SCOPED: Score–Curvature Out-of-distribution Proximity Evaluator for Diffusion
Authors: Brett Barkley
Preston Culbertson
David Fridovich-Keil
Venue: ICLR 2026 Poster (2026)
Keywords: Out-of-distribution detection
Diffusion models
Typicality
Generative modeling
Reinforcement learning
Primary area: generative models
TL;DR: We propose the Score–Curvature Out-of-distribution Proximity Evaluator for Diffusion (SCOPED), a highly parallelizable, computationally efficient, and accurate method for detecting distribution shifts.

Abstract: Out-of-distribution (OOD) detection is essential for reliable deployment of machine learning systems in vision, robotics, and reinforcement learning. We introduce Score–Curvature Out-of-distribution Proximity Evaluator for Diffusion (SCOPED), a fast and general-purpose OOD detection method for diffusion models that reduces the number of forward passes on the trained model by an order of magnitude compared to prior methods, outperforming most diffusion-based baselines and approaching the accuracy of the strongest ones. SCOPED is computed from a single diffusion model trained once on a diverse dataset and combines the Jacobian trace and squared norm of the model’s score function into a single test statistic. Rather than thresholding on a fixed value, we estimate the in-distribution density of SCOPED scores using kernel density estimation, enabling a flexible, unsupervised test that, in the simplest case, only requires a single forward pass and one Jacobian–vector product (JVP), made efficient by Hutchinson’s trace estimator. On four vision benchmarks, SCOPED achieves competitive or state-of-the-art precision-recall scores despite its low computational cost. The same method generalizes to robotic control tasks with shared state and action spaces, identifying distribution shifts across reward functions and training regimes. These results position SCOPED as a practical foundation for fast and reliable OOD detection in real-world domains, including perceptual artifacts in vision, outlier detection in autoregressive models, exploration in reinforcement learning, and dataset curation for unsupervised training.

Published as a conference paper at ICLR 2026
SCOPED:
SCORE-CURVATURE OUT-OF-DISTRIBUTION
PROXIMITY EVALUATOR FOR DIFFUSION
Brett Barkley
Preston Culbertson
Department of Electrical and Computer Engineering
Department of Computer Science Coreell University
The University of Texas at Austin
Austin, TX, USA
Ithaca, NY, USA
@barkley@utexas, edu
ceullbert.scc@cconee ledd
David Fridovich-Keil
Department of Aerospace Engineering and Engineering Mechanics
The University of Texas at Austin Austin, TX, USA
dfk@utexas.co edu
ABSTRACT
Out-of-distribution (OOD) detection is essential for reliable deployment of ma- chine learning systems in vision, robotics, reinforcement learning, and beyond. -iitt--disttibution Proximity Evaluator for Diffu-
We introduce Score-Curvatue sion (SCOPED), fast and general-purpost OOD detection method for diffusion models that reduces the number of forward passes on the trained model by an or- der of magnitude compared to prior methods, outperforming most diffusiin-based baselines and closely approaching the accuracy of the strongest ones. SCOPED is computed from single diffusion model trained once diverse dataset, and combines the Jacobian trace and squared norm the model's score function into fixed value, estimate the
single test statistic. Rather than thresholding in-distribution density of SCOPED scores using kernel density estimation, en- abling flexible, unsupervised test that, in the simplest case, only requires single forward pass and one Jacobian-vector product (JVP), made efficient by Hutchin- son's trace estimator. On four vision benchmarks, SCOPED achieves competi- tive or state-of-the-ar precision-recal scores despite its low computational cost. The same method generalizes robotic control tasks with shared state and ac- tion spaces, identifying distribution shifts across reward functions and training regimes. These results position SCOPED as practical foundation for fast and reliable OOD detection in real-world domains, including perceptual artifacts in vision, outlier detection in autoregressive models, exploration in reinforcement learning, and dataset curation for unsupervised training. Our code is available http://gggb..oooo//e/eoooooooeee
INTRODUCTION
Duttif-distribution (OOD) detection is essential for the reliable deployment of machine learning systems in domains such as vision, robotics, and reinforcement learning. Modern models are prone to high confidence on abnormal irrelevant inputs. Icading to safety and robustness risks in real- world use (Nguyen et al.) 2015 Nalisnick et al.) 2018 2019). To address this, large body of work has explored OOD detection methods (Hendrycks et al. 2018 Liu al. 2020 Graham al., 2023 Heng et al. 2024). Unsupervised methods are especially attractive since they require only in-distribution data, making them broadly applicable regardless of the eventual downstream task.
Generative modeling has emerged as a natural tool for OOD detection, but existing methods have key limitations. Likelihood-baa based approaches suffer from well-documented pathologies, such

---

Published as a conference paper at ICLR 2026
signing higher likelihood to OOD datasets than to the training set (Nalismick et al. 2018 Choi al. 2018). Reconstruction-ue based methods, including autoencoders and diffusion reconstructions, de- pend on carefully tuned information bottlenecks and are brittle in practice (An & Cho
2015 Pinaya
et al. 2021). More recent diffusion-basee approaches such as DiffPath (Heng et al.
2024 lever-
age trajectory geometry for OOD detection, but require evaluating the model along entire denoising paths which, like earlier diffusion-
OOD methods that require many model evaluations, is com- putationally expensive and poses a serious challenge for real-time and compute- limited applications.
To address these shortcomings we propose the Score-Curvature out-of-distribution Proximity Eval- uator for Diffusion (SCOPED), a general-pune purepss alternative that requires far fewer model evalu- ations. Our method exploits fundamental intuition from information geometry (Cover & Thomas 2006]: near the typical set of distribution (i.e., for "in-distribution" samples). the local curvature of the log-probability density is related to the norm of the score function. Since diffusion models learn the score directly (Ho al.) 2020 Song et al. 202T), this curvature information can be obtained efficiently by a single Jacobian-vector product (JVP) through the trained model, provided the diffu- sion step chosen appropriately. SCOPED constructs a simple statistic that summarizes the balance between curvature and score function norm, which serves query point is in- or diatr---iisribution. Computing this statistic requires an order of magnitude fewer evaluations than the 10-1000 calls typical of prior diffusion-based OOD detection methods (Mahmood et al. 2020 [enn et al. 2024). In addition, we introduce a simple offline procedure for selecting the diffusion step at which SCOPED is applied. Guided by the monotone decay of the signal-to-na tignal-to-noise ratio under the forward diffusion process, we compute the SCOPED test statistic at step early- and mid-way way through the denoising schedule (chosen using only in-distribution data), ensuring robustness without any tuning on OOD datasets.
reliable signal for whether given
We first validate SCOPED in reinforcement learning, a setting where the notion of in ii-iitrribution vs. out-of- distribution data is less clear-cut than in vision. Environments can share identical dy- namics yet differ in rewards (e.g., reacher-easy vs. reacher-ha humano i d-wa k), and independently trained policies can induce distinct tions even within the same task. On the DeepMind Control Suite (DMC) (Tassa et al. 2018) and D4RL Gym benchmarks (Fu et al., 2020), SCOPED successfully separates such distribution shifts in proprioceptive RL domains. Detailed comparisons, including the effects of dataset diversity and replay mixtures, are provided in Section [.1]
humano d- snand vs. distribu-
We then turn to vision, where standardized baselines enable rigorous comparison. Across four benchmarks (CIFAR-10, SVHN, CelebA, CIFAR-100), SCOPED achieves competitive state-of- the-art Area Under the Receiver Operating Characteristic curve (AUROC) scores while requiring an order of magnitude fewer diffusion model evaluations than most prior methods. Importantly, the same base diffusion model as the most comparable prior work (Heng et al. (2024). making clear that our efficiency gains are algorithmic rather than a consequence of dataset or model differences.
Key Contributions:
1. We introduce SCOPED, an OOD detection method that leverages information- theoretic connections between statistic. SCOPED requires an order of magnitude fewer evaluations than compet- ing diffusion-basel methods, and unlike path-based approaches its probes are independent and can be fully parallelized across samples and timesteps. We also propose simple offline noise-level selection strategy using only in- distribution data.
norm and curvature to define single test
2. We provide a comprehensive evaluation of SCOPED across both proprioceptive re- inforcement learning settings (DMC, D4RL) and vision benchmarks (CIFAR-IO, SVHN, CelebA, CIFAR-100), showing that dataset choice fundamentally shapes OOD separability and that SCOPED achieves competitive state-of-the-art AU- ROC on vision tasks.
2

