Re-Benchmarking Out-of-Distribution Detection in Deep Neural Networks
Authors: Jinling Gao
Haoyue Bai
Lin Zhu
Nanyang Ye
Venue: Submitted to ICLR 2023 (2023)

Abstract: Out-of-distribution (OOD) detection is a key challenge for making machine learning models robust in the real world, where we want models to be aware of uncertainty outside their training data distribution. Despite the rapid development of existing OOD detection algorithms, their experimental settings are usually inconsistent, e.g., datasets, evaluation metrics, model selection, implementation choices. In this paper, we aim to understand OOD detection fundamentally and provide a comprehensive benchmarking of the current state of the art OOD detection methods in a consistent and realistic evaluation setting. This benchmarking contains a serious of datasets split, model selection criteria and OOD detection algorithms. This experimental framework can be easily extended to new algorithms, datasets, and model selection criteria. We conduct extensive experiments on this benchmark and find that the threshold of OOD detection algorithms are not consistent over different datasets and model selection criteria.

Under review as a conference paper at ICLR 2023
RE-BENCHMARKING OUT-OF-DISTRIBUTION DETEC- TION IN DEEP NEURAL NETWORKS
Anonymous authors Paper under double-blind review
ABSTRACT
cuttof-distributiin (OOD) detection is key challenge for making machine learn- ing models robust in the real world, where we want models to be aware of un- certainty outside their training data distribution. Despite the rapid development of existing OOD detection algorithms, their experimental settings are usually inconsistent, e.g., datasets, evaluation metrics. model selection, implementation choices. In this paper, we aim to understand OOD detection fundamentally and provide a comprehensive benchmarking of the current state of the art OOD detec- tion methods in a consistent and realistic evaluation setting. This benchmarking contains a serious of datasets split, model selection criteria and OOD detection al- gorithms. This experimental framework can be easily extended to new algorithms,, datasets, and model selection criteria. We conduct extensive experiments on this benchmark and re-evaluate algorithms contained in this benchmark.
INTRODUCTION
Deep learning has achieved superior performance when the training and test data are sampled from the same distribution (Krizhevsky et 2012 He et al., [016 Redmon et al. 2016), i.c., independent and identically distributed (i.idd).. However, the real world is open and presents diverse inputs for modern deep learning models. -ittof-distribution (OOD) detection is of great importance AI safety, which aims to determine whether an input is different from its training data and reject them (or safe handling by human users) (Yang et al. 2021 Hendrycks & Gimpel| 2017].
Extensive recent research endeavors are devoted to the problem of -iitri--ditiiittonnn detec- tion (Liang et al. 2018 Hsu et al., 2020. [Huang af.) 202T Ming et al.) 2022 Sun et al. 2022
Meinke & Hein 2020), including softmax-based score and generative-based methods. The goal of out-of-distribution detection to effectively separate between ID and OOD data. Most of the previ- ous works with discriminative models focus deriving score criterion of the probability density of OOD samples from different space of modern deep neural networks, e.g., output space (Hendrycks) & Gimpel 2017 [iu et al.) (2020), feature space (Lee et al.) 2018) and gradient space (Huang al. 2021). Generative- high likelihood to test OOD data (Ren al., 2019 Schirmeisser al. 2020 Xiao et al. 2020).
methods leverage deep generative models for OOD detection and assign
Although a plethora of OOD detection algorithms has been proposed recently, they are evaluated based on different OOD datasets, evaluation metrics, and model selection criteria. Inspired by stan- dard benchmarks such as ImageNet (Russakovsky et al., 2015). DomainBed (Gulrajani & Lopez- Paz 202T, J, we propose comprehensive testbed for out- distribbuui detection. This benchmark includes 5 OOD datasets, 5 baseline algorithms, and three evaluation criteria. In this work, we pro- vide framework to reproduce experimentation in OOD detection and propose a simple yet effective method for adaptive model selection in OOD detection. Then, we carefully implement five OOD detection algorithms on five representative OOD datasets and three evaluation criteria and we reveal that the changeable threshold to separate IID and OOD data may be a possible reason to sub-optimal OOD detection performance, while existing works lacks the in-depth analysis on model selection and evaluation criteria of OOD detection algorithms. Based the experiments and analysis in this work, leading to the recommendation for OOD research: The threshold of a OOD detection algorithm should be stable against model selection criteria.
Based on the observations and analysis, we make several recommendations for future OOD detection research:

---

Under review as a conference paper at ICLR 2023
We propose framework comprehensively benchmarking OOD detection algorithms in rigorous and realistic evaluation setting.
We point out the weakness of previous benchmark methods and re-evaluate algorithm per- formances under different data-spliting methods.
We observe the unfairness of existing metric in OOD detection.
We understand OOD detection fundamentally and illustrate the importance of threshold that separating IID and OOD data for model selection in finding optimal OOD detection model.
(a) FashionMnist
(b) KMnist
(c) Places
(d) TinylmageNet
(e) Textures
Figure 1: Visualization typical examples widely used OOD detection datasets.
2 RELATED WORKS
2.1 OOD DETECTION ALGORITIMS
GradNorm (Hungg et al. 2021 employs the vector norm of gradients, which backpropagated from the KL divergence between the softmax output and a uniform probability distribution, to derive OOD scores for detecting OOD data. MOS (Huang & Li 2021) proposes a group-based OOD de- tection framework with a scoring function MOS to decompose the large semantic space into smaller groups with similar concepts, which allows simplifying the in distribution and OOD data decision boundaries and thus enhancing OOD detection especially a large-scale setting. MLP (Hendrycks) & Gimpell 2017) presents simple baseline that utilizes probabilities from softmax distributions for detecting OOD data. Generalized ODIN (Hsu et al.) 2020) proposes two strategies, the decomposed confidence and the modified input preprocessing for improving OOD detection, and does not need OOD data for tuning the model.
ODIN (Lingg al. 2018) separates the softmax score distributions and achieves more effective OOD detection by using temperature scaling and adding small perturbations to the input. The work (Liu al.) (2000) uses an energy score distinguish ID and OOD data, that is theoretically aligned with the probability density of the inputs. Energy can be used as both scoring function of any pre-trained classifier and trainable cost function fine-tune the model. Outlier Exposure (OE) (Hendrycks et al. 2019) utilizes auxiliary data to help OOD detectors work well on unseen distributions of OOD data. Mahalanobis (Lee et al. 2018) proposes a confidence score based on the Mahalanobis distance to obtain the class conditional Gaussian distributions for detecting out-of- distribution. Likelihood Ratio (Ren et al., 2019) proposes a deep generative model based approach and likelihood ratio method for OOD detection.
OOD detection using auxiliary outlier data assume that auxiliary outlier data is completely sep- arable from ID data. ViM (Wang et al. 2022) present virtual-logit matching OOD score method that combines feature space class-agnostec score and ID dlass-depedent logits. DUQ (Van Amers- foort et al.) 2020) is based RBF networks estimate uncertainty in single forward pass. WOODS Katz-Samulls et al., 2022) leverages wild mixture data and utilizes a machine learning classifier in natural habitats. Metric Learning (Masana al. 2018) makes of metric learning
2

---

Under review as a conference paper at ICLR 2023
instead of cross-entropy loss to divide prediction on the learned classes. Generative OOD Sam- ples /Venekar et al., 2019) proposes an algorithm to generative effective OOD samples based on a manifold learning network. GOOD (Bitterwolf al. (020) focus certificating worst case guar- antees by applying low confidence at OOD point for OOD detection.
2.2
BENCHMARKS
There are several public available datasets for benchmarking OOD detection algorithms: MasionM- NIST (Xiao et al. 2017), Kuzushij-MNNIST (Clanuwat et al.) 2018), Texture Dataset (Cimpoi al.,
2014). Places (Zhou et al. 2017). CIFAR-10, 10, CIFAR- 100 (Krizhevsky et al. 2009), SVHN Netzer al. 2011 LSUN (uu et al. 2015). ImageNet-O (Hendrycks al. 2021 Srivastava In this work, we use the standard split for each ID and OOD datasets. There is widely used com- mon benchmark in recent years: CIFAR- 10, CIFAR- 100 as ID data, SVHN, LSUN, Places365, Tex-
2022).
tures as OOD data. (standard ResNet-20 (He et al. 2016) network). CAOS Benchmark (Hendrycks) al., ) and MOS (Huang Li. 2021) (Google BiT-S Kolesnikov et al. (2020) models) uti- lizes a large-scale that leverage ImageNet-21K K to evaluate multilabel anomaly detectors: ImageNet as ID dataset and iNaturalist, SUN, Places, Textures as OOD datasets. These are commonly used evaluation metrics in existing OOD detection benchmarks: AUROC (Hendrycks & Gimpel 2017),
AUPR Heeddrycks & Gimpel 2017), False-positive rate (FPR95), and Detection Accuracy.
Recently, codebase called OpenOOD is proposed Yang al. 2022). in which nine bench- marks from neighboring fields such as anomaly detection and open set recognition are considered. Yang utilizes unified hyperparameters and architecture choices aiming ensure fairness among different methods and compares the performances of methods under various dataset benchmarks. However, no one focuses on multiple datasets spliting datasets.
NEW BENCHMARK
Here we make a detailed introduction of datasets, baseline algorithms, and the methods of split of datasets used in works with some slight changes.
benchmark. These datasets and algorithms are selected according to prior
3.1 OOD DETECTION
Threshold appears crucial in OOD detection since it is used to discriminate ID data and OOD data. It serves as the boundary between ID data and OOD data. If the threshold is too small, then the model will mistake OOD data as ID data and opposite if the threshold is too big. Thus, once other factors such datasets, algorithms, model selection, and dataset split are determined, the threshold becomes the most important element that affects OOD detection. The task of improving the performance of OOD detection turns into the task of finding the optimal threshold. In the setting of optimal OOD detection, the threshold of a OOD detection algorithm should be stable against model selection criteria.
1) The distance between threshold of OOD detection algorithm and the expectation of optimal threshold is minimized. The less the distance is, the better performance will the model show. How- ever, it is hard to get the optimal threshold.
2) The variance of threshold minimized. real world, there often exist more than one datasets. Hence, one stable threshold can be used for multiple datasets, which can save much time without sacrificing the performance of OOD detection. our benchmark, we consider the threshold as well and compare different thresholds in all cases.
3.2 DATASETS
Previous works use certain dataset ID data, e.g., CIFAR-10 (Krizhevsky et al., 2009), CIFAR- 100 (Krizhessyy et al. 2009), and ImageNet-21K Hendrycks et al. (2022) and some other datasets then fixed as OOD data. In benchmark, these datasets are used as both ID data and OOD data. In different groups, the same dataset may play different roles. These datasets do not overlap with each other. TinylmageNet (Le & Yang 2015)
choose five commonly used datasets. However,
3

---

Under review as a conference paper at ICLR 2023
contains 200 categories of different creatures with 500 training images in each category. We use the entire training data in our experiment. FashionMNIST (Xiao et al.) 2017) is a dataset about fashion clothes, including 60,000 training images within 10 classes. We pick out the training data from each class in order to form the dataset. KMNIST, whose full name is Luzushiji-MNIS" (Clanuwat et al.) 2018), is similar to FaShionMNIST (Xiao et al. 2017) since they share the same number of images and categories. The difference is that KMNIST focuses on Japanese characters. According to the similarity of KMNIST and FaSHiOnMNIST. we choose images from KMNIST the same way we choose images from FashionMNIST. Places365 consists of 180,000 images from 365 classifications of scene. We use the subset of 10,000 images among 50 manually selected classes. Textures (Cimpoi et al. 2014) is textural dataset containing 5,640 images under 47 categories collected from real world. We put all these data from Textures into our experiments.
3.3 BASELINE ALGORITHMS
We choose five baseline algorithms of OOD detection, MSP (Hendrycks & Gimpel, 2017 ODIN (Liang et al. 2018), OE (Hendrycks et al. 2019), Energy (Liu et al. (020), and Grad- Norm (Huang et al. 2021), in our benchmark. Their performances and effectiveness have been proved in former works. However, one baseline, GradNorm, requires some changes. This baseline calculates scores from parameters of the layer of the model. Accordingly, those datasets which have more classes will have higher grad norm scores even if they are OOD datasets, which contradicts our hypothesis that ID) datasets have higher scores than OOD datasets. After get the grad norm scores, we divide these scores by the classes of their datasets. Thus, we change grad_norm into mean grad gram and climinate the impact of data types.
3.4 METRICS
As for the metrics, we not only use the traditional criteria such as FPR95, AUROC (Hendrycks & Gimpel 2017) and AUPR (Hendrycks & Gimpel, 2017), but also choose Fl score, accuracy, preci- sion rate as well as recall rate. The accuracy shows if the model can judge whether the data belongs to ID dataset or OOD dataset correctly. The precision rate is the rate represents the proportion of OOD data correctly judged in all data which is considered as OOD data. The recall rate represents the proportion of OOD data which correctly judged in all OOD data. FPR95 represents the proba- bility that OOD data is mistaken ID data when the accuracy of classifying OOD data reaches 95%. AUROC and AUPR are two basic metrics in classification problems. These two metrics show the capacity of the model to distinguish different classifications. In our benchmark, we use F1_score, FPR95, AUROC as well as AUPR as the metrics to evaluate the performance of OOD detection. Among these metries, F1 score, AUROC and AUPR higher when models discriminate OOD data from ID data better, while FPR95 is in reverse proportion to the performances of models in OOD detection.
3.5 DATASETS SPLITT
Prior works have focused on deriving score criterion of data from different aspects until Gulrajani and Lopez-Paz recommended a new benchmark in which model selection is taken into account in OOD detection. However, datasets split is an importance factor in OOD detection as well. Thus, in spite of the traditional method of datasets split, we propose another two methods of datasets split.
Casel: Standard method
The existing method of OOD detection to select one dataset as ID dataset and choose another dataset as OOD dataset. We use the same method in case 1. Firstly, we set five clusters. Each cluster contains one dataset, which is used as ID dataset. These clusters are distinguished according to their ID dataset. For example, the ID dataset in the first cluster is FashionMnist while that in the second cluster is KMnist. Hence, there remain four datasets each cluster. Ulteriorly, we divide each cluster into four groups. Each group includes one dataset selected among those four remaining datasets. For example, the four groups in the first cluster consist of KMnsst, Places, Textures and TinyImageNet respectively. Then get twenty groups of diverse ID data and OOD data. After dividing these groups, we train models for each cluster using its ID dataset. When we get these five models, can start work of OOD detection. Since each cluster has model and four groups,
4

---

Under review as a conference paper at ICLR 2023
AUROC
AURRL
10. Deliia Sakkeaa
Stric as 000 Teaeeapte
B. beloo
cleak 900 Faue
66
65
10
V100Y
300'09
05A9
DON
30
D4/01
59000
10
00/9
12
220
Dr To 200 200-9
D Teptteeee vo OOD Toakwetke
Teyirackorys OOD bolar
Tederagphll es OC0 Patco
32
05.
400
0518
IC C:/hooe sa. 200 st
Ic: S:/hoo va. COD, Strte
D. Paserva 000 Thy insceie
D. Tarac Na. D0C, Teraon
Figure 2: Comparisons of state-of-the-ae OOD detection algorithms in terms of different evaluation metrics of Case 1. We plot results of the three metrics and the thresholds in case 1. The five baselines in the same group are put into the same figure.
we use this model detect OOD data for these four groups. For each group, we calculate scores of all methods, such as grad norm and energy, for each batch of data in both ID dataset and OOD dataset. After we get the scores of one group, we use these scores to discriminate ID data and OOD data in this group, and then choose the score which has the best performance in OOD detection as the result for this group. At the end, we obtain twenty groups of results for each method.
Case2: Multiple ID datasets and multiple OOD datasets
In this case, we choose multiple datasets as ID datasets and multiple datasets as OOD datasets in group. For each group, we select three of the five datasets as ID datasets and use the other two datasets as OOD datasets. Different groups contain diverse combinations of datasets. In each group, we utilize ID datasets in order to train a model which belongs to this group. Nevertheless, these three ID datasets are used one by one. By contrast, the model is trained by a batch of data from one dataset at one time. Then, another batch of data from another ID dataset is sent into the model. When we get the models in all groups, we start the work of OOD detection. We calculate the scores of all methods in each group, and then them as the threshold to detect OOD data in their groups
5

---

Under review as a conference paper at ICLR 2023
AUROC
AURR
0001 Maai 56 9052 Fediss Me4d
0001 Siee 0000 Testsoade
0020 Oeei Sa 0002 bollow
V100Y
05.9
D4/01
00/
122
100
OC00 Tww.--tteeetccc.oo 55 0O02 1Masi
2001 Teyleagle, 56 0002 fortero
0000 "Twbhagghee 55 0002 Iolaro
0023 www.lmooooekkcccoo OS OOD0 RAc
40
CO01. Place 65 COOL Meei
CO0L: 5s 0002 Twheniirat
Foou S5 000G Thy Inspelie
octa:Taew 64 O000 Tecuri
Figure 3: Comparisons of ofate-of-the-art OOD detection algorithms in terms of different evaluation metrics of Case 2.
F7935
AIROC
ALFIL
13
30
00
Figure 4: Comparisons of state-of -ftte-of-the-art OOD detection algorithms in terms of different evaluation metrics of Case 3.
For each group, we compare the performance of each threshold and select the optimum threshold which performs the best in OOD detection.
Case3: All datasets in group

---

Under review as a conference paper at ICLR 2023
Here in this ID dataset and multiple datasets as OOD datasets in a group. At the beginning. we select one dataset among these five datasets for each group. These groups group contains a different dataset, which used as II) dataset this group. 'hen for each group, make the remaining four datasets OOD datasets. When finish grouping these datasets, use the ID dataset in each group to train a model for the group which the dataset belongs to. After models are trained, OOD datasets. However, unlike what we do in the first case, we make the scores of different groups in common use among all groups. The scores from these five datasets compose the threshold set. Then, we test all scores in the threshold set and choose the one that shows the optimum performance for each group.
combine the selection of datasets of the first two We one dataset
different from each other since each
calculate the scores of all methods for each group using its ID dataset and
Table 1: The average results of the same method under the same metric in the second case
Metrics
F1 sccore
AUROC
FPR95
AUPR
Algorithms
Energy
0.83
0.77
0.42
0.79
GradNorm
0.82
0.73
0.53
0.76
MSP
0.74
0.76
0.51
0.72
ODIN
0.74
0.75
0.44
0.74
OE
0.79
0.75
0.48
0.76
Table 2: The average results of the same method under the same metric in the second case
Metrics
F1 _score
AUROC
FPR95
AUPR
Algorithms
Energy
0.65
0.72
0.42
0.57
GradNorm
0.70
0.72
0.47
0.62
MSP
0.67
0.70
0.61
0.55
ODIN
0.70
0.73
0.63
0.60
OE
0.65
0.72
0.45
0.56
Table The average results of the same method under the same metric in the second case
Metrics
F1 score
AUROC
FPR95
AUPR
Algorithms
Energy
0.91
0.76
0.80
0.89
GradNorm
0.95
0.77
0.59
0.94
MSP
0.93
0.72
0.80
0.90
ODIN
0.88
0.72
0.80
0.90
OE
0.90
0.74
0.83
0.88
4 EXPERIMENTS
4.1 PREPARATION BEFORE EXPERIMENTS
We use ResNet18 which has been pre-trained as the model all our experiments. We separate all images based the classes and give each image corresponding label because what need supervised learning. Before our experiments start, we resize all images to 224 x 224. For each dataset to be trained in the models, it is split into training and validation set. Training accounts

---

Under review as a conference paper at ICLR 2023
(al Energy
(b) GradNom
(c) MSP
(d] ODIN
[c] DE
Figure 5: F1 score thresholds of different metrics in case 1. Each figure represents one metric in case 1. The figure is divided into several small areas, each of which shows the threshold of group in case 1. The diagonal areas means ID dataset is equivalent to OOD dataset. We stipulate thresholds in diagonal areas since they used in our experiments. (Better viewed in the zoom-in mode)
Energy
Graddoon
Figure 6: F1 _score thresholds of different metrics in case 2. We the method the in the first method to plot thresholds in case 2. (Better viewed in the zoom-in mode)
for 80% of the data while the remaining 20% is used for validation. The images are sent into models as batch at one time and the batch size is set to 8.
4.2 EXPERIMENT RESULTS AND ANALYSIS
The main results of our experiments are shown in the figures above. We print the highest _l_score the highest AUROC, the highest AUPR and the lowest FPR95 of different groups of each baseline algorithm using these three methods. For each method, we calculate the average scores of all groups in the same algorithm under the same metric, which are used to appraise the performance of OOD detection with the corresponding algorithms. We then make comparison of the scores among algorithms. Afterwards, we attain the following results:
Previous benchmark method exaggerates the effectiveness of OOD detection algorithms Previ- ous researchers use the same but simple method of splitting datasets, one as ID dataset another OOD dataset, to test their algorithms. However, according to the results that get from these three methods, the traditional method cannot reflect the real effectiveness of algorithms. From Ta- ble T Table [ and Table the results vary widely among methods. For example, the result under AUPR in Energy using the traditional method is 78.8 88.88 while that result reduces to 56.54% using the second method split datasets and increases 89. 89.04% in the last method. Even though we get high AUPR scores in the third method, the FPR95 scores increase relatively. The statistics above show that algorithms perform worse when multiple datasets form ID datasets and OOD datasets, which represents the effectiveness of algorithms. Since traditional method only focuses on single ID dataset with single OOD dataset, the real effectiveness of these algorithms is overstated.
Among all methods, GradNorm outperforms other algorithms on various benchmark settings but is still not robust Figure shows the performance of different algorithms in the first method. AS we can see, Energy seems the best algorithm since it has the optimum results under However, when comes to the other two methods, to our surprise, GradNorm becomes the best al- gorithm. In the second method, GradNorm reaches 62.496% under AUPR while in the last method, it performs the best under all metrics. Thus, GradNorm has more potential when OOD detection includes more than dataset. It seems the more data included in OOD datasets, the better Grad- Norm performs compared to other algorithms. We assume two reasons to explain its strength. The first one is that the gap of gradients between ID data and OOD data can be enlarged with the addi-
metric.
8

---

Under review as a conference paper at ICLR 2023
DCW
Figure 7: F1 Flcscore thresholds of different metrics case Unlike the two cases above, we only have five groups distinguished by ID dataset. We use ID datasets the x-axis and plot thresholds of each group in different metric figures. (Better viewed in the zoom-in mode)
tion of datasets, which enables models to discriminate ID data and OOD data more easily. Besides, considering models case are shared in case 3, they should have similar performances. However, GradNorm seems better in case 3. Then we propose the second assumption that GradNorm may be adept in detecting OOD data and perform worse in classifying ID data. Though GradNorm shows better performance than other algorithms, it still has some weakness. As Figure 6. and Figure [ the thresholds got in GradNorm are not stable, which means GradNorm is not robust and may have poor performance when used in different groups of datasets.
see in Figure [
AUPR might not be good indicator for OOD detection Former researchers use AUROC, FPR95, and AUPR basic metrics to evaluate their algorithms. In experiment, use these metrics as well. Since the calculation of AUROC as well as AUPR has no relation with thresholds, they only reflect the effectiveness of the elassifier. However, after comparison of results of three methods, find that AUPR scores vary widely when tested in different methods while AUROC scores show few differences, which means the effectiveness of the same classifier is different under these two metrics. We suppose that this phenomenon is resulted by the unbalanced datasets. AUPR represents area under PR curve, which has great change when data is unbalanced, the propotation of positive data or negative data is much larger than the other one. Thus, the datasets selection and split method will affect AUPR scores. In other words, AUPR scores cannot reflect the real performance algorithms and seems unfair metric in OOD detection.
CONCLUSION
In this paper, we re-test five OOD detection algorithms in three dataset splitting methods including the traditional method and two newly proposed methods. We summarize the following insights: First, Former benchmark method of dataset splitting magnifies the real effectiivnnes of OOD de- tection algorithm. Algorithms show worse performances when the group contains multiple datasets. However, the traditional method forgets to take this circumstance into account. Second, GradNorm is the best algorithm among the five algorithms when there exist more than one dataset in group. Even though the performance of GradNorm cannot match that of Energy in the traditional method, transcends all other algorithms in the second and last method. In other words, the real effectiveness of GradNorm outperforms the other algorithms. Last, AUPR seems be an unfair indicator OOD detection though it is widely used. AUPR scores rely on the proportion of OOD data. Thus, AUPR may vary widely when using different groups of datasets, which unfair to evaluate algorithms. We hope our work can remind others that there still remain details which can be optimized in OOD detection work. Even though some parts of OOD detection work have been widely utilized, they may be unjustified and can be improved.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Julian Bitterwolf, Alexander Meinke, and Matthias Hein. Certifiably adversarially robust detection of out-of-distribution data. NeurIPS, 2020.
Mírcea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. De- scribing textures in the wild. In CVPR, 2014.
Tarin Clanuwat, Mikel Bober-Irizar, Asanobu Kitamoto, Alex Lamb, Kazuaki Yamamoto, and David Ha. Deep learning for classical japanese literature. NeurlPS Workshops, 2018.
Ishaan Gulrajani and David Lopez-Paz. In search of lost domain generalization. ICLR, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, 2016.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out- out-of-distribution examples in neural networks. ICLR, 2017.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. ICLR, 2019.
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In CVPR, 2021.
Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-of-distriutionn detection for real-world settings. ICML, 2022.
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of- distribution image without learning from out-of-distribution data. In CVPR, 2020.
Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space. In CVPR, 2021.
Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distribu- tional shifts in the wild. NeurlPS, 2021.
Julian Katz-Samuels, Julia Nakhleh, Robert Nowak, and Yixuan Li. Training ood detectors in their natural habitats. ICML, 2022.
Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. In ECCV, 2020.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. TR, 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. NeurlPS, 2012.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 2015.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. NeurlPS, 2018.
Shiyu Liang Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. ICLR, 2018.
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detec- tion. NewrIPS, 2020.
Mare Masana, Idoia Ruiz, Joan Serrat, Joost van de Weijer, and Antonio M Lopez. Metric learning for novelty and anomaly detection. BMVC, 2018.
Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't t know. ICLR, 2020.
10

---

Under review as a conference paper at ICLR 2023
Yifei Ming, Hang Yin, and Yixuan Li. On the impact of spurious correlation for out-of-distribution detection. AAAI, 2022.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning, NIPS, 2011.
Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection. In CVPR, 2016.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snock, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. NeurIPS, 2019.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. IJCV, 2015.
Robin Schirrmeister, Yuxuan Zhou, Tonio Ball, and Dan Zhang. Understanding anomaly detection with deep invertible networks through hierarchies of distributions and features. NeurIPS, 2020.
Anugya Srivastava, Shriya Jain, and Mugdha Thigle. Out of distribution detection on imagenet-o. arXiv preprint arXiv:2201.0953 2022.
Yiyou Sun, Yifei Ming. Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. ICML, 2022.
Joost Van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using single deep deterministic neural network. In ICML., 2020.
Sachin Vernekar, Ashish Gaurav, Vahdat Abdelzad, Taylor Denouden, Rick Salay, and Krzysztof Czarnecki. Out-of-distribution detection in classifiers via generation. Neur/PS, 2019.
Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual-
logit matching. In CVPR, 2022.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint arXiv: 770.007777 2017.
Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: out-of-distribution detection score for variational auto-encoder. NeurIPS, 2020.
Jingkang Yang. Kaiyang Zhou, Yixuan Li. and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:21 / 10. 1334, 2021.
Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang, Guangyao Chen, Bo Li. Yiyou Sun, al. Openood: Benchmarking generalized out-of- distribution detection. NeurIPS, 2022.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint
03365., 2015.
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. TPAMI, 2017.


Reviews:
[{"review_id": "q2gOflxhnW-", "reviewer": "Reviewer_6ZgR", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work provides a new benchmark for out of distribution detection with deep neural networks. Authors choose a total of 5 datasets and split them in different ways to create in-distribution (ID) and out-of-distribution (OOD) datasets. A total of three evaluation criteria are considered for ranking different algorithms. Authors find that the benchmarking results are highly sensitive to different settings.", "summary_of_the_review": "Unsatisfying writing quality makes this work hard to understand. Paper is focused on evaluating existing methods on existing datasets, with existing evaluation metrics. No clear motivation on why the benchmark proposed in the work is necessary or novel.", "strength_and_weaknesses": "## Strength\n\nOut of distribution detection is an important problem in machine learning. A comprehensive benchmark that allows meaningful comparison across different OOD algorithms is highly valuable to the community.\n\n## Weaknesses\n\nWriting is extremely poor. Grammar and language issues are everywhere, rendering this work basically unreadable. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "pDacXA2xRNn", "reviewer": "Reviewer_ZnnK", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper is about benchmarking out of distribution detection algorithms, using multiple datasets.\n\nThe paper has no relevant contributions, due to lack of clarity in the paper (I cannot understand exactly what the authors propose as new benchmark or dataset split), and overall I do not believe the evaluation is valid, there are too many issues in this paper to speak of contributions.\n", "summary_of_the_review": "I cannot recommend this paper for acceptance. There are many issues and weaknesses, the main body of the paper is not understandable, the selection of OOD detection methods and metrics is not appropriate, from where it is not clear if the evaluation can be trusted or interpreted, and thus the conclusions/contributions are not robust. Additionally I believe the paper's motivations lie in faulty assumptions about thresholds' behavior, and this is not discussed or argued further, this is a severe weakness in the narrative, specially since the authors could have argued why this assumption makes sense and in which cases it holds.\n\nUnfortunately I do not think a revision can fix this paper due to the number of issues, and I can only recommend rejection.\n", "strength_and_weaknesses": "Strengths\n- Benchmarking OOD detection is a good idea overall, it is an often overlooked area of research, and the authors make a correct assessment that multiple datasets should be used. In this paper five datasets are used for evaluation.\n\nWeaknesses\n- The paper is difficult to read and ideas do not always follow clearly. Overall I had troubles understanding the writing of this paper, particularly  Section 3.5.\n- The dataset split section (Sec 3.5) proposes three ways to split datasets, but after reading this section multiple times, I cannot understand exactly how this works. Case 1 is mostly clear, but Case 2 and 3 are not. In particular it is not clear to me how multiple datasets are used to train a single model, and if I am misunderstanding, how multiple models are used to perform OOD detection. The paper is very light on details, and I believe this would be better explained using mathematical formulations.\n- The paper fails to make a good case for about its conclusions and contributions. Overall I do not find that the evaluation in this paper is correct and its conclusions are weak or irrelevant, particularly about the influence of thresholds or selection of methods to compare. There are too many question marks on the evaluation.\n- One argument made in the paper is about thresholds, that \"The threshold of a OOD detection algorithm should be stable against model selection criteria\". Unfortunately I do not agree with the authors on this definition, the threshold for deciding ID or OOD usually depends on many factors, depending on the OOD detection methods, many methods use activations or other complex statistics, which do depend on the model architecture or dataset. Taking that the threshold should be stable as an assumption does not seem to be well justified, and the paper does not discuss further on this assumption.\n- The paper does not make a clear definition of threshold (in Sec 3.1), the paper talks about threshold generically, and a mathematical model of the threshold is not provided, some simple definitions on how you use the threshold would suffice, to make it clear to the reader. \n- The selection of OOD detection methods is not well justified. The authors do survey a good selection, but then select five methods without proper justification. In particular I think uncertainty-based methods should be there (like ensembles, dropout, DUQ, etc), and a justification on why those methods were chosen should be added.\n- The selection of metrics is not well justified. The authors use F1 score, accuracy, precision, and recall, but they do not say why these metrics are necessary and what they are measuring in particular for the OOD detection problem.\n- Also about metrics, AUPR and AUROC are threshold independent, since they use multiple thresholds, and other metrics like precision, recall, accuracy, and F1, do need a threshold, but the paper does not mention how the threshold was set to compute any of these metrics. The only sentence mentioning something related is \"For each group, we compare the performance of each threshold and select the optimum threshold which performs the best in OOD detection\" which is extremely vague.\n- The paper mentions \"previous benchmarks\" but does not cite or refer to which benchmarks they are talking about. This severely undermines the connections of this paper to the state of the art and its scientific credibility.\n- Considering all the doubts I have in the concept of the paper, its evaluation, I cannot consider the conclusions to be valid. Overall I do not find any relevant contributions to the state of the art.\n\nMinor Issues\n- Tables 1, 2, and 3 have exactly the same caption, it is not clear how these results are different. This is a major issue that affects how results can be interpreted.\n- Paper does not have an appendix, since there are many details and explanations missing, some of them should go into the supplementary material. I note that the supplementary material exists, but it only proposes a new algorithm that is not evaluated in the paper, so functionally it is not an appendix to this paper.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "mB5x3cW59Q", "reviewer": "Reviewer_UJzP", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper is on OOD detection and evaluate existing algorithms on several datasets. I am not elaborating as the manuscript does not seem ready for submission at all. Please see the weakness section.", "summary_of_the_review": "I am voting for rejection as the manuscript does not seem ready for submission and the content is not novel and not reproducible.", "strength_and_weaknesses": "Weaknesses:\n1) The manuscript does not seem ready for submission at all. There are typos everywhere. For example, Tables 1, 2 and 3 have the exact same legend. I am not going to detail all of them but sentences like \" Likelihood Ratio (Ren et al., 2019) proposes a deep generative\" is another example of lack of proof-reading.\n2) There are no experimental details so the work cannot be reproduced.\n3) The content is not novel: simple application of existing methods on several datasets without a thorough analysis afterwards.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "gLLrl30gpSE", "reviewer": "Reviewer_7v19", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a new benchmarking suite for OOD detection. It consists of five different datasets, and OOD detection tasks are constructed by taking different splits of the datasets as ID and OOD. The authors evaluate the performance of five OOD detection methods on their benchmark across four metrics, finding that the performance of OOD detection methods is highly dependent on the ID/OOD dataset split. ", "summary_of_the_review": "I believe that the paper requires large improvements in many aspects before it would be ready for publication. Therefore, I recommend rejection.", "strength_and_weaknesses": "Strengths:\n- OOD detection is an important problem in machine learning.\n\nWeaknesses:\n1. The presentation of the paper is extremely poor. There are several spelling and grammar mistakes in almost every section. Figures 2-4 are also poorly presented, and the authors should consider focusing on a smaller set of results and showing it as a table.\n\n2. The authors do not sufficiently motivate why a new OOD detection benchmark is necessary. As such, it is unclear to me what the significance of the paper is. What is the issue with existing benchmarks which the authors discuss in Section 2.2? Though the authors spend much of their attention on the dataset split, it seems that Case 2 is unlikely in practice as models are typically trained on one dataset, and Case 3 is a less useful version of Case 1, as it hides the per-OOD-dataset performance.\n\n3. The authors do not show confidence intervals for any of their results. As such, it is not possible to conclude whether one method significantly outperforms another.\n\n4. The authors focus a lot of attention on the F1 score as a metric, which assumes a fixed threshold on the OOD score. However, I believe that F1 is less useful as a metric as the threshold is highly dependent on the specific use case -- the relative cost of a FN and FP are highly dependent on where and how the model is used.\n\n5. The authors do make a few interesting findings, such as the fact that existing OOD benchmarks are too easy, or the disagreement between AUROC and AUPRC. However, they are not very well explored, and do not provide much insight. The paper would be better served with more rigorous justifications such as those in [1]. \n\n6. The set of methods which the authors consider is rather small, relative to other benchmarks such as OpenOOD [2].\n\n7. It seems to me that the support of the distribution of images from Places and TinyImageNet are very similar, so I am not convinced that one dataset can be considered OOD relative to the other.\n\n[1] https://arxiv.org/pdf/2107.06908.pdf\n\n[2] https://arxiv.org/pdf/2210.07242.pdf", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject