Towards a Certificate of Trust: Task-Aware OOD Detection for Scientific AI
Authors: Bogdan Raonic
Siddhartha Mishra
Samuel Lanthaler
Venue: ICLR 2026 Poster (2026)
Keywords: OOD Detection
Scientific ML
Neural Operators
Diffusion Models
Joint Likelihood Estimation
Partial Differential Equations
Fluid Dynamics
Regression
Segmentation
Classification
Primary area: applications to physical sciences (physics, chemistry, biology, etc.)
TL;DR: This paper introduces a task-aware OOD detection method using diffusion-based joint likelihoods of inputs and predictions, enabling reliable certificates of trust for AI models in scientific ML related tasks.

Abstract: Data-driven models are increasingly adopted in critical scientific fields like weather forecasting and fluid dynamics. These methods can fail on out-of-distribution (OOD) data, but detecting such failures in regression tasks is an open challenge. We propose a new OOD detection method based on estimating joint likelihoods using a score-based diffusion model. This approach considers not just the input but also the regression model's prediction, providing a task-aware reliability score. Across numerous scientific datasets, including PDE datasets, satellite imagery and brain tumor segmentation, we show that this likelihood strongly correlates with prediction error. Our work provides a foundational step towards building a verifiable 'certificate of trust', thereby offering a practical tool for assessing the trustworthiness of AI-based scientific predictions.

Published as a conference paper at ICLR 2026
TOWARDS A CERTIFICATE OF TRUST: TASK-AWARE OOD DETECTION FOR SCIENTIFIC AI
Bogdan Raonic
Siddhartha Mishra
Samuel Lanthaler
Seminar for Applied Mathematics, ETH Zurich & ETH AI Center Zurich, Switzerland
Seminar for Applied Mathematics, ETH Zurich & ETH Al Center Zurich, Switzerland
ABSTRACT
Data-driven models are increasingly adopted in critical scientific fields like weather forecasting and fluid dynamics. These methods can fail on out-of- distribution (OOD) data, but detecting such failures in regression tasks is an open challenge. We propose likelihoods using a score- score-based diffusion model. This approach considers not just the input but also the regression model's prediction, providing task-aware relia- bility score. Across numerous scientific datasets, including PDE datasets, satellite imagery and brain tumor segmentation, we show that this likelihood strongly cor- relates with prediction error. Our work provides foundational step towards build- ing a verifiable 'certificate of trust', thereby offering a practical tool for assessing the trustworthiness of Al-based scientific predictions.
OOD detection method based on estimating joint
INTRODUCTION
Deep learning is rapidly transforming scientific computing. Most problems in this domain involve the prediction of unknown, spatially and/or temporally varying physical properties such as the temperature distribution in a solid or the flow velocity of fluid from given initial or boundary conditions. Traditionally, such problems have been addressed by physical models formulated as partial differential equations (PDEs) Evans] (2022), and approximated with bespoke numerical al- gorithms Quarteroni & Valli 1994).. However, data-driven approaches building on neural networks are now increasingly applied to scientific computing Mishra & Townsend (2024), achieving state- of-the-art accuracy in applications like numerical weather forecasting (Bodnar et al. 2025).
This novel data-driven paradigm offers significant advantages, including reduced computational costs and the ability to learn from historical data even when no tractable physical model exists (Lu
cet al. 2021; Li et al. 2021; Raonic et al. 2023) Pfaff et al. 202I). Nevertheless, purely data-driven approaches also introduce critical drawbacks, primarily concerning prediction reliability. Whereas PDE models reflect fundamental physical laws that remain valid even in extreme, previously unseen conditions, in contrast, data-driven approaches inherently interpolative, and prediction accuracy can deteriorate for inputs far from the training distribution (Herde et al. (2024).
ccoosed-world" assumption, expecting test data to share the training data's 's distribution (in-distribution, or ID). Yet, real-world scientific applications frequently encounter out-of-distribution (OOD) samples that require careful handling (Drummond & Shearer 2006). As a consequence, deep learning predictions typically lack a certificate of trust- worthiness, making difficult to ascertain their accuracy and reliability on real-world inputs.
Machine learning models are typically built
To address challenges related to ID/OOD distribution shifts, out-of-distributiin detection has gained significant attention over the last decade Yang et al. (2024). This has led the development of a number of OOD detection methods, including classification-, distance-, and density-base ap- proaches. While this topic is extensively studied for tasks such as image classification, its applica- tion to regression, which constitute vast majority of learning tasks in scientific computing, remains severely underexplored.
1.1 CONTRIBUTIONS
This work addresses the critical need for tools to asses the accuracy and reliability of neural network predictions, particularly for OOD data in scientific and engineering applications. While the ultimate

---

Published as a conference paper at ICLR 2026
goal of this research direction is to furnish end-users with reliable "certificates" of prediction quality, the main contribution of the present paper is to propose the following important steps towards this objective,
We develop and empirically validate novel approach integrating any underlying regres- sion model v with a score-based diffusion model for OOD detection. Our proposed cer- tificate is based on the evaluation of the estimated joint likelihood p(z, Mpred), with 3/pred being the model's prediction for input æ.
Our approach is zero-shot, in the sense that it does not require any access to the ground truth predictions for the test distribution, for OOD detection. If some ground-truti test samples are available, we can go further than ID vs. OOD detection and provide an a posteriori estimate of the underlying prediction error.
We tailor this method specifically for regression tasks, while also demonstrating its appli- cability to classification and segmentation problems.
We perform an extensive evaluation across diverse scientific datasets, including PDE datasets (Wave and Navier-Stokes equations), a humidity forecasting problem utilizing satellite data, image classification benchmarks, and brain tumor segmentation.
In all cases. we observe very strong correlation between the model's prediction errors on ID and OOD data, and the estimated joint likelihood p(z, 3pred). We also adapt other certificates, derived as aggregated statistics from the probability- setting, and show that these resulting baselines also provide satisfactory OOD detection, indicating the efficacy of the proposed approach based on the joint input/outputs.
ODE, to our proposed
2 RELATED WORK
A first approach to OOD detection, with applications to image classification, directly leverages latent features from the trained networks including outputs of the final or earlier layers. For example. Liu et al. (020)); Zhang et al. 22022) define explicit energy scores based on such features. Test samples with lower energy are considered ID and vice versa. softmax approach for estimating conditional likelihoods is used in (Hendrycks & Gimpel| 2016) Hsu et al., 2020). Other works also use latent features (statistics) to distinguish ID/OOD samples, (Yang et al. 2024) and references therein.
OOD detection can be viewed through epistemic uncertainty. where estimating this uncertainty yields a scalar detection score. Methods like MC-Dropout Gal & Ghahramani (20T6) and Rate- In Zeevi et al. (2025) use dropout train and test time to generate stochastic forward passes that approximate Bayesian inference. Other approaches, such as [Chan et al. (2024), use hybrid Bayesian methods to estimate epistemic uncertainty.
Density-based methods capture the ID with probabilistic models, flagging inputs from low-density regions OOD based on likelihoods. Early works employ (mixtures of) Gaussian distributions
(Lee et al. 2018 Pleiss et al. 2019). Normalizing flows in classification tasks are leveraged in (Ren)
al. 2019 Nalisnick et al. 2019c Goodier & Campbelll 2023). Some papers estimate likelihoods
on latent features with diffusion models Ding et (2025 Järve et al. (2025).
Modeling the joint distribution p(x, y) has been explored in Nalisnick et al. (2019a). where hybrid model coupled a deep invertible transform with a generalized linear model, mainly locusing on OOD detection classification. A hybrid approach was also put forward by Cao & Zhang 2002). An assessment of likelihood based OOD detection, identifying systematic biases in the context of image classification, is provided in Nalisnick et al. (2019b). Subsequent work revisiting these examples and proposing improvements include Ren et al. (2019); Nalisnick & et al. explore "typicality" Nalisnick et al. (2019c), "local intrinsic dimension" " Kamkari et al. (2024), and enhanced normalizing flows via a "approximate mass" penalty Chali al. (2023) Beyond likelihood estimation, applications of diffusion models to OOD detection include reconstruction- based approaches (Graham al. 2023) and work by (Heng et al. (2024) (DiffPath), which perform OOD detection based on rate-of change and curvature of diffusion paths.
(202)). Other approaches
The overwhelming proportion of work OOD detection has been in the vision/image domains with classification as the learning objective. In contrast, there are very few articles that explore how OOD detection (and error certification in general) can be performed in scientific machine learning.
2

---

Published as a conference paper at ICLR 2026
where bulk of the learning tasks petressioo-bbseee A few exceptions to this rule are EEsharkawy & Kahn (2025). who introduce Contrastive Normalizing Flows for parameter estimation for high- energy physics, Fanelli et al. (2022) propose conditional generative approach for anomaly detection in experimental physics. For drug discovery, Molecular Out-Of-distributiio Diffusion (MOOD) al. (2023) employs diffusion model explore chemical space, guiding generation towards novel molecules. Abdi et al. (2025) apply DiffPathh to medical image OOD detection.
What this brief literature survey brings out is the scarcity of OOD detection and prediction certifi- cation methods for most of scientific machine learning applications. The main goal here is to devise such a method.
METHODOLOGY
A generic regression task consists in minimizing over parameters y, loss of the form,
xxxy C f=Jxu E(y, V Vx((x)) p(r, u) da dy,
(1)
where Up is model of the operator V which defines the ground truth, E is the loss function and p(x, y) is the (ground truth) training distribution.
Given unseen input x' with corresponding ground-truth output y", our goal is to determine quantity c(x*), to be used as a certificate, which correlates with the loss Ely", V=((x"). We impose two important requirements: (i) c(x*) must be computable without knowledge of y", and (ii c(x*) should indicate to an end user whether they can expect E(y", L (x*)) to be small.
Likelihood as Certificate. To this end of finding certificate, we provide with motivating heuristic computation in SI where under certain assumptions on the training and generalization of the regression model Vp and on the underlying ground truth probability distribution, we derive the following (approximate) relation,
log (L(v", VV((x"))) S a log(e) - log(p(o", -ypred) O (c*))
where e > is the average loss and Upred = V (=")), with positive constants a, B. From the above relation, immediately observe that i) the error of the prediction V=((=*) nicely relates to (correlates with) the likelihood p(x", Upree) and ii) the error should be small where data are abundant (high likelihood) and can be large where data are scarce (low likelihood).
Moreover, given the decomposition, log p(x", Upredd ) = log po=") + log P(yprod x=)), it follows that the joint likelihood certificate ensures i) the model V. should generalize better in regions of high input likelihood p(z*) ) and ii) Task-specific information enters through the conditional likelihood P(ypred xx*) which captures the intrinsic complexity of predicting Mpred from x². The role of each term in this decomposition is explored in SI A.2 for regression tasks for simple one-dimensional functions, where we demonstrate how both terms are essential in designing good certificate.
Given these heuristic considerations, we will base our certificate on the joint likelihood p(z*, Vpred). However, one immediately runs into the difficulty of determining this joint probability distribution from data. We will approximate this distribution with diffusion model as described below.
Diffusion Models. Diffusion models map a Gaussian reference distribution to a target distribution p(z). They are commonly implemented using a backward stochastic differential equation (SDE). However, this SDE also has an equivalent probability flow ODE formulation (Tang Zhao 2024 Section 4.3):
d=
dt 2 (z)()(t):
(3)
To sample from p(z), we start with samples from Gaussian prior initial data and solve the ODE 27 Here s(2; t) Ri V, log pt is the so-called score
scorefunetice function and a; is the underlying noise level.
transforms a Gaussian prior into the target distribution, it also enables evaluation of the data density p(z). By integrating along the solution path of the ODE, we obtain (Tang & Zhao
As the probability flow ODE (27
2024 Appendix D.2, Eq. (39)):
T ["
log = log Po
oo (V ())))((())
(4)
3

---

Published as a conference paper at ICLR 2026
The divergence term (z)()); can be approximated using stochastic estimators, detailed in Tang & Zhao 2024 Appendix D.2). In this work, we apply this to the joint variable = (z. y). In prachce, the score function is approximated from trained denoiser using Tweedie's 's formula Karras et al. (2022).
Computing the Certificate. As argued above, our certificate is given by the joint likelihood p(1;, y)- To compute it, we train the denoiser Da of our score-based diffusion model on the available data pairs (In, Vn), n : .V. We note that the training of the diffusion model does not involve the regression model Ve in any form.
Given any input x², then first generate the prediction Vx((x*) using the regression model, and then we estimate the joint log- ligeliiel p(æ", Mpreed by numerically solving the associated probability flow ODE (4). with its score function being estimated by the trained Denoiser Dg. The certificate computation is also illustrated in Fig. (A.B).
ID/OOD classification. While the relation suggests that the test error and the joint likelihood are perfectly correlated, we emphasize that it is heuristic relation and may not hold exactly. Thus, finding an exact formula between the error and proposed certificate very difficult. On the other hand, we can still utilize the certificate in the important task of classifying test samples in- distribution (ID) or out-of-distribution (OOD), providing the end user with a metric for ascertaining whether the regression model is reliable or not.
decision samples
error
IV
s(x, v(x))
certificate
Wave Equation
Navier Stokes
Navier-Stokes Equations
MERRA2
Humidity
p(xy)
(x, (x))
Orror
B
certificate
certificate
certificate
certificate
Figure 1: Illustraiion of the approach: (A) A regression model and joint diffusion model D. (B) Certificate from the probability flow ODE. (C) Classification as ID/OOD based on the certificate (regions II/V are good). (D) Correlation between error and certificate, with posteriori estimates.
To this end, we first take a small number of decision samples from the training distribution and com- pute the median of the corresponding certificate values, denoting le. along with their standard deviation, оe- We define ID samples as those with certificate value greater than 1 - 1.5a while OOD samples have values below Le 1.5o As shown Figure [ (C), this procedure defines vertical boundary between ID/OOD samples, separated according to their certificate values. More formal calibration techniques could also applied, such as quantile-conformall methods, FPR con- trol, or standard temperature scaling. For testing purposes, the horizontal dashed line shows the boundary between small/large errors, here defined as the 95th percentile of errors of the decision samples. Note that the horizontal threshold can be adjusted by the end user, reflecting their chosen tolerance for acceptable error levels. The resulting quadrants the error vs certificate plane are shown in Figure (C). A good certificate should minimize misclassified samples in regions I and III, corresponding to ID-classifid samples with large errors (region I), and OOD-classified samples despite a small prediction error (region III), respectively. This ID/OOD classification procedure pro- vides a quantitative metric to assess the reliability of the certificate. Finally, our proposed overall
4

---

Published as a conference paper at ICLR 2026
algorithm for reliability certification in terms of ID/OOD detection is summarized in Algorithm Further details can be found in SIA.44
4 RESULTS
To assess the proposed approach empirically, we consider variety of datasets of relevance to sci- entific computing, including regression on the solution operator for the wave equation, the Navier- Stokes equations and a Humidity Forecast regression dataset, based on real-world data. In addition, also revisit image classification within the proposed framework, and extend the approach to brain tumor segmentation.
Wave Equation. In this experiment, we consider regression the solution operator of the wave equation with periodic boundary conditions in two spatial dimensions. Initial conditions are obtained from field with random Fourier coefficients. The distribution is characterized by two parameters K and r, where K controls the number of active Fourier modes, and r controls the decay rate of Fourier coefficients. Test and training distributions differ in the range of values from which K and r are chosen to generate samples. We refer to SI B.] for further details on the data distributions.
Once the model V is trained on the training set X {uo,. (2) n== we then test its perfor- mance on the test distribution. For this experiment, the support the training distribution a subset of support of the test distribution. Hence, some samples drawn at test-time will be similar to those from training, while others may differ significantly. In addition to the regression model V we also train a diffusion model De to approximate the joint input/output distribution. The regression model the CNO architecture of Raonic et al. (2023) and the diffusion model is a UVTT type denoiser con- sidered in Molinaro et al. (2025), ) see SD for details. The chosen loss function here is the L Lerrr.. Histograms of the estimated likelihood certificate ca (z) and L errors are illustrated in SI (
The approach for ID/OOD detection in the present work hinges on presumptive correlation be- tween likelihoods and errors: How does the absolute Ln error correlate with the estimated joint log-likelihood? We summarize this correlation in Figure (D)), where the errors evaluated for the test distribution. Our results show that samples drawn from the training distribution exhibit higher likelihood values and lower errors compared those from the test-distribution. Additionally, we observe very clear correlation between these quantities.
Algorithm OOD Detection with Diffusion Certificates
1: Train task model V , on (z, y) and denoiser (diffusion) model Dg on p(x, y)
2: Define certificate (æ (x)) via probability-flow ODE (e.g. likelihood as in
3: From training samples, compute (error, cg) and set ID/OOD boundary
4: for test sample x do
5: Upred f- (x)
6:
C c co(a, Uprea)
7: if' Oboundary then
8:
classify as ID
9: else
10:
classify OOD
11: end
12:
end for
We perform ID/OOD classification as described in Section In addition to the scatter plot of error vs certificate, Figure (D) also shows the resulting classification regions: The vertical dashed line in this plot shows the ID/OOD boundary. Additionally, the horizontal dashed line shows the boundary between small/large errors, which we here define as the 95th percentile of errors in the training distribution. Representative examples of predicted and ground-truth samples from ID and OOD classes can be found in B. Figures aland
For further insight into the results, we split the OOD class into intermediate, critical (CD), where certificates lie in (Le- -2-335 le - plot joint histograms of (K,r) for ID (left), CD (center), and OOD (right) samples in Figure]] The ID samples predominantly correspond to high values the decay parameter r, specificallly < 0.75, which is the minimum observed value of in the training
the ID/CD/OOD separation, 1.50,.) 4 ). and OOD, where certificates fall below L - -3 To illustrate
5

---

Published as a conference paper at ICLR 2026
set. Critical samples tend to have intermediate values of r, whereas OOD samples characterized by both low r values and typically high K values, regions where the model exhibits the poorest generalization.
Ablations. The above results provide strong empirical evidence for the utility of the proposed like- lihood certificate on the studied dataset. To better understand the sensitivity of our approach, performed two ablation studies on the sensitivity to the diffusion model training and number of samples used determine ID/CD/OOD ranges.
Sensitivity to the Diffusion Model:
The first ablation examines the extent to which the diffusion model needs to be trained be effective for OOD) detection, with further details in SI B.1.2 The model is trained for 500 epochs, with final estimated likelihoods shown in Figure I0] We repeat like-
lihood estimation using intermediate checkpoints with fewer epochs. B.12 Figure [3 illustrates the progression of the L1 error versus the estimated joint oog-liielihood log po (I, Upred) ) throughout training. As the model is trained for more epochs, the estimated likelihood becomes increasingly aligned with the prediction error, with the final model (trained for 500 epochs) showing a pronounced correlation between the two. We also observe that the average estimated log-likelihodd over both the training and test distributions increases steadily throughout training, exhibiting rapid transition during training (cp. F2igue [4). For the last 100 epochs of training, the model's 's explanation of the data remains consistent across checkpoints (cp. SI Figure 15 This suggests that once the diffusion model is sufficiently trained, it provides reliable performance for OOD detection.
Classification Sensitivity: In previous evaluations, used 32 samples drawn from the training dis- tribution to classify inputs into ID and OOD categories. We check what is the number of samples required achieve reliable classification performance. This ablation illustrates how the classifi- cation boundaries, based on the estimated joint log-likelihood. evolve as the number of randomly selected training samples increases, with results shown in SI B.1.3 Figure I6 With only 4 sam- ples, the classification is conservative, resulting in many test samples being labeled as OOD. As the number of samples used for decision-makkng increases, the boundaries become progressively more stable and reliable.
Regression Model Architecture: In our final ablation, we evaluate the proposed framework using various regression architectures. Instead of the previously used CNO model, we now consider ViT Dosovitskiy et al. (2020). UNet |Ronneberger et al. (2015), and C-FNO Molinaro et al.) (2025) ar- chitectures. The same diffusion model trained in earlier sections is employed throughout. Each regression model is trained on the same dataset used for the CNO experiments (cp. BI Figure 17.. In each case, we observe that samples with low likelihoods correspond to high prediction rors, whereas samples with high likelihoods exhibit lower errors across all tested architectures. This indicates that the approach is robust, and does not require a matching regression model architecture and diffusion model backbone.
Navier-Stokes Equations. In this experiment, validate the proposed approach the time- dependent Navier-Stokes equations with periodic boundary conditions in two dimensions, and with (spectral) viscosity papers Raonic et al. (2023) ) Herde et al. (2024). termed NS-Sines, NS- Moderate, NS-Shear Layer, NS-Brownian, NS-PwC, with further details provided in SI For both the regression and diffusion tasks, we employ an all2all training strategy, as recommended in Herde et al. (2024).
x 10-4. To this end, revisit six datasets of varying difficulty, from the
Labeling of input samples as ID/OOD is performed by the same procedure as in the wave equation. We refer to SI B.2 for addi- tional details related the varying setup of this experiment, and an ablation on autoregressive vs direct formulations. We sum- marize the correlation between L1 -errroos and likelihood certifi- cate in Figure (D), where the models are trained on the NS- NS-Mix dataset and tested on a variety of previously unseen datasets.
NSS Gest m us Nucke Sx Reaviess
We again observe a very clear correlation between errors and the likelihood certificate. Additionally, we performed several exper- iments, where in each experiment (or mix of datasets) as our ID training distribution, and we test OOD detection on the other datasets, with results shown in B.2
Log bothoes -05
choose different dataset
Figure 2:
Navier-Stokes. L Error vs input-only likelihood log (x()) for NS-Mix.

---

Published as a conference paper at ICLR 2026
Fig. 19 These results demonstrate that ID/OOD detection works robustly across this range of datasets.
Insufficiency of p(x) as certificate. So far, have restricted attention to the joint likelihood p(z, y). We here investigate the suitability of p(a) as an alternative certificate. A potential issue with this approach is that the distribution p(x:) is completely task-agnostic. The task itself could be to solve a PDE, given the input 2, but it could be something completely different. Therefore the intrinsic difficulty of the task is not incorporated into the input distribution. Moreover, the way we evaluate the trained model is also not incorporated into the certificate. Therefore we do not recommend this approach, given the supporting evidence below.
We analyze the certificate log (z( for the NS-MIX problem. In Fig. we present the L1 errors plotted against the estimated log-likelihodd. While we observed a clear correlation with errors when using the joint likelihood p(x., y) as certificate (cp. Fig. (D), no such correlation between po(r)) and the Li-errors is observed. Notably, the NS-Sines dataset receives the highest likelihood scores. However, despite these high likelihoods, the downstream task associated with this dataset remains challenging, resulting in large test errors. This indicates that, in this case, p(x) is not a reliable metric for OOD detection. This conclusion is further supported by SI A.2. Table S which demonstrates that, in fact, all task-agnostic baselines fail. This failure occurs for all the certificates based on only the input distribution.
MERRA-2 Humidity Forecast. In this experiment, we use MERRA-2 satellite data to forecast surface-level specific humidity Global Modeling and Assimilation Office (GMAO) (2015). Training is performed on a 128 x 128 region over South America, using 4h snapshots, in the period 2016- 2021 (SI B.3 Fig. 26). The task is predict humidity 12h ahead. A time-conditioned regression model is trained to forecast up to 60h (15 steps) into the future, and evaluated on 12h predictions (3 steps). In addition. a diffusion model trained to estimate the joint likelihood p( 212)) of humidity snapshots over the same region. We evaluate humidity prediction for 2023 on four test sets (SI B.3 Fig. 26): (I) South America (training region), (2)
(3) Africa, and
(4) Asia Due to differing humidity patterns, generalization degrades outside the training domain: performance is best on South America, moderate on Australia Ocelnia,, and poor on Africa and Asia.
Figure [D) plots L1 errors against the likelihood certificate. We observe that the diffusion model assigns high likelihoods, corresponding to low prediction errors, to samples from South America. Samples from Australia receive slightly lower likelihoods and are mostly identified as OOD. As anticipated, the African and Asian datasets fall entirely within the OOD region. In SI B.3 the pre- dicted humidity fields appear overly smooth, lacking fine-scale structures. This is expected, since the regression task is ill-posed and no auxiliary information (e.g.. boundary conditions, wind, tem- perature, pressure) is provided. For comparison, Fig. 25 shows the error histogram of our 12-hour forecasts against a persistence baseline (humidity assumed constant). The model clearly outper- forms persistence, with its error distribution shifted to the left.
Classification.
To complement the regression datasets considered before, we next apply our ap- proach to classification tasks. We start with classic image datasets, CIFARIO and MNIST. We train a classifier V. to predict a discrete label y from the image x. The classifier is trained using a conven- tional softmax- based loss function, maximizing the log-pro bogooobabiylity corresponding to the true label y. During the training of the diffusion model, we concatenate an additional channel containing the constant value y to the e channels of the image
Bi Dlow
The classifier predicts aroprbbbaslittes logp(y (x)) for each class label (the last layer before the softmax is applied). To include full information about classifier outputs during testing, we do not define Upred as the single class label with highest probability. In- stead, to define the channel Spred that is fed into the diffusion model to compute log p(x. Upred), els of ypred independently from the set of labels, where each pixel value is chosen with probability p(y lr).
Liwar
sample the individual pix-
jene Lioe Brod -log 2am
Figure 3: CIFARIO Image
In this way, predictions with low confidence introduce variabil- ity into the label channel, effectively "corrupting" those samples. Consequently, samples for which the classifier is confident re-
Classification. Accuracy vs Likelihood Certificate.
7

---

Published as a conference paper at ICLR 2026
main mostly unaffected. By incorporating uncertain label values, we effectively perturb the ome-dimensionae manifold on which the labels reside.
CIFARIO. In this experiment, train both classifier and a diffusion model using the CIFAR dataset, containing 10 distinct classes. We designate one class as out-of-distribution (OOD), which is underrepresented in the training set. The class chosen the OOD class is trucks (the last class). For each in-distribution class, we select approximately 4.5K training samples, with slight variations in the exact number for each class. For the OOD class, we select only 10% of the samples.
In Figure 3 we show the accuracy of the classifier vs. the likelihood certificate. We observe a linear relation between the accuracy and the predicted likelihoods. As expected, the performance of the classifier was the worst for the OOD class (i.c. the truck class). Additionally. the classifier was unable to accurately predict the cat class (below 60% accuracy), and the diffusion model accurately assigned low likelihood to this class. Two effects combine to yield this result: (1) The classifier rarely overconfident in the wrong label. (2) Even when the classifier overconfident in the wrong label, the estimated likelihood is still much lower than the ones obtained when the classifier is overconfident in the correct label.
MNIST. We repeat this experiment for MNIST. The OOD class is the number 9. The results, shown in SI B.7 Figure 32 are similar to the ones obtained in the case of CIFAR1O dataset. Note that the classification task is very easy, so almost all the ID samples are properly classified. Finally, per- form an extensive ablation of our approach on the well-known issues of ID/OOD misclassification for CIFAR/SVHN identified in Ren et al. (2019), with details in BB..1
Segmentation. In this section, we evaluate our approach on binary segmentation tasks (i.e. pixel- wise classification). Our method follows similar strategy as for classification, with one key dis- tinction: we explicitly reduce the influence of non-semantic pixels by corrupting them with white noise during training. The method is explained in full detail in B.B
Our objective is to perform brain tumor segmentation on the BraTS2020 dataset Menze et al. (2014). This dataset contains 3D brain MRI volumes. The data is divided into two categories: (I) High-grade gliomas (HGG), (2) Low-grade gliomas (LGG). Each brain scan is accompanied by a simplified segmentation mask defined as non-tumor tissue pixels and 1: tumor tissue pixels. We train our segmentation model using brain scans with HGG tumors, from which we select 190 for training, 10 for validation, and 10 for testing. During training. we apply a range of augmenta- tion techniques. We refer to SI B.8 for further details on the datasets and employed augmentation techniques; we also include an ablation on the noise corruption technique.
Our evaluation is conducted on 10 held-out HGG brains and an additional set of 10 LGG brains. For the HGG cases, we evaluate the model not only on FLAIR MRI seans, which were used during training. but also on 72-weighted scans, representing a different MRI modality. For the LGG cases, performance is assessed on both axial (z-axis) slices, aligned with the training direction, and x- axis slices, offering side view of the brain and allowing us to test the model's 's generalization to previously unseen anatomical orientations.
SI B.S Fig. 37 shows the relation between relative L, segmentation error and our likelihood cer- tificate across four test scenarios. Most low-error cases are correctly classified as ID, while nearly all high-error cases (relative L, 2 1.0) are identified as OOD. Furthermore, it is crucial to highlight that our approach effectively identifies OOD samples originating from a different MRI modality, namely To MRI scans (see subfigure 3 in Figure 37
Aggregating all datasets, the 2d histogram of error vs. likelihood (SI B.8
Fig. 38 left)) shows
high density around low likelihood and errors near 1.0, i.c.. OOD. Low-error points cluster near the threshold but remain ID. The likelioeldoood histogram (middle) is right-skewed, favoring higher values. Finally, error histograms (right) confirm that ID samples are mostly low-error, while OOD samples are dominated by high-error cases, with some low-error outliers.
Quantitative performance metries and Baselines. As illustrated in Fig. [[C), the ID/OOD bound- ary (vertical) and error boundary (horizontal) divide the -rree-os-ikellhood scatter plot into 4 quad- rants. We consider the null-hypothesis that testing samples are OOD and, based on this sub-division, identify true positives (classified OOD, large error), false positives (classified OOD, small error), true negatives (classified ID, small error) and false positives (classified ID, large error). Further details can be found in SI A.4
8

---

Published as a conference paper at ICLR 2026
JLBC
JDPath
JSFNS
JSBDDM
JMSSM
OODC
ACC
0.855
0.864
0.862
0.865
0.892
0.545
FPR
0.040
0.108
0.095
0.108
0.066
0.395
Wave
FDR
0.126
0.359
0.314
0.359
0.220
0.453
AUROC
0.936
0.912
0.916
0.913
0.946
ACC
0.994
0.988
0.989
0.988
0,989
0.603
FPR
0.001
0.002
0.002
0.002
0.002
0.142
NS-PwC
FDR
0.002
0.003
0.003
0.003
0.003
0.673
AUROC
0.999
0.999
0.999
0.999
0.999
ACC
0.947
0.788
0.786
0.788
0.788
0.424
FPR
0.009
0.022
0.020
0.021
0.020
0.090
NS-MIX
FDR
0.024
0.062
0.058
0.060
0.058
0.350
AUROC
0.992
0.918
0.886
0.913
0.891
ACC
0.956
0.989
0.922
0.981
0.987
0.741
FPR
0.034
0.004
0.067
0.001
0.002
0.259
MERRA2
FDR
0.046
0.006
0.086
0.002
0,003
0.518
AUROC
0.992
0.998
0.989
0.997
0.998
ACC
0.743
0.789
0.727
0.785
0.772
0.709
FPR
0.077
0.087
0.169
0.097
0.123
0.291
Brain
FDR
0.253
0.297
0.580
0.332
0,422
0.291
ARCB
0.743
0.765
0.381
0.726
0.611
0.705
AUROC
0.808
0.808
0.742
0.802
0.782
ACC
0.899
0.884
0.857
0.881
0.886
0.617
FPR
0.033
0.045
0.071
0.046
0.043
0.224
Average
FDR
0.091
0.145
0.208
0.151
0,141
0.457
AUROC
0.945
0.927
0.906
0.925
0.923
Table I: Performance metrics on scientific datasets for proposed likelihood certificate, and several OOD detection baselines (using joint input/output distribution).
To quantify the performance of the proposed certificate across our experiments, we finally report relevant statistical metries in Table [ Specifically, we report the accuracy (measuring correctly classified samples), false positive rate (FPR), and false discovery rate (FDR). To ensure statistical significance of our results, we also report the AUROC metric. The AUROC represents the prob- ability that randomly selected positive sample receives a higher classifier score than randomly The proposed likelihood certifi-
selected negative one, and is inherently cate (termed as JLBC) is compared to number of diffusion-based baselines: curvature-based certificate JDPuth (see Heng et al. (024)), certificate incorporating contributions both from curvature of the score function and from the score function itself (termed JSBDDM) Abdi et al. (2025), the sum of the score functions Joint Score Function Norm Score (JSFNS, introduced by us in this paper), and certificate based sums of norms of the score, referred in framework as JMSSM MMhmmood et al.) (2020). All these baselines are still computed by using the denoiser to calculate the score function for the joint distribution. All the previous works primarily relied on input-distribution-baee -based approaches. As part of our contribution, we extend these methods to the joint-distribution setting (denoted with by adapting their approaches accordingly, ensuring fair and consistent comparison within our framework. We additionally include a non-diffusion baseline OODC (see D.I.. which requires access the ground- for some test samples. For the Wave Equation experiment, we additionally compared our method against two Bayesian-style approaches where the predicted epistemic uncertainty is used for OOD detection, namely MC-Dropout Gal & Ghahramani (2016) and Rate-In Zeevi et al. (2025). both of which dropout during training and inference to enable stochastic forward passes (i.c., approximate Bayesian inference). Consult SI for further details all the baselines.
wreshold-independeee
Throughout all experiments, we find that certificates derived from diffusion models trained on the joint input/output distribution robustly classify inputs with large errors to be OOD, indicated by the low FPR. The results furthermore indicate that the likelihood based certificate is the most robust among these certificates, demonstrated by it being the best performing approach average (Tab.

---

Published as a conference paper at ICLR 2026
1}. Moreover, the JLBC certificate is significantly more accurate for all metries on the most chal- lenging NS-MIX dataset, where the underlying training and test distributions are both mixtures of multiple distributions. For this task, we also compute the ROC curve and compare it against several baselines (see Figure 4 right). The JLBC demonstrates near-perfect OOD discrimination, whereas the other models show considerably lower ability to distinguish between ID and OOD samples. Regarding the comparison against Bayesian approaches, JLBC clearly surpasses both MC-Dropout and Rate-In in the Wave Equation experiment, delivering substantially higher aceuracy and AUROC while also being considerably faster to evaluate (see SI Table A and SI Finally, we conduct that JLBC delivers reliable and stable OOD certificates
an ablation study while requiring only fraction of second per sample for certificate computation, enabling fast and robust inference practice. These findings highlight the utility and potential of the proposed joint input/output approach for identifying problematic predictions across variety of datasets. Further discussion and ablations on the choice of boundaries can be found in A.4 (cp. Table
A Posteriori estimates the prediction error. We reiterate that our proposed approach is zero- shot as no access to any ground truth test samples is necessary. A natural question that arises is: can say more in case have access to the ground truth for some test samples. Revisiting Eqn. ( we see that the error-(log- )likelihood relation is heuristically an approximate exponential. Hence, aim to fit a scaled and shifted exponential the error log-likelihood relation for small number (~-64) of samples of the test distribution for our regression tasks (Wave, NS-Mix and MERRA-2, see B.4 for details). We observe from Fig. (D) and SI Fig. 27, that this exponential fit provides a reliable estimate of the error from the likelihood, yielding quantitative posteriori error estimate, which can be very useful in scientific applications.
Inference on Training Distribution. In some cases, the objective is to assess the model's gener- alization ability within its own training distribution. The main challenge here identify the most challenging samples that still belong to that distribution. In this regard, we perform a posteriori error estimation for the Wave-Fq and NS-PwC experiments using 64 training samples to determine likelihood and error bounds, and a respective relationship between them. Uncertainty bounds of the established relationship are derived via the setbeeercettiee rule. For the NS-PwC experiment, we present the error fits in Figure We also examine how the uncertainty bounds depend the chosen confidence threshold by varying the percentile used to define the bands. As shown in SI Figure 29 increasing the threshold from the 65th to the 95th percentile expands the bounds, capturing more samples but also amplifying the associated uncertainty. For further details, see SI B.4.1
UCA B5T
Expoeetil Bi
Bocuaw plon BoCcave Blh
Certricato
fe Partive Tate
Figure 4: Left: Error fits and corresponding enror-cetiffiate histograms for the training distributions (NS-PwC experiment). Right: ROC curves for the NS-MIX experiment, where JLBC shows near- perfect OOD discrimination, while other models perform notably weaker.
CONCLUSION
In this work, we addressed the critical challenge of assessing the reliability of data-driven models in scientific AI, where out-o--distributio failures have significant consequences. We proposed a novel, task-aware OOD detection method tailored for regression tasks. Our approach leverages a score-based diffusion model estimate variety of certificates on the joint input/output distribution. This is found to be crucial for an informative reliability score for regression tasks, where methods based on the input distribution p(x) can completely fail. Thus, this work represents foundational step towards building verifiable "certificates of trust" for Al-based scientific predictions.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Lemar Abdi, Francisco Cactano, Amaan Valiuddin, Christiaan Viviers, Hamdi Joudeh, and Fons van der Sommen. Outtof-disti detection in medical imaging via diffusion trajectories. arXiv preprint arXiv:2507.23411, 2025.
Cristian Bodnar, Wessel P Bruinsma, Ana Lucic, Megan Stanley, Anna Allen, Johannes Brandstetter, Patrick Garvan, Maik Riechert, Jonathan A Weyn, Haiyu Dong, et al. foundation model for the earth system. Nature, pp. 1-8, 2025.
Senqi Cao and Zhongfei Zhang. Deep hybrid models for out-of-distribution detection. Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4733-4743 2022.
Samy Chali, Inna Kucher, Mare Duranton, and Jacques-Olivier Klein. Improving normalizing flows with the approximate mass for out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 750-758, 2023.
Matthew Chan, Maria Molina, and Chris Metzler. Estimating epistemic and aleatoric uncertainty with a single model. Advances in Neural Information Processing Systems, 37:109845-109870, 2024.
Yifan Ding, Arturas Aleksandrauskas, Amirhossein Ahmadian, Jonas Unger, Fredrik Lindsten, and Gabriel Eilertsen. Revisiting likelihood-based -isttiibbiittio detection by modeling repre- sentations. arXiv preprint arXiv:2504.07793, 2025.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010. 1929, 2020.
Nick Drummond and Rob Shearer. The open world assumption. In eSI Workshop: The Closed World of Databases meets the Open World of the Semantic Web, volume 15, pp. 1, 2006.
Ibrahim Elsharkawy and Yonatan Kahn. Contrastive Normalizing Flows for Uncertainty-Aware Parameter Estimation. arXiv preprint arXiv:2505.08709, 2025. URl/https::/arxiw.orrg
Lawrence C Evans. Partial differential equations, volume 19. American Mathematical Society, 2022.
Cristiano Fanelli, James Giroux, and Z Papandreou. 'flux+ mutability': conditional generative approach to one-class classification and anomaly detection. Machine Learning: Science and Technology, 344)0045, 2022.
Yarin Gal and Zoubin Ghahramani. Dropout bayesian approximation: Representing model uncertainty in deep learning. In international conference on machine learning, pp. 1050-1059.
PMLR, 2016.
Global Modeling and Assimilation Office (GMAO). MERRA-2
(M2TINXFLX): 2D, I-Hourly, Time- Averagee, Single-Level, Assimilation, Surface Flux Diagnostics, Version 5.12.4. Goddard Earth Sciences Data and Information Services Center (GES DISC), Greenbelt, MD, USA, 2015. Data used for the period 2013-2023.
Accessed: 2025-04-22.
Joseph Goodier and Neill DF Camphell. Likelihoodd out-of-distribution detection with de- noising diffusion probabilistic models. arXiv preprint arXiv:2310.17432 2023,
Mark S Graham, Walter HL Pinaya, Petru-Daniel Tudosiu, Parashkev Nachev, Sebastien Ourselin, and Jorge Cardoso. Denoising diffusion models for out-of out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2948-2957, 2023.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of nuttof-distribution examples in neural networks. arXiv preprint 1610021610.021 2016.

---

Published as a conference paper at ICLR 2026
Alvin Heng, Harold Soh, al. model. Advances in Neural Information Processing Systems, 37:43952 43974, 2024.
detection with single unconditional diffusion
Maximilian Herde, Bogdan Raonić, Tobias Rohner, Roger Käppeli, Roberto Molinaro, Emmanuel de Bézenac, and Siddhartha Mishra. Poseidon: Efficient foundation models for pdes, 2024.
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: of-distribution image without learning from out-of-distribution data. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10951-10960, 2020.
Detecting out-
Joonas Järve, Karl Kaspar Haavel, and Meelis Kull. Probability density from latent diffusion models for out-of-distribution detection. arXiv preprint arXiv:2508. 15737, 2025.
Hamidreza Kamkari, Brendan Leigh Ross, Jesse C. Cresswell, Anthony L. Caterini, Rahul Kr- ishnan, and Gabriel Loaiza-Ganem. A geometric explanation of the likelihood OOD detection paradox. Forty-first International Conference on Machine Learning, 2024. URL https: //openzeview.. wwwp//ttww/tminiieeeeeeoe (eVermmmP...EVEXXXXp.pI.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. Advances in Neural Information Processing Systems, 35:26565-26577 2022.
Kimin Lec, Kibok Lee, Honglak Lec, and Jinwoo Shin. A simple unified frame- work for detecting out-of-distribution samples and adversarial attacks. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Ad- vances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018. URL / /tttps://procceediii. co httpc//ppprrfee//eeeeeeeeeeeeeee filess/ppper///18.. 7bcaad09cc22
#ile/abdee665577cccc677777 hccpaa//7aaaaa000111111100000003 pdf
Seul Lee, Jachyeong Jo, and Sung Ju Hwang. Exploring chemical space with score-based out-of- distribution generation. In International Conference Machine Learning, pp. 18872-18892. PMLR, 2023.
Zongyi Li, Nikola Borislavov Kovachki, Kamyar Azizzadeneshelii Burigede Liu, Kaushik Bhat- tacharya, Andrew Stuart, and Anima Anandkumar, Fourier neural operator for parametric partial differential equations. In International Conference on Learning Representations, 2021.
Weitang Liu, Xiaoyun Wang. John Owens, and Yixuan Li. Energy-based out-of-distribution detec- tion. Advances in neural information processing systems, 33:21464-21145, 2020.
Lu Lu, Pengzhan Jin, Guofei Pang, Zhongqiang Zhang, and George Em Karniadakis. Learning nonlinear operators via DeepONet based on the universal approximation theorem of operators. Nature Machine Intelligence, 3(3):218-229, 2021.
Ahsan Mahmood, Junier Oliva, and Martin Styner. Multiscale score matching for out-of-distributtin detection. arXiv preprint 21X::20100.13132, 2020.
Bjoern H Menze, Andras Jakab, Stefan Bauer, Jayashree Kalpathy-Cramer, Keyvan Farahani, Justin Kirby, Yuliya Burren, Nicole Porz, Johannes Slotboom, Roland Wiest, The multimodal brain tumor image segmentation benchmark (brats). IEEE transactions on medical imaging, 34 (10):1993-2024, 2014.
Siddhartha Mishra and Alex (Eds.) Townsend. Numerical Analysis meets Machine Learning. Hand- book of Numerical Analysis. Springer, 2024.
Roberto Molinaro, Samuel Lanthaler, Bogdan Raonić, Tobias Rohner, Victor Armegioiu, Stephan Simonis, Dana Grund, Yannick Ramic, Zhong Yi Wan, Fei Sha. Siddhartha Mishra, and Leonardo Zepeda-Núñezz Generative ai for fast and accurate statistical computation of fluids, 2025. URL hitts:://arii> orgg abs / 2409 18359
E. Nalisnick and et al. Why Normalizing Flows Fail to Detect Out-of--Dstribttion Data. In NewrIPS, 2020. URL ht httptt/sss/ppppeecccc.ne.ieeeeep
12

---

Published as a conference paper at ICLR 2026
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Hybrid models with deep and invertible features. International Conference on Machine Learn- ing. pp. 4723 4732.. PMLR, 2019a.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? In International Conference on Learning Representations, 2019b.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, and Balaji Lakshminarayanan. Detecting out-of-distributiio inputs to deep generative models using typicality, 2019c. URL https:
//arxiv..rg/abs//1..
02994
Tobias Pfaff, Meire Fortunato, Alvaro Sanchez-Gonzalez, and Peter W. Battaglia. Learning Mesh- Based Simulation with Graph Networks, June 2021. UR/httt::/axxii.or// orgp////00/bbb....
03409 arXiv:2010.03409 [cs].
Geoff Pleiss, Amauri Souza, Joseph Kim, Boyi Li, and Kilian Q Weinberger. Neural network out- of-distribution detection for regression tasks. 2019.
A. Quarteroni and Valli. Numerical approximation of Purtial differential equations, volume 23. Springer, 1994.
Bogdan Raonic, Roberto Molinaro, Tim De Ryck, Tobias Rohner, Francesca Bartolucci, Rima Alaifari, Siddhartha Mishra, and Emmanuel de Bézenac. Convolutional neu- ral operators for robust and accurate learning of pdes. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.). Advances in Neural In- Curran Associates, Inc.,
formation Processing Systems, volume 36, pp. 77187-77200.
neurips 2023. URL htttps:/ iew.ri/ wtw.iiss.ccppeeee ww/ppppp.ppppc.ccceeetp. htg.a//eee......o...oooooeeeeeer f3c.f3c155000 Bat.e//a..S.b....aaaaaaaaaaaaaee
Jie Ren, Peter J Liu, Emily Fertig. Jasper Snock, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distributiin detection. Advances in neural information processing systems, 32, 2019.
Olaf Ronneherger, Philipp
Fischer, and Thomas Brox. U-net: Convolutional networks for biomedi- cal image segmentation. In International Conference on Medical image computing and computer- assisted intervention, pp. 234-241. Springer, 2015.
Wenpin Tang and Hanyang Zhao. Score-based diffususoo models via stochastic differential equations a technical tutorial, 2024. /wR.itttpss///ax...o.rr.
v.wpaaaiivvvrooo wwtp:/o.swr////2222/222222 07487]
Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized -ustof-distribution de- tection: A survey. International Journal of Computer Vision, (32112)5635-56622 Dec 2024. ISSN 1573- 1405.
doi: 10. 12277//11123-02--222211 URL http://////o.....00.00...00000
611263-024-000
Tal Zeevi, Ravid Shwartz-Zij Yann LeCun, Lawrence H Staib, and John A Onofrey. Rate-in: Information-drive adaptive dropout rates for improved inference- -atrence-time uncertainty estimation. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 20757-20766, 2025.
Jinsong Zhang, Qiang Fu, Xu Chen, Lun Du, Zelin Li, Gang Wang, Shi Han, Dongmei Zhang, et al. diitr--dittiittion detection based on in-distribution data patterns memorization with modern hopfield energy. In The Eleventh International Conference Learning Representations, 2022.
13

---

Published as a conference paper at ICLR 2026
A THEORY AND MOTIVATION
A.1 MOTIVATION FOR JOINT LOG-LIKELIHOODS AS CERTIFICATES
We in the setting of ( and assume that the loss function e is of the form,
{(y, (x)) = y (x)),,
(5)
for some S oo. In practice, set p
We further assume that there exists a parameter yp", such that the resulting minimized loss is given by,
fly, V J
p(x) S sc<<l.
(6)
Hence, we assume that the generalization error of the trained model y Ue is very small.
Next, we fix 0 < < 1 and define the following two sets.
((x,)) v) E y Ely, V." (x)) v) ) B = (1x,0) E My, vx)) e
Clearly A C B as p - Denoting the probability measure as, P(C)-
/
vddzdy, A measurable C C X y
Xxy
we have that F(A) S P(B). By Chebychev's inequality, we obtain that,
Ely, V (x))p(z, v)dryy S cl / xxy
P(A) PPB) ca
(8)
Hence, we also obtain that,
1(A4)21-e-
Thus, under the assumption of well-trained and generalizable model Tp", we have, with very high probability of 1 -e--a the event that
A = [( v) xX :.y(yy Ely, V (x)))(( S {e
(10)
occurs.
Under the assumption that p(r, y) # O, for any (x, E X x V, we can divide in 110 to conclude that, with very high probability, we have a pointwise estimate of the form,
fly, V' (x)) <
(11)
p(., v)
Taking logarithms in 11 and observing that both its sides are positive results in the following pointwise estimate (which holds with high probability),
log (f(y, V (x))) S a log(e) log(p(x,
(12)
for all (r. E A
Under the assumption that log(p(z, v)) is locally Lipschitz in y. one can expand around (x(()) to obtain
log(p(z, (x)))) < log p(=, y) + Lyy - (x)), < log (0r v) Ll(g, v (x))², from
(13)
log pog,(r,)) y) (c²²)
where the last inequality follows from the fact that (a, y) B
Plugging
13 into
we obtain with high probability that,
log (fly, V (x))) < a log(e) - log(p(æ, V (x))) + +0 +
(14)
14

---

Published as a conference paper at ICLR 2026
which is precisely Eqn. of the main text.
Note that the above form Eqn. [4) clearly demonstrates that the loss is controlled terms of the joint likelihood-base certificate with very high-put tigh-probability and motivates our use of these certifi- cates.
In deriving
made some key assumptions, namely, i) that the model V/ has very low general- ization errors, L.e., it trains and generalizes well in-distribution ii) we have access to the likelihood (or good approximation of it) and iii) the ground truth probability density function is non-degenerate and log-Lipschitz In practice, these assumptions may not hold and we need to empirically verify whether likelihood-basee certificate is good indicator of the error or not. As demonstrated by the many numerical experiments in the main text, this does appear to hold, in general.
14
Finally, the inequality in (44 suggests that a high likelihood will result in low error. This fact is consistent with the observations in Table that the ACC and FPR scores therein are very high and very low, respectively. However, given the mequality in (14. we might expect that low likelihood might correspond to low error. Indeed, from Table [ we see that the FDR is, on average, three times higher than the FPR, making it consistent with the nature of the inequality (1).
A.2 TOY PROBLEM: ILLUSTRATE CONTRIBUTIONS JOINT LIKELIIOOD
In the following, we consider simple toy problems, where a simple cullilayer-perceptrey (MLP) is trained to regress on functions ld. In these examples, ,", E IK are real-valued, and connected by noisy relationship y² f(x*) with function f.
In A.2. we illustrate the importance of p(x*) ) by regressing on simple [xx but with an unbal- anced input data distribution p(z). In SI we illustrate the importance of taking into consider- ation pyypeed x²) in regression tasks. Here, the input distribution p(z) is balanced by construction, but the dependence of y² x² is more complex for positive inputs, x 0, than for negative inputs,
xx < 0.
A.2.1 IMPORTANCE OF p(z*).
In this simple example, we will explore 1d regression using a basic two-layer MLP. Our objective is to approximate a function f : IR + IR from data pairs (4g, f(x,,) + +e) where N represents the number of training samples. The noise term e, follows a normal distribution (0, 0.1), and is drawn from a specific distribution that we will define shortly.
scenario where the distribution of training inputs exhibits two modes: one that is sampled frequently and another that is sampled much less often. Specifically, we want to explore dataset where there are many samples for positive values of x, while negative values of are significantly underrepresented. Let define the density of training inputs to be:
We are interested
[W 1,0.5), p(z) = Nix;-1,;111 x<0 0.
>> O,
Note that there needs be some normalization constant C that the integral of p over RR is (there is also some cutoff at 0). Here, v represents the fraction of less represented mode in the data.
Given function f that we seek to approximate, we construct our training inputs by first selecting the number of positive samples, N_, and drawing them from (1,, 0.5). Additionally, we include vN++ samples drawn from (-1,,, 0.5) in the training set. For evaluation, we generate two test sets, one for positive samples and one for negative samples, each containing 512 points drawn from from./(1 (11, 0.5) and andd((11 (M11,, 0.5), respectively.
First, fix presents the target functions, training samples, prediction errors, and overall performance of the trained MLPs. Across all examples, we set N4 100 or N+ 200. Notably, the performance the + set is consistently 3 to 10 times better in every case. For the exact error, please take a look at the legend of middle figures.
0.1. We train MLP. fe. to approximate four different functions. Figure
Next, we fix // = 0.1 and examine how the errors for the + and - sets change as we vary the number of training samples, N_, for all the target functions. For each point the graphs, 10
15

---

Published as a conference paper at ICLR 2026
Osl
Seenn
Grund muth
Grard Presition
317
0.222
Oet -0355"+2
Mean La D.22
Graune Truth
Mean 0.200
Prediction
15'
Figure Performance
trained MLP fa on four different target functions. The figure illustrates the target functions, training samples, prediction errors, and overall model performance. Training is conducted with N4- = 100 or N= 200, and the results show that the performance on the + set is consistently to 10 times better. For exact error values, refer to the legend in the middle figures.
different models are trained, time with new training set, the mean L2 error calculated for each model, and the median of these 10 errors is reported. The results are presented in the left figures of Fi We observe that the T.2 errors consistently decrease as N4 increases, which expected. Similarly, the error for the class also scales with the number of training samples.
Finally, we set N4 200 (or N4 50 in case of linear function) and vary the fraction negative training samples, The right figures in Figure illuutrate how the L2 enror evolves as / increases. We observe that the performance on the class improves with increasing v, while the performance on the + class remains largely unaffected. For sufficiently large v, the errors for both classes become nearly equal. Note that for each point on the graphs, we trained 10 different models and used the same procedure above compute the errors.
16

---

Published as a conference paper at ICLR 2026
dlsss C956
dass 0555
1.28
2x10
1410
24.00
Trairing samples of dlsss
Factir
dlMs dlsee
cless clsss
km -274
Taining samples clacs
Tractor
clacx
Tractior
Figure 6: Impact of varying N_ and // on L2 eπrors for the regression problems from Figure 5 For each point on the graphs, 10 different models are trained. each time with new training set, the mean Lz error is calculated for each model, and the median of these 10 errors is reported. The figures on the left show how errors for the + and - sets change as N4 increases with v 0.1, demonstrating consistent decrease in error. The figures the right illustrate the effect of increasing while keeping N4 fixed, showing improved performance for the class while the + class remains mostly unaffected.
17

---

Published as a conference paper at ICLR 2026
(a) Regression model
(b) Diffusion samples (SDE)
(c) log likelihood log (2 y)
1.00
Sumpled ISEE
1a4
Pediction HNLp
55
52
Figure 7: (Left) Ground truth values (3) and predicted values fo (1), (Center) Samples drawn from the trained diffusion model, (Right) Joint prior log-likelihood log (2 v)-
A.2.2 IMPORTANCE OF P(prred xx'). Let us study the function
f(x) sin T.r
<<D 0
(15)
sin (25m.)))
The function is continuous and exhibits low-frequency behavior for negative inputs, while it becomes highly oscillatory for positive inputs.
We define the training set X ((x, I (x))) where 1)) and N 5000. This means that, on average, half of the dataset represents the low-frequency region of f. while the other half corresponds to the high-frequency region. We train model (an MLP), denoted as fe. approximate the function f using the dataset X. The model is trained for 500 epochs. The function fo provides good approximation of f in the region of negative inputs. However, for positive values of æ, phenomenon known as collapse to the mean value (as described in Molinaro et al. (2025) ) occurs. In this region, where f has high Lipschitz constant, fe lacks the capacity accurately approximate the function. The ground truth values of f, as well as the predictions of fo are given in the Figure (Left).
Next, we train ccore-based diffusion denoiser, Do, to generate samples from the joint distribution (I, fx)).. We expect the diffusion model samples to be concentrated around the curve (ar, (x)). For negative values of x, this curve occupies relatively small region of the plane, whereas for positive values of x, it spans a much larger portion of the plane. For that reason, for positive values of x, we expect the samples to be distributed (almost) uniformly in the region (0, 1) x (-1, 1, In Figure 7 the middle plot displays samples drawn from the trained diffusion model using the probability flow ODE sampler, while the right plot shows samples generated using the Marer-Maruyama SDE sampler. We observe that in the region of negative x values, both techniques yield the samples centered around the graph.
For any point (x, y) in the plane, one can estimate the log-likelihood log p(æ, y) using the instanta- neous change of variables formula in the probability flow ODE (see Tang & Zhao 2024g) to get
log log = log Pr (x(T)) + 1'" tt(
(16)
In our choice of the forward SDE, we set T' = 1, 1, while fa can be expressed in terms of the (es- timated) score function and the diffusion coefficient. The score function computed from the denoiser Do using Tweedie's formula. Note that the divergence term inside the integral in [6] can be estimated using Skilling-Hutchinng Hutchinson estimation (see Tang & Zhao (2024) for clarification).
Let us observe a 2d uniform, 128² grid in the region [-1,1] x 1]. For each grid point, we compute the joint log- likelihood log Po (z. y) using the formula 16 The resulting likelihood values are shown in Figure 7 (Right). It is observed that for negative values of x, the density is concen- trated around the graph, while for positive values of x, the probability distributed across the entire
To he more precise, relevant analysis in Molinaro et al. 2025 suggests that the distribution has approxi- mate density da dy/ / y²
18

---

Published as a conference paper at ICLR 2026
region [0,1] [-1, 1], as expected. We note that while estimating the log- loellikkissoods an addi- tional correction arises by solving the probability flow ODE backwards in time to obtain log-prion log (T(TT, Vr).
A.3 LIKELIHOOD ESTIMATION
Joint log-likelihodss (Eq. 16 are computed using the RK38 solver from the integrate_tore library for the initial value problem (and RK45 in 1d experiments). The divergence term is approximated via a stochastic estimator (see (Tang & Zhao 2024 Appendix D.2)) with 32 Monte Carlo samples.
A.4 DECISION BOUNDARIES
After both the problem speecifc model and the diffusion model are trained, the likelihood function and error bounds are defined to support decision-making, are given a task-specific model g : X - Y, a eistiiood-estimatioon function L. (X, Y) + I (derived from the trained denoiser Dd), and a small set of M N input-output pairs (24, 91)
well as hypothesis testing. Assume we
X Y, i == L,..., M, sampled from the training distribution.
The decision boundaries illustrated in Figure C in the main text are derived using a small subset of input-output pairs from the training set (dark blue dots). The vertical dashed line represents certificate threshold. Samples to the right of this line (higher values) are classified as in-distributtio (ID), while those to the left (lowe values) are classified as out-of-dittribution (OOD). The horizontal dashed line represents the error threshold. Samples with low certificale values expected to lie above this line with high probability (they have large prediction errors), while samples with high certificate values will lie below it, in general (they have small errors). This separation defines four quadrants:
Quadrant I (upper right, high certificate and high errors): These are the most problematic points. They are classified ID based certificate, but their large errors indicate they should be OOD, (i.e. false positives).
2. Quadrant II (upper left, low certificate high errors): These are true positives for OOD detection, correctly identified as OOD due to low certificate and high error.
3. Quadrant III (lower left, low certificate + low errors): These are false negatives, samples classified as OOD even though their prediction error is small. These occur trade-off to keep Quadrant small. The horizontal error threshold is chosen not to be too high.
4. Quadrant IV (lower right, high certificate + low error): These are true negatives. They are correctly identified as ID, with both high certificate and low error.
The objective is to maximize the number of true positives (Quadrant II) and true negatives (Quadrant IV) while minimizing false positives (Quadrant I). False negatives (Quadrant III) are an acceptable trade-off for (more) strict control over false positives.
There multiple ways define the certificate and error boundaries. Given M testing onput-output pairs, we first compute the certificate values
1, Lo (xi, (x:))
and the errors
e; = 1lys - (x:))l)
We then calculate the median of the certificate values, median(4), and their standard deviation, = st.( The certificate boundary (vertical line) is defined as
Io m a--0 a,
where a is tunable parameter, set to = 1.5 in all our regression experiments. The error boundary es (horizontal line) defined as the (100 - B)th percentile of the error values. our regression experiments, we set 3 = 0.05. We also conduct ablation studies to compare alternative methods for defining lo and cb. and to test the stability of the resulting boundaries across different definitions. Note that the error boundary is introduced only define the quadrants. One should keep in mind that the error boundary can be defined differently, depending on the use case and the acceptable margin of error.
19

---

Published as a conference paper at ICLR 2026
hpuu
Ground Truth
Prediction
0.15
0.10
045
0.00
14
20
24
Cor
Figure 8: Wave equation. A randomly selected ID sample (q dist.). Absolute L1 error is 0.097. The estimated log likelihood is 19.78. Parameters for this samples are K 28 and -0.79. A posteriori error estimate (defined B.4) is 0.10 + 0.02.
B EXPERIMENTS
B. WAVE EQUATION
Problem Setup. In this experiment, we study Wave equation
der e² Au 0, in D (O,T), uo(2, (x. r, r,K,,aj) any)
(17)
with constant speed of propagation = 0.1 and the initial condition given by
K
f(z, y K, az)) = Oij" (6 (²) (in((r sin(Tju),
Σ
(18)
where K is the number of active Fourier modes, is the spectral decay and ai are coefficients of the respective modes. The exact solution at time f is given by
K
u(.,y, = Σ at (2 + (²)= sin(ri)) sin (Trjy) cos (CTV/P+3) 12 v(a,))
Our objective is to approximate the operator G: ul:: 5).
Data distributions. As it is described in the main text, we define the training distribution For each initial condition, the parameters are distributed as U(0.75, 0.85). K Udiscrete (20, 28). and 0g ~ ((1100, 1.0). Once the model G. is trained on the training set X = (Jn. ((fm)) we want to test its performance the testing distribution For each initial condition, the parameters are distributed as r U(.655, 0.925), K ~ Vdiserene (16,32), and a. ~ (1-1.0, 1.0). We observe that the supp(p) C supp(g). Therefore, expect that some samples drawn from distribution q will be similar to those from p. while others may differ significantly. Note that we use only N = 1000 samples in the training set.
Wave Equation Critical Region (CD) To better analyze the intermediate region for the Wave equation, we further split the OOD class. We define critical (CD) subset where certificate values fall within (4, - 3,,, 1.5g), while samples with certificates below / - 3a are classified as (pure) OOD.
B.I.1 JOINT LOG LIKELIHOOD VS L1 ERROR
We show an example of predicted and a ground-truth sample from ID and OOD classes in Figures [ We observe that the parameter K and the decay r of the ID sample Figure aligg with parameter group of the y-distribution. The OOD sample in F correspoodd to K 31, a value not encountered during training, and is associated with r = -0.85 decay. This leads to inaccurate model predictions, indicated by the eиror and the low likelihood valuc.
We show a scatter plot the estimated likelihood certificate vs the L1 error in Figure 10
We show the joint histograms of the parameter values (K,r) for ID samples (left), critical samples (center), and OOD samples (right) (see Figure IT.. The ID samples predominantly correspond to high values of the decay parameter (r < 0.75) which is the minimum observed value of r in the training set. Critical samples tend to have intermediate values of r, whereas OOD samples are described by both low values and usually high K values.
20

---

Published as a conference paper at ICLR 2026
025
020
0.15
0.10
Certitatts
Figure 9: Wave equation. A randomly selected OOD sample (q dist.). Absolute L1 error is 0.227. The estimated log likelihood 16.12. 12. Parameters for this samples are K and -0.85.
posteriori error estimate (defined in B.4) is 0.21 + 0.02.
028
015
Livel
Lant slagpl Jowel
Figure 10: Wave equation. Likelihood erroo error plane illustrating in-distribution (ID) and out-of- distribution (OOD) classification boundaries, with quadrants indicating true/false positives and neg- atives.
DISE
Train
Train Dist.
Figure 11: Wave equation. 2d histograms of the values of the parameter K and the decay for ID samples (left), critical samples (middle) and OOD samples (right). The rectangular region in red represents parameters of the training distribution.
Tul D.t.
Tesn Tae
Figure 12: Wave equation. Left: Histogram of estimated likelihoods of the samples drawn from p distribution (training) and q distribution (testing). Right: Histogram of relative Lı errors for the same samples.
21

---

Published as a conference paper at ICLR 2026
100 Epects
200 Ipecte
250 Epocts
303 Epoc 1s
500 Esocks
Error
10-1
10
20
25
Joint Log Likelihood log plc, Verea)
Figure 13: Evolution of the joint log-likelihood log p(a, Uprod) versus the L, error across training checkpoints of the diffusion model. Likelihoods are estimated using models trained for 100, 200, 250, 300, and 500 epochs. As training progresses, the joint likelihood estimates become more informative for error detection, with the final model (500 epochs) exhibiting a clear correlation between likelihood and prediction error.
B. 1.2 SENSITIVITY TO THE DIFFUSION MODEL.
We now examine the extent to which the diffusion model needs to be trained to be effective for OOD detection. We train the model 500 epochs, corresponding to approximately 8k gradient steps. The estimated likelihoods shown in Figure 10 of the main text are obtained from the diffusion model trained for 500 epochs. We now repeat the likelihood estimation using intermediate checkpoints of the model trained for less epochs. Figure 13 illustrates the progression of the L1 eπтоr versus the estimated joint log-likelihood log (xx Mpred/ throughout training. As the model is trained for more epochs, the estimated likelihood becomes increasingly correlated with the prediction error, with the final model (trained for 500 epochs) showing a noticeable correlation between the two.
We observe that the average estimated log- likeliieeoood over both the training and testing distributions increases steadily throughout training. Figure 14 shows the evolution of the median estimated log- likelihood the training distribution (red curve) alongside the validation EMA loss (blue eurve). In the beginning. the median log-likelihoor remains close to zero for the first 150 epochs. It then rises over the next 250 epochs, before gradually saturating in the end of training. The saturation coincides with the plateauing of the validation loss.
In Figure 15] the model evaluated at epoch 400 shown on the left, and at epoch 500 on the right. The two plots are nearly identical, which indicates that the model's capability to explain the data remains consistent across these two checkpoints. This suggests that once the diffusion model is sufficiently trained, it provides reliable performance for OOD detection.
1.1.3 CLASSIFICATION SENSITIVITY
In this section, we address the following question: What is the number of samples required to achieve reliable classification performance?
Figure 16 shows how the classification boundaries, based on the estimated joint log- log-likelihood, evolve as the number of randomly selected training samples increases. With only samples, the classification is conservative, resulting in many test samples being labeled as OOD. As the number of samples used for decision-making increases, the boundaries become more stable and more reliable. At 128 samples, the classification boundaries well-formed and lead to good performance.
1.4 REGRESSION MODEL ARCHITECTURE ABLATION
In this section, we evaluate the proposed framework using various regression architectures. Instead of the previously used CNO model, we now consider ViT Dosovitskiy et al. (2020). UNet Ron- neberger et al. (015)) and C-FNO Molinaro et al. (2025) architectures (see D.4 for architectural details). The same diffusion model trained in earhir sections is used here. Each regression model trained on the same dataset used for the CNO experiments. Figure 17 presents the L, emors plot-
22

---

Published as a conference paper at ICLR 2026
20
Median of Joint Log Likelihood
2.00
Validation EMA Loss
15
1.75
1.50
-10
1.25
0.75
0
100
200
300
400
500
Epoch
Figure 14: Evolution of the median estimated joint log-likelihood on the training distribution (red) and the EMA validation loss (blue) during the training. The estimated likeliilloood remains low during the initial phase. increases between epochs 150 and 400, and saturates as the validation loss begins to plateau.
I
1D
Critical
Critical
Goo Train
Train
Joint Log Likelhhodd por. Venal
joint Log Likelhhod pix, Hunol
Figure 15: Comparison of the L1 error versus estimated joint log-likeldhood p(x, Mpred) train- ing epochs 400 (left) and 500 (right). The similarity between the two plots indicates that the model's behavior stabilizes, and the likelihood estimates remain consistent once sufficient training done.
Labe
(d) 128 samples Figure 16: Effect of the number of training samples on the stability of classification boundaries based on the estimated joint log-likelihood log p(x, Mpred). Each subplot shows the L, error versus estimated ligeliill for different numbers randomly selected training samples: 8, 32, and 128.
(a) 4 samples
(b) 8 samples
(c) 32 samples
23

---

Published as a conference paper at ICLR 2026
12
100 12.5 35.0
235
(a) VIT
(b) UNet
(c) C-FNO
Figure 17: Comparison of L and estimated joint log-likelihoods log p(2; ypred) for different regression architectures (VīT. UNet, C-FNO) using the same diffusion model. While low likelihoods consistently correspond to high-error samples within each model, the absolute likelihood values not comparable across models.
BERR
31
aL
Accuracy
FPR
FNR
0.05
1.5
0.855
0.040
0.105
0.01
1.5
0.861
0.026
0.113
0.25
1.5
0.813
0.133
0.054
0.05
1.0
0.827
0.019
0.154
0.01
1.0
0.821
0.012
0.117
0.25
1.0
0.819
0.095
0.086
0.05
2.0
0.865
0.069
0.066
0.01
2.0
0.877
0.054
0.069
0.25
2.0
0.777
0.186
0.037
0.05
0.05
0.857
0.061
0.082
0.05
0.01
0.851
0.106
0.043
0.05
0.25
0.770
0.010
0.220
Table 2: Wave equation. Performance metrics (accuracy, FPR, and FNR) for different configurations of the error-boume boundryy percentile SERR and the likelihood boundary parameters: either percentile- based (Bz) aatiaan--nndttnnrrddaaa siriaatio---eeedd (azz) definitions.
ted against the estimated joint liglliiess log pa (z, Ypred) for the different models. Similar to the CNO case, we observe that samples with low likelihoods correspond to high prediction errors, whereas samples with high likelihoods exhibit lower errors across all tested architectures.
We find that this method cannot be reliably used for model selection. Although the estimated log- likelihoods for the C-FNO model are higher than those for the ViT and UNet models, its correspond- ing prediction errors also higher. This indicates that only the relative likelihoods within single model are meaningful, while comparisons of estimated likelihoods between different models are not interpretable.
B. DECISION BOUNDARIES ABLATION
We now analyze the dependency and stability of the accuracy, FPR, and FNR as the positions of the likelihood certificate and error boundaries are varied (defined in A.4). While the error bound- ary is always defined using percentile-based approach, for the likelihood certificate boundary we compare the median and std method with an alternative percentile-bur the variation in accuracy, FPR, and FNR as the parameters for the error- and grelihood-boundaae estimations are adjusted. We find that accuracy remains relatively stable, even when BERR is as high as 0.25. The best results achieved with a 1.5 and BERR {0.01, 0.05). One should keep in mind that the error boundary can also be specified manually. This section presents an ablation study on approach defining this boundary.
definition. Table 2 shows
24

---

Published as a conference paper at ICLR 2026
B.1.6 COMPUTATIONAL COMPLEXITY OF THE JLBC FOR OOD DETECTION
As discussed in SMA.3 our certificate estimation procedure uses the RK38 solver. We a single integration step from { = 0 to 1. Because RK38 is fourth-order Runge-Kutta method, this requires only four internal substeps to solve the probability floo ODE. The Skilling Hutchinson divergence is estimated using random tensor of size 32. This choice was made in (largely) heuristic manner. evaluate impact of this choice, we perform an ablation study on the random-tensor size. All inference experiments were conducted on single RTX 4090 GPU. The performance metries and samplewise certificate computation times are reported in Table
The results indicate that the complete certification process requires only a fraction of a second per sample. The metrics remain highly stable even when the random-tensor size is reduced to 2, in which case the per-sample inference time is approximately 0.02s. Importantly, the diffusion model requires retraining or finetuning at inference time, as the proposed method identifies ID/OOD samples in a fully zero-shot manner.
JLBC Tensor size
Certificate time [s]
AUROC
ACC
32
0.211
0.936
0.855
8
0.062
0.936
0.859
0.020
0.937
0.857
Table 3: Computation time and performance of the JLBC certificate across different random-tensor sizes.
B.1.7 COMPARISON WITH BAYESIAN APPROACHES
The OOD detection problem be interpreted through the epistemic uncertainty point of view. High epistemic uncertainty (that indicates the model's lack of knowledge about the system) typically indicates that input lies outside the training distribution. Estimating this uncertainty and using as a scalar score enables Bayesian models to act as OOD) detectors. In this context, methods such MC-Dropout Gal & Ghahramani (2016) and Rate-In Zeevi et al. (2025) dropout during both training and inference, allowing for stochastic forward passes that approximate Bayesian inference by randomly sampling subnetworks.
We our model on the Wave Equation experiment against MC-Dropou and Rate-In. MC-Dropout estimates uncertainty by performing multiple stochastic forward passes with dropout activated dur- ing inference (approximating a Bayesian ensemble). The Rate-In method can be viewed as a more advanced variant of MC-Dropout, where the dropout rates used during inference are adaptively tuned. This adaptation increases inference time compared to standard MC-Dropout, but results in higher accuracy and AUROC. We also re-evaluate the JLBC model (marked with in Table using a newly trained version that includes dropout (p = 0.1). Overall, the Liffusion-based approach re- mains dominant, achieving much higher performance while requiring only about 0.02s per sample for certificate computation. This computation time is roughly five times faster than Rate-In In despite its lower accuracy. Note that model accuracies computed using fixed threshold correspond- ing to the mean plus/minus 1.5 standard deviations of the score, while the AUROC metric remains wreshold-independeee
Figure shows the histograms of error versus certificate values for JLBC, MC-Dropout, and Rate-In. Among the three, JLBC provides the clearest separation between ID and OOD samples. The Rate-In performs second best and MC-Dropout shows the weakest distinction in this setting.
25

---

Published as a conference paper at ICLR 2026
JLBC Tensor size
Certificate time [s]
AUROC
ACC
32
0.211
0.955
0.873
0.020
0.955
0.869
MC-Dropout Tensor size
Certificate time [s]
AUROC
ACC
32
0.028
0.526
0.407
0.002
0.642
0.676
Rate-In Tensor size
Certificate time [s]
AUROC
ACC
128
0.240
0.809
0.742
32
0.150
0.816
0.762
0.120
0.714
0.693
Table 4: Comparison of diffusion-based certificates, MC-Dropout, and Rate-In approaches across different random tensor sizes. JLBC uses random tensors for estimating the divergence term in the probability-flov ODE, whereas the other two methods use them for Monte Carlo estimation. The diffusion certificates achieve high accuracy and AUROC with low computation time, while MC-Dropout and Rate-In provide weaker uncertainty estimates. Rate-In method offers moderate improvements over MC-Dropout at the cost of higher runtime. With sufficiently large tensor sizes used during Rate-In in inference, the performance eventually reaches saturation point.
(a) MC-Dropout
(b) Rate-In
(c) JLBC
0.80
608
410
609
Inc-Cropoul Cartificate
Rale-tn
Centifictte
Figure 18: Histogram of error versus certificate values across different methods. JLBC and Rate- In are evaluated using 32 random samples, while MC-Dropout uses 2 samples (corresponding to its best-performing configuration). JLBC exhibits the strongest separation between ID and OOD samples, followed by Rate-In. In. The MC-Dropout performs the weakest under these settings.
26

---

Published as a conference paper at ICLR 2026
B.2 HAVIER-STOKES
Problem Setup. In this experiment, we study Navier-Stokes equations
+ (u Vju+ + Vp vAu, div = 0,
(19)
in the torus D T2 with periodic boundary conditions and viscosity v x 10 only applied to high-enough Fourier modes (those with amplitude 2 12). The data taken from the papers Raonic et al. 2023) and Herde et al. (2024).
In this section, we validate our intuition on time-dependent 2D Navier-Stokes equation problems. To achieve this, define six datasets of varying difficulty (mainly taken from Herde et al. (2024) namely:
1. NS-Sines. We consider the following initial conditions,
(x,
aijj sin (2 + Br.)) sin(2rjy + ww.s
(2 (i j))9
:-=1
(20)
u. v)
Oijj
cos cos (2riz + Bi,)) cos (2s(2 + ttg))
(2 5))8
1,j=1
where the random variables are chosen Cijj ~ 11-1111- Sa, (0 and %. ~ ((.2m))
The number of modes p is chosen to be p = 10, while the spectral decay is = 1/2.
2. NS-Sines Moderate. The initial conditions have the same form as 20 but with the spectral decay q 1. The higher order modes are dampened to greater extent, making the solution less chaotic.
3. NS-Gauss. Given tvo-dimensional velocity field (uzz Uy), its vorticity is given by the scalar w = curl u = Ug - 0yUg. We specify the initial conditions in terms of the vorticity, given by,
wolx, v) = Σ exp (x- x2,)2 + (y y:) i=1
ai 0i
(21)
20
where we chose = 100 Gaussians with a; 111111, ai 40.01.111. ~ Mo.1j. and y/ Mj..1. 4. NS-Shear Layer. We take initial conditions the shear layer,
tanh 2T V-2.5
for y + as(x)) S
uo(x, y) tanh 2n otherwise 0.75
(22)
vo v)
where og [0,1] + is a perturbation of the initial data given by
as(x) = = +
On (2 - Bx).
(23)
k=1
The parameters are chosen to be p ~ U4T,8,..123 as Mp.1). Ba Uj.22/ 0.025,
p ~ Mo.00 (0..0.0..2)). and L[--0.0025...00 0.625)).
5. NS-Brownian We generate Brownian Bridges directly in Fourier space with the following method:
W(x)=
Σ
Σ
a scm (
(mne)
(24)
| m.n,eE(0.11
1 SN
where
(in(2))
for i =
sc, sc, (x)
(25)
cos(2) (z) for i
and the af (mné) 1111 These Brownian Bridges are propagated through the discretized Navier-Stokes system from time / -0.5 to = 0.
27

---

Published as a conference paper at ICLR 2026
LBC
DPath
SFNS
SBDDM
MSSM
Joint LBC
ACC
0,404
0.487
0,486
0.487
0,484
0.947
NS-MIX P(X)
FPR
0.187
0.345
0.339
0.345
0.343
0.009
FDR
0.518
0.994
0.976
0.994
0.988
0.024
Table 5: Approximation of p(æ) used for OOD detection for NS-MIX fails completely for diffusion- based baselines. We here include our proposed Joint LBC (JLBC) based estimating p(a,, Upred) as a reference for comparison.
6. NS-PwC. The initial vorticity is assumed to be constant along uniform (square) partition of the underlying domain and is given by,
wo(r, y) = Ci.j in [x x [1
(26)
for r; = for i = 0. P. and Ci.j 11-1111 The number of squares in each direction was chosen to be 10.
p
Each dataset consists trajectories that are made of 11 solution snapshots (input + 10 solution snap- shots). Note that in Herde al. 2024), the original trajectories have length of 21, but we subsam- pled them to length of 11 by selecting every other snapshot in time. For both the regression and diffusion tasks, we use an al/2all training strategy, as recommended in the original work.
For the NS-MIX dataset, training is conducted on a combination of:
NS-Sines
NS-Gauss
NS-Shear Layer
The model is trained on full trajectories, with 18K trajectories in total, yielding nearly 3M I/O pairs.
For the NS-PwC dataset, training uses 5K trajectories length 8 (the first 8 snapshots). Figure shows the L eгror vs the likelihood certificate for the two experimental settings. Note that the decision boundaries for the NS-MIX dataset are derived only from the NS-Gauss and NS-Shear Layer datasets. Although the model was trained on the NS-Sines distribution well, its errors remain very large. This because NS-Sines requires much more training trajectories than 18k to achieve (highly) accurate predictions.
In both NS-MIX and NS-PwC, the models are evaluated across all six distributions described above. The final evaluation is performed on the 8th solution snapshot.
In the NS-MIX experiment, we present randomly selected samples from all test distributions, in- cluding the inputs, ground truth solutions, predictions, and corresponding absolute error.. While the predictions for NS-Sines and NS-Sines Moderate may not appear highly inaccurate at first glance, the diffusion- based certificate successfully identified them OOD, since their errors signifi- cantly larger compared to other distributions. This also evident in the absolute error plots, where large values occur only for NS-Sines and NS-Sines Moderate. For details, Figure 23
In the NS-PwC experiment, we additionally show randomly selected samples from all the test dis- tributions (see 24 While the solutions from the NS-PwC and NS-Brownian distributions well approximated, the trained model fails to generalize to the other four distributions, whose samples classified OOD.
B.2.1 INSUFFICIENCY OF p(x) AS CERTIFICATE
In the Table 5 we show the accuracy rates and other metrics for baselines (defined in C on the NS- MIX problem, based estimating the input distribution p(x) alone. We observe that all certificates derived from such a task-agnostic approach completely fail on this dataset. This result highlights the necessity of joint-distribution-aaass approach for obtaining reliable certificates.
28

---

Published as a conference paper at ICLR 2026
NS PVICIT
NS NS-Gsuss
Absolute L. Eiror (AR)
Absolute (AR)
NS Easy
NS
NS Brownion
Sn
32-2
10-1
pix. Yored aul pix, Veres mR)
pOOr Vores.oe) 0.5 pOr, Yoma.ao
(a) NS-MIX
(b) NS-PwC
Figure 19: Absolute L1 error versus likelihood for four experimental settings. Each plot shows re- sults for different testing distributions, with the vertical dashed line indicating the likelihood thresh- old and the horizontal dashed line indicating the error threshold. These decision boundaries divide the space into four quadrants corresponding to true positives, false positives, true negatives, and false negatives.
Absolute L, Error (AR)
NS Sin
NS
NS
Sin Easy
NS Browmin
NS PWC
5.0
5.2
5.3
5.4
5.5
5.6
5.7
plx, aaren.an)
Figure 20: Ablation Study for the certificate. Training distribution is NS-MIX.
B.2.2 ABLATION STUDY ABOUT THE EVALUATION OF THE LIKELIIOOD
If the models evaluated autoregressively (AR), our certificate for the time-dependent problems evaluated as
s(x) = 0.5 p(z, yDIR) + 0.5 p(z, VAR).
where VAR is the AR prediction, while YDIR the prediction obtained by directly approximating the solution at the test time T'. We do not use only the p(æ, yAn)), as the model is not trained to make predictions in autoregressive manner. The model is trained to directly predict the solution, so YDuR is the real indicator of how well and accurate our model performs. In the paper Herde et al. (2024), authors noted that AR evaluation is sometimes beneficial for the model performance, but is unclear when this strategy leads to better performance. For NS-MIX and NS-PwC, we use uniform AR rollouts, using 7 AR steps, with the final evaluation corresponding to the 8th solution snapshot.
Let test PAR ( p(z, yAR) tions, such as NS-MIX, ( (I) is good certificate, as seen in Figure 20
certificate. For sufficiently complex training distribu-
However, (x) is not always the best possible indicator. Take for example NS-Sines Moderate training distribution. We trained a regression and a diffusion models on 4.5K trajectories of length 8. If ( is used, some of the samples that have larger than 20% relative eπror classified as in-distribution. The mixed certificate is more conservative, as punishes the model's inability to directly predict the solution (with one forward pass). In Figure 21 show the performance
29

---

Published as a conference paper at ICLR 2026
Abcolute Error (AR)
Absolute L, Error (DIR)
20--
Sin
NS
Gauss
pix. Vomd,an)
plx,yeees on))
Figure 21: Ablation Study for the certificate. Training distribution is MSdden-Moderate. Left: AR Evaluation with the certificate p(r, yAR). Right: Direct Evaluation with the certificate p(z, YDIR).
Absolute L, Error (AR)
10-1
Easy
plx. Yarea.
Figure 22: Ablation Study for the certificate. Training distribution is NS-Sines Moderate. Evaluation with mixed certificate.
of the certificate SaR()). In the same figure, right, show the error of the direct evaluation vs p(z, (DrR). We see that the model is generally unable to accurately predict the solution with direct evaluation in case of NS-Gauss. Thus, cannot expect the performance of the AR evaluation be accurate, either. The results of the mixed certificate are shown in Figure 22
30

---

Published as a conference paper at ICLR 2026
(a) NS-PwC
(b) NS- Brownian
(c) NS-Shear Layer
(d) NS-Gauss
(e) NS-Sines Moderate
(I) NS-Sines
Figure 23: Randomly selected samples from the testing distributions in NS-MIX experiment, show- ing inputs, ground truth solutions, model predictions, and corresponding absolute errors. While pre- dictions for NS-Sines and NS-Sines Moderate appear visually reasonable, their significantly larger eπrors compared to other distributions allow the diffusion- certificate to correctly flag them as OOD. Note that the ground truth outputs, predictions, and absolute errors have the same colorbar.
31

---

Published as a conference paper at ICLR 2026
(a) NS-PwC
(h) NS-Brownian
(c) NS-Shear Layer
(d) NS-Gauss
(c) NS-Sines Moderate
(f) NS-Sines
Figure 24: Randomly selected samples from the testing distributions in NS- NS-PwC experiment, show- ing inputs, ground truth solutions, model predictions, and corresponding absolute errors. The pre- dictions for NS-PwC and NS-Brownian appear visually accurate, while the remaining distributions exhibit larger errors. Our method successfully identifies these other distributions as OOD. Note that the ground truth outputs, predictions, and absolute errors have the same colorbar.
32

---

Published as a conference paper at ICLR 2026
model Constart prediction
Absolute L Error
Africa
Adio
log Yoned
Error
Figure 25: Humidity prediction. Left: L errors vs. Estimated log likelihood for different testing datasets. Right: Histogram of absolute errors for 12-hour humidity predictions. The comparison is between our trained model and a persistence forecasting baseline, which assumes no change in humidity over time.
B.3 HUMIDITY FORECAST
In this experiment, we use MERRA-2 satellite data to forecast surface-level specific humidity over various global regions, in a period January-April. Refer Figure 26 for illustration of the data format. The objective to predict specific humidity 12 hours into the future. We evaluate our models on humidity prediction for the year 2023 using four different test datasets:
1. South America Training region
2. Australia and Oceania region
3. African region
4. Asian region
Since humidity patterns vary significantly across continents, we expect poor performance in regions that differ from the training domain. Figure[55 presents pressenss Lı errors plotted against the estimated log- likelihood Upred), where Ypred denotes the 12-hour predicted humidity. We observe that the diffusion model assigns high likelihoods (corresponding to low prediction errors) to samples from South America. Samples from Australia get slightly lower likelihoods and are mostly identified as OOD. As expected, the African and Asian datasets fall entirely within the OOD region.
We observe that the predicted humidity appear too smooth, lacking fine-scale structures. This is expected, as capturing small-scale features challenging without providing additional information (such boundary conditions, auxiliary variables like wind speed, air temperature, pressure, etc). In fact, our regression task is mathematically ill-posed, so perfect predictions are not expected. In 25 (Right), we compare the error histogram of our model's 12-hour humidity predictions with persistence forecasting baseline, where the humidity is assumed to be constant over time (the output identical the input). The comparison shows that our model clearly outperforms the persistence baseline. This is evidenced by the error distribution of our model being shifted to the left. Note that all the statistics are computed over normalized data.
33

---

Published as a conference paper at ICLR 2026
(a) South America
Input
Ground Truth
Prediction
0.0175
0.0125
Huridlly
0.0100
0.3075
0.0050
(b) Australia
Input
Ground Truth
Prediction
0.018
0.316
oooo
0.014
0.012
0.308
(c) Africa
Input
Ground Truth
Prediction
0018
0,014
0.012
Humblly
0.010
0.088
0.004
0.002
(d) Asia
Input
Ground Truth
Prediction
0.016
0.014
0.312
0.310
Hurnitity
F
0.308
0.006
-0 0.004
0.902
Figure 26: Humidity prediction over different testing regions.
34

---

Published as a conference paper at ICLR 2026
020
L. Emnr
035
Cartiicate
Figure 27: Fitted exponential curves of regression error as a function of the certificate (estimated log-likelihood) for the Wave Equation, NS-MIX, and MERRA2 test cases. Shaded regions denote the percentile deviation regions, within which the majority of test samples are contained.
B.4 A POSTERIORI ERROR ESTIMATES
Once the regression and diffusion models are trained on the training distribution, and set of test samples is available, the prediction error be observed function of the certificate values (in our case, the estimated log-likelihood). We illustrate this relation in three settings: Wave Equation, NS-MIX, and MERRA2. We assume the availability of approximately 64 samples (i.e. input-output pairs) from the test distribution for constructing the error cert-ficte curve. For the Wave Equation, all 64 samples come from single test distribution. In the NS-MIX case, with six distributions, we take 11 samples from each (66 in total). For MERRA2, which has four test distributions, we consider 16 samples per distribution (64 in total).
We compute the I errors of the regression model on the available test samples and estimate the corresponding certificates. parametric exponential function of the form
y (x) exp(-ba) c
then fitted to the certificate-erros pairs. Figure 27 presents the fitted curves for the Wave Equation, NS-MIX, and MERRA2 experiments. From each set of samples, we evaluate the absolute deviation between the fitted curves and the true errors, and calculate the 75th percentile of these deviations. Majority of the test samples are contained within the 75th-percentile bands.
35

---

Published as a conference paper at ICLR 2026
B.4.1 INFERENCE ON TRAINING DISTRIBUTION
In certain situations, the goal is evaluate how well the model generalizes within its own training distribution. The challenge in this setting is to identify the "most difficult solutions" that lie inside the training distribution. In such cases, one can also perform posteriori error estimates. We earry out these estimates on the training distributions of the Wave Equation and NS-PwC experiments. set of samples from the training distribution is used to determine both the likelihood and the envor bounds, as well as to fit the exponential relationship between the certificate and the emror. To establish the uncertainty bounds, we apply the 75th-percentile rule. We present the error fits alongside the corresponding error-certificate histograms for the Wave-Eq and NS-PwC experiments in Figure
Ablation of threshold. In the previous cases, the uncertainty bands were defined using the 75th percentile of the absolute eтror deviations as the threshold. We now vary this threshold and illustrate how the uncertainty bounds evolve the threshold value increases. Figure 29 shows this evolution for the 65th, 75th, 85th, and 95th percentile bounds for the Wave-Fq experiment. We find that at the 75th percentile, the vast majority of samples lie within the bounds while the underlying uncertainty remains moderate. At the 95th percentile, nearly all samples are contained within the bounds (at the cost of significantly larger uncertainty).
314
Errrr
L, Errar
0.10
220
3.0
035
75-percentil
percecentlee
21
Certificate
Cortificate
0.07
4.
E.99
Exponential Ri
Exponential At
TSparceellle
75percentle
Cortificato
Cortificato
Figure 28: Error fits and corresponding error-certificate histograms for the training distributions. The top panels show results for the Wave Equation, while the bottom panels correspond the NS- PwC experiment.
36

---

Published as a conference paper at ICLR 2026
(a) 65-percentile
(b) 75 75-percentile
(c) 85 88-ppeceetelee
(d) 95-peceeetile
Figure 29: Evolution of the uncertainty bounds for thresholds set the 65th, 75th, 85th, and 95th percentiles. Lower thresholds (e.g., 75th) capture most samples with moderate uncertainty, while higher thresholds (e.g.. 95th) capture nearly all samples but result in larger uncertainty.
37

---

Published as a conference paper at ICLR 2026
B.5 IMAGE CLASSIHICATION
Let be image with channels (where 3 for RGB images and 1 for grayscale images). Let be the label associated with that image. The goal of a classification model y is to predict the label y of the image In probabilistic terms, it is challenging work with p(æ. Strue) and interpret p(z, Upred) in a continuous sense, since is discrete label. Although the predicted label is discrete, the model Ve trained using a seftma-bbased loss function, which assigns log-pree ogg-robabbilites to all possible labels and maximizes the log-probability corresponding to the true label
On top of the classifier, train a diffusion model to predict the joint probability function p(ar, y)- During training, we concatenate an additional channel containing the constant value y to the c channels of the image I. During testing, leveraging the output of the classifier. In that case, only the label corresponding to the highest log- probability would be used in the likelihood estimation. Relying only on the predicted class does not capture the confidence of the classifier in its prediction. To address this, we define the predicted label as a function of the full set of log- bog-probabilities produced by the classifier, represented by the last layer (before the softmax is applied).
only use predicted label Upred, we are not fully
Let M be the number of classes and (/2, .2,,, IM) be the corresponding bog-probabilities. Let fI...., M } and let us define the probability Pm as softmax applied to the log probabilities, that is,
exp(Im/TT)
Pm
1 exp(Ie/T)
where T' is the temperature parameter that set to T' = 1. Let be the resolution of the image, i.e. each channel of the image is in R=² Instead of assigning constant value for each pixel of the label channel, we observe pixels as single realizations of i.i.d. random variable that follow discrete distribution over 21, ... .M) }. with associated probabilities P2,.P2,... ..... Par]. In this way, predictions with low confidence introduce variability into the label channel, effectively "corrupting" those samples. Consequently, samples for which the classifier is confident remain mostly unaffected. By incorporating uncertain label values, we effectively perturb the one-dimensional manifold on which the labels reside.
Note that the classifier can predict wrong label with high confidence, but our hope is in the following:
This does not happen often. The classifier is usually uncertain about OOD samples.
The diffusion model itself understands that some label is wrongly predicted (i.e. classifier predicted bird instead of truck).
B.6 CIFARIO
In this experiment, train both classifier and diffusion model using the CIFAR dataset, which contains 10 distinct classes. As described in the main text, we designate the class "trucks" as the OOD class. In Figure 31 we show the predicted labels passed to the diffusion model together with estimated log lieeliooss..ds Some of the labels are uncorrupted, while some are very noisy. We observe the following:
The classifier is rarely overconfident in the wrong class.
Even when the classifier is overconfident in the wrong class (e.g. the truck in the first row), the estimated likelihood still much lower than the ones obtained when the classifier is confident in the correct label.
B.7 MNIST
For the MNIST, we do the same experiment. The OOD class is the number 9. Note that the classi- fication task is very easy, so almost all the ID samples are properly classified. [ shows the predicted labels passed to the diffusion model together with estimated log-likelihoods for this task.
38

---

Published as a conference paper at ICLR 2026
Figure 30: CIFAR Dataset. Samples from the dataset.
Etec
The Usel sun-1 1:42
Tuo 96.%
LDW Stdc 1:23
Tue Soel Sua 1:54
Trl UEE CNN
Tru N0B Tog. 1122
Tha kpil Fug 1:22
bolt Fare.
lise
AAll Cog
bast
Tome
band 330
Figure 31: CIFAR Dataset. Labels passed to the diffusion model
3.00
GO0
0.0
Accuracy
Plr.Yoral
Figure 32: MNIST Image Classification. Accuracy vs. Likelihood Certificate.
Trachintt
Tax
6.1m433
apel 6.1122
bbel
103 Bbd.
TLA: absi
S
2
B
Figure 33: classified.
MNIST Dataset. Up: Labels passed the diffusion model. Down: Samples to be
39

---

Published as a conference paper at ICLR 2026
B.7.1 ABLATION STUDIES
In Ren et al. (2019), the authors investigated OOD detection using likelihood--asee methods. They found that non-semantic pieces of information (such as background pixels in natural images) can substantially affect likelihood estimates, sometimes leading to incorrect OOD decisions. For ex- ample, Akeelihood-base model trained on the CIFAR-10 10 dataset may assign higher likelihoods to samples from the SVHN dataset, despite never seeing them during the training.
In our setup, the first three channels represent the image, while the fourth channel encodes the image label/class. Although the class is originally a discrete scalar, we embed it into a much higher- dimensional space (32 -d2e-dimesioonal space in our benchmarks). Similarly to background pixels in natural images, this low-entropy, high-dimensional embedding can significantly influence likelihood estimation. As explained in the previous section, we avoid this effect by perturbing the label/class channel. By introducing noise and incorporating information from the output of the trained classifier, increase the entropy of the label channel, which may reduce its dominance in the likelihood estimation process.
To show the effect of the perturbations, now unperturbed labels for likelihood estimation. We assign the pixel values of the class channel to the class with the highest predicted probability from the classifier. In the left panel of Figure 34] we show the classification accuracy of each label against the median estimated likelihood of the corresponding samples. We observe no clear correla- tion between accuracy and estimated likelihood. Notably, the most accurate class exhibits the lowest likelihood, which differs from the behaviour observed when the noisy labels were used. This result clearly suggests that the estimated likelihood is heavily influenced by background pixels and the unperturbed label channel. To further support this hypothesis, we evaluate our models on the SVHN dataset, which contains images of street view house numbers (see (36] for SVHN samples). Since the classifier has never been exposed to SVHN labels during training, its predictions are always incorrect. However, we can still estimate the joint likelihood p(z, Mprea) using the diffusion model, where Vpred denotes the unperturbed, predicted labels. In the right panel of Figure 34 compare the histograms of estimated likelihoods for the CIFAR- 10 and SVHN datasets. We observe that the SVHN samples exhibit generally higher likelihoods than those from CIFAR-10. This failure mode has also been documented in Nalisnick et al. (019b)).
We evaluate our setup using noisy labels (NL abbr.) for likelihood estimation. In Figure 35a we compare the histograms of estimated likelihoods for all samples in the CIFAR-10 and SVHN test sets. Unlike the previous results with unperturbed labels, the SVHN samples no longer show higher likelihood estimations. However, the two distributions now clearly overlap.
To improve OOD detection, sequentially refine the subset of CIFAR-10 samples used for generat- ing likelihood histograms. In Figure 33b] we restrict the analysis to correctly classified CIFAR-10 samples (CC abbr.). Figure 33cc shows the histograms for high-confidence samples (HC abbr.). Those HC samples are the ones for which the classifier assigns at least 90% confidence to some class Note that general, the HC class is not necessarily the accurate one. Finally, Figure 35d we focus samples that are both HC and CC.
In these last two figures (NL+CC and NL+HC), the CIFAR-IO likelihood histogram shifts to the right, creating a clearer separation from the SVHN distribution. Next, we select subset of CC and HC CIFAR-10 samples (NL+CC+HC). By defining a threshold around the median of the estimated likelihoods (within one standard deviation, for instance), of SVHN samples as OOD. This whole analysis further supports our assumption that the classifier is rarely overconfident in incorrect labels (provided that the true label belongs to the classifier's label space). Further separation between SVHN and CIFAR-10 likelihoods requires decreasing the influ- ence of non-semantic, background pixels on the likelihood estimates (as proposed and demonstrated in Ren et al. (2019))
successfully detect large portion
40

---

Published as a conference paper at ICLR 2026
ID. Classes
CIAR3C
0CG Class
CIRAA1O median
0.-
Accuracy
0.4
0.2
0.5
0.0
Joint Log
Likelhoodd loog pix. Yarea
Joint Log Likellhood -log Vered)
Figure 34: Left: Median estimated likelihood vs. classification accuracy for each CIFAR- 10 class using unperturbed labels. Right: Histogram of estimated likelihoods for CIFAR-10 10 and SVHN samples; SVHN exhibits higher likelihoods despite being OOD.
IORTE
POARD
(d) NL CC HC Figure 35: Histograms of estimated likelihoods for CIFAR-10 and SVHN test samples under differ- ent filtering strategies of CIFAR- 10 dataset. (a) All test samples using noisy labels (NL). (b) Only correctly classified (CC) CIFAR-10 samples. (c) Only high-confidence (HC) samples (d) Samples that are both correctly classified and high-confidence (CC + HC). As the selection becomes more refind,, the CIFAR-10 10 likelihood distribution shifts to the right, improving separation from SVHN.
(a) NL
NL CC
(C)NL HC
5
2
10
9
18
18
3
Figure 36: SVHN Dataset. Up: Labels passed to the diffusion model. Down: Samples to be classified.
41

---

Published as a conference paper at ICLR 2026
B.8 BRAIN TUMOR SEGMENTATION
This section contains additional results for the evaluation of our approach on binary segmentation tasks. Since the segmentation is nothing but pixel-wise classification, our method follows similar strategy to the one used for classification tasks. Since in the case of segmentation, we know exactly what the background (non- -on-semantic pixels) are, we explicitly reduce their influence by corrupting them with white noise during the training. We will explain the method after we explain our datasets.
Our objective is to perform brain tumor segmentation on the BraTS2020 dataset. This dataset contains 3D brain MRI volumes of the shape 240 x 240 x 155. The data is divided into two tumor categories:
High-grade gliomas (HGG)
Low-grade gliomas (LGG)
Each brain scan also has multi-class segmentation mask with the following label assignments:
O: background
1: necrotic core
2: edema
3: enhancing tumor
For our task, we convert these multi-class masks into binary masks. The transformed labels are defined as:
0: non-tumor (background)
1: turor (any of the original classes 2, or 3)
We train our segmentation model using brain scans with HGG tumors. The dataset consists of 210 HGG brain volumes, from which we select 190 for training. 10 for validation, and 10 for testing. To extract 2D slices, we sample 100 slices per brain along the z-axis (corresponding to slice indices 30 through 130). Each slice is resized to a resolution of 128 The pixel values of each brain slice are normalized to [0, 1]. During training, we apply range of augmentation techniques, including horizontal and vertical flips, random rotations, and random shifts and scalings. The input images are FLAIR MRI scans.
In parallel with the segmentation model, we also train a diffuusion model on the same dataset. During the diffusion training, we exclude the rotation-based augmentations. The diffusion model is trained on the joint distribution p(x,8) y), where x represents the 2d MRI scan of the brain, while y is the binary segmentation mask. Our evaluation is done 10 held-out HGG brains and an additional set of 10 LGG brains. For the HGG cases, we evaluate the model not only on FLAIR MRI seans, which used during training, but also T2-weighted scans. The T2 scans represent different MRT modality. For the LGG cases, performance is assessed on both axial (z (z-axis) slices used during the training. and x-axis slices, representing a side view of the brain. This allows us to test the model's generalization to previously unseen anatomical orientations//lices. Note that we test our approach on the brain slices with at least 0.3% tumor pixels present (i.e. least 50 pixels). For the segmentation model backbone, we use CNO architecture Raonic et al. (203) with silu activation function.
To reduce the impact non-semantic (i.e. background) regions, we apply masking during diffusion model training. We replace the background pixels with low-variance Gaussian noise sampled from (0, 0.025). During inference, no perturbation applied. We also present an ablation study in which the diffusion model is trained unperturbed data for comparison.
Figure 37 shows the relationship between the relative L1 error on the segmentation masks and the es- timated log-like likeliieldoood of p(z, Mprea) for the four test scenarios described earlier. We define the OOD threshold as the median of the estimated log ligliikess computed over the HGG in-distribution test set. Most cases with low segmentation errors are correctly classified ID. Notably, the vast major- ity of cases where the segmentation model either predicts an entirely empty tumor mask or produces mask that has overlap with the ground truth (i.e., relative 7,, error 1.0) correctly identified
42

---

Published as a conference paper at ICLR 2026
KE0T MY
1C B0
(d) LGG x-axis Figure 37: Scatter plots showing the relationship between relative I, error and estimated log- likelihood for test samples across different brain MRI datasets. (a) HGG dataset representing ID samples (b) LGG dataset (c) HGG samples from a different MRI modality (I,2 MRI) (d) LGG sam- ples plotted along the x-axis. The plots illustrate how low likelihood values generally correspond to higher errors (OOD), while higher likelihoods align with lower errors (ID).
(a) HGG ID
(b) LGG
(c) HGG T2 MRI
Convereed Lil hoods
SANWAN Onor
10
Jin Log be Brssd -00
jir Log Lieinsee wiig
An 20 Emer
Figure 38: Histograms illustrating the relationship between segmentation quality and model likeli- hood across various test cases. (Left) Joint distribution of the relative L1 segmentation error and the estimated log- likelihood log Iprea). (Middle) Distribution of log-likelihoods across test sam- ples. (Right) Distribution of segmentation errors across the same test samples as in the middle. These plots demonstrate that low-likelihood samples often correspond to poor segmentation quality and can be effectively identified as OOD.
as OOD. It is crucial to highlight that our approach effectively identifies OOD samples that come from different MRI modality, namely T2 MRI scans (refer to the third plot in Figure 37.
We now combine the test samples from all datasets. Figure 38 the first plot shows a 2d histogram of relative L error vs. estimated log-likelihood. We first note that the region of highest density correspond to low likelihood values and errors close to 1.0. Those are correctly classified as OOD. Additionally, many low-error points lie near the classification threshold, but are classified ID. The second plot shows the histogram of estimated log-likelihoods, which is skewed to the right. In the final plot, we show histograms of errors for samples classified as ID (in blue) and OOD (in red). The ID histogram contains most of the low-error samples, while the OOD histogram includes some low-error samples, but mostly consists of high-error ones. Note that the OOD error histogram has a peak around error 1.0, indicating that the most completely incorrect predictions are classified as OOD.
B.8.1 ABLATION STUDY NOISE INJECTION
We now retrain the diffusion model without adding white noise to the non-semantic, background pixels during the training. In the left panel of 42gure we plot the relative I,, emror of the predicted segmentation masks vs. the estimated log-likelihood log p(æ,, 3prea). The results show that many of the high-likelihood samples correspond to predictions with large errors (i.c., relative error 2 1.0). This indicates that the highest likelihood predictions often correspond to cases where the model fails to detect any tumor, despite it being present in the ground truth. Since the majority of pixels in the segmentation masks represent non non-tumor regions, and no noise was applied during training, the model tends to assign higher likelihood to completely non-semantic (no-tumor) predictions.
The right plot of Figure 42 shows the error histograms for ID and OOD samples, (where ID/OOD is defined by the median across all predictions). Unlike the behavior observed when noise was
43

---

Published as a conference paper at ICLR 2026
Figure 39: An example of an HGG brain samples (first row), ground truth segmentation masks (second row) and predicted segmentation masks (third row).
Figure 40: An example of an LGGx brain samples (first row), ground truth segmentation masks (second row) and predicted segmentation masks (thrid row).
44

---

Published as a conference paper at ICLR 2026
Paa
Figure 41: An example of an HGG-T2 brain samples (first row), ground truth segmentation masks (second row) and predicted segmentation masks (thrid row).
HGG Non hoisy
ID
HGG median
1.0
OOD
0.8
Relative
Den
02-
24
1.0
Joint Likelhood
Relative Ly
Figure 42: Ablation study: diffusion model trained without noise injection into background pixels. (Left) Relative L1 error of the predicted segmentation masks versus the estimated log-like lidelhood log p(x. 3pea). High-likelihood samples mostly correspond to large segmentation errors, often rep- resenting cases where the model predicts tumor, despite its presence. (Right) Histogram of segmentation errors for ID and OOD samples. Unlike the noise-injected setting, ID samples now have both low and high error regions, while OOD samples tend have low errors. This result shows the failure of the method without noise injection.
injected during training, we now see that ID samples have both low and high error values, while OOD samples mostly correspond to low-error cases. This reverse behavior indicates that, without noise injection, the model fails to associate high likelihoods with accurate predictions. This further suggests that noise injection during training crucial for effective OOD detection.
B.8.2 CLASSIFIC SENSITIVITY
In brain segmentation, particular attention must be paid to highly problematic cases, such as:
No cancer pixels detected despite their presence.
45

---

Published as a conference paper at ICLR 2026
Scan type
PERR
0L
Accuracy
FPR
FNR
ARCB
HGG
0.675
0.003
0.322
LGG
0.733
0.056
0.211
0.1
0.25
HGG L.
0.720
0.143
0.137
LGGx
0.844
0.106
0.005
average
0.743
0.077
0.180
0.743
HGG
0.530
0.002
0.468
LGG
0.677
0.027
0.296
0.1
0.00
HGG L2
0.759
0.079
0.162
LGGx
0,670
0.041
0.289
average
0.659
0.037
0.304
0.827
HGG
0.787
0.028
0.185
LGG
0.783
0.080
0.137
0.1
0.50
HGG L.2
0.704
0.208
0.088
LGGx
0,816
0.142
0.042
average
0.772
0.114
0.114
0.611
Table 6: Performance of the segmentation experiments for different values of as with SERR fixed 0.1. Results are reported for different scan types (HGG. LGG, HGG L2, and LGGx) terms of accuracy, false positive rate (FPR), false negative rate (FNR), and accuracy critical brain cases (ARCB). Average values across different scan types are also provided.
MN
V91
H367,M3)
L0g W1P. -ig
Jonti Lnail www.-ogg.......o.oo.oo 20o
1o0n Log Lia Badd ph.
(c) HGG L2, az 0.5 Figure 43: Brain segmentation results for the HGG L.2 case. Each plot includes the corresponding likelihood and error decision boundaries, illustrating how the choice of az affects the separation of ID and OOD.
(a) HGG L2, az 0.0
HGG L2, az 0.25
Cancer pixels are detected in a cancer-free brain slice.
Cancer pixels are present but completely missed, with other pixels incorrectly detected instead.
These situations correspond to relative L1 errors of 2 1.0. A crucial property of the OOD detector is to classify such cases as OOD. For this reason, in the segmentation task, we introduce additional metric, ARCB (accuracy rate critical brains). The ARCB measures accuracy rate specifically for these critical cases.
We empirically observe that the values of 8ERR (defined in A.4 in the range (0.1.0.25) yield the most stable performance. For all the following evaluations, fix 8ERR 0.1. We then vary the parameter a and report the corresponding performance of our method in Table 6 We observe that increasing az leads to higher overall accuracy, but also results in higher FPR and lower ARCB. This indicates a clear trade-off between maximizing accuracy and maintaining a high ARCB, with a low FPR. The most balanced performance is achieved at a' = 0.25.
Figure 43 shows the brain segmentation results for the HGG 1.2 case, where each plot presents the corresponding likelihood and error decision boundaries for different oz.
46

---

Published as a conference paper at ICLR 2026
C DIFFUSION-BASED CERTIFICATES
Let us observe the probability flow ODE of the form
dr 1
dt -0-00o((;:1)
(27)
where sY;tt) Va lol px()) is the score function learned during training. As noted in the section
A one estimate the true log-likelihood log p(x) of a data point r. by numerically solving Eqn. 27 backwards in (diffusion) time. We call this approach Joint Likelihood Based Certificate (or JLBC).
We train a score-based diffusion model to estimate V logloooPeee (z)), where x is the joint distribution
(ro: (xa)), where is the operator of interest.
Once the score function has been estimated, additional probability-flow ODE-based certificates can be constructed. All such certificates originate from the same diffusion model trained on the joint distribution of inputs and outputs. Unlike the classification baseline, diffusion-based methods require no extra samples for OOD detection. Let us define the rescaled score function as
<Y₁; = - s(Y;
One can define unified, score-based certificate as
tc()t;t Σ
a(Y) Σ cYYit)
+ 3
+ |c(())))ll
Ōt
Here, = 1, S denotes the discrete time steps used in the numerical approximation of the solution of the probability flow ODE (RK steps), and a, 8. E 10, The partial derivatives with respect to time (second term in the equation) are approximated with a finite difference scheme. When a =
and 3 = 1, the certificate reduces to the curvature-based quantity proposed in Heng et al. 2024h for image classification (referred to DiffPatth.. Our method differs in that is trained on the joint distribution, and we therefore refer to it as JDPath. When a = = and 7 0, the certificate incorporates contributions both from the curvature of the and from the score function itself. This approach was proposed for medical image classification in denote this O, only the contribution from the sum of the score
function
Abdi et al. (2025) (termed SBDDM). In our joint-distribution, score-based settings, variant as JSBDDM When = 1 and 3 functions remains. We refer to this approach as the Joint Score Function Norm Score (JSFNS). For = 1,a B O. This is variant of the certificate introduced in Mahmood et al. (2020) is referred in our framework as JMSSM. As noted above, we unified different certificates into one single expression, and made them fully operational in our joint-distribution, score-basee based diffusion settings.
For M testing sample used to define the OOD boundary, we evaluate the different certificates. Then, we compute the median, m, together with the standard deviation, The OOD boundary is defined as
I + c.
where c is a tunable parameter, fixed to = 1.5 in all our regression experiments and e = -0.5 in the segmentation experiment. Note that the definition of involves a plus sign, in contrast to the likelihood-basee approach, since larger errors correspond to larger certificate values (in the regres-
sion cases).
47

---

Published as a conference paper at ICLR 2026
D MODELS AND ARCHITECTURES
D.1 CLASSIFICATION BASELINE
We compare our approach against a classification baseline that we construct. Specifically, after training task-specific model, draw M samples from the test distribution. Using the horizontal (error) boundary e, defined before, we assign binary labels to these M test samples. A classification model is then trained this labeled set, with 0.2 M samples reserved for validation, and 0.8 M for training. Once trained, this classification model used to predict the ID/OOD classes of the remaining samples.
In each setting, the classification baseline trained on 112 test samples (90 training and 22 valida- tion samples) For experiments that involve multiple test distributions, sample an equal number of trajectories from each distribution to construct the training set. If the testing distribution contains K datasets, we use samples from K/2 of them train the baselines. This ensures fairer compari- son with our method. The M samples used for training are excluded from inference. It is important note that this comparison unfair, since our method is able to identify ID/OOD samples zero-shot manner. This classification baseline relies on access to M ground-truth solutions for training, which is the requirement we aim eliminate. We call this classification-bass approach OODC.
D.2 PASK-SPECIFIC MODELS
For all our tasks, employed the CNO Raonic al. (2023) architecture with silu activations. In all the regression tasks, the model augmented by transformer blocks at selected layers. We refer to this modified design the Operator-UViT architecture. We used architecture of different sizes, depending on the problem. We report the architectural details and the training setups for all the problems in Table 7
Setting
Wave Eq. (CNO Var- Small)
ICN Small)
KS-PWU
ICN Small)
MERRAU
SS-MIX (CNO Buse)
Brain-Sopit (CNO Small NoAD
MINIS (CNO Small NoAIZ)
(CNO Small NoAoZ)
CIFARII
Archleeture
Lilling dinenesa
64
UpDDown
Reshull blecks (bettieneck)
Rosihal Neekks (midlle)
Alicntion layer ned
[TRT.T]]
[TRRETT]
[TFTTTT
[T.RT.F]]
(FFRFF)
(RFRRR)
[FRFFF]
Allentio biccksllaer
Attenikaa ladden dim
256
256
256
364
Attention MI. dim
256
354
S12
Attention hoads
Atiention hoad dim
128
128
128
256
Permetes (M)
21.8
41.8
41.8
113.0
17.
11.2
11.2
Training
AdanW ~140K
Alaaw
Adum
Scheduler
Cosine
Cosine
StepLP
Iniil
2-10
5-10
5-10
5. 5-10
Trining sunples
~2,7MM
-2K
<40K
Epodis
50
Bach
96
Table 7: Architectures and training setups across different problems.
D.3 DIFFUSION MODELS
For the diffusion denoisers Da, we adopted the UVIT architecture from Molinaro et al. 20255) combined with exponential noise scheduling and variance- caiaacceeeploding diffusion scheme. Further details are provided in Section 6.3 of Molinaro et al. (2025).
For all the clsssaassiiiiatioo tasks, we use 4-layer UVIT architectures with channel numbers adapted to task difficulty. For classification tasks, where the input resolution is lower, we employ 1-layer UVITs.
For the Wave Equation problems, we use the following architecture of the UVIT:
Number of layers: 4
Channels per layer: [32, 64, 128, 256]
Number of attention blocks per layer
48

---

Published as a conference paper at ICLR 2026
Attention hidden dimension: 128
Attention Heads:
Attention Head dimension: 128
Trainable parameters: 22.2M
For the MERRA2, NS-PwC and the segmentation problem, we use the following architecture of the UVIT:
Number of layers:
Channels per layer: [48, 96, 192, 384]
Number of attention blocks per layer
Attention hidden dimension: 256
Attention MLP dimension: 128
Attention Heads:
Attention Head dimension: 128
Trainable parameters: 69.3M
For the classification problems, we use the following architecture of the UVIT:
Number of layers:
Channels per layer: [256]
Number of attention blocks per layer
Attention hidden dimension: 512
Attention Heads: 4
Attention Head dimension: 256
Trainable parameters: 34.0M
D.4 OTHER REGRESSION MODELS (WAVE EQ.)
The architecture of the UNet model used in the ablation study B. 1..4is:
Number of layers:
Channels in the layers: [60, 120, 240, 480)
Number of ResNets in the bottleneck:
Trainable parameters: 19.2M
The architecture of the VIT model used in the ablation study i.1.4iss:
Number of attention blocks 6
Attention hidden dimension: 256
Attention MLP dimension: 512
Attention Heads:
Attention Head dimension: 64
Trainable parameters: 9.7M
The architecture of the C-FNO model used in the ablation study B. is:
Number of Fourier Layers 4
Number of Fourier Modes: 16
Latent Dimension: 96
Cony. kernels per layer: [3, 5]
Trainable parameters: 19.0M
49

---

Published as a conference paper at ICLR 2026
E LLM ASSISTANCE IN WRITING
The LLMs were used only to rephrase certain sentences in the paper. No additional assistance was taken from them in terms of writing.
50


Reviews:
[{"review_id": "WwCIludiJU", "reviewer": "Reviewer_ToFP", "summary": "This work proposes a method to classify test examples as in-distribution or out-of-distribution. To this end, the authors propose a diffusion model to compute the certificate (joint likelihood of test example and the model prediction). The experiments include two PDE datasets, a satellite-data based forecasting, image classification and brain tumor segmentation. Across all datasets, the estimated certificate strongly correlates with prediction errors on ID vs OOD data. \n\nWhile the results seem to be strong, the results section is really hard to follow with most tables and figures in the Appendix. I'd encourage the authors to move some of the key results to the main text.", "questions": "- Whenever applicable, provide citations for the baselines.\n- There is only a short discussion in the paper regarding posterior estimates. I'd encourage expanding this subsection.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 4, "presentation": 2, "contribution": 4, "strengths": "- The paper studies an important research question and presents strong results across a wide variety of domains and tasks (regression and classification)\n- The proposed method works both in a zero-shot setup as well as with a setting with ground-truth examples.\n- When compared with other diffusion-based baselines (Table 1), the proposed method outperforms across all datasets.", "weaknesses": "- The paper currently misses out on connecting the baselines (lines 425-431) with previously published work. Its unclear if any of these are directly related to the works cited in section 2.\n- Its unclear if the gains reported in Table 1 are statistically significant. It would be helpful to include some tests for this.\n- The main text (section 4, pages refers extensively to the results in the Appendix, this makes it really hard to follow the arguments. I'd encourage editing the paper to move key results to the main text.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Kixy7RhABb", "reviewer": "Reviewer_ARrh", "summary": "The authors propose Joint Likelihood-Based Certificate (JLBC), which uses a diffusion model to perform out-of-distribution (OOD) detection. The core idea of this method is to train a diffusion model to approximate the joint distribution $p(x, y_\\text{pred})$ where $y_\\text{pred}$ is the output of the base regression model. The log-likelihood estimated from the diffusion model serves as a certificate of trust, which correlates with the base model's prediction error. Experimental results over a number of domains (e.g., medical, wave, weather) support the validity of this correlation.", "questions": "1. How does the proposed approach compare to uncertainty-based methods (e.g., IGRUE, HyperDM, Rate-in, Bayesian NNs, MC dropout, etc.) on the same tasks?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The method doesn't require any retraining of the base regression model, reducing computational overhead. Moreover, the method operates zero-shot (aka it doesn't require any ground truth OOD vs. ID labels).\n2. The use of diffusion models to represent / estimate joint likelihoods is well studied / supported.\n3. Empirical studies. The experiments are performed over a number of different datasets and downstream tasks, giving a good idea of the expected performance of the method in real-world scenarios.", "weaknesses": "1. Novelty and distinction from prior works is somewhat unclear. Section 2 references a number of OOD detection methods and yet concludes with \"[there] is [a] scarcity of OOD detection...methods for...scientific machine learning applications,\" which seems contrary. Additional discussion specifically on the shortcomings of previous methods---which are addressed by the proposed method---should be included. Moreover, further discussion on diffusion / learning-based methods for uncertainty estimation should be in mentioned, since many of these methods seem relevant (e.g., estimation of epistemic uncertainty is often used for OOD detection).\n2. Computational overhead. Diffusion model training and inference can be expensive, perhaps even more so than the underlying regression model. \n3. Conciseness. The writing in the manuscript is quite dense (particular the results section) and could benefit from more clear / concise organization.\n4. Lack of theoretical guarantees. The method proposes the joint likelihood estimate as a certificate of trust, yet there are no concrete guarantees on the correctness of the estimate (i.e., OOD prediction's) accuracy.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hZZ6kMiLRO", "reviewer": "Reviewer_2W7u", "summary": "This paper proposes a task‑aware (mostly regression-based tasks) out‑of‑distribution (OOD) detector for scientific ML that estimates a joint likelihood $\\log p(x, y_{\\text{pred}})$ with a score‑based diffusion model and uses it as a reliability certificate for an arbitrary downstream predictor. The key intuition is a heuristic link between prediction error and joint likelihood (Eq. (2)), and the practical pipeline solves the probability‑flow ODE to score new data points.\n\nDecision thresholds are set from a small set of training samples to separate ID vs OOD (Fig. 1C) and the same score can be used to fit an a‑posteriori error curve when a few labeled test samples are available (Fig. 1D and Fig. 24). Valid experiments are run on canonical datasets: regression on PDE operators (wave and 2D Navier–Stokes), satellite humidity forecasting (MERRA‑2), image classification (MNIST, CIFAR‑10), and brain‑tumor segmentation The proposed method is compared with several diffusion-based baselines on these setups with metrics like ACC, FPR, FDR to demonstrate the effectiveness of this joint likelihood as compared to input-only likelyhood $p(x)$ in correlation to prediction error. Ablation studies are conducted as well to further isolate the impact of number of calibration samples and different task models.", "questions": "1. On Eq. (2):  Can you formalize conditions under which the error–likelihood correlation provably holds (e.g., bounded density ratio between train/test, Lipschitz loss, coverage of $p(y|x)$? Conversely, can you build a counterexample where $\\log p(x, y_{\\text{pred}})$ is high but error is high (beyond the anecdotal segmentation failure without noise)?\n2. In NS experiments, you average direct and autoregressive likelihoods (Sec. B.2.2, Figs. 18–20). Can you quantify when each dominates and whether the mixture is necessary if the regressor is trained with scheduled rollouts?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Empirical result appears to be strong. Fig.2 and Table 3 are good illustration indicative of why $p(x)$ could fail for scientific regression and why joint likelihood is a better proxy.\n2. Experiment setups are carefully crafted and elaborated. Full details are presented, and a wide spectrum of data sources are provided with proper justifications.\n3. The proposed method is intuitively sound within the context of score-based diffusion, and appears to be robust to various scientific regression tasks. \n4. Simple exponential fit provides actionable error estimates once a few test labels are available.\n5. Related studies is well discussed, demonstrating the gaps in this field, and strengthening the originality of the work\n6. The method shows a certain degree of significance by filling the gaps in good predictors for regressor tasks. However, given the lack of discussion on its computational costs and complexity in real scenarios, it is hard to gauge whether it will be meaningful/provide additional insights for more practical methods in this area.\n7. In general, given the depth of the discussion and the breath of the experiments conducted, it is a high quality presentation.", "weaknesses": "1. Lack of theoretical supports and further discussions: Equation (2) assumes approximately uniform training error over $p(x,y)$. This key step is not formalized; conditions under which the correlation degrades are not identified (e.g., heavy label noise, multi‑modal conditionals $p(y|x)$ with identical likelihood but disparate errors). Strengthening or bounding the approximation would help.\n2. The choice of metrics can be better justified. The metrics used (ACC, FPR, FDR) can be swapped with other common OOD metrics (AUROC, TNR@TPR95) for stronger comparisons to prior works\n3. (optional) To strengthen the significance of the work, comparison other baselines other than diffusion-based scores should be considered. For example, (i) likelihood‑ratio methods (e.g., Ren et al., 2019) applied to joint or representation spaces; (ii) ensembles/MC‑dropout as task‑aware uncertainty proxies; (iii) conformal risk‑coverage curves for selective prediction; (iv) energy‑based scores on joint representations.\n4. The “median − 1.5σ” rule (Sec. 3; App. A.4) is somewhat ad‑hoc despite ablations (Table 2 & Table 4). More principled calibration (e.g., quantile‑conformal bands or controlling FPR at target levels) would increase reliability.\n5. Computing joint log-likelihood requires solving the probability‑flow ODE and estimating divergences with 32 MC samples (App. A.3). Runtime, memory, and scalability versus input/output resolution and time‑steps are not quantified. This matters for high‑res scientific workloads -> Potentially limited practicality and thus significance.\n6. Code availability are not provided.\n\nReference:\nJie Ren, Peter J. Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark DePristo, Joshua Dillon, Balaji Lakshminarayanan. “Likelihood Ratios for Out‑of‑Distribution Detection.” NeurIPS 2019.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)