Current Anomaly Detectors are Anomalous: On Semantic Treatment of OOD Inputs
Authors: Ramneet Kaur
Xiayan Ji
Souradeep Dutta
Yahan Yang
Michele Caprio
Elena Bernardis
Oleg Sokolsky
Insup Lee
Venue: Submitted to ICLR 2023 (2023)
Keywords: machine learning
training distribution
out-of-distribution
OODs
detection
semantic information

Abstract: Machine learning models have achieved impressive performance across different modalities. It is well known that these models are prone to making mistakes on out-of-distribution inputs. OOD detection has, therefore, gained a lot of attention recently. We observe that most existing detectors use the distribution estimated by the training dataset for OOD detection. This can be a serious impediment since faulty OOD detectors can potentially restrict utility of the model. Such detectors, tied to the bias in data collection process,  can be impermeable to inputs lying outside the training distribution but with the same semantic information (e.g., class labels) as the training data. We argue that in-distribution should not be tied to just the training distribution but to the distribution of the semantic information contained in the training data. To support our argument, we perform OOD detection on semantic information extracted from the training data of MNIST and COCO datasets, and show that it not only reduces false alarms but also significantly improves detection of OOD inputs with spurious features from training data. 

Under review as a conference paper at ICLR 2023
CURRENT ANOMALY DETECTORS ARE ANOMALOUS: ON SEMANTIC TREATMENT OF OOD INPUTS
Anonymous authors
Paper under double-blind review
ABSTRACT
Machine learning models have achieved impressive performance across different modalities. It is well known that these models are prone making mistakes on out-of-distribution inputs. OOD detection has, therefore, gained a lot of attention recently. We observe that most existing detectors use the distribution estimated by the training dataset for OOD detection. This can be a serious impediment since faulty OOD detectors can potentially restrict utility of the model. Such detectors, tied to the bias in data collection process, can be impermeable to inputs lying out- side the training distribution but with the same semantic information (e.g., class labels) as the training data. We argue that in-distribution should not be tied to just the training distribution but to the distribution of the semantic information con- tained in the training data. To support on semantic information extracted from the training data of MNIST and COCO datasets, and show that it not only reduces false alarms but also significantly im- proves detection of OOD inputs with spurious features from training data.
argument, we perform OOD detection
INTRODUCTION
Machine learning models have achieved remarkable success in accomplishing different tasks across modalities such as image classification (Gkioxari et al. 2015
speech recognition (Hannun et al.] 2014), and natural language processing (Majumder et al. 2017). it however known, that such mod- els are unreliable on samples which are less likely to occur, according to the model's in-distribution estimated from its training data (Guo al., 2017 Hendrycks & Gimpel 2016). Detection of these out-of offtriibbiiitti (OOD) inputs is important for the deployment of machine learning models in safety-critical domains such as autonomous driving (Bojarski et al., (016). and medical diagno- sis (De Fauw et al. 2). OOD detection has, therefore, gained a lot of attention recently (Liang let al. 2017 Lee et al. 2018 Hendrycks et al. 2019 Kaur et al. 2021b).
Even though there is sufficient interest in OOD detection, to the best of our knowledge, its unclear what precisely entails an OOD input. Existing detectors estimate a distribution that is tied to the training dataset, and flagging inputs as OOD when the assigned probability according to the esti- mated distribution is low. The standard drill involves a set of in-distribution inputs drawn from a dataset such as CIFAR10, and detecting those inputs OOD that are drawn from different dataset such as SVHN (Hendrycks & Gimpel 2016: Kaur et al. 202 Lee et al, 2018). Such external inputs (from SVHN) would have non-overlapping class labels (from CIFARTON O0). Ming et al. (2022)
show that the existing detectors are unfortunately tied to the sampling bias of the training dataset. This results in low detection on OOD inputs with spurious features such as background, color, etc. from the training data. The authors report low detection performance of existing detectors on two datasets: 1) Birds (Sagawa et al. 2019) with class labels in (waterbirds. landbirds), and 2) CelebA (Liu et al. 2015) with class labels in {grey hair, non non-grey hair). Table [ shows these results for OOD images containing water (or land) as spurious feature for waterbirds (or landbirds), and OOD images of bald male with male as spurious feature for grey hair. This means that even though the classifier might be able to generalize better, OOD detectors itself can stifle its utility. On the other hand these detectors can be permeable to real OOD inputs which ought to be rejected. With this in mind, we propose to treat intended distribution of images as in-distribution. Images contain- ing semantic information relevant to the training classe Inputs deficient of semantic information
We will be using the terms "in-distrihution" and "intended distribution" exchangeahly in the paper.

---

Under review as a conference paper at ICLR 2023
Table 1: Low OOD detection by existing detectors OOD inputs with spurious features from the training
data MMing et al. )022). Our Algorithm significantly improves detection on these OOD inputs.
Test Set
Baseline
ODIN
Mahala
Energy
Gram
Our
OOD for Birds
23.32
22.75
30.65
25.78
41.75
98,97
OOD for CelebA
16.30
18.93
21.25
28.72
18.79
74.36
X
Chamiffer
Out Distribution
D, Iatended Ditrihution
Out of Ditrrtbation
Blurry
Dog
Out Distriuttion
Training
Durk
Intendel, mut present in training
Figure 1: The intended distribution has much higher variability in of the samples it covers, when compared to training distribution. The classifier trained to classify birds [sitting birds. flying birds} expected to generalize well for the intended distribution, which has birds sitting on trees, snow or water. OOD inputs are the ones which are unlikely to occur from the vantage point of the intended distribution Dr.
w.r.t any training class such bird for the Birds dataset and hair for CelebA need to be detected as OOD.
Contributions:
We propose two OOD detection algorithms based distinct ways of estimating the intended distribution. The first algorithm uses expert guided semantic information. When expert guidance is absent, and there is sufficient labeled data, we propose using semantic segmentation network. Table [ shows that we achieve significant improvement by 57.22% and 45.64% on OOD detection with semantic segmentation networks for Birds and CelebA, respectively. This highlights the drawback of the current approaches.
Our experiments on COCO (Lin et al. (014)) and MNIST (LeCun et al. 1998) datasets show that the existing detectors overfit to the training data for estimating in-distribution, resulting in 1. false OOD detection on inputs with same (training class) labels but from a separate dataset, and 2. low OOD detection on inputs with classes, absent from the set of training classes. This low detection due to sensitivity of detectors to the spurious features from the training data. The proposed algorithms not only reduces false alarms significantly but also improves OOD detection (2 20%) on inputs with spurious features from training data.
Related Work. OOD detection has been extensively studied and detectors with OOD scores based on the difference in statistical, geometrical or topological properties of an-distribution and OOD in- puts have been proposed. These detectors can be classified into three categories, supervised (Lee et al. 2018, Kaur et al. 2021a), self-super (Hendrycks et al. 2019] Kaur et al. 2022). and un- supervised (Hendrycks & Gimpel 2016 Liang et al. 2017). Unsupervised approaches can function without an OOD dataset for training the detector, while supervised approaches do. Self-supervised approaches require a self-labeled dataset for training the detector. This dataset created by applying transformations to the training data and labeling the transformed data with the applied transforma- tion. The proposed OOD detection algorithms this paper are unsupervised in nature, [Mig et al. (022) show that the existing detectors perform poorly on OOD inputs with spurious features from training data. They, however, do not propose a solution for fixing the existing detectors.
Domain generalization Zhou et al. (2022) is an active research area where efforts are made for gen- cralizability of machine learning classifier to its classes beyond the training data. tries to ask the question of whether classifier trained on the images of birds trees would work on images of birds on water? Domain-invariant representation learning Li et al. 2018). training data augmenta- tion with higher variability (Zhou et al. 2020) etc. have been proposed to solve this problem. With the intended distribution of images containing (training) class- specciic information for classifier, propose inputs that do contain this information OOD.
2

---

Under review as a conference paper at ICLR 2023
There has been a great interest in making use of semantic segmentation networks in under- standing problem (Mo et al. 2022), one of the core problems in computer vision with applications e.g. to autonomous driving, video surveillance, and robot perception (Garcia- Gareia et al., (017). Recently, the use of segmentation networks was proposed to train classifiers with a handful of train- ing examples Mojab al. (202T). We make use of segmentation networks for OOD detection.
PROBLEM FORMULATION AND METHODOLOGY
Let Axx be the measurable space from which images are sampled. We assume X' is an at most countable subset of a (possibly very sigh-dimensional) Euclidean space IR Axxx3 whose dimension depends on the size of the images. Here, h, w refer to the height and width of the image. Denote by A(X)Axx) the space of (countably additive) probability measures on (X,Ax) and consider a candidate distribution D E A(X,,
Let then Xi...., ,,, ~ D iid, denote by 21...... the realizations of random variables X1. Xi..... Xn, and call S ; Fn our training (also
referred to as input sample set).
We assume that the support of D, written supp(D), is a proper subset of X, that is, supp(D) ç X. Then, we introduce what we call the intended distribution, i.e. a probability measure Dj E ( Ax) whose support supp(D1) ) a proper superset of supp(D). We can write:
supp(D) S supp(Dr) C.
Intended distribution D, needed because it assigns non-zero probability to the set of images which are likely to be seen by the classifier in the real world. For instance, in case of standard birds dataset, D captures images of birds on trees. But, the intended distribution D, can refer to birds on trees, water, or snow. We ask the following research question: Given the input sample set S, can build an OOD detector that is able to estimate Dj closely?
2.1 METHODOLOGY
This is a difficult problem, since it demands generalization from the OOD detectors which are strictly tied to the training set S. For an e O, we define the intended set of inputs X, == {ar X Dy(x) > }} C supp(Dr): next we endow it with sigma algebra Ax, C CAx. Let (V. be the measurable space of (class) labels, and assume y is at most countable. The oracle classifier is Ax, Ayy- E V, which produces the ground truth labels. With X' : X X, we define the following space
measurable map C : X3 + V. x + C(x)
8 (F X X' X1. (s, + F(s, C(x)= C(s))
The elements of f0th are maps that combine semantically relevant and irrelevant images so as to preserve the original label of the image. The label is determined by the oracle classifier C.
Our assumptions are the following three:
1. F # (. There exists at least map F' that combines semantically relevant and irrelevant images so as to preserve the original label of the image.
2. sup.eex [D)x) (x)) < 8. for some 8 2 The distance between the original and the
intended distributions is bounded by quantity 5.
3. supre. (D(x) (z)) < 1). for some 17 2 0. The distance between and an estimate of the intended distribution D,, that we are able to compute is bounded by quantity 7).
The first assumption is realistic one, since it is almost always the case that we can decompose an image into the two aforementioned components. The second assumption is reasonable because it is usually the case, that the distance between the intended and the sampling distribution is not arbitrar- ily large. The third assumption states that when building the estimate of the intended distribution, we do not move too far away from the sampling distribution. Then, we have the following.
Theorem 1. Let DI, D, A(X,Ax) be defined above. Then, there is 2 0 such that d(D,, supzex (P)(z) (z))) Sv.
As no confusion arises, we do not distinguish hetween prohability measure and probability distrihution.
3

---

Under review as a conference paper at ICLR 2023
Algorithm Detecting OOD Inputs as Out-of-Intended Distribution Inputs
Test datapoint E A' Parameters: Training set S, detection threshold Output: "I" if is detected as OOD; "0" otherwise
Input:
X estimated X, from S
Dj- = OOD Detection(X(, E 2)
Return 1 if (, o) < e, otherwise
The proof Theorem | is included Appendix. The Theorem states that the distance between the estimated intended distribution Dy and the intended distribution Dy is bounded by / = 8 + 2 0. If the sampling process was perfect, then intended distribution Dj would be arbitrarily close to D, hence d 0 and the distance between D, and D, would be bounded by 1 only. That is the error due to the short-fall of the algorithm which estimates the intended distribution from the sampled data.
OOD Detection: In image classification, the intended input set Xg is the set of images with class labels in V. An OOD input is an image whose (associated class) label does not belong to y. In light of Theorem that shows that under three natural assumptions - the distance between DD and DD is bounded, we propose to perform OOD detection using D). With X' being the estimation of X obtained from training set S, and Dj being estimated from X2, I proposes to detect those inputs OOD whose probability according to DD, is low.
We can assign probabilities to the (class) labels associated to the elements of X2 using a pushforward argument. That is, we define Py as:
y 3 + Py(1) = = C,Dr(y) == Dy(c-+()),
We estimate D, for OOD) detection. In the next section, we propose two ways of defining the OOD detection function D, in Algorithm !
3 USING SEMANTICALLY RELEVANT INFORMATION FOR OOD DETECTION
In this section, we use two kinds of maps, Nr and M,. The former introduced in section 3.1 represents a semantic segmentation network, while the latter introduced in section 3.2 represents a two-step process. We estimate the set X' of intended images for a classifier from the class-specific semantic information contained in S. Inputs without semantic information for any class in ) detected as OOD. We define:
:= (a' E Rdxxxx3 :' = -\x),, E S). where, M a generic segmentation map.
We argue that & is a good estimator of X2 because it preserves the semantically relevant information that is required for classification. This is in line with our intuition of using the elements of set F which combine semantically relevant and irrelevant information.
3.1 OOD DETECTION WITH SEMANTIC SEGMENTATION NETWORK
In scenarios with large amount of labeled available data, we propose to use semantic segmentation models as Ng- The output of a segmentation network, the segmentation map, is the classification of each pixel in the image into either background (semantically irrelevant information) or one of the class labels in y. We propose &t as the set of segmentation maps on (the elements of) S, where class information is labeled by the segmentation network. We call that segment of segmentation map as the foreground segment which is labeled with a class in y.
Here N, is segmentation algorithm that filters the input with the class-specific semantic informa- function N. X Rxx=x +1), generic Euclidean space R. In particular, .N, only keeps height and width of the image, losing the color information; the third dimension is given by a vector of dimension | + 1, where [}] is the number of (class) labels, and the extra dimension captures "extra label" associated to the background and all the images that are not assigned any of
tion in y. It can be seen Ax A where (RR) denotes the Borel bigma-algeebre
4

---

Under review as a conference paper at ICLR 2023
the labels in y. Its entries reals between and that up to 1; they represent the probability of image æ belonging to (class) label E ) or to the "extra label".
OOD Detection Scores; The classification -aasd detection scores by the existing detec- tors (Hendryeks Gimpel 2016 Liang et al. 2017) can be used for OOD detection on the fore- ground segment of the input image. Similar the baseline detector (Hendrycks & Gimpell 2016), which uses softmax score of the predicted class by a classification network for detection, we pro- pose softmax scores for the predicted class of the foreground segment for detection. Since the detection score has to be a single value, we take average of the softmax scores for the pixels in the foreground segment.
Recall that X' C. Rxxxxx3 Let '6 {0, (0,,,c1,... CN CN+1 J. N N, be partition of &' whose clements are N classes of images (c.g. birds, clothes, cars, etc.), computed as:
c c==C- = (a E C(a) y) for y yeyij (I,...,NY,
one class - the (N + 1)-th - that incorporates the background and everything that not subsumed in the other N classes, that is, c X (Uf=19), and the whole space X' and the empty set 0.
Pick any E X' and let H [1,....hh and W fl...., . w) For generie vector o, denote by a, its i-th entry, while for a generic element t of (X*+)x write ti to denote the ((>) + 1)- dimensional vector that we obtain if we "slice" at first coordinate and second coordinate j.
Let q (g1, - -.n..---NN (NN49N+1) IRN+1, define function
q g S(g) = max; 4i
when arg max; 9i E (I,..., N, +1}
otherwise
Definition 1. Pick any x E X. Define the following baseline score
BS(x) = Σieh Ejew (xN)
h w
We can also use the classification-basse score used by the ODIN detector (Liagg et al. 2017). ODIN an enhanced version of the baseline detector where the temperature-scalee softmax of the preprocessed input is used for detection. The input is preprocessed by adding small perturbations:
T == Ç sign( Liign-VV.lgeea (x,
Here is the perturbation magnitude, sign denotes the sign function, T Ryo is the tempera- ture scaling parameter, S'(x, T) an
N N-dimensional vector whose i-th entry
S(x,T) exp(f((x)TT)
Σ exp(s, (x)/T)
given by the lemperature-scaled softmax score of the i-th class predicted by the classification network f = fi.....f..) that is trained to classify classes in fcr..... CN), ), and S1 T) = max, (x T)..
Definition 2. Pick any x e X. Define the ODIN score as
OS(x) Eieh Ejew S(N.(T))s)
Algorithm 2 the proposed algorithm for OOD detection with 2, as the segmentation maps of S.

---

Under review as a conference paper at ICLR 2023
Algorithm 2 D OOD Detection with Seman- tic Segmentation Network
Algorithm 3 D, OOD Detection with Refer- ence Set
Input: Test input o X.
Input:
Test input o E X'
Parameters: Semantic segmentation net- work Ns, trained on S, detection score ds E (BS, OS), detection threshold
Parameters: Segmentation algorithm Ayr, reference set R. detection threshold e Output: "1" if detected as OOD; "0" oth- erwise
Output: "1" if o detected as OOD; oth- erwise
CompateeeereetSonnlee....
o' = (o)
Return 1 if max(r) 0 otherwise
Create s.t, Zi,j = S( Vi Vi h,
Return 1 if ds(2) < c, 0 otherwise
3.2 OOD DETECTION WITH REFERENCE SET
Datasets such as MNIST, with a history of feature engineering techniques (Belongie et al. 2000), permit semantically relevant pixels to be derived easily. The generation of the segmentation Ax Ax)
map N X' - hxxw=x follows a two step process. First it uses standard segmentation algorithm to define super-pixels of an image. Next, it removes the seg- ments which are can be regarded as irrelevant information. We create image out of the two components by setting different colors to these pieces. We leave the details with examples (Fig. to the Appendix.
OOD Detection Score: Given a pair of segmented images, we compare them using a metric known the SSIM value. It is a well known metric to compare similarity between images. OOD detection performed by measuring its similarity with the nearest neighbor a reference set.
SSIM: Structural similarity index metric (SSIM) (Wang al. 2004) computes statistical similarity between two images. SSIM value calculated as:
SSIM (Z1 x2) S₁ (2 (2)52(11, where
(1 x2) = lum(#1, x2), x2) = com(21, x2 corr((o()11))
The functions lum, con and corr compare the luminosity, contrast and correlation between two image inputs 21 and Ø2. The details of the implementation can be found in (Wang et al. 2004) and (Brunet al. (0122). SSIM permits fast GPU based implementation. Next, define reference set R X2 we mean an image whose associated (class) label is some y E y. It is defined as:
of size | containing one representative of each class y Y; by representative,
:= fx & x ~ ( Vy E }} C X₁.
more involved algorithm can be used to replace this simple choice, such as the ones proposed in Yang et al., Dutta et al. (2022). But, we find this simple procedure to work well in this context.
Algorithm 3 combines these pieces together. We compute SSIM of an input image E X' with all images in R and use the maximum value for detection. In other words if the similarity value of with its nearest neighbor in below the threshold e, we declare o as OOD.
Algorithm:
EXPERIMENTS
We perform experiments with the existing state-of-the-art (SOTA) detectors from all the three cate- gories supervised, unsupervised, and supervieeee OOD detection techniques.
Unsupervised: Baseline detector (Hendryeks & Gimpel,2015 is the SOTA unsupervised detector. uses softmax score a classifier for the predicted class. ODIN (Liang et al. (2017) an enhanced version of the baseline detector that uses cumperature--saledd softmax score but, for perturbed input for detection. Details are section 3.1
Supervised Mahalanobis detector (Mahala) is the SOTA supervised detector which uses Maha- lanobis distance (Mahalanobis) 1936) the input in the training feature space of the classifier for detection.

---

Under review as a conference paper at ICLR 2023
Distribution images from Clear Vizwiz
quality images (OOD) from Vizwiz
OOD images from COCO
Figure 2: Examples of images from the three test cases for COCO.
Self-supervised : Aux (Hendrycks et al. 2019) is the SOTA self-supervised detector which uses error in the prediction of the applied transformation with an auxiliary task predicting the an applied rotation, vertical and horizontal translations. The sum of the error in the three predictions and classification error used for detection.
the input for detection. It trains classifier
Evaluation Metrics: We call in-distribution inputs as positives and OOD inputs as negatives. We report the Receiver Operating Characteristic curve (ROC), Area under ROC (AUROC), and True Negative Rate (TNR) at 95% True Positive Rate (TPR) for evaluation. These are the standard metrics
used in OOD detection (Hendrycks al. 2019 Liang al. 2017 Lee al. 2018
4.1 CASE STUDY I: OOD DETECTION WITH SEMANTIC SEGMENTATION NETWORK
4.1.1 DATASET AND MOTIVATION
Common Objects in Context-Stuff (COCO) dataset (Caesar et al. 2018b) is large-scale vision dataset created for the purpose of training machine learning models for object detection, segmenta- tion and captioning with 182 object classes. We that subset (training and test) of COCO which can classified with the class labels from the set y {cup, umbrella, orange, toaster, broccoli, banana, vase, zebra, kite). These classes common to another dataset Vizwiz (Chiu al. 2020 Vizwiz a real patient dataset captured by blind people. This dataset is collected with the purpose of assisting partially blind people. Where the quality of images captured in the Vizwiz are labeled with either "no issues", or with issues such as "blurry", "too bright", "too dark". "camera obstructed"' etc. We call the images with "no issues" label in the Vizwiz dataset as the clear Vizwiz.
be an issue. So, images
We train the ResNet18 (He et al. 2016) model to classify the training set of COCO dataset. With 74.33% as model's accuracy on test COCO, it achieves a comparable accuracy of 68. 14% on the clear Vizwiz. Detecting inputs from clear Vizwiz as OOD by the existing detectors restricts generalizability of classifiers from the training distribution D to the intended distribution D,.
4.1.2 SEMANTIC SEGMENTATION NETWORK N₂ FOR ALGORITHM 2 AND CLASSIFIER FOR DETECTION BY EXISTING DETECTORS
As recommended by the authors of the COCO dataset (Caesar et al. 2018a). we train the DeepLab version 2 (v2) segmentation model (Chn al. 2017) on the training set of COCO. DeepLab v2 uses ResNet101 (He et al. 2016) model as the backbone model. For a fair comparison with the existing detectors, we train the ResNet101 classifier on the training set of COCO. We use the trained classifier for OOD detection by the existing SOTA unsupervised and supervised detectors. The accuracy of the classifier on the test COCO set is 68.64%. COCO dataset commonly used for object detection and segmentation. The classification accuracy of 68.64% is comparable with the SOTA detection accuracy (in terms of mean average precision) of 64.2% on COCO (Wei et al. 2022). For the self-supervised detector AUX, we train the ResNet101 classifier with the auxiliary losses of rotations and translations. Its classification accuracy on the test COCO set is 74.11%
4.1.3 TEST CASES AND RESULTS
We conduct our experiments with the following three test cases:
(a) In-Distribution from Clear Vizwiz: Inputs with the class labels in ) but from the clear Vizwiz.
(b) OOD from Vizwiz: Inputs with blurry, too bright, too dark, and obstructed issues from Vizwiz.
Due to the quality issues of these images, this dataset canmot be labeled with any labels y
(c) OOD From COCO: Inputs from the test COCO dataset with class labels not in Y Here, filter that subset of the test COCO that can be classified with the class labels from the set (traffic light, stop sign, parking meter, fire hydrant).
7

---

Under review as a conference paper at ICLR 2023
(a)
In-Distribution from Clear Vizwiz
(b) OODs from Vizwiz (blurry, too bright etc.)
True Postive Rate
True Positive Rate
Raneline 67.5
Rawdar 85
ODIN: 72.70
0.1
ODI: 92.48
AUX: 13.08
NUX 92.72
(3S)) 31.57
Our(BS) B4.18
Our(OS): 35.48
Our(OS): 8t.re
03
02
0.1
15
00
02
06
05
14
False Positive Rate
False Positive Rate
OODs from COCO
10
True Positive Rate
Roweiie 54.72
DDIN:
Mahola: 63 16
65.83
Our(R8]: 85.43
Our(O5):
False Positive Rate
Figure 3: (a) AUROC less than 50% on in-distribution inputs from clcar Vizwiz, and (c) highest AUROC on OOD inputs from COCO by Algorithm (2 shows that the proposed detection not only significantly reduces the false alarms but also improves OOD detection inputs with spurious features from training set.
Figure shows some examples of the images from the three test cases. Figure Seuure3comm compares the ROC and AUROC results of the existing detectors with A Algorithm On these test cases:
(a) In-Distribution from Clear Vizwiz (Fig. a)): AUROC less than 50% by our approach (with both the baseline and ODIN scores) implies that the proposed detector is not able to distinguish be- tween the test COCO and Clear Vizwiz datasets. AUROC greater than 50% by the existing detectors implies that these detectors distinguish clear Vizwiz from the test COCO by assigning higher OOD detection scores to clear Vizwiz.
(b) OOD from Vizwiz (Fig. 31)): With these images OOD for COCO, we require the AUROC to be as close to one as possible. The existing supervised detector Mahala achieves the best AUROC of 92.90% and our results 84.18% and 85%76% with bascline and ODIN scores respectively.
(c) OOD from COCO (Fig. e))) Significantly higher (2 20%) AUROC by Algorithm 2 (with both scores) than the existing ones indicates that the proposed detector performs OOD detection these inputs with spurious features from the training data better than the existing ones.
Discussion
The performance of the proposed Algorithm ( depends on the semantic (or foreground) information segmented in X, by the segmentation network. We observe that the trained segmenta- tion network labels all pixels in 22% images of the test COCO background. This results in low AUROC (in comparison to 92.90% by Mahala) of 85.76% on low quality OOD inputs from Vizwiz.
If the segmentation network trained well to segment inputs drawn from X' (ex. test COCO) then the detection performance of Algorithm 2 jimproves. Figure 4 shows the ROC and AUROC results on the 88% images of test COCO that are segmented with class labels in ) by the network. This test case is analogous to using a well trained segmentation network which segments 100% of the test COCO with class labels in as improving the training segmentation network is beyond the scope of this paper. With the 100% test COCO segmented with class labels in y by the segmentation network, the performance of Algorithm 2 improves from 85. 76% to 98.52% (with ODIN score) on OOD inputs from Viziwz and 43% to 97. 47.42% (with baseline score) on OOD inputs from COCO. Here we show results on test cases (b) and (c). Results on test case (a) are included in Appendix.
4.2 CASE STUDY II: OOD DETECTION WITH A REFERENCE SET
4.2.1
DATASET AND MOTIVATION
We use a mixture of MNIST-M GGanin & Lempitsky 2013) and Background-Coloree Goloree-MNISS (BC- MNIST) (Bui et al. 2021) datasets. Both MNIST-M and BC-MNIST are modified versions of
8

