
Gérard Biau, Frédéric Chazal, David Cohen-Steiner, Luc Devroye, Carlos Rodriguez, et al. A
weighted k-nearest neighbor density estimate for geometrie inference. Electronic Journal of Statistics, 5:204-237, 2011.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density- based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 90-104, 2000.
LJ Buturović. Improving k-nearest neighbor density and eπror estimates. Pattern Recognition, 26(4): 611-616, 1993.
Kamalika Chaudhuri and Sanjoy Dasgupta. Rates of convergence for the cluster tree. In NIPS, pp- 343-351. Citeseer, 2010.
Blair Chen, Liu Ziyin, Zihao Wang, and Paul Pu Liang. An investigation of how label smoothing affects generalization. arXiv preprint arXiv:2010. 12648, 2020.
Yunqiang Chen, Xiang Sean Zhou, and Thomas Huang. One-class svm for learning in image re- trieval. In Proceedings 2001 International Conference on Image Processing (Cat. No. 01CH37205), volume 1, pp. 34-37. IEEE, 2001.
Jan Chorowski and Navdeep Jaitly. Towards better decoding and language model integration in sequence sequence models. arXiv preprint 1612. 2016.
Taurus T Dang, Henry YT Ngan, and Wei Liu. Distance-based k-nearest neighbors outlier detection method in large-scale traffic data. In 20/5 IEEE International Conference on Digital Signal Processing (DSP), pp. 507-510. IEEE, 2015.
Sanjoy Dasgupta and Samory Kpotufe. Optimal rates for k-NN density and mode estimation. In Advances in Neural Information Processing Systems, pp. 2555-2563. 2014.
Luc P Devroye and Terry J Wagner. The strong uniform consisteney of nearest neighbor density estimates. The Annals of Statisties, pp. 536-5446 540, 1977.
Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et A density-based algorithm for discovering clusters in large spatial databases with noise. In Kdd, pp. 226-231, 1996.
Keinosuke Fukunaga and I. Hostetler. Optimization of k nearest neighbor density estimates. IEEE Transactions on Information Theory, 19(3):320-32) 1973.
Yingbo Gao, Weiyue Wang, Christian Herold, Zijian Yang, and Hermann Ney. Towards a better understanding of label smoothing in neural machine translation. In Proceedings of the 1st Confer- ence of the Pacific Chapter of the Association for Computational Linguistics and the 10th International Joint Conference Natural Language Processing, pp. 212-223, 2020.
10

---

Under review as a conference paper at ICLR 2022
Milos Hauskrecht, lyad Batal, Michal Valko, Shyam Visweswaran, Gregory F Cooper, and Gilles Clermont. Outlier detection for patient monitoring and alerting. Journal of biomedical informatics, 46(1):47-55, 2013.
Ville Hautamaki, Ismo Karkkainen, and Pasi Franti. Outlier detection using k-nearest neighbour graph. In Proceedings of the 17th International Conference on Puttern Recognition, 2004. ICPR 2004., volume 3, pp. 430-433. IEEE, 2004.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and examples in neural networks. arXiv preprint 1r1ivv1610.02//1 2016.
John R Hershey, Zhuo Chen, Jonathan Le Roux, and Shinji Watanabe. Deep clustering: Discriminative embeddings for segmentation and separation. In 2016 JEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 31-35. IEEE, 2016.
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of- distribution image without learning from out-of-distribution data. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 10951-10960, 2020.
Heinrich Jiang, Been Kim, Melody Y Guan, and Maya Gupta. To trust or not to trust a classifier. In NeurlPS, pp. 5546-5557, 2018.
Hans-Peter Kriegel, Peer Kröger, Erich Schubert, and Arthur Zimek. Loop: local outlier probabilities. In Proceedings of the 18th ACM conference Information and knowledge munagement, pp. (649-1652, 2009.
Alex Krizhevsky et al. Learning multiple layers of features from tiny images. 2009.
Yi-Hung Kung, Pei-Sheng Lin, and Cheng-Hsiung Kao. An optimal k-nearest neighbor for density estimation. Statistics & Probability Letters, 82(10):176-1111 2012.
Nevine Makram Labib, Mohammed Abo Rizka, and Amr Ehab Muhammed Shokry. Survey of machine learning approaches of anti-money laundering techniques to counter terrorism finance. In Internet of "Ttings-Applicatiion and Future, pp. 73-87. Springer, 2020.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. arXiv preprint 1rXiv.1612.01444, 2016.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11 (6((1))2278-22 (1:2222222222 1998.
Yann LeCun al. Lenet-5, convolutional neural networks. URL: hutp://aan. lecun. com/exdb/lenet. 10,5):14, 2015.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confiingccnndeeneeeclliibaaaadd classifiers for detecting -uttof-distribution samples. arXiv preprint 17 2017.
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of ofitt--diitributtin image detection in neural networks. arXiv preprint arXiv:1706.02690 2017.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 eighth ieee international conference on data mining, pp. 413-422. IEEE, 2008
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp. 3730-3738, 2015,
Michal Lukasik, Srinadh Bhojanapalli, Aditya Menon, and Sanjiv Kumar. Does label smoothing mitigate label noise? In International Conference Machine Learning, pp. 4458- PMLR,
2020a.
Michal Lukasik, Himanshu Jain, Aditya Krishna Menon, Seungyeon Kim, Srinadh Bhojanapalli, Felix Yu, and Sanjiv Kumar. Semantic label smoothing for sequence to sequence problems. arXiv preprint arXiv:2010.07447, 2020b.
11

---

Under review as a conference paper at ICLR 2022
YP Mack. Rate of strong uniform convergence of k-nn density estimates. Journal of statistical planning and inference, 6(2):185-192, 1983.
Clara Meister, Elizabeth Salesky, and Ryan Cotterell. Generalized entropy regularization or: There's nothing special about label smoothing, arXiv preprint arXiv:2005.0088/ 000200 2020.
Rafael Müller, Simon Korbliihh, and Geoffrey Hinton. When does label smoothing help? arXiv preprint arXiv: NXXiv:/906.00622)) 2019.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Nicolas Papernot and Patrick McDaniel. Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning. arXiv preprint
2018. 2018.
Sangdon Park, Osbert Bastani, Nikolai Matni, and Insup Lee. Pac confidence sets for deep neural networks via calibrated prediction. arXiv preprint arXiv:2001.0011 100000 2019.
Gabriel Pereyra, George Tucker, Jan Chorowski, Eukasz Kaiser, and Geoffrey Hinton. Regularizing neural networks by penalizing confident output distributions. arXiv preprint arXiv: 2017.
Marcel Prastawa, Elizabeth Bullitt, Sean Ho, and Guido Gerig. A brain tumor segmentation framework based on outlier detection. Medical image analysis, 8(3):755-283, 2004.
Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 427-438, 2000.
Bernhard Schölkopf, Robert Williamson, Alexander Smola, John Shawe- Tayeer John C Platt, et al. Support vector method for novelty detection. In NIPS, volume 12, pp. 582-588, Citeseer, 1999.
Bernhard Schölkopf, John C Platt, John Shawe-Taylor, Alex Smola, and Robert C Williamson. Estimating the support of high-dimensional distribution. Neural computation, 1443):144311471, 2001.
David Skillicorn. Knowledge discovery for counterterrorism and law enforcement. CRC Press, 2008.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mmist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint 1XXiv17788.07447 2017.
Junyuan Xie, Ross Girshick, and Ali Farhadi. Unsupervised deep embedding for clustering analysis. In International conference on machine learning, pp. 478-487, PMLR, 2016a.
Lingxi Xie, Jingdong Wang, Zhen Wei, Meng Wang, and Qi Tian. Disturblabel: Regularizing enn the loss layer. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4753 4762, 201
Li Yuan, Francis EH Tay, Guilin Li, Tao Wang, and Jiashi Feng. Revisiting knowledge distillation via label smoothing regularization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3903-391 2020.
Valentina Zantedeschi, Maria-Irime Nicolac, and Ambrish Rawat. Efficient defenses against adversar- ial attacks. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, pp.
39-49, 2017.
Jiong Zhang and Mohammad Zulkernine. Anomaly based network intrusion detection with unsuper- vised outlier detection. In 2006 IEEE International Conference on Communications, volume 5, pp. -293. IEEE, 2006.
Puning Zhao and Lifeng Lai. Analysis of knn density estimation. arXiv preprint arXiv:2010.00433. 2020.
Ye Zhao, Brad Lehman, Roy Ball, Jerry Mosesian, and Tean-Françoii de Palma. Outlier detection rules for fault detection solar photovoltaic arrays. In 2013 Twenty-Eighth Annual IEEE Applied Power Electronics Conference and Exposition (APEC), pp. 2913-2920. IEEF, 2013.
12

---

Under review as a conference paper at ICLR 2022
Appendix
A PROOFS
We need the following result giving guarantees between the probability measure on the true balls and the empirical balls.
Lemma (Uniform convergence of balls (Chaudhuri & Dasgupta, 2010)). Let F be the distribution corresponding to I and Fn be the empirical distribution corresponding to the sample X. Pick
6 < Assume that dlog n. Then with probability least 1 5, for every ball B R.D we
have
Vdlogn
F(B) 2 Cs
FB
n
k
Vk
(B) 2 k
F(B) +
C8.n
n
n
k
Vk
F(B) <
Co.
+ (B)
where Cs 16log(2/0)
Remark. For the rest of the paper, many results qualified to hold with probability least 1 8. This is precisely the event in which Lemma 1 holds.
Remark. If 1/n, then Ca,- O(llog n) 8/22)
Proof of Theorem 1. Suppose that r satisfies f(x) = 0. Then we have
F(B(x,r)) = fx²) 1[x' E r)xrr) = / f(x)
1[x' E B(x, r))d'
$ C3 / -2 1/ E B(x,r))dd* < Car
k
k
Vk
<< Co.
2n
Therefore, by Lemma 1, we have that ru (2) I r. Now for the second part, we prove the contrapositive. Suppose that fxx > X. Then we have
2k
VT
F(B(r,r) 2 (A C2r - 02
2
+ Ca
7
Therefore, by Lemma 1, we have that f(x) 2 A, as desired.
Proof of Theorem 2. We borrow some proof techniques used in Dasgupta & Kpotufe (2014) to give uniform bounds on fx) fa(x)) where fa is the h-NN density estimator defined as
k
fx(x): =
(a(x'dd
is also clear that S C (ks/))2d for some C" depending on f. If we choose such that
F(B(x, r)) S uar (f(z) + Car k Cón Vi
Then, have by Lemma that (x) > Thus, have
n Ud pd - C..n/V/ Vk ff(z)+ (Com - (k/m))/a)
k f(x) + Cor
fa(x)
for some C1 > 0 depending on f. The argument for the other direction is similar: we instead choose
such that
k -+ Co.n Vk
F(B(x,r)) 2 (f())(()) Car
13

---

Under review as a conference paper at ICLR 2022
Again it's clear that I C" (k/n) for some C" depending on f. Next, have by Lemma that (2) $ r. Thus, we have
k
f(x) - Car
(Cn (k/n)///
fx(2)
1 C+ 2 f((z) - C2
pd
VT
for some C2 depending on f. Therefore, there exists Co depending on such that
(Cam Vk
sup ( S Co RER4
+kk/n))/d
Finally, we have that setting 2- Cu. we have
(Com (k/n))//d) > f(x2) ( + VT
(Con + (k/n)l//d) 2 fu(
fx(11) 2 f(x1) Co
then immediately follows that rx(21) The (T2). as desired.
Proof of Proposition 1. Define max (x)) We have (((((Foue)) ((X d(p(Fout) ( d(Eintt X) + T'
Yout (Foutt X)
Tk ((imuti Xin))
el X) + I'u
Next, we have
Tk (o( ((((n)) Tins
T& (Tmi X(n)
since pairwise distances within are scaled by Vin through our mapping é.
Thus, it suffices to have
Yio S (outd X) oF X) + Fi
which is equivalent having
To 1 Yout Yin d(xx 2).
Which holds when
Yout Tin
Fa <
-miin
Vin
1/d
This holds because we have
S
2k camna
by Lemma 1, and the result follows by the condition
on k.
14


Reviews:
[{"review_id": "yaAVGzmEKZ1", "reviewer": "Reviewer_pUXL", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\nPros\n- The paper is mostly well-written and easy to follow. \n- Although it is not connected to the actual implementation, the theoretical results that guarantee there exists a threshold that perfectly separate OOD and in-distribution samples and show that label smoothing can improve the OOD detection performance are interesting. \n\nCons\n- Computation of r_k(x;X) for each new sample x involves computation of distance between the feature of the sample and features of all existing training dataset. Due to this huge computation (or memory requirement in the case of storing all feature values of training samples), the method will not be applicable to modern large-scale datasets. \n- Also, it is unclear how the authors obtain the threshold between in-distribution samples and OOD samples in terms of r_k(x;X) values.\nIn deep architectures, a range of feature values is largely different from layer to layer. Therefore, it seems unnatural to use the average of \\hat{T}_i(x) as a threshold. It would be better to investigate a more principled way to weigh \\hat{T}_i(x) or at least include how \\hat{T}_i(x) differs across the different layers. \n- The theoretical results do not go well with the practice. Specifically, the theoretical results in the paper are based on the conditions that k \\geq f(log n) for some function f( ) and k/n \\rightarrow \\infty. This means that it assumes a large scale dataset, and the value of k will be large as well. However, the proposed method is not applicable to the large dataset and the authors performed experiments with k=1.\nExperiments are performed only with small scale dataset and a shallow architecture. Therefore, it is unclear whether the method still outperforms baselines in the popular benchmark or in practice. ", "summary_of_the_paper": "This paper proposes a OOD detection method based on the k-nn density estimator. The authors provide theoretical results that guarantee the existence of a threshold separating in-distribution and OOD samples in terms of k-nn radius. In addition, the authors propose to use their method along with label smoothing based on the empirical observation in Muller 2020 that shows label smoothing helps to gather in-class samples and separate samples from different classes in feature space. They also provide a theoretical result that explains how label smoothing can help to improve the OOD detection performance of the method. \n", "summary_of_the_review": "While the theoretical results in the paper are interesting, these results are not connected to the implementation of the methods. Also, the method has a limited practical significance in terms of scalability. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "YY_FgKGN_dD", "reviewer": "Reviewer_swL5", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strengths\n\nThis paper proposed an interesting unsupervised OOD method. Empirical experiments showed the superior performance of the proposed method over some baselines; meanwhile, theoretical high-probability statistical results were given to analyze the proposed method.\n\n# Weaknesses\n\nHere are some of my comments/questions. I would appreciate it if the author(s) could give a response. If I am wrong, please correct me. Thanks.\n\n- The author(s) demonstrated the effectiveness of the proposed method through empirical experiments. Currently, there are many new developments in OOD (some of which can be quickly searched and found through search engines), but the methods compared in this paper are obviously inadequate. So I encourage the author(s) might provide more up-to-date OOD algorithms as baseline comparisons before this paper is published at influential conferences or journals so that the effectiveness of the proposed method is convincing.\n\nIn addition, this paper is generally well written, but some places (some issues) in this paper should be further clarified/fixed.\n\n- The format of many references is inconsistent, for example,\n\n   - Conference names are sometimes abbreviated and sometimes not;\n\n   - Authors' names are sometimes abbreviated and sometimes not;\n\n- Some tables are presented as a Figure, resulting in inconsistent font sizes in the tables; for example, Figure 3.\n", "summary_of_the_paper": "Out-of-distribution detection is important in many aspects of machine learning. Based on label smoothing and $k$-NN density estimate, this paper proposed an unsupervised OOD detection method. By empirical experiments, the author(s) demonstrated the effectiveness of the proposed method. And theoretical results for the proposed OOD method were provided.", "summary_of_the_review": "This paper proposed a deep $k$-NN density-based method for out-of-distribution detection in an unsupervised fashion. Empirical experiments were performed to verify the effectiveness of the proposed method, and theoretical results were proven. However, I think that while this is an interesting paper, it would be better to compare more of the new OOD baselines to make the proposed method persuasive.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "Kp8jSMjS890", "reviewer": "Reviewer_E77y", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "While from the experimental results it appears that label smoothing generally improves kNN based OOD detection, I have many issues with the paper:\n\n1. The paper extrapolates the conclusions of Muller et al too much. In Muller et al, the authors showed that label smoothing pushes the penultimate layer representation of a class equally away from the representations of other classes. This conclusion was  grounded in simple but concrete analytical results as well as compelling empirical demonstrations. This in no way implies that label smoothing pushes \"OOD points further away from the training manifold\". Note that Muller's conclusions are only applicable to the classification layer representations and not representations learned by deeper layers.  Furthermore, uniform label smoothing doesn't respect relationships between class labels and this clustering might hurt OOD detection for some domains. I find designing algorithms for high-dimensional representations based on intuition gained from 2D visualizations to be deeply problematic.\n2. The claim in abstract that with label smoothing \"kNN density estimator performs better as a OOD detection method theoretically\" is not supported at all. In Proposition 1 the authors assume that label smoothing separates the in and out-distribution points, i.e. the representations of ID points are pushed towards a single point in the interior of the manifold while the representation of OOD points are pushed towards the boundary. Under this assumption it is obvious that KNN would work well for OOD detection but the theoretical result is the assumption.  \n3. The **Label Smoothed Embedding Hypothesis** formalism in in Proposition 1 is too strong and doesn't make sense. In Proposition 1 the authors assume that there is a single point $x_0$ in the interior of the feature space $\\mathcal{X}$ towards which all the in distribution points are pushed towards when using label smoothing. Also, I don't understand how the feature representation of $x$ ($\\phi(x)$) is a linear combination of $x$ and $x_0$.\n4. The writing is too informal. In Definition 1, $B(x, r)$ is not defined which I assume is the Euclidean ball of radius r centered on x. Terms like training manifold are not defined. It is not clear what \"uncertainty in the softmax function\" means. The authors claim that softmax probabilities cannot distinguish between ID and and OOD points because \"softmax probabilities sum to 1\". I don't understand what this means. Any discrete distribution must sum to 1.\n5. Figure 1 doesn't support claim that \"1NN radii shrink, indicating a contraction towards training manifold for both in-distribution and OOD points. Contraction is higher for ID points than OOD points.\". In the top-right corner even though the 1NN radii shrink under label smoothing, it seems like there is high overlap between the 1NN radii of ID and OOD points. There has to be some quantitative justification for this claim, it is hard to conclude this from looking at the plots.\n6. Following up from the claim about not using softmax distribution, I would have liked to see the control implemented with temperature scaling to reduce calibration error first. Using the softmax probabilities naively to detect OOD points is not a good idea since it is well known that neural network probabilities are not well calibrated. Simple temperature scaling can fix this.", "summary_of_the_paper": "The paper proposes using kNN density estimation for detecting outliers or out-of-distribution (OOD) points using hidden representations learned by a neural network trained with label smoothing. The main claim of the paper is that, under the hypothesis that \"label smoothing causes in-distribution points to contract to the training points faster than OOD points\", the kNN radius can be used to separate OOD points. The paper provides some weak empirical justification for this hypothesis but demonstrate that their method generally out-performs kNN without label smoothing and other baselines on 5 datasets.", "summary_of_the_review": "While I think there is some merit in the proposed algorithm, a lot of the claims made in the paper are not well supported and are extrapolated too much from the results of Muller et al. The theoretical results are perfunctory and the writing it very informal. I think the paper can be improved by making the claims more rigorous either empirically or analytically, especially the label smoothing embedding hypothesis.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "JtCWpsodKHn", "reviewer": "Reviewer_orsU", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "1. Strengths. \n\n- The paper is well written and easy to follow.\n\n- It proposes a simple but effective method for OOD detection based on the k-nn density estimate in the hidden space of a classifier. \n\n- The paper provides interesting theoretical results regarding the importance of the k-nn radius for OOD prediction. \n\n- The experimental results reflect the benefits of label smoothing on the OOD prediction task. Moreover, the proposed method offers competitive performance compared to the chosen baselines.    \n\n2. Points that can be improved. \n\n- Most of the provided theoretical results seem to be on the properties of the k-nn radius for OOD detection. However, it would make more sense to derive similar results for the statistic T(x), which is used as the OOD score. \n\n- The paper includes some interesting results regarding the recall/prediction of the k-NN density-based OOD detection method. It would be useful to report these measures in the experiments (e.g., the area under the precision-recall curve).\n\n- The different theoretical results assume that the number of nearest neighbors is relatively large. Based on the experiments, however, the authors suggest setting k = 1. More discussions regarding this aspect would be useful.   \n\n- The choice of the threshold \"t\" to make the OOD decision does not seem to be discussed in the paper nor investigated in the experiments.  \n\n3. Question\n\nOne question (related to the first point of section 2. above) that arises is why not make OOD prediction based on the k-nn radius rk(gi(x); gi(Xin)) directly. \n\n", "summary_of_the_paper": "This paper proposes a method for Out-Of-Distribution (OOD) detection that relies on the k-nn density estimate in the feature space of a classifier model. Given a data example, the idea is to compute an OOD score based on the k-nn radius w.r.t to the training observations at every hidden layer. The mean of the scores from the different layers is then used for OOD prediction. The authors provide several theoretical results highlighting some desirable properties of the k-nn radius for the OOD detection task. One such result states that training the classifier with label smoothing can improve k-nn radius-based OOD prediction under some regularity conditions. Empirical results show that the proposed method performs well compared to the chosen baselines, and label smoothing seems to improve OOD predictions in most cases. Experiments also include ablation studies showing that the proposed method is not very sensitive to some hyperparameter settings, such as the number of nearest neighbors and the amount of smoothing.", "summary_of_the_review": "The paper is well-written. It proposes a simple method for OOD detections along with interesting theoretical analyses and promising empirical results. There are, however, several aspects that deserve to be improved/clarified. Please refer to the main review section for more details.    ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The problem considered in this paper is of general interest to all reviewers. However, while the reviewers in general appreciate the authors’ effort in providing theoretical analysis for a seemingly effective algorithm, they are unconvinced that the key technical claims are well justified (i.e. separation between theoretical analysis and the algorithm, which ultimately relies on the OOD score), the propositions are clear (e.g., key claims in the quality of kNN density estimator as an OOD detector not well supported by analysis/experiments), or that the experimental results are sufficiently compelling (e.g., lack of controlled experiments/ ablation study) to merit acceptance for the proposed solution.
Decision: Reject