---

Published as a conference paper at ICLR 2026
2
BACKGROUND
Our method applies to both discrete-time Denoising Diffusion Probabilistic Models (DDPMs) Ho al. 2020) and continuous- Elucidated Diffusion Models (EDMs) (Karras al. 2022 which
are two widely used and mathematically connected formulations of score-based diffusion.
2.1 SCORE-BASED DIFFUSION MODELS
Diffusion models (Sohl-Dicksteni et al. 2015 Song al. 2021) train neural network to approxi- mate the score function 8q (T, 1) As V= log Pt (Tt) of progressively noised data Zy. step L. Gaus- sian noise with variance of is added according over noise scales from which training samples are drawn so the network learns to denoise across the full noise range. Given noised imput, the network predicts either the score sentation (e.g. denoised data or noise), from which the score can be recovered; see Appendix [foo details. Sampling then integrates the corresponding reverse dynamics map Gaussian noise back into data. Early noise levels preserve fine detail, while later ones retain only coarse structure.
schedule that grows with I, defining distribution
equivalent repre-
DDPM and EDM discrete and continuous instances of this shared framework: both ultimately train a network to approximate V. log (x+). This common structure underlies our OOD detec- tion method. For completeness, we provide a more detailed derivation of DDPM, denoising score matching, and EDM in Appendix
2.2 TYPICALITY AS MEASURE OF OOD
A core idea in information theory is that typical outcomes of random process are not necessarily the most probable. Typical sets are classically defined in terms of sequences: a sequence of i.i.d. draws [21, [nJ ~ p 5-typical if
H(p) - 55 - 22, ,,,,,,,,,,,,,.. S H() 6
where (p)) -EE p(x)] is the (differential) entropy of density p. The asymptotic equipartition property (AEP) ensures that, in the limit n - co, any sequence { will be O-typical with probability (Cover & Thomas 2006).
Although the typical set is defined terms of i.i.d. sequences, it is also natural to discuss typicality for length = sequences of high-dimensional distributions. Consider the example of isotropic Gaussian distribution in high dimension d, where the density is maximized at the mean, yet almost all mass lies in a thin shell with radius vd. This counterintuitive phenomenon, sometimes referred as the Gaussian annulus theorem /Vershynim 2018 Nalisnick et al. 2019), tells us that with high probability any random draw will lie on the shell, rather than near the mode at the origin. This shell precisely the set of points at which -lo ((x) = Hp)).
This perspective has two consequences for OOD detection. First, it explains why likelihood- based methods can fail: points with high density may be atypical if they fall outside the shell where mass concentrates. Second, it suggests that in-distribution data should lie in the typical set. Formally, then, we define OOD points as follows.
Definition (5-0OD points) We call sequence of n points, {21, In 5-0OD for distribation p if they are not 8-typical.
In practice we seek to identify length n = 5-OOD sequences, with 5 specified indirectly by comparing the test statistic to adaptive threshold calibrated on in-distribution data.
2.3 THE ECORE-CURVATURE RATIO
Let p(z) be nondegenerate density and define the score s(x) == - ((z). Under standard regularity conditions, classical results provide two equivalent expressions for the Fisher information:
Ep V log](=)] -E [s(x)) sx) [[))
hence
[r (V.s(1))] Ep [1Is(=)]1]]
3

---

Published as a conference paper at ICLR 2026
cf. (Gallager 2013). The local curvature
x(x) Tr (V2s(1) Tr (V2 log p(x))
nonnegative for log-concave models and positive for Gaussians. For in-distribution samples drawn from p, therefore, the expected score magnitude (measured by p) matches expected curvature.
Nevertheless, one still define the statistic
|s(x)]1 <(x))
T(x)
for any point a at which x(x) # O, with the intuition that high-dimensional distributions will assign virtually all probability mass typical samples, with -lg p(z) Ra (p) and at which T(x) R 1. For numerical stability, when computing T(x) we add a small e to the denominator to avoid division by zero, though in practice observe that k(x)) always takes on large values.
expect
As concrete example, consider the d-dimensional isotropic Gaussian setting: ~ _N(0, In this case the score s(r) x//0² and the curvature x(x) d/o
T(x) = ||s())]1 K(x) d
|0/|2
concentrates sharply around do2 in high dimensions, T(x) remains close the typical set, while samples far from this shell yield values that deviate substantially. This intuition forms the core of our approach: we hypothesize that the statistic ((x) is highly predictive of a point's 's membership in the ô-typical set, and propose to use it as metric for OOD detection.
Because ||ar||2
Importantly, diffusion models provide direct access both the score s(x) and the curvature k(x) (via the Jacobian trace, which can be estimated efficiently). This makes T(x) computable from single trained diffusion model chosen noise level, thereby linking the information- -heoretii notion of the typical set to practical, modell-basdd criterion for out-of-distribution detection.
final subtlety that the typicality ratio admits global sign ambiguity: the squared norm in the numerator discards orientation, while the Jacobian trace in the denominator retains sign information. We correct this with global sign factor, as detailed in Appendix [D] and confirm in Appendix thhat this correction is necessary for stable OOD performance in vision-based tasks.
FROM THE CUURRRCRUR RATIO TO A PRACTICAL OOD METRIC:
SCOPED
3.1 ACHIEVING COMPUTATIONAL EFFICIENCY
A key advantage of SCOPED over path- path-based diffusion approaches such as DiffPath (Heng et al., 2024) is its independence from serial trajectory integration. DiffPath requires propagating samples through the probability flow ordinary differential equation (ODE) with Denoising Diffusion Implicit Models (DDIM) (Song et al., 2021). where each step depends on the previous one. This makes the method inherently sequential: the cost scales linearly with the number of integration steps, and timesteps cannot be parallelized. As result, the number of function evaluations (NFEs) grows directly with the trajectory length.
In contrast, SCOPED probes the diffusion model at arbitrary noise levels without reconstructing the full denoising path. Fach statistic is computed from forward evaluation and single JVP at a chosen timestep, independent of all other timesteps. This independence means that (i) NFEs are reduced by roughly order of magnitude compared to path-based methods, since only handful of strategically chosen timesteps are required, and (ii) those evaluations are not serially dependent and therefore be fully parallelized across both samples and timesteps modern accelerators. In practice, this combination reduced counts and effective parallelism yields efficiency gains that exceed what NFE tallies alone would suggest.
A second source of efficiency comes from curvature estimation. Naively, evaluating the Jacobian trace Tr TT()):(z:)) is prohibitively expensive in high dimensions. We instead employ Hutchinson's
4

---

Published as a conference paper at ICLR 2026
3
stand walk
stand walk
Density
Density
2
0.5
0.0
0
10
20
30
10
20
30
OOD
(a) Trained on humancid-wal
(b) Trained on humanoid-sten
Figure 1:
Distribution of SCOPED OOD scores T(x) for humanoid and humano i walk transitions. In-distribution evaluations concentrate near with tight quantiles, while cross-task evaluations shift upward and become more dispersed, indicating separability.
stochastic trace estimator (Hutchinson, 1989, which uses randomized projections to form unbi- ased estimate with cost linear in the dimension. Each probe requires only a single JVP with the score network, avoiding explicit Jacobian matrix formation. In practice, single probe is often sufficient, and averaging a few probes can further reduce variance (Pearlmutter 1994 Martens] (2110). This makes SCOPED a given noise level comparable cost one additional forward pass of the score network, since Hutchinson's 's estimator avoids building the full Jacobian.
Together, these properties make SCOPED practical at scale: order of magnitude fewer NFEs than path-based diffusion methods, parallelism across timesteps and samples, and curvature estimation that avoids the quadratic cost of explicit Jacobian formation, requiring only a few JVPs.
3.2 MOTIVATION AND OOD DETECTION WITH KERNEL DENSITY ESTIMATION
Although T(x) measures typicality and is feasible to compute with Hutchinson's estimator, its raw values are not universally calibrated across datasets, diffusion noise levels, or models. On its own, T(x) is therefore not reliable discriminator of in-distribution (ID) versus out-of-distribution (OOD) data. We illustrate this with simple RI. example, then motivate our approach for calibration.
Motivating example in reinforcement learning. We train high-proficiency Soft Actor-Critic (SAC) policies (Haarooj et al. 2019) on numanoid-stand and humanoid-wal which are nigh-dimensional. proprioceptive, continuous control robotics tasks from the Deep.Mnid Control Suite (Tassa et al. 2020) with identical dynamics but non-overlapping rewards. Each trained pol- icy is rolled out deterministically to create a transition replay buffer of Doservation-action-- observation-reward tuples per task. We fit an Elucidated Diffusion Model (EDM) denoiser (Lu) ct al. 2023) to each dataset and evaluate the typicality ratio T(x) on each transition in both ID and cross-task buffers. As shown in Figure ID evaluations per transition concentrate near 1 with tight quantiles, while cross-task evaluations shift upward and become much more dispersed. This pair of datasets is trivially separable via the T(z) statistic, which serves sanity check that T(x) can capture distributional differences; however, we will see below that care must be taken to choose an effective threshold when data is not trivially separable.
Calibration for practical detector. Despite the separation in the above example, absolute T(x) values are not always comparable across datasets and models, so a fixed threshold is unreliable. Dur- ing training we have access to ID samples. We therefore compute T(x: on ID data, and fit density to these values using kernel density estimation (KDE), which estimates a smooth probability density by placing Gaussian kernels around each observed value. The result is continuous estimate of the ID test statistic distribution without assuming a specific parametric form. This converts typicality into a calibrated anomaly score, given by llog (T(x))) where h is the KDE fit in-distribution values of T(r), which we use for OOD detection with empirical results in Section 5
It is important to note, however, that the effectiveness of this calibration depends on the domain and the dataset used to train the diffusion model, which need not coincide with the ID data. this RL example, we found that separability between humanoi d-stand and humano d-wal k was
5

---

Published as a conference paper at ICLR 2026
robust to the choice of training dataset without introducing the KDE concept. In contrast, as we show in Section and mirroring prior work (Heng et al. 2024), training dataset choice plays a critical role in vision-based settings and even other proprioceptive datasets, where separability can be strongly affected by the diversity and coverage of the training distribution.
3.3 OFFLINE SELECTION OF NOISE LEVELS FOR SCOPED
Choosing the noise level is crucial for balancing retained signal with injected noise.
For our proprioceptive D4RL, and DMC tasks, we evaluate at a single noise level approximately three-quarters of the way through the noise schedule where empirically found separation to become trivial under (zx) between in-distribution and out-of-distribution data.
In contrast, for vision experiments, we estimate the signal-to-noise ratio (SNR) of the distri- bution (xt) offline using only in-distribution data (cf. Appendix E at different points along the forward diffusion process t. SNR decays monotonically: early timesteps preserve fine detail, while later ones approach noise dominance. To ensure robustness across this spectrum, we evaluate SCOPED at two points: early step
1) that maximizes fine information, and mid-level step (t = 300) where about 95% of the signal remains, the SNR curve enters a roughly linear decline, and coarse structure is retained while some fine detail is suppressed.
For each test input we compute anomaly scores (negative log-likelihoods under the KDE fit) at both timesteps and take their maximum as the final anomaly score. This is fully unsupervised, requires only ID data, and adds negligible cost since the KDE fit is precomputed offline and only the typicality ratio is evaluated online. Specifically, we fit a KDE data at the chosen timesteps and compute the negative log-likelihood of the typicality score for test input under this density model. For evaluation we report AUROC, which threshold-fres whereas for deployment a cutoff can be set from ID) data.
curvature statistics of ID
We define two reference variants. SCOPED (Single) fixes the noise level at 300, chosen once from in-distribution data using the same procedure above. SCOPED (Oracle) assumes knowl- edge of the best-performing timestep for each ID/OOD dataset pair, providing an informative but unattainable upper bound.
We emphasize that, unlike prior diffusion- based methods such as DifiPath (Heng et al. 2024). which sweep hyperparameters OOD benchmarks, SCOPED selects noise levels using only in- distribution data. Our ablations show robustness, not tuning.
RELATED WORK
Out-of-distribution (OOD) detection has been studied through confidence scores (Hendrycks al.; 2018 Liang et al. 2017), generative likelihoods (Nalisnick et al.] [019] Choi et al.) 2018: Ren al. 2019), and reconstruction methods (An & [ Pinaya et al. 2021). While effective in narrow cases, these approaches often fail under dataset shifts, such as high likelihoods on OOD data or sensitivity of autoencoder reconstructions bottleneck design.
Diffusion models have recently been applied to OOD detection through reconstruction (Graham al. 2023 Liu et al. 2023) and through score-based or trajectory- statisties (Mahmood
et al. 2020 Heng et al. 2024). However, such approaches often rely on multiple evaluations across timesteps or full denoising paths, and remain limited by the broader challenge that training OOD detectors only on ID data is misaligned with the OOD objective (Li et al.) 2025). SCOPED ad- dresses these issues by deriving a single statistic from the score and its curvature at a chosen noise level, which reduces computation and grounds detection in generative model geometry. It can also incorporate a foundation dataset alongside ID data to mitigate the ID-only misalignment. To our knowledge, SCOPED is also among the first approaches to validate diffusion- based OOD detection on RL benchmarks, including D4RL and the DeepMind Control Suite (Fu et al. 2020 Tassa et al. 2018).

---

Published as a conference paper at ICLR 2026
5 RESULTS
As in prior work, experiments here compare OOD detection across dataset pairs.
For RL, we generate transition tuples (observation, action, next observation, reward) from Deep- Mind Control Suite (DMC) tasks such as humanoid-stand and humanoid-wal (Tassa et al. 2018), as well OpenAI Gym tasks (Brockman al. 2016) from the offline D4RL benchmark (Fu et al. 2020). These cover a range of continuous control problems and allow us to examine shifts across reward functions and independently trained policies. Since OOD baselines are over- whelmingly vision-focused, we use these RL tasks primarily as sanity checks and case studies, not competitive benchmarks.
For vision-based tasks, we evaluate OOD detection on CIFAR-I0 (C10), SVHN, CelebA, and CIFAR- (C100), which cover both x 32 and 64 x 64 resolutions. We use Denoising Diffusion Probabilistic Models (DDPMs) (Ho et al. 2020), trained unconditionally
CelebA to match the strongest comparable baselines (Heng et al.. 2024). Following Henn et al. (2024), we adopt a con- sistent resizing procedure to avoid artifacts that simplify detection due to data fidelity discrepancies: when datasets have different original resolutions, match the power-resolution set, and both are then upsampled to the model's input resolution. This ensures consistent blur across datasets and prevents artificially inflated OOD detection performance.
images are first downsampled to
We benchmark performance in vision tasks against strong generative baselines, including DiffPath (Heng et al., 2024), IGEBM (Du & Mordatch| 2019), VAEBM (Xiao et al., 2022), and Improved
CD (Du al. [021) We also include likelihood-driver tests, namely Input Complexity (Serrà al.)
2019)
Density of States (Morningstar et al. (021). WAIC (Choi et al. 2018). Typicality (Nalisnick)
2019). and the Likelihood Ratio (Ren et al. 2019) applied to Glow (Kingma & Dhariwal, 2018 Finally, we compare to diffusion- baade baselines: vanilla NLL, Input Complexity computed from diffusion model likelihoods, and implementations of DDPM-OOD (Graham et al. 20.3). LMD (Liu et al. 2023), and MSMA (Mahmood et al. 2020). We report AUROC and computational cost measured as the number of function evaluations. defined as forward passes. For comparability, our method also performs one Jacobian-vector product per evaluation, and we note this cost in the totals.
al.
5.1 REINFOR LEARNING CASE STUDIES
We first consider reinforcement learning, a domain where the definition of in-distribution is inher- ently ambiguous. Environments can share identical dynamics while differing in rewards, and even within a single task, different policies can induce markedly different state-action distributions due the highly stochastic nature of RL training. To capture these axes of divergence, we evaluate SCOPED across three categories: reward changes (c.g. reacher- r-aas vs. teacher-hard humanoi and vs. humanoid-walk), transitions induced by different behavior policies as collected in different replay buffer realizations (e.g., realizations that differ only by random seed (e.g., reacher-hard seed vs. seed B).
vs. ant ant-expert), and policy
DMC results. On Deep Control Suite tasks, SCOPED achieves perfect separation across all tested shifts (Appendix(C) GJ Table These results validate that the method captures distributional di- vergence not only in cases where the state-action-ees reward distributions are clearly non-overlapping, such as humanoi i-ddiantand versus humanoi d-wall k (cf. Figure T.. but also in settings where overlap is expected, such as finger-turn reacher tasks. In these latter cases, the same dynamics and similar reward structures generate transitions that occupy overlapping regions of the state-action space, yet SCOPED still produces strong separation and perfect oul-of-distributio de- tection accuracy. This outcome would not have been obvious priori and suggests that the statistic is sensitive more subtle distributional cues than reward specification alone. While these experiments may appear straightforward a posteriori, they serve as valuable sanity checks: they confirm that SCOPED behaves in line with intuition when distributions are clearly distinct, while also demon- strating sensitivity in cases where overlap exists and separability is less obvious. Together, they provide a foundation before turning to more challenging benchmarks.
D4RL results. The D4RL benchmarks provide more nuanced picture (cf. Figure 2 Each dataset is collected from a different behavior policy (Fu et al., 2020): random from an untrained agent, expert from fully trained SAC policy, medi um from partially trained policy at about
7

---

Published as a conference paper at ICLR 2026
one-third expert performance, and mediun-replay from the full replay buffer of the medium agent throughout training, which more diverse but also noisier due to exploratory behavior.
In hopper-v2 and walker2d-v2, SCOPED achieves near-perfect AUROC across most pairs, while ant-v2 is harder, especially for medium vs. expert or medium-replay. A key observation is that training the most diverse dataset (medium-replay) does not produce the strongest detector: it consistently underperforms Hopper and Walker, and only conditionally helps in Ant.
Although counterintuitive, this result is consistent with vision-based OOD methods (Heng et al. 2024) that rely on a single foundation model rather than ID training: performance depends heavily on the choice of training distribution, and more diversity of dataset coverage does always help. In RL. termination conditions constrain random or partially trained agents to narrow regions of state space, while replay mixtures add noisy and inconsistent trajectories. This makes superficially diverse buffers more entangled and less separable. In contrast, proficient and diverse policies such as expert agents generate broad but coherent coverage, sharpening the boundary between in- and out- of-distribution as is consistently shown by our results. Dataset choice is therefore central factor in RL OOD detection, and intuitions from vision that "more coverage helps" do not transfer directly.
Ant
Hopper
Walker2d
R
0.53
1.00
R
1.00
1.00
0.48
0.73
1:00
0:59
0.98
E
0.79
0.55
0.76
1:00
1.00
1.00
E
1:00
1:00
1:00
MR
0.54
0.50
0.50
MR
0.02
0.69
0.74
MR
1.00
0.52
0.25
MR
MR
MR
Figure 2: AUROC heatmaps for D4RL. Rows indicate the training buffer and columns the OOD buffer. D4RL data is abbreviated R (random), M (medium), E (expert), and MR (medium-replay).
Interpretation. Taken together, these case studies demonstrate that SCOPED naturally extends to proprioceptive RL data while revealing important trade-off's. The DMC results serve clear sanity checks, while the D4RL results illustrate more subtle distinctions that, for example, configurations that maximize separability for one dataset pair may perform poorly for another. In partieular, ter- mination conditions and replay mixtures can make diverse buffers less separable, whereas expert datasets sharpen boundaries and yield stronger detectors. We emphasize that these studies intended as competitive benchmark, but as diagnostic explorations of how SCOPED interacts with different notions of distribution shift in RL reward changes, policy changes, and distinct policy realizations. With this foundation, we next turn to vision benchmarks, where standardized datasets and strong baselines allow more rigorous quantitative comparison.
5.2
MAIN VISION-BASED BASED RESULTS
Before turning to results, we first clarify the setup for vision-based OOD detection.
Foundation dataset. We follow Heng et al. (0024) and use an unconditional DDPM trained on CelebA (available here) as the backbone for our diffusion OOD detector. CelebA is natural choice because large and diverse, and has been shown yield strong performance prior diffusion- based OOD work. Using the same model also ensures that our results are directly comparable to the strongest diffusion-basee baselines, without confounding effects from architecture or training dif- ferences. In this setting CelebA serves as the foundation dataset for model training, while ID/OOD evaluation carried out across CIFAR-10, S SVHN, CelebA, and CIFAR-100.
Results. Table reports AUROC across CIFAR-IO, 10, SVHN, CelebA, and CIFAR- along with the number of function evaluations (NFE), conventionally measured as the number of forward passes through the network. To make accounting explicit, we denote a forward network evaluation as 1F and a JVP as 1J. Although the precise complexity of these operations depends implementation, and batch size, prior work has noted that a JVP has equivalent cost to approxi- mately one forward (Baydin al. 2018), so we adopt the convention that 1 1F, Each SCOPED
architecture,
8

---

Published as a conference paper at ICLR 2026
evaluation therefore requires 1F+1J J (two effective forward passes), while the two-step variant uses 2F+2J. Although this at minimum doubles the nominal cost relative to forward-only methods, the crucial difference is that SCOPED evaluations samples and timesteps. By contrast, trajectory-based methods such as DiffPath require serial in- tegration steps whose cost scales linearly with path length. In practice, this independence means SCOPED achieves substantially lower wall-clock time despite the need for a JVP.
independent and can be fully parallelized across
With this setup, the results show that SCOPED achieves competitive or state-of-the-ar detection accuracy while requiring orders of magnitude fewer effective function evaluations than prior meth- ods. The default two-step variant (2F+2J) offers robustness across dataset pairs while remaining far cheaper than trajectory-bused approaches. Ablations over different early-mid step pairs (Ap- pendix D confirm that AUROC remains consistently high across choices, demonstrating that the two-step procedure provides robust performance across timesteps.
We also evaluate SCOPED (Single), which fixes the noise level at f 300 chosen once from in- distribution data. By omitting the earlier fine-detail step, this variant sacrifices some robustness, yet it demonstrates that strong performance is achievable with only 1F+1J. Ablations varying the mid-step choice (Appendix H confirm that performance remains relatively insensitive to the exact choice of step.
Finally, SCOPED (Oracle) assumes knowledge of the best-performing timestep for each ID/OOD dataset pair, constructed by selecting the single step that yields the highest AUROC (highlighted in bold in 3)b While unavailable practice, it provides an informative upper bound. Importantly, all noise levels for SCOPED and SCOPED (Single) are selected using only in-distribution data; un- like some prior diffusion-basse OOD methods, our ablations do not tune against OOD benchmarks, preventing evaluation leakage.
Table I: AUROC scores for in- out-of-distribttion tasks. Higher is better. Underline second best, bold best (Oracle excluded). Because SCOPED evaluations are independent across samples and timesteps, they parallelize fully, making wall-clock cost substantially lower than path-based methods despite the additional JVPs. We report computational cost as #F + #J, where F denotes a forward pass and J Jacobian-vector product. Baseline results reproduced from Heng et al. (2024) with the omission of the Textures dataset, which we discuss in Appendix
Method
SVHN vs CelchA
CelebA vS
Arg
#J
SVHN
ColebA
C100
C10
C100
C10
SVHN
C100
IC
0.950
0.863
0.736
IGEBM
0.630
0,700
0.500
YAEBM
0.830
0.770
0.620
Improved
0,910
0.830
DoS
0.955
0.995
0.571
0.962
1.00
0,965
0.949
0.997
0.956
0.928
WAIC
0.143
0.928
0.532
0.802
0.991
0.831
0.507
0.139
0.535
0.601
TT'
0.870
0.848
0.548
0.970
1.00
0.965
0.634
0.982
0.671
0.832
IR
0.064
0.914
0.520
0.819
0.912
0.779
0.323
0.028
0.357
0.524
Diffasion-based
NLL
0.574
0.990
0.814
1000
IC
0.921
0.516
0.519
0.080
0.028
0.100
0.485
0.972
0.510
0.459
1000F 0J
MSMA
0.957
1.00
0.995
DDPM-OOD
0.390
0.659
0.536
0.951
0.986
0.945
0.795
0.636
0.778
0.742
350F + 0.0
LMD
0.992
0.557
0.604
0.919
0.890
0.881
0.989
1.00
0.979
0.868
10"r 0.
Curvature and Diffusion- Based
DiffPath
0.910
0.897
0.590
0.939
0.979
0.953
0.998
1.00
0.998
0.918
IOP OC
SCOPED
0.814
0.940
0.971
0.996
0.959
0.925
0.994
0.892
2
SCOPED (Single)
0.774
0.867
0.460
0.976
1.00
0.966
0.938
1.00
0.971
0.884
IF 1J
SCOPED (Oracle)
0.964
0.885
0.768
0.993
1.00
0.975
0.938
1.00
0.971
0.944
1F+ 1J
6 CONCLUSION
In this work we introduced SCOPED, diffusion- based OOD detection method that leverages the curvv-curv ratio as simple, theoretically motivated, and computationally efficient test statistic that is highly paralletizable. Unlike prior approaches that require long diffusion trajectories many

---

Published as a conference paper at ICLR 2026
function evaluations, SCOPED achieves competitive state-of-theeart performance both vision and RL benchmarks while reducing model evaluations by an order of magnitude.
Our experiments demonstrate that SCOPED generalizes across domains, cleanly separating distri- bution shifts in RL and delivering strong accuracy on standardized vision benchmarks. These results show that efficiency and robustness need not be traded off, and that simple geometric properties of the score function provide powerful signals for detecting atypical inputs.
Looking ahead, the success of SCOPED suggests broader design principle: OOD detection can be grounded in the geometric statistics of generative models rather than expensive likelihood or path- based estimators. Future work could combine SCOPED with methods, integrate it with exploration strategies in RL. or extend it to autoregressive models and multimodal domains. We hope that SCOPED provides both practical tool for fast OOD detection and conceptual bridge between information-theoreti typicality and generative model geometry.
advanced noise-step selection
Reproducibility Statement We have taken several steps to ensure the reproducibility of our re- sults. Implementation details for SCOPED are provided in Appendix [F] with full descriptions of noise level selection in Section 3.33 score computation in Appendix C and sign correction in Ap- pendix D Additional ablations, including single-step versus two-step variants and noise-level sensi- tivity, are reported in Appendix and Appendix[] Vision experiments use the open-source CelebA DDPM checkpoint from Heng et (2024), RL experiments rely the standard D4RL datasets and our own trained diffusion models. We have released the code for the vision experiments to ensure easy replication and it is available at http://gtttbboommmcccccoootttttt
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Jinwon An and Sungzoon Cho. Variational autoencoder based anomaly detection using recon- struction probability. 2015. URL https: httpp//p..eaaanissccoooaa....ooa www.:/aarrrrg/ooousooooooo
36663713
Atilim Gunes Baydin, Barak A. Pearlmutter, Alexey Andreyevich Radul, and Jeffrey Mark Siskind. Automatic differentiation in machine learning: A survey. Journal of Machine Learning Research, 18(153):1 43, 2018.
Greg Brockman, Vicki Cheung, Ludwig Pettersson, Jonas Schneider, John Schulman, Jie Tang, and Wojciech Zaremba. Openai gym. arXiv preprint arXiv:1606.01540, 2016.
Hyunsun Choi, Eric Jang, and Alexander A Alemi. Waic, but why? generative ensembles for robust anomaly detection. arXiv preprint 11Xiv:1810.01392..22 2018.
Thomas M. Cover and Joy A. Thomas. Elements of Information Theory. Wiley-Interscience, Hobo- ken, NJ, 2 edition, 2006.
Yilun Du and Igor Mordatch. Implicit generation and modeling with energy based models. In Advances in Neural Information Processing Systems, volume 32, 2019.
Yilun Du, Shuang Li, Joshua Tenenbaum, and Igor Mordatch. Improved contrastive divergence training of energy-based models. International Conference on Machine Learning, pp. 2837- 2848. PMLR, 2021.
Justin Fu, Aviral Kumar, Ofir Nachum, George Tucker, and Sergey Levine. D4rl: Datasets for deep data-driven reinforcement learning, 2020.
Robert G. Gallager. Stochastic Processes: Theory for Applications. Cambridge University Press, 2013.
Mark S Graham, Walter HL Pinaya, Petru-Daniel Tudosiu, Parashkev Nachev, Sebastien Ourselin, and Jorge Cardoso. Denoising diffusion models for of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2948-99889999 29448-297,,20 2023.
Tuomas Haarnoja, Aurick Zhou, Kristian Hartikainen, George Tucker, Sehoon Ha, Jitendra Tan, Vikash Kumar, Henry Zhu, Abhishek Gupta, Pieter Abbeel, and Sergey Levine, Soft actor- critic algorithms and applications. Attps::/arxx:: org. wwwpo////////.......././//..aaaa 05905 2019. arXiv preprint.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 18Xiv:1812.044: 244606, 2018.
Alvin Heng, Harold Soh, et al. Out-of-distribution detection with a single unconditional diffusion model. Advances in Neural Information Processing Systems, 37:43952-443977 2024.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 33, pp. 6840-6851, 2020.
Michael F. Hutchinson. A stochastic estimator of the trace of the influence matrix for laplacian and Computation, 18(3):1059-
smoothing splines. Communications in 1076, 1989.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. Advances in neural information processing systems, 35:26565-26577, 2022.
Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1xl convolutions, In Advances in Neural Information Processing Systems, volume 31, 2018
Yucen Lily Li, Daohan Lu, Polina Kirichenko, Shikai Qiu, Tim GJ Rudner, C Bayan Bruss, and An- drew Gordon Wilson. Out-of- distrribibt detection methods answer the wrong questions. arXiv preprint XxXv:25077.0881 2025.
11

---

Published as a conference paper at ICLR 2026
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint arXiv:1706.02690, 2017.
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribunn detec- tion. Advances in neural information processing systems, 33:21464-21475, 2020.
Zhenzhen Liu, Jin Peng Zhou, Yufan Wang, and Kilian Q Weinberger. Unsupervised out-of- distribution detection with diffusion inpainting. In International Conference on Machine Learn- ing. pp. 22528-22538 PMLR, 2023.
Cong Lu, Philip Ball, Yee Whye Teh, and Jack Parker-Holder. Synthetic experience replay. Ad- vances in Neural Information Processing Systems, 36:46323-46344, 2023.
Ahsan Mahmood, Junier Oliva, and Martin Styner. Multiscale score matching for ouitt--disttibution detection. arXiv preprint 0rXiv:2010.131333 2020.
James Martens. Deep learning via hessian-free optimization. In Proceedings of the 27th Interna-
fional Conference Machine Learning, pp. 745-742, 2010.
Warren Morningstar, Cusuh Ham, Andrew Gallagher, Balaji Lakshminarayanan, Alexander A Alemi, and Joshua Dillon. Density of states estimation for out of distribution detection. In International Conference on Artificial Intelligence and Statistics, pp. 3232-3240 PMLR, 2021.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't 't know? arXiv preprint arXIv:1810.001136, 2018. 2018.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, and Balaji Lakshminarayanan. Detect- ing out-of-distribution imputs to deep generative models using typicality. arXiv preprint 12XXv:1906.02994, 2019.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confi- dence predictions for unrecognizable images. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 427-436, 2015.
Barak A. Pearlmutter. Fast exact multiplication by the hessian. Neural Computation, 6(1):147-160 1994.
Walter Hugo Lopez Pinaya, Petru-Daniel Tudosiu, Robert Gray, Geraint Rees, Parashkev Nachev, Sébastien Ourselin, and M Jorge Cardoso. Unsupervised brain anomaly detection and segmenta- tion with transformers. arXiv preprint 102. 2021.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark DePristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distributtin detection. In Advances in Neural Information Processing Systems, volume 32, 2019.
Joan Serrà, David Álvarez, Vicenç Gómez, Olga Slizovskaia, José F Núñez, and Jordi Luque. Input complexity and out-of-distributin detection with likelihood-base generative models. In Inter- national Conference on Learning Representations, 2019.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan. and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learn- ing. pp. 2256-2265. pmlr, 2015.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- tional Conference on Learning Representations, 2021. URL
Foorum?d==PTTIGT - Forumm21-=PX111122RR
Yuval Tassa, Yotam Doron, Alistair Muldal, Tom Erez, Yazhe Li, Diego de Las Casas, David Bud- den, Abbas Abdolmalcki, Josh Merel, Andrew Lefrancq. et al. Deepmind control suite. arXiv preprint arXiv: /801 2018.
12

---

Published as a conference paper at ICLR 2026
Yuval Tassa, Saran Tunyasuvumakool, Alistair Muldal, Yotam Doron, Peter Trochim, Steven Liu, Steven Bohez, Josh Merel, Tom Erez, Timothy Lillicrap. and Nicolas Heess. dm.control: Soft- ware and tasks for continuous control. Software Impacts, 6:100022, November 2020. ISSN 2665- 9638. doi: 10. 00.1016).simpa.2222.. 100022. URL. http:::::aaaww..or///////aa////e 2tt.////////220.22233.. 12983
Roman Vershynin. Righ--Dimensional Probability: An Introduction with Applications in Data Sci- ence, volume 47. Cambridge University Press, 2018.
Zhisheng Xiao, Karsten Kreis, Jan Kautz, and Arash Vahdat. Vaebm: symbiosis between varia- tional autoencoders and energy- baergy models. arXiv preprint arXiv:2010.00654 2020.
A USAGE OF LARGE LANGUAGE MODELS (LLMS)
LLMs were used for paper writing assistance and to aid in brainstorming, software development, and experiment design.
B OMISSION OF TEXTURES DATASET IN TABLE
In this work, we intentionally omit the Textures dataset to maintain a consistent basis for comparison across all evaluated models. While our setup follows DiftPath [Hen et al. (2024) for architectural consistency, the original study reports Textures results almost exclusively for diffusion- based ap- proaches: non-diffusion baselines, such as DoS, were not evaluated on this task. Including Textures in the aggregate AUROC calculation would introduce an asymmetric evaluation, as diffusion meth- ods would benefit from an additional easily separable data points ( 0.999) that are unavailable to other methods, preventing direct and fair comparison of mean performance.
Furthermore, these near-perfect scores on Textures dominate the overall average and artificially inflate DifiPath's 's relative ranking to second place. Removing this dataset restores uniform evalua- tion protocol where all methods are assessed on the same benchmarks, which places DiffPath third behind DoS and MSMA. Overall, because Textures is (1) trivially easy for diffusion models, (2) missing for key baselines, and (3) statistically skews the relative performance hierarchy, we report averages only over benchmarks common to all prior methods.
C ADDITIONAL BACKGROUND ON DIFFUSION MODELS
Diffusion models (Sohi-Dickstein et al. 2015 Ho et al. 2020 Song et al. 2021 Karras et al, 2022] are generative models that learn invert a forward noising process. Starting from clean data Zop po) the forward process gradually perturbs samples toward Gaussian noise, produc- ing intermediate marginals Pt (z). neural network trained to approximate the score function so (0 x Vz log (z²) across noise levels. Sampling then integrates reverse-time differential equation, expressed either stochastic differential equation (SDE) or its deterministic probabil- ity flow ordinary differential equation (ODE), to transform noise back into data. Intuitively, high- frequency details disappear at small amounts of noise, while coarse or global structure is destroyed at large noise levels (Ho al. 2020: Song et al., 2021).
DDPM. The Denoising Diffusion Probabilistic Model (DDPM) (Ho et al. 2020) defines a discrete forward Markov chain with variance schedule { Let o = - 3, and a; I[ ds and define the effective noise scale of = 1 ãt. The step-t corruption of the clean data is Vā xo OEE, <~ (~,(00,11 I).
so that p(æ,1 | mn) = NN a Do. 0) A network co, is trained to predict e via
(DDPM = Ex,gor [Ilco(10, --1
Using V, log))(x)) = -0--Ep Efe| mil/ oz. define s0( = - c0(2,, t)/o,. Then
(DDPM(() Er,.. of so( t) +
which is a denoising score matching objective with noise level weight w(t) = =o where w(.)
controls the relative importance of different noise scales.
13

---

Published as a conference paper at ICLR 2026
Continuous SDE formulation. Another general view of diffusion models specifies the forward process as an SDE (Song et al. (021). Here f(z,,) t) is drift term, g() is the diffusion coefficient, and B, denotes standard Browman motion (with B, its time-reversed counterpart). These functions specify the forward noising process whose marginals are p((x)):
dx f(z,,t) dt + g(t) dBs.
2o xo<po(r),
with reverse SDE
de (z g logp((m()) + g(t) dB.
and equivalent probability flow ODE dx
= f(x,))) [ pog
dt
When viewed in this way, training reduces the denoising score matching (DSM) objective for continuous noise scales, arising from process similar to DDPM. Concretely, letting ža := 20 + are with NNO0,)) /) and > the score estimator (z o)) is trained with the loss
(D) Ex,. w(() || so(co, + =11
Here w(o) 2 0 the general weighting function across noise scales and captures parameterization or preconditioning of the model. In the DDPM setting, taking E {ox) and predicting noise recovers wt) = of as in DDPM.
EDM. One concrete instantiation of the continuous SDE framework is Elucidated Diffusion Mod- els (EDM) (Karras et al. 2022), which provides a principled continuous noise schedule (t), input and output preconditioning, and solver choices that improve stability and sample quality. EDM often parameterizes the score function in terms of denoiser Do(x, a) via the relation
Sq (2. o)) D3(0,
Connection. DDPM and EDM are both instantiations the same score-based framework: DDPM corresponds to discrete, periance-rreservnng SDE with w(t) of while EDM uses continuous noise scale and preconditioning that imply a different effective weighting. Both ultimately train network to approximate the score V log Pt (zz), providing a common foundation that our method exploits for OOD detection and highlighting the generality of our approach across diffusion model variants.
D SIGN AMBIGUITY IN THE TYPICALITY RATIO
The typicality ratio
[1 t)l
T(x) -Tr(V (1
admits global sign ambiguity. The numerator a squared norm, which removes orientation, while the denominator involves the Jacobian trace without any loss of sign information.
To enforce consistency, we multiply T(x) by a global sign factor derived from the score itself:
sign sign Σ so(
Our implementation applics this factor to all OOD scores. We show in Appendix that this correc-
tion is important for vision tasks.
E SIGNAL-TO-NOISE RATIO OF CIFAR-10
We define the fraction of signal at timestep / as
Felleam
Estean + Enoise
14

---

Published as a conference paper at ICLR 2026
where Eciean is the average energy of clean images from the dataset and Enoise is the energy tributed by Gaussian noise at timestep t. This quantity can be viewed as a normalized signal-to- noise ratio: it measures the proportion of total energy attributable to signal rather than noise, and bounded between and 1. This fraction decreases steadily with timestep, with early timesteps preserving fine detail and later ones becoming noise-dominated. All quantities are averaged CIFAR-10.
1.0
Fraction of Signal
0.8
0.6
0.4
1000
2000
3000
4000
Noising Timestep
The fraction of signal retained under the forward diffusion process decays steadily with timestep. Early timesteps preserve fine image detail, while later ones become noise-dominated.
Figure 3: Signal-to-noise ratio curve for CIFAR-10.
IMPLEMENTATION WALKTHROUGH (VISION EXPERIMENTS)
We summarize here the procedure for computing SCOPED scores the vision experiments.
1. Backbone model. We the publicly released unconditional DDPM pretrained CelebA by Henn et al. (2024) (available here) as our diffusion backbone. This ensures fair comparison recent prior diffusion-basee OOD results like (Heng al. 2024).
2. Select noise levels. For vision tasks, we evaluate at two timesteps: / 1 (fine detail preserved) and = 300 (mid-level, ~95% signal retained), chosen from the signal-to-non noise ratio curve (Appendix[B)
3. Offline calibration. Compute score and curvature values T(x) for in-distribution (ID) data at each selected noise level, and fit a kernel density estimate (KDE) to these values.
4. Test-time scoring. For each candidate input zo. corrupt F, the chosen timestep, run the model to obtain the score sp (Zt, 1), and estimate curvature <(xx) = Tr(V Tr(Vaso(E2,,)) using Hutchinson's 's trace estimator.
5. Form the statistic. Compute
T(x) [2, t)ll
-x(x's +
and apply a global sign factor described in Appendix D where 0 is small constant added for numerical stability to avoid division by zero.
6. Aggregate across timesteps. For each timestep, evaluate T(x) under its ID KDE and compute the negative likelihodd (NLL).
(a) In the two-step variant, take the maximum NLL across the two preselected timesteps as the anomaly score.
(b) In the single-step variant, use the NLL at a single preselected timestep only.
(c) In the oracle variant, select the single timestep that yields the highest AUROC with hindsight.
15

---

Published as a conference paper at ICLR 2026
7. Thresholding. For evaluation report AUROC (threshold-free For deployment, cut- off can be fixed from ID data alone, e.g., the (1 - a) quantile of the in-distribution score distribution, where is the desired false positive rate (c.g., 0.05 corresponds to 5% ID false alarm rate).
G OFFLINE DMC RESULTS
We provide results for SCOPED on offline DeepMind Control Suite (DMC) replay buffers col- lected by deploying SAC policies to proficiency in various tasks. These experiments test whether SCOPED distinguish distribution shifts induced by either different reward functions (c.g., humanoid-ster
vs. humanoi sooooiddwlll or by in- dependently trained policies within the same task. As shown in Table SCOPED achieves perfect separation (AUROC = 1.0) in all cases.
reacher-easy vs. reacher-ha
Table 2: SCOPED AUROC scores under DMC environment shifts.
Case
Train buffer
Eval buffer
AUROC (OOD)
Reacher
easy + hard
1.000
hard - easy
1.000
Finger-Tumm
easy - hard
1.000
hard > easy
1.000
Humanoid
stand - walk
1.000
walk + stand
1.000
Reacher hard policy realizations
seedA seedB
1.000
seedB + seedA
1.000
Finger hard policy realizations
seedA seedB
1.000
seedB + seedA
1.000
H ABLATION OVER SINGLE STEP CHOICES IN NOISE SCHEDULE FOR SCOPED
We ablate the choice of timestep when SCOPED is deployed single noise level. Table reports AUROC across vision dataset pairs for individual timesteps as well as an oracle baseline that selects the best-performing timestep with hindsight. Average AUROC is highest at mid-level timesteps, though performance at individual steps still varies across dataset pairs. This bolsters our claim, based on the SNR study, that combining early and mid-level evaluations yields more robust detector than relying on a single fixed step.
Table 3: AUROC when SCOPED is deployed at individual timesteps in the noise schedule. Bold entries indicate the best value each column. The SCOPED (Oracle) row assumes a priori knowl- edge of both in-distribution and diitt--distriuution data and selects the timestep in the denoising schedule that maximizes AUROC.
Timestep
C10
SVHN ColebA
CelebA SVHN
Avg
SVHN
ColobA
C100
C10
C100
C10
C100
0.6671
0.8852
0.7678
0.8058
0.8773
0.6534
0.9164
0.8891
0.7247
0.7985
0.7241
0.7346
0.5570
0,8830
0.9645
0.8913
0.5437
0.8689
0.5601
0.7497
0.7812
0.6241
0.5459
0.9081
0.9816
0.9053
0.6319
0.9474
0.6425
0.7742
0.8031
0.5793
0.5465
0.9188
0.9644
0.9159
0.6257
0.9630
0.6472
0.7755
100
0.9118
0.3645
0,5448
0.9623
0.9887
0.9540
0.6357
0.9797
0.6790
0.7801
100
D.7744
0.8672
0.4596
0.9757
1.0000
0.9655
0.9383
1,0000
0.9705
0.8835
0.9957
0.91
500
0.8585
0.6506
0.4848
0.9235
0.9376
0.9357
0.8144
0.9628
0.8773
0.8272
SCOPED (Oncle)
0.9638
0.8852
0.7678
0.9925
1.0000
0.9752
0.9383
1,0000
0.9705
0.9437
16

---

Published as a conference paper at ICLR 2026
1 ABLATION OVER Two STEP CHOICES IN NOISE SCHEDULE FOR SCOPED
We ablate the choice of timestep pairs when SCOPED is deployed with two evaluations. Table reports AUROC across vision dataset pairs for combinations of one early (low-noise) and one mid- level timestep. Average AUROC is consistently high across different choices, indicating that the two-step variant is robust to the precise placement of timesteps and does not depend on careful tuning.
Table 4: Ablation of timestep selection for SCOPED with NFE=2. Each row shows AUROC when pairing one early (low-noise) timestep with one mid-noise timestep from the diffusion schedule. Results are reported across three ID vs OOD benchmarks, with averages in the final column. Per- formance remains consistently high across different choices, indicating robustness to timestep se- lection.
Time Steps
C10 ColebA
SVHN CelobA
CelebA
Avg
SVHN
C100
C10
C100
C10
SVHN
C100
(1.10))
0.904
0,367
0.550
0.960
0.989
0.944
0.640
0.975
0.676
0,778
(1,200)
0,904
0.285
0.812
0.987
0.996
0.967
0.735
0.992
0.922
0.844
(1,300)
0.814
0,940
0.468
0.973
0.996
0.959
0.924
0.995
0.961
0.892
(1,400)
0.793
0,926
0.470
0.924
0.994
0.907
0.906
0.991
0.954
0.874
(1,500)
0.866
0.483
0.926
0.937
0.929
0.963
0,872
(2,100)
0.862
0,376
0.554
0,948
0.996
0.952
0.639
0.980
0,680
0,776
(2,200)
0,802
0,346
0.761
0.976
0.999
0,969
0.725
0.997
0.927
0.834
(2.300)
0.839
0,936
0.486
0.965
0.999
0.961
0.922
0.998
0.969
0.897
(2,400)
0.826
0.939
0.480
0.912
0.997
0.911
0.919
0.994
0.965
0.883
(2,500)
0,800
0.773
0.521
0.905
0.957
0.931
0.823
0.965
0,881
0.841
(3,100)
0.875
0
0.546
0.956
0.995
0.950
0.633
0.974
0.674
0.777
(3,200)
0.816
0,516
0.618
0.980
0.998
0.968
0.709
0.992
0.910
0.834
(3,300)
0,860
0.892
0.485
0.969
0.999
0.960
0.897
0.994
0.947
0.889
(3,400)
0.845
0.8%6
0.476
0.928
0.996
0.916
0.897
0.990
0.946
0.877
(3.500)
0.819
0,745
0.518
0.925
0.967
0.931
0. 0.806
0.963
0.860
0.837
(4,100)
0.891
0.395
0.545
0.960
0.995
0.953
0 0.627
0.978
0.665
0.779
(4,200)
0.858
0.509
0.595
0.984
0.998
0.970
0.702
0.993
0.882
0.832
(4,300)
0.877
0.840
0.490
0.971
0.998
0.962
0.888
0.995
0.931
0.884
(4,400)
0.864
0.853
0.479
0.934
0.996
0.919
0.876
0.992
0.928
0.871
(4,500)
0.851
0.681
0.520
0.933
0.968
0.940
0.801
0.967
0.847
0.834
(5.100)
0.897
0.398
0.545
0,963
0.995
0.955
0.624
0.978
0.661
0.780
(5,200)
0.871
0.503
0.587
0.985
0.998
0.969
0.706
0.993
0.871
0.831
(5,300)
0.882
0.815
0.487
0.972
0.998
0.963
0. 868
0.995
0.919
0.878
(5,400)
0.871
0.482
0.936
0.996
0.921
0.878
0.869
(5.500)
0.863
0.638
0.525
0.938
0.968
0.945
0.783
0.969
0.846
0.830
AVG
0,854
0.658
0.539
0.952
0.989
0.946
0.790
0.985
0.865
0.842
J ABLATION OVER TWO STEP CHOICES IN NOISE SCHEDULE FOR SCOPED WITHOUT SIGN AMBIGUITY TERM
We repeat the two-step ablation without applying the global sign correction described in Ap- pendix D T that while AUROC remains non-trivial when SCOPED is applied without sign correction, average performance drops to 0.81 compared to 0.84. This confirms that the sign term is necessary for stable performance in vision benchmarks, even though raw curvature ratios can still capture some separation.
17

---

Published as a conference paper at ICLR 2026
Table 5: Ablation of timestep selection for SCOPED with NFE-2 and sign term. Each row shows AUROC when pairing one early (low-noise) timestep with one mid-noise timestep from the diffusion schedule. Results are reported across three ID vs OOD benchmarks, with averages in the final column. Performance remains consistently high across different choices, indicating robustness to timestep selection.
Time Steps
C1O vs ColebA
SVHN vs CelobA
CelebA vs SVHN
Avg
SVHN
C100
C100
C10
C100
(1,100)
0.863
0.367
0.543
0.963
0.994
0.955
0.642
0.983
0.685
0.777
(1,200)
0.752
0,280
0.408
0.996
0.999
0.996
0.617
0.992
0.656
0.744
(1,300)
0.850
0.899
0.863
0.996
0.999
0.997
0.602
0.987
0.634
0.870
(1,400)
0.855
0.987
(1,500)
0.884
0.651
0.699
0.864
0.940
0.862
0.584
0.950
0.606
0.782
(2,100)
0.858
0.374
0.542
0.947
0.993
0,943
0.639
0,980
0.682
0.773
(2,200)
0.781
0.334
0.452
0,980
0.997
0.982
0.612
0.989
0.651
0.753
(2,300)
0.876
0.890
0.838
0,983
0.997
0.984
0.599
0.984
0.630
0.865
0,889
0.848
0.955
0.993
0.958
0.585
0.970
0,614
0.857
(2,500)
0.829
0.737
0.697
0.852
0.953
0,853
0.581
0.948
0.603
0.784
(3.100)
0,389
0.995
0.949
(3,200)
0.797
0,500
0.502
0.985
0.998
0.985
0.608
0.985
0.646
0.778
(3,300)
0,903
0.869
0.814
0.987
0.998
0.987
0.594
0.982
0.628
0.863
(3,400)
0.909
0.874
0.821
0.970
0.995
0.970
0. 5.56
0.969
0.611
0,856
(3,500)
0.835
0.715
0.626
0.878
0.965
0.875
0. 580
0.947
0.600
0,780
0,891
0.995
0.627
0.665
(4,200)
0.836
0.506
0.513
0.988
0.998
0.988
0.606
0.987
0.646
0.785
(4,300)
0.801
0.998
0.989
0.597
(4,400)
0.929
0,850
0.813
0.976
0.996
0.976
0. 585
0.973
0.611
0.857
(4,500)
0.866
0.676
0.611
0.888
0.968
0,883
0.583
0.953
0.602
0.781
(5,100)
0.897
0.398
0.545
0.963
0.995
0.955
0.624
0.977
0.661
0.779
(5,200)
0.847
0.502
0.514
0.990
0.998
0.989
0.606
0.987
0.646
0.787
(5,300)
(5,400)
0.935
0.829
0.809
0.979
0.996
0.978
0.585
0.974
0.614
0.855
(5,500)
0.878
0.600
0.891
0.968
0.887
0.581
0.954
0.603
AYG
0.867
0.645
0.664
0.957
0.989
0.955
0.602
0.975
0.633
0.810
18


Reviews:
[{"review_id": "Gt2lgA4wnr", "reviewer": "Reviewer_3dQi", "summary": "This paper presents a novel approach to detecting out-of-distribution inputs by combining a diffusion model’s score function norm with the Jacobian trace curvature into a single typicality statistic. This statistic is then calibrated using kernel density estimation to accurately represent the in-distribution density. The key advantage of this approach lies in its efficiency, as it computes each score using only a single forward pass and a single Jacobian vector product, utilizing Hutchinson’s trace estimator. This avoids the need for serial trajectory integration and significantly reduces the number of evaluations. Moreover, this approach enables full parallelism, further enhancing its computational efficiency.\n\nOne notable aspect of the paper is the offline selection of noise levels. This is achieved through an SNR study, which helps determine the optimal noise level for the given task. The paper shows that evaluating early and mid-schedule steps, such as $t=1$ and $t=300$, remains robust without tuning on out-of-distribution data.", "questions": "- I was curious about comparison between this method with unsupervised approaches that employ VAE-style encoders and decoders. The paper mentions that it offers unsupervised approaches, but I’m not sure about the differences and contributions compared to classical VAE-style out-of-distribution detection. Table 1 provides a partial performance comparison in C10, but I couldn’t delve into the fundamental strength of its high-level understanding.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- **Computational efficiency and performance across domains:** This paper attains competitive AUROC score on CIFAR‑10/100, SVHN, and CelebA while reducing computational burdens, and it perfectly separates several shifts on DeepMind Control Suite.\n\n- **Data-driven calibration and noise selection:** kernel density estimation over in‑distribution statistics yields a calibrated anomaly score, and noise levels are picked from an offline SNR curve such as $t=1$ and $t=300$, avoiding out-of-distribution set leakage while maintaining robustness.", "weaknesses": "- The technical contribution of this paper appears similar to the previous study [1] that employs JVP and trace operators. While I acknowledge that this paper proposes a practical approach using KDE for calibration, the main idea is quite similar to that of the previous paper. They should clarify the technical differences and the reasons why this approach is more meaningful.     \n\n- This paper primarily focused on relatively low-resolution image diffusion models. However, recent diffusion-based generative models have  been capable of generating high-resolution images by adapting VAE-style dimension-reduction approaches. If this method is empirically constrained to pixel-space diffusion models, the authors should provide a clear explanation for this limitation and identify the underlying numerical errors.   \n\n**Reference**\n\n[1] Jeon, Dongjae, Dueun Kim, and Albert No. \"Understanding and Mitigating Memorization in Generative Models via Sharpness of Probability Landscapes.\" ICML2025", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lxSZ3ciKdA", "reviewer": "Reviewer_aGYj", "summary": "The paper introduces **SCOPED**, an OOD scoring method for diffusion models that leverages a **score–curvature ratio** \\(T(x)=\\|s_\\theta(x,t)\\|^2 / \\mathrm{Tr}(\\nabla_x s_\\theta(x,t))\\) at one or two noise levels. The score comes from the trained diffusion model at a chosen timestep, while the curvature (trace of the score Jacobian) is efficiently estimated via a single **Hutchinson JVP**. To normalize across datasets/models/timesteps, the method fits a **KDE** on in-distribution \\(T(x)\\) values and uses \\(-\\log\\) density as the anomaly score. SCOPED aims to capture **typicality** without running full diffusion trajectories, yielding strong OOD separation on both **vision** and **RL** benchmarks with **very low NFE** and full **batch parallelism**.", "questions": "Please see Weaknesses.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- **Simple, model-reuse design:** one forward + one JVP per timestep; no extra networks or training.\n- **Theory-motivated:** connects OOD detection to **typicality** via score norm vs. curvature balance.\n- **Highly efficient:** drastic reduction in **NFE** vs. path-based baselines; trivially parallelizable over samples/timesteps.\n- **Competitive accuracy:** reports **SOTA/near-SOTA AUROC** while being significantly faster.", "weaknesses": "While I’m not a domain expert, I do have the following concerns:\n\n**1. Diffusion model choice vs. dataset/task fit**  \nI’m not fully certain the paper establishes that the proposed statistic is portable across diffusion families and problem settings. If the backbone is latent diffusion, the score/curvature live in latent space while many intuitions and downstream decisions operate in pixel space; the semantics of “typicality” may differ between these spaces and make cross-setup comparisons hard to trust. Conversely, pixel-space score models (EDM/VE/VP) are heavier and their noise schedules differ, so the same two-timestep heuristic and thresholding may not transfer. The reliance on ε/v parameterizations also introduces schedule-specific conversions to score; small mismatches in schedule, EMA usage, or conditioning (class-conditional vs. unconditional, text guidance) can change the magnitude and distribution of the statistic. Architectural shifts (UNet ↔ DiT) and training recipes (noise schedule, optimizer, data filtering) could further alter curvature behavior, raising concerns about whether results reflect the method or the particular diffusion recipe chosen for each dataset/task.\n\n**2. Real-world complexity and high-resolution data**  \nOn complex, high-resolution images, a single global score/curvature ratio may blur heterogeneous content: small out-of-domain regions can be averaged away by large in-domain areas, while rare but in-domain structures might be spuriously flagged. As resolution grows, Hutchinson-based curvature estimates tend to be noisier, sign instabilities near zero can occur, and numerical sensitivity increases, which can propagate into unstable OOD scores. Calibration learned on a narrow ID slice may drift across cameras, ISPs, compression levels, lighting, or seasonal/style shifts; near-OOD shifts are more common in practice than far-OOD dataset swaps and may be harder to separate. The choice of resolution and noise levels interacts with SNR and texture statistics, so operating points that work on small benchmarks may not hold at 512²–1024² or beyond. Finally, long-tailed categories and mixed scenes introduce class/region dependence in the statistic, complicating threshold comparability and raising the risk of biased false positives/negatives in deployment.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xxZJuqae0V", "reviewer": "Reviewer_Q3wu", "summary": "This paper introduces SCOPED (Score-Curvature Out-of-distribution Proximity Evaluator for Diffusion), a novel and highly efficient method for Out-of-Distribution (OOD) detection using pre-trained diffusion models.\n\nThe primary problem this work addresses is the high computational cost of existing diffusion-based OOD methods, which often require numerous sequential model evaluations to integrate a full denoising trajectory.\n\nThe core contribution is a new, computationally cheap OOD test statistic: the \"score-curvature ratio\" ($T(x)$). This statistic is motivated by information geometry and compares the squared norm of the model's score function ($||s(x)||^2$) to the local curvature of the log-probability density (the trace of the score's Jacobian, $Tr(\\nabla_x s(x))$). The intuition is that for in-distribution (ID) samples, these quantities are closely related, while OOD samples will show a significant discrepancy.\n\nKey features of the method are:\n\n1. **High Efficiency:** Instead of a full path, SCOPED only requires evaluation at one or two _independent_ noise levels (e.g., an \"early\" and \"mid-level\" step).\n    \n2. **Fast Curvature:** The Jacobian trace is estimated efficiently using Hutchinson's trace estimator, which only requires a single Jacobian-vector product (JVP) per evaluation, making its cost (approx. $1F+1J$) comparable to a forward pass.\n    \n3. **Unsupervised Calibration:** The method is calibrated by fitting a Kernel Density Estimator (KDE) to the $T(x)$ scores from the ID dataset. The final anomaly score for a new sample is its negative log-likelihood (NLL) under this KDE.\n    \n\nThe authors evaluate SCOPED on standard vision (CIFAR, SVHN, CelebA) and reinforcement learning (DMC, D4RL) benchmarks. The results demonstrate that SCOPED achieves competitive or state-of-the-art (SOTA) AUROC scores while reducing the number of model evaluations by an order of magnitude compared to prior diffusion-based OOD detectors.", "questions": "- Why you didn't evaluate scoped using openood benchmark so we can see its effect on Near and Far-OOD per each ID dataset?\n\n- How did you choose the timesteps t=1 and t=300 and do we need to tune them as hyperparameters ?\n\n- The KDE calibration step is critical, but KDEs can be sensitive to hyperparameter choices like bandwidth. Could you provide a sensitivity analysis for the KDE bandwidth? How was this parameter selected for the paper's experiments, and how much does performance degrade if it's not optimal?\n\n- The vision experiments all rely on a single DDPM trained on CelebA. How robust is SCOPED's performance to this choice? For example, how would it perform if the foundation model's domain were very distant from the ID task's domain \n\n- The choice of $t=1$ and $t=300$ seems to work well as a heuristic. How would you recommend a practitioner select these timesteps for a completely new dataset and a different diffusion model architecture?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "-  **High Computational Efficiency:** This is its primary advantage. It reduces the number of model evaluations by an order of magnitude (e.g., from ~10-1000 for path-based methods to just $1-2$) by avoiding sequential denoising paths.\n\n-  **Strong Theoretical Grounding:** The method is not an arbitrary heuristic. It's based on a well-motivated principle from information geometry—the \"score-curvature ratio\"—which links the model's score to the local curvature of the data distribution.\n\n-  **Excellent Performance:** Despite its low computational cost, SCOPED achieves competitive or state-of-the-art OOD detection accuracy (AUROC) across multiple benchmarks, demonstrating that it does not sacrifice performance for speed.\n\n-  **Generality Across Domains:** The paper successfully validates the *same* method on two very different domains: standard computer vision (CIFAR, SVHN) and high-dimensional robotic control/reinforcement learning (DMC, D4RL).\n\n-  **Practical Unsupervised Design:** The entire system is calibrated *only* using in-distribution (ID) data. The use of Kernel Density Estimation (KDE) provides a flexible, non-parametric way to set the OOD threshold without needing any OOD examples.\n\n- **Parallelizable:** Unlike path-based methods where each step depends on the last, SCOPED's evaluations (e.g., at $t=1$ and $t=300$) are independent and can be run in parallel, further increasing its real-world speed.", "weaknesses": "- Agnostic to Downstream Model Uncertainty: The most significant conceptual limitation is that the OOD score is completely decoupled from the downstream task model (e.g., the classifier). SCOPED is a distributional OOD detector, not a model-centric one.\nIt only answers: \"Does this input look like the in-distribution dataset?\" It cannot answer: \"Is this input hard for the main classifier?\"\nConsequently, this method cannot detect in-distribution samples with high epistemic uncertainty i.e., \"hard\" or atypical ID samples that the main classifier is likely to misclassify. This is a key capability of other OOD methods, often measured by AUPR on correct vs. incorrect ID predictions, which is not addressed here.\n\n- Dependence on Foundation Model & Calibration Data: The method's effectiveness relies on two separate components: a pre-trained \"foundation\" diffusion model and the ID data used for KDE calibration.\n\n- The quality and domain of the diffusion model cap the performance. It is unclear how SCOPED would perform if the diffusion model's training data (e.g., CelebA) is too distant from the main task's ID data (e.g., medical X-rays), as the \"measuring tool\" itself may lack sensitivity in the correct feature space.\n\n- The paper does not discuss the sensitivity to the KDE hyperparameters which is a critical free parameter that could significantly impact the robustness of the resulting OOD score.\n\n- The choice of timesteps ($t=1$ and $t=300$) is presented as a robust combination of \"fine detail\" and \"coarse structure\" based on an SNR curve, but it remains an empirically-chosen heuristic.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nptwVoxLeF", "reviewer": "Reviewer_nrLZ", "summary": "This paper proposes an efficient out-of-distribution detection method utilizing the ratio between the score and the curvature. The key idea of the model is based on the intuition of isotropic Gaussian approximation, where the output is close to 1 in the typical set. The proposed method, SCOPED, is evaluated in reinforcement learning data and a standard OOD detection framework.", "questions": "See Weakness", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. It is not hard to understand the key idea of the method. The manuscript is well-written.\n\n2. I believe the method further extends by using the curvature information of the diffusion model. \n\n3. Reinforcement learning benchmark is interesting, although I do not think this is a standard evaluation framework like CIFAR-10 (ID) against CIFAR-100 (OOD).", "weaknesses": "1. My biggest concern about the paper is the structural similarity of the proposed method against DiffPath [1]. DiffPath shows significance against existing methods since 1) it does not require a diffusion model suited for ID data, 2) it has a small computation cost. This paper follows a similar framework, with only marginal improvements. This questions the significance of the approach.\n\n2. Furthermore, the empirical results of the proposed method on single and double step lags behind DiffPath. If the variant of the method can utilize multiple time steps (e.g., <5 since computing J is slower than computing F) can outperform DiffPath, it can have merits. Unless I can find a good reason to apply the proposed method.\n\n3. The evaluation benchmark seems largely borrowed from [1], but evaluation on the texture dataset is missing. It would be interesting to evaluate the OOD texture data.\n\n4. While it is relatively minor, it would be better to note the actual runtime of the SCOPED compared against DiffPath.\n\n5. Furthermore, I believe Table 1 can be improved. \"Diffusion-based\" and \"Curvature and Diffusion-based\" should be revised to represent the \"ID-dependent method\" and \"ID-agnostic method\", respectively, for readability.\n\n\n[1] Out-of-Distribution Detection with a Single Unconditional Diffusion Model, NeurIPS 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)