---

Under review as a conference paper at ICLR 2023
(b) OODs from Viawiz (blurry, too bright etc.)
(c) OODs from COCO
Positive Rate
True Positive Rate
Esseins: 87.13
Banirr:: $6.01
00t 92.87
2.4
GDIN 56.10
AUX: 53.25
AUX: t8.5o
Qur(RS)]: Our(OS) 9t:00
Our(OS)) 96.52
Positive
Positive
Figure 4: ROC and AUROC results of the existing detectors and Algorithm 2 on that subset of test COCO which is segmented with class labels in y by the trained segmentation network No.
Iy- Di-Distribution from BC-MNIST
True Positive Rate
AUROC TNR
66.03
ODI%: 12
Matala: 93.62 57.55
Our: 41.66 22.0
False Positive Rate
Figure 5: AUROC less than 50% on in-distribution inputs from BC-MNIST by Algorithm 3 shows that the proposed algorithm significantly reduces false alarms (by the existing detectors) for training set of MiX-MNIST.
MNIST (LeCun et al., 1998) dataset. MNIST-M is MNIST with its digits blended over patches of colored images. BC-MNIST is the colored version MNIST where both digits and background colored. We use mixture dataset of 100% data from MNIST-M and 50% data from BC-MNIST. We call this dataset as MiX-MNIST.
With 60, 000 training images in MNIST-M and 4000 training images in BC-MNIST, 96.77% of the training data MiX-MNIST comes from MNIST-M and the remaining 3.23% from BC-MNIST. We train the Lenet5 (LeCun et al. 1998) classifier on Mix-MNIST The classifier achieves comparable accuracy of 90% and 91% on test MNIST-M and test BC-MNIST datasets respectively. Therefore, with the classifier's ability to generalize BC-MNIST with only 3.23% of BC-MNIST as the training data, detecting inputs from BC-MNIST as OOD by the exiting detectors (Fig. 5 limits the applicability of the classifier.
4.2.2 EXPERIMENTAL DETAILS AND RESULTS
For the existing detectors, we use trained the LeNet5 model with its accuracy 91.91% on the test set of MiX-MNIST. Figure 5 compares the ROC, AUROC, and TNR results of the existing detectors with Algorithm on the detectors implies that existing detectors distinguish the test data of MiX-MNIST from the test set of BC-MNIST with higher OOD detection scores assigned BC-MNIST. AUROC less than 50% by the proposed Algorithm 3 shows that it does not distinguish between the test sets of MiX-MNIST and BC-MNIST. We achieve the lowest false alarm rate of 2.95% here.
of BC-MNIST. AUROC higher than 50% by the existing
We perform additional experiments for MiX-MNIST with OOD datasets from (low quality) Vizwiz and Pashion-MNIST. Details and results on these experiments are included in Appendix.
CONCLUSION
In this paper show that including more nuanced semantic information about the content of images can improve detection of duittf-distribution inputs. This to the best our knowledge, one of the first approaches which differentiates between sampling distribution and intended distribution.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Serge Belongie, Jitendra Malik, and Jan Puzicha. Shape context: A new descriptor for shape match- ing and object recognition. Advances in neural information processing systems, 13, 2000.
Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars. arXiv preprint arXiv: 1604460311111 2016.
Dominique Brunet, Edward R. Vrscay, and Zhou Wang. On the mathematical properties of the structural similarity index. IEEE Transactions on Image Processing, 21(4):1488-144 1499, 2012. doi: 10.1 10.11991122011.2172222
Manh-Ha Bui, Toan Tran, Anh Tran, and Dinh Phung. Exploiting domain-specific features to en- hance domain generalization. Advances in Neural Information Processing Systems, 34:21180 1899- 21201, 2021.
Holger Caesar, Jasper Uijlings, and Vittorio Ferrari. github. com rome www.chttotoe///ootttttt 2018a.
The COCO-Stufi dataset. https://
Holger Caesar, Jasper Uijlings, and Vittorio Ferrari. Coco-stuff:
Thing and stuff classes in context. In Proceedings of the IEEE conference computer vision and paltern recognition, pp. 1209- 1218, 2018b.
Blang-Chieh Chen, George Papandreou, lasonas Kokkinos, Kevin Murphy, and Alan Yuille. Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs. IEEE transactions on pattern analysis and machine intelligence, 40(4): 834 848, 2017.
Tai- Yin Chiu, Yinan Zhao, and Danna Gurari. Assessing image quality issues for real-world prob- lems. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3646-3656, 2020.
Jeffrey De Fauw, Joseph R Ledsam, Bernardino Komera-Paredess Stanislav Nikolov, Nenad Toma- sev, Sam Blackwell, Harry Askham, Xavier Glorot, Brendan O' O'Donoghue, Daniel Visentin, et al. Clinically applicable deep learning for diagnosis and referral in retinal disease. Nature medicine, 24(9))1342-1350, 2018.
Souradeep Dutta, Yahan Yang, Elena Bernardis, Edgar Dobriban, and Insup Lee. Mem- ory classifiers: Two-stage classification for robustness in machine learning. arXiv preprint 23X1v:2206.05333, 2022.
Pedro Felzenszwalb and Daniel P Huttenlocher. Efficient graph- based image segmentation. Inter- national journal of computer vision, 59(2)1167-181, 2004.
Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning, pp. 1180-1188 PMLR, 2015.
Alberto Garcia-Garcia, Sergio Orts-Escolano, Sergiu Oprea, Victor Ailenn--arttinz, and Jose Garcia-Rodriguee A review on deep learning techniques applied to semantic segmentation. arXiv preprint arXiv: 7004 104.00677 2017.
Georgia Gkioxari, Ross Girshick, and Jitendra Malik. Contextual action recognition with r* cnn. In Proceedings of the IEEE international conference on computer vision, pp. 1080-1088, 2015.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. arXiv preprint arXiv: 07770000599 2017.
Awni Hanmun, Carl Case, Jared Casper, Bryan Catanzaro, Greg Diamos, Erich Elsen, Ryan Prenger, Sanjeev Satheesh, Shubho Sengupta, Adam Coates, et al. Deep speech: Scaling up end-to-end speech recognition. arXiv preprint urXiv:/412.555 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
10

---

Under review as a conference paper at ICLR 2023
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv preprint 1rXiv:1610.02116,, 2016.
Dan Hendryeks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self supervsue learning can improve model robustness and uncertainty. Advances Neural Information Processing Systems, pp. 15663-15674, 2019.
Pavel lakubovskii. Segmentation models pytorch. https://githbb.comm///e/
segmentation httpriatttooommsellaeeeemmmmeeee pytorch,
pytorcs 2019.
Ramneet Kaur, Susmit Jha, Anirban Roy, Sangdon Park, Oleg Sokolsky, and Insup Lee. Detecting oods as datapoints with high uncertainty. arXiv preprint arXiv:2108.06338) 2021a.
Ramneet Kaur, Susmit Jha, Anirban Roy, Oleg Sokolsky, and Insup Lee. Are all outliers alike? on understanding the diversity outliers for detecting oods. arXiv preprint 1tt::2113.12222 2021b.
Ramneet Kaur, Susmit Jha, Anirban Roy, Sangdon Park, Edgar Dobriban, Oleg Sokolsky, and In- sup Lee. iDECODe: In-distribution Equivariance for Conformal Out-of-distribution Detection, Association for the Advancement of Artificial Intelligence, 2022.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 (66(1)):227-23333 1998.
Cheng-Han Lee, Ziwei Liu, Lingyun Wu, and Ping Luo. Maskgan: Towards diverse and interactive facial image manipulation. In IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2020.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-disttibutton samples and adversarial attacks. Advances neural information processing systems, 31, 2018.
Ya Li, Xinmei Tian, Mingming Gong, Yajing Liu, Tongliang Liu, Kun Zhang, and Dacheng Tao. Deep domain generalization via conditional invariant adversarial networks. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 624 639, 2018
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint arXiv: arXiv:/706.02690. 2017.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pp. 740-755. Springer, 2014.
Tsung- Yi Lin, Piotr Dollár, Ross Girshick, Kaiming He, Bharath Hariharan, and Serge Belongie. Feature pyramid networks for object detection. Proceedings of the IEEE conference on com- puter vision and pattern recognition, pp. 2117-2125, 2017.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild.
In Proceedings of the IEEE international conference on computer vision, pp. 3730-3738, 2015.
Prasanta Chandra Mahalanobis. On the generalized distance in statistics. National Institute of
Science of India, 1936.
Navonil Majumder, Soujanya Poria, Alexander Gelbukh, and Erik Cambria. Deep learning- based document modeling for personality detection from text. IEEE Intelligent Systems, 32(2):74-79, 2017.
Yifei Ming, Hang Yin, and Yixuan Li. On the impact of spurious correlation for outti--distributtion detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 10051-10059, 2022.
Yujian Mo, Yan Wu, Xinneng Yang, Feilin Liu, and Yujun Liao. Review the nologies of semantic segmentation based deep learning. Neurocomputing, 493:626-644 2022.
tech-
11

---

Under review as a conference paper at ICLR 2023
Nooshin Mojab, Philip S Yu, Joelle A Hallak, and Darvin Yi. Cvs: Classification via segmentation for small datasets. arXiv preprint arXiv:2111.0002,,220 2021.
Shiori Sagawa, Pang Wei Koh, Tatsunori B Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generaliza- tion. arXiv preprinl arXiv: /91 1911191711, 2019.
Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli. Image Quality Assessment: From Error Visibility Structural Similarity. IEEE Transactions on Image Processing, 13(4):600-612, April 2004. doi: 10. 1009/TT...0033819866.
Yixuan Wei, Han Hu, Zhenda Xie, Zheng Zhang, Yue Cao, Jianmin Bao, Dong Chen, and Baining Guo. Contrastive learning rivals masked image modeling in fine-tuning via feature distillation.
arXiv preprint arXiv:2205.14144 2022.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mniss a novel image dataset for benchmark-
ing machine learning algorithms. arXiv preprint arXiv:170..07744 2017.
Yahan Yang, Ramneet Kaur, Souradeep Dutta, and Insup Lee. Interpretable detection of distribution shifts in learning enabled cyher-physical systems.
Kaiyang Zhou, Yongxin Yang, Timothy Hospedales, and Tao Xiang. Learning to generate novel domains for domain generalization. In European conference computer vision, pp. 561-578. Springer, 2020.
Kaiyang Zhou, Ziwei Liu, Yu Qiao, Tao Xiang, and Chen Change Loy. Domain generalization: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
12

---

Under review as a conference paper at ICLR 2023
A APPENDIX
A.1 PROOF OF THEOREM 1
Proof. It immediate to see that the proposed d is a proper metric. Then, the proof goes as follows
d(D), D1) = sup (D)(x) Dy(x)) = sup (Dr(1) Dr(x)) D(x) D(x)
aEx
#Ex
S sup
{
(D(x)) -D,(x)) (D)()) D(x))]
=EX
I sup (D(x) - Dy(x)) + sup (D((x) - D(z)
xEX
aEX
5 + n
So putting + 77, we conclude the proof.
A.2 EXAMPLE IMAGES FROM COCO SEGMENTED WITH CLASS- RELEVANT INFORMATION
Figure 6 shows some examples of images sampled from COCO and clear Vizwiz datasets on the left and corresponding output of the trained semantic segmentation network NN, from section 4.1.2 on the right.
S
X
coco
Clear Vizwiz
Figure 6: Example images from COCO and clear Vizwiz left and output of the trained semantic segmentation network on these images on the right. Yellow color the segmented images represent the class class-specific semantically relevant information, and purple color represents the semantically irrelevant information.
A.3 RESULTS ON IN-DISTRIBUTION INPUTS FROM CLEAR VIZWIZ WITH THAT SUBSET OF COCO WHICH IS SEGMENTED WITH CLASS LABELS IN ) BY THE SEGMENTATION NETWORK A,
Figure 7 shows these results. Again, AUROC less than 50% by our approach (with both the baseline and ODIN scores) implies that the proposed detector not able to distinguish between the test COCO and Clear Vizwiz datasets. AUROC greater than 50% by the existing detectors implies that these detectors distinguish clear Vizwiz from the test COCO by assigning higher OOD detection scores clear Vizwiz.
13

---

Under review as a conference paper at ICLR 2023
(a) In-Distribution from Clear Vizwiz
True Positive 1
Doceline: 10,42
ODNI: 74.22
Maralz: 60.09
AUX 75.35
Our (DS): 39.52
Our(O8j:
False Positive Rate
Figure 7: ROC and AUROC results of the existing detectors and Algorithm on that subset of test COCO which is segmented with class labels y by the trained segmentation network No-.
A.4 DETAILS ABOUT THE TWO-STEP SEGMENTATION ALGORITHM NG, USED IN ALGORITHM 3
Detecting semantically relevant pixels is the first step in this algorithm. In order to separate the semantically relevant pixels, we first partition the image into meaningful segments using Felzen- szwalb's Algorithm Felzensswalbb & Huttenlocher (2004. Next we mark the segments placed away from the center as being semantically irrelevant. Whatever remains closely maps to semantically relevant information. We binarize the result in the previous step, obtain black and white version of the image. Figure [ shows some examples of images sampled from Mix-MNIST on the left and corresponding output of the segmentation algorithm N, from section 4.2.2 on the right.
S
A1
O
6
6
MNIST-M
4
4
1
BC-MNIST 7
7
Figure 8: Example images from Mix-MNIST on left and the output of the segmentation algorithm on these images the right. White color in the segmented images represent the class- mantically relevant information, and black color represents the semantically irrelevant information.
14

---

Under review as a conference paper at ICLR 2023
A.5
EXPERIMENTAL DETAILS AND ADDITIONAL EXPERIMENTS ON MIX-MNIST
A.5.1
EXPERIMENTAL DETAILS
Given two binarized versions of an image pair by the segmentation algorithm Nr described in Ap- pendix A..4 we compute the SSIM value between these images. We restrict ourselves non- negative version of the SSIM metric in this paper. To estimate whether image contains digit, maintain reference set for digits zero to nine. Figure 9 shows the reference set used in experi- ments. For given test image, compute the SSIM between the binary version of the image and each digit image in the reference set. If the test image does not resemble any digit in the reference set, declare it to be OOD.
O
2
3
5
6
7
8
9
Figure 9: Reference set of 0-9 digits extracted from images in Mix-MNIST by the segmentation algorithm N₁.
A.5.2 ADDITIONAL EXPERIMENTS
We conduct additional experiments on MiX-MNIST with the following two cases: (a) OOD from Vizwiz: Images with the blurry, too dark, and obstructed quality issues from Vizwiz.
(b) OOD from Fashion-MNIST: Images from Fashion-MNIST (Xiao et al., 2017) dataset with class labels from fashion objects such as trousers, shoe etc.
The results are follows:
Figure 10 compares the ROC and AUROC results of the existing detectors with the proposed OOD detection Algorithm] 3 Table shows these results on TNR (at 95% TPR) on these test cases:
(a) OOD from Vizwiz (Fig. 10 a)): With failure assign any labels to this dataset due quality issues, these images are OOD for the MiX-MNIST dataset and here we require the AUROC to be as close to
possible. The existing detector ODIN achieves the best AUROC of 94.95% and our result 90.93%. We achieve the best TNR (Q95%TPR) detection of 67. 15% here.
(b) OOD from Fashion-MNIST (Fig. 1O(b):: With the class labels of Fashion-MNIST disjoint from the classes in MiX-MNIST, images from Fashion-MNIST are OOD for MiX-MNIST. The ex- isting supervised detector Mahala achieves the best AUROC of 86.03% and our (unsupervised) results are comparable at 84.27%. Mahala achieves the best TNR (Q95%TPR) detection of 56.86% and ours second best at 44.67%.
OOD from Vizwiz (blurry, bright etc.)
OOD from Fashion-MNNSS
Positive Rate
True Positive Rate
Bazeline: 93.70
Baseline 84.33
ODIN:
ODIN:
Makala: 77.19
Mahula: 86.03
AUX. 80.25
AUX: 68.59
False Positive Rate
False Positive Rate
Figure 10: AUROC results of the existing detectors and Algorithm 3 on MiX-MNIST.
Table 2: TNR (@95% TPR) existing detectors and Algorithm
on MiX-MNIST.
Test Sct
Baseline
ODIN
Mahala
AUX
Our
OOD from Vizwiz
64.73
66.67
54.16
43.23
67.15
OOD from Fashion- -NISST
23.13
19.02
56.86
11.24
44.67
15

---

Under review as a conference paper at ICLR 2023
A.6
DETAILS ON THE CELEBA AND BIRDS EXPERIMENTS
A.6.1 CELEBA
We use the semantic segmentation network N, by Lee et al. (2200) CelebA dataset. The network segments faces into different parts including nose, hair, mouth, etc. In this experiment, we ran Algorithm 2 with the Baseline score.
In-distribution images: Male with grey hair
Spurious out-af-distribution Images: Bald Male
Figure 11: Images from CclebA dataset.
A.6.2 BIRDS
We the semantic segmentation network N₂, by lakubovskij 2019). Here, select Feature Pyra- mid Network (FPN) (Lin et al. 2017) with ResNet50 (He et al.) 2016) as its backbone architecture. It segments the images into parts: bird and background. In this experiment, with the Baseline score.
Algorithm)
In-distribution images: waterbirds/landdirrss
Spurious uutoof-distrbbution images:
water/land images without birds
Figure 12: Images from Birds dataset
16


Reviews:
[{"review_id": "vA_ZyNTw14M", "reviewer": "Reviewer_sQTF", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper raises a gap in current OOD detection approaches that rely too heavily on the training examples, and falsely mark images out of the train set but with similar semantic meaning. \n\nThe authors coin the term \"intended distribution\" to capture both the training set, but also the rest of the \"semantically similar\" data.\nTwo baseline approaches are proposed to close this gap and estimate the intended distribution:\n- using semantic segmentation, or more precisely the mean confidence of the resulting map. two flavours are proposed: either directly (BS) or via the ODIN method (OS) as a preprocess to the map.\n- using a reference set, or more precisely find the most similar reference image in the SSIM sense and use the latter measure as an OOD indicator.\n\nThe experimental section compares the proposed methods to several SOTA methods from three categories of OOD techniques: supervised, unsupervised, and self-supervised.\n\nThe proposed baselines are", "summary_of_the_review": "The paper shows a failure case of exiting OOD approaches and naive baselines that compete well in these scenarios.\nWhile I possibly misunderstand some parts of the theoretical claims (as in- can the intended actually be estimated), the empirical part should be enough to create a discussion in the community.", "strength_and_weaknesses": "### Strength \nThis paper shows a failure case for existing approaches on semantially similar data, and that a seemingly naïve approach is much less susceptible to such a case. \n\nThe paper attempts to formalize the problem in a very rigorous manner, based on 3 reasonable assumptions in the bottom of page 3.\n\n\n### Weaknesses\nIt is not clear to me that the proposed approaches actually estimate the intended distribution.\nWhile theorem 1 is very attractive, I am missing\n- A design choice that shows the proposed algorithms are alinged with the 3 assumptions, or in any way aimed at the elusive distribution?\n - (in light of theorem 1) why is estimating the training distribution dissimilar than estimating the intended one?\n- And therefore - a non-empirical indication that prior works do not actually estimate the intended \n- For the reference set baseline - why is selection of **one** representative enough? is there a theoretical justification?\n\nSmaller notes\n- clarity of notation, e.g. try to avoid using x' as the result of the map N(x) - this is confusing\n- the definition of S' in the end of definition 1 is hard to read - stating it is a softmax *before* the expression might make the sentence more fluent.\n- \"Unif\" in the end of the SSIM section is not defined.\n- page 5 line 2 - did you mean \"of _pixel_\" rather than \"of _image_\"?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "rH5ZtT4Aazv", "reviewer": "Reviewer_mNjq", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper makes the argument that current OOD detectors are faulty since they are tied to the bias in the data collection process. The authors show examples where several existing OOD detectors would have classified an auxiliary test data set as OOD, but the classifier performs well on those examples.  The authors argue that the auxiliary test data set should not have been OOD in the first place since humans could have classified the data correctly using the class labels for the original dataset. \n\nThey also propose a new OOD detector that does not classify that auxiliary dataset as OOD. Some theoretical basis for the results is also presented.\n\n\n\n", "summary_of_the_review": "Interesting idea, but validation falls short.", "strength_and_weaknesses": "The thesis in the paper is provocative in that it is arguing that all the previous OOD detectors are based on a faulty premise that the training data reflects the true distribution (unknown) and thus all OOD detectors are biased; furthermore, they argue that the bias can be corrected -- at least for image classifiers.\n\nI think that any bias in the training data is going to be reflected in the OOD detector is a reasonable thing to expect -- so that statement is not a surprise. That is true for machine learning models trained on a dataset as well -- the models have a similar bias. That is why having good training sets is usually important. \n\nBut, the paper also proposes algorithms which appear to do a better OOD detection. Unfortunately, this is where the paper falls seriously short.   The authors essentially make a one-sided argument that their OOD detector is a better detector overall because it does not classify the custom dataset that the authors constructed (which has high accuracy) on a custom model that the authors trained with blended data as OOD dataset.\n\nBut, it is also likely trivial to construct counter-examples for the authors' OOD detector below: \n\nAuthor's Premise: The authors used a model that was trained on  96.77% MNIST-M and 3.23%  BC-MNIST dataset and argued that it still accurately classifies BC-MNIST dataset, but several existing OOD detectors classify the BC-MNIST dataset as OOD, but their OOD detector does not.  Therefore, their OOD detector is superior.\n\nCounter-example to the author's premise: Let's say instead the model was trained 100% on MNIST-M (or even more extreme case, 100% original MNIST). It seems that the OOD detector by the authors would still call BC-MNIST data as in-distribution because of all the pre-processing described in the appendix that does segmentation into foreground/background and converts colors to black and white.  But in that case, I suspect either of the ML models would perform horribly on the BC-MNIST dataset while the authors' model would predict the BC-MNIST as in-distribution dataset.  So, overall, the experiments are not conclusive in showing the value of the approach.\n\nThe OOD algorithm by the authors is also complex and has a lot of priors built-in. For instance, use of segmentation to separate foreground and background and then removal of colors makes assumptions about the domain. For instance, the authors assume that segments placed away from the center are semantically irrelevant (A.4). These are priors. If they were known, potentially, a classifier should be trained on pre-processed data.  In that case, existing OOD detectors should work well since pre-processing would be part of the model.\n\nI also encourage authors  to evaluate their OOD on situations on which prior OOD methods were evaluated.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "nyH4YsK5bd", "reviewer": "Reviewer_iQtU", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper argues that semantic information should be considered for OOD detection which should not be just tied to the training data distribution. This argument is interesting and practically useful. Then the authors proposed to leverage the semantic segmentation network and reference set to detect OOD data semantically. Experiments are done on COCO and MNIST datasets.", "summary_of_the_review": "Please see the above Strength And Weaknesses section.", "strength_and_weaknesses": "The proposed problem is meaningful and interesting. However, here are some questions:\n- This paper attempted to introduce the complex notations in Section 2 to define semantic information for OOD detection. However, it is unclear what the exact definition of semantics is. \\delta and \\eta in assumptions are not sufficient to clarify the meaning of semantics. It would be good to share detailed examples for the given definition.\n- In addition, the notations in Section 2 and 3 would be better to be simplified and the writing of this part can be significantly improved to make it more understandable and readable.\n- In OOD detection, the proposed method is heavily dependent on the segmentation network. The experiments are tested on relatively simple datasets and show improvements. In practice, what if the dataset is complex and the segmentation network does not perform well? Moreover, compared with OOD detection, segmentation does not seem to be simpler to solve than OOD detection when data has a large variety. It is not very convincing to heavily rely on segmentation results to detect OOD.\n- The experiments should be conducted on more complex datasets. The evaluations on the same datasets in existing OOD papers are expected.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "8od66TVMsu", "reviewer": "Reviewer_fcgs", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a discussion on the definition of the in-distribution (ID) vs. out-of-distribution (OOD) for OOD detection problems, arguing that existing methods fail to semantically extrapolate the in-distribution (e.g. the ID of flying and sitting birds should include and generalize to various backgrounds, e.g. sky, woods, water, etc.). The paper calls such a \"semantically complete\" characterization of the ID the \"Intended Distribution\". Following this argument, the paper proposes to leverage semantic segmentation networks for OOD detection generalizing to the intended distribution. Here, classification OOD methods (e.g. maximum softmax or ODIN) are proposed to be used over the pixels in the foreground, whereas pixels in the background attain the max OOD score. An experimental evaluation on COCO and Vizwiz is presented showing that the proposed methods compares favorably over previous approaches in the intended distribution OOD detection task.", "summary_of_the_review": "The paper presents some interesting and valid discussion on OOD detection vs. generalization, proposing to leverage segmentation networks to improve OOD detection that generalizes to semantically coherent classes. However, cost aspects of requiring more granular information for segmentation are not yet sufficiently addressed and discussed in my opinion.", "strength_and_weaknesses": "*Strengths*\n+ The paper contributes some helpful conceptual structure for thinking about OOD detection, essentially discussing the balance of OOD detection vs. generalization, arguing that OOD detection should generalize to semantically coherent classes (disregarding potentially spurious background correlations)\n+ The paper is well motivated and integrated into the existing literature.\n\n*Weaknesses*\n- The proposed method essentially defers OOD detection for classification to a segmentation problem, which requires more granular information (pixel-/object-level annotations). I think this aspect is not communicated clearly in the paper yet, and I think to some degree the reported improvements are expected, given the proposed model uses much more semantic information from a segmentation model.\n- On the other hand, the paper does not seem to put in much effort in testing the limits of well trained segmentation models (\"[...] as improving the training of segmentation network is beyond the scope of this paper.\"), which presents the foundation of the proposed approach. Here, I think the paper should go deeper in exploring the strengths and limits of this approach.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject