Splitting & Integrating: Out-of-Distribution Detection via Adversarial Gradient Attribution
Authors: Jiayu Zhang
Xinyi Wang
Zhibo Jin
Zhiyu Zhu
Jianlong Zhou
Fang Chen
Huaming Chen
Venue: ICML 2025 poster (2025)
Keywords: Out-of-Distribution Detection
Attribution
Primary area: social_aspects

Abstract: Out-of-distribution (OOD) detection is essential for enhancing the robustness and security of deep learning models in unknown and dynamic data environments. Gradient-based OOD detection methods, such as GAIA, analyse the explanation pattern representations of in-distribution (ID) and OOD samples by examining the sensitivity of model outputs w.r.t. model inputs, resulting in superior performance compared to traditional OOD detection methods. However, we argue that the non-zero gradient behaviors of OOD samples do not exhibit significant distinguishability, especially when ID samples are perturbed by random perturbations in high-dimensional spaces, which negatively impacts the accuracy of OOD detection. In this paper, we propose a novel OOD detection method called \textbf{S \& I} based on layer \textbf{S}plitting and gradient \textbf{I}ntegration via Adversarial Gradient Attribution. Specifically, our approach involves splitting the model's intermediate layers and iteratively updating adversarial examples layer-by-layer. We then integrate the attribution gradients from each intermediate layer along the attribution path from adversarial examples to the actual input, yielding true explanation pattern representations for both ID and OOD samples. Experiments demonstrate that our S \& I algorithm achieves state-of-the-art results, with the average FPR95 of 29.05\% (ResNet34)/38.61\% (WRN40) and 37.31\% (BiT-S) on the CIFAR100 and ImageNet benchmarks, respectively. Our code is available at: https://github.com/LMBTough/S-I}{https://github.com/LMBTough/S-I

Splitting & Integrating: Out-of-Distriuution Detection via Adversarial Gradient Attribution
Jiayu Zhang"
Xinyi Wang"* 2
Zhibo Jin
Zhiyu Zhu
Jianlong Zhou
Fang Chen Huaming Chen"
Abstract
1. Introduction
(OOD) detection is essential for enhancing the robustness and security of deep learning models in unknown and dynamic data environments. Gradient-based OOD detection methods, such as GAIA, analyse the explana- tion pattern representations of in-distribution (ID) and OOD samples by examining the sensitivity of model outputs w.r.t. model inputs, resulting in superior performance compared to traditional OOD detection methods. However, we argue that the non-zero gradient behaviors of OOD samples do not exhibit significant distinguishability. espe- cially when ID samples are perturbed by random perturbations in high-dimensional spaces, which negatively impacts the accuracy of OOD detec- tion. In this paper, propose novel OOD detection method called S & I based on layer Splitting and gradient Integration via Adversarial Gradient Attribution. Specifically, our approach involves splitting the model's intermediate lay- ers and iteratively updating adversarial examples layer-by-layer. We then integrate the attribution gradients from each intermediate layer along the attribution path from adversarial examples to the actual input, yielding true explanation pattern rep- resentations for both ID) and OOD samples. Ex- periments demonstrate that our & algorithm achieves state-of tfate-of-the-art results, with the average FPR95 of 29.05% (ResNer34)/38.611 (WRN40) and 37.31% (BiT-S) the CIFAR100 and Im- ageNet benchmarks, respectively. Our code is available at: http://gthub.coomLLBBBToO
Deep neural networks have achieved remarkable success in variety of domains, including autonomous driving (Chen et al., 2021) and medical diagnosis (Yadav & Jadhav, 2019). However, their performance and reliability are strongly influ- enced by the assumption that the test data originates from the same distribution as the training data. In practical applica- tions, this assumption is frequently violated, as models often face inputs that deviate significantly from the in-distribution (ID) training data. Such inputs, known as -utoo--distriuttion (OOD) samples, present major challenge for deep neural networks, which can produce overconfident yet incorrect predictions.
Therefore, performing OOD detection is essential for ensur- ing the safe and reliable deployment of deep neural networks in real-world applications. Currently post-hoc OOD detec- tion methods can be mainly divided into three categories: output-based methods (Hsu al., 2020; Liu et al., 2020; Hendrycks & Gimpel, 2016; Liang et al., 2017), feature representation--bssed methods (Sun et al., 2021; Sastry & Oore, 2020; Song et al., 2022) and gradient-based meth- ods (Huang et al., 2021; Lee & AlRegib, 2020; Igoe et al., 2022; Chen et al., 2023). Among them, output- meth- ods rely on the confidence score of the model output to determine whether the input sample belongs to the training data distribution, while feature ods detect OOD samples by analyzing the feature vectors of the intermediate layers of the neural network. However, compared with gradient-based methods that identify OOD samples by calculating the gradient information of input samples w.r.t model parameters (or certain layer output), they are easily deceived by some OOD samples with high output similarity casily affected by the quality of fea- ture representation. Therefore, in this paper we focus on muudient-basee methods.
pnteeseetttion-baseee meth-
"quual contribution Suzhou University of Technology, Suzhou, China Faculty of Computer Science Information Technology, University of Malaya, Kuala Lumpur, Malaysia 'Dat Science Institute, University of Technology Sydney, Sydney. Australia "School of Electrical & Computer Engineering, University of Sydney, Sydney, Australia, Correspondence to: Huaming Chen <huaming chen @ eydncy.edu.au>>
As one of the mainstream gradient-based methods, the GAIA (Chen et al., 2023) algorithm investigates the ex- planation pattern representations of ID and OOD samples from the sensitivity of model outputs w.r.t model inputs, i.e., the attribution gradients (Simonyan, 2013). Specifically, by pro-aaropgg the attribution gradient 0f(z;9) of the 8x
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
model output f(x; 0) w.r.t. the input sample x each inter-

---

Splitting & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
& algorithm
Split layers: gb++1)+ Iterate to get the Sample Set: (sif 1,
Attribution path
Aar
Ari
Integrate attriburise gradicnts the rs-th Seature on the j-th layer
W
del, of d 1 Aigee
Helgee
Imputiz 2
Adversarial Sampleri
ni Σ do @ V fo (2-01))
pacda Bit.
Bird yin
vel gano
Scores 72,7%
Score: 78.3%
Image
Outpet
AC
A
Visualize explanation pattern representations Igradient distribttion)
Before GAIA
Tear Onn tecke
Integrate layers
Attribution Gradicuts
Our
After GAIA
Feature
Figure 1. Algorithm flowchart. The gradient distribution (Y-axis frequency) of OOD samples investigated by GAIA tends to exhibit non-zero values (X-axis attribution gradient). We argue that the abnormal gradients induced by perturbations in input data cause feature components that should be predicted as ID to be incorrectly classified OOD, resulting in irregular gradient distributions. By performing multiple adversarial attacks to analyze the feature distribution shifts from ID adversarial examples to OOD input samples, we can progressively identify high-confidence non-zero gradients and obtain explanation pattern representations denoted by the shaded regions.
mediate layer, GAIA considers input samples with a large number of non-zero attribution gradients as OOD samples. As shown in Fig. 2, we find that for OOD samples, the at- tribution map often does not focus on certain key features and shows scattered pattern, which means that the model has no clear understanding of OOD samples. Therefore, we argue that this phenomenon indicates that the model may have higher sensitivity (i.e., larger gradient value) to any feature under an unseen distribution, and even some irrele- vant details will get high gradient values. This characteristic makes the non-zero gradient behavior of OOD samples not significantly differentiating, especially when ID samples are subject random perturbations in high-dimensional space. At this time, the gradient fluctuation caused by small input changes of the model will make it difficult for the gradient sensitivity to stably reflect the actual relationship between the model output and the input, affecting the distinction between the explanation pattern representations of ID and OOD samples.
Figure 2. Attribution visualization. The left two images (label 'tulip") ) represent the ID input sample and its attribution map, while the right two images (label '0') represent the OOD input sample and its attribution map.
ent aL(f(ze0) of the loss function over the model output 8x [[ 0}) w.r.t the i-th iteration adversarial example x; along the attribution path from the baseline to the actual input, thereby smoothing the volatility of the attribution gradient and reflecting the true explanation pattern represen- tation.
Besides, it is worth emphasizing that traditional gradient- based methods such as GAIA assume that the influence of each intermediate layer of the model on the input features is uniform and linearly cumulative. In fact, the sensitiv- ity of intermediate features in different layers to the input may be highly heterogeneous, with early layers focusing on low-level edge or texture information and later layers focusing on high-level semantic features. In deeper neural networks, this may introduce unstable gradient explosions
In this paper, to address this shortcoming, for the first time, investigate the explanation pattern representation of ID and OOD samples from the perspective of adversar- ial attacks (Kurakin et al., 2018). Specifically, we intro- duce adversarial examples to artificially add perturbations to input samples. Then, we use adversarial examples as baselines and gradually integrating the adversarial gradi-
2

---

In general, for an image classification interpretation task, the objective of gradient-based attribution is to determine attribution value A,e E R Rx8x K that reflects the im- Splitting& & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
or cumulative errors in inter-layer features, reducing the representation accuracy of the explained pattern. To address this problem, we introduce the concept of layer splitting for the first time. Assuming that the neural network has a total of intermediate layers, we split the current j-th intermediate layer from the subsequent (j + 1 ~ 1)-th inter- mediate layer while updating the adversarial example layer by layer. Based on these insights, we propose a novel OOD detection method called S & I based on layer Splitting and gradient Integration via Adversarial Gradient Attribution. Comprehensive experiments on both CIFAR 100 and large- scale InageNet-IK benchmarks validate the effectiveness of our & I algorithm. Fig. shows the algorithm flowchart.
training, it tends to produce overconfident predictions for such inputs (Nguyen al., 2015; Hein al., 2019). Based on this characteristic, OOD detection can be formulated as a binary classification problem as follows (Zhang et al., 2023):
GOOD if 2(x) 2 ID if 2(X) <
Binary Classifier
(1)
Where & represents the threshold for distinguishing OOD and ID samples, and (2(X) is the confidence score func- tion for the binary classification. We consider input sam- ples I with confidence scores greater than or equal to & as OOD samples Tout- Here Eq. provides a mathematical understanding of OOD detection and does not affect the subsequent introduction of our algorithm.
Our key contributions are summarized as follows:
Given the observation that the attribution gradients of OOD samples are not significantly distinguishable, in order to reduce the abnormal gradient fluctuations caused by random perturbations in ID samples in high- dimensional space, we first introduce adversarial ex- amples to artificially add perturbations to the input samples for OOD detection, thereby reflecting ture explanation pattern representations.
2.2. From gradient -based attribution to adversarial attack
We, for the first time, propose the concept of layer splitting and adversarial attribution gradient integra- tion for OOD detection. By decomposing intermediate layers and iteratively updating adversarial examples mayer-by-layer we integrate the attribution gradients of each iteration along the attribution path from adversar- ial examples to the actual input sample. We also give the theoretical proof of our algorithm in our paper.
portance of each feature component z within the input (ra)
sample R K w.r.t. the model output f (a; 0). Here x is pixel-level feature, S and R represent the width and (re)
height of the k-th channel input sample. f(z; 0) typically represents the predicted labels of the image, expressed as confidence scores for each class.
Experiments demonstrate that our S & algorithm achieves SOTA results. with the average FPR95 of 29.05% (38.61 9)) and 37.31 % on the CIFARION 100 and ImageNet benchmarks, respectively. We have also open-sourced the relevant code.
One approach understanding how model makes deci- sions is pinpoint the minimal feature changes that either weaken or strengthen its current prediction. This requires that the feature modifications remain limited, so not to distort the semantic content of the original sample. Conse- quently, the challenge of interpretation can be reformulated as identifying the most influential features that affect the model's decision, while ensuring the changes remain within certain constraints.
2. Preliminaries
2.1. Problem definition
Given a deep neural network f with parameters 0, for a su- pervised task, the output of the network for the input sample space X can be expressed as f(X; Y). Here Y repre- sents the label space, and in the following we omit Y for convenience. The goal of -fitt--diitriuution (OOD) detec- tion is identify input data that comes from a distribution different from the training data. Let Zin X represents the in-distribution (ID) samples, and Font E X represents the OOD samples. Typically, there is no intersection be- tween the label sets yin E Y and your E Y for ID and OOD samples. Taking an image classification task as an example, since the model has never seen OOD data Fout during
Attribution gradients calculation Currently, commonly employed gradient-based attribution algorithms, such as Integrated Gradients (IG) (Sundararajan et al., 2017) and Boundary- based Integrated Gradients (BIG) (Wang et al., (f(a?)) to represent local 2021), utilize gradient information 8x changes for calculating importance scores. If we denote the importance of each feature component in the input sample calculated by IG as A!G then the integration process of IG can be expressed as Eq. 2:
3

---

Splitting& & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
predictions while maintaining the semantic similarity the original input. In this scenario, the label of the adversarial example is manipulated to be t'. It is important to note that, according to the characteristic of adversarial attacks, the label 1' is manipulated by the model during training, and therefore, t' still belongs to the ID label set Yín. Generally, T iterations are required to obtain the optimal adversarial example. The attack process can be described as follows:
T 0f
(x'
x T x (x z'))
A/ =
(
x (rs) (rs)
where rs 1, ...., RS represents the rs-th feature com- ponent in the input sample x. The gradient of the model output w.r.t. the rs-th feature component is denoted by af(e'+ xx)=))x(x==2)) In this context, x' denotes the baseline
sample, typically represented by black image zero embedding vector in image or text models. From Eq. 2, we can see IG divides the integration path (ar - x') into T iterations with equal step sizes to compute A/2 (z). In
24. = x4-1 + n sign (V ()(o)))()))
(3)
s.t. fxx; =t' *
GAIA (Chen et al., 2023), the authors argue that the attri- bution gradients = 0f(2' + (x (()="))) related to the input
where v denotes the learning rate, i ..., 3o I. and Fadv TT- The sign(-) function indicates the direction of the update for the adversarial example. To ensure that the perturbations added do not alter the semantic information of the original sample, we constrain the magnitude of these perturbations as follows:
0 (+4)
samples are the key gradients for OOD detection. Moreover, input samples x exhibiting non-zero attribution gradients across most feature components x are highly likely to be
(re)
OOD samples.
Accuracy loss of attribution gradients However, both attribution algorithm IG or attribation-based OOD detection algorithm GAIA set the baseline sample x' as a black image, i.e., x' 0. It is worth noting that for tasks of varying scales, the selection of baseline points is complex and of- ten ad-hoc. Additionally, using black images as baselines can make it difficult to preserve the original semantic infor- mation. In this regard, adversarial attacks (Kurakin et al., ca1al-capable of altering model decisions with minimal perturbations can generate adversarial examples that are highly similar to the original images, relying solely on input samples and the model. Therefore, employing adversarial examples as baselines for attribution retains semantic in- formation and eliminates the need for specific baseline selection method. We believe that using adversarial exam- ples with semantics similar to the original sample as the baseline (Pan et al., 2021; Zhu et al., 2024b;a) can improve the accuracy of attribution gradient calculations, concept that has already been demonstrated in several SOTA attri- bution algorithms. The accuracy of attribution gradients is crucial for attribution- based OOD detection, as it signifi- cantly influences the distribution of the attribution gradients.
Tadv x112 S
(4)
where |1-112 represents the L2 norm and denotes the maxi- mum allowable perturbation. It is clear that the iteration of adversarial samples can be interpreted as gradient ascent process that maximizes the loss function associated with the original label (thereby misleading the model's predictions) while simultancously minimizing the perturbations applied to the input sample, in accordance with the requirements of the interpretation challenge. In the next section, we will introduce how we incorporate adversarial attacks into attri- bution to explore the distributional characteristics of ID and OOD samples.
3. Layer splitting and adversarial attribution gradient integration for OOD detection
3.1. Zero importance verification under the adversarial attack
In this subsection, we first give a mathematical proof of zero importance verification under the adversarial attack. Our goal is to proof that, when adversarial examples are used as the baseline, the attribution gradients of each feature component .c still tend to be zero for ID samples, indi- (rs) cating zero importance. In the GAIA (Chen et al., 2023) scenario, we can express the model output f(x; 8) w.r. the true label t using a higher-order Taylor expansion under the zero baseline (black image):
2.3. Definition of adversarial attacks
Given a deep neural network ff and an original input sam- ple x E TR Rx for standard image classification task, where the true label corresponding to x is t E yin, the objec- tive of adversarial attacks is to generate an adversarial exam- ple Tede by adding perturbations to x. These perturbations are designed to mislead the model into making incorrect

---

Splitting& & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
sample z with a higher prevalence of zero-valued #5(m))
(ra)
P
1 10f((;;)
yield smaller attribution |A(x)) RS
[1)s( indicat-
((;0)= + ΣV Σ
x (F4)
p! 0
ing an ID sample Tin-
p=1ra=1
(rx)
1 8 f(:; 8)
Proof 1: It is known from advanced calculus that if 0f(=:0) = O, then its y-th partial derivative & f(a:0) O.
.... R2(x)
21 0 5 (1)2) (1) (2)
0 (+a)
(ra)
Consequently, due to the chain rule of gradients, its p-th mixed partial derivative 8 f(x:0)
where 8" f(x00) x
represents the p-th order derivative of output
azgg... 2..00
0. From Eq. 6,
(2) (x)
[z)) 0 always holds.
(a; 8) w.r.t the feature component x f(x:0)
0g 2 represents
(rs)
(i) (2)
the second-order mixed partial derivative of f f(x; Rp(z)
the remainder after Taylor expansion. Then we can get the following label output change, i.e., the absolute value of the attribution for the input sample x::
[A(x) = [f 0) - -f fIadui 0)1
P
n2
OP [(x; 0)
(Fado (rs)
x )
AA(x) = (s;;; 0) - [(0;; 0)1
pl
θ x P
(rs)
(rs)
P RS
0 f(x;0)
0 fx1;; 0)
I
OxP P
(r9)
+
(ra)
(6)
21 (Tade
2 )0 Vadv
x.
(1)
(1)
(2) (2)
1 (x;(0)
+
21 Ox dr (1)()
+...
... + Rx(
{Fado - x. ( - xx)
(1) (2)
(1)
(1) (2)
(2)
According to the description of the sensitivity axiom in GAIA and IG (Sundararajan et al., 2017), we can get the following theorem:
+ RTp(da - x3)
An attribution method adheres the Sensitivity Axiom if, for any imput and baseline that differ in single feature and produce different predictions, the feature with the difference must be assigned non-zero attribution.
Theorem I:
In the adversarial attack scenario, instead of using f(; 0). we use (xadde 0) as the baseline. At this time, Eq. 6 is transformed into Eq. 7.
Proposition 2: When the baseline sample is an adversarial sample, if the gradient [f(=)) satisfies the conditions in
Since GAIA demonstrates that OOD samples typically ex- hibit overconfident predictions (Chen et al., 2023), we can assert that the label output change for OOD samples [S 0) /(0; 0)] is, some extent, greater than that [f(m f(0; 0) for ID samples. Then we get [A(x:n) < [A(zout] in common cases. This is intuitive because the feature components of ID samples typically match the distribution of the training data, resulting in a smaller contribution to the predictions and relatively lower attribution values. According to Theorem 1, the attribution for features that do not influence the model predictions is zero, indicating zero importance. Therefore, the smaller attribution of ID samples A((zi)) EAs |Ars (dr.)) imply that the gradient polynomials associated with the fea- ture components Fin in the higher-order Taylor expansion (rs)
Proposition 1, then the attribution gradients of each feature component x still tend to be zero for ID samples. (rs)
Proof 2: After adversarial attacks, the label l' of the ad- versarial sample still belongs to the ID label set yiu- Addi- tionally, adversarial samples possess the characteristic that require iterative training within the neural network. There- fore, adversarial samples can be regarded ID samples in our opinion. According to Theorem 1, GAIA demonstrates that OOD samples typically exhibit overconfident predic- tions, since the input sample x E Tin, then neither f(x; 0) nor f(rddi 0) exhibits overly confidence in this case. We can get low-level [A()),, which means that the input sam- ple has a higher prevalence of zero-valued af(a:)) When
a (mo)
have a higher occurrence of zero gradients.
the input sample E Tout, then [Iaddi 0) will exhibit overly confidence. In this case, we can demonstrate that If (Iont: 6) - fx 0)1 > (f 0) - f : 0)1, indi- cating a higher prevalence of non-zero gradients for OOD samples.
Proposition 1: For a feature component x E x that is
(rs)
to be attributed, if (=(00) is zero throughout the entire at- #
(P4)
tribution process, then [x) In this case, the input
5

---

Splitting& & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
3.2. S & I algorithm
form Eq. 8 into:
3.2.1. ADVERSARIAL AITRIBUTION GRADIENT INTEGRATION
A
Σ
Aafh O g(r (re) (re)
(10)
From Sec. 3.1, it can be concluded that the key OOD detection lies in obtaining the distribution of attribution gra- dients. For the input sample.x z; we perform Eq. 3 to update adversarial examples. To integrate the attribution gradients we need, we apply the first-order Taylor approximation to expand the loss function and incorporate the gradient infor- mation along the attribution path from Fo to TT:
From Proposition 2, it can be deduced that if the attribution
gradient g ( of the feature component a2 the j-th (re)
(rs)
layer and the k-th channel tends to be non-zero, then the
feature component tends to be OOD. Therefore, we need to compute the non-zero density of input sample -5Sh to obtain the non-zero expectation. Here, following the conditions set by GAIA-Z, when the label space Y is relatively small, such as in CIFAR100 (Krizhevsky al., 2009), we can derive the expectation:
(f (f(-11)) (ei xx-1) 4o
((((+))) = LU ((=-1))))
d=;-1
T
T-1
T-1
ØL ($ (xiI)
Σ
1/f (m:)) Σ (.(())))
+
(1:+1 x.;)
dz.
100
I-1
ÖL (f (2:))
A Lf L(f (2o))
Σ
(zi+1 - xi)
jk الا & #0 (I)) (re) (re)
dz:
E [e
[e]
1 RXSXT
T-1
Σ On = Σ AZi- o g(zi-1)
(8)
When the labe space Y is relatively large, such as Ima- geNet (Deng et al., 2009), it time-consuming to calculate the non-zero density for each label the dataset. Following the conditions set by GAIA-A, assuming that the network feature extraction function is (-), we can get the last I-th layer input 2/_1 V( 1; 0). Considering the gradient matrix on the /-th layer, k-th channel input sample _i x= and the j-th layer, k-th channel input sample 2/t we get:
Here o and 0 is omitted for convenience. And Ari-1 a It is obvious that Eq. 8
I; I; g(x,-1) = -
satisfies Theorem 1. However, there is a problem with Eq. 8. Since the neural network has / intermediate layers, we can- not use the union parameters 0 of the neural network when performing gradient ascent on the j-th layer. In fact, we use the parameters 0(++1)~l of the (j+1) ~ (-th layers to update the adversarial examples. Unlike GATA, which assumes that each intermediate layer of the model has uniform impact on the feature map. our purpose is to distinguish the sen- sitivity of intermediate feature maps on different layers to the model input. Therefore, we first introduce the concept of layer splitting to deeply investigate the distribution of attribution gradients.
On
On?"
(12)
V a(0.9> sm er (log sottmax
P (aft ( (o)))))))
where Y 1ym E Y]. It is worth noting that unlike GAIA, we only take the top-N% outputs (here top-90%) when integrating the outputs of each label to remove the influence of redundant channels in the last layer. Then we can get the expectation w.r.t. zik;
3.2.2. LAYER SPLITTING
Specifically, assuming that the dimension of the sample space is R RxSk we will use the following formula to update the adversarial example 1²th with predicted label on the k-th channel, j-th layer:
RxSxT Σt evo!t (G
(T. (f (fSttm ( (3(+);))))))))))
E [c]225k]
2fth = 10 + sign
R XT Σt Eot (GHh,
0rik
(13)
where 2/th lkt, And we can get Azth
where Rt and St represent the height and width of the last I-th layer input sample, respectively. G represents a gradient component in the gradient matrix. Finally, we can get the overall OOD score:
g(ogh1) 01 (2) (00+))) To compute attribu-
tion of the rs-th feature component on witk we then trans-
6

---

Splitting & Integrating: Out-of-Distribuuie Detection via Adversarial Gradient Attribution
Table Experimental result CIFAR henchmark. Here backbone models are ResNet34 and WRN40. The lower the FPR95, the better the performance, with AUROC behaves inversely. All values are percentages and the best value is bolded.
SVIN
LSUN
TinyImageNet
Places
Textures
AVG
Dutaset/Model
Methods
FPR951
AUROC
FPR95_
AUROC1
FPR95
AUROCI
FPR95]
AUROC
FPR95L
AUROC1
FPR95]
AUROCT
85.69
74.8
82.09
83.22
74.61
ODIN
86.21
74.13
83.58
72.81
75.21
79.31
87.19
70.61
82
74.76
82.84
74.32
Energy
87.55
73.91
84.38
72.58
73.46
79.83
88.53
70.17
82.54
74.69
83.29
74.24
C0
/ResNei34
GramNorm
71.08
62.5
18.99
94.06
68.35
64.57
69.62
53.13
35.56
78.99
52.72
70.65
Rankfeat
92.94
65.55
90.84
70.65
87,46
74.98
90.78
72.68
86,74
73.99
89.75
71.57
React
93.15
80.88
82.3
79.63
73,02
79.88
86,07
77.9
79.01
80.54
80.83
79.77
GATA
15.73
97.06
33.33
94, 18
63.85
89.17
16.78
97.17
15.82
97.09
29.1
94.93
15.68
97.06
97.09
94.93
83.27
73.53
83.96
75.19
ODIN
83.44
79.85
76.68
80.32
76.91
77.84
85.81
72.5
83,42
74.95
81.25
77.09
Energy
84.58
79.7
76.32
80.45
76.77
77.9
86.13
72.35
83,95
74.83
81.55
77.05
CIFARI00
GradNorm
65.2
65.62
55.7
100
98.73
14.4
77.78
44.05
79.48
42.29
/WRN40
Rankfeat
99.97
15.4
98.79
34.34
99.04
36.01
99.71
22.18
99.47
22.49
99.4
26.08
React
94.11
67.95
87.02
67.
88.66
65.39
89.75
64.31
89.91
63.88
89.89
65.73
GAIA
15.19
97.19
37.97
91.59
87.06
73.42
25.64
95.26
27.29
94.05
38.63
90.3
15.19
97.19
37.95
95.26
27.27
94.05
38.61
90.3
are output-based methods. ReAct (Sun et al., 2021) and Rankfeat (Song et al., 2022) are feature representation-bute methods. GradNorm (Huang et al., 2021) and GAIA (Chen et al.. 2023) are gradient-based methods. Here GAIA is our main competitive baseline. We use FPR95 (false positive rate at 95% true positive rate) and AUROC (area under the receiver operating characteristic curve) as our evaluation metrics (Chen et al., 2023).
(E (E(c)>>)))
(14)
where K is the maximum number of channels among all intermediate layers. We use E [<]>**] in Eq. 11 and Eq. 13 respectively at different levels of label space Y. Here т represents a confidence score, where a larger indicates a higher likelihood that the input sample is an OOD sample. The pseudocode of our S& I algorithm can be found in Appendix. A.
4.2. Experimental result
Experiments on CIFARI00 benchmark: In Tab. 1, we evaluate the OOD detection performance of our S & I al- gorithm and other baselines the CIFAR100 benchmark. Since CIFAR 100 is small label space dataset, we use Eq. 11 to obtain the OOD score. Experimental results show that our S & algorithm achieves the best performance com- pared with other post-hoc OOD detection methods. Specif- ically, our method achieves the lowest average FPR95 of 29. 99.05% and 38.61% % on ResNet34 and WRN40 models, respectively. For the representative output-based method ODIN, our method achieves 65. and 52.47% FPR95 reduction on ResNet34 and WRN40 models, respectively. At the same time, our method achieves 67.63% and 45.24% FPR95 reduction on the ResNet34 model compared with the feature representation-bant based method Rankfeat and gradient- based method GradNorm, respectively. For the AUROC evaluation metric, method achieved the highest average AUC of 94.93% on the ResNet34 model. It can be noticed that compared with the main competitive baseline GAIA, our method did not achieve a particularly large improvement on CIFAR100. We believe that this is because the feature distinction between classes in small label space datasets low, and adversarial attacks may not be able effectively amplify the difference between ID samples and OOD sam- ples. For the ImageNet- IK dataset with large label space,
4. Experiments
4.1. Experimental setup
Datasets and models: We followed the experimental setup of GAIA (Chen et al., 2023) and conducted extensive experiments. Specifically, on the CIFARION benchmark, we used CIFARIO as ID datasets (Krizhevsky et al., 2009). We select SVHN (Netzer et al., 2011), TinyImageNet (Liang al., 2017), LSUN (Yu al., 2015), Places (Zhou al., 2017) and Textures (Cimpoi et al., 2014) OOD datasets. The corresponding backbone models are ResNet34 (He et al., 2016) and WRN40 (Zagoruyko, 2016). On the Ima- geNet benchmark, we use ImageNet as our ID) dataset (Deng et al., 2009). We also selected iNaturalist (Van Horn et al., 2018), SUN (Xiao al., 2010), Places (Zhou et al., 2017) and Textures (Cimpoi al., 2014) as OOD datasets. The corresponding backbone model is the pre-trained Google BiT-S (Kolesnikov al., 2020).
Baselines and evaluation metrics: We selected various host-hoc OOD detection methods as our baselines. Among them, MSP (Hendrycks & Gimpel, 2016), ODIN (Liang al., 2017), Energy-based framework (Liu et al., 2020)
7

---

Splitting & Integrating: Out-of-Distributin Detection via Adversarial Gradient Attribution
Table Experimental result on ImageNet benchmark. Here backhone model is BiT-S. The lower the FPR95, the hetter the performance, with AUROC behaves inversely, All values are percentages and the best value is bolded.
iNaturalist
Textures
SUN
Places
AVG
Methods
FPR951
AUROCT
FPR95
AUROCT
FPR951
AUROCT
FPR95
AUROCT
FPR951
AUROCT
MSP
63.93
87.57
82.66
74,45
80.24
78.22
81.43
76.71
77.06
79.24
ODIN
62.69
89.36
81.31
76.3
71.67
83.92
76.27
80.67
72.99
82.56
Energy
64.91
88.48
80.87
75.79
65.33
85.32
73.02
81.37
71.03
82.74
GradNorm
50.03
90.33
61.42
81.07
46.48
89.03
60.86
84.82
54.7
86.3
Rankfeat
46.54
81.49
27.88
92.18
38.26
88.34
46.06
89.33
39,69
87.84
React
44.52
91.81
52.71
90.16
62.66
87.83
70.73
76.85
57.66
86.67
GATA
29.49
93.51
40.46
92.69
34.88
92.42
48.48
88.04
38.33
91.67
Our
28.59
93.67
39.17
92.9
33.78
92.58
47.72
88.21
37.31
91.84
we can use adversarial attacks to gradually identify OOD samples with high confidence scores, so the improvement is more obvious. We will verify this in the next subsection.
ing data. Among them, output-based methods rely on the confidence score of the model output determine whether the input sample belongs to the training data distribution, which is common in OOD detection based the maxi- mum softmax probability (MSP) (Hendrycks & Gimpel, 2016). Liang et al. proposed the ODIN algorithm, which utilizes temperature scaling and random perturbations to differentiate the softmax score distributions of ID and OOD samples (Liang et al., 2017). In order to explore the applica- bility of ODIN in different scenarios, Hus al. proposed confidence score decomposition approach and an improved input preprocessing approach based on the existing ODIN algorithm (Hsu et al., 2020). Liu et al. proposed a unified OOD detection framework based on energy scores to replace the traditional softmax score, thereby reducing the effect of overconfident output for softmax scores when inputting OOD samples (Liu al., 2020). Considering the problem that output-based -bssdd methods have poor discrinination effect in high-dimensional feature space, feature representation- based methods detect OOD samples by capturing structural information in feature space. Sun et al. proposed the Re- Act (Sun et al., 2021) algorithm based on the analysis of the internal activation pattern the model to reduce the overconfidence of neural networks on OOD samples. By removing the rank-1 matrix consisting of the largest singular value and its corresponding singular vector in the feature matrix, Song et al. proposed the Rankfeat (Song et al., 2022) algorithm for OOD detection. Gradient-based meth- ods are dedicated to analyzing the gradient information of input samples relative to model parameters (or output of a certain layer) (Huang al., 2021: Lee & AlRegib, 2020; Igoe al., 2022). Chen al. proposed the state-of-the-at GAIA (Chen et al., 2023) algorithm investigate the dif- ferent representations of attribution gradients (Simonyan, 2013) on ID and OOD samples for the first time. We further explore the true explanatory pattern representations by layer splitting and adversarial attribution gradient integration to enhance the accuracy of OOD detection.
Experiments on ImageNet benchmark: In Tab. 2, we evaluate the OOD detection performance of our S & I al- gorithm and other baselines on the ImageNet benchmark. Since ImageNet is a large label space dataset, we use Eq. 13 to obtain the OOD score. Experimental results show that our best performance compared with other post-hoc OOD detection methods. Specifically, our method achieves the lowest average FPR95 of 37.31% on the backbone model BiT-S model. At the same time, our method also achieves the highest AUROC of 91.84%. For the representative output-based method ODIN, our method achieves an FPR95 reduction of 48.88% At the same time, our method achieves an FPR95 reduction of 6% and 31.79% compared with the feature representation- based method Rankfeat and the gradient-based method GradNorm, re- spectively. Notably, compared with the main competitive baseline GAIA, our method obtains a 2.66% FPR95 reduc- tion, demonstrating the excellent performance on large label space datasets. Furthermore, to verify the impact of the ad- versarial attack and the layer-splittng modules (our first two contributions) on OOD detection, we conducted detailed ablation experiments in Appendix. B. The experimen- tal results demonstrate that both two modules significantly contribute to performance improvement. We also compare the computational costs of each method in Appendix. C. Finally, Appendix D provides additional experiments, in- cluding a comparative analysis with SCALE (Xu et al., 2024)-thh latest post-hoc OOD detection method proposed in 2024-as as well as an investigation into the effects of the adversarial attack learning rate 77.
algorithm achieves
5. Related work
Here we focus on post-hoc OOD detection methods as they can perform OOD detection after the model is deployed without retraining the model or accessing the original train-
8

---

Splitting& & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
6. Conclusion
Cimpoi, M., Maji, S., Kokkinos, I., Mohamed, S., and Vedaldi, A. Describing textures in the wild. In Pro- ceedings of the IEEE conference on computer vision and pattern recognition, pp. (606-3613) 2014.
In this paper, we contend that non-zero gradient behaviors of OOD samples lack sufficient differentiation, particularly when ID samples are perturbed by random perturbations in sigh-dimensional spaces, which hampers the accuracy of OOD detection. To tackle this issue, we propose the S & I al- gorithm. Specifically, we first split the model's ' intermediate layers and iteratively update adversarial examples layer-by- layer. The attribution gradients of each intermediate layer along the attribution path from adversarial examples to the actual input are integrated obtain true explanation pattern representations for ID and OOD samples. Experimental re- sults demonstrate that our S & I algorithm achieves superior performance compared to SOTA post-hoc O0D detection methods. The results highlight the effectiveness of S & algorithm in enhancing the robustness of OOD detection method in dynamic data environments, paving the way for more secure applications in real-world scenarios.
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEFE conference on computer vision and pattern recognition, pp. 248-255, Icee, 2009.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learn- ing for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Hein, M., Andriushchenko, M., and Bitterwolf, J. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 41-50, 2019.
Hendrycks, D. and Gimpel, K. A baseline for detecting misclassified and out-of-distrbuttio examples in neural networks. arXiv preprint arXiv:1610.0211 2016.
Impact statement
Ensuring the safe deployment of machine learning models in real-world applications hinges on their ability to recognize unfamiliar or anomalous inputs. This work introduces S & a novel Dut-of-DDstribuus
Hsu, Y.CC,, Shen, Y., Jin, H., and Kira, Z. Generalized odin: Detecting out-of distriibiiiittionnnn image without learn- ing from distri-iitttiuution data. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10951-10960, 2020.
(OOD) detection algorithm that integrates adversarial attribution gradients with layer-wise model decomposition. By addressing the limitations of prior gradient-basee based approaches, S & captures more faithful ex- planation pattern representations, achieving state-of ciite-of-theaard ti-the-art art performance on both small- and large-scale benchmarks such as CIFAR 100 and ImageNet. Beyond technical innova- tion, our method contributes to the broader societal goal of trustworthy AL Robust OOD detection plays foundational role in safety-critiche criitcal domains such as autonomous driving, healthcare diagnostics, and real-time Deciison-making sys- tems, where failing to identify unfamiliar data can lead to harmful or even catastrophic consequences. By improving detection accuracy and stability without requiring retrain- ing, S& & supports more reliable and adaptable Al systems that are better equipped to operate in dynamic, open-world environments.
Huang, R., Geng, A., and Li, Y. On the importance of gradients for detecting distributional shifts in the wild. Advances in Neural Information Processing Systems, 34: 677-689, 2021.
Igoe, C., Chung, Y., Char, I., and Schneider, J. How useful are gradients for ood detection really? arXiv preprint arXiv:2205. 10439, 2022.
Kolesnikov, A., Beyer, L., Zhai, X., Puigcerver, J., Yung, J., Gelly, S., and Houlsby, N. Big transfer (bit): General vi- sual representation learning. In Computer VisionFECCV 2020: 16th European Conference, Glasgow, UK, Au- gust 23-28, 2020, Proceedings, Part 16, pp. 491-507. Springer, 2020.
References
Krizhevsky, A., Hinton, G., al. Learning multiple layers of features from tiny images. 2009.
Chen, J., Li, J., Qu. X., Wang, J., Wan, J., and Xiao, Gaia: delving into gradient- based attribution abnormality for
Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 912 Chapman and Hal//CRC, 2018.
detection. Advances in Neural Information Processing Systems, (6:79946-799588 2023.
Chen, L., Lin, S., Lu, X., Cao, D., Wu, H., Guo, C., Liu, C., and Wang, F.-Y. Deep neural network based vehicle and pedestrian detection for autonomous driving: A survey. IEEE Transactions on Intelligent Transportation Systems, 22(6):3234-322 2021.
Lee, J. and AIRegib, G. Gradients as measure of uncer- tainty in neural networks. In 2020 IEEE International Conference on Image Processing (ICIP), pp. 2426-2420. IEEE, 2020.

---

Splitting & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
Liang, S., Li, Y., and Srikant, R. Enhancing the reliability of outtro-diisributioon image detection in neural networks. arXiv preprint arXiv: 1706.02690, 2017.
zoo. In 2010 IEEE computer society conference on computer vision and pattern recognition, pp. 3485-3492. IEEE, 2010.
Liu, W., Wang. X., Owens, J., and Li, Y. Energy-basee out- of-distribution detection. Advances in neural information processing systems,
Xu, K., Chen, R., Franchi, G., and Yao, A. Scaling for training time and post-hoc out-of-distribttion detection enhancement. In ICLR, 2024.
2020.
Netzer, Y.. Wang, T., Coates, A., Bissacco, A., Wu, B., Ng. A. Y., et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, pp. Granada, 2011.
Yadav, S. S. and Jadhav, S. M. Deep convolutional neural network based medical image classification for disease diagnosis. Journal of Big data, 6(1):1-18, 2019.
Yu, F., Seff, A., Zhang, Y., Song, S., Funkhouser, T., and Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv
Xiao, Lsun:
Nguyen, A., Yosinski, J., and Clune, J. Deep neural net- works are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE con- ference on computer vision and pattern recognition, pp. 427-436, 2015.
preprint arXiv:1506.0338 03365, 2015.
Zagoruyko, S. Wide residual networks. arXiv preprint arXiv:1605.00 146.0077166666 2016.
Zhang, J., Yang, J., Wang, P., Wang, H., Lin, Y., Zhang, H., Sun, Y., Du, X., Li, Y., Liu, Z., et al. Openood vl. 5: Enhanced benchmark for
Pan, D., X., and Zhu, D. Explaining deep neural network models with adversarial gradient integration. In Thirtieth International Joint Conference on Artificial Intelligence (IJCAT), 2021.
detection.
arXiv preprint arXiv:2306.09900 2023.
Zhou, B., Lapedriza, A., Khosla, A., Oliva, A., and Tor- ralba, A. Places: A 10 million image database for scene recognition. IEEE transactions on pattern analysis and machine intelligence, 400 2017.
Sastry, C. S. and Oore, S. Detecting out-of -idtr--disttibution ex- amples with gram matrices. In International Conference on Machine Learning, pp. 8491-8501. PMLR, 2020.
Simonyan, K.
Deep inside convolutional networks: Visu- alising image classification models and saliency maps. arXiv preprint 1rX1v:1312.6034, 2013.
Zhu, Z., Chen, H., Zhang, J., Wang, X., Jin, Z., Xue, J., and Salim, F. D. Attexplore: Attribution for explana- tion with model parameters exploration. In The Twelfth International Conference on Learning Representations, 2024a.
Song. Y., Sebe, N., and Wang. W. Rankfeat: Rank-1 fea- ture removal for out-of-distribution detection. Advances in Neural Information Processing Systems, 35:17885- 17898, 2022.
Zhu, Z., Chen, H., Zhang, J., Wang, X., Jin, Z., Xue, M., Zhu, D., and Choo, K.-K. R. Mfaba: A more faithful and accelerated boundary-based attribution method for deep neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 77228-172333 2024b.
Sun, Y., Guo, C., and Li, Y. React: Out-of-distribution detection with rectified activations. Advances in Neural Information Processing Systems, 34:144-151 2021.
Sundararajan, M., Taly, A., and Yan, Q Axiomatic attribu- tion for deep networks. In International conference on machine learning, pp. 3319-3328. PMLR, 2017.
Van Horn, G., Mac Aodha, O., Song, Y., Cui, Y., Sun, C., Shepard, A., Adam, H., Perona, P., and Belongie, S. The inaturalist species classification and detection dataset. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 8769-8778, 8778, 2018.
Wang, Z., Fredrikson, M., and Datta, A. Robust models more interpretable because attributions look normal. arXiv preprint arXiv:2 / /257, 2021.
Xiao, J., Hays, J., Ehinger, K. A., Oliva, A., and Torralba, A. Sun database: Large-scale scene recognition from abbey
10

---

Splitting & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
A. Pseudocode
Algorithm 1 SS
Input: Input sample 2, model with parameters 8, number of layers I, number of iterations T, number of channels K, image height R. image width S, loss function T,, learning rate
Output: OOD score
1: Initalize: 4 = b
2: for
do
3: for 1 1
4: Perform adversarial attack by Eq. 9 to get Axt" and g(x;"1))
5: prokppro adversarial attribution gradients by Eq. 10 or Eq. 12.
6: Calculate E [e] by Eq. 11 Eq. 13 depending the label space Y {1mmlym E Y).
7: Calculate the overall OOD score T by Eq. 14.
8: end for
9: end for
return OOD score
B. Ablation experiments
Here conduct detailed ablation experiments the adversarial attack module and layer splitting module of our S& I algorithm. Specifically, up three scenarios: model with non-adversarial layer-splitting. b) model with adversarial non-layer-splitinng, and c) our model with non-adversarial + non-layer-splitting. The ablation experiment results are as follows:
Table 3. S & (Non-adversariill Layer Splitting)
Table 4. S & (Adversarial + Non-layer Splitting)
OOD Dataset FPR95 (%)
AUROC (%)
OOD Dataset FPR95 ( (%)
AUROC ( (%)T
iNaturalist 34.75
92.48
iNaturalist 28.70
93.82
Textures
55.05
88.73
Textures
61.79
85.72
Sun
24.85
95.38
Sun
32.75
92.90
Places
40.60
91.47
Places
55.80
84.12
Average
38.81
92.02
Average
44.76
89.14
Table 5. S & (Non-advvrraarill + Non-layer Splitting)
Dataset FPR95 (%) 1
AUROC (%) f
iNaturalist 47.05
88.92
Textures 60.11
80.76
Sun
46.35
86.62
Places
67.00
79.57
Average 55.13
83.97
It can be seen that compared with Tab. 3 (Non-adversarial + Layer splitting), Tab. 5 (Non-adversarial + Non-layer splitting) achieved performance reduction of 16.32% and 8.05% on FPR95 and AUROC, respectively, and performed worse on each dataset, which shows the effectiveness of the layer splitting module. Compared with Tab. (Adversarial + Non-layer splitting), Tab. (Non-adversarial + Non-layer splitting) achieved performance reduction of 10.37% and 5.17% on FPR95 and AUROC, respectively, and performed worse on other datasets except the FPR95 metric of Textures, which strongly shows the effectiveness of the adversarial attack module. Therefore, through ablation experiments, we believe that the first two contributions proposed in the introduction are effective.

---

Splitting & Integrating: Out-of-Distribation Detection via Adversarial Gradient Attribution
C. Comparison of computational costs
Here we provide comparison of computational costs between our method and other baselines with the evaluation metric Frame Per Second (FPS). This metric refers the number of image frames the model can process per second. In OOD detection, FPS reflects the inference speed real-time capability of the model, serving as critical metric of algorithm efficiency. A higher FPS indicates faster processing speed.
Table 6. FPS comparison of different OOD detection methods (ImageNet)
Method
FPS
Our 4.9019
GAIA
6.3572
MSP
16,9090
ODIN
6.6613
Energy
16.3934
GradNorm 8.7750
RankFeat 4.8416
ReAct 15.8378
From Tab. 6, it can be observed that the ImageNet dataset, our method is slightly slower than GAIA. However, from the perspective of the main experimental metrics, FPR95 and AUROC, on the ImageNet dataset, our method achieves significant performance improvement. Compared to the computationally similar RankFeat method, our approach not only achieves faster runtime efficiency but also provides more accurate OOD detection. Therefore, we believe the computational cost of our algorithm an acceptable trade-off.
D. Additional experiments
In this part, we first conduct ablation study the hyperparameter learning rate 7). We vary the learning rate in the range 0.0005, 0,001, 0,0015, 0.002. It can be seen that our method consistently achieves high AUROC and low FPR95 scores across all OOD datasets under different settings. The performance remains stable, with only marginal fluctuations observed. This demonstrates that our method robust learning rate selection and can generalize well without requiring sensitive hyperparameter tuning. Then, we compare our method with the latest 2024 baseline SCALE (Xu al., 2024). can be seen that our method has better performance than SCALE on each OOD dataset. Using CIFARI00 the benchmark and learning rate of 0.001, our method shows 65.32% improvement in FPR95 and 28.37% improvement in AUROC compared to SCALE.
Table 7. Additional experiments
Methols
19105
SVIN
AUROC:
1PR95
LSUN
AUROCY
SPRUS]
Taylmap AURULY
Poaza
AUROCT
HPR95L
ToamIs
AUROCT
FPR95.
AVG
ALROCC
Aluatin esperiment learting rae 0.001
DIFARRRURRRNNNEEL... 0.001
Our
15.65
17.26
33.25
94.15
63.71
55.17
16.73
97.17
15.82
97.05
29:05
91.93
Alhatin experimeni loaning raie 0.0055
CIFARL CIPARL OURcaNN3344 0.0005
Our
15.67
97.05
33.32
94.17
63.72
59.15
1871
97.17
15.34
95.1
29.05
94.93
Alkatin esperiment loaning zate 0.0015
CIFARL (0RRcNN344 0.0015
Our
15.65
07.04
33.3
94.15
63.25
59.13
15.67
97.16
1533
97.11
29.02
94.92
Alaaton experimenton lomning va nto
CIFAR MRReeNNee24.11000
15.99
90.05
11.4
04.13
63.24
00.11
16.79
92.16
15.7
97. 17
24.05
94.91
Comparstie experiment with SCALE
CIFAR (4R
SCALE
$7.5
24.07
348
72.
34.55
79.64
70.08
83.16
33.66
83.76
33.95
12


Reviews:
[{"review_id": "wQwXuKAKaz", "reviewer": "Reviewer_4Hn3", "summary": "This paper proposes S & I (Splitting and Integrating), a gradient-based out-of-distribution (OOD) detection method that builds on gradient attribution techniques by leveraging adversarial attacks to refine feature explanations. The core idea is to split neural network layers and iteratively integrate attribution gradients across layers to obtain more robust feature representations for distinguishing between in-distribution (ID) and OOD samples. The approach is empirically validated with strong results, particularly on large-label-space datasets like ImageNet. The authors argue that this method improves model robustness and security in dynamic data environments.\n\n---\n\n## Update after rebuttal\nAs mentioned below, I am happy with the authors response. I will maintain my initial score (Weak Accept).\n\n---", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Claims And Evidence:**\n\n1. We sincerely state that in Section B of the supplementary materials, we have provided ablation experiments for the adversarial attack module and the layer splitting module. By comparing Table 4 and Table 5, it can be demonstrated that the adversarial attack module plays a significant role in our method.\n\n2. We would like to point out that the statement, \"different network layers focus on different types of features (textures, semantics, etc.)\" is both intuitive and theoretically supported, as demonstrated in numerous studies [1][2]. GAIA assumes that all intermediate layers have the same influence on the feature maps, which contradicts the hierarchical feature distribution inherent in neural networks. Compared to GAIA's uniform treatment of all layers during attribution, our proposed layer splitting theory offers an innovative contribution by more precisely capturing the feature sensitivity of different layers. Finally, the ablation experiments shown in Table 3 and Table 5 of the supplementary materials already demonstrate that the layer splitting module plays a crucial role in our method.\n\n[1] Zeiler, M. D., & Fergus, R. (2014). Visualizing and understanding convolutional networks. ECCV 2014.\n\n[2] Yosinski, J., Clune, J., Nguyen, A., Fuchs, T., & Lipson, H. (2015). Understanding neural networks through deep visualization. ICML Workshop on Deep Learning.\n\n3. We would like to point out that comparing the ablation experiments with and without integration does not align with the principles of discrete path integration. According to the formula in line 282: $A=L\\left(f\\left(x_T\\right)\\right)-L\\left(f\\left(x_0\\right)\\right)=\\sum_{i=0}^{T-1} \\frac{\\partial L\\left(f\\left(x_{i}\\right)\\right)}{\\partial x_i}\\left(x_{i+1}-x_i\\right)$, the attribution result $A$ is expressed as the cumulative sum of gradient changes along each point on the path. If layer-by-layer integration is not used and the attribution is only calculated based on the changes between the start and end points, the gradient variations along the path are ignored. This results in an inaccurate attribution gradient distribution, making it impossible to perform the OOD detection task properly, let alone improve detection accuracy. \n\n4. We sincerely state that in Section C of the supplementary materials, we have provided a comparison of computational costs. We use the frames per second (FPS) metric in Table 6 to evaluate the efficiency of the methods. We believe the computational cost of our algorithm is an acceptable trade-off.\n\n**Methods And Evaluation Criteria**\n\nPlease refer to point 4 in the Claims and Evidence section for the efficiency analysis. We are also pleased to highlight the significance of our method through the practical task of plant OOD detection. For details, please see our response to **Reviewer SPNg in Q1**.\n\n**Theoretical Claims**\n\nWe would like to clarify that we have provided extensive mathematical proofs as the theoretical foundation for our method (including but not limited to the claims and proofs of Theorem 1 and Theorem 2). We use Equation 3 to ensure that the adversarial perturbation consistently enhances feature sensitivity. Equations 9 and 10 formally derive the layer splitting strategy from a mathematical perspective.\n\n**Experimental Designs Or Analyses**\n\nThe analyses of time efficiency, ablation studies, and real-world OOD cases can be found in the above rebuttals.\n\n**Relation To Broader Scientific Literature**\n\nWe would like to clarify that energy-based OOD scoring has already been used as a baseline for comparison in our paper on line 371, and our method demonstrates significantly better performance. As for Mahalanobis distance-based scoring, since it is an earlier work and it seems that no clear citation link has been provided by the reviewer, we have not included it as a comparison target. We compare our method with the latest 2024 baseline \"SCALE\". It can be seen that our method has better performance than SCALE on each OOD dataset. For more details, please refer to **Q1 in Questions For Authors at Reviewer 5PTw**\n\n**Essential References Not Discussed**\n\nWe appreciate the reviewer's addition; however, it seems that no clear citation link of the two references has been provided. If the reviewer could supply the link, we would be happy to discuss these works.\n\n**Other Strengths And Weaknesses**\n\nThe efficiency analysis, comparison experiments, and ablation studies can be found in the above rebuttals.\n\n**Other Comments Or Suggestions**\n\nWe appreciate the reviewer’s suggestions, and we will improve the presentation of the formulas and figures to enhance the clarity of the paper.\n\n**Questions For Authors**\n\nThe time efficiency analysis, comparison experiments, and real-world OOD case analysis can be found in the above rebuttals.\n\nWe sincerely hope that our response has addressed the reviewer's concerns. We would be truly grateful if the reviewer would consider adjusting the score accordingly.", "claims_and_evidence": "Some of the claims made in this submission are that: \n1. Adversarial gradient attribution improves OOD detection over GAIA. Although, experiments across multiple datasets strengthen this claim, the paper does not provide an ablation study that isolates the specific impact of adversarial baselines.\n\n2. The paper argues that different network layers focus on different types of features (textures, semantics, etc.), and thus should be split rather than treated uniformly. Unfortunately, the claim lacks theoretical justification beyond intuition. An ablation study comparing different numbers of layer splits (e.g., one split, two splits, all layers) would clarify how much splitting contributes to performance.\n\n3. The authors argue that gradients from different layers should be integrated iteratively to prevent instability. Here too, an ablation comparing results with vs. without integration would clarify how much gradient integration itself improves detection accuracy.\n\n4. It is not clear how much additional overhead does layer-splitting and gradient integration introduce. This also begs the question of whether the method be used efficiently for large architectures.", "methods_and_evaluation_criteria": "The evaluation criteria are mostly appropriate but have gaps. More specifically, I found the methods and evaluation protocol used to be mostly reasonable but I think that additional computational and statistical validation is needed for a complete assessment. For instance, no computational efficiency analysis (runtime/memory overhead) is done to evaluate the efficiency of  the proposed framework. No real-world OOD cases (e.g., adversarial or domain-shifted OOD data) are studied to further strengthen the claims made in the paper.", "theoretical_claims": "The theoretical claims in the paper are mostly plausible but lack full mathematical rigor and empirical validation. The proof that adversarial baselines improve gradient attribution follows a logical argument but does not include empirical verification to confirm that adversarial perturbations consistently enhance feature sensitivity. The claim that layer splitting improves stability is based on heuristic reasoning rather than a formal mathematical justification, as it lacks a precise metric for instability. Similarly, the argument that gradient integration reduces noise assumes variance reduction but does not provide explicit variance bounds or an empirical demonstration of this effect. Finally, the proof that the proposed OOD scoring function is optimal assumes that OOD samples always yield stronger gradients, which is not universally true and requires further validation across diverse datasets. Strengthening these claims with statistical validation, variance analysis, and empirical testing would improve the paper’s theoretical foundation.", "experimental_designs_or_analyses": "The framework proposed by the authors follows standard OOD detection practices, but there are some critical gaps in validation. While the experimental design follows standard OOD detection protocols, it lacks statistical efficiency benchmarks, ablation studies, and failure case analyses. Addressing these issues would improve confidence in the results. For instance, the method introduces adversarial perturbations + layer-wise gradient integration, which may be computationally expensive, but fails to report per sample inference time analysis and a comparative analysis against baselines. I wish also there were more experiments isolating the effects of adversarial attribution, layer splitting, and gradient integration. Conducting such an ablation study can show which component contributes most to performance gains.", "relation_to_broader_scientific_literature": "The paper refines gradient-based OOD detection by incorporating adversarial perturbations and layer-wise gradient integration, linking it to prior work in feature attribution, adversarial attacks, and hierarchical feature processing. While novel, it lacks comparisons to some closely related methods that could strengthen its scientific positioning. For instance, this method is related to energy-based OOD scoring (Liu et al., 2020) and Mahalanobis distance-based scoring (Lee et al., 2018) due to the fact that it scores OOD samples based on gradient density rather than activation energy or distance metrics, but no such comparison is considered in the paper.", "essential_references_not_discussed": "The paper introduces valuable refinements to gradient-based OOD detection but does not cite some key works on gradient stability, adversarial attribution, feature disentanglement, and alternative OOD scoring methods. Addressing these gaps would strengthen its scientific positioning and clarify how it improves upon prior approaches. On gradient-based OOD detection, the work doesn't cite [1], and concerns expressed in [1] seems to contradict some claims made in this current work. On adversarial perturbations, the work doesn't consider the fact that adversarial perturbations may distort attribution maps, as discussed in [2]. Experimentally validating that the attribution gradients of adversarial examples that are integrated in the model do not affect feature quality might be useful.\n\n\n[1] Gradient Stability in OOD Detection (Serrà et al., Hooker et al.)\n[2] Adversarial Perturbations for Attribution (Etmann et al., Dombrowski et al.)", "other_strengths_and_weaknesses": "The paper is original, practical, and well-explained, but lacks computational efficiency analysis, broader comparisons, and ablations. These missing elements weaken confidence in the method’s impact, but addressing them could make it a strong contribution.", "other_comments_or_suggestions": "Some equations are referenced without clear explanation of their role in derivations. Please consider adding a short remark before or after.\nAlso, some figures lack descriptive captions. It'd be useful if the authors could clearly explain what is being shown in gradient attribution maps.", "questions_for_authors": "The paper presents a creative combination of adversarial perturbations and layer-wise gradient attribution, making a valuable contribution to gradient-based OOD detection. The methodology is clearly explained and has potential real-world applications. However, the significance of performance improvements, computational cost, and comparison to alternative OOD methods remain unaddressed. Adding runtime benchmarks, broader method comparisons, and failure case analyses would significantly strengthen the paper. Some of the key strengths of this paper are: 1.) using adversarial perturbations as baselines rather than standard black images (as in GAIA), which seems to be a novel refinement over GAIA, and 2.) the proposed method improves OOD detection without retraining, making it feasible for real-world deployment in settings like medical imaging or security applications. The ability to work with pre-trained networks increases its usability for practitioners.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BmFb9h1u2O", "reviewer": "Reviewer_mGtj", "summary": "This paper proposes a method called S&I (Splitting and Integration) for improving out-of-distribution (OOD) detection in deep neural networks. S&I introduces two components: (1) layer splitting, which decomposes intermediate layers of the network to iteratively update adversarial examples and reduce gradient instability, and (2) gradient integration, which aggregates attribution gradients along the attribution path from adversarial examples to the input. Experimental setup is followed a previous work GAIA and experiments were conducted across various ID/OOD datasets.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Other Strengths And Weaknesses**\n\nWeakness1：We thank the reviewer for the valuable comment. We would like to clarify that the insignificant improvement of our method on CIFAR100 does not mean limited effect, but means that our method can achieve the same or even slightly better performance than GAIA on small datasets. Besides, we would like to emphasize that our approach demonstrates significant improvements on the larger-scale ImageNet dataset. This distinction highlights the strength of our method in addressing the challenges of OOD detection in large-scale environments, which is a critical focus of our work. We also want to clarify that current OOD detection metrics such as FPR95 and AUROC have already achieved promising performance across many benchmark datasets. However, our approach prioritizes robustness and reliability in large-scale scenarios like ImageNet, where these challenges become more pronounced.\n\nWe are pleased to highlight the significance of our method through the practical task of plant OOD detection. For details, please see our response to **Reviewer SPNg in Q1**.\n\n\nWeakness2：Thanks to the reviewer for the suggestion. We would like to clarify that this view is one of the motivations of our paper. In lines 194-197, we explained that the attribution-based OOD detection method such as GAIA is developed based on the baseline selection of $x'=0$. GAIA checks OOD samples by counting the distribution of non-zero attribution gradients, so the highly OOD nature represented by non-zero attribution gradients has been proven. However, using the black image with x=0 as the baseline will make it difficult to retain the original semantic information of the sample when attributing, and it is easily disturbed by noise, which will cause deviations when counting non-zero attribution gradients, reducing the accuracy of OOD detection. Adversarial samples can retain the semantic information of samples while introducing minimal perturbations, so we designed an adversarial attribution-based OOD detection method by layer splitting and attribution integration, corresponding to the pseudo code of lines 409-414. Since non-zero gradient represents a high confidence OOD sample probability (as expressed by GAIA), it is obvious that the accuracy of calculating non-zero gradient will significantly affect the accuracy of OOD detection. This is the starting point for designing our method, and the performance improvement in extensive experiments (especially on large-scale ImageNet) has proven that our method can more accurately calculate the attribution gradient (i.e., we can obtain more accurate non-zero and zero gradient distribution) to obtain better OOD detection performance.\n\n\n**Other Comments Or Suggestions**\n\nFor the FPR numbers in brackets, we hope that the following explanation can help the reviewer’s understanding. Referring to Table 1, we can see that the backbone models are ResNet34 and WRN40, respectively. Therefore, the FPR numbers in brackets represent the results on the WRN40 model. We promise to revise the text to avoid ambiguity.\n\n**Questions For Authors**\n\nQ1: Our method can be easily extended to other gradient-based OOD detection methods. By introducing adversarial samples as a baseline, the gradient calculation can be stabilized and noise interference can be reduced. This strategy can be applied to other gradient-based methods (such as GradNorm, GAIA, etc.) to enhance the distinguishability of gradient patterns by generating adversarial samples, thereby improving detection robustness. In addition, layer splitting can alleviate the problem of gradient explosion or cumulative error in deep networks by analyzing the gradient sensitivity of different layers in a hierarchical manner. This module can be independently integrated into other methods, such as decomposing by layer when computing gradient importance and optimizing the detection logic by leveraging the characteristics of different layers (e.g., low-level textures and high-level semantics).\n\nQ2: Regarding the inclusion of additional comparison methods, we are open to the reviewer’s suggestions and are willing to compare our method with the latest 2024 baseline \"SCALE\" [1], the results are in the link: https://anonymous.4open.science/r/S-I-F6F7/rebuttal/additional_exp_result.md. It can be seen that our method has better performance than SCALE on each OOD dataset. Using CIFAR100 as the benchmark and a learning rate of 0.001, our method shows a 65.32% improvement in FPR95 and a 28.37% improvement in AUROC compared to SCALE.\n\n[1] Xu, K., Chen, R., Franchi, G., & Yao, A. (2023). Scaling for training time and post-hoc out-of-distribution detection enhancement. arXiv preprint arXiv:2310.00227.\n\nQ3: Please see the clarifications in Weakness 2.\n\nWe sincerely hope that our response has addressed the reviewer's concerns. We would be truly grateful if the reviewer would consider adjusting the score accordingly.", "claims_and_evidence": "not all, see the weaknesses", "methods_and_evaluation_criteria": "yes", "theoretical_claims": "yes", "experimental_designs_or_analyses": "yes", "relation_to_broader_scientific_literature": "The paper could has broader scientific impact on OOD detection, especially for understanding the gradient-based methods, and provides new idea about the OOD detection.", "essential_references_not_discussed": "no", "other_strengths_and_weaknesses": "Strengths:\n1. The paper is well organized and easy to read.\n2. The paper provides a theoretical analysis of the proposed method.\n3. Experiments were conducted on standard protocols and across many benchmarks.\n\nWeaknesses:\n1. The paper only has marginal improvement over GAIA in average, reflecting that the proposed method is less effective.\n2. The motivation is less convincingly described, for the main argument “the non-zero gradient behaviors of OOD samples do not exhibit significant distinguishability”, only a visualization in Fig.2 is presented to support it. Is there any statistic evidence? Considering the marginal accuracy improvement over GAIA, it is highly possible that such a key argument does not in practice, or this may not be the key defect for GAIA.\n\n\n==================== post rebuttal =======================\n\nAfter read the rebuttal, the reviewer maintains the initial recommendation.", "other_comments_or_suggestions": "The FPR numbers in the brackets of abstract and end of section 1 are not easy to understand, suggesting to remove them.", "questions_for_authors": "Can the method extend to other gradient based OOD methods?\n\nGAIA was published on 2023, how about the performance compared the state of the art gradient based OOD methods?\n\nFor the argument presented in this paper “the non-zero gradient behaviors of OOD samples do not exhibit significant distinguishability”, it is unclear how the proposed S&I conquer this problem.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "igP0r1RUAE", "reviewer": "Reviewer_SPNg", "summary": "This paper addresses the challenge of out-of-distribution (OOD) detection in deep learning by proposing S & I, a novel method based on layer Splitting and gradient Integration via Adversarial Gradient Attribution. While existing gradient-based methods struggle to distinguish OOD samples due to non-zero gradient behaviors, especially in high-dimensional spaces with noisy in-distribution (ID) samples, S & I improves detection by iteratively updating adversarial examples layer by layer and integrating attribution gradients along the attribution path. Experimental results on CIFAR100 and ImageNet demonstrate that S & I outperforms state-of-the-art OOD detection methods, enhancing model robustness and security in unknown and dynamic data environments.\n\n## update after rebuttal\nI thank the authors for their rebuttal, which has addressed my concerns. I am now pleased to change my recommendation from weak reject to weak accept.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the valuable suggestions. We provide the following responses to the questions in “**Questions For Authors**”.\n\nQ1: We would like to clarify that the insignificant improvement of our method on CIFAR100 does not mean limited effect, but means that our method can achieve the same or even slightly better performance than GAIA on small datasets. Besides, we would like to emphasize that our approach demonstrates significant improvements on the larger-scale ImageNet dataset. This distinction highlights the strength of our method in addressing the challenges of OOD detection in large-scale environments, which is a critical focus of our work. We also want to clarify that current OOD detection metrics such as FPR95 and AUROC have already achieved promising performance across many benchmark datasets. However, our approach prioritizes robustness and reliability in large-scale scenarios like ImageNet, where these challenges become more pronounced.\n\nWe are pleased to highlight the significance of our method through the practical task of plant OOD detection. Firstly, we selected the ImageNet dataset as the in-distribution (ID) dataset. To perform the plant OOD detection task, we chose the iNaturalist dataset as the OOD dataset. Specifically, we manually selected 110 plant categories from the iNaturalist dataset and randomly sampled 10,000 images for these categories. The related experimental codes and results can be found in our anonymous GitHub repository (https://anonymous.4open.science/r/S-I-F6F7/additional_OOD_samples/). The entire work is fully open-source.\n\nThe detected OOD samples are stored in the \"additional_OOD_samples\" folder. Interestingly, the OOD samples detected from the iNaturalist dataset are all plant species that are not present in the ImageNet dataset, demonstrating the effectiveness of our method in plant OOD detection tasks. This result can be further explained by the dataset characteristics: ImageNet is a general-purpose image classification dataset, while iNaturalist focuses on biodiversity and covers a wide range of fine-grained species. For certain visually similar plant categories, such as the Violet category in ImageNet and the Viola sororia category in iNaturalist, conventional OOD detection methods like MSP, ODIN, and GradNorm struggle to distinguish them and often classify OOD samples as ID categories. However, our method can accurately distinguish fine-grained plant species, as evidenced in the additional_OOD_samples folder. We provide the following example for the reviewers’ reference:\n\nDetection of angiosperms: The following link shows an OOD sample detected from the iNaturalist dataset, belonging to the Lotus corniculatus category (https://anonymous.4open.science/r/S-I-F6F7/additional_OOD_samples/b51107eaf0608d345a265f623c776706.jpg). The corresponding ID sample from the ImageNet dataset, belonging to the Rapeseed category, is available at this link: (https://anonymous.4open.science/r/S-I-F6F7/ImageNet_rapeseed/1.png).\nBy comparing these two images, it becomes evident that the visual differences between them are minimal, making it challenging for humans to distinguish visually similar plant species. However, our method effectively identifies fine-grained plant species, which has significant real-world implications, such as discovering new plant species or protecting endangered plant populations.\n\nRegarding the inclusion of additional comparison methods, we are open to the reviewer’s suggestions and are willing to compare our method with the latest 2024 baseline \"SCALE\". It can be seen that our method has significantly better performance than SCALE on each OOD dataset. For more details, please refer to **Q1 in Questions For Authors at Reviewer 5PTw**\n\nQ2: We sincerely express that we have provided ablation experiments of the adversarial attack module and layer splitting module in Part B of the supplementary material. By comparing Table 4 and Table 5, it can be proved that adversarial attack module plays an important role. Similarly, by comparing the ablation experiments in Table 3 and Table 5, it can be proved that the layer splitting module also plays an important role. We hope our response can address the reviewer's concerns.\n\nQ3: We kindly acknowledge that we have provided a comparison of computational costs in Part C of the Supplementary Materials. We measure the efficiency of our methods using the frame per second metric in Table 6. It can be observed that on the ImageNet dataset, our method is slightly slower than GAIA. However, from the perspective of the main experimental metrics, FPR95 and AUROC, on the ImageNet dataset, our method achieves significant performance improvement. Compared to the computationally similar RankFeat method, our approach not only achieves faster runtime efficiency but also provides more accurate OOD detection. Therefore, we believe the computational cost of our algorithm is an acceptable trade-off.", "claims_and_evidence": "Yes, the claims are supported by clear and convincing evidence.", "methods_and_evaluation_criteria": "Yes, the proposed method and evaluation criteria make sense for the problem.", "theoretical_claims": "I reviewed all the theorems and proofs in the paper and, to the best of my judgment, they appear to be correct. However, there is a possibility that I may have misunderstood something.", "experimental_designs_or_analyses": "I reviewed the experimental design, including the datasets, models, baselines, and evaluation metrics, and did not identify any obvious issues.", "relation_to_broader_scientific_literature": "The key contributions of the paper align with the broader out-of-distribution (OOD) detection literature, particularly in the area of gradient-based OOD detection methods.", "essential_references_not_discussed": "To the best of my knowledge, all relevant works necessary for understanding the paper’s key contributions are properly cited and discussed.", "other_strengths_and_weaknesses": "Other Weaknesses:\n\n1. The proposed method does not appear to significantly outperform the baseline method, GAIA. To better assess the significance of the improvements, it would be beneficial to repeat the experiments multiple times and report the mean and variance of the results.\n\n2. The paper lacks ablation experiments to evaluate the impact of different components in the proposed method. Conducting such experiments would help clarify the contributions of each part of the proposed approach.\n\n3. There is no analysis of the computational complexity of the proposed method compared to the baselines. Providing a complexity analysis would offer valuable insights into its efficiency and practicality for real-world applications.", "other_comments_or_suggestions": "No other comments.", "questions_for_authors": "I am willing to raise my scores if the authors address the following questions:\n\n1. Does the proposed method demonstrate a significant improvement over the baselines?\n\n2. How do the different components of the proposed method contribute to its overall performance?\n\n3. How does the computational complexity of the proposed method compare to that of the baselines?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jkp33G7Tyb", "reviewer": "Reviewer_5PTw", "summary": "The authors propose a post-hoc detector, which is an interesting approach, especially given that post-hoc methods generally struggle with robustness against adversarial examples. Their lightweight architecture allows for easy retraining and is practical for deployment.\n\nIn particular, their method involves splitting the model’s intermediate layers and iteratively updating adversarial examples layer by layer. They then combine the attribution gradients from each intermediate layer along the attribution path from the adversarial examples to the actual input, producing accurate explanations for both in-distribution (ID) and out-of-distribution (OOD) samples.\n\nThe method is well-supported with formulas and explanations. When compared to other post-hoc methods, it shows some improvements in terms of accuracy, though the improvements are limited. The appendix includes ablation studies that demonstrate the importance of layer-splitting, providing experimental support. Additionally, they report the frames per second of their method, which is on the lower end.\nThe underlying main related work is GAIA [1] and gradient-based OOD detector and [2] for the Axioms and theoretical foundations.\n\n\nThe code is developed independently, though OpenOOD, the standardized benchmark for OOD tasks, could have yielded similar results. \n\nThe work has some weaknesses, such as a limited description of the attack method, and the related work section could be strengthened with more citations.\n\n[1] https://arxiv.org/pdf/2311.09620 \n[2] https://arxiv.org/pdf/1703.01365\n\n\n## update after rebuttal\nI upgrade my score from weak accept to accept. \nThe author(s) showed additional experiments comparing with SCALE, a sota method,  where their method is performing better.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Theoretical Claims:**\n\nWe appreciate the reviewer's suggestions. Our mathematical proofs are all grounded in theoretical foundations. Regarding the reviewer's concern about \"OOD samples being overconfident in prediction,\" we have cited (Nguyen et al., 2015; Hein et al., 2019) on lines 161-164 in our manuscript to support this claim. This perspective is also accepted by GAIA, as illustrated in Figure 1 of the GAIA paper. We hope our response has addressed the reviewer's concerns.\n\n**Weaknesses:**\n\n1. We appreciate the reviewer’s suggestion. Indeed, replacing \"noise\" with \"perturbation\" better reflects the deliberately manipulated nature of adversarial attacks. Regarding Equation 3, it can be extended as an untargeted BIM (Basic Iterative Method) attack, meaning that the adversarial example's label differs from the original label and does not need to be manipulated to a specific category. Notably, the difference between BIM and FGSM lies in the iterative process: FGSM generates adversarial examples with a single-step update, whereas BIM performs multiple iterations and projects the perturbations within a predefined bound to control the magnitude of the disturbance. To help readers understand the concept of adversarial attacks (especially BIM), we cited Kurakin et al. (2018) [1] as a reference on line 190. But regarding the understanding of Equation 3, we find the reviewer’s suggestion very constructive, and we will cite [1] at Equation 3 to further support the explanation.\n\n[1] Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018). Adversarial examples in the physical world. In Artificial intelligence safety and security (pp. 99-112). Chapman and Hall/CRC.\n\n2. We appreciate the reviewer’s suggestion. For the adversarial attack hyperparameters in Equation 3, we used a learning rate $\\eta$ of 0.001 and a fixed number of attack step $T=2$. For the parameter $\\epsilon$ in Equation 4, since it is jointly controlled by the learning rate and the attack step, and we have fixed the number of attack step in our experiments, we conduct an ablation study on the hyperparameter learning rate $\\eta$ to investigate the impact of different perturbations on our method. For details on the ablation experiment, please refer to **Q3 in Questions For Authors**.\n\n3. Please refer to **Q3 in Questions For Authors**\n\n4. We referred to the definition of OOD detection in GAIA [2] to propose our Equation 1. Indeed, we highly appreciate the reviewer’s constructive suggestions. As an open-source and comprehensive OOD detection framework, the OpenOOD has made significant contributions to OOD research. We will refine our manuscript by incorporating the definition of OOD detection at Equation 1 in OpenOOD.\n\n[2] Chen, J., Li, J., Qu, X., Wang, J., Wan, J., & Xiao, J. (2023). Gaia: Delving into gradient-based attribution abnormality for out-of-distribution detection. Advances in Neural Information Processing Systems, 36, 79946-79958.\n\n**Other Comments Or Suggestions:**\n\n1&2. We sincerely thank the reviewer for pointing out the errors, and we have addressed this issue.\n\n**Questions For Authors:**\n\nQ1. For the selection of post-hoc detectors, we referred to the baselines set in GAIA, which includes gradient-based OOD detection methods such as GAIA and GradNorm, as well as feature representation-based methods like Rankfeat and React, and output-based methods such as MSP and ODIN. Regarding the inclusion of additional comparison methods, we are open to the reviewer’s suggestions and are willing to compare our method with the latest 2024 baseline \"SCALE\", the results are in the link: https://anonymous.4open.science/r/S-I-F6F7/rebuttal/additional_exp_result.md. It can be seen that our method has better performance than SCALE on each OOD dataset. Using CIFAR100 as the benchmark and a learning rate of 0.001, our method shows a 65.32% improvement in FPR95 and a 28.37% improvement in AUROC compared to SCALE.\n\nQ2. In fact, this attack is essentially a BIM attack. Please refer to our response in **Weaknesses 1**, which we hope will resolve the reviewer's concerns.\n\nQ3. We appreciate the reviewer's suggestions and are happy to conduct an ablation study on the learning rate to explore the impact of different perturbation magnitudes on our method. In the Table at link: https://anonymous.4open.science/r/S-I-F6F7/rebuttal/additional_exp_result.md, we vary the learning rate in the range {0.0005, 0.001, 0.0015, 0.002}. It can be seen that our method consistently achieves high AUROC and low FPR95 scores across all OOD datasets under different settings. The performance remains stable, with only marginal fluctuations observed. This demonstrates that our method is robust to learning rate selection and can generalize well without requiring sensitive hyperparameter tuning.\n\nWe sincerely hope that our response has addressed the reviewer's concerns. We would be truly grateful if the reviewer would consider adjusting the score accordingly.", "claims_and_evidence": "- They supported their claims experimentally. - not problematic.", "methods_and_evaluation_criteria": "It is not clear to me, why they compared with these post-hoc detectors, although there are more.", "theoretical_claims": "At proof 2: It is claimed that OOD samples are overconfident in prediction. This is not clear to me, because adversarial examples are can be also very confident.\nI am not sure if in ln 259 (right column) holds the inequality.", "experimental_designs_or_analyses": "It is unclear why other methods, such as SCALE, which is one of the most recent approaches, were not included in the comparison.", "relation_to_broader_scientific_literature": "Post-hoc OOD detectors are important and very vulnerable to adversarial example.", "essential_references_not_discussed": "- OOD standard framework: https://github.com/Jingkang50/OpenOOD or https://arxiv.org/pdf/2306.09301\n- FGSM attack: https://arxiv.org/abs/1412.6572 or even https://arxiv.org/pdf/2306.09301", "other_strengths_and_weaknesses": "Strengths:\n\n- The focus on post-hoc OOD detection methods, which are at the forefront of OOD detection research, is a notable strength of this work.\n- The gradient-based approach presented offers a promising and potentially robust method for this problem, making it a strong candidate in the field.\n\nWeaknesses:\n\n- The term \"adversarial noise\" may be a misnomer. Typically, \"noise\" refers to random fluctuations, whereas an adversarial example is a deliberate manipulation of the input. The definition provided in Equation 3 closely resembles the FGSM attack, but it is not properly cited.\n- In the experimental setup, the attack parameters remain unspecified. Equation 4 introduces a hyperparameter for perturbation strength, but it is unclear whether the perturbation is sufficiently strong to evaluate the method's robustness accurately.\n- There is no ablation study regarding the effect of adversarial perturbation strength, making it difficult to assess the impact of this variable.\n- Equation 1 could be enhanced by referencing relevant literature, such as [1].\n\n[1] https://arxiv.org/pdf/2306.09301", "other_comments_or_suggestions": "- In Table 2, the value 88.21 should not be bolded for the proposed method, as Rankfeat demonstrates stronger performance. This issue can be easily addressed.\n- ln 208 - typo: balck --> black", "questions_for_authors": "Dear author(s),\n\nthank you for your insightful paper on this important topic.\n\nI have a few questions:\n\n- What is the rationale behind comparing to the selected post-hoc detectors? Are there more recent methods that could also be considered for comparison?\n- Is it accurate to state that the attack is essentially an FGSM attack?\n- Would it be possible to conduct an ablation study to analyze the effect of varying the strength of the generated perturbations? Wouldn't this useful for your method and missing to your ablation study in the appendix? Or do you think that this ablation study is unnecessary and why? \n\nAfter discussion, I might update my score. I hope for insightful discusses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "none"}}]

Author rebuttal:

Meta-review: This paper received mostly positive ratings, with only one reviewer at weak reject. Two reviewers raised their scores after the rebuttals, indicating the effectiveness of the authors arguments and additional results which showed performance vs. new baselines as requested. The negative review was not particularly thorough, and the reviewer did not respond to the rebuttal other than acknowledging it. The work introduces an interesting new method for OOD detection, as appreciated by three of the reviewers, with SOTA results on standard datasets.
Decision: Accept (poster)