A framework for benchmarking Class-out-of-distribution detection and its application to ImageNet
Authors: Ido Galil
Mohammed Dabbah
Ran El-Yaniv
Venue: ICLR 2023 notable top 25% (2023)
Keywords: benchmarking
out of distribution
class out of distribution
OOD
OOD detection

Abstract: When deployed for risk-sensitive tasks, deep neural networks must be able to detect instances with labels from outside the distribution for which they were trained.
In this paper we present a novel framework to benchmark the ability of image classifiers to detect class-out-of-distribution instances
(i.e., instances whose true labels do not appear in the training distribution) at various levels of detection difficulty.
We apply this technique to ImageNet, and benchmark 525 pretrained, publicly available, ImageNet-1k classifiers. 
The code for generating a benchmark for any ImageNet-1k classifier, along with the benchmarks prepared for the above-mentioned 525 models is available at https://github.com/mdabbah/COOD_benchmarking.

The usefulness of the proposed framework and its advantage over alternative existing benchmarks is demonstrated by analyzing the results obtained for these models, which reveals numerous novel observations including:
(1) knowledge distillation consistently improves class-out-of-distribution (C-OOD) detection performance; (2) a subset of ViTs performs better C-OOD detection than any other model; (3) the language–-vision CLIP model achieves good zero-shot detection performance, with its best instance outperforming 96% of all other models evaluated; (4) accuracy and in-distribution ranking are positively correlated to C-OOD detection; and 
(5) we compare various confidence functions for C-OOD detection.
Our companion paper, also published in ICLR 2023 (What Can We Learn From The Selective Prediction And Uncertainty Estimation Performance Of 523 Imagenet Classifiers), examines the uncertainty estimation performance (ranking, calibration, and selective prediction performance) of these classifiers in an in-distribution setting.

Published as a conference paper at ICLR 2023
A FRAMEWORK FOR BENCHMARKING CLASS-OUT-OF- DISTRIBUTION DETECTION AND ITS APPLICATION TO IMAGENET
Ido Galil
Mohammed Dabbah*
Ran El-Yaniv Technion, Deci.AI raniecs www.nitcchcooo.coo ac. i1
Technion
Amazon
idogalil. ggagmaiil com
m. M. dabbah gmmail com
ABSTRACT
When deployed for risk-sensitive tasks, deep neural networks must be able detect instances with labels from outside the distribution for which they were trained. In this paper we present novel framework to benchmark the ability image classifiers to detect llas--ottof-ddistibutoo instances (i.e., instances whose true labels do appear in the training distribution) at various levels of detection difficulty. We apply this technique to ImageNet, and benchmark 525 pretrained, publicly available, ImageNet- Ik classifiers. The code for generating a benchmark for any ImageNet- Ik classifier, along with the benchmarks prepared for the ahove-mentioned 525 models is available https://github. http::/ggthhh..co/mmmabbbbba com/mdabbah/ COOD DOOD.eecchmrkiing.
The usefulness of the proposed framework and its advantage over alternative exist- ing benchmarks is demonstrated by analyzing the results obtained for these models, which reveals numerous novel observations including: (1) knowledge distillation consistently improves class-out-ofs pout-ofdiistrbutiion (C-OOD) detection performance: (2) subset of ViTs performs better C-OOD detection than any other model; (3)
the language- visiin CLIP model achieves good zero-shot detection performance, with its best instance outperforming 96% of all other models evaluated; (4) accuracy and in-distribution ranking are positively correlated to C-OOD detection; and (5)
we compare various confidence functions for C-OOD detection. Our companion paper, also published in ICLR 2023 (Galil et al., 2023), examines the uncertainty estimation performance (ranking, calibration, and selective prediction performance) of these classifiers in in-distribution setting.
INTRODUCTION
Deep neural networks (DNNs) show great performance in wide variety of application domains including computer vision, natural language understanding and audio processing. These models trained on data coming from certain distribution P(X, Y). usually with the assumption that test points will be sampled from the same distribution. When the underlying distribution P(X,Y* of test points is different from the one used train model, we may longer expect the same performance from the model. The difference in distribution may be the result of many processes such natural deviation the input space X, noisy sensor readings of inputs, abrupt changes due to random events, newly arrived or refined input classes, etc. Here we distinguish between input distributional changes Pxjy and changes in the label distribution. We focus on the latter case and consider the -otts-oottoo--srribbee 2013), where the label support set y changes to a different set that includes the set VOOD, containing new classes not observed in training.
(C-OOD) scenario, AKA open-set recognition (Scheirer et al.,
Consider the detection task in which our model is required to distinguish between samples belonging to classes it has seen in training, where P(xly E ViD), and samples belonging to novel classes, iee,, x ~ Pax ly E VOOD). The question we now ask is: how should models be evaluated to most accurately reflect their detection performance? We aim to benchmark the detection performance
*The first authors have equal contribution.

---

Published as a conference paper at ICLR 2023
of DNN classification models that use their confidence rate function (e.g., softmax response; Section 2) to detect OOD labels, where the basic premise is that instances whose labels are in VOOD assigned lower K. values.
Most works on OOD detection use small-scale datasets that generally do not resemble the training distribution and, therefore, easy to detect. The use of such sets often causes C-OOD detectors to appear better than they truly are when faced with realistic, yet harder tasks. Motivated by this deficiency, Hendrycks al. (2021) introduced the ImageNet-O dataset however, has two limitations. First, it benchmarks models with a single difficulty level exclusively, having only hard C-OOD instances, which might not be relevant for every task's requirements (Section explains how to define different difficulty levels). Second, the original intent in the creation of ImageNet-O was to include only hard C-OOD instances. definition of "OOD hardness", however, was carried out with respect to ResNet-50's difficulty in detecting C-OOD classes, specifically when using softmax as its confidence function. This property makes ImageNet-O) strongly biased. Indeed, consider the right-most box in Figure 1, which corresponds the performance of 525 models over ImageNet-O. The orange dot in that box corresponds to ResNet-50, whose OOD detection performance is severely harmed by these ImageNet-O data. Nevertheless, it is evident that numerous models perform quite well, and all other models perform better than ResNet-50. The lack of an objective benchmark for C-OOD is the main motivation for our work.
solution. ImageNet-O,
Models:
VVII-L/32-384
ResNet-50
90
AlexNet
C-OOD AUROC (detection)
60
40
Dtun Veann Baaay
Medary
Rand
50
51
52
53
S5
S7
s9
s10 ImageNet-O
Severity Levels
Figure 1: OOD performance across severity (difficulty) levels, using the benchmarks produced by our increase the difficulty until it reaches near chance detection performance at the highest severity ($10). The top curve belongs to VIT-L/32-384, which surpasses all models every severity level. We also observe how success failure with regard to the previous C-OOD benchmark, ImageNet-O, does not reflect the models' true OOD detection performance since it was designed to specifically fool ResNet-50. At the bottom provide visual examples for OOD classes from ImageNet-22 lk that may populate each severity level due their similarity ID classes from ImageNet- 1k, and in this example, to Monarch butterfly.
framework. The detection performance decreases for all models
Our contributions. We propose novel technique to generate a C-OOD benchmark that covers variety of difficulty levels. Unlike other existing benchmarks (c.g.. ImageNet-O), technique is not biased towards an arbitrary model such as Resnet50 and/or a specific confidence function such as the softmax response. This useful property is obtained by tailoring the benchmark to the model being evaluated, including its confidence function, and not seeking to determine single objective criterion for hardness of C-OOD samples (see Section 3).
Second, we show and explain how we filter ImageNet-21k to use it for the purpose of generating C-OOD benchmarks for ImageNet-1k (Deng al., 2009) classifiers (see Section 4). We will provide
2

---

Published as a conference paper at ICLR 2023
simple code to choose the filtering parameters most suitable for the specific aim for which the benchmark is meant (e.g., what is classes are considered OOD).
Third, we demonstrate the power and usability of our method by applying our C-OOD framework to generate benchmarks for 525 ImageNet- Ik classifiers available from popular repositories. We provide benchmark for each of these classifiers, which will be available for use from our code.
We then analyze the results of these benchmarks to make numerous novel observations concerning C-OOD detection such as: (1) training regimes using knowledge distillation (Hinton et al., 2015) consistently yield models with better C-OOD detection performance than the same models trained identically, but without distillation; (2) a subset of ViTs performs better C-OOD detection than any other model; (3) the language- vision model CLIP achieves good zero-shot detection performance for low difficulty (severity) levels: (4) accuracy and in-distribution
(ID) ranking are positively correlated with C-OOD detection; (5) we compare the performance of various confidence functions for C-OOD detection; (6) A number of other observations (see Section 5).
Lastly, we emphasize that the resulting difficulty levels of our framework allow benchmarking with respect to the difficulty levels most relevant to the task. For example, for task with a high tolerance for risk (e.g., task for an entertainment application), the performance of a model on median difficulty level might be more important than on the hardest difficulty level (severity 10). The opposite might be true for some applications with low tolerance for risk (e.g., medical applications), for which one requires the best performance to be attained even if the OOD is very hard to detect (severity 10). Furthermore, in Section 5 we show that detection algorithms do not always improve performance on all inputs equally, and could even hurt performance for specific difficulty levels and models (see Figure 7 for a striking example). Choosing the combination of (model, detection algorithm) based only on the detection performance on all data may yield sub-optimal results for our specific desired level of difficulty.
PROBLEM SETUP
Let X be the input space and y = Vi1 U VOOD be the label space. Let P(X,)) be an unknown distribution over X' x y. A model f is a prediction function f : X + ViD. and its predicted label for an image is denoted by Úy (z:). The model f is produced by training on labeled set Tm = {(x; ):)) S (X x ViD), sampled i.i.d. from P(X,Vix) with the objective of minimizing its empirical risk, defined by f(](Tm) - 1 E (xx,,, 34), where é : ViD x ViD + R+ is a given loss function (e.g.. cross-entropy loss for classification). Note that by this definition, the model f will always misclassify any x ~ ((XYYooD)
mi
We define confidence score function <( flf). where x E X, and ÿ E Vio the model's prediction for æ. as follows. The function should quantify confidence in the prediction of for the input æ, based on signals from model f. This function should induce partial order over instances in X.
The most common and well-known k function for a classification model f (with softmax at its last layer) is its softmax response values x(x, f) & f(r) (Cordella et al., 1995; De Stefano et al., 2000)- - which also widely accepted as a baseline in the OOD literature (Hendrycks & Gimpel, 2017; Hendrycks et al., 2021; Berger et al., 2021; Shalev et al., 2018). While this is the primary we evaluate for the sake of simplicity, various other i. functions, which are also utilized for OOD detection, exist. To name few: Out-offdisttiibution detector for neural networks (ODIN) (Liang et al., 2018), Monte-Carlo dropout (MC dropout) (Gal & Ghahramani, 2016), Mahalanobis distance (Lee et al., 2018), and more. Although many of these methods use the direct output from f. could be different model unrelated to of and unable to affect its predictions.
functions can be evaluated by the quality of the partial order they induce over instances in X. For every two random samples (I1 31), (I2, v2)) ~ P(X,Y", ,)), and given that x, belongs to an OOD label and that 22 belongs to ID label, the detection (or ranking) performance of k is defined as the probability that k ranks I2 higher than Z1:
(1) The Area Under the Receiver Operating Characteristic (AUROC AUC) metric is often used to measure the performance of OOD detection. When ID samples are counted as true positives and OOD samples are counted as false positives, AUROC, in fact, equals the probability in Equation (1) (Fawcett,
Pr[K(11,1il)
< K(22, Felf) I x1
(oOD)) A2 P(X Vib)]
3

---

Published as a conference paper at ICLR 2023
2006) and thus is proper metric to measure OOD detection in classification. See Appendix A for evaluating R functions in an ID setting.
3 CONSTRUCTING A MODEL- CLASS-OUT-O--DISTRIIUIOO BENCHMARK
We first choose dataset that contains samples from large of OOD labels (e.g., labels from ImageNet-21s Ik that are not included in ImageNet- 1k). Ideally, this OOD dataset should consist of OOD labels representing labels the model may encounter when deployed. Any large dataset could be used for the purpose of henchmarking performance on C-OOD by splitting it according to labels into an ID component, i.e., the labels on which the model trains, and into an OOD component, i.e., the labels which the model is exclusively tested.
We now introduce a novel framework for generating C-OOD benchmarks with a controllable degree of severily, which could be thought of as the difficulty level of the data. Algorithm summarizes our proposed technique. Let VOOD be large set OOD classes (e.g., labels from ImageNet-21K that are
Algorithm 1 Generating C-OOD benchmarks
1: function GENERATE_BENE BENCHIAMKK(,,,,, K, YOOD, group_size = (in|))
2: for E Voon do
Split all samples of class y into two sets: ca.t and Geep 4: Set the severity score of class ÿ to be: s(ylf, Touel Exeeg k(xlf).
3:
5:
Insert the class and its score (ū. siūlf k)) into classes array
6:
Sort classes_arves _array in ascending order by each OOD class' score s()lfx
7:
for i < |DoDD! - group_size do classes-arrayli
& Sliding window of size group_size
8:
grp-array(i]
group_size
9:
for < 11 do
D Select groups in different percentiles to serve as benchmarks
10: SCU beebbhhhhkkkkll
{ar cyest s.t. ÿ grp_arrayli] and j = 1 [grp_arrayl)
11: return sev benchmark
not included in ImageNet-1k), and let (,) be severity score, defined as the average confidence given by к to samples from class ÿ E VOOD- This score reflects the level of difficulty faced by the model ff and its function when detecting instances from class ÿ. When considering IDD instances expect x to give high values for highly confident predictions. Therefore, the larger sØllf, k) is, the harder it is for
detect the OOD class among ID classes. We estimate ( k) for each class in the OOD dataset (e.g., ImageNet-21 using a set of samples from the class (denoted by c while keeping a disjoint set of samples from the same class to be used for testing (denoted by Clest) Using we sub-sample groups of classes (severity levels) from VOOD. with increasing severity such that severity level [0, 10] is the ith percentile of all severity levels.
To achieve this, we first estimate the severity score for each class ÿ in our OOD dataset for our model and its confidence function (f, x), as follows:
s
k(*lf).
Icest
We group the OOD classes into different groups, and choose the size of each group G to be the same as Dibl, the number of labels in the ID dataset (e.g.. in ImageNet we choose it to be 1000 classes). The number of possible groups of labels from VOOD could be huge (in ImageNet, for example, the number of possible groups of size 1000 from the 20, 000 OOD classes is about (20,000)
2.5 10222 so instead of going over every possible group of classes, we sort the classes by their severity scores and then sliding window of size Did to define |oool - Didl
groups of classes with increasing severity (see Figure 2). This method for reducing the number of considered groups of classes was chosen because it groups OOD classes with similar severity scores together.
Next, we choose the groups that correspond to the percentiles {10 =) in the array of sorted groups. Finally, construct the C-OOD benchmark for each severity level i from the of test.
4

---

Published as a conference paper at ICLR 2023
Sliding window of size Mio
yo
1
V2
3
y 4
ys
y
y Dooo
Disall1
Figure 2:
We define [Yoool - Viol + classes M/ E VoOD by their severity scores sßilS, k)), and then use sliding window of size [Mi to choose the considered groups.
groups of classes with increasing severity by sorting all OOD
samples clest of all classes in group i. This procedure for choosing groups allows us to interpret the severity levels using percentiles. For example. severity level 5 contains classes that match the median severity among the considered groups. Thus, the performance evaluated on the benchmark for severity 5 corresponds to the performance of the model on samples with a median detection difficulty.
The resulting benchmark is tailored to the evaluated model, since the latter was used to generate it and, therefore, can be used to measure its specific performance. In Appendix we further argue why our framework can be used to compare C-OOD detection performance of different models.
4 CONSTRUCTING BENCHMARKS FOR IMAGENET CLASSIFIERS
To use ImageNet-2Ik as an OOD dataset, we first filter out undesired labels. Since ImageNet-21K contains the ID dataset (ImageNet-IK)) the first step is to remove the ID classes from the OOD dataset. Next, we remove all classes that are hypernyms or hyponyms of classes in ImageNet- IK because it might be inaccurate include them as OOD class. For example, ImageNet- IK contains the class "brown bear" and ImageNet-22 IK has the class "bear", which is a hypernym for "brown bear" so it would not accurate to include "bear" in a C-OOD detection test. We furthermore filter OOD classes that, together with an II) class, either comprise the same object are a component of the other one. This is due to most images in the dataset containing both components as parts of the whole object (e.g.. "pool ball" from ImageNet-Ik, 1k and "pool table" from ImageNet-21k). We also filter out classes that are practically identical, even though they possess WordNet id numbers that are different (e.g., "hen" is found twice two distinct classes, with id n015 10851 in ImageNet- Ik and id n01 7926400 in ImageNet-2Ik). Since each class in the ImageNet-IK k validation set has 50 samples, we set the number of testing samples for each C-OOD class be 50 well 1c% 50. In addition, We set the estimation set for each class be 150 lo2 150. Overall, this means that each OOD class must have at least 200 samples. Accordingly, we remove classes with less than 200 samples. For classes with more than 200 samples randomly select 200 samples and remove the rest.
While the above filtering choices are trivial and suitable for most tasks, two additional filtering options are dependent on the task and its definition of two objects being considered identical. The first option concerns animal classes that might appear to be very similar but have a biological difference such that an expert could distinguish between the two. A good example of this can be observed in Figure 3, depicting the ImageNet- 1k class of Monarch butterflies and the ImageNet-211 k class of Viceroy butterflies, which are both distinct species of butterflies. The similarity is so remarkable that scientists believe they have evolved to mimic one another to repel common predators (Ritland & Brower, 1991). This mimicry does not only fool predators and the untrained eye: all models studied in this paper classified more than 50% of Viceroy samples Monarch butterfly. The fact that such
Monarch
Vicerpy
Figure 3: While both butterflies appear very similar, a Viceroy can be distinguished from a Monarch by black line crossing its postmedian hindwing. The red arrow on the Viceroy image indicates this black line.
classes are biologically different led us to keep them in the test by default and serve extremely
5

---

Published as a conference paper at ICLR 2023
hard OOD classes. Our code, however, allows users disable such classes easily, since some tasks might permit such similar classes to be classified as the same.
The second option concerns inanimate objects created by humans that might appear very similar but are, by definition, distinct from one another and are used differently. An example two such classes
Ping pong
Cue ball
Figure 4: While both balls appear similar, they are distinguished by their different
is shown in Figure 4, depicting a cue ball used for billiard games and a ping pong ball. Both are strikingly similar, and we believe a person completely unfamiliar with one of the games might easily confuse the two, if all they had were the images. Our code can be configured easily to either exclude or include such classes.
After completing the filtering as described above, the remaining classes were used in the process described Section as the OOD classes VoOD, with ImageNet's validation set being the of ID classes Vin. Our code allows the generation of C-OOD benchmarks for any ImageNet classification model and its x confidence scoring function. Moreover, we ran the process ourselves for 525 models pretrained on ImageNet, taken from the torchvision (0. 10) and "timm" (0.4.12) repositories (Paszke et al., 2019; Wightman, 2019), with softmax as к. For these models, the benchmarks are ready to be used by the community without further preparations being necessary.
5 PERFORMANCE ANALYSIS
Having generated C-OOD benchmarks using the above technique for 525 different models. in this section we analyze the results. We first focus on results obtained when setting the confidence function to be the softmax response, as it is widely accepted as a baseline in the OOD literature (Hendrycks Gimpel, 2017; Berger et al., 2021). We then evaluate additional x functions such as ODIN, entropy and MC dropout. Our analysis leads to several interesting insights.
Training regimes
VVanllla Koowledge Disiillation
-Vanilla Advenarial Training
AUROCImp improveemee
ImageNetZkk Pretroining
13
155
Severity Levels
Figure 5: The mean relative improvement when using different training regimes (distillation, pretrain- ing etc.). The shaded green area indicates the area of positive improvement.
1) Knowledge distillation improves C-OOD detection. We measured C-OOD detection improve- ment (measured in AUROC) when using different training regimes to explore whether certain method consistently contributes to detection performance. Results are depicted in Figure 5. To make a fair comparison, we only compare pairs of models such that both models have identical architecture and training regimes, with the exception of the method itself being evaluated (e.g., training with or without knowledge distillation). Of all training regimes (knowledge distillation, adversarial training (Goodfellow et al., 2015), pretraining on ImageNet-21k,, see below), knowledge distillation had the most significant impact most severity levels > 3. In Galil et al. (2023) we also find that among these training regimes, knowledge distillation is the best booster of uncertainty estimation performance in an in-distribution setting. Next, we find that ImageNet21k pretraining also improves performance, and is more beneficial to performance than knowledge distillation in low levels of

---

Published as a conference paper at ICLR 2023
severity S 3. Note that this observation could not have been achieved with simplified benchmarks (e.g., ImageNet-O). Our new framework allows for such observations thanks to the division of the benchmarks into different levels of severity. Finally, it is not surprising that adversarial training is irrelevant to C-OOD detection.
2) A subset of ViTs achieves the best C-OOD detection performance, both in absolute terms and per-model size (# parameters, see Figure in Appendix C). Several training regimes (including the original regime from the paper introducing ViT) result in ViTs that outperform all other architectures and training regimes in terms of C-OOD detection, e.g.. Dosovitskiy et al. (2021); Steiner et al. (2022); Chen et al. (2022); Ridnik al. (2021). Further research into other training regimes, however, reveals that not all training regimes result in superb performance (Touvron et al., 2021; 2022; Singh et al., 2022; Paszke et al., 2019), even when similar amount of data introduced into the training. We also find that the same successful subset of ViT's outperforms any other model in terms of uncertainty estimation performance in an in-distribution setting Galil et al. (2023). These observations warrant additional research with the hope of either training more robust ViTs transferring the unidentified ingredient of the successful subset of ViTs into other models.
3) The language-vision CLIP model achieves good zero-shot C-OOD detection performance for low severity levels. CLIP (Radford et al., 2021) enables zero-shot classification and produces an impressive performance. We find it is also good at C-OOD detection (especially in severity levels lower than 6), without needing any training or fine-tuning with regard to the dataset. This observation significant because it means CLIP could be used as zero-shot C-OOD detection algorithm without the need to train on the ID classes. This also allows the user to change the definition of which classes considered ID in a flexible manner without the need to retrain the detector. To the best of our knowledge, we are the first to make the observation that CLIP can serve as a capable zero-shot detector on its own, without further training, additional components, or knowledge of the possible OOD classes in advance. For more details, see Appendix D.
Midels
Speaman commestion 0.65
coc00 AUROC (denactioo)
Rilk thin
0134 a0)
MLLP Stoeer Sto8.
R.T (tan
70
Accuracy
Figure 6: Architecture accuracy vs. mean C-OOD AUROC performance. In the legend, the pair of numbers next to each architecture name corresponds to the Spearman correlation and the number of networks tested from that architecture family (most samples are too small to draw any specific conclusions). Accuracy appears to have high correlation with the C-OOD detection performance, with Spearman correlation of 0.65.
4) Accuracy is the factor most correlated with C-OOD detection. We observe that accuracy is typically good indicator of the model's 's performance in C-OOD detection at most severity levels [sp sg]. with Spearman correlation values in the range of [0.6, 0.73) at those levels (see Figure 12 in Appendix E). The scatter plot in Figure 6 shows the relationship between the architecture accuracy and its C-OOD detection performance. When grouping the networks by architecture, we notice that most architectures also follow this trend. When measuring the correlation between AUROC and accuracy among only the 20% most accurate models, however, the Spearman correlation drops to a range of [0.34, 0.43] (see Figure 13 in Appendix E).
5) In-distribution ranking performance is positively correlated with C-OOD detection. The next best indicative factor correlated with C-OOD detection performance after accuracy is the model's in-distribution ranking performance ("ID AUROC", see Appendix A), with Spearman correlation values in the range of [0.4, 0.5). When measuring the correlation between AUROC and ID AUROC
7

---

Published as a conference paper at ICLR 2023
among only the 20% most accurate models, however, the Spearman correlation increases to range of [0.54, 0.77]; see Appendix E for more details.
6) Most OOD classes appear in every severity level E [0, 10] for at least one model, with the exception of some classes that appear to reach severity level 10 for most or even all models (e.g.. Viceroy Butterfly, depicted in Figure in Section 4). This observation suggests that "OOD hardness" is usually subjective, and changes greatly across different models.
7) The ranking of the best C-OOD detection models tends to remain similar across severity levels. This means that when selecting the best model for deployment, it is usually enough to observe its performance on only few severity levels; Appendix F. Note that this conclusion is only true when leaving the g confidnece function fixed (see below).
8) ODIN offers significant improvements over softmax for most models. In addition evaluating with softmax as the к confidence function, we evaluate a few additional methods to serve as functions: ODIN, entropy, MC dropout and "max-logit" (not applying softmax). For each model and K we re-ran the algorithm described in Section 3 to benchmark (f, k) (we do this because using the same C-OOD groups produced when using softmax might give an unfair advantage to other functions); see Appendix G for more technical details.
Model:: VIT-1/12 394
AllaNic
155
Scwollyy
Figure 7: Relative improvement gain in C-OOD detection performance when using ODIN instead of softmax. Each point represents an evaluated model. The green shaded area indicates the area of positive improvement.
Figure shows each model's improvement when using ODIN rather than softmax, from which is visible that the improvement has a high variance: some models benefit significantly from using ODIN, while it is detrimental to other models. Furthermore, whether or not model benefits from ODIN changes across different levels of severity. For example, applying ODIN instead of softmax to ViT-L/32-384 barely improves detection when at severity level (AUROC improves by 0.4%), but significantly improves its detection as the severity level increases (for severity level 10, AUROC improves by 9%). Other models' detection performance, on the other hand, may decrease as severity increases (see Figure 7 for examples). These facts suggest that the pair of (model, λ) needs to be considered with respect to the task and severity level relevant to it. Moreover, it may be that the k function hyperparameters need be optimized specifically for the desired severity level.
9) Not applying softmax can improve some models significantly, although most are harmed by it. Figure 16 in Appendix G depicts the effect of not applying softmax, which we dub "max- logit". While most models are harmed by using max-logit instead of softmax, some models are sigmificantly benefited. ViTs, which already outperform all other models, perform significantly better when softmax is not applied, with ViT-L/32-384 improving by 10.6%. It is worth mentioning that of all the (model,x) pairs evaluated in this paper, VIT-L/32-384- applied with max-logit achieve the best detection performance. Interestingly, regardless of the x function evaluated, VIT-L/32-384 demonstrated the best detection performance. Figure 8, we plot its performance across all severity levels using each of the x functions we consider. Also, as noted in Appendix G. the hyperparameters used for ODIN when applied to ViT were not optimized specifically to it. Performance by using ODIN may improve beyond max-logit with model-specine optimization. Observing that max-logit could be so beneficial for a subset of models while being harmful to most other models was made possible thanks to the scale of our study.
8

---

Published as a conference paper at ICLR 2023
0:000 AUROC (Benedor)
0.9
0.85
08
Confilence Function:
Softmax VIT (9T1/322 1/32-384
Mas-lugit 1/32-354
Eatropy
Monte Carlo dropout VIT 1/32 384
ODIN VTT L/32 384
0.7
30
51
12
58
54
55
50
57
530
Severity Levels
Figure 8: OOD detection performance of ViT-L/32-384, the best model evaluated using each of the functions we consider.
10) Using entropy as a confidence function k improves C-OOD detection performance in most cases. We compare the performance gain from switching to using entropy instead of the softmax score. The results are depicted in Figure 17 in Appendix G. We note that, in most cases, using entropy improves the detection performance."
11) MC dropout improves detection, especially for low levels of severity. We evaluate MC dropout Gal & Ghahramani (2016) in the context of C-OOD detection. We use 30 dropout-enabled forward passes. The mean softmax score these passes is calculated and then a predictive entropy score is used as the final uncertainty estimate. The improvements when using MC dropout instead of softmax across all severity levels are depicted in Figure 18 in Appendix G using box plots. We find that MC dropout improves performance, especially at lower levels of severity. The improvement becomes less significant as severity increases. Similar to ODIN, MC dropout seems to improve some models more significantly lower severity levels (e.g., MobileNets (Howard et al., 2019)), while other models are improved more significantly by MC dropout at higher severity levels (e.g.. ViTs). We further analyze MC dropout and recall that it comprises two main components: (a) dropout-enabled forward passes and (b) entropy of the mean probability vector from the forward passes. To test which component contributes the most to the perceived gains, we compare the C-OOD detection performance when using MC dropout to the C-OOD detection performance when using just entropy (with no multiple dropout-enabled forward passes). The results of this comparison are plotted in Figure 19 in Appendix G. We find that MC dropout slightly improves upon entropy at most severity levels, especially at lower ones, with few outliers being either significantly improved or harmed.
CONCLUDING REMARKS
We introduced a novel approach to benchmarking the performance of classifiers in detecting C-OODs. In contrast to existing techniques, the proposed method allows for unbiased measurements against specific models or confidence functions. A key feature of the proposed benchmarking procedure is that it allows for graded measurements of class out-of-distribution levels of severity. Using this property, we can identify trends in detection robustness that are otherwise impossible to detect. In addition to opening new avenues for future research, the proposed method can be used to draw more precise conclusions about the performance various models and detection techniques.
Using new benchmarking procedure, we offered numerous interesting observations that merit further investigation into how to improve C-OOD detection. Among the interesting questions raised is enhance
why is knowledge distillation beneficial to boosting detection performance, and how its robustness to C-OODs? What can we learn from the architectures that were inclined to perform well in C-OOD detection, such as ViT and CLIP? Finally, could detection methods be crafted and optimized for specific severity levels, or can they be modified to be so by changing a hyperparameter?
Entropy is maximal when the distribution given by the model for P(ylæ) is uniform, which implies high uncertainty. To convert entropy into a confidence signal, which should increase as the uncertainty decreases, we negative entropy.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGMENTS
This research was partially supported by the Israel Science Foundation, grant No. 710/18.
REFERENCES
Christoph Berger, Magdalini Paschali, Ben Glocker, and Konstantinos Kamnitsas. Confidence-based diito--iittriuttion detection: A comparative study and analysis. In Carole H. Sudre, Roxane Licandro. Christian F. Baumgartner, Andrew Melbourne, Adrian V. Dalca, Jana Hutter, Ryutaro Tanno, Esra Abaci Turk, Koen Van Leemput, Jordina Torrents- and Christopher K. Macgowan (eds.), Uncertainty for Safe Utilization of Machine Learning in Medical Imaging, and Perinatal Imaging, Placental and Preterm Image Analysis 3rd International Workshop, UNSURE 2021, and 6th International Workshop, PIPPI 2021 Held in Conjunction with MICCAI 2021, Strasbourg, France, October 1, 2021, Proceedings, volume 12959 of Lecture Notes in Computer Science, pp. 122-133 Springer, 2021. doi: 10. 00000//97883-000-8773------ https://doi.or//10. wtt../////111110997788181088111 030-87735------ 122
William M. Wells III,
URL
Xiangning Chen, Cho-Jui Hsieh, and Boqing Gong. When vision transformers outperform resnets without pre-training strong data augmentations. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022. URL http:://pppneeeeee...eeeeellillt
Xiangxiang Chu, Zhi Tian, Yuqing Wang, Bo Zhang, Haibing Ren, Xiaolin Wei, Huaxia Xia, and Chunhua Shen. Twins: Revisiting the design of spatial attention in vision transformers, 2021.
L. P. Cordella, C. De Stefano, F. Tortorella, and M. Vento. A method for improving classification reliability of multilayer perceptrons. IEEE Transactions on Neural Networks, 140-1740-1 1995. doi: 10. 10.1109000 10.11992..41038..
C. De Stefano, C. Sansone, and M. Vento. To reject or not to reject: that is the question-an answer in case of neural classifiers. IEEK Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), 30(1):84-94, 2000. doi: 10. 02.110955326.274555
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li. Kai Li, and Li Fei-Fei. Imagenet: large-scale hier- archical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248-255, 2009.
doi: 10. 2wWp://CPR.200955000000
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.nec, 2021. URL https///opemrriew.eee/fouuu Pid= fid==icbFadNTy..
Sepideh Esmaeilpour, Bing Liu, Eric Robertson, and Lei Shu. Zero-shot out-of -id--ri-ittiiutiinn detection based the pre-trrined model CLIP. In Thirty-Sre Sixth AAAI Conference Artificial Intelligence,
AAAI 2022, Thirty-Fourth Conference on Innovative Applications of Artificial Intelligence, IAAI 2022, The Twelveth Symposium Educational Advances in Artificial Intelligence, EAAI 2022 Virtual Event, February 22 March 1, 2022, pp. 6568-6576. AAAI Press, 2022.
URL https:
boossaaai.org/index.ppoo Shhpp/AAA//attice/ve/////////
Tom Fawcett. An introduction to roc analysis. Pattern Recognition Letters, 27(8):61-874, 2006. ISSN 0167-8655. doi: https://doi.orr/00.0000006 wttp::/............a..e www.pa.............. 10.010. URL http:://www.
ROC Analysis in Pattern Recognition.
Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of oitoof-distribution detection. In Mare' Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan (eds.), Advances in Neural Information Processing Systems 34: An- nual Conference Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pp. 7068-7081, 2021. URL 3941 haaraaattotttttttssaaaaaattttaa
1/hash/
10

---

Published as a conference paper at ICLR 2023
Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. 2016.
Ido Galil, Mohammed Dabbah, and Ran El-yaniy, What can we learn from the selective prediction and uncertainty estimation performance of 523 imagenet classifiers? In International Conference on Learning Representations, 2023. URL
Shang-Hua Gao, Ming-Ming Cheng, Kai Zhao, Xin-Yu Yu Zhang, Hsuan Yang, and Philip Torr. Res2net: A new sulti-scale backbone architecture. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(2):652 662, Feb 2021. ISSN 1939-3539. doi: 10. 109/ppami.2019 2938758. URL http::/dx..oiiorr/10..1111 109.T.AA....111.111.1 29397797
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.). 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL http://arsiv..rr/abs///// 1.2..5522.
Dan Hendrycks and Kevin Gimpel. baseline for detecting misclassified and out-of- examples in neural networks. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017. URL https://openrevie..ne/////o http://opparreieeeee//oommaaoaae Http:///wweeee///oommmd-----aaa
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adver- sarial examples. In IEEE Conference Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, pp. 15262-15271. Computer Vision Foundation IEEE, 2021. URL https///ppnaacces... www.sstteeee.oeeeeeee httpa///omncen/////2/////ammmmma Examples CVPR 2021 paper.html.
Natural Adversarial
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in neural network, 2015.
Andrew Howard, Ruoming Pang, Hartwig Adam, Quoc V. Le, Mark Sandler, Bo Chen, Weijun Wang. Liang-Chieh Chen, Mingxing Tan, Grace Chu, Vijay Vasudevan, and Yukun Zhu Searching for mobilenetv3. In 2019 IEEE/CVF International Conference Computer Vision, ICCV 2019, Seoul, Korea (South), October 27 November 2, 2019, pp. 1324-1324. IEEE, 2019. doi: 10. 10.1109/I 2019.00140. URL httttss://doi.orgg//// httpp:///aoo.og///..1///////CC// 1110011100000CC.220000000044
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distributie samples and adversarial attacks. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pp. 7167-7177, 2018. URL https: httppppp....ppppoo//////aaaaaaaa
Abstractt.t
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In International Conference on Learning Representations, 2018.
URL https///pparreeeee.e///ouniiiiaa VGKIRRZ.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performance deep learning library. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d' d'Alché-Buc, E. Fox, and R. Garnett (eds.), Advances Neural Information Processing Sys- tems 32, pp. 8024-8035, Curran Associates, Inc., 2019. URL htwpri/eweeyeeiiiigeeerrnrneeeee wew.neeeeeee-----n------ee- library.pdf.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 8748 8763. PMLR, 2021. URL http://proeeedingg..tr.eeee 39/radford22 a.hmll.

---

Published as a conference paper at ICLR 2023
Tal Ridnik, Emanuel Ben Baruch, Asaf Noy, and Lihi Zelnik. Imagenet-21k pretraining for the masses. In Joaquin Vanschoren and Kit Yeung (eds.), Proceedings of the Neural Information Processing Systems Track Datasets and Benchmarks NeurIPS Datasets and Benchmarks 2021, December 2021, virtual, 2021. URL attps::/ddatasets-beeeheee www.aaeeeeeeeeeceeaaooooeeeennno proceedings.neurip... http:/222//hhh1/1811170211111110 (a1e77766677e611106624444444
06a3b84- round1 .tmll
David Ritland and Lincoln P. Brower. The viceroy butterfly not a batesian mimic. Nature, 350 (6318):497-498, Apr 1991. ISSN 1476-4687. 1038/350497a0.
doi: 10.1038/350497a0. URL http:://oi..rr//10
Walter J. Scheirer, Anderson de Rezende Rocha, Archana Sapkota, and Terrance E. Boult. Toward open set recognition. IEEE Trans. Pattern Anal. Mach. Intell., 35(7:1157-1172,, 2013. doi: 10. P.11099AMMM..2012..555 URL https:///di.orgg// http://ccb.org/0...119/PPAAMMM 119/TPAMM..011.2555
Gabi Shalev, Yossi Adi, and Joseph Keshet. Out-of- distrrbtbbttonn detection using multiple semantic label representations. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi. and Roman Garnett (eds.), Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pp. 7386-7396, 2018. URL https:/prooceeiigs.eeue neurips.. cc/paper/201 wttpah////51lcc//l//e/ htt15////06644440000000042222220
Abstract.html.
Mannat Singh, Laura Gustafson, Aaron Adcock, Vinicius de Freitas Reis, Bugra Gedik, Raj Prateek Kosaraju, Dhruv Mahajan, Ross B. Girshick, Piotr Dollár, and Laurens van der Maaten. Revisiting weakly supervised pre-training of visual perception models. CoRR,
2022. URL
https://ariiv.or/aab//22200 108371.
Andreas Peter Steiner, Alexander Kolesnikov, Xiaohua Zhai, Ross Wightman, Jakob Uszkoreit, and Lucas Beyer. How to train your vit? data, augmentation, and regularization in vision transformers. Transactions on Machine Learning Research, 2022. URL https://openreview.nedl forum
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 10347-10357. PMLR, 2021. URL http://proeeeddngg.llrrssssss 1391ovooon111 html.
Hugo Touvron, Matthieu Cord, and Hervé Jégou. Deit III: revenge of the vit. CoRR, abs/2204.071188 2022. doi: 14855500arXx..22040771111 URL http://dbbooooll.44455/uxxx22212
Ross Wightman. Pytorch image models. http://giiibbbbmmm/wwgiaaaaaaaah
2019.
I. Zeki Yalniz, Hervé Jégou, Kan Chen, Manohar Paluri, and Dhruv Mahajan. Billion-scale semi- supervised learning for image classification. CoRR, abs/1905.00546, 2019. URL http://arxiv.org/
Hang Zhang, Chongruo Wu, Zhongyue Zhang, Yi Zhu, Haibin Lin, Zhi Zhang, Yue Sun, Tong He, Jonas Mueller, R. Manmatha, Mu Li, and Alexander Smola. Resnest: Split-attention networks, 2020.
A DEFINING IN-DISTRIBUTION AUROC
We follow Galil et al. (2023) in defining in-dsitribution AUROC ("ID AUROC"). ID AUROC is defined similarly to Equation 1, but discriminating between correct and incorrect predictions instead of discriminating between ID and OOD instances.
For every two random samples (Z1,31); (x2, w2) ~ P(X,)) and given that {(f(z) vi) > {( (122. y2), the ranking performance of is defined as the probability that ranks 22 higher than x1:
Pr[x(a1,01) Úl k(x2, ((((((((()))))))))))))) ((f(2)) v2)l
12

---

Published as a conference paper at ICLR 2023
When the 0/1 loss is in play, it is known that AUROC in fact equals the probability in Equation (2) (Faweett, 2006) and thus a proper metric to measure ranking in classification (AKA ID AUROC or discrimination).
B COMPARING MODELS' PERFORMANCE USING OUR FRAMEWORK
The proposed framework allows for fair comparison of models in terms of model-specific difficulty, rather than a fixed set of OOD classes chosen according to some (possibly arbitrary) criterion. This is because the framework evaluates each model's ' performance provides more accurate representation of the model's own performance. As the famous quote goes, "You can't judge fish by its ability to climb a tree". Rephrasing this quote to adapt it to our discussion: if we want to compare a fish with monkey on what is hardest for each of them, we should judge the fish by its ability to climb tree and the monkey's ability to swim (although we are aware that some monkeys can swim). Our framework constructs specialized tests for both.
tailored benchmarks. This approach
That being said, by considering the construction of severity levels (per model), it is possible (ne- glecting estimation error of the estimation sets cgst) to compare the performance of two models specifically for the classes populating their maximal severity (severity 10);
(I) Suppose that model A has better performance (AUROC) on its own group Z of hardest classes (severity 10) than model B's performance on its own severity classes, denoted K. Assume that K does not equal Z (otherwise are done). Thus, AUROC(A, Z) > AU).
(2) By construction of severity groups, for every set of classes R * AUROC(A, Rt) 2 AUROC(A, Z) (since Z is the set of hardest classes for model A). This holds true for any set of classes Rt including the set K. Therefore, AUROC(A, K) 2 AUROC(A, 2).
Z.
By combining (1) and (2) get that AUROC(A, AUROC(A, Z) AUROC K) AUROC(A, ))== > AUROC(B, K), meaning that for the same set classes K, model performs better than model B.
"mirror" argument could be crafted to compare the models' performance on the classes populating their minimal severity (severity 0).
C PER-SIZE PERFORMANCE COMPARISON
The scatter plot in Figure 9 shows the relationship between the # of architecture parameters and its C-OOD AUROC performance. Overall, there a moderate Spearman correlation of 0.45 between #parameters and the C-OOD performance when considering all tested networks. When grouping the networks by architecture families, however, we see that some architectures have high correlation between their model size and their C-OOD AUROC. Architecture families that exhibit this behavior are, for example, ViTs, Swins, EffecientNetV2 and ResNets whose correlations are 0.91, 0.94, 0,89, and 0.79, respectively. Other families exhibit moderate correlations, e-g., EffecientNet (V1) with 0.47 Spearman correlation. Some architectures, on the other hand, have strong negative correlation, e.g., Twins Chu et al. (2021), NesT Zhang et al. (2020) and Res2Net Gao et al. (2021), 1),, whose correlations are -0.94.11.0, and -0.85, respectively.
Additionally, we note that the subset of ViT models mentioned in Section are also the best even when considering model size limitation.
D ZERO-SHOT C-OOD DETECTION WITH CLIP
To evaluate CLIP on ImageNet, we first prepare it following the code provided by its authors httpss//gituubb.coooppaa///////e
The labels of ImageNet- Ik are encoded into normalized embedding vectors. At inference time, the incoming image is encoded into another normalized embedding vector. cosine similarity is then calculated between each label-embedding vector and the image-embedding vector. The highest similarity score is then taken as the confidence score for that prediction.
To evaluate CLIP's C-OOD performance, we re-run the algorithm described in Section 3 to benchmark (CL.P, P, Kcosing similarity). The best-performing instance of CLIP (ResNNet-00x64) outperforms 96%
13

---

Published as a conference paper at ICLR 2023
Models
Spearman correlation 0.45
Various (0.45,
AlexNet (-
90
ResNer (0.79, 33)
EfficienNNet (0.47, 52)
C-OOD AUROC (detection)
Twins (-0.94, 6)
VIT (0.91, 21)
MLP Mixer (-0.32,
NesT (-1.00, 3)
ShuttleNetV2 (1.00, 2)
SqueezeNet (-1.00, 2)
80
Swin (0.94, 6)
Res2Net (-0.85, 9)
EfficientNNrV2 (0.89, 15)
BIT (0.64, 9)
70
13
15
16
17
18
20
21
log10 Parameters #
Figure 9: Number of architecture parameters vs. C-OOD AUROC performance at severity level (median severity). The pair of numbers next to each architecture name in the legend corresponds to its Spearman correlation and number of models tested from that architecture (family), respectively. Note that specific VIT transformers Vertical lines indicate the sizes of ResNet-50 (left vertical line) and ResNet-100 (right vertical line).
also the best when considering model size limitation.
100
C-OOD AUROC (detection)
80
70
80
50
Models:
VIT-I/32-384
ResNet-50
AlexNet
CLIP Res6et-50x64
54
S8
s9
s10
ImageNet-O
Severity Level
Figure 10: The same graph as in Figure 1, but with an additional lime-colored curve for CLIP ResNet-50x64. Note that severity levels increase, CLIP's detection advantage is greatly reduced.
of all other models (measured by its mean AUROC over all severity levels). Figure we visualize this CLIP's performance across all severity levels, in comparison to all other models. Interestingly, CLIP's relative advantage over other models decreases as the severity increases, and at severity 10, even lower than the median. The same is observed in Figure 11 which depicts comparison between three identical ResNet-50 models that were trained with three different training regimes, one of them being CLIP. CLIP outperforms its competition up severity (with significant margin in lower
14

---

Published as a conference paper at ICLR 2023
C-ODD AUROC (dstection)
10.8
0.7
0.6
Model:
RessNet-50- Torchvision
-eeeNet-50-- Semi-supervieed learning
ResNet-50
90
51
52
95
95 57 58 39
510
Severity
Figure 11: A comparison of three identical ResNet-50 models trained with different training regimes: (I) The orange-colored curve represents a ResNer-50 model trained on ImageNet- I with Torchvi- sion's recipe; (2) the purple-colored curve represents ResNet-50 model trained with semi- supervised regime (Yalniz et al., 2019); and (3) the lime-colored curve represents a ResNet-50 trained with CLIP.
severity levels), and then underperforms. We hypothesize the degradation in CLIP's performance for higher severity levels happens due to an increase in the number of OOD classes that are descriptively similar to ID classes at higher levels of severity. For example, when examining different types of butterflies from Figure 3, the string text of "monarch butterfly" is very similar to the string text of "viceroy butterfly", simply due to both sharing the word "butterfly". Other butterflies that are less visually similar might be "confused" by CLIP and classified as monarch butterflies, simply because they are also defined as butterflies, making their cosine similarity with the text "monarch butterfly" higher. Common image classifiers, the other hand, may confuse different butterflies if they appear visually similar and share many distinguishable features, but are not affected by the fact both classes defined "butterflies".
We also observe that while CLIPs with a confidence function Keosine similarity perform very well C-OOD detection, their IDD ranking worse than other models. Using softmax and'sor adding linear-probe (as described in Radford et al. (2021)) improves ID ranking significantly. but results in mediocre C-OOD detection performance. We believe that this suggests the multimodal nature of CLIP is crucial component of its C-OOD detection performance, and that the scaling effect of softmax hinders the partial order induced on OOD and ID instances.
In Fort et al. (2021), it was suggested that CLIP be used as zero-shot OOD detection algorithm. Their suggested method, however, requires knowledge of the possible OOD classes in advance. The authors of Esmaeilpour et al. (2022) suggested to use an additional captioning model, which is fine-tuned on some large dataset (which hopefully contains knowledge of the OOD classes that might emerge during inference), instead. Our suggested approach, in contrast, requires no knowledge, fine-tuning and no models other than CLIP itself.
E CORRELATIONS OF VARIOUS FACTORS WITH C-OOD DETECTION PERFORMANCE
We searched for factors that could be indicative of or correlated with good performance in C-OOD detection. To this end, we measure the correlations of various factors with the C-OOD detection AUROC performance across all levels of severity. The results can seen the graphs in Figure 12. We observe that accuracy is typically a good indicator of the model's performance in C-OOD detection at most severity levels (&g ss), with Spearman correlation values in [0.6, 0.73] at those levels (see Figure 12). When measuring the correlation between AUROC and accuracy among only
15

---

Published as a conference paper at ICLR 2023
0.7
Spearman Correlation
0.5
0.4
0.3
0.2
Accuracy
AUROC
bgg#Parammtters)
0.1
Input Size
50
82
94
96
58
510
Severity Levels
Figure 12: Spearman correlations between C-OOD detection AUROC and Accuracy, ID-AUROC, #parameters, input size, and embedding size across all severity levels.
0.8
0.7
0.6
Spearman Correlation
0.5
0.4
0.3
0.2
Accuracy
AUROC
log(#Parameters)
-0.1
Input Size
s0
54
96
58
810
Severity Levels
Figure 13: Spearman correlations between C-OOD detection AUROC and Accuracy, ID-AUROC, #parameters, input size, and embedding size across severity levels, among only the 20% % most accurate models.
the 20% most accurate models, however, the Spearman correlation drops to range of [0.34, 0.43) (see Figure 13).
The best indicative factors are the ranking performance ("ID AUROC"), number of parameters, and the input image size (moderate correlations). Finally, the embedding size is only weakly correlated.
Figure 14 shows scatter plot of in-distribution ranking performance and C-OOD detection per- formance of all evaluated models. The overall Spearman correlation is 0.43. The legend indicates correlations obtained by specific architecture families. Interestingly, ID AUROC exhibits slightly increasing correlation up to severity Sy, and at $10 becomes the most indicative factor for C-OOD detection performance. In contrast, all other investigated factors lose their indicative power at the highest severity levels (8g, $1).. Moreover, when measuring the correlation between AUROC and ID AUROC among only the 20% most accurate models, the Spearman correlation increases range
16

---

Published as a conference paper at ICLR 2023
Models (Speirman correlation per family, number of models)
Various (0.40, 388)
ShuffleNerV2 (1.00, 2) SqueezeNet (1.00.
AlexNet (-
90
ResNet (0.16, 33)
Swin (0.83, 6)
VIT (0.74, 21)
EfficientNetv2 (-0.46, 15)
C-OOD AUROC (detection)
MLP Mixer (1.00, 4)
BiT (0.32, 9)
85
80
75
70
Overall Spearman correlation 0.43
86
88
ID AUROC
Figure 14: The x-axis represents ID ranking performance (measured by AUROC), and the y-axis represents C-OOD detection performance in severity 5 (higher is better). The legend indicates correlations, by specific architecture families, with the number on the right representing sample size, and the one on the left representing the correlation between ID ranking and detection.
of [0.54, 0.77], making it the most indicative factor for C-OOD detection among such models (see Figure 13).
F CORRELATION BETWEEN RANKINGS OF MULTIPLE SEVERITY LEVELS
810
0.376
0.416
0.451
0.512
0.549
0.576
0.808
0.634
0.575
0.812
1.0
0.779
0.989
0.812
59
0.787
0.846
0.833
0.918
0.944
0.963
0.979
0.989
1.0
0.961
0.675
87
0.815
0.879
0.915
0.946
0.969
0.983
0.992
1.0
0. 0.989
0. 0.909
0.634
66
0.938
0.983
0.982
0.379
0.603
65
0.845
0.918
0.955
0.98
0.993
1.0
0.993
0.983
0.953
0.888
0.575
Spearman
0.983
0.969
0.549
s3
0.302
0.955
0.905
1.0
0.991
0.90
0.965
0.948
0.915
0.024
0.513
0.928
0.461
=1
0.965
1.0
0.985
0.955
0.931
0.918
0.9
0.879
0.845
0.789
0.415
90
0.985
0.929
0.002
0.854
0.046
0.615
0.787
0.375
50
54
65
56
57
88
:10
Figure 15: Spearman correlation between the rankings of the models given by different severity levels.
Since we use multiple benchmarks for C-OOD detection (i.e., the 11 severity levels), test the performance models in C-OOD detection, and each severity level may rank the models differently (i.e. the best performers for each severity level may vary), we now consider the question of how these rankings change across severity levels. To this end we calculated the correlations between the rankings obtained at different severity levels. The resulting correlation matrix can be seen in Figure 15. Overall, we observe high correlations, which means that different severity levels generally yield similar rankings of the models. This means that when selecting the best model for deployment, is usually enough observe its performance only few severity levels.
17

---

Published as a conference paper at ICLR 2023
We also notice that for each severity level 8,, the correlation with sj is higher the closer j is to i. This not surprising and might be anticipated because adjacent severity levels have close severity scores by design.
G COMPARISON OF DIFFERENT CONFIDENCE FUNCTIONS
This section contains additional technical details and figures related to our comparison ODIN, max-logit, entropy and MC dropout. Our main conclusions are presented in Section 5 of the main text.
Improvement using max logit instead of softmax (i.e. not applying softmax)
Improvement OOD AUROO (derection)
Severity
Figure 16: Relative improvement gain in C-OOD detection performance when using max-logit instead of softmax (i.e., not applying softmax). In median terms, using max-logit harms performance over softmax for most evaluated models. However, some models (e.g.. ViTs) greatly benefit from not applying softmax. The green shaded area indicates the area of positive improvement.
Improvement using entropy instead of softmax
Improvement t C- 00D AUROC (detection)
Severity Levels
Figure 17: Relative improvement gain in C-OOD detection performance when using entropy instead of softmax. median terms, entropy offers positive improvement over softmax for most levels of severity except E {7, 8, The green shaded area indicates the area of positive improvement.
To use MC dropout, we first use 30 dropout-enables forward passes. The mean softmax score of these passes is calculated and then predictive entropy score is used the final uncertainty estimate.
When using ODIN, we use a temperature of and set to be 10 We obtained these hyperpa- rameters by using simple grid search validation set, and using models of different
18

---

Published as a conference paper at ICLR 2023
improvement by using MC-dropout instead of softmax
Improvement 3o In C-000 AUROO (derection)
aos 24
Severity Levels
Figure 18: Relative improvement gain in C-OOD detection performance when using MC dropout instead of softmax. We find that MC dropout improves performance, especially at lower levels of severity. The improvement becomes less significant as severity increases.
Improvement by using MC-dropout instead of entropy
improvement % C-000 AUROC (seeccioo)
Severity Levels
Relative improvement gain in C-OOD detection performance when using MC dropout instead of entropy.
Figure 19:
architectures of the entire sample of models evaluated. Our objective was to find the hyperparameters that improve the mean AUROC across all severity levels the most. We believe that tinettuning the hyperparameters with the specific model and severity levels in mind may allow for better results.
19


Reviews:
[{"review_id": "i_UKbH-Uj6", "reviewer": "Reviewer_CQ4c", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a benchmark for out-of-distribution detection for ImageNet(-1K) models, using data from ImageNet-21k as out-of-distribution samples. The work presents a strategy for evaluating OOD detection, avoiding pitfalls encountered in prior work. Additionally, the authors evaluate a wide array of ImageNet models, and highlight findings on which models and confidence functions outperform others.", "summary_of_the_review": "Overall, this is a good paper, with some issues in presentation and clarity. I have raised some questions about the presentation and clarity above, and particularly about the use of severity levels in the evaluation. Assuming these are addressed, I would vote to accept the work.", "strength_and_weaknesses": "Strength:\n\n- The authors point out a key issue in prior work on evaluating OOD detection: when OOD datasets are constructed by filtering to be difficult for one model, the bias in filtering results in other models naturally outperforming the original model. \n\n- The authors evaluate a large array of models on their data, in contrast to prior work, and find interesting conclusions about OOD detection (e.g., that CLIP models outperform models trained on ImageNet)\n\nWeaknesses:\n\n- The notion of severity levels needs to be motivated further. The paper states that the proposed method of computing severity levels is better than prior work – but why do we need severity levels? A plausible alternative metric is to simply compute AUROC on the entire OOD dataset, without the severity levels. Why is this metric insufficient? What conclusions would change if you were to use this metric?\n    - If the AUROC overall metric is sufficient, the severity levels can still be used as a diagnostic. It’s unclear that one needs to look at AUROC at each level individually when comparing models.\n- While interesting, the result about CLIP’s OOD detection needs further explanation and comparison. The paper claims it outperforms “96%” of other models. But this is a strange metric: the 96% presumably includes models like AlexNet. Using this metric, the ViT-L/32-382 outperforms “99.99%” of other models. It would be more interesting to compare a CLIP model head-to-head with a model with the same architecture, trained with different training strategies, such as training on ImageNet-1k (or pretraining on IN21k then finetuning on IN1K).\n- Notation could be more clear – it’s still unclear to me exactly how AUROC is computed. \n    - In Eq (1), what is \\hat{y}? Is it the prediction of f on x1, or on x2? Is it the same when computing k(x1, \\hat{y} | f) as k(x2, \\hat{y} | f)? I assume not.\n    - In Section 3, k is changed from k(x1, \\hat{y} | f) to k(x | f). How is this defined?\n    - Is AUROC computed per OOD class, then averaged across classes within a severity level? Or are samples for all classes in a severity level merged together, and then AUROC is computed once for the severity?\n- How is ID AUROC defined?\n    - Do you compute AUROC per class, with samples from all other classes treated as negative, and then averaged?\n- Nits / questions:\n    - It would be useful to explain why ODIN, entropy and MC dropout specifically were chosen for evaluation in the work.\n    - Fig 6 – what severity level is this evaluated at?\n    - Sec 5, (1) – is this on all 525 models?\n    - Sec 5, (1) – any ideas why imagenet 21k training hurts OOD detection?\n    - Would it be possible to evaluate the effect of removing softmax at test time, and re-evaluating? Depending on how AUROC is defined (see my questions above), this may or may not change the results. This may also allow a more fair comparison between ImageNet models (which usually have a softmax) to CLIP models (which are just using cosine similarity without a softmax). Relatedly, evaluating the impact of the softmax temperature on OOD detection would be interesting. These experiments are not necessary for acceptance, but I would appreciate the authors’ thoughts on the impact of the softmax – it will also help me understand the evaluation better.\n    - If possible, it would help to share the AUROC for all models at all severity levels in a table in the supplementary, or in a webpage\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "P5V9yDpDnfd", "reviewer": "Reviewer_gv9a", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a method for benchmarking models (combined with a dataset and a confidence function $\\kappa$) for their ability to recognize out-of-distribution examples at test time. In particular, the paper considers the OOD case of when the model is presented with an example with a label that that model had not seen during training. The paper uses the methodology to evaluate 525 different models as well as some different confidence functions to produce some observations about different types of models and about the OOD task generally.", "summary_of_the_review": "Sometimes the best papers are those papers that raise more questions than they answer. This is one of those papers. While the technical contributions are not especially monumental or flashy, the observations coming from the solid empirical work in the paper are very intriguing, especially from a practicing data scientist lens. As such, I believe this paper does merit acceptance and publication.", "strength_and_weaknesses": "The paper well grounded in previous works is attacking a significant problem of interest to the community and has a very extensive empirical validation backing up its claims/observations (which are numerous). The most interesting aspect of the paper for me was the observations and claims about OOD detection, such as the performance of vision transformer models or how knowledge distillation helps with detecting OOD samples. I believe these types of observations are both important for practitioners and also as starting points for additional research.\n\nThe paper’s only real weakness is in its clarity, and, possibly its correctness. There are some points in the paper that need further explanation. Specifically\n\n-\tIn section 2, how is AUC used to measure OOD performance? It seems like there is some cut-off score for $\\kappa$ below which the paper assigns the value of OOD versus ID, and then uses these assigned values to compute AUC. If so, what is the cut-off value? Is it different for different $\\kappa$’s or models? \n\n-\tHow does one make apples-to-apples comparisons between models for the OOD performance? As is mentioned in the paper (section 5, point 6) OOD hardness is subjective and the proposed method will have different classes in different hardness ratings for different model + $\\kappa$ configurations. This would lead me to believe that one cannot really conclude that one model is better than another in OOD detection as data breakdowns between the two models are not the same. Is there a way to overcome this limitation or otherwise have a comparison between two models on their OOD performance where the only difference is the model itself? Or, is this not a problem for comparing models?\n\n-\tA minor point, but could you add the web addresses, probably as footnotes, for timm and torchvision for total clarity on the packages?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "1bW-rnTcDs", "reviewer": "Reviewer_3d28", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a benchmarking framework for class-out-of-distribution detection with various levels of detection difficulty. This work benchmarks this technique's application to ImageNet with 525 publicly available pre-trained ImageNet-1K classifiers. Based on this benchmark, the authors identify several trends in out-of-distribution detection robustness and serve as a foothold for future research.", "summary_of_the_review": "This is a benchmarking paper focusing on an important problem. The contributions of the paper will have some impact to the OOD detection community.", "strength_and_weaknesses": "Strengths:\n\nS1. This work provides a new benchmarking framework to detect class-out-of-distribution instances with different levels of difficulty. This opens new avenues for future OOD detection research.\n\nS2. The authors analyze the results of this benchmarking which lead to numerous interesting observations.\n\nS3. This paper presents a good viewpoint on designing large-scale objective benchmarks with different levels of detection difficulty for class-out-of-distribution, which is useful for real-world applications.\n\nWeaknesses:\n\nW1. It is not clear how and the intuition why a subset of ViTs achieves the best C-OOD detection performance.\n\nW2. The computational complexity is not discussed when analyzing baseline models, e.g., knowledge distillation, and language-vision CLIP.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: notable-top-25%