Single Layer Predictive Normalized Maximum Likelihood for Out-of-Distribution Detection
Authors: Koby Bibas
Meir Feder
Tal Hassner
Venue: NeurIPS 2021 Poster (2021)
Keywords: out-of-distribution
normalized maximum likelihood
information theory
deep neural network
regret
generalization error

Abstract: Detecting out-of-distribution (OOD) samples is vital for developing machine learning based models for critical safety systems. Common approaches for OOD detection assume access to some OOD samples during training which may not be available in a real-life scenario. Instead, we utilize the {\em predictive normalized maximum likelihood} (pNML) learner, in which no assumptions are made on the tested input. We derive an explicit expression of the pNML and its generalization error, denoted as the regret, for a single layer neural network (NN). We show that this learner generalizes well when (i) the test vector resides in a subspace spanned by the eigenvectors associated with the large eigenvalues of the empirical correlation matrix of the training data, or (ii) the test sample is far from the decision boundary. Furthermore, we describe how to efficiently apply the derived pNML regret to any pretrained deep NN, by employing the explicit pNML for the last layer, followed by the softmax function. Applying the derived regret to deep NN requires neither additional tunable parameters nor extra data. We extensively evaluate our approach on 74 OOD detection benchmarks using DenseNet-100, ResNet-34, and WideResNet-40 models trained with CIFAR-100, CIFAR-10, SVHN, and ImageNet-30 showing a significant improvement of up to 15.6% over recent leading methods.

Single Layer Predictive Normalized Maximum Likelihood for Out-of-Distribution Detection
Koby Bibas
Meir Feder
School of Electrical Engineering
School of Electrical Engineering
Tel Aviv University
Tel Aviv University meirdeng. tau. ac il
kobybibas@gmaill
Tal Hassner
Facebook AI
talhassner@gmaile @gwaaineeegmmaal..ommmm
Abstract
Detecting out-of-distribution (OOD) samples is vital for developing machine learn- ing based models for critical safety systems. Common approaches for OOD detection assume access to some OOD samples during training which may not be available a real-life scenario. Instead, we utilize the predictive normalized maxi- mum likelihood (pNML) learner, in which assumptions are made on the tested input. We derive an explicit expression of the pNML and its generalization error, denoted the regret, for single layer neural network (NN). We show that this learner generalizes well when (i) the test vector resides a subspace spanned by the eigenvectors associated with the large eigenvalues of the empirical correlation matrix of the training data, or (ii) the test sample is far from the decision boundary. Furthermore, describe how to efficiently apply the derived pNML regret any pretrained deep NN, by employing the explicit pNML for the last layer, followed by the softmax function. Applying the derived regret deep NN requires neither addi- tional tunable parameters nor extra data. We extensively evaluate our approach on 74 OOD detection benchmarks using DenseNet- 100, ResNet-34, and WideResNet- 40 models trained with CIFAR- 100, CIFAR- 10, SVHN, and ImageNet-30 showing significant improvement of up to 15.6% over recent leading methods.
1 Introduction
An important concern that limits the adoption of deep neural networks (DNN) in critical safety systems is how assess confidence in their predictions, i.e, quantifying their generalization capability (Kaufman et al. 2019:; Willers et al.) (2220). Take, for instance, a machine learning model for medical diagnosis (Bibas al. (2021). It may produce (wrong) diagnoses the presence of test inputs that are different from the training set rather than flagging them for human intervention (Singh al. 202T). Detecting such unexpected inputs had been formulated as the -iitt--distriuution (OOD) detection task (Hendrycks and Gimpel 2017). as flagging test inputs that lie outside the training classes, i.c., are not in- ii-distribution (IND).
Previous learning methods that designed to offer such generalization measures, include VC- dimension (Zhong al. 2017 /aapnik and Chervonenkis 2015) and norm based bounds (Neyshabur et al. 2018; Bartlett et al. (017). As a whole, these methods characterized the generalization ability based on the properties of the parameters. However, they do not consider the test sample that is presented to the model (Jiang et al. 20200), which makes them useless for OOD detection. Other approaches build heuristies over the empirical risk minimization (ERM) learner, by post-processing
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

the model output (Sastry and Oore, 2020) or modifying the training process PPapadopoulss et al. | Vyas et al, 2018). Regardless of the approach, these methods choose the learner that minimizes the loss over the training set. This may lead to a large generalization error because the ERM estimate may be wrong on unexpected inputs; especially with large models such as DNN (Belkin et al. 2019).
To produce a useful generalization measure, we exploit the individual setting framework (Merhav and Feder 1998). In the individual setting, there is no assumption about how the training and the test data are generated, nor about their probabilistic relationship. Moreover, the relationship between the labels and data can be deterministic and may therefore be determined by an adversary. The generalization error in this setting is often referred to as the regret (Merhav and Feder, 1998). This regret is defined by the log-loss difference between learner and the genie: a learner that knows the specific test label, yet is constrained to use an explanation from a set of possible models. The individual setting is the most general framework and so the result holds for a wide range of scenarios. Specifically, the result holds to OOD detection where the distribution of the OOD inputs is unknown.
The pNML learner (Fogel and Feder 2018) was proposed as the min-max solution of the regret, where the minimum is over the learner choice and the maximum is for any possible test label value. Intuitively, the pNML assigns probability for potential outcome as follows: Add the test sample to the training set with an arbitrary label, find the ERM solution of this new set, and take the probability it gives to the assumed label. Follow this procedure for every label and normalize to get a valid probability assignment. The pNML was developed before for linear regression (Bibas et al. (019b) and was evaluated empirically for DNN (Fu and Levine 2021 Bibas et al. 2019a).
We derive an analytical solution of the PNML. learner and its generalization error (the regret) for a single layer NN. We analyze the derived regret and show it obtains low values when the test input either (i) lies in a subspace spanned by the eigenvectors associated with the large eigenvalues of the training data empirical correlation matrix or (ii) is located far from the decision boundary. Crucially, although our analysis focuses on single layer NN, our results are applicable to the last layer of DNNs without changing the network architecture or the training process: We treat the pretrained DNN as feature extractor with the last layer as single layer NN classifier. We can therefore show the usage of the pNML regret as a confidence score for the OOD detection task.
To summarize, we make the following contributions.
1. Analytical derivation of the pNML regret. We derive an analytical expression of the pNML regret, which is associated with the generalization error, for a single layer NN.
2. Analyzing the PNML regret. We explore the pNML regret characteristics as a function of the test sample data, training data, and the corresponding ERM prediction. We provide visualization on low dimensional data and demonstrate the situations in which the pNML regret is low and the prediction can be trusted.
3. DNN adaptation. We propose an adaptation of the derived pNML. regret to any pretrained DNN that uses the softmax function with neither additional parameters nor extra data.
Applying our pNML regret a pretrained DNN does not require additional data, it is efficient and can be easily implemented. The derived regret is theoretically justified for OOD detection since it is the individual setting solution for which we do not require any knowledge on the test input distribution. Our evaluation includes 74 IND-OOD detection benchmarks using DenseNet-BBC-100, ResNet-34, and WideResNet-400 trained with CIFAR- 100, CIFAR- 10, SVHN, and ImageNet-30. Our approach outperforms leading methods in nearly all 74 OOD detection benchmarks up to a remarkable + +15.2%
2
Related work
OOD detection. Many recent work use additional OOD set in training (Malinin and Gales 2018
Hendrycks et al. 2019a| Nandy et al. 2020 Mohseni et al., 2020). A well-known method for OOD detection, named ODIN (Liang et al. 2018), manipulates the input image based on the gradient of the loss function. This input manipulation increases the margin between the maximum probability of images with known classes and images with unknown objects. However, the manipulation strength defined by OOD data which might be unavailable or different from the OOD samples in inference.

---

Different approaches propose to manipulate the loss function in the training phase. Lee et al. (0118) proposed to use the Mahalanobis distance between the test input representations and the class conditional distribution in the intermediate layers to train a logistic regression classifier to determine if the input sample is OOD. The Energy method (Liu et al. 2020) adds a cost function to the training phase to shape the energy surface explicitly for OOD detection. [Papadopoulos et al. (2021) suggested the outlier exposure with confidence control (OECC) method in which a regularization term is added to the loss function such that the model produces a uniform distribution for OOD samples.
All mentioned methods require manipulating the DNN architecture or adding additional data. The Baseline method (Hendrycks and Gimpel (017) is one of the earliest approaches designed to identify whether test input is IND and does not require changing the pretrained model. This method uses the maximum probability of the DNN output as the OOD score. The Gram method (Sastry and Oore, 2020) detects OODs based on feature representations obtained in intermediate layers. Given a test sample, the Gram matrices of the test sample features are compared with those of the training samples known to belong to the estimated class of the test sample. However, this method requires IND validation set and does not have theoretical motivation.
Other work suggested using Bayesian techniques to estimate the prediction confidence (Gal and
Ghahramani 2016; Lakshminarayanall et al. 2017: van Amersfoort el al., 2020). However, the Bayesian techniques add extensive compute overhead the prediction.
The pNML learner. The pNML. learner is the min-max solution of the supervised batch learning in the individual setting (Fogel and Feder] 2018). For sequential prediction it is termed the conditional normalized maximum likelihood (Rissanen and Roos 2007 Roos and Rissanen 2008).
Several methods deal with obtaining the pNML learner for different hypothesis sets, Bibas et al. (2019b) and Bibas and Feder (202T) showed the pNML solution for linear regression. Rosas et al. (2020) proposed an NML based decision strategy for supervised classification problems and showed attains heuristic PAC learning. Fu and Levine (202T) used the pNML for model optimization based on learning density function by discretizing the space and fitting a distinct model for each value.
For the DNN hypothesis set, Bibas et al. (2019)) estimated the PNML. distribution with DNN by fine-tuning the last layers of the network for every test input and label combination. This approach computationally expensive since training needed for every test input. Zhou and Levine (2020) suggested a way to accelerate the pNML computation in DNN by using approximate Bayesian inference techniques to produce tractable approximation the pNML. Pesso al. (202I) used the pNML with adversarial target attack as a defense mechanism against adversarial perturbation.
3 Notation and preliminaries
In the supervised machine learning scenario, a training set consisting of N pairs of examples is given
DN {II, Ww) 2n E X' yh. V,
(I)
where v,, is the n-th data instance and yn its corresponding label. The goal of learner to predict the unknown test label y given a new test data by assigning probability distribution g(-[x: to the unknown label. The performance is evaluated using the log-loss function
E(g: y) = log (z)
(2)
For the problem to be well-posed, we must make further assumptions on the class of possible models or hypothesis set that is used to find the relation between x and y. Denote @ as general index set, this class is set of conditional probability distributions
Pe = (po(y)z), 0 E θ).
The ERM is the learner from the hypothesis set that attains the minimal log-loss on the training set.
The individual setting, An additional assumption required to solve the problem is related to how the data and the labels are generated. In this work we consider the individual setting (Merhay and Feder, 1998. Fogel and Feder 2018 Bibas et al. 2019b a). where the data and labels, both in the training and test, are specific individual quantities: We do not assume any probabilistic relationship between them, the labels may even be assigned in an adversarial manner.
3

---

The genie. In the individual setting the goal is to compete with a reference learner, genie, that has following properties: (i) knows the test label value, (ii) is restricted use model from the given hypotheses set Pe. and (iii) does not know which of the samples is the test. This reference learner then chooses model that attains the minimum loss over the training set and the test sample
N
0(DN; arg min (po; I, y) BeB
é (po: Fnn Vin Ua)
(4)
7=1
The regret is the log-loss difference between a learner q and this genie:
log ((v) x:) - [ log Po PacDamm (ulzc)
R(g: DN: v)
(5)
Theorem (Fogel and Feder (2018)) The universal learner, denoted the pNML, minimizes the regret for the worst case test label
r RD x)
min max R(g: Dx; NEy
(6)
The PNML probability assignment and regret are
Po(Dwia.y) (y|z)
Queaes. (u|z) Evey Po(D
T= log
Σ V'Ey
ParDwwar (1/a))
Proof. The regret is equal for all choices of y. we consider a different probability assignment, should assign smaller probability for at least one of the outcomes. If the true