Non-parametric Outlier Synthesis
Authors: Leitian Tao
Xuefeng Du
Jerry Zhu
Yixuan Li
Venue: ICLR 2023 poster (2023)

Abstract: Out-of-distribution (OOD) detection is indispensable for safely deploying machine learning models in the wild. One of the key challenges is that models lack supervision signals from unknown data, and as a result, can produce overconfident predictions on OOD data. Recent work on outlier synthesis modeled the feature space as parametric Gaussian distribution, a strong and restrictive assumption that might not hold in reality. In this paper, we propose a novel framework, non-parametric outlier synthesis (NPOS), which generates artificial OOD training data and facilitates learning a reliable decision boundary between ID and OOD data. Importantly, our proposed synthesis approach does not make any distributional assumption on the ID embeddings, thereby offering strong flexibility and generality. We show that our synthesis approach can be mathematically interpreted as a rejection sampling framework. Extensive experiments show that NPOS can achieve superior OOD detection performance, outperforming the competitive rivals by a significant margin. Code is publicly available at https://github.com/deeplearning-wisc/npos.

Published as a conference paper at ICLR 2023
OUTLIER SYNTHESIS
Leitian Tao
Xuefeng Du, Xiaojin Zhu, Yixuan Li
School of Information Engineering Wuhan University
Department of Computer Sciences
University of Wisconsin -aadison {xfdu, jerryzhu, sharonli]@cs wisw
taoleitian@gmale com
ABSTRACT
Out-of-distribution (OOD) detection is indispensable for safely deploying ma- chine learning models in the wild. One of the key challenges is that models lack supervision signals from unknown data, and as result, can produce over- confident predictions on OOD data. Recent work on outlier synthesis modeled the feature space as parametric Gaussian distribution, a strong and restrictive as- sumption that might not hold in reality. In this paper, we propose novel frame- work, non-parametric outlier synthesis (NPOS), which generates artificial OOD training data and facilitates learning reliable decision boundary between ID and OOD data. Importantly, our proposed synthesis approach does not make any distributional assumption the II) embeddings, thereby offering strong flexibility and generality. We show that our synthesis approach can be mathe- matically interpreted rejection sampling framework. Extensive experiments show that NPOS can achieve superior OOD detection performance, outperform- ing the competitive rivals by significant margin. Code is publicly available https: / github..hu.. com deoom//eepeaannnngg wwssswwscc///eee wisswwwsss/s.s...
INTRODUCTION
When deploying machine learning models the open and non-stationary world, their reliability is often challenged by the presence of out-of-distribution (OOD) samples. As the trained models have been exposed the unknown distribution during training. identifying OOD inputs has become vital and challenging problem in machine learning. There is increasing awareness in the research community that the source-trained models should not only perform well on the In-Distribution (ID) samples, but also be capable of distinguishing the ID vs. OOD samples.
To achieve this goal, promising learning framework to jointly optimize for both (1) accurate classification of samples from Pin. and (2) reliable detection of data from outside IP... This frame- work thus integrates distributional uncertainty as a first-class construct in the learning process. In particular, uncertainty loss term aims to perform level-set estimation that separates ID OOD data, in addition to performing ID classification. Despite the promise, a key challenge is how to provide 00D) data for training without explicit knowledge about unknowns. A recent work by Du et al. (2022c) proposed synthesizing virtual outliers from the low-likelihood region in the feature space of ID data, and showed strong efficacy for discriminating the boundaries between known and unknown data. However, they modeled the feature space as class-conditional Gaussian distribution strong and restrictive assumption that might not always hold in practice when facing complex distributions in the open world. Our work mitigates the limitations.
In this paper, we propose a novel learning framework. that enables the models learning the unknowns. Importantly, our proposed synthesis approach does not make any distributional assumption on the embeddings, thereby offering strong flexibility and generality especially when the embedding does not conform to a parametric distribution. Our framework illustrated in Figure 1. To synthesize outliers, our key idea is to "spray" around the low-likelihood ID embeddings, which lie on the boundary between ID and OOD data. These bound- ary points are identified by non- parametrii density estimation with the nearest neighbor distance. Then, the artificial outliers sampled from the Gaussian kernel centered at the embedding of the boundary ID samples. Rejection sampling is done by only keeping synthesized outliers with low likelihood. Leveraging the synthesized outliers, our uncertainty loss effectively performs the level-
Outlier Synthesis (NPOS),

---

Published as a conference paper at ICLR 2023
(a) ID embeddings
(b) Boundary samples
(c) Non-parametric outlier synthesis
ID samples Synthesized outliers
Rawen (g)
separates synthesized outliers
Figure 1: Illustration of our non-parametric outlier synthesis (NPOS). (a) Embeddings of ID data opti- mized using Equation 8, which facilitates learning distinguishable representations. (b) Boundary ID embed- dings are selected based on the non- para-aarattic k-NN distance. (c) Outliers are synthesized by sampling from a multivariate Gaussian distribution centered around the boundary embeddings. Rejection sampling is performed by keeping the synthesized outliers (orange) with the lowest likelihood. The risk term Ropen performs level-set estimation, learning separate the synthesized outliers and ID embeddings (Equation 6). Best view in color.
estimation, learning separate data between two (ID vs. outliers). This loss term is crucial to learn a compact decision boundary, and preventing overconfident predictions for unknown data.
Our uncertainty loss is trained in tandem with another loss that optimizes the IDD classification and emhedding quality. In particular, the loss encourages learning highly distinguishable ID representa- tions where ID samples are close to the class centroids. Such compact representations are desirable and beneficial for non-parametric outlier synthesis, where the density estimation can depend on the quality of learned features. Our learning framework is end-to-end trainable and converges when both ID classification and ID/outlier separation perform satisfactorily.
Extensive experiments show that NPOS achieves superior OOD detection performance, outperform- ing the competitive rivals by large margin. In particular, Fort et al. (2021) recently exploited large pre-trained models for OOD detection. They fine-tuned the model using standard cross-entropy loss and then applied the maximum softmax probability (MSP) score in testing. Under the same pre-trained model weights (i.e., CLIP-B/16 (Radford et al., 2021)) and the same number of fine- tuning configuration, NPOS reduces the FPR95 from 41.87% (Fort et al., 2021) to 5.76% direct 36.11% % improvement. Since both methods employ MSP in testing, the performance gap signifies the efficacy of our training loss using outlier synthesis for model regularization. Moreover, contrast NPOS with the most relevant baseline VÓS (Du et al., 2022c) using parametric outlier synthesis, where NPOS outperforms by 13.40% in FPR95. The comparison directly confirms the advantage of our proposed non- non-parametric outlier synthesis approach.
To summarize our key contributions:
1. We propose a new learning framework, non-parametric outlier synthesis (NPOS), which automatically generates outlier data for effective model regularization and improving test- time OOD detection. Compared to a recent method VOS that relies on parametric distribu- tion assumption (Du et al., 2022b), NPOS offers both stronger performance and generality.
2. We mathematically formulate our outlier synthesis approach rejection sampling proce- dure. By non-marametric density estimation, our training process approximates the level-set distinguishing ID and OOD data.
3. We conduct comprehensive ablations to understand the efficacy of NPOS, and further verify its scalability to a large dataset, including ImageNet. These results provide insights on the non- par-meraettiic approach for OOD detection, shedding light future research.
2 PRELIMINARIES
Background and notations. Over the last few decades, machine learning has been primarily op- erating in the closed- world setting, where the classes are assumed the same between training and test data. Formally, let X Rd denote the input space and Y,, f1...., C} denote the label space, with C' being the number of classes. The learner has access to the labeled training set D.,. = {(x;, y: Hi) drawn i.i.d. from the joint data distribution P Pxy,, Let P.,. denote the marginal distribution on X,
2

---

Published as a conference paper at ICLR 2023
which is also referred to the in-distribution. Let f X + RC denote function for the classi- fication task, which predicts the label of an input sample. To obtain an optimal classifier, a classic approach is called empirical risk minimization (ERM) (Vapnik, 1999): f argmin Reloned (f), where Retoee() = D (xf(x)); y6) and & is the loss function and F is the hypothesis space.
Out-of-distribution detection. The closed-world assumption rarely holds for models deployed in the open world, where data from unknown classes can naturally emerge (Bendale & Boult, 2015). Formally, our framework concerns common real-world scenario in which the algorithm trained on the ID data with classes Yn f1.... C}2 but will then be deployed in environments containing out-of-distributiin samples from unknown class y & Yn and therefore should not be predicted by f. At its core, OOD detection estimates the lower level set L == {x (x) S 3). Given any x, classifies as OOD if and only if x E C. The threshold 3 is chosen by controlling the false detection rate: fc (x) = 0.05. The false rate can be chosen as a typical (e.g., 0.05) or another value appropriate for the application. As in classic statistics (see (Chen et al., 2017) and the references therein), we estimate the lower level set C from the ID dataset Din.
METHOD
Framework overview. Machine learning models deployed in the wild must operate with both classification accuracy and safety performance. We use safety to characterize the model's ability to detect OOD data. This safety performance lacking for off-the-shelf machine learning algorithms - -which typically focus on minimizing error only on the in in-iistribution data from Pin. but does not account for the uncertainty that could arise outside ii.. For example, recall that empirical risk min- imization (ERM) (Vapnik, 1999), a long-established method that is commonly used today, operates under the closed-world assumption (i.e., no distribution shift between training vs. testing). Models optimized with ERM are known to produce overconfidence predictions OOD data (Nguyen et al., 2015), since the decision boundary is not conservative.
To address the challenges, our learning framework jointly optimizes for both: (1) accurate classifi- cation of samples from Pin, and (2) reliable detection of data from outside Pm-- Given a weighting factor a, the risk can be formalized as follows:
argmin
Relosed
+ a
Ropen (g)
1
Classification error
Error of OOD detector
where Rf) aims to classify ID samples into known classes, and (g) aims to distinguish ID vs. OOD. This framework thus integrates distributional uncertainty as first-class construct. Our newly introduced risk term (g) is crucial to prevent overconfident predictions for unknown data, and to improve test-time detection of unknowns. In the sequel, we introduce the two risks Ropen (g) (Section 3.1) and Relosed))) (Section 3.2) in detail, with emphasis placed on the former.
3.1 FORMALIZE (OPEN(g)
OOD detection via level-set estimation. To formalize (g)en(g). we can explicitly perform 3- level set estimation, i.e., binary classification in realization, between ID and OOD data. Concretely, the decision boundary is the empirical |3 level set fx (x) 3). Consider the following OOD conditional distribution:
Q( OOD) 1 (x) S (x))
Zout =| / 1[fm((x) - {19[Pinxx)ds
(2)
Zout
where 11-1 is the indicator function. Q(x OOD) is P,, restricted to c fx P(n(x) s 38} and renormalized. Similarly, define an ID conditional distribution:
Q( ID) = 1[ (x) (1
(3)
1 Zout
Note Q(x OOD) and Q(x ID) have disjoint support that partition h(X), where h : X + Rd feature encoder, which maps an input to the penultimate layer with d dimensions. In particular,
3

---

Published as a conference paper at ICLR 2023
for any non-degenerate prior QOOOD) = 1 Q(I),, the Bayes decision boundary for the joint distribution Q is precisely the empirical 3 level set.
Since only have access to the ID training data, critical consideration is how provide OOD data for training. A recent work by Du et al. (2022c) proposed synthesizing virtual outliers from the low-likelihood region in the feature space h(xx), which is more tractable than synthesizing x in the input space X. However, they modeled the feature space as class-conditional Gaussian distribution -a strong assumption that might not always hold in practice. To circumvent this limitation, our new idea is to perform non-parametric outlier synthesis, which does not make any distributional as- sumption on the ID embeddings. Our proposed synthesis approach thereby offers stronger flexibility and generality.
To synthesize outlier data, we formalize our idea by rejection sampling (Rubinstein & Kroese, 2016) with P., as the proposal distribution. In a nutshell, the rejection sampling can be done in three steps:
1. Draw an index in D by i uniform/11 [n] where n the number of training samples.
2. Draw sample v (candidate synthesized outlier) in the feature space from a Gaussian kernel centered at h(x.) with covariance I=I: v (h(xx,,) I2
3. Accept v with probability Q(h(x))OOD) where M is upper bound the likelihood ratio MP.
Q(h(x) OOD)/Pin. Since Q(h(x) OOD) is truncated Pin, one can choose M = 1/ Zout- Equivalently, accept v (vin(v) < 3.
Despite the soundness of the mathematical framework, the realization in modern neural networks is non-trivial. A salient challenge the computational efficiency drawing samples uniformly from Pn in step 1 expensive since the majority of samples will have a high density that is easily rejected by step 3. To realize our framework efficiently, we propose the following procedures: (1) identify boundary ID samples, and (2) synthesize outliers based on the boundary samples.
Identify ID samples near the boundary. We leverage the non-parametric nearest neighbor dis- lance as a heuristic surrogate for approximating Pin. and select the ID data with the highest k-NN dis- tances the boundary samples. We illustrate this step in the middle panel of Figure Specifically, denote the embedding set of training data as Z = (Z1. Z2, .... z,,), where is the Lormmlill For any embedding z' Z. we calculate the k-NN penultimate feature Z; hxxx)//ll(x;)) distance w.r.f. Z:
dx dz I|z' z(2)l22.
(4)
where (()) is the k-th nearest neighbor in Z. If an embedding has a large k-NN distance, it is likely to be on the boundary in the feature space. Thus, according to the k-NN distance, we select embeddings with the largest h--N distances. We denote the set of boundary samples as B.
Synthesize outliers based on boundary samples. Now we have obtained a set of ID embeddings near the boundary in the feature space, synthesize outliers by sampling from a multivariate Gaussian distribution centered around the selected ID embedding h((x,) E B:
o((
(5)
where the v denotes the synthesized outliers around l(x;),, and o² modulates the variance. For each boundary ID sample, we can repeatedly sample p different outliers using Equation 5, which produces a set V, = (V1, V2, .... vp). To ensure that the outliers are sufficiently far away from the ID data, further perform filtering process by selecting the virtual outlier in V; with the highest k-NN distance w.r.t. Z, as illustrated in the right panel of Figure (dark orange points).
The final collection of accepted virtual outliers will be used for the binary training objective:
expx(h(x))
Ropen = Ev-y log
+ Ex
[-log log 1 exp (h(x))
(6)
expolv>
where d(-) is nonlinear MLP function and l(x)) denotes the ID embeddings. In other words, the loss function takes both the ID and synthesized outlier embeddings and aims to estimate the level set through the binary cross-entropy loss.
4

---

Published as a conference paper at ICLR 2023
Table 1: OOD detection performance ImageNer-100 (Deng al., 2009) ID. All methods are trained on the same backbone. Values are percentages. Bold numbers are superior results. indicates larger values are better, and indicates smaller values are better.
OOD Datasets
Methods
iNaturalist
Avenge
ID ACCT
FPR951
AUROCT
FFROS)
AUROC
FPR95]
AUROCT
FPR95]
AUROCT
FPR95,
AUROCT
MCM (zero-shot)
15.23
97.30
25.05
95.95
24.91
95.66
33.68
94.11
24.72
95.76
89.32
(Fine-tuned)
Fort et aL/MSP
49.48
93.72
38.56
93.16
41.30
91.53
38.16
93.53
41.87
92.98
94.64
ODIN
7.32
98.09
29.05
92.63
32.58
92.60
15.50
96.58
21.11
94.98
94.64
Energy
20.95
95.94
18.42
94.77
22.35
93.08
15.36
96.19
19:27
94.99
GrudNorm
28.72
91.14
54.41
73.08
43.02
81.13
28.28
91.29
38.61
84.16
94.64
VIM
13.75
96.67
31.68
93.31
39.61
88.95
26.94
94.13
28.00
93.27
94,64
KNN
6.77
98.21
26.72
92.87
23.13
92.81
15,02
96.73
17.91
95.16
94.64
VOS
8.05
98.01
29.54
92.91
29. 54
92.91
13.79
97.28
19.16
95.009
94.14
VOS+
NPOS (ours)
0.70
99.14
9.22
98.48
5.12
98.86
8.01
98.47
5.76
98.74
94.76
3.2 OPTIMIZING ID EMBEDDINGS WITH RELOSED
Now discuss the design of Retosed which minimizes the risk on the in-distribution data. We aim to produce highly distinguishable ID representations, which non- parametriic outlier synthesis (cf. Section 3.1) depends on. In nutshell, the model aims learn compact representations that align ID samples with their class prototypes. Specifically, we denote by μ4, M2,....... .. MCC the prototype embeddings for the ID classes e {1, 21,2,... C). The prototype for each sample assigned based on the ground-truth class label. For any input with corresponding embedding l(x), we can calculate the cosine similarity between l(() and prototype vector jaj 1(x) [4g
fg (x)
[}(x)]] ||
which be viewed the j-th logit output. A larger fy indicates stronger association with the j-th class. The classification loss is the cross-entropy applied to the softmax output:
efv(x)/(F-11))))
Relosed
log
Σe= el(x0(((-111)))
where J is the temperature, and (x) is the logit output corresponding to the ground truth label y.
Our training framework is end-to-end trainable, where the two losses Ropen (cf. Section 3.1) and Retosed work in a synergistic fashion. First, as the classification loss (Equation 8) shapes ID embed- dings, our non-pann con-paraettric outlier synthesis module benefits from the highly distinguishable repre- sentations. Second, our uncertainty loss in Equation would facilitate learning compact decision boundary between ID and OOD, which provides reliable estimation for OOD uncertainty that can arise. The entire training process converges when the two components perform satisfactorily.
3.3 TEST-TIME OOD DETECTION
In testing, use the scoring function as Ming et al. (2022a) for OOD detection S(x)
5/000/ max, Des efe0s/r. where f, (x) = [< The rationale is that, for ID data, it will be matched to one of the prototype vectors with a high score and vice versa. Based on the scoring function, the OOD detector is (x 1{S(x) Δ}. where by convention, represents the pos- itive class (ID), and 0 indicates OOD. À is chosen so that a high fraction of ID data (e.g., 95%) is above the threshold. Our algorithm is summarized in Algorithm (Appendix C).
k(x))
4 EXPERIMENTS
In this section, we present empirical evidence to validate the effectiveness of our method on real- world classification tasks. We describe the setup Section 4.1, followed by the results and compre- hensive analysis in Section 4.2-Section 4.5.
4.1 SETUP
Datasets. We use both standard CIFAR- 100 benchmark (Krizhevsky et al., 2009) and the large- scale ImageNet dataset (Deng et al., 2009) the in-distribution data. Our main results and ablation

---

Published as a conference paper at ICLR 2023
Table 2: OOD detection performance for ImageNet-1k (Deng al., 2009) as ID..
OOD Datasets
Methods
iNaturalist
SUN
Textures
Average
ID ACC
FPR95)
AUROCT
FPR95]
AUROC
PPR95)
ALROCT
FPR9S]
AUROCT
FPR95,
AUROCI
MCM (acro-shot)
32.08
94.41
39.21
92.28
44.88
89.83
58.05
85,96
43.55
90.62
68.53
(Pine-tuned)
Fort ot aL/MSP
54.05
87.43
73.37
78.03
72.98
78.03
68.85
79.06
67.51
80.64
79.64
ODIN
30.22
94.65
54,04
57.17
55.06
85.54
51.67
87.85
47.75
58.80
79.64
Energy
47.67
79.64
GrudNorm
81.50
72.56
$2.00
72.86
80.41
73.70
79.36
70.26
80.82
72.35
79.64
VIM
32.19
93.16
54,01
87.19
60.67
83.75
53.94
87.18
50.20
87.82
79.64
KNN
29.17
94.52
35.62
92.67
39.61
91.02
64.35
85.67
42.19
90.97
79.64
VOS
31.65
94.53
43.03
91.92
41.62
90.23
56.67
86.74
43.24
90.86
79.64
VOS+
28.99
94.62
36.88
92.57
38.39
91.23
61.02
86.33
41.32
91.19
79.58
NPOS (ours)
16.58
96.19
43.77
90.44
45.27
89.44
46.12
88,80
37.93
91.22
79.42
studies are based on ImageNet- 100, which consists of 100 randomly selected classes from the orig-
inal ImageNet- Ik dataset. For completeness, we also conduct experiments on the full ImageNet- Ik dataset (Section 4.2). For OOD datasets, we adopt the same ones as in (Huang & Li, 2021), includ- st (Van Horn et al., 2018), SUN (Xiao et al., 2010), PLACES (Zhou
ing subsets of Na et al., 2017), and TEXTURE (Cimpoi et al., 2014). For each OOD dataset, the categories are disjoint from the ID dataset. We provide details the datasets and categories in Appendix A.
Model. In our main experiments, we perform training by fine-tuning the CLIP model (Radford al., 2021), which one of the most popular and publicly available pre-trained models. CLIP aligns an image with its corresponding textual description in the feature space by self-supervised contrastive objective. Concretely, adopts a simple dual-stream architecture with one image en- coder I X - Rd (e.g., ViT (Dosovitskiy et al., 2021)), and one text encoder ' t - Rd (e.g., Transformer (Vaswani et al., 2017)). We fine-tune the last two blocks of CLIP's image encoder, using proposed training objective in Section 3. To indicate input patch size in ViT models, append "/x" to model names. We prepend -B, -L to indicate Base and Large versions of the corresponding architecture. For instance, VTT-B/16 implies the Base variant with input patch resolution of 16 x 16. We mainly use CLIP-B/16, B/16, which contains a ViT-B/16 Transformer as the image encoder. We utilize the pre-extracted text embeddings from masked self-attention Transformer as the prototypes for each class, where = Ttt,) and f; is the text prompt for a label y;- The text encoder is not needed in the training process. We additionally conduct ablations on alternative backbone architec- ture including ResNet in Section 4.3. Note that our method is not limited to pre-trained models; it can generally be applicable for models trained from scratch, as we will later show Section 4.4.
Experimental details. We employ a two-layer MLP with a ReLU nonlinearity for é, with a hidden layer dimension of 16. We train the model using stochastic gradient descent with momentum of 0.9, and weight decay of 10-4, For ImageNet-100, we train the model for a total of 20 epochs, where only Equation for representation learning for the first ten epochs. We train the model jointly with our outlier synthesis loss (Equation 6) in the last 10 epochs. We set the learning rate be 0 for the Relosed branch, and 0.01 for the MLP in the Ropen branch. For the ImageNet- Ik dataset, we train the model for 60 epochs, where the first 20 epochs are trained with Equation 8. Extensive ablations on the hyperparameters are conducted in Section 4.3 and Appendix F.
Evaluation metrics. We report the following metrics: (1) the false positive rate (FPR95) of OOD samples when the true positive rate of ID samples is 95%, (2) the area under the receiver operating characteristic curve (AUROC), and (3) ID classification error rate (ID ERR).
4.2
MAIN RESULTS
NPOS significantly improves OOD detection performance. As shown in the Table 1, we com- pare the proposed NPOS with competitive OOD detection methods. For a fair comparison, all the methods only use ID data without using auxiliary outlier datasets. We compare our methods with the following recent competitive baselines, including (1) Maximum Concept Matching (MCM) (Ming et al., 2022a), (2) Maximum Softmax Probability (Hendrycks & Gimpel, 2017; Fort et al., 2021), (3) ODIN score (Liang et al., 2018), (4) Energy score (Liu et al., 2020b), (5) GradNorm score (Huang al., 2021), (6) ViM score (Wang al., 2022), (7) KNN distance (Sun et al., 2022), and (8) VOS

---

Published as a conference paper at ICLR 2023
Table 3: Ablation on model capacity and architecture. ID dataset is ImageNet-100.
OOD Datnsets
Model
Methods
INaturalist
Textures
Average
ID ACC
FPR95
AUROC
TPR95
AUROC
FPR95
AUROC
FPR95
ALROC
FPR95
AUROC
al.
87.19
60.50
47.54
90.51
59.02
88.00
92.26
RN50<4
MCM
20.15
96.61
22.52
95.92
27.04
94.54
28.39
93.97
24.54
95.26
87.84
Ours
3.12
99.15
4.75
98.30
12.87
98.75
11.02
97.93
7.94
98.53
92.32
Fort et al.
49.48
93.72
38.56
93.16
41.30
91.53
38,16
93.53
41.87
92.98
94.64
VIT-B/16
MCM
15.23
97.30
25.05
95.95
24.91
95.66
33.68
94.11
24.72
95.76
89.32
Ours
0.70
99.14
9.22
98.48
5.12
98.86
8.01
98.47
5.76
98.74
94.76
Fort al.
26.63
93,34
34.75
03.62
33.75
92.13
32.95
91.95
32.02
92.76
96.39
VII-L/14
MCM
15.09
97.49
14.25
97.42
96.75
18.27
96.50
92.30
Ours
0.13
99.43
4.79
99.10
6.36
98.42
7.63
98.19
4.73
98.79
96.28
(Du et al., 2022b) which synthesizes outliers by modeling the ID embeddings as a mixture of Gaus- sian distribution and sampling from the low-likelihood region of the feature space. MCM is the latest zero-shot OOD detection approach for vision-languag models. All the other baseline meth- ods are fine-tuned using the same pre-trained model weights (i.e., CLIP-B/16) and the same number of layers ours. We added a fully connected layer to the model backbone, which produces the clas- sification output. In particular, Fort et al. (2021) fine-tuned the model using cross-entropy loss and then applied the MSP score in testing. KNN distance is calculated using features from the penulti- mate layer of the same fine-tuned model as Fort et al. (2021). For VOS, we follow the original loss function and OOD score defined in Du et al. (2022b).
We show that NPOS can achieve superior OOD detection performance, outperforming the compet- itive rivals by large margin. In particular, NPOS reduces the FPR95 from 41.87% (Fort et al. (2021)) to 5.76% (ours) - a direct 36.11% improvement. The performance gap signifies the ef- fectiveness of our training loss using outlier synthesis for model regularization. By incorporating the synthesized outliers, our risk term Ropen is crucial to prevent overconfident predictions for OOD data, and improve test-time OOD detection.
non-parametrie outlier synthesis outperforms VOS. We contrast NPOS with the most relevant baseline VOS, where NPOS outperforms by 13.40% in FPR95. A major difference between the two approaches lies in how outliers are synthesized: parametric approach (VOS) vs. non -onpaaraettric approach (ours). Compared to VOS, our method does not make any distributional assumption on the ID embeddings, hence offering stronger flexibility and generality. Another difference lies in the IDD classification loss: VOS employs the softmax cross-entropy loss while our method utilizes a different loss (cf. Equation 8) to learn distinguishable ID embeddings. To clearly isolate the effect, we further enhance VOS by using the same classification loss defined in Equation 8 and endow VOS with stronger representation space. This resulting method dubbed VOS+ and its corresponding performance is also shown in Table Note that VOS+ and NPOS only differ in how outliers are synthesized. While VOS+ indeed performs better compared to the original VOS, the FPR95 still worse than our method. This experiment directly and fairly confirms the superiority of our proposed non-parametric outlier synthesis approach. Computationally, the training time using NPOS is 30.8 minutes on ImageNet- 100, which is comparable to VOS (30.0 minutes).
NPOS scales effectively to large datasets. To examine the scalability of NPOS, we also evaluate on the ImageNet- k dataset (ID) in Table 2. Recently, Fort al. (2021) explored small-scale OOD detection by fine-tuning the ViT model, and then applying the MSP score in testing. When extending large-scale tasks. we find that NPOS yields superior performance under the same image encoder configuration (ViT-B/16). In particular, NPOS reduces the FPR95 from 67.31% 1% to 37.93%. This highlights the advantage of utilizing non-parane corrmaraettric outlier synthesis to learn conservative decision boundary for OOD detection. Our results also confirm that NPOS can indeed scale to large datasets with complex visual diversity.
Learning compact ID representation benefits NPOS. We investigate the importance of optimiz- ing ID embeddings for non-parametric outlier synthesis. Recall that our loss function in Equation 8 facilitates learning a compact representation for ID data. To isolate its effect, we replace the loss function with the cross-entropy loss while keeping everything else the same. On ImageNet- 100, this yields an average FPR95 of 17.94%, and AUROC 95. 95.75%. The worsened OOD detection perfor- mance signifies the importance of our ID classification loss that optimizes ID embedding quality.

---

Published as a conference paper at ICLR 2023
102
16:23
27.35
120
92.36
70
95-
65
92-
60
18.92
90-
85
15
02
60
50
76.5
75
150
Regubnication weight
Verience
Kinn KMX distance
Figure 2: (a) Ablation study on the regularization weight a on Ropen- (b) Ablation on the variance a² for synthesizing outliers in Equation (c) Ablation on the for the k-NN distance. The numbers are FPR95. The ID training dataset is ImageNet-100.
4.3 ABLATION STUDY
Ablation on model capacity and architecture. To show the effectiveness of the ResNet-based architecture, we replace the CLIP image encoder with RN50x4 (178.3M), which shares similar number of parameters as CLIP-B/16 (149.6M). The OOD detection performance of NPOS for the ImageNet- 100 dataset (ID) shown Figure results with the ResNet-based backbone, and the performance is comparable between RN50x4 and CLIP--/16 (7.94 vs. 5.76 in FPR95). Moreover, we observe that larger model capacity indeed leads to stronger performance. Compared with CLIP-B, NPOS based CLIP-L/14 reduces FPR95 to 4.73%. This suggests that larger models are endowed with a better representation quality which benefits outlier synthesis and OOD detection. Our findings corroborate the observations in Du al. (2022c) that a higher-capacity model is correlated with stronger OOD detection performance.
can be seen that NPOS still shows promising
Ablation on the loss weight. Recall that training objective consists of two risks Relosed and Rugen. The two losses are combined with a weight a on Rapens and constant on Relosed- Fig- ure 2 (a), we ablate the effect of weight ImageNet-100. When a reduces to a small value (e.g., 0.01). the performance becomes closer to the MSP baseline trained with Relosed only. In contrast, under mild weighting, such OOD detection performance significantly improved. Too excessive regularization using synthe- sized outliers ultimately degrades the performance.
the OOD detection performance. Here the ID data is
0.1, the
Ablation on the variance x² in sampling. A proper variance o² in sampling virtual outliers critical to method. Recall in Equation 5 that o² modulates the variance when synthesizing outliers around boundary samples. In Figure 2 (b), we systematically analyze the effect of o² on OOD detection performance. We vary d² {0.01, 0.1, 0.5, 1.0, 10). We observe that the perfor- mance of NPOS is insensitive under a moderate variance. In the extreme case when o² becomes too large, the sampled virtual outliers might suffer from severe overlapping with ID data, which leads to performance degradation as expected.
Ablation on & in calculating KNN distance. In Figure 2 (c), we analyze the effect of k, i.e., the number of nearest neighbors for non-parametric density estimation. In particular, we vary k = {100, 200, 300, 400, 5003. We observe that our method not sensitive this hyperparameter, varies from 100 to 500.
4.4 ADDITIONAL RESULTS WITHOUT PRE- TRAINED MODEL
Going beyond fine-tuning with the large pre-trained model, we show that NPOS is also applicable and effective when training from scratch. This setting allows us to evaluate our algorithm itself without the impact of strong model initialization. Appendix D showcases the performance of NPOS trained on three datasets: CIFAR-10, CIFAR-100 100, and ImageNet- 100 datasets. We substitute the text embeddings μ4; vision-language models with the class-conditional image embeddings estimated in exponentiallmmovin-avveaa 7)z), Vc E 21,2,.. ...... C), where the prototype f4c for class c is updated during training as the moving average of all embeddings with label and denotes the normalized embedding of samples in class c. The EMA style update avoids the costly alternating training and prototype estimation over the entire training in the conventional approach (Zhe al., 2019).
(EMA) manner (Li et al., 2021): p. Normalize(714. +
8

---

Published as a conference paper at ICLR 2023
We evaluate on six OOD datasets: TEXTURES (Cimpoi et al., 2014), SVHN (Netzer et al., 201 D, PLACES365 (Zhou et al., 2017), LSUN-RESIZE RESIZE & LSUN-C (Yu et al., 2015), and ISUN (Xu et al, 2015). The comparison is shown in Table 4, Table 5, and Table 6. NPOS consistently improves OOD) detection performance over all the published baselines. For example, on CIFAR-100, NPOS outperforms the most relevant baseline VOS by 27.41 % in FPR95.
4.5 VISUALIZATION ON THE SYNTHESIZED OUTLIERS
Qualitatively, we show the t-SNE visualization (Van der Maaten Hin- ton, 2008) of the synthesized outliers by our proposed method NPOS in Figure 3. The ID features (colored in purple) are extracted from the penul- timate layer of model trained ImageNet- 100 (class name: HERMIT CRAB). Without making any distributional assumption on the embedding space, NPOS is able to synthesize outliers (colored in orange) in the low- likelihood region, thereby offering strong flexibility and generality.
Figure 3: t-SNE visu- alization of synthesized outliers by NPOS.
RELATED WORK
OOD detection has attracted a surge of interest since the overconfidence
phenomenon in OOD data is first revealed in Nguyen al. (2015). One line of work performs OOD detection by devising scoring functions, including confidence-basee methods (Bendale & Boult, 2016; Hendrycks & Gimpel, 2017; Liang al., 2018), energy-based score (Liu al., 2020b; Wang et al., 2021), distance-based approaches (Lee et al., 2018b; Tack et al., 2020; Sehwag et al., 2021; Sun et al., 2022; Du al., 2022a; Ming et al., 2023), gradient-based score (Huang et al., 2021), and Bayesian approaches (Gal & Ghahramani, 2016; Lakshminarayanan et al., 2017; Maddox et al., 2019; Malinin & Gales, 2019; Wen et al., 2020; Kristiadi et al., 2020).
Another promising line of work addressed OOD detection by training- time regularization (Bevandić al., 2018; Malinin & Gales, 2018; Geifman & El-Yaniv, 2019; Hein al., 2019; Meinke & Hein, 2020; Mohseni et al., 2020; Jeong& & Kim, 2020; van Amersfoort et al., 2020; Yang et al., 2021; Wei et al., 2022). For example, the model is regularized to produce lower confidence (Lee et al., 2018a; Hendrycks et al., 2019) or higher energy (Du et al., 2022c; Liu et al., 2020b; Katz-Samuels et al., 2022; Ming et al., 2022b) on the outlier data. Most regularization methods require the availability of auxiliary OOD data. Among methods utilizing ID data only, Hsu et al. (2020) proposed to de- compose confidence scoring during training with a modified input pre- pre-processing method. Liu et al. (2020a) proposed nermraa-normaalzedd neural Gaussian process by optimizing the network design for uncertainty estimation. Closest to our work, VOS (Du et al., 2022c) synthesizes virtual outliers using multivariate Gaussian distributions, and regularizes the model's decision boundary between ID and OOD data during training. In this paper, we propose a novel non- nan-parametric outlier synthesis approach, mitigating the distributional assumption made in VOS.
Large-scale OOD detection. Recent works have advocated for OOD detection in large-scale set- tings, which are closer to real-world applications. Research efforts include scaling OOD detection to large semantic label space (Huang & Li, 2021) and exploiting large pre-trained models (Fort al., 2021). Recently, powerful pre-trained vision-language models have achieved strong re- sults on zero-shot OOD detection (Ming et al., 2022a). Different from prior works, we propose a new training/fine-tuniig
procedure with non-paraeetric outlier synthesis for model regularization. Our learning framework renders a conservative decision boundary between ID and OOD data, and thereby improves OOD detection.
CONCLUSION
In this paper, we propose a novel framework NPOS, which tackles ID classification and OOD uncer- tainty estimation in one coherent framework. NPOS mitigates the key shortcomings of the previous outlier synthesis-based OOD detection approach, and synthesizes outliers without imposing any dis- tributional assumption. To the best of our knowledge, NPOS makes the first attempt to employ a non-parametric outlier synthesis for OOD detection and can be formally interpreted as rejection sampling framework. NPOS establishes competitive performance on challenging real-world OOD detection tasks, evaluated broadly under both the recent dision-languas trained from scratch. Our in-depth ablations provide further insights on the efficacy of NPOS. We hope work inspires future research OOD detection based on nonpparametric outlier synthesis.
models and models that

---

Published as a conference paper at ICLR 2023
REPRODUCIBILITY STATEMENT
We summarize our efforts below to facilitate reproducible results:
Datasets. We use publicly available datasets, which are described in detail in Section 4.1, Section 4.4, and Appendix A.
2. Baselines, The description and hyperparameters of the OOD detection baselines are ex- plained Section 4.2, and Appendix B.
3. Methodology. Our method is fully documented in Section 3, with the pseudo algorithm detailed in Algorithm 1. Hyperparamters are specified in Section 4.1, with a thorough ablation study provided in Section 4.3 and Appendix F.
4. Open Source. Code, datasets and model checkpoints are publicly available https: wttp://.cccc/eeeeeeeeeeeeeeeeeee htt.s/hww.ccco.eeeeaaaaaaaa////a
ACKNOWLEDGEMMENT
Li gratefully acknowledges the support of the AFOSR Young Investigator Award under No. FA9550- 23-1-0184; Philanthropic fund from SFF; Wisconsin Alumni Research Foundation; faculty research awards from Google, Meta, and Amazon, Zhu is supported in part by NSF grants 1545481, 1704117 177, 1836978, 2023239, 1428 2202457, ARO MURI W91 INF21 10317, and AF CoE FA9550- 18-1- 0166. Any opinions, findings, conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views, policies, endorsements, either expressed or implied of sponsors.
10

---

Published as a conference paper at ICLR 2023
REFERENCES
Abhijit Bendale and Terrance Boult. Towards open world recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1893-1902, 2015.
Abhijit Bendale and Terrance Boult. Towards open set deep networks. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, pp- 1563-1572, 2016.
Petra Bevandić, Ivan Krešo, Marin Oršić, and Siniša Segvić. Discriminative out -iitrii-ittiitttionn detection for semantic segmentation. arXiv preprint arXiv: 1808.07703 2018.
Yen-Chi Chen, Christopher R Genovese, and Larry Wasserman. Density level sets: Asymptoties, inference, and visualization. Journal of the American Statistical Association, 112(520):1684- 1696, 2017.
Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. De- scribing textures in the wild. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3606-3613, 2014.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image database. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 248-25422 255, 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x16 words: Transformers for image recognition at scale. In Proceedings of the International Conference Learning Representations, 2021.
Xuefeng Du, Gabriel Gozum, Yifei Ming, and Yixuan Li. Siren: Shaping representations for detect- ing out-of-distribution objects. In Advances in Neural Information Processing Systems, 2022a.
Xuefeng Du, Xin Wang. Gabriel Gozum, and Yixuan Li. Unknown-aware object detection: Learning what you don't know from videos in the wild. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022b.
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. In Proceedings of the International Conference on Learning Representations, 2022c.
Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of -ut-r--dist detection. Advances in Neural Information Processing Systems, 34:7068-7081, 2021.
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model un- certainty in deep learning. Proceedings of the International Conference on Machine Learning, pp. 1050-1059, 2016.
Yonatan Geifman and Ran El-Yaniv. Selectivenet: A deep neural network with an integrated reject option. In Proceedings of the International Conference on Machine Learning, pp. 2151-2159, 2019.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International conference on machine learning, pp. 1321-1330, 2017.
Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high- confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 41- 50, 2019.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and distriibitiiitoo examples in neural networks. Proceedings of the International Conference Learning Repre- sentations, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In Proceedings of the International Conference Learning Representations, 2019.
11

---

Published as a conference paper at ICLR 2023
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out- of-distribution image without learning from distiiibibtttinn data. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 10951-10960. 2020.
Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8710-8719, 2021.
Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distribu- tional shifts in the wild. In Advances in Neural Information Processing Systems, 2021.
Taewon Jeong and Heeyoung Kim. Ood-maml: Meta-learning for few-shot out-of-distribution de- tection and classification. Advances in Neural Information Processing Systems, 33:3907-3916, 2020.
Julian Katz-Samuels, Julia B. Nakhleh, Robert D. Nowak, and Yixuan Li. Training OOD detectors in their natural habitats. In Proceedings of the International Conference on Machine Learning, pp. 10848-10865, 2022.
Agustinus Kristiadi, Matthias Hein, and Philipp Hennig. Being bayesian, even just bit, fixes overconfidence relu networks. In International conference on machine learning, pp. 5436- 5446, 2020.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Balaji sakshminarayanan. Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. In Advances in Neural Information Processing Systems, volume 30, pp. 6402-6413 2017.
Kimin Lee, Honglak Lee, Kibok Lec, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting out-o--dist samples. In Proceedings of the International Conference Learning Representations, 2018a.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in Neural Information Processing Systems, 31, 2018b.
Junnan Li, Caiming Xiong, and Steven C. H. Hoi. Mopro: Webly supervised learning with momen- tum prototypes. In Proceedings of the International Conference on Learning Representations, 2021.
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of -ittr--disttibution image detection in neural networks. In Proceedings of the International Conference Learning Representations, 2018.
Jeremiah Liu, Zi Lin, Shreyas Padhy, Dustin Tran, Tania Bedrax Weiss, and Balaji Lakshmi- narayaman. Simple and principled uncertainty estimation with deterministic deep learning via distance awareness. Advances in Neural Information Processing Systems, 33:7498-75111 2020a.
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based - detec- tion. Advances in Neural Information Processing Systems, 33:21464-21475. 2020b.
Wesley J Maddox, Pavel Izmailov, Timur Garipov, Dmitry P Vetrov, and Andrew Gordon Wilson A simple bascline for bayesian uncertainty in deep learning. Advances in Neural Information Processing Systems,
2019.
Andrey Malinin and Mark Gales. Predictive uncertainty estimation via prior networks. Advances in Neural Information Processing Systems, 31, 2018.
Andrey Malinin and Mark Gales. Reverse kl-divergence training of prior networks: Improved un- certainty and adversarial robustness. Advances in Neural Information Processing Systems, 2019.
12

---

Published as a conference paper at ICLR 2023
Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't know. In Proceedings of the International Conference on Learning Representations, 2020.
Yifei Ming, Ziyang Cai, Jiuxiang Gu, Yiyou Sun, Wei Li, and Yixuan Li. Delving into out-of- distribution detection with lasionelanguage representations. In Advances in Neural Information Processing Systems, 2022a.
Yifei Ming, Ying Fan, and Yixuan Li. POEM: dusto--disttibution detection with posterior sampling. In Proceedings of the International Conference on Machine Learning, pp. 15630-15665, 2022b.
Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embeddings for out-of-distribution detection? In Proceedings of the International Conference on Learning Representations, 2023.
Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable aot-of-distributtin detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 5216-5223, 2020.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High con- fidence predictions for unrecognizable images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 427-436, 2015.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In Proceedings of the International Conference on Machine Learning, pp.
2021.
Reuven Y Rubinstein and Dirk Kroese. Simulation and the Monte Carlo method. John Wiley & Sons, 2016.
Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. In International Conference on Learning Representations, 2021.
Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In Proceedings of the International Conference on Machine Learning, pp. 20827- 20840, 2022.
Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. Advances in Neural Information Processing Systems, 2020.
Joost van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using single deep deterministic neural network. In Proceedings of the International Conference Machine Learning, pp. 9690-9700, 2020.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008
Grant Van Hor,, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 8769-8778, 2018
Vladimir Vapnik. The nature of statistical learning theory. Springer science & business media, 1999.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances Neural Informa- fion Processing Systems, 30, 2017.
13

---

Published as a conference paper at ICLR 2023
Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: -ittt--distribution with virtual- logit matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.
Haoran Wang, Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't know? Proceedings of the Advances in Neural Information Processing Systems, 2021.
Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In Proceedings of the International Conference on Machine Learning, pp. 23631 -2644,, 2022.
Yeming Wen, Dustin Tran, and Jimmy Ba. Batchensemble: an alternative approach to efficient ensemble and lifelong learning. In International Conference Learning Representations, 2020.
Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3485-3492 2010.
Pingmei Xu, Krista Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint arXiv:1504.06755, 2015.
Jingkang Yang, Haoqi Wang, Litong Feng, Xiaopeng Yan, Huabin Zheng, Wayne Zhang, and Ziwei Liu. Semantically coherent out-of-distribution detection. In Proceedings of the International Conference on Computer Vision, pp. 8281-8289, 2021.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint /506 2015.
Xuefei Zhe, Shifeng Chen, and Hong Yan. Directional statistics- based deep metrie learning for image classification and retrieval. Pattern Recognition, 93:113- 2019.
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE transactions on pattern analysis and machine intelligence, 40(6):1452-1444 2017.
14

---

Published as a conference paper at ICLR 2023
Non-parametric Outlier Synthesis (Appendix)
A DETAILS OF DATASETS
ImageNet- We randomly sample 100 classes from ImageNet-Ik (Deng al., 2009) create
ImageNet- 100. The dataset contains the following categories: n01986214, n04200800, n03680355, n03208938,
a02963159, 003874293, 002058221, n04612504, n02841315, m02099712. n02093754, n936499999 a02114712, d03733281, d02319095,
001978455, 004127249, 007614500, n03595614, n04542943, n02391049. n04540053, n03483316, n03146219, a02091134, 002870880,
m04499046, 003347037, m02090379, n10148035, n077115556, m04487081, n04192698, n12268853, n02881205, m02002556, n04273569,
a02443114, a03544143, ni3669007, n04557648, n02510455, n03633091, n02174001, a02077923, a03085013, m03888605, n02279972.
MM311114,, o01748264, n02837789, n07613480, n02111312, n02137549, ni21111129, ab1689811, a020996001 n02085620, n03786901,
m04476259, n12998815, n04371774, n02814533, n02009229, n02500267, n04592741, n02 19789, n02090022, n02132136, n02797295,
n01740131, 182951358, n04141975, n02169997, n01774750, n02128757, n02097298, n02085782, n03476684, n03095699, n04326547,
#02107142, a022641379, 004081281, 006599364,, nU3444034, nU7745940, nU3876231. n09421951,
n03467068, n01530575,
003338043, a03391062, m22777292 aUS710113, a09256479, n02443-844 n01728572, n03903868.
OOD datasets. Huang & Li curated diverse collection of subsets from iNaturalist (Van Horn et al., 2018), SUN (Xiao et al., 2010), Places (Zhou et al., 2017), and Texture (Cimpoi et al., 2014) as large-scale OOD datasets for ImageNet-IK, where classes ImageNet-Ik. We provide brief introduction for each dataset as follows.
test sets do not overlap with
iNaturalist contains images of natural world (Van Horn al., 2018). has 13 super-categories and 5,089 sub-categories covering plants, insects, birds, mammals, and so on. We use the subset that contains 1 10 plant classes which are not overlapping with ImageNet-Ik.
SUN stands for the Scene UNderstanding Dataset (Xiao et al., 2010). SUN contains 899 categories that cover more than indoor, urban, and natural places with or without human beings appearing in them. We use the subset which contains 50 natural objects not in ImageNet-Ik.
Places is a large scene photographs dataset (Zhou et al., 2017). contains photos that are labeled with scene semantie categories from three macro-classes: Indoor, Nature, and Urban. The subset use contains 50 categories that are not present ImageNet-
Texture stands for the Describable Textures Dataset (Cimpoi al., 2014). It contains images of textures and abstracted patterns. As no categories overlap with ImageNet-1k; we use the entire dataset in Huang & Li (2021).
B BASELINES
To evaluate the baselines, we follow the original definition in MSP (Hendrycks & Gimpel, 2017; Fort et al., 2021), ODIN score (Liang et al., 2018), Energy score (Liu et al., 2020b), GradNorm score (Huang et al., 2021), ViM score (Wang et al., 2022), KNN distance (Sun et al., 2022) and VOS (Du et al., 2022b).
For ODIN, we follow the original setting in the work and set the temperature T as 1000.
For both Energy and GradNorm scores, the temperature set to be T 1.
For ViM, follow the original implementation according to the released code.
For VOS, we ensure that the number of negative samples is consistent with our method for each class, we sample 60k points after estimating the distribution and select six outliers with the lowest likelihood. For the OOD score, we adopt the uncertainty proposed in the original method.
For VOS+, we use the same loss function as defined Section 3, but only replace the sam- pling method to be parametric. The way VOS+ synthesizes outliers is the same VOS (first modeling the feature embedding as a mixture of multivariate Gaussian distribution, and then sample virtual outliers from the low-likelihood region in the embedding space). For a fair comparison, we also use the textual embedding extracted from CLIP as the pro- totype for VOS+. Note that VOS+ and NPOS only differs in how outliers are synthesized.
15

---

Published as a conference paper at ICLR 2023
C ALGORITHM OF NPOS
We summarize our algorithm in implementation. Following (Du et al., 2022c), we construct class- conditional in-distribution sample queue {Qo)am). which periodically updated as new batches of training samples arrive.
Algorithm NPOS: Non-parnnae parametric Outlier Synthesis
Input: ID training data Dn {(x,, ye) initial model parameters 0 for backbone, nonlinear MLP layer & and class condiconnaa prototypes μt.
Output: Learned classifier f fxx,, and OOD detector G(x).
while train do
Update class-coniitional queue {Qe]am with the feature embeddings i(x) of training sam-
ples in the current batch.
Select set of boundary samples B, consisting top-ra embeddings with the largest k-NN distances using Equation 4.
Synthesize a set of outliers Vi around each boundary sample x, E [B U B2 ....Bc using
Equation 5.
Accept the outliers in each V; with large k-NN distances.
5. Calculate level-set estimation loss Ropen and IDD embedding optimization loss Relosed using Equations 6 and 8, respectively, update the parameters 0, based on loss in Equation 1.
Update prototypes using μt Normalize(7p.. + 7)2), Ve .1,2,..., C}.
end
while eval
1. Calculate the OOD score defined in Section 3.3.
Perform OOD detection by thresholding comparison.
end
D EXPERIMENTAL DETAILS AND RESULTS ON TRAINING FROM SCRATCH
In this section, provide the implementation details and the experimental results for NPOS trained from scratch. We evaluate on three datasets: CIFAR-10, CIFAR-100, and ImageNet-100. We sum- marize the training configurations of NPOS in Table 7.
The results on CIFAR-10 are shown in Table 4. All methods are trained on ResNet-18. We consider the same set of baselines as in the main paper. For the post-hoc OOD detection methods (MSP, ODIN, Energy score, GradNorm, ViM, KNN), we report the results by training the model with the cross-entropy loss for 100 epochs using stochastic gradient descent with momentum 0.9. The start learning rate is 0.1 and decays by factor of 10 at epochs 50, 75, and 90 respectively. The batch size set to 256. The average FPR95 NPOS is 10. 16%, significantly outperforming the best baseline VOS (27.85 27).8%). The results CIFAR-100 are shown in Table 5, where the strong performance of NPOS holds.
CIFAR-10 and CIFAR-100.
Table 4: 0OD detection performance on CIFAR-10 ID. All methods are trained on ResNet-18 Values are percentages. Bold numbers are superior results.
Datasets
Methods
SVHN
LSUN
ISUN
Texture
Places365
Average
ID ACC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
54.57
94.21
ODIN
20.93
95.55
7.26
98.53
33.17
94.65
56.40
86.21
63.04
96.57
36.16
92.30
94.21
Energy
54.41
91.22
10.19
96.00
27.52
95.59
55.23
89.37
42.77
91.02
38.02
93.05
94.21
GradNerm
VIM
24.95
95.36
18.80
96.63
29.25
95.10
24.35
95.20
44.70
90.71
28.41
94.60
94.21
KNN
24.53
95.96
25.29
95.69
25.55
95.26
27.57
94.71
50.90
89.114
30.77
94.15
94.21
vos
15.69
93.96
NPOS
5.61
97.64
4.08
97.53
14.13
94.92
94.67
91.35
10.16
93.86
ImageNet-100. The results are shown in Table 6. All methods are trained on ResNet-101 using the ImageNet- 100 dataset. We use slightly larger model capacity accommodate for the larger- scale dataset with high-solution images. NPOS significantly outperforms the best baseline KNN by 18. 88.66% in FPR95. For the post-hoc OOD detection methods, report the results by training the
16

---

Published as a conference paper at ICLR 2023
Table 5: OOD detection performance CIFAR-100 as ID. All methods are trained on ResNet-34. Values are percentages. Bold numbers are superior results.
0OD Datasets
Methods
SVHN
Places365
LSUN
ISUN
Texture
Average
ID ACC
FPR95
AUROC
FPRO5
AUROC
FPR95
AUROC
FPR95
AUROC
FFR95
AUROC
FFR95
AUROC
MSP
85.30
72.41
73.40
81.09
85.55
74,00
88.95
68.59
86.45
71.32
83.85
73.48
73.12
ODIN
76.13
41.50
91.60
74,70
90..20
73.17
76.33
78.62
73.12
Energy
89.15
78.16
44.15
90.85
$1.85
80.57
90.35
65.18
$4.30
73.96
77.96
78.32
73.12
GradNorm
91.05
67.13
55,72
86.09
97.80
44.21
89.71
58.23
96.20
52.17
86.10
61.57
73.12
KNN
66.38
83.76
79.17
71.91
70.96
83.11
77.83
78.89
88.00
67.19
76.47
77.08
73.12
VOS
76.55
75.68
29.95
94.02
75.61
76.84
83.64
71 71.46
76.94
76.23
68.18
78.95
73.69
Table 6: OOD detection performance on ImageNet-100 100 as ID. All methods are trained on ResNet- 101. Values are percentages. Bold numbers superior results.
OOD Datasets
Methods
iNaturalist
Places
SUN
Textures
Average
ID ACC
FPR95
AUROC
FPROS
AUROC
FPR95
AUROC
EPR95
AUROC
FPR95
AUROC
MSP
76.30
82.20
81.90
77.54
82.70
78.35
75.30
80.01
79.05
79.52
84.16
ODIN
53.00
89.52
70.40
82.77
66.90
85.01
48.40
89.19
59.67
86.62
84.16
Energy
72,60
85.31
69.80
83.15
74.40
83.96
63.40
84,80
70.05
84.31
84.16
GradNorm
50.82
84.86
68.27
74.46
65.77
77.11
40.48
88.17
56.33
81.15
84.16
VIM
72.40
84.88
76.20
81.54
73.80
83.99
22.20
95.63
61.15
KNN
56.96
86,98
64.54
83.68
63.04
85.37
15.83
96.24
50.09
88.07
84.16
VOS
54.68
89.74
63.71
88.97
41.67
91.54
67.92
84.34
56.99
88.65
84.39
NPOS
19.49
96.43
36.17
88.47
44.91
91.62
3.97
99.18
31,13
93.93
84.23
model with the cross-entropy loss for 100 epochs using stochastic gradient descent with momentum 0.9. The start learning rate 0. and decays by a factor of 10 epochs 50, 75, and 90 respectively. The batch size is set 512.
Our results above demonstrate that NPOS can achieve strong OOD detection performance with- out necessarily relying the pre- trained models. Thus, framework provides strong generality across both scenarios: training from scratch or fine-tuning on pre-trained models.
Table Configurations of NPOS: training from scratch
CIFAR-10
CIFAR-100
ImageNet-100
Training epochs
500
500
500
Momentum
0.9
0.9
0.9
Batch size
256
256
512
Weight decay
0.0001
0.0001
0.0001
Classification branch initial LR
0.5
0.5
0.1
Initial LR for Rapen(g)
0.05
0.05
0.01
LR schedule
cosine
cosine
cosine
Prototype update factor y Regularization weight a starting epoch of regularization
0.95
0.95
0.95
0.1
0.1
0.1
200
200
200
Queue size (per class) [Qel À in nearest neighbor distance
600
600
1000
300
300
400
Number boundary samples (per class) m
200
200
300
0.1
0.1
0.1
Temperature
0.1
0.1
0.1
E ADDITIONAL EXPERIMENTS ON MODEL CALIBRATION AND DATA-SHIFT ROBUSTNESS
Data-shift robustness. We evaluate the -POS-trained model (from scratch with 5 random seeds) on different test data with distribution shifts in Table 8. Specifically, we report the mean classi- fication accuracy and the standard deviation for measuring data-shift robustness. The number in
17

---

Published as a conference paper at ICLR 2023
the bracket of the first column indicates clean accuracy the in-distribution test data. The results demonstrate that compared to the vanilla classifier trained with the cross-entropy loss only, NPOS does not incur substantial change in distributional robustness.
Table 8: Evaluations data-shit robustness (numbers are in %).
TD data
Original test ACC
shifted dataset
CE-OOD ACC (R))
NPOS-OOD ACC (Rasel Roper
CIFAR-10
94,06
CIFAR-IO-C
72.97 = 0.36
72.63 + 0.52
CIFAR-100
74.86
CIFAR-100-C
0.24
46.93
ImageNet-100 100
84.22
ImageNet-C
33.49 = 0.34
34.29 = 0.76
ImageNet-100
84.22
ImageNet-R
28.98 0.62
29.50 +: 1.43
ImageNet-100
84.22
ImageNet-A
13.92
12.16 2.24
ImageNet-100 100
84.22
ImageNet-v2
72.17 = 0.95
71.67 = 1.54
ImageNet-100
84.22
ImmgeNNttSkettte
17.94
Model calibration. In Table 9, we also measure the calibration error of NPOS (with random
seeds) different datasets using Expected Calibration Error (ECE, in %) (Guo et al., 2017). In the implementation, we adopt the codebase' for metric calculation. The results suggest that NPOS maintains overall comparable (in some ing a much stronger performance of OOD uncertainty estimation.
better) calibration performance, while achiev-
Table 9: Calibration performance (numbers are in %).
Model
Datasct
Method
ECE
CE(Resoed (g)
0.62+t 0.04
CIFAR-10
NPOS (Rewsed (g) + Rapen())
0.27 0.06
CR
3.19+ 0.05
training from scratch
CIFAR-100
NPOS
4.02+00.15
CE
7.17
ImageNet-100
NPOS
7.52 0.29
CE
2.34 0.01
ImageNet-100
NPOS
1.06 0.03
w/ pre-trained model
CE
3.42 0.02
ImageNet-1K
NPOS
2.66 0.07
F ADDITIONAL ABLATIONS ON HYPERPARAMETER, AND DESIGNS
In this section, we provide additional analysis of the hyperparameters and designs of NPOS. For all the ablations, we use the ImageNet- 100 dataset as the in-distribution training data, and fine-tune on VIT-B/16.
Ablation on the number of boundary samples. We show in Table 10 the effect of m the number boundary samples selected per class. We vary m E {100, 150, 200, 250, 300, 350, 400). We observe that NPOS is not sensitive to this hyperparameter.
Table 10: Ablation study on the number of boundary samples (per class).
m
FPR95
AUROC
AUPR
ID ACC
100
10.63
98.14
97.56
93.97
150
9.94
98.21
97.75
94.02
200
8.52
98.34
97.93
93.78
250
7.41
98.49
98.25
94,42
300
6.12
98.70
98.49
94,46
350
8.77
98.15
97.75
94.00
400
7.43
98.51
98.21
94.52
Ablation the number of samples in the class-conditional queue. In Table 11, investigate the effect of ID queue size IQel E {1000, 1500, 2000, 2500, 3000}. Overall, the OOD detection performance of NPOS is not sensitive to the size of the Dass-condittonal queue. A sufficiently large 'ul is desirable since the non-parametric density estimation can be more accurate.
'htpps: //gi thub. wwt gol ss http///mmrrattur__eeee 1ing
18

---

Published as a conference paper at ICLR 2023
Table 11: Ablation study on the size of ID queue (per class).
[Qcl
FPR95
AUROC
AUPR
ID ACC
1000
7.18
98.51
98.24
94.40
1500
5.76
98.74
98.73
94.76
2000
6.76
98.64
98.35
94.76
2500
8.75
98.28
97.89
94.36
3000
7.57
98.45
98.19
94.28
Ablation on the number of candidate outliers sampled from the Gaussian kernel (per bound- ary ID sample). As shown in Table 12, analyze the effect of p the number of syn- thesized candidate outliers using Equation 5 around each ID boundary sample. We vary E {600, 800, 1000, 1200, 1400). reasonably large p helps provide meaningful of candidate outliers to be selected.
Table 12: Ablation on the number of candidate outliers drawn from the Gaussian kernel.
FPR95
AUROC
AUPR
ID ACC
600
19.26
96.25
94.66
94.20
800
10.75
97.96
97.44
94.24
1000
5.76
98.74
98.73
94.76
1200
8.72
98.28
97.90
94.34
1400
10.59
98.12
97.61
94.38
Ablation on the temperature for ID embedding optimization. In Table 13, we ablate the effect of temperature J used for the ID embedding optimization loss (cf. Equation 8).
Table 13: Ablation study the temperature
t
FPR95
AUROC
AUPR
ID ACC
5 13.83
97.33
96.65
94.80
6 10.32
98.12
97.32
94.64
7 6.26
98.61
98.40
94.58
8
5.76
98.74
98.73
94.76
9
9.99
98.09
97.59
93.58
8.92
98.96
97.96
93.30
Ablation the starting epoch of adding Rg))n(g). In Table 14, we ablate on the effect of the starting epoch of adding Ropen(S (g) in training. The table shows that adding Ropen(g) at the beginning of the training yields slightly worse OOD detection performance. The reason might be that the representations are still not well-formed at the early stage of training. Instead, adding regularization in the middle of training yields more desirable performance.
Table 14: Ablation study on the starting epoch of adding Ropen(g)-
epoch
FPR95
AUROC
ACC
0
9.36
98.03
94.06
5.79
98.61
94.21
10
5.76
98,74
94.76
15
16.21
97.34
94.39
20
32.68
94.62
94.16
Ablation on the density estimation implementation. NPOS adopts class-conditional approach for outlier synthesis. For instance, it identifies the boundary ID samples by calculating the k-NN distance between sample pairs holding the same class label. After synthesizing the outliers in the feature space, it rejects synthesized outliers that have lower k-NN distance, which is also imple- mented in a class-conditional way. In this ablation, we contrast with an alternative class-agnostic implementation, i.e., calculate the k-NN distance between samples across all classes in the train- ing set. Under the same training and inference setting, the class- aaanstig NPOS gives a similar OOD detection performance compared to the cansiconnitional NPOS (Table 15).
19

---

Published as a conference paper at ICLR 2023
Table 15: Ablation different implementations of the non-parametric density estimation.
OOD Datasets
Methods
iNaturalist
SUN
Places
Textures
Average
ID ACC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
Class-conditional
0,70
99.14
9.22
98.48
5.12
98.86
8.01
98.47
5.76
98.74
94.76
clans-agnostic
G ADDITIONAL RESULTS ON THE MEAN AND STANDARD DEVIATIONS
We repeat the training of our method on ImageNet- 100 with pre-trained ViT-B/16 for different times. We report the mean and standard deviations for both NPOS (ours) and the most relevant baseline VOS in Table 16. NPOS is relatively stable, and outperforms VOS by a significant margin.
Table 16: Results on the mean and standard deviations after runs.
Method
FPR95
AUROC
ID ACC
VOS NPOS
18.26::1.1 7.43-00.8
95.76+00.7 98.34+0.6
94.51 94.38+102
H SOFTWARE AND HARDWARE
We use Python 3.8.5 and PyTorch 1.11.0, and NVIDIA GeForce RTX 2080Ti GPUs.
20


Reviews:
[{"review_id": "x8c4tP_V52", "reviewer": "Reviewer_8Tpk", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "When deploying ML models in the field, it is important to be able to detect when incoming data is an outlier. This can be quite difficult. This paper proposes an approach which learns to generate out-of-distribution data, and uses it to train a classifier. This classifier can then be used in deployment with the original ML model, to reject data that is too different from the training distribution of the trained model.\n\nPrevious work proposes synthesizing virtual outliers from the low-likelihood regions of the feature space, which is more tractable than synthesizing outliers in the input space, but it modeled the distribution of the feature space as class-conditional Gaussians. The authors instead propose to perform non-parametric outlier synthesis.", "summary_of_the_review": "The work is a small increment to existing work.", "strength_and_weaknesses": "- The paper addresses a problem that is important and impactful.\n\n- I am not convinced that the move from Gaussian priors on the feature space to non-parametric forms is an improvement. Existing techniques for generative models train the encoder such that the embeddings have a Gaussian distribution. A valid objection is that this Gaussian distribution can only be expected to hold over the training data. However, nonparametric models require selection of kernel functions, which generally require domain-specific knowledge of the phenomenon in question. If domain-specific knowledge can inform the kernel of the OOD distribution, why can it not inform the selection of the ID in the first place?\n\n- A natural drawback of detecting outliers at the feature level is that a given input-to-feature mapping may do an inadequate job of describing an input that is OOD. In other words, if the OOD sample is also OOD for the the feature space, I am not sure that this approach could help much.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "vkR2BgZ4iKe", "reviewer": "Reviewer_M7jy", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a novel methodology to perform non-parametric outlier synthesis. It suggests using KNN to identify boundary points, and then generating outlier samples by sampling from a gaussian distribution centered in such samples and discarding the synthetic samples that very likely are closer to the in-distribution data. They suggest regularising the in-distribution training performance by adding a loss term for outliers. They perform some experiments and ablations.", "summary_of_the_review": "The paper is overall interesting, but needs to significantly improve the experimental evaluations. If the authors can significantly improve the experiments I'm happy to improve the score. \n\n------------\nPost rebuttal update: The authors have satisfactorily addressed most of my concerns. I therefore update my score to 6, inviting the authors to integrate the new experiments and comments in the new draft.", "strength_and_weaknesses": "Strengths:\n- Although not extremely novel (which is not a big problem for me), the method is simple and easy to implement. The authors provide a clear algorithm box in appendix. \n- The method is heuristic but principled, and illustrated with a simple and immediate diagram\n- The writing is mostly clear, although the structure of the paper could be improved\n- The ablations are interesting and poke interesting aspects\n\nWeaknesses:\n- Q1: Many times the performance improvements over the baselines seem marginal when measured with some metrics. Could the authors report means and standard deviations for 5-seed experiments for all the proposed methods?\n- Q2: (Very important) The story of the paper is about out-of-distribution detection. However, the experiments in which the network is trained from scratch on the in-distribution data are marginal and not extensive enough (see Q3, Q4, Q5). Using a pre-trained model that has been trained on web-scale data is not particularly meaningful for the plain out-of-distribution (or open set) detection (although recent literature does it, neglecting the definition itself of the problem) since the network already knows how to extract representations about the out-of-distribution data, that make the task of distinguishing in-distribution from out-of-distribution much easier and also ill-posed. It's important for the literature to stop pretending pre-training has no impact just because this allows to report inflated numbers. For the way you frame your paper, I would not suggest putting so much emphasis on large pre-trained models and not on trained-from-scratch ones. If you want to focus on pre-trained models fine-tuning then you should probably change the framing of the paper.\n- Q3: The training setup for experiments training from scratch is also pretty bizarre (why training a ResNet34 for 600 epochs? it seems like it's overtraining) Could you please justify why?\n- Q4: The used baselines are not among the best performing. Could you please compare also with KFAC-LLLA [1], SNGP [2], Deep ensembles [3],, Generalized-ODIN [4] and BatchEnsemble [5]?\n- Q5: To assess the goodness of your method, could you please at least show results of training from scratch on CIFAR-10 and ImageNet on a ResNet and some other architecture of your choice? \n- Q6: The proposed method is applied only for part of the training. I can imagine this is to prevent the second term of the loss from compressing the in-distribution features at the early stages of training when the representations are still not well-formed. Could the authors further discuss this point and provide experiments about it? Especially because the way your method affect representations yields to Q7.\n- Q7: Given the behaviour of the model, I would expect the proposed procedure might potentially have adverse effects on the calibration of a model and on its data-shift robustness . Could you perform experiments measuring these quantities on distribution-shift (for ImageNet, there's plenty of datasets: ImageNet-A/R/v2/Sketches/C etc. etc., for CIFAR-100 there's only CIFAR-100-C, but for CIFAR-10 there's also CIFAR-10.1 and CIFAR-10.2) and in-distribution data? For calibration, you may use the Mean Calibration Error. No need of re-training, just test on these datasets. I don't care if the results are bad, but if something bad happens it should be reported as a limitation. \n\n\nMargin Improvements: \n- Adding up arrows/down arrows to metrics of the tables\n- I hope in Table 4 you reported the accuracies and not the error. \n\n[1] https://arxiv.org/abs/2002.10118\n[2] https://arxiv.org/abs/2006.10108\n[3] https://arxiv.org/abs/1612.01474\n[4] https://arxiv.org/abs/2002.11297\n[5] https://arxiv.org/abs/2002.06715", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "D4zt70_yW14", "reviewer": "Reviewer_fjV3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper provides a non-parametric method for OOD generalization. They consider a particular form of OOD, where the objective is to abstain from classification on points that are considered OOD. They define the ground truth of such points according to a level set, $\\mathcal{L}$, which comprises of all points with probability density (in the training distribution) at most $\\beta$. \n\nThey propose a loss function that is a linear combination of the classification risk over in-distribution samples with the error rate of the OOD detector that is implicit within the classifier. At a high level, their training algorithm works as follows:\n\n1. Use nearest neighbors to estimate the probability density of points in the training sample.\n2. Use the parameter $\\beta$ to create estimates on which points are outliers.\n3.  Use Gaussian noise centered at randomly chosen outliers to create synthetic outliers.\n4. apply rejection sampling to make the synthetic outliers conform to the desired distribution.\n5. Finally, apply nearest neighbors for both classification and outlier detection.\n\nHere, nearest neighbors is always applied in the feature space which is learned. They then validate their algorithm over extensive experiments on multiple datasets. ", "summary_of_the_review": " I think that this work should be accepted. I am quite interested in theoretical problems that this paper naturally introduces, and I find their algorithm quite aesthetically pleasing (beyond being effective). ", "strength_and_weaknesses": "This paper has an interesting and intuitive algorithm, and carefully validates this algorithm over a wide variety of datasets. Although their algorithm lacks theoretical guarantees, I believe it is still a very interesting and important contribution -- subsequent work could very well lead to more theoretical insights about this problem. \n\nIn addition to addressing a relevant problem, I think this paper proposes an interesting high level approach to applying non-parametric algorithms for OOD generalization, namely outlier synthesis. A key property of classical non-parametric theory is that it generalizes well within the support of a probability distribution (in the large sample limit). To have any hope of giving results on OOD samples, non-parametric methods need training data that is also ``OOD\", and this paper gives a natural way of generating such data. \n\n ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster