NECO: NEural Collapse Based Out-of-distribution detection
Authors: Mouïn Ben Ammar
Nacim Belkhir
Sebastian Popescu
Antoine Manzanera
Gianni Franchi
Venue: ICLR 2024 poster (2024)
Keywords: anomaly detection
OOD
Primary area: representation learning for computer vision, audio, language, and other modalities

Abstract: Detecting out-of-distribution (OOD) data is a critical challenge in machine learning due to model overconfidence, often without awareness of their epistemological limits. We hypothesize that "neural collapse", a phenomenon affecting in-distribution data for models trained beyond loss convergence, also influences OOD data. To benefit from this interplay, we introduce NECO, a novel post-hoc method for OOD detection, which leverages the geometric properties of “neural collapse” and of principal component spaces to identify OOD data. Our extensive experiments demonstrate that NECO achieves state-of-the-art results on both small and large-scale OOD detection tasks while exhibiting strong generalization capabilities across different network architectures. Furthermore, we provide a theoretical explanation for the effectiveness of our method in OOD detection. We plan to release the code after the anonymity period.

Published as a conference paper at ICLR 2024
NECO: NEURAL COLLAPSE DISTRIBUTION DETECTION
BASED OUT-OF-
Mouïn Ben Ammar 1.+ Nacim Belkhiri, Belkhir',Sebastian Sebastian Popescu', Antoine Manzanera', Gianni Franchi
U2IS Lab ENSTA Paris Palaiseau, FRANCE
SafranTecht, Chateaufort 781 17, FRANCE
(first. last) @enstaparis com", safrangroup.com
ABSTRACT
Detecting out-o--diittibutiin (OOD) data is a critical challenge in machine learn- ing due to model overconfidence, often without awareness of their epistemo- logical limits. We hypothesize that "neural collapse", a phenomenon affecting in-distribution data for models trained beyond loss convergence, also influences OOD data. To benefit from this interplay, we introduce NECO, a novel post-hoc method for OOD detection, which leverages the geometric properties of "neural collapse" and of principal component spaces to identify OOD data. Our exten- sive experiments demonstrate that NECO achieves state-of-the-ar results on both small and large-scale OOD detection tasks while exhibiting strong generalization capabilities across different network architectures. Furthermore, we provide the- oretical explanation for the effectiieness of our method in OOD detection. Code com/ drti//eco
is available at
INTRODUCTION
In recent years, deep learning models have achieved remarkable success across various domains OOpenAl 2023; Ramesh et al. 2021 Jumper et al. 2021). However, a critical vulnerability often plagues these models: they tend to exhibit unwarranted confidence in their predictions, even when confronted with inputs that deviate from the training data distribution. This issue gives rise to the challenge of Out-of-Distribution (OOD) detection for Deep Neural Networks (DNNs). OOD de- tection holds significant safety implications. For instance, in medical imaging DNN may fail to make an accurate diagnosis when presented with data that falls outside its training distribution (e.g., using a different scanner). A reliable DNN classifier should not only correctly classify known In- Distribution (ID) samples but also flag any OOD input as "unknown" OOD detection plays a crucial role in ensuring the safety of applications such as medical analysis (Schlegl et al., 2017). industrial inspection (Paul Bergmann Stege 2019), and autonomous driving (Kitt et al. 2010).
There are various approaches to distinguish ID and OOD data that fall into three main categories: confidence-basse based (Liu et al.) 2020 Hendrycks & Gimpel| 2017] Hendrycks et al. |022 Huang et al,
2021 Liang et al. 2018), fcatures/logits-bone based (Sun & Li [222 [unn al. 2021
Wang al. 2022
Djurisic ef al. 2022) and distance/density based (Ming et al. 2023 Lee et al.
2018b Sun et al,
be approached in a supervised manner, primarily employing outlier exposure methods (Hendrycks et al. 20088), by training a model on OOD datasets. However, in this work, we focus on post-hoc (unsupervised) OOD detection methods. These methods do not alter the network training procedure, hence avoid harming performance and increasing the training cost. Consequently, they be seamlessly integrated into production models. Typically, such methods leverage a trained network to transform its latent representation into scalar value that represents the confidence score in the output prediction. The underlying presumption is that ID samples should yield high-confidens approaches make use of a medel-learned representation, such as the model's l's logits or deep features which are typically employed for prediction, to compute the OOD score.
2022). OOD detection
scores, while the confidence should notably drop for OOD samples. Post-hoc
series of recent studies (Ishida et al. 2020 Papyan V 2020 have shed light on the prevalent
practice of training DNNs well beyond the point of achieving zero error, aiming for zero loss. In the
"corresponding author

---

Published as a conference paper at ICLR 2024
Terminal Phase of Training (TPT), occurring after zero training set enror is reached, a "Neural Col- lapse" " (NC) phenomenon emerges, particularly in the penultimate layer and in the linear classifier of DNNs (Papyan V 2020), and it is characterized by four main properties:
Variability Collapse (NC1): during the TPT, the within-class variation in activations be- comes negligible as each activation collapses toward its respective class mean.
2. Convergence to Simplex ETF (NC2): the class-mean vectors converge to having equal lengths, as well as having equal-sized angles between any pair of class means. This config- uration corresponds to a well-studied mathematical concept known as Simplex Equiangular Tight Frame (ETF).
3. Convergence to Self-Duality (NC3): in the limit of an ideal classifier, the class means and linear classifiers of neural network converge to each other up to rescaling, implying that the decision regions become geometrically similar and the class means lie the centers of their respective regions.
4. Simplification to Nearest Class-Center (NC4): the network classifier progressively tends select the class with the nearest class mean for given activation, typically based on standard Euclidean distance.
These NC properties provide valuable insights into how DNNs behave during the TPT. Recently it was demonstrated that collapsed models exhibit improved OOD detection performance (Haas al.] accelerate the model's collapse
2023). Additionally, they found that applying L2 normalization process. However, to the best our knowledge, no one has yet evidenced the following interplay between NC of ID and OOD data:
5. ID/OOD Orthogonality (NC5): As the training procedure advances, OOD and ID data tend to become increasingly more orthogonal to each other. In other words, the clusters of OOD data become more perpendicular to the configuration adopted by ID data (i.e. the Simplex ETF).
Building upon the insights gained from the aforementioned properties of NC, as well as the novel observation of ID/OOD orthogonality (NC5), we introduce new OOD detection metric called "NECO", which stands for NEural Collapse-based Out-of-distribution detection. NECO involves calculating the relative norm of sample within the subspace occupied by the Simplex ETF structure. This subspace preserves information from ID data exclusively and normalized by the norm of the full feature vector.
We summarize our contributions as follows:
We introduce and empirically validate a novel property of NC the presence of OOD data.
We proposed novel OOD detection method NECO, a straightforward yet highly efficient post-hoc method that leverages the concept of NC. Furthermore, we offer comprehensive theoretical analysis that sheds light on the underlying mechanisms of NECO.
NECO demonstrates superior performance compared to state-of-the-arr methods across dif- ferent benchmarks and architectures, such as ResNet-18 18 on CIFAR 100, and vi- sion transformer networks on ImageNet-1K:
RELATED WORK
Neural Collapse is set of intriguing properties that are exhibited by DNNs when they enter the TPT. NC in its essence, represents the state which the within-class variability of the penultimate layer outputs collapse to a very small value. Simultaneously. the class means collapse to the vertices of Simplex ETF. This empirically emergent structure simplifies the behavior of the DNN classifier. Intuitively, these properties depict the tendency of the network to maximize the distance between the class cluster mean vectors while minimizing the discrepancy within a given cluster. Papyan V (2000) have shown that the collapse property of the model induces generalization power and ad- versarial robustness, which persists across a range of canonical classification problems, on different neural network architectures (e.g., VGG (Simonyan & Zisserman 2015), ResNet (He et al. 2016).
2

---

Published as a conference paper at ICLR 2024
and DenseNet (Huang et al. 2017) and variety of standard datasets (e.g., MNIST Deng 2012
CIFAR-10 and CIFAR- 100 (Krizhevsky) 2012)), and ImageNet (Russakovsky et al. 2015).. NC
behavior has been empirically observed when using either the cross entropy (Papyan V 2020) or
the mean squared error ( (MSE) loss (Han et al. 2022). Many recent works attempt to theoretically
analyze the NC behavior (Yang et al.] [022] Kothapalli [223] Errgen & Pilancil [021 /huu et al.)
2021 Tirer& & Bruna 2022). usually using a mathematical framework based on variants of the un-
constrained features model, proposed by Mixon et al. (2020).
Haas et al. (2023) states that collapsed models exhibit higher performance in the OOD detection task. However, to our knowledge, no one has attempted to directly leverage the emergent properties of NC to the task of OOD detection.
OOD Detection has attracted a growing research interest in recent years. It can be divided into two pathways: supervised and unsupervised OOD detection. Due to the post-hoe nature of our method, we will focus on the latter. Post-hoc approaches can be divided into three main categories. Firstly, confidence-based methods. These methods utilize the network final representation to derive a confidence measure as an OOD scoring metric (DeVries & Taylor] 2018 Huang & Li 202 1b)
Hendrycks & Gimpell 2017:Liu et al. [2020] Hendrycks et al. [0222] Liang et al. [2088] Huang et al, 2021]. Softmax score (Hendrycks & Gimpel,,2011 is the common baseline for post-hoc methods
as they use the model softmax prediction as the OOD score. Energy (Liu et al. 2020) elaborates on that principle by computing the energy (i.e., the logsumexp on the logits), with demonstrated advantages over the softmax confidence score both empirically and theoretically. ODIN (Liang)
iet al. (0188) enhances the softmax score by perturbing the inputs and rescaling the logits. Secondly,
distance/density based (Abati et al. 2019 Lee et al.
2018a; Sabokrou al.) 2018 Zong et al.
2018
Lee et al. [2018) Ming et al. [223 Ren et al. 2021; Sun et al.) 2022 Techapanurak et al.
2019
Zacemzadeh et al., [202]] van Amersfoort et al. (020)) These approaches identify OOD samples
by leveraging the estimated density on the II) training samples. Mahalanobis (Lee et al., 2018b)
utilizes a mixture of class conditional Gaussians on the distribution of the features. (Sun et al. 2022)
uses non-parametric nearest-neighbor distance as the OOD score. Finally, the feature/logit based methods utilize a combination of the information within the model's logits and features to derive the OOD score. (Wang et al., 2022) utilizes this combination to create virtual logit measure the OOD nature of the sample. ASH (Djurisic et al., (022) utilizes feature pruning/filling while relying on sample statistics before passing the feature vector to the DNN classifier. Our method lies within the latter subcategory, bearing different degrees of similarity with some of the methods. In the same subcategory, methods like NuSA (Cook et al., 2020) or ViM (Wang al., 2022 leverage the principal/Null space to compute their OOD metric. More details are presented at 4.1
3 PRELIMINARIES
3.1 BACKGROUND AND HYPOTHESES
In this section, we will establish the notation used throughout this paper. We introduce the following symbols and conventions:
We represent the training and testing sets as Dj = (æ., v and D, (x;, y/ y: re- spectively. Here, æ; represents image, 3/: E [[0, C'I denotes its associated class identifier, and C' stands for the total number of classes. It is assumed that the data in both sets are in- dependently and identically distributed (i.i.d)) according to their respective unknown joint distributions, denoted as Pi and P,,
In the context of anomaly detection, assumeion that Pi and P. exhibit a high degree of similarity. However, (a=00D ,f o00 yer where the data is considered to be i.i.d. according to own unknown joint distribution, referred to as POOD, which is distinct from both P7 and P,.
also introduce another test dataset denoted as DOoD
The DNN is characterized by a vector containing its trainable weights, denoted as w. We use the symbol f to represent the architecture of the DNN associated with these weights, and fu denotes the output of the DNN when applied to the input image x,,
To simplify the discussion, we assume that the DNN can be divided into two parts: a feature extraction component denoted as hws and final layer, which acts classifier and is
3

---

Published as a conference paper at ICLR 2024
denoted (-). Consequently, for any input image 2;, can express the DNN's output as fw (x;) = (Iw hw) (z,).
In the context of image classification, we consider the output of (-) to be vector, which ) E IR for image æ, with D the dimension of the feature space. we denote as h, = h (z;)
We define the matrix H E Mn (R) as containing all the h (x;)) values where 2; belongs to the training set Dr. Specifically, H (21) ... hw (Znz) represents the feature space within the ID data.
We introduce Df as a dataset consisting of data points belonging to class c, and H repre- sents the feature space for class E [0, C?]--
For a given combination of dataset and DNN, we define the empirical global mean NG I/card(D:) EmIED, (xs) E ID and the empirical class means He 1/ dataset.
(x,) E IR, where card(-) represents the number of elements in
In the context of a specific dataset and DNN configuration, we define the empirical co- variance matrix of H to refer to Σr MDx (Dxx(EE) (R)) This matrix encapsulates the total covariance and can be further decomposed into two components: the between-class covari- ance, denoted as EB. and the within-class covariance, denoted as Ew. This decomposition is expressed as Σr ΣB + Σw.
Similarly for a given combination of an OOD dataset and a DNN, we define the OOD empirical global mean PG .0DD and the OOD empirical class means Pe ,0D and the OOD feature matrix HOD E (().
In the context of unsupervised OOD detection with post-hoe method, we train the function (-) using the dataset D,. Following the training process, we evaluate the performance of fo on a com- bined dataset consisting of both DOOD and D,. Our objective is to obtain a confidence score that enables us to determine whether new test data point originates from DooD or D,.
3.2 NEURAL COLLAPSE
Throughout the training process fwr has been demonstrated that the latent space, represented by the output of hws exhibits four distinct properties related to NC. In this subsection delve deeper into the first two, with the remaining two being detailed in D The first Neural Collapse (NC1) property is related to the Variability Collapse of the DNN. As training progresses, the within-class variation of the activations diminishes to the point where these activations converge towards their respective class means, effectively making Σw approach zero. To evaluate this property during training, (Papyan V 2020) introduced the following operator:
Ew Σ
NC1 Tr
C
Here, [t] signifies the Menre-Penrose pseudoinverse. While the authors of Papyan V (200)) state that the convergence of Σw towards zero is the key criterion for satisfying NCI, they also point out that Tr Ew is commonly employed in multivariate statistics for predicting misclassification. This metric measures the inverse signal-to-noise ratio in classification problems. This formula is adopted since it scales the intra-class covariance matrix Σw (representing noise) by the pseudoin- verse of the inter-class covariance matrix Eg (representing signal). This scaling ensures that NC1 is expressed in a consistent reference frame across all training epochs. When NC1 approaches zero, indicates that the activations are collapsing towards their corresponding class means.
The second Neural Collapse (NC2) property is associated with the phenomenon where the empiri- cal class means tend to have equal norms and to spread in such a way as to equalize angles between any pair of class means as training progresses. Moreover, as training progresses, these class means tend to maximize their pairwise distances, resulting in a configuration akin to a Simplex ETF. This property manifests during training through the following conditions:
Here, || lla represents the L2 norm of a vector, denotes the absolute value, (..-) is the inner product, and 8. is the Kronecker delta symbol. The convergence the Simplex ETF is assessed
4

---

Published as a conference paper at ICLR 2024
through two metries that each verify the following properties: the "equinormality" of class/classifier means, along with their "Maximum equiangularity". Equinormality of class means is measured using its variation, follows:
std. {llme - (4al22)
EN class- mennss
(2)
arg. {llme ue [Gll2)
where std and avg represent the standard deviation and average operators, respectively. The second property, maximum equiangularity, is verified through:
(pc - pG, Me - pG) + 0-I
Equiangulaaittylass.mmmm Avge,a
(3)
lIue pa 1e Mer Mal12
As training progresses, if the average of all class means is approaching zero, this indicates that equiangularity is being achieved.
4 OUT OF DISTRIBUTION NEURAL COLLAPSE
Neural collapse in the presence of OOD data. NC has traditionally been studied in the context of ID scenarios. However, recent empirical findings, as demonstrated in Haas et al. (2023) have shown that NC can also have positive impact on OOD detection, especially for Lipschitz DNNs (Virmaux & Scaman 2018). It has come to our attention that NC can influence OOD behavior as well, leading us to introduce a new property: (NC5) ID/OOD orthogonality: This property suggests that, as training progresses, each of the vectors representing the empirical ID class mean tends to become orthogonal the vector representing the empirical OOD data global mean. In mathematical terms, we express this property as follows:
OOD (ees PQ |pellelle OOD
Vc,
0
(4)
OOD
To support this observation, we examined the following metric:
OOD (Mas PG
OrthoDeevadasee--OOD = Avg.
(5)
|| OOD
This metric assesses the deviation from orthogonality between the ID class means and the OOD mean. As training progresses, this deviation decreases towards zero if NCS is satisfied. To vali- date this hypothesis, we conducted experiments using CIFAR-IO as the ID dataset and CIFAR-100 alongside SVHN (Netzer et al. 201T) as OOD datasets. We employed two different architectures, ResNet- 18 (He et al. 2015) and VIT (Dosovitskiy et al. 2020). and trained each of them for 350 epochs and 6000 steps (with a batch size of 128), respectively. During training, we saved network parameters at regular intervals and evaluated the metric of equation for each saved network. The results of these experiments on NC5 ( eq. 5) are shown in Figure [ which illustrates the conver- gence of the OrthoDev. Both of these models were trained using ID data and were later subjected to evaluation in the presence of out-o--distribution (OOD) data. Remarkably, these models exhib- ited a convergence pattern characterized by tendency to maximize their orthogonality with OOD data. This observation is substantiated by the consistently low values observed in the orthogonal- ity equation 5 It implies that during the training process, OOD data progressively becomes more orthogonal to ID data during the TPT. In D we present additional experiments conducted on dif- ferent combinations of ID and OOD datasets, and in C.5 we give further details NECO. We find this phenomenon intriguing and believe it can serve as the basis for new OOD detection criterion, which we will introduce in the next Subsection.
4.1 NEURAL COLLAPSE BASED OUT OF DISTRIBUTION DETECTION (NECO) METHOD
Based on this observation of orthogonality between ID and OOD samples, previous works (Wang et al., 2022, Cook et al. 2020) have utilized the null space for performing OOD detection. We introduce notations and details of these methods. Given image represented by feature tor hew (x), we impose that (x) W h (z). where W is the matrix of the last fully con- nected layer. Cook et al. 2020
Wang al. (2022) have highlighted that features (x)) can
5

---

Published as a conference paper at ICLR 2024
0.6
1.0
NC5: ID/OOD OrthoDev
<CIFARIONOOD (SVHN)
NC5: ID/OOD OrthoDev
ID (CIFARIOWOOD (SVHN)
0.5
<CIFARIONOOD (CIFAR10O)
0.9
ID (CIFARIOMOOD (CIFAR10O)
0.4
0.3
0.7
0.2
0.6
0.1
0.5
0.00
0.4
880
1760
2640 Steps
3520
4400 5280
120
180
240
300
360
Epochs
Figure 1: Convergence to ID/OOD orthogonality for ViT-B (left), Resnet- 18 (right) both trained on CIFAR-10 as ID and tested in the presence of OOD data. Dashed purple lines indicate the end of warm-up steps in the case of ViT and learning rate decay epochs for ResNet-18.
be decomposed into two components: (x)) = lw) W + ( In this decomposition, (ar) = W x (x))", and importantly, W x ( = O. Hence, the component (ar) w does not directly impact classification but plays a role influencing OOD detection. light of this
observation, NuSA introduced the following score: NuSA(x) (=)) [= and ViM
[|]([)]]
introduced ViM(x) = (x:) ||. To identify the null space, NuSA optimizes the decomposition after training. On the other hand, ViM conducts PCA on the latent space H (also after training) and decomposes it into principal space, defined by the d-dimensional projection with the matrix P E (R.)(RR) spanned by the d eigenvectors corresponding to the largest d eigenvalues of the co- variance matrix of H, and null space, obtained by projecting the remaining eigenvectors. In contrast, based on the implications of NC5, we propose a novel criterion that circumvents having to find the null space, specifically:
NECO(x) = |P Vmw(2)) PATTPPPhaa (w) [x)]]
(6)
Vhw(x) hw
Our hypothesis is that if the DNN subject the properties of NCI, NC2, and NC5, then it should be possible to separate any subset of ID classes from the OOD data. By projecting the feature into the first d principal components extracted from the ID data, we should obtain a latent space representation that is close to the null vector for OOD data and not null for ID data. Consequently, by taking the norm of this projection and normalizing it with the norm of the data, we can derive an effective OOD detection criterion. However, in the case of vision transformers, the penultimate layer representation cannot straightforwardly be interpreted as features. Consequently, the resulting norm needs to be calibrated in order serve as a proper OOD scoring function. To calibrate NECO score, we multiply it by the penultimate layer biggest logit (MaxLogit). This has the effect of injecting class-based information into the score in addition to the desired scaling. It is worth noting that this scaling is also useful when the penultimate layer size is smaller than the number of classes, since in this case, it is not feasible to obtain maximum OrthoDev between all classes. We refer the reader to E for empirical observations on the distribution of NECO under the presence of OOD data.
4.2 THEORETICAL JUSTIFICATION
To gain a better understanding of the impact of NECO, we visualize the Principal Component Anal- ysis (PCA) of the pre-logit space in Figure 2 with ID data (colored points) and the OOD (black). This analysis is conducted on the ViT model trained on CIFAR-10, focusing on the first two prin- cipal components. Notably, the ID data points have multiple clusters, one by class, which can be attributed to the influence of NC1, and the OOD data points are positioned close to the null vector. To elucidate our criterion, we introduce an important property:
Theorem 4.1 (NC1+NC2+NCS imply NECO). We consider two datasets living in RDD, (DoOD; Dz} and a DNN fa)() (-) = (h.))) that satisfy NCI, NC2 and NC5. There d < D Dooor PCA on D, s.t.
NECO("OOD 00D) ) 0. Conversely, for E D, and considering f Ö we have that NECO(x:) + 0.

---

Published as a conference paper at ICLR 2024
The proof for this theorem can be found in A
ID
ID
OOD
0OD
0OD
PC
PC2
1
PC
PC
Figure 2: Feature projections on the first 2 principal components of PCA fitted on CIFAR-10 10 (ID) using ViT penultimate layer representation. OOD data are ImageNet-O (left), Textures (middle), and SVHN (right). The Figure shows how NCI property is satisfied by ID data, and that OOD data lie around the origin.
Remark 4.1. We have established that NECO TECO(LOO0) OOD) =0, 0, which does not imply that NECO(x) = O for all x Doon- However, in addition NC5, we can put forth the hypothesis that NC2 also occurs on the mix of ID/OOD data, while NCI doesn't occur on the OOD data by themselves. resulting in an OOD data cluster that is equiangular and orthogonal the Simplex ETF structure. We refer the reader to Section D justification. Furthermore, the observations made in Figure appear to support our hypothesis.
5 EXPERIMENTS & RESULTS
In this section, compare method with state-offthh-aar algorithms, small-scale and large- scale OOD detection benchmarks. Following prior work, we consider ImageNet-IK, CIFAR- 100 and CIFAR-100 100 as the ID datasets. We use both Transformer-bas based and CNN-based models to benchmark our method. Detailed experimental settings are as follows.
OOD Datasets. For experiments involving ImageNet-1K K as the inliers dataset (ID), we assess the model's performance on five OOD benchmark datasets: Textures (Cimpoi et al.) 2014). Places365 (Zhou et al. (016),, iNaturalist (Horn et al. 2017), a subset of 10000 images sourced from (Huang 2022l ImageNet-OO (Hendrycks 2001lb) and SUN (Xiao al. 2010). For experiments where CIFAR-10 10 (resp. CIFAR-100) serves as the ID dataset, we employ CIFAR-100 (resp. CIFAR- 10) alongside the SVHN dataset (Netzer al.] 201T) OOD datasets in these experiments, The standard dataset splits, featuring 50000 training images and 10000 test images, are used in these evaluations. Further details are provided Cn We refer the reader to for additional testing results on the OpenOOD benchmark (Zhang al. 2023
Evaluation Metrics. We present results using two widely adopted OOD metrics (Yang al. 202T]. Firstly, we consider FPR95, the false positive rate when the true positive rate (TPR) reaches 95%. with smaller values indicating superior performance. Secondly,
the AUROC metric, which is threshold-free and calculates the area under the receiver operating characteristic curve (TPR). A higher value here indicates better performance. Both metrics are reported as percentages.
Experiment Details. We evaluate our method on a variety of neural network architectures, includ- ing Transformers and CNNs. ViT (Vision Transformer) (Dosovitskiy et al.) 2020) is a Transformer- based image classification model which treats images as sequences patches. We take the official pretrained weights on ImageNet-21K (Dosovitskiy et al.) 2020) and fine-tune them on ImageNet- IK, CIFAR-I0, and CIFAR-100. Swin (Liu et al. 2021 is also a transformer-based classification model. We use the officially released V2-B/2 model, which is pre-trained on ImageNet-21 K and fine-tuned on ImageNet-1K 1K. From the realm of CNN-based models, we use ResNet-18 18 (He let al. 2015)). When estimating the simplex ETF space, the entire training set is used. Further details As a complementary experiment, we also assess
pertaining to model training are provided in C.4
approach DeiT Touvron al. (202) in

---

Published as a conference paper at ICLR 2024
Baseline Methods. In our evaluation, compared our method against twelve prominent post- hoc baseline approaches, which we list and provide ample details pertaining to the implementation and associated prparpprraeterss in B
ImageNet-O
Textures
iNaturalist
SUN
Places365
Average
Model
Method
AUROC1 FARJAUROC" FARJAUROCT AUROC FURLAU
FAROAU FPR.
VIT-
Softmax score
85,31 52.65
86.64 49.40
97.21 12.14
86.64 53.75
85.32 56.93
88.26 44,97
B/16
MaxLogit
92.23 36.40
91.69 36.90
98.87 5.72
92.15 39.88
90.05 46.75
92.99 33.13
Enengy
93.03 31.65
92.13 34,15
9,70444766
92.65 36.90
90.38 43.72
93.45 30.24
Energy+ RReAct
93.08 31.25
92.08 34.50
99.112 4.91
92.56 36.94
90.19 44.25
93.39 30.37
VIM
94.01 28.95
91.63 38.22
99.59 2.00
92.73 34.00
89.67 44.12
93.56 29.46
Residuul
92.10 38.35
87.71 52.34
99.36 2.79
40.91
85.60 53.93
90.85 37.66
GradNorm
84.70.34.85
34.85
86,29 35.76
97.45 6.17
86.67 39.49
83.59 46,94
87.74 32.64
Mahalanobis
94.00 30,90
91.69 37.93
99.67 1.55
91.38 38.48
88.66 46.09
93.08 30.99
KI. Matching
53.40
84.61 52.38
95.07 15.31
83.25 62.10
82.00 65.99
85.57 49.84
ASH-B
69.28 85.25
66.05 83.29
72.62 80.62
59.36 91.53
55.08 92.68
64.48 86.67
ASH-P
93.31 29.00
91.55 37.58
98.75
92.96 33,50
90.07 41.81
93.33 29.63
ASH-S
92.85 29.45
91.00 39.73
98.50 7.28
92.61 33.12
89.55 41.68
92,90 30.25
NuSA
34,38
88.28 51.24
9.12
89. 40.08
85.28 54,51
90.92 36.65
NECO (ours)
94.53 25.20
92.86 32.44
3,236
93.15 33.98
90.38 42.66
94.05 27.51
SwinV2
Switinoofumux Softmax
61,0989960
81.72 60.91
47.69
81.24 66.85
S1.09 68.27
78.75 66.66
MaxLogii
61.34 87.95
80,36 59.55
86.47 50.51
78.17 68.50
77.43 69.41
76.75 67.18
Energy
85.75
77.91 64.44
81.85 63.44
73.80 76.89
73,09 76.68
73.59 73.44
Energy+ ReAct
68,38 83.85
84,56
90.23
82.61 69.27
81.41 70.19
81.44 67.03
VIM
69.066 83.45
81,50 61.18
87.54 54.09
75.24 73.92
73.12 76.46
77.29 69.82
Residual
66.82 83.80
77.36 65.00
83.23 59.77
71.03 76.41
68.90 78.53
73.47 72.70
GrudNorm
37.39 95.95
33.84
31.82 95.01
31.97 96.29
33.06 95.73
33.62 95.26
Mahalanobis
71.87 86.05
84.51 63.35
89.81 57.10
80.28 75.39
78.52 77.10
80.99 71.00
KL-Mutching
58.60
75.30 71.69
82.93 58.29
73.72 76.53
72.11 78.91
72.53 74.58
ASH-B
47.17 96.35
38.59 97.50
48.62.97.55
52.11 95.64
52.93 96.15 18
47.86 96.64
ASH-P
37.38 97.95
26.51 98.90
20.73 99.28
24.49 99.08
26. 98.93
27.05 98.83
ASH-S
95.36
36.08 94.63
16.15 16.15
22.21 98.53
23.72 98.05
27.70
NuSA
56.50
62.72 83.14
64.01 83.58
55.97 91.28
54.44 92.71
58.73 88.53
NECO (ours)
65.03 80.55
82.27 54.67
91.89 34.41
82.13 62.26
81.46 64.08
80.56 59.19
Table I: OOD detection for NECO and baseline methods. The ID dataset is ImageNet-IK, and OOD datasets are Textures, ImageNet-O, iNaturalist, SUN, and Places365. Both metrics AUROC and FPR95. are in percentage. A pre-trained ViT-B/16 model and Swin V2 are tested. The best method is emphasized in bold, and the 2nd and 3rd ones are underlined.
Result on ImageNet-IK. In Table we present the results for the ViT model in the first half. The best AUROC values are highlighted in bold, while the second and third best results are underlined. Our method demonstrates superior performance compared to the baseline methods. Across four datasets, achieve the highest average AUROC and the lowest FPR95. Specifically, we attain FPR95 of 27.51%, surpassing the second-place method, ViM, by 1.95%. The only dataset where we fall slightly behind is iNaturalist, with AUROC being only 0.33% lower than the best-perg approach. In Table D we provide the results for the S2 model in the second half. Notably, our method consistently outperforms all other methods in terms of FPR95 on all datasets. On average, we achieve the third-best AUROC and significantly reduce the FPR95 by 7.47% compared to the second-bess performing method, Softmax score. We compare NECO with MaxLogit (Hendrycks) et al. 2022) to illustrate the direct advantages of our scoring function. On average, we achieve FPR95 reduction of 5.62% for and 7.99% for Swin when transitioning from MaxLogit to NECO multiplied by the MaxLogit. This performance enhancement clearly underscores the value of incor- porating the NC concept into the OOD detection framework. Moreover, NECO is straightforward to implement in practice, requiring simple post-hoc linear transformations and weight masking.
Results on CIFAR. Table Pablee/preeentt the results for the VIT model and Resnet-18 both on CIFAR- 10 and CIFAR-100 as ID dataset, tested against different OOD datasets. On the first half of the table, we show the results using a ViT model. On the majority of the OOD datasets cases we outperform the baselines both in terms of FPR95 and AUROC. Only ASH outperforms NECO on the use case CIFAR-100 vs SVHN. On average we surpass all the baseline on both test sets. In the second half, show the results using a ResNet-19 18 model. Similarly to ViT results, on average the baseline strategies by at least 1.28% for the AUROC on the CIFAR-10 cases and lowered the best baseline performance by 8.67% in terms of FPR95, the CIFAR-100 cases. On average, our
surpass
8

---

Published as a conference paper at ICLR 2024
CIFAR-100
SVHN
Average
CIFAR-10
SVHN
Average
AUROC1 FPRLAUROCT FPRJAUROC1 APRLAURCC FPRJAUROCY FPRLAUROC FPR.
Softmax score
98.36 7.40
99.64 0.59
99.003.999
92.13 34.74
91.29 39.56
91.71 37.15
VIT
MaxLogii
98.60 5.94
99.90 0.23
99:25 3.09
92.81 26.73
96.20 18.68
94.51 22.71
Energy
98.63
99.92 0.21
99.28 3.07
92.68 26.37
96.68 15.72
94.68 21.05
Encrgy&ReAct
98.68 5.92
99.92 0.23
99.30 3.08
93.43 25.93
96.65 15.88
95.04 20.91
VIM
98.81
9.85
99.16 2.84
26
95.55 26.33
95.17 26.22
Residual
98.49 7.09
96.95 12.64
97.72 9.87
94,63 28.42
92.43 44.65
93.53 36.54
GradNorm
95.82
99.85
9.7
26.20
94.85 16.69
93.48
Mahalanobis
98.73 5.95
95.52 18.61
97.13 12.28
95.42 24.02
93.91 37.11
94.67 30,57
KI-Matching
95.07
13.37
38.34
79.83 40.04
ASH-B
95.15 17.49
99.09 4.81
97.12 11.15
78.07 53.01
82.99 53.97
80.53 53.49
ASH-P
97.89 7.22
99.90 0.26
98.90 3.74
85.12 29.82
97.04 14.06
91.08 21.94
ASH-S
97.56 7.73
99.89 0.32
98.73 4.03
83.30 30,96
97.04 14.55
90.17 22.56
NuSA
98.56 6.79
99.60 1.03
99.08 3.91
94.50 28.77
94.27 35.91
94,39 32.34
NECO (ours)
98,95 4.81
99.93 0.12
99.44 2.47
95.17 23.39
96.65
15.47
95,41 19.43
Softmax score
85.07 67.41
92.14 46,77
88.61 $7.09
75.35 83.09
77.30 85.61
76.33 84.35
ResNet-18
MaxLogit
85.36 59.19
93.73
83.12
85.36
Energy
85.46 58.68
93.96 29.71
89.71 44, 20
75.25 83.76
76.40 90.77
75.83 87.27
Energy+ReAct
84.22 60.04
92.31 35.17
88.27 47.61
70.00 85,99
74.14
72.07 88.52
VIM
85.11 63.76
94.87 27.35
89.99 45.56
67.61 90.08
86.13 67.31
76.87 78.70
Residuul
76.06 76.53
90.21 48.18
83.14 62.
45,99 96.19
72.52 86.60
59.23 91.40
GradNorm
60.83 69.98
78.28 42.83
69.56 56.41
72.62 84.64
69.66 91.58
59.55 88.11
Mahalanobis
81.23
90.39 54.51
85.81 63.43
55.85 95.41
79.96 81.63
67.91 88.52
KI-Matching
77.83 68.12
86.73 49.44
82.28 58,
73.52 83.05
77.32 74.82
67.91 78.94
ASH-B
73.89 64.45
83.79 44.77
78.84 54.61
74, 84,00
72.1482.02
76. 83.01
ASH-P
83:96 59.90
26.04
42.97
75.46 82.98
71.28 89.43
76.37 86.21
ASH-S
82.48 62.38
91.54 39.94
87.01 11
72.17 85.20
80.18 74.39
76.18 80.00
NuSA
85 59.52
21.82
90.71
40.67
70.32 86.36
88.4
57
29.38
NECO (ours)
86.61 57.81
95.92 20.43
91.27
39.12
70,26 85.70
88.57 54.35
79.42 70.03
Table 2: OOD detection for NECO baseline methods. The ID dataset are CIFAR-IO/CIFAR- and OOD datasets are CIFAR-IO0/CIAAR alongside SVHN. Both metrics AUROC and FPR95 in percentage. The best method is emphasized in bold, and the 2nd and 3rd ones are underlined.
approach outperforms baseline methods in terms of AUROC. However, we notice that our method performs slightly worse on the LIFAR-10--D/CIIAR--I---- task.
CONCLUSION
This paper introduces a novel OOD detection method that capitalizes on the Neural Collapse (NC) properties inherent in DNNs. Our empirical findings demonstrate that when combined with over- parameterized DNNs, our post-hoc approach, NECO, achieves state-of-the-an OOD detection re- sults, surpassing the performance of most recent methods on standard OOD benchmark datasets. While many existing approaches focus on modeling the noise by either clipping it or considering its norm, NECO takes different approach by leveraging the prevalent IDD information in the DNN, which will only be enhanced with model improvements. The latent space contains valuable infor- mation for identifying outliers, and NECO incorporates an orthogonal decomposition method that preserves the equiangularity properties associated with NC.
We have introduced novel NC property (NC5) that characterizes both ID and OOD data behavior. Through our experiments, we have shed light on the substantial impact of NC on the OOD detection abilities of DNNs, especially when dealing with over-parameterized models. We observed that NC properties, including NC5, NC1, and NC2, tend to converge towards zero as expected when the network exhibits over parametrrizzainnn This empirical observation provides insights into why our approach performs exceptionally on variety of models and broad range of OOD datasets (we refer the reader to the complementary results in E), hence demonstrating the robustness of NECO against OOD data. While approach excels with Transformers and CNNs, especially in the case of over- parametrrzee models, we observed certain limitations when applying it to DeiT (see the results
in D} These limitations may be attributed the distinctive training process of DeiT (i.e., including a distillation strategy) which necessitates a specific setup that we did not account for in or- der to prevent introducing bias to the NC phenomenon. We hope that this work has shed some light on the interactions between NC and OOD detection. Finally, based on our results and observations, this work raises new research questions on the training strategy of DNNs that lead to NC in favor of OOD detection.

---

Published as a conference paper at ICLR 2024
REFERENCES
Davide Abati, Angelo Porrell,, Simone Calderara, and Rita Cucchiara. Latent space autoregression for novelty detection, 2019.
Julian Bitterwolf, Maximilian Müller, and Matthias Hein. In or out? fixing imagenet out-of- distribution detection evaluation, 2023.
Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. De- scribing textures the wild. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2014.
Matthew Cook, Alina Zare, and Paul Gader. Outlier detection through null space analysis of neural networks, arXiv preprint urXiv:2007.0126. 2020.
Li Deng. The mnist database handwritten digit images for machine learning research. JEEE Signal Processing Magazine, 29(6):141-144 2012.
Terrance DeVries and Graham W. Taylor. Learning confidence for out-of-distribution detection in neural networks, 2018
Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for ouist--diitriuutiin detection. arXiv preprint arXiv:2209.09858, 2022.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenbom, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x words: Transformers for image recognition at scale. CoRR, abs/2010.1 1929, 2020. URL Utthttps::/ //tp::///axvv..oo wwwpxxiv.oog/aaoo abs /2010. 11200.1199999 1929
Tolga Ergen and Mert Pilanci. Revealing the structure of deep neural networks via convex duality, 2021.
Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of dis-if--istributioo detection. CoRR, abs/2106.03004, 2021. http://pps///aa....ro///aaaaaaaa
03004
Jarrod Haas, William Yolland, and Bernhard T Rabus. Linking neural collapse and 12 normalization with improved out-of-distribution detection in deep neural networks. Transactions on Machine Learning Research, 2023. ISSN 2835-8856. URL httpp::/ wttps/////ppeeiiie...... net forum?
Id=f
X. Y. Han, Vardan Papyan, and David I.. Donoho. Neural collapse under mse loss: Proximity to and dynamics on the central path, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual leaminn for image recog- 2015.
nition. CoRR,
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp- 770-778, 2016.
doi: 10. N0.1109/CVPR.2016
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common cor- ruptions and perturbations. arXiv preprint arXiv: 290.. 2019.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of cuttof-distribution examples in neural networks. Proceedings of International Conference on Learning Representa- tions, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas G. Dietterich, Deep anomaly detection with outlier exposure. CoRR, abs/1812.04606 2018.
04606
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang. Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, al. The many faces of robustness: A critical analysis of dustrf-distribution generalization. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 8349, 2021a.
10

---

Published as a conference paper at ICLR 2024
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adver- sarial examples. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 15271, June 2021b.
Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Xiaodong Song. Scaling out- -ito---distribution detection for real- settings. In Interna- tional Conference on Machine Learning. 2022. URL httpp::/app..eeeeeeeepp http:////aaa.emmmiiiiic.ceeceeee
org/ Co:
Grant Van Horn, Oisin Mac Aodha, Yang Song, Alexander Shepard, Hartwig Adam, Pietro Perona, and Serge J. Belongie. The inaturalist challenge 2017 dataset. CoRR, abs/1707.06642, 2017.
URL http://tpaaaa http///rxvvvvoom org/ abs 11t./1107... 06642
Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Q. Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2261-2269, 2017. doi: 10. 1091CVP..2.2
Rui Huang and Yixuan Li. Mos: Towards scaling -uitt--distribution detection for large semantic space. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 8710-8719, June 2021a.
Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space, 2021b.
Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distribu- tional shifts in the wild. CoRR, abs/2110.00218, 2021. URL https: org/ /
2110. 00218
Takashi Ishida, Ikko Yamane, Tomoya Sakai, Gang Niu, and Masashi Sugiyama. Do we need zero training loss after achieving zero training error? CoRR, abs/2002.08709, 2020. URL https:
08709
John Jumper, Richard Evans, Alexander Pritzel, and et al. Highly accurate protein structure pre-
diction with AlphaFold. Nature, 596:583-589, 2021. doi: 10. 10.110008446666 1001008881556---1-08111122 URL
021 https: // www. nat com www.o///rticeeesssseoooooo 021--4111---0001111113-33--33-1- 03819-2
Bernd Kitt, Andreas Geiger, and Henning Lategahn. Visual odometry based on stereo image quences with ransac-based outier rejection scheme. In Intelligent Vehicles Symposium, pp. IEEE, 2010. http:t/tp://lpppp -iini-ttiir... de cbtconnfivs//iiieeeccccccc ivssivv//vvv
html #XitEGL10)
Vignesh Kothapalli. Neural collapse: A review on modelling principles and generalization, 2023.
Alex Krizhevsky. Learning multiple layers of features from tiny images. University of Toronto, 05 2012.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. simple unified frame- work for detecting out-of-distribution samples and adversarial attacks. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Ad- vances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., filesspapeer/010e/
2018a. URL Tacaaaaccccccccoccccaaaaaaaaaaaa o.c. pdf
www.::/g.....iiii......o.c.. 2lle/abdeb6f5 (1577555555666 (ewe44444caaa999000
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified frame- work for detecting cut-of-distributie samples and adversarial attacks. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Ad- vances in Neural Information Processing Systems, volume 31. Curran Associates. Inc., 2018b. URL htttps://prccestt ngs
wtw.:eeednnnnnnnn.nnn........eee www.ine..s..mm wwtpurris.ccpppppeee cc/paper. fi wwt.fffl//pppre/eeeee.. Fil w.te//bbbbffff. www.e6f555565566 6677666667667777 0otpe://4400000000000000000
.pof
Shiyu Liang Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In International Conference on Learning Representations, 2018.

---

Published as a conference paper at ICLR 2024
Weitang Liu, Xiaoyun Wang, John Douglas Owens, and Yixuan Li. Energy-basee oftt-oo--strrbuutf detection. ArXiv, abs/2010.03759, 2020. URL https: appi semanticscholaa: orq/
DerpusID:2222000
Ze Liu, Han Hu, Yutong Lin, Zhuliang Yao, Zhenda Xie, Yixuan Wei, Jia Ning, Yue Cao. Zheng Zhang, Li Dong, Furu Wei, and Baining Guo. Swin transformer V2: scaling up capacity and resolution. CoRR, abs/2111 02/22111.09883
09888
Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embeddings for out-of-distribution detection? In The Eleventh International Conference on Learning Repre- sentations, 2023. URL https: / openrevieeeeweeeeeeeeeeee n forum? -anenndddddaaa-aa-aa aEF FEOW5pdd
Dustin G. Mixon, Hans Parshall, and Jianzong Pi. Neural collapse with unconstrained features, 2020.
Yuval Netzer, Tao Wang, Adam Coates, A. Bissacco, Bo Wu, and A. Ng. Reading digits in natural images with unsupervised feature learning. In Proceedings the NIPS Workshop on Deep Learn ing and Unsupervised Feature Learning, 2011. URL httpp::///// //apsi://pp.p.. api semanticschole..
arg/CorpusTin 16852518
OpenAl. Gpt-3, 2023. URL
com/ Computer software.
Donoho DL. Papyan V, Han XY. Prevalence of neural collapse during the terminal phase of deep learning training. Computer Vision and Pattern Recognition, 2020.
David Sattlegger Paul Bergmann, Michael Fauser and Carsten Stege. Mvtec ad comprehensive real-world dataset for unsupervised anomaly detection. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9592-9600, 2019.
Aditya Ramesh, Mukul Goyal, Daniel Summers-Stay, and al. Dall-e: Creating images from text. arXiv preprint 20ti:22002./2992 2021. httpttttts://aaee
.org////aaaoo................... ht////bs211222 2102. 12092
Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International conference on machine learning, pp. 5389-5400 500...00........ 2019.
Jie Ren, Stanislav Fort, Jeremiah Liu, Abhijit Guha Roy, Shreyas Padhy, and Balaji Lakshmi- narayanan. A simple fix to mahalanobis distance for improving near-ood detection, 2021.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV), 115(3)211-2522 2015. doi: 10. 1007// 1263-015-0816.y.
Mohammad Sabokrou, Mohammad Khalooei, Mahmood Fathy, and Ehsan Adeli. Adversarially learned one-class classifier for novelty detection, 2018.
Thomas Schlegl, Philipp Seeböck, Sebastian M Waldstein, Ursula Schmidt-Erfurth, and Georg Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In International conference information processing in medical imaging, pp. 146 157. Springer, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2015.
Yue Song, Nicu Sebe, and Wei Wang. Rankfeat: Rank-1 feature removal for out-of-distriibtiin detection, 2022.
Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-distributiio detection. In European Conference on Computer Vision, 2022.
Yiyou Sun, Chuan Guo, and Yixuan Li. React: cuttof-diittibution detection with rectified activa- tions. In A. Beygelzimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.). Advances in Neural Information Processing Systems, 2021. URL //tp://///e///eeieeeeee net forum? dd= RR5m
12

---

Published as a conference paper at ICLR 2024
Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors, 2022.
Engkarat Techapanurak, Masanori Suganuma, and Takayuki Okatani. Hyperparameter-free out-of- distribution detection using softmax of scaled cosine similarity, 2019.
Tom Tirer and Joan Bruna. Extended unconstrained features model for exploring deep neural col- lapse, 2022.
Hugo Touvron, Matthicu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention, 2021.
Joost van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using a single deep deterministic neural network, 2020.
Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set set recognition: good closed-set classifier is all you need? arXiv preprint arXiv:2110.06207 2021.
Aladin Virmaux and Kevin Scaman. Lipschitz regularity of deep neural networks: analysis and efficient estimation. Advances in Neural Information Processing Systems, 31, 2018.
Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual-
logit matching. 2022.
Jianxiong Xiao, James Hays, Krista A. Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recogmition from abbey to zoo. 2010 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, pp. 3485-3492, 2010. URL httpss:/aapp...
ssmaant hra.hholl...org//oooosttti1:0100
Jingkang Yang. Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110.113344 2021.
Yibo Yang, Shixiang Chen, Xiangtai Li, Liang Xie, Zhouchen Lin, and Dacheng Tao. Inducing neural collapse in imbalanced learning: Do really need learnable classifier at the end of deep neural network?, 2022.
Alireza Zaeemzadeh, Niccolo Bisagno, Zeno Sambugaro, Nicola Conci, Nazanin Rahnavard, and Mubarak Shah. Out-of-distrbbttion detection using union of I-dimensional subspaces. Pro- ceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp- 9452-9461, June 2021.
Jingyang Zhang, Jingkang Yang. Pengyun Wang, Haoqi Wang, Yueqian Lin, Haoran Zhang, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, Yixuan Li, Ziwei Liu, Yiran Chen, and Hai Li. Openood v1.5: Enhanced benchmark for out-of-distribution detection, 2023.
Bolei Zhou, Aditya Khosla, Àgata Lapedriza, Antonio Torralba, and Aude Oliva, Places: An image database for deep scene understanding. CoRR, abs/1610.02055, 2016. URL
axg/abs/16100 02055
Zhihui Zhu, Tianyu Ding, Jinxin Zhou, Xiao Li, Chong You, Jeremias Sulam, and Qing Qu. A geometric analysis of neural collapse with unconstrained features. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (eds.), Advances Neu- ral Information Processing Systems, volume 34, pp. 29820-29834. Curran Associates, Inc., 2021. URL http:s////poceediisssseeieieeeee
files/paper/2021/
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In In-
ternational Conference on Learning Representations, 2018. URL httpt:::///// httttt://openrreeseee /ttp:///ppeeeii...// net / www.ommiddneuaa.........
13

---

Published as a conference paper at ICLR 2024
TABLE OF CONTENTS SUPPLEMENTARY MATERIAL
Theoretical justificctinn
15
B Details on Baselines Implementations
15
Additional Experiment Details
17
C.1
OOD datasets
17
NECO pseudo-code
17
Effect of MaxLogit multiplication
18
Fine-tuning details
18
C.S Dimension of Equiangular Tight Frame (ETF)
19
C.6
Classification Accuracy
D
Details about Neural Collapse
21
Additional neural collapse properties
D.2
Neural collapse additional results
22
Complementary Results
24
14

---

Published as a conference paper at ICLR 2024
A THEORETICAL JUSTIFICATION
Before proceeding with the proof of Theorem 4.1 we first introduce some notation and useful lemma for the subsequent proof.
Given a vector ø1 E I we define = as the projection of 2 onto a subspace obtained by applying PCA an external dataset D of same dimensionality as 21. This subspace has dimensions limited to d < D.
Lemma A.1 (Orthogonality conservation). We consider a single dataset, D1 = (ha)__1 E RD, along with two vectors, {=1, x2] E RP, that are not necessarily part of D₁ with the condition that (21, 22) = 0. Considering a PCA on D1, it follows that (z (2PCA, 222 2 =0
Proof. If 1. 22, then have z| z2 0. Let define P E (D.a(R) the projection matrix of the PCA.
By definition P is an orthogonal matrix, hence pTP la and PP Ip. where ID and La are the identity matrices of MIDxx((R) and Maxa(BR), respectively, We have (zf =fCA 0, thus proving the orthogonality of PCA projections.
(PT2,) =1)T(PTT zạ) z PPP2. Z2 2 IDz2 21 22
This lemma asserts that the PCA projection keeps the orthogonal property of two vectors, which will be of great importance towards the proof of the next theorem.
For completeness, we reiterate the theorem, followed by the proof.
Theorem A.2 (NC1+NC2+NC5 imply NECO). We consider two datasets living in R.D, (DOOD. } and DNN f. (gw o h-) that satisfy NC1, NC2 and NC5. There 3d & D for PCA on D, s.1. NECO(" OOD) = O. Conversely, for x E D, and considering æ + Ô we have that NECO(()) +
Proof. Assuming, for the sake of contradiction, that have Vd < D NECO(LOOD) + 0 and NECO(x) = 0 for data points æ in D,. Given PCA dimension d s.t. d 2 C and based on the mathematical underpinnings of PCA (i.e., linear nature of projections) coupled with the NCI+NC2 assumptions, most data points in D, satisfy the condition that (a)()))) is maximized and there- fore not equal to zero, implicitly the NECO score not being equal zero.
Considering our assumption of NC1 NC2, we can infer that each class resides within one- dimensional space that is aligned with pe- As a result, the set of vectors {Ma) forms an or- thogonal basis. According to the PCA definition, the dimensional space resulting from PCA, when
PCA represents the PCA d C. should be spanned by the set {ue PCA1C Joml Here, for each class c, fre projection of lee- Utilizing the orthogonality conservation lemma and considering our assumption of NC5, we can PCA is orthogonal to PG
deduce that each He
,00D Consequently, we can confidently state that NECO OOD) = O, thereby achieving the sought contradiction.
B DETAILS ON BASELINES IMPLEMENTATIONS
In this section, we provide an overview of the various baseline methods utilized in our experiments. We explain the mechanisms underlying these baselines, detail the hyperparameters employed, and offer insights into the process of determining hyperparameters when a baseline was not originally designed for a specific architecture.
ASH. ASH, as introduced by Djurisic et al. (2022). employs activation pruning at the penulti- mate layer, just before the application of the DNN classifier. This pruning threshold is determined on per-sample basis, eliminating the need for pre-computation of ID data statistics. The original paper presents three different post-hoc scoring functions, with the only distinction among them being the imputation method applied after pruning. In ASH-P, the clipped values are replaced with zeros. ASH-B substitutes them with a constant equal to the sum of the feature vector be- fore pruning, divided by the number of kept features. ASH-S imputes the pruned values by taking
15

---

Published as a conference paper at ICLR 2024
the exponential of the division between the sum of the feature vector before pruning and the fea- ture vector after pruning. Since our study employs different models than the original ASH paper fine-tuned their method using range of threshold values, specifically [65, 70, 75, 80, 85, 90, 95, 99), for their three variations of ASH, consistent with the thresholds used in the original paper. The optimized ASH thresholds are presented in Table B.3
by Djurisic et al. (202)),
Ash Variant
dataset
CIFAR-10
CIFAR-100
ImageNet
Model
VIT
75
60
70
SwinV2-B/16
ASH-B
DeiT-B/16
60
ResNet-18
75
90
VIT
SwinV2-B/16
60
ASH-P
DeiT-B/16
60
ResNet-18
VIT
SwinV2-H/16
99
ASH-S
DeiT-B/16
99
ResNet-18
Table B.3: Ash optimised pruning threshold per-model and per-dataset. Values are percentage.
ReAct. For the ReAct baseline, we adopt the ReAct+Energy setting, which has been identified the most effective configuration in prior work Sun et al. (202T). The original paper determined that the 90th percentile of activations estimated from the di-tstrritttion (ID) data was the optimal threshold for clipping. However, given that employed different models in experiments, found that using a rectification percentile of = 99 yielded better results in terms of reducing the false positive rate (FPR95) for models like VIT and DeiT, while a percentile of p 0.95 was more suitable for Swin. In our reported results, we use the best threshold setting for each model accordingly ensure optimal performance.
VIM and Residual. Introduced by Wang et al. 2022). VIM decomposes the latent space into a principal space P and a null space pt_ The VIM score is then computed by using the projection of the features on the null space to create a virtual logit, using the norm of this projection along with the logits. In addition, they calibrate the obtained norm by a constant alpha to enhance their performance. Alpha is the division of the sum of the Maximum logits, divided by the sum of the norms in the null space projection, both measured on the training set. As for Residual, the score is obtained by computing the norm of the latent vector projection in the null space.
We followed ViM official paper (Wang et al. (2022) recommendation for the null space dimenssion the VIT, DeiT and swin, i.e., [512,512, 1000] respectively. However, the case of ResNet- 18 was not considered in the paper. We found that a 300 latent space dimension works best in reducing the FPR.
Mahalanobis. We have also implemented the Mahalanobis score by utilizing the feature vector before the final classification layer, which corresponds to the DNN classifier, following the method- ology outlined in Fort et al. (202T). To estimate the precision matrix and the class- wise average vector, utilize the complete training dataset. It is important to note that incorporate the ground-truth labels during the computation process.
KL-Matching. We calculate the class-wise average probability by considering the entire training dataset. In line with the approach described in Hendrycks al. (2022), we rely on the predicted class rather than the ground-truth labels for this calculation.
Softmax score. Hendrycks & Gimpel (2017) uses the maximum softmax probability (MSP) of the model as an OOD scoring function.
MaxLogit. Hendrycks et al. (2022) uses the maximum logit value (Maxlogit) of the model as an OOD scoring function.
16

---

Published as a conference paper at ICLR 2024
GradNorm. Huang & Li (22 computes the norm of gradients between the softmax output and a uniform probability distribution.
Energy. Liu et al. (2020) proposes to use the energy score for OOD detection. The energy function maps the logit outputs to scalar Energy(as (x; f) E R. In order to keep the convention that the score
need to be lower for ID data, [iu et al. (2020) used the negative energy as the OOD score.
C ADDITIONAL EXPERIMENT DETAILS
C.I OOD DATASETS
For experiments involving ImageNet-IK as the inliers dataset (ID), assess the model's perfor- mance on five OOD benchmark datasets. Textures (Cimpoi et al. 2014) dataset comprises natural textural images, with the exclusion of four categories (bubbly, honeycombed, cobwebbed, spiralled) that overlap with the inliers dataset. Places365 (Zhou et al. 2016) is dataset consisting of images depicting various scenes. iNaturalist (Horn al. 2017) dataset focuses on fine- aiee-graind species clas- sification. We utilize subset of 10 000 images sourced from (Huang & Li 202 ImageNet-O) (Hendrycks et al. 2021bb is dataset comprising adversarially filtered images designed to challenge OOD detectors. SUN (iiao et al. 2010) is a dataset containing images representing different scene categories. Figure C.3 shows five examples from each of these datasets.
For experiments where CIFAR-10 (resp. CIFAR-100) serves as the ID dataset, employ CIFAR- 100 (resp. CIFAR-10) 10) as OOD dataset. Additionally, we include the SVHN dataset (Netzer et al, 2011) OOD datasets in these experiments. The standard dataset splits, featuring 50000 training images and 10000 test images, are used in these evaluations.
Figure C.3: Example images from ImageNet- Ik considered OOD datasets. Each row representing an OOD dataset: ImageNet-O, Textures, iNaturalist, SUN and Places365 respectively from top to bottom.
C.2 NECO PSEUDO-CODE
Algorithm presents the pseudo-code of the process utilised to compute NECO during inference. This assumes that PCA already computed on the training data, the DNN is trained and a threshold on the score is already identified.
17

---

Published as a conference paper at ICLR 2024
Algorithm 1: NECO OOD detection pseudo code Data: X
// inference data samples
Inputs:
model, pea, thres; // where model is the DYN, pou is model nat inaeed on training date
using main peincipal compenents, and thres threshold solected after the validation with ROC Curve
X Features (X)
ETFx, featuures
Fxeatrrrr = (Ca(X)
Norm(ET Fx peatuures)
score
Norm Featurea)
score > threshold then
isOOD=
else end return score, isOOD
is00D=true
C.3 EFFECT OF MAXLOGIT MULTIPLICATION
Table shows the performance of NECO with and without the maximum logit multiplication. We observe that using maximum logit considerably improve the performance average than the stan- dalone NECO score. This gap can be explained by the limited size of the feature space in vision transformers (e.g. 768 in the case of ViT) which insufficient to converge perfectly to the Simplex ETF structure due to the number of classes within ImageNet-IK I dataset. In addition, we can observe a larger performance gap for the DeiT case. We suggest that this might be due due the specific training procedure of DeiT, relying on a distillation process, which might hinder its collapse.
ImageNet-O
Textures
INaturalist
SUN
Places365
Average
Model
Method
AUROCA FPRJAUROCT FPR_AUROC" AURLAUROC EPRLAUROCY EPR_AUROCT FPR.
NECO Maxlogit
93.27 30.05
89.02
99.48 1.47
89.30 38.24
85.89
91.31 33.77
VIT
NECO
94.53 25.20
92.86 32.44
99.34 3.26
93.15 33.98
90.38 42.66
94.05 27.51
SwinV2
NECO w/o Maxlogit
63.17
75.52 69.63
90.72 36.37
81.59
80.52 60.77
78.31 62.38
NECO
65.03 80.55
82.27 54.67
91.89 34.41
82.13 62.26
81.46 64.04
80.56 59.19
DeiT
NECO w/o Maxlogit
56.21 95,80
60.02 96 68
71.41 84.49
S7.29 84.10
55.54 82.74
60.10 88.76
NECO
62.72 84.10
80.82 59.47
89.54 42.26
77.64 65.55
76.48 68.13
77.44 63,90
NesNerNECCO w/o Maxlogit
71.01 88.44
84.86 60.79
81.04 84,85
60.4296.77
61.92 96.34
71.85 84.83
50
NECO
69.80 86.43
88.09 51.53
87.94 62.69
75.56 77.55
73.07 78.62
78.89 71.36
Table C.4: OOD detection performance for NECO with versus without Maxlogit multiplication. Both metrics AUROC and FPR95. are in percentage. A pre-trained ViT-B/16 is used for testing.
C.4 FINE-TUNING DETAILS
The fine-tuning setup for the VIT model is as follows: we take the official pre-trained weights on 1 (Dosovitskiy et al. (2220) and fine-tune them on ImageNet-IK, CIFAR-10, and cosine warm- batch size, 0.9 momentum, and an initial learning rate of 2x10-2 For CIFAR-10 and CIFAR-100 the weights are fine-tuned for 500 and 1000 steps respectively. With 100 warm-up steps, 512 batch size, and the rest of the training parameters being equal to the case of ImageNet- 1K. Swin (Liu al. 202T) is also a transformer-based classification model. We use the officially released Swin V 22-B16 616 model, which is pre-trained on ImageNet-21K and fine-tuned on ImageNet- IK. R8 (He et al. 2015) is a CNN-based model. For both CIFAR-10 and CIFAR-100, the model is trained for 200 epochs with 128 batch size, 5x10-4 weight decay and 0.9 momentum. The initial learning rate is 0.1 with a cosine annealing scheduler. When estimating the simplex ETF space, the entire training set is used. Note That for in the imagenet case, used input size of 384 for VIT. while the image size was only 224 for Swin and DeiT models, which might contribute to the higher performance of the ViT model.
CIFAR-100. For ImageNet-IK, the weights are fine-tuned for 18 000 steps, with 500
up steps, 256
18

---

Published as a conference paper at ICLR 2024
C.5 DIMENSION OF EQUIANGULAR TIGHT FRAME (ETF)
In Figures C.6 and C.4 we show the performances, in terms of AUROC and FPR95, for dif- ferent models, with difterent data: ImageNet, CIFAR-10 or CIFAR-100. We observe that both performance metrics remain relatively stable once the dimension rises over certain threshold for each case study. This suggests that including more dimensions beyond this threshold adds little to meaningful information about the ID data. We hypothesize that the inflection point in these curves indicates the best approximate subspace dimension of the Simplex ETF relevant to our ID data. Therefore, for greater adaptability, Table Cable/C.]Jshove the best ETF values that minimize the FPR (and maximize the AUC in case of equal FPR) for each tuple dataset. Hence, our results depicted in general case,
Section 5 utilize the best ETF values for each tuple <model, ID, OOD>, In the according to Figures C.5 and C.4] we still have the flexibility to find a single ETF dimension per ID dataset and model the specific application demands while maintaining state-of-the-er per- formance. For the evaluation/inference phase, the threshold can be fixed at dimension d such that the first d principal components that explain at least 90% of the variance from the train dataset.
ImageNet-O)
Textures
Naturallist
VIT-B/16
140
270
490
270
360
ImageNet
SwinV2-B/16
70
510
450
560
670
DeiT-B/16
430
670
370
710
730
CIFAR-10
ResNet- 18
V/I-
130
40
250
100
VTT
260
CIFAR-100
ResNet-18
150
470
Table C.5: Best Simplex ETF approximate dimension, for different DNN architectures and ID data case studies: ImageNet, CIFAR-10, and CIFAR-100. The Best ETF dimension is found by minimizing the FPR95, then maximizing the AUROC in of equal FPR95 across the dimensions. The values are presented for different DNN architectures and ID data (ImageNet, CIFAR-IO, and CIFAR- (00) and their respective OOD test cases.
100
90
80
80
70
70
60
50
40
naturalist
places
40
30
imgenet-o
SUN
10
exple ned variance
100
200
300
400
100
200
300
500
600
700
ETF approximative dimension
ETF approximative dimension
VIT Model
100
100
90
90
80
60
60
50
50
naturalist
40
iagenet-o
30
texture
20
SUN
20
places
10
and variance
10
100
200
300
400
500
500
300
900
100
200
300
400
500
600
700
800
900
ETF approximative dimension
ETF approximative dimension
(b) Swin Model
Figure C.4: Comparison of Performance metrics - AUROC (left) and FPR95 (right) against
the principal space dimension, for ViT (Top) and SwinV2 (Bottom), with ImageNet as ID data and different OOD datasets: iNaturalist, ImageNet-O, Textures, SUN, Places365.
19

---

Published as a conference paper at ICLR 2024
100
90
80
80
70
70
FPR95
50
40
40
30
cifar100
SVHN
10
explained variance
100
400
500
600
700
100
200
300
400
500
600
700
ETF approximative dimension
ETF approximative dimension
(a) VIT Model
100
100
90
90
70
60
60
50
30
30
20
cifar100
20
SVHN
10
explained variance
100
200
300
400
100
200
300
400
ETF approximative dimemsion
ETF approximative dimension
(b) ResNet-18 Model
Figure C.5: Comparison of Performance metrics - AUROC (left) and FPR95 (right) against the principal space dimension, for ViT (Top) and ResNet-15 18 (Bottom), with CIFAR-10 as ID data, and different OOD datasets: SVHN, CIFAR-100.
100
90
80
80
70
70
60
50
40
40
30
30
SVHN
cifar10
10
explained variance
10
100
200
300
400
500
600
700
100
200
300
600
700
approximative dimension
ETF approximative dimension
VIT Model
100
100
90
90
80
70
60
50
50
40
30
20
cifar10
20
SVIIN
10
explained variance
10
100
200
300
200
100
200
300
200
ETF approximative dimension
ETF approximative dimension
(b) ResNet-18 Model
Figure C.6: Comparison of Performance metrics - AUROC (left) and FPR95 (right) - against the principal space dimension, for ViT (Top) and ResNett-1 (Bottom), with CIFAR-100 ID data, and different OOD datasets: SVHN, CIFAR-10.
20

---

Published as a conference paper at ICLR 2024
C.6 CLASSIFICATION ACCURACY
Considering the post hoc nature of our method, when an input image is identified as in-distribution (ID), it important to note that one can always use the original DNN classifier. This switch comes with a negligible overhead and ensures optimal performance for both classification and out- of-distribution (OOD) detection. Consequently, the classification performance of the final model remains unaltered in our approach. We refer the reader to Table C.6 for the observed classification accuracy.
Pre-trained
Accuracy
ID Data
Model
Architecture
dataset
(top1%) %)
VIT-B/16
Transformer
ImageNet-21I
83.84
ImageNet
SwinV2-B/16
Transformer
ImageNet-21k
81,20
DeiT-B/16
Transformer
ImageNet-21lk
81.80
VrT-B/I6
Transtormer
ImageNet-2Tk
98.89
CIFAR-10 10
ResNet-18
Residual Convnet
95.46
VIT-B/I6
Transtormer
ImageNet-21k
92.16
CIFAR-100
ResNet-18
Residual Convnet
78.59
Table C.6: Top 1% accuracy ID data for the original classification task, for the models and ID dataset considered in our experiments, including relevant model details (from the type of architecture with/without pretraining distinction).
D DETAILS ABOUT NEURAL COLLAPSE
D.1 ADDITIONAL NEURAL COLLAPSE PROPERTIES
Here, we present the equations for the remaining two properties of "neural collapse". Additionally, Figure shows visual illustration of the Simplex ETF structure in the case four classes.
We evaluate the convergence to Self-duality (NC3) using the following expression:
Self-duality =
|| W 1
In this equation, W represents the matrix of the penultimate layer classifier weights, M is the matrix
Figure D.7: Visualisation of the Simplex ETF structure.
of class means, and M denotes matrix with unit-normalized means columns. Additionally, || 1 signifies the square of the L2 norm.
Moreover, the Simplification to Nearest Class-Center (NC4, Equation is measured as the proportion of training set samples that are misclassified when we apply the simple decision rule of assigning each feature space activation the nearest class mean:
21

---

Published as a conference paper at ICLR 2024
Simplificttionto-NCCC = argmin, |2 Mell2, where 2 represents the feature vector for a given imput æ.
(8)
D.2 NEURAL COLLAPSE ADDITIONAL RESULTS
In this Section, present additional results related the convergence of the NC equations dis- cussed in the main paper. The experiments follow the same training procedure as detailed in Section 4 and intend give additional empirical results and theories the neural collapse properties in the presence of OOD data.
Convergence of NC1. Figure D.8 presents the convergence of the NCI variability collapse on ViT or ResNet-18 CIFAR-10 or CIFAR-100. We observe that variability collapse on ID data tends to converge to zero, hence confirming that DNN reaches the variability collapse in accordance with (Papyan V 2020). In addition, we evaluate NC1 directly only OOD data for CIFAR-100 or SVHN using a model trained on ID data. We observe that values tend to diverge or stabilize to higher NC1 value. According to equation [ high value for NC1 suggests low inter-class covariance with a high intra-class covariance. The low inter-covariance of the OOD data clusters may be interpreted evidence that they getting grouped together single cluster with mean HG nOOD, hence supporting our initial hypothesis.
Besides this, we observe that for the CIFAR-I00 ID data and CIFAR-I0 as OOD data pair, the NCI values are always relatively lower than the remainder of OOD cases. This is probably due to the fact that the CIFAR- 10 label space is included entirely within the CIFAR-I00 label space, hence confusing the model due to its similarity.
10a
10
OOD (SVHN)
OOD (cifar100)
10?
10
ID only (cifar10)
102
Icifar100) (SVHN) only (cifar10)
NC1
101
109
109
10-1
10-2
880
1760
2640
3520
4400
5280
55
110
165
220
330
Steps
Epochs
CIFAR-10
10a
10a
O0D (cifar10)
ID only (cifar100)
102
10a
OOD (SVHN)
OOD (cifar10)
NC1
(cifar100)
101
OOD (SVHN)
109
10a
10-10
10-1
0
220
330
Steps
Epochs
(a) ViT-B/16
(b) ResNet-18
CIFAR-100
Figure D.8: Convergence towards variability collapse (NC1) for ID/OOD data separately for VIT-B (left), ResNet-18 18 (right) both trained on CIFAR- 100 as ID. Dashed purple lines indicate the end of warm-up steps in the case of VIT and learning rate decay epochs for ResNet-18.
Convergence of NC2 in presence of OOD. In order assess "neural collapse" properties in the presence of OOD data, we investigate the convergence of NC2 equiangularity when the validation set contains OOD data. To this end, for the computation of NC2, consider the OOD one
22

---

Published as a conference paper at ICLR 2024
supplementary class. Figure D.9 compares the convergence of NC2 when only ID data used (in dashed black), or when OOD are included as extra classes (in blue and green). In all scenarios the NC2 value tends to converge the same trend as those without OOD, except for experiments with CIFAR-10 as ID data that have higher NC2 values. According to NC2, this suggests that the equiangularity property between II) clusters and OOD clusters is respected, thus favoring a good separation between ID and OOD data in terms of NECO scores. We are to reinforce this observation in the next paragraph discussing NC5 convergence.
plateau below 0.10. The examples with OOD data follow
0.25
0.6
only (CIFARIO)
only (CIFARIO)
NC2. Equinangularti
OOFAR (CIFARLOO)
Tguinangularity
(CIFARIO1/0OD (CIFAR100)
(CIFAR10//OOD (SVHN)
0.4
(CIFARTO)/OOD (SVHN)
0.15
0.3
0.10
0.2
0.1
0.00
0
880
1760
2610
3520 Steps
4400
5280
0.0
55
110
165
220 Epochs
275
330
CIFAR-10
NC2: Equinangulariy
0.10
ID (CIFARI0O//OOD (CIFARI0)
ID only (CIFAR100)
0.30
....
ID (CIFAR1OOI/OOD (CIFARIO)
ID only (CIFAR100)
0.08
ID (CIFAR100)/0O0 (SVHN)
0.25
ID (CIFAR100//0D (SVHN)
Equinangu
0.20
0.06
0.15
0.04
0:10
0.02
0.00
900
1800
2700
0.00
165
330
Steps
Epachs
ViT-B/16
CIFAR-100
(b) ResNet-18
Figure D.9: Convergence of NC2 for the ID/OOD Equiangularity - in the presence of OOD data- for ViT-B (left), ResNet-18 18 (right) both trained on CIFAR-I0 as ID. Dashed purple lines indicate the end of warm-up steps in the case of VIT and learning rate decay epochs for ResNet-18.
As for the second part of NC2, the equinormality property, its convergence the mix of ID/OOD data is not relevant to OOD detection. Since if NCS is verified, the norm of the OOD data will be reduced to zero in the NECO score. However, in order guarantee an unbiased score towards any ID class, NC2 equinormality needs to be verified on the set of ID data. Since if an ID data cluster has smaller norm than the others, it is more likely that will be mistaken as OOD, since its closer to the null vector. Figure 1.10 the convergence of this property on our ID data, hence guaranteeing an unbiased score.
Convergence of NCS. Figure D.I1 illustrates the convergence of NCS when CIFAR-10 or CIFAR-100 are used ID datasets. In all cases, we observe for both models i.e. ViT-B/16 and ResNet-18) very low values for NC5 (Equation 5). Hence, according to our hypothesis, the models tend maximize the ID/OOD orthogonality as we reach the TPT. While all cases exhibit convergence of the OrthoDev, we observe that ViT tends to converge to much lower value than ResNet-18. Hence, this may explain the performance gap between the ViT-B/16 and the ResNet- 18 models.
In Section 5 we empirically demonstrate that ViT-B/16 (pre-trained on ImageNet-21K) with NECO outperfoms all baseline methods. In Figure D.12 we illustrate the NC5 OrthoDev during the fine-tuning process ImageNet- 1K against different OOD datasets (see Section 5 for the dataset details). Despite a very low initial value (2 x 10-1 1 for the worst example), we observe that NC5 tends slightly decrease. We believe that the low initial value is due to the pretraining the
23

---

Published as a conference paper at ICLR 2024
0.14
0.35
only (CIFAR10)
only (CIFARIO)
NC2: Equinormality
0.12
Fauinormality
0.30
0.10
0.25
0.08
M www.mmmnnnnnnmmmmmmm....
0.20
0.06
0:15
0.04
0.10
0.02
0.05
0.00g
B80
1760
2640
3520
4400
5280
0.00g
55
110
165
220
275
330
Steps
Epachs
10
0.14
0.45
NC2: Equinormality
0.12
ID only (CIFAR100)
0.40
ID only (CIFAR100)
0.35
0.10
Eguiner
0.30
0.08
0.25
0.06
0.20
0.15
0.04
g
0.10
0.02
0.05
0.00
900
1800
2700
0.00g
165
330
Steps
Epachs
ViT-B/16
CIFAR-100
(b) ResNet-18
Figure D.10: Convergence of NC2 equinormality on ID data for ViT-B (left), ResNet-18 (right) both trained on CIFAR-10 as ID. Dashed purple lines indicate the end of warm-up steps in the case of VIT and learning rate decay epochs for ResNet-18.
ImageNet-2IK dataset, hence favoring premature TPT in the fine-tuning phase.
In Figure [D.3] We investigate the neural collapse when the DNN is trained without pre-trained weights, and show the convergence of the NCI, NC2 and NC5. We observe that the curves tend to be steeper than experiments with pre-trained weights, reinforcing the hypothesis about the contri- bution of the pretraining towards reaching the TPT faster. While are able to reach reasonable performance in the OOD cases, we observe that the NC5 value is slightly higher than experiments with pretrained weights, suggesting their contributions in the neural collapse and its properties for the OOD detection. We hypothesize that this is due to the rich information contained in the pre- trained weights that indirectly contributes to the separation in the ETF of the ID from the OOD.
Complementary Feature Projection on Various OOD Datasets Finally, to further demonstrate the broad pertinence of NECO score, Figure sh14s features projection of ID (CIFAR-00) and OOD (CIFAR-100, iNaturalist, SUN, Places365) datasets on the first two principal components of PCA, fitted on CIFAR-10 ID data. Each class of the ID dataset is colored and the OOD datasets are gray. As result of the convergence of the NCI property, notice how the ID classes are well clustered despite the low dimensional representation. Conversely, the OOD samples are all centered at the null vector position. This suggests that the NECO score for all these cases will be highly separable between ID and OOD data, we discuss in Appendix E
E COMPLEMENTARY RESULTS
In this section, we present additional results that extend findings, with either complementary DNN architectures or OOD benchmarks. The intent is to gain a better understanding of the versatility of our proposed approach, NECO, against different cases.
24

---

Published as a conference paper at ICLR 2024
0.6
1.0
NC5; ID/00D OrthaDev
(CIFARI01/OOD (CIFARLOO)
01/OOD (SVHN)
NCS: ID/00D OrthoDev
0.9
(CIFARIOU/ODD (CIFAR10O)
(CIFARI ONJOOD (SVHN)
0.4
0.8
0.3
0.7
0.6
0.1
0.5
0.0
880
1760
2640
3520
4400
5280
0.40
60
120
180
240
300
360
Steps
Epochs
CIFAR-10
0.20
1.0
NC5: ID/OOD OrthoDev
ID (CIFARI00)/OOD (SVHN)
8 2
0.9
ID ICIFARIOOWOOD (CIFARIO)
ID [CIFAR100//000 (CIFAR10)
ID (CIFAR10OW0OD (SVHN)
0.15
0.8
0.7
0.10
0.6
0.05
0.5
- 0.4
0.00
900
1800
2700
0.30
120
180
Steps
Epochs
(a) ViT-B/16
CIFAR-100
(b) ResNet-18
Figure D.11: Convergence of NC5 for the ID/OOD orthogonality- in the presence of OOD data for ViT-B (left), ResNet- 18 (right) both trained on CIFAR-I0 (Top) and CIFAR-100 (Bottom) as ID. Dashed purple lines indicate the end of warm-up steps in the case of ViT and learning rate decay epochs for R8.
0.25
(ImageNitti000 (lextures)
ID (IageeNet)000 (ImageNietoo)
0.20
ID (ImageNet)000 (Place3363)
(ImageNet)OOD (Natuurlisz)
NC5: ID/OOD OntooDv
10 (ImagsNet))00D (SUN)
0.15
0.10
0.05
0.00
1500
3000
4500
6006
15500
Steps
Figure D.12: Convergence towards OrthoDev minimization, for a VIT-B/16 model pre-trained on ImageNet- IK and finetuned on ImageNet-Ik. Dashed purple lines indicate the end of the warm-up steps.
NECO with DeiT and ResNet-50. Table E.7 presents the results for NECO applicd on the DeiT model fine-tuned on ImageNet- IK and evaluated different datasets against baseline methods, as well as ResNet-50. The best performances are highlighted in bold. Contrary to the results with VIT, observe that average NECO with DeiT only surpasses the baselines in terms of FPR95. Whilst on ResNet-50, NECO ranks as the third best method.
OpenOOD Benchmark ImageNet-1K 1K Challenge. OpenOOnnii is recent test bench focusing on OOD detection proposing classic test cases from the literature. In this paragraph we focus on
Official GitHub page of OpenOOD: http://gghhabbeoo//n/gggagg//00n
25

---

Published as a conference paper at ICLR 2024
0.7
1.0
1 only (CFARLD)
0.3
ICRARLOOOOD (5VHN)
NCA Equnungutiig
13 TCHAILOYOOO (CIFALLLO))
0.887
TCHALLDYOOD (CHFAILLOO)
13 ICIARLDYOOD ISVHNO
0.6
0.5
0.4
0.2
0.2
135
25
89
111
133
Epochs
Epochs
(a) NC2
(h) NC5
Figure D.13: Convergence variability collapse (NC1), ID/OOD Equiangularity (NC2), and ID/OOD orthogonality (NCS) in the presence of OOD data. A ViT-B/16 is trained (150 epochs) without pre-training on CIFAR-10, with Top % accuracy=72.0755 OOD Performance on CIFAR- 10/CIFAR-100) 95.96% AUROC and 13.86% FPR95; on CIFAR-10 SVHN:AUROC -99.15% and FPR95 =3.77%
ID
ID
0OD
OOD
PC2
PC2
-2
0
2
4
-2
0
2
(a) CIFAR-100
(b) iNaturalist
ID
ID
OOD
OOD
PC2
PC2
-4
-4
-6
-6
2
PC 1
PC 1
(c) SUN
(d) Place365
Figure D.14: Projections on the first principal components of PCA fitted CIFAR-10 using the ViT penultimate layer representation. The colored points indicate the ID dataset classes while the gray points the OOD.
26

---

Published as a conference paper at ICLR 2024
Model
Method
AUROC1
ImageNet-O
AURCI FPRJAUROCT FPRJAUROCT [PR|ALROC)
Textures
INaturalist
SUN
Places365
APRRAU FPR.
Average
Softmax score
63.5087.70
81.56 65.18
88.44 31.79
81.18 67.64
80.57 69.68
79.05 68.39
MaxLaggt
61.3088.00 85.05
80.32 62.15
85.28 52.99
26.70.7..53
75.74 69
75.86 67.52
Energy
60.59
71.23
Energy-Roos
64,24 82.30
80.25 63.94
84.05 59.69
77.19 69.54
73.78 71.41
76.30 69.37
VIM
73.93 89.20
78.62
88.75 71.68
71.70 82.60
76.66 80.04
79.13 81.81 83
Residual
95
DeiT-B/16
GradNorm
32.79 98.50
38.93 93.85
27.47 98.78
31.21 98.13
30.55 98.39
32.19 97.55
Malxulanotis
75.37 90,90
81.04 82.45
90.32 67.52
80.95 81,39
80.21 78.80
81.57 80.21
Matching
68.36
64.63
89.44 51.81
74.94
ASH-B
46.86 94.05
60.22 95.50
46.24 95.4495.00
35.76 97.45
35.39 96,
44.89 93.78
ASH-P
32.21 99.25
24.71 99.06
14.55 99.83
22.36 98.998
23.41 99.21
23 23.45 99.27
ASH-S
32.85
27.13 97.74
NuSA
$4.65 94,85
$3.96 46
72.47 85.31
50.12 96.28
50.74 95.47
56. 93.47
NECO (ours)
62.72
80.82 59.47
89.54 42.26
77 64.6444 65.55
76.48 68.13
77 77.44 63.90
Softmax score
77.12
78.
76.66
77.01
MaxLogit
94,19
71 26 74
79.88 68.52
74.05 75.47
71 30 42
69. S4 78.15
Energy
48.23 92.80
49.29 95.64
50.85 98.14
50.13 97.93
48.90 97.76
49.48 96.45
Energy ReAcct
99.05
97.67
28.53 99.79
27.81
VIM
81.74
84.00 58.57
84,20 61.42
66.23 90.24
63.92 90.96
74.31 76.59
Residual
71.90
83.31
64 98. 61..92
83.13
65.54-91.64
63.54 92.37
73.48 78.70
ResNet-50
GradNorm
39.03 99.00
30.40 99.98
29 99.79
28.53 99.73
32.94 34
Mahsllaobii
85.40
87.54553.74 53.74
90.73 49.18
76.60 83.34
84.11
80.61 71.16.
KL Matchigg
67.55
86.11 63,93
89.51 50.04
81.23 73.89
79.28 75.98
50.74 70.86
RankFFear
Song
2022
51.15.97.01
82. 74.45
98.93
47.92 97..9977.30
62.08
AST-B
43.1499.10
46.57 98.37
36.24 99 99
32.01 99.55
29.79 99.75
37.55 .1
ASH-P
52,93 95
50.40 96.38
57.54 95.64
58.91 95.30
39.59 93, 93.66
55.87 95 22
ASH-S
51.08 93,50
20.78 73.35
79.57
11
73.26
70.21 78.27
68.98
NuSA
66.06 89.45
80.86 64.17
44.60 98.24
$2.66 97.97
51.59 98.44
59. 89 65
NECO (ours)
86,43
88.09
87.94
75.56
73.07 78.62
78.89 21.
Table E.7: OOD detection for NECO and baseline methods. The ID dataset is ImageNet-IK, and OOD datasets are Textures, ImageNet-O, iNaturalist, SUN, and Places365. Both metries AUROC and FPR95 are in percentage. A pre-trained DeiT-B/16 and ResNet-50 models tested. The best method is emphasized in bold.
the ImageNet-IK IK challenge with a of OOD test cases grouped in increasing difficulties: Near- OOD - with SSB-hard (Vaze et al. (02T)) and NINCO (Bitterwolf et al. 2023). Far-OOD- - with iNaturalist (Horn et al. (017). Textures (Cimpoi et al., 2014), OpenImage-O (Wang et al. 2022)
Covariate Shift - with ImageNet-C (Hendrycks & Dietterich 2019). ImageNet-R (Hendrycks)
jet al. 2021a), ImageNet-V2 (Recht et al. 2019). Figure E. shows five examples from each of these datasets.
Table E.8 pressenss our results on each group, including a global average performance. On average over all the test sets, observe that NECO outperforms all the baseline methods, with all DNN models. With SwinV2, NECO reaches the first rank, terms of FPR95, and the top3, in terms of AUROC, all datasets. However, the global average. VIT with NECO is the best strategy- Although NECO perform relatively well on the Covariate Shift, in particular with SwinV2, but remains limited with VIT.
Distribution of NECO Values. To verify the discrepancy in the distribution of NECO scores between ID and OOD values, Figure 1. depicts the density score histograms for the ImageNet benchmark when using ViT and Swin models. These histograms reveal a significant degree of separation certain cases, such as when iNaturalist is used as the OOD dataset with the ViT model. However, in some other cases, like when ImageNet-O is employed as the OOD dataset with the Swin model, the separation remains less pronounced. Across all the presented scenarios, ViT-B consistently outperforms other variants of vision transformers in the OOD detection task. This observation leads us to hypothesize that VTT-B exhibits more collapse than its counterparts, although further testing is needed to draw definitive conclusions.
Similarly, figure E. presents the density score histograms for the CIFAR-1O/CIFAR- bench- mark when using ViT and ResNet-18 models, respectively. In certain cases, such CIFAR-10 (ID)SVHN (OOD) with the ViT model, these histograms reveal nearly perfect separation. However, achieving separation becomes notably more challenging in the case of CIFAR-100 (IDYCIFAR- 10 (OOD). This difficulty arises because CIFAR- 10 shares labels with a subset of the CIFAR-100 dataset, causing their data clusters to be much closer. This effect is particularly pronounced when using a ResNet-18 model compared to ViT. The superior performance of the ViT model is further highlighted by its significantly lower values across all "neural collapse" metrics.
27

---

Published as a conference paper at ICLR 2024
Figure E.15: Example images from OOD datasets with each representing dataset: ImageNet- V2iimageee:Ciimageeete NINCO, SSB-hard and Openlmage-O) respectively from top to bot- tom.
ID
0.30
0.25
025
0.2
Benus
0.20
0.15
015
0.05
3.00
10
0.00
24
0.00
30
20
ViT-B/16
ID
ID
0.25
0.15
3.20
0.15
0.10
0.10
8.00
12
14
26
0.00
30
15
20
30
35
30
0.00
10
15
30
45
30
(b) V2
Figure E.16: ID (ImageNet) and OOD ImageNet-O (left), Textures (center) and iNaturalist (right) NECO score distributions.
28

---

Published as a conference paper at ICLR 2024
Cnvoriate Shift
NEar OOD
Far OOD
Global
Model
Method
ImigeNce-V2
ImogeNNe-CC
ImogeNNet-R
Average
SSII-bard
Asernge
Testures
Ihaturalist
open-
Average
Average
AUROC FPR AUROCT FPRLAUROCY AUROE FPR
AUTROCT FFR AUROOY FUROOO FVR
AUTROC
FPR_AUROCY
(RRJAROOC [ARRAUTO FPREAA AURRCC FPR
Sofmrr soom
N4.1 89.57
71.75 71.07
$1.42 56.83
70.59
77.40
86.97
46.07
S0.31 56.05
54.06 56.15
$0.64 49 20
97.21 12.14
93.06 29.62
92,51 30.30
82.75 57.65
MaxLogg
58.71
73.64
47.16
73.00 65.51
92.91
53.00
36.90
98.57 5.72
96.75 17.33
95.77
55.81
Frergy
88. 89.20
23.54 69.00
87.12 44.52
13.06 07.50
91.13 55.51
$7.88-00 49.15
90.50
02.13
99 4.7044.76
07.13 14.62
96. 10 1.5
86.07 42.46
Eucagy-RAss
58.57 89.32
73.37 69.82
$6.93 44.02
69.02 72.95
03.0 10 33.43
$7.60 49.74
90.35
92.08
4.91
97.13 14.76
96.08 15.05
83:97 42.67
57.33
70.10
52.61
36.73
91.63 36.22
50.59 2.00
97.33 15:90
95.12 18.71
55.43
Residual
55.18
62.81 90.03
$1.90 06
66.63 83.58
05.05-4 44.95
85.38 51.62
67.67 48.20
87.71 52.34
00.36
94.54 25.77
93.97 26.97
12.14 53.64
VIT
GraNSom
54,45 89.64
69.44 68.09
76.54 16.91
56.51 69.41
37.14 84.21
$0.39 51.11
52.55 44.12
36.29 35.75
97.45 0.17
93.74 10.01
92.49 19.51
50.35 44.00
Matolarobis
Matchigg
54.58 90.09
65.36 73.41
76.24 59.06
65.55 74.19
84.30 51
70.92 69.70
77.61 60:47
34.61 52.35
95.07 15:31
90.22 35.32
80.97 34.34
77.71 55.51
ASH B
48.70 94.29
44.1399.799 93.79
$7.90 59.25
50.24 92.45
57.30 59.09
57.25 92.61
57.27 90.35
66.05 53.29
72.62 50.62
08.34 68.3483.42
69.00 92 44
59.03 89.30
A
96.55.91.16
69.94 77.33
46.19
36.49
37.56
98.75 6.25
96.45 15.10
05.58
20.64
85.01
ASH 5
25.38
68.85 78.55
95.23.5022
09.99 73.47
90.34 37.67
$9.30 37.99
59.82 37.53
91.00 39.73
9.550
95.97 19.4
95.16
22 14
$4.35 45.31
A
54.8
63.42 90.01
79.81 73.19
16.9688 85.23
97 19.05
67.41 45.55
18.09 47.59
89.28 51 14
99.30 3.12
94.87 35 AM
94.15
68
12:21 57.61
NECO
58.69
23.48
47.45
72.87.6.544 68.54
$7.52
36.26
32.44
3.26
97.55 12.99
96.58
Softmas score
52,76 90.14
25.99667442 67.42
98.356439
10.79 74.00
25.54 71.9
70.54 52.39
74.54 77.15
31.72 50.91
58.59
57.66
85.08 57.70
85.13 55.
17.07 07.53
MaxLogg
56.77 50.62
75:41 00.11
76.05 8588
04.01 21.16
00.00:2 23.32
06.05 5364
70.74
80130
56.47 20.11
K3.45 55.75
83.00 25.72
70.95 09.24
Erargy
74.23
79.37
70.58
torgy-ReAr
56.76 90.77
75.71 06.57
79.16
71.54 77.90
74. 25.25
65 38 65.70
70.00 00
84.56 59 365
51.99
64.72 59.51
19.90 11
70.41 06 M8
56.30 90.88
68.09
53.02.55.67
80.16 76.32
74.55 77.97
60.94
$1.50 51.15
87.54 54,09
55.66 55 56
84.00
04
75.26 20.67
Resilual
55.25
62.84 55.38
59.69
70.95
84.56
77.36
53.23 59.77
81.72 60.75
80.77
71.83 73.91
SoinV2
GrdNem
45.78 012895.55
48.37 76.71
97.0099220
40.36 M5.14
34.90 95 34
40.76 95.05
57.85 15. 50
33.84 95.31
51,82 95.01
29.55 15 15
31.73
94.57
30.50 14.27
Mabalanobis
57.14 90.53
70.04 53.55
$4.58
70.59 76.09
78.76 79.11
58.37
73.55 93.74
34.51 65.35
59 57.10
88,20 55.95
87.51
77:25 72.12
KL. Marchinnnn
54.74 90.95
64.08
75.40
N1.18
K3.8
67.02
79.61
K2.93
10.26
79.50 00
70.75
ASH-S
50.67 95.06
$2.00 94.40
50.13 97.54
$0.96 95.00
$3.33 96. 70
55.91 94.86
$4.62 05.78
38.99 97 50
48.62 97 55
97.75
45.00 07 60
49 05.66.6 96.51
A
45.30 95.91
36.09 96.14
25.85 98.51
35.95
29.17 96.37
97.51
33.19
26.51 98.90
20.73 99.28
22.35 99.22
23.20
13
30.49 97.96
ASH-S
95.35
36,40 94.69
27:52
97.23
91.05
16.15
22,91
25.05
30.77
NuSA
55,90 92.21
53.01 93.80
61.15 56.95
56.72 90.99
50.70 92.19
54.32 90.21
55.51 92.70
62:72 53.14
64.01 53.55
64.31 82.81
63.68 93.17
59.02 99.49
NECD (ours)
77.16
20.36
75006
5441
10.96 47.96
W7.05
78.57
Solimes
58.86 90.54
75.42.1.5 71.27
7844 5435
70A8 75.55
29.20 72.81
70.56 54.10
74.88 25.45
$1.96 65
18.44 51.79
84.54 61.14
84.88
39.32
17.04 20.21
MasLoga
56.84 90.33
25:55 67.51
75.40 52.66
60.26
23.48
75.08 22.18
67.11 84.35
71.00 23.25
80.32 52.15
85.25 52.99
80.74 60.06
82.11 55.40
74.54 99.00
Energy
55.55
74.25
72:23 16.16
67.34
74.56
76.M1
57.05
66.25
77.64
27
16.40
75.34 66.53
77.00
7U.72
Rosc
56 90:41
25.55 10
77.00 50.73
50.72
23.00
75
68.21 66.79
09.64 99:75
$0.25 53.94
65.05 90.69
60.55
81.62 62.
74.16 70.96
VIM
49 90.03
65.68 91.97
$4.79 9656
68.99 90.52
78.20 $1.56
64.45 91.12
71.33 86334
78.62 85
68.75 71.68
86.40 75.08
84.90 77 48
75:42 90.55
Resittal
55.85
76.21
92.23
63.16
64.55
73.
DeIT
GrddNonn
46.54 94.62
$6.39 80.16
26.00 26.43
42.96 91.07
34.63 97.45
43.45 05.91
39.04 96.60
60.22 55.50
46.24 95.00
27.50
44.62 92.922222
42.61 93.12
Mihalunobis
32.43 90.56
66.96 91.50
$5.37 56.87
01.92 79.58
50.75 50.91
67.72 91.08
24.23 95.00
24.71 99.05
14.55 99.83
88.01 72.18
42.42 90.30
50.69 83 22
Ki-Marhhnng
76.53
79.95
16.42
ASH 8
00.38 94,53
40.66 97.00
46.99 90
44.84 M3.64
41.14 96.50
34.30 96.28
97.02
39.93 95335
27.47 96.78
40.78
35,73 93 84
3M.72 95 A0
ASM--
44.55 95.00
35.21 96
19.57 99.13
19.11 97.10 10
99.49
19.03.00 V7 10
12.6699.17
$1.04 92:45
90.32 63.567.52 47.52
12.75
63.00 03.033311 11
44:22 92.14
ASE-S
48.35 94.91
30.00 96.55
95.86
39.96 95.58
31.88 97.69
36.75 96.91
97.30
82.20 64 63
50.44 51.31
27.41
66.35
48.45 87.09
NuSA
52.88 93,99
59.16 87.85
59.01 93.53
$7.02 M1.79
64.76 $6.90
57.30 57.31
61.05 87.30
$3.96 95.45
72.47 55.31
62.41 91.49
02.95 90.75
50.12 85.29
NECO (surs)
53.08 03.13
63.00
53.55
89.63 72.49
78. 66.88
56.24 90.00
73.19
80.81 59.47
$0.54 42.36
81. 11.48 97.77
24.00 53.14
25.94 68.38
Table E.8: OOD detection for NECO against baseline methods, on the ImageNet- 1K challenge from openOOD benchmark (Zhang et al. 2023) that includes: open-image, ImageNet-V2 V2, ImageNet-R, ImageNet-C, NINCO, SSB-hard, Textures and iNaturalist. Both metrics AUROC and FPR95. are in percentage. Three architectures (ViT with fine tuning on ImageNet- IK V2, and DeiT)) are evaluated. The best method is emphasized in bold, and the 2nd and 3rd ones are underlined.
29

---

Published as a conference paper at ICLR 2024
10 000
10 X00
139
003
0CD
135
612
604
004
o00
0.0
20
CIFAR-10 VS SVHN
CIFAR- VS CIFAR-100
CIFAR-10 vs SVIIN
CIFAR-10 vs CIFAR-100
238
6.14
335
0.10
232
2400
045
000
18%
A0g
MEDO wibr
AB00
secovatte
4p00
CIFAR-100 vs SVHIN
CIFAR-100 vs CIFAR-10
CIFAR-100 vs SVHN
CIFAR-100 vs CIFAR-10
ViT-B/16
ResNet-18
Figure E. NECO score distributions for different ID and OOD tuples, with a ViT-B/16 (left) and ResNet- 18 (right) both fine-tuned on the ID training dataset.
30


Reviews:
[{"review_id": "ewPGWyC8iV", "reviewer": "Reviewer_r6r7", "summary": "This paper proposes to study OOD detection from the perspective of Neural Collapse. In that regard, they proposed NECO, Neural Collapse-based OOD Detection. NECO involves calculating the relative norm of a sample within the subspace configuration adopted by the ID data (i.e., Simplex ETF). The authors show that NECO exhibits strong generalization capabilities across various network architectures.", "questions": "Please refer to the weaknesses I highlighted in the above section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "This paper is overall well-written although the wording can somewhat be simplified (see weaknesses). The idea is quite simple and intuitive. The method is thoroughly evaluated and shows great performance against many benchmark datasets and OOD detection methods.", "weaknesses": "1. At times, the manuscript is a bit misleading. For instance, the sentence \"Intuitively, these properties depicts the tendency of the network to maximally separate class features while minimizing the separation within them\" is quite counter-intuitive. I'd suggest the authors to proofread the manuscript again to make it easier to digest.\n\n2. Although NECO shows strong ID classification and OOD detection capabilities across aggregated benchmarks, it undeperformson standalone datasets such as ImageNet-O, Textures, and iNaturalist depending on the encoding architecture that is used. An explanation for this behavior could make a stronger case for the paper.\n\n3. Since NECO is a post-hoc method, it is not obvious from the manuscript at what point in the training process does the neural collapse occurs for NECO to kick in. In other words, a model could still be well-trained without necessarily reaching the neural collapse phase. In that specific case, would NECO require training the model a bit more, or how would NECO's performance compare with say NuSA or ViM?\n\n4. NECO makes a somewhat stringent assumption that the subspace of the ID (and OOD?) is linear by making use of PCA to learn the matrix $P$ spanned by the d eigenvectors corresponding to the largest d eigenvalues of the covariance matrix $H$, where $H$ represents the feature space of the ID data. I think a justification as to why this feature space is linear is important. A non-linear dimensionality reduction, or a manifold-based learning method, would be more appropriate given the fact that neural nets are non-linear in nature.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WFWRzaYI0Y", "reviewer": "Reviewer_1ZaR", "summary": "This paper proposes an unsupervised anomaly detection method based on the phenomenon of neural network collapse, called NECO.The authors design an anomaly detection metric by exploiting several properties of neural networks during the training process, such as decreasing intraclass variance, equidistribution of class means, self-pairing of class means with classifiers, and orthogonality of class means with anomalous data. And experiments were conducted on several datasets and models to prove the effectiveness of NECO.", "questions": "1.\tIn section 3.2, \"Nervous Breakdown\", could more visual explanations or visual diagrams of the nature of NC1 and NC2 be provided?\n2.\tIs the observation of Out of Distribution Neural Collapse mentioned in Section 4 based on some existing theoretical or experimental evidence? If it is based on experimental evidence, please provide more detailed experimental settings and results.\n3.\tSection 3 introduces many notations and definitions, but there seems to be no visual explanation or context for each definition. Could consideration be given to providing more context or explanation for each of the main definitions?\n4.\tWhy was this particular form chosen to define NECO(x) in Eq. (8)? What is the intuition or theoretical basis behind it?\n5.\tReferring to the use of PCA for visualization, is it possible to describe in more detail the specific application of PCA, e.g. the number of principal components chosen?\n6.\tAre the limitations or possible failure scenarios of the proposed method further explored or analyzed?\n7.\tThroughout the article, is it possible to provide a complete flowchart or pseudo-code of the algorithm to help readers better understand the whole process of NECO?\n8.\tIn experimental setup, are different network architectures or hyperparameters considered to validate the robustness of the approach?\n9.\tHave the authors considered the impact of different types of OOD data? For example, have the authors considered situations where OOD data is very similar to ID data?", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1.\tA novel and simple anomaly detection metric is proposed that exploits the geometric nature of the neural network training process.\n2.\tUses a large number of experiments on multiple datasets and models to demonstrate the effectiveness of NECO and compares it to other methods\n3.\tA clear and convincing theoretical analysis is provided, revealing the mechanisms and assumptions behind NECO.\n4.\tThe article is well-structured with clear diagrams and well-defined notation.", "weaknesses": "1.\tThe article does not discuss the conditions and scope of the neural network collapse phenomenon, such as whether specific loss functions, activation functions, optimizers, etc.\n2.\tThe article does not analyze the sensitivity of anomaly detection metrics.\n3.\tThe article does not explore the interpretability of anomaly detection metrics, such as whether it can give the causes or characteristics of anomalous data.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6ADOiSmKwQ", "reviewer": "Reviewer_Ek3F", "summary": "In this paper, a novel post-hoc OOD detection method, NECO, is presented. NECO utilizes the geometric properties of neural collapse (NC) and principal component space to identify OOD data. This paper hypothesizes that NC not only affects the convergence of the loss during training but also impacts OOD detection.", "questions": "Why not put NuSA in the baseline? Can NECO outperform NuSA?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is clearly motivated and well-written.\n2. This paper is innovative in the novel observation of ID/OOD orthogonality(NC5).\n3. This paper provides thorough theoretical analysis.\n4. Experimental results on the ImageNet and CIFAR benchmarks demonstrate that NECO is state-of-the-art. And NECO can be generalized to various backbones.", "weaknesses": "1. The NECO score is similar to the ViM score. The main difference is that the NECO score utilizes principal space features, while the ViM score utilizes null space features for OOD detection.\n2. The manuscript lacks critical baseline comparisons, such as [1]. It is recommended that the authors conduct a comparison with it to provide a more comprehensive evaluation.\n\n[1] Song, Yue, Nicu Sebe, and Wei Wang. \"Rankfeat: Rank-1 feature removal for out-of-distribution detection.\" Advances in Neural Information Processing Systems 35 (2022): 17885-17898.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U0xSHELqVN", "reviewer": "Reviewer_Qb8y", "summary": "This work investigates the impact of Neural Collapse on the detection of OOD samples. They observe that, as training progresses,\nID and OOD data separability increases in the embedding space. Their proposed detection score computes the ratio between the norm of the projected embeddings with a PCA and the norm of the embedding. They multiply the final score with the maximum logit output to boost\nperformance. They run experiments with common benchmarks on image classification.", "questions": "1. Some notations are not clear to me. What does the operator $avg_{c,c^\\prime}$ mean? $\\frac{1}{c}\\frac{1}{c^\\prime}\\sum_{i=1}^c\\sum_{j=1}^{c^\\prime}(\\cdot)_{ij}$?\n2. I would suggest the authors run experiments on ResNet-50 on the ImageNet benchmark to strengthen their empirical results.\n3. What is the detection performance of only equation (8)? I suggest the authors to ablate on the influence of the MaxLogit multiplied to it.\n4. In equation 6, I'm assuming the numerator goes to zero, and the denominator is always bounded. Is this correct?\n5. On the proof, it states that $C\\leq d \\leq D$, but what if $C> D$? Which is usually the case for ImageNet-1K.\n6. I may have missed it in the text, but how do the authors select the parameter $d$ for the PCA projection?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The work is well motivated with inspiration from a phenomenon studied usually exclusively for ID data: neural collapse. By revealing a novel property\nin the presence of OOD data, they contributed to a better understanding of the NE phenomenon. \n\nThey also display improvements on the benchmark compared to some previous work in OOD detection.", "weaknesses": "**Theoretical soundness:** One of the main contributions of the paper is Theorem 4.1. But the proof is hard to follow and does not provide enough detail\n(e.g., \"based on the mathematical underpinnings of PCA\"). Taking a more pragmatic and didactic approach could clarify the proof and strengthen the theoretical results of the paper.\n\n**Empirical benchmark:** The benchmark on ImageNet is missing results on other popular architectures, such as ResNet, that are present only on the CIFAR\nbenchmark only. Results on ResNet-50 are highly appreciated and common in a plethora of previous work, and I believe would strengthen the empirical benchmark of the paper.\n\nSome passages of the paper are hard to follow. The writing and especially the notation can be polished.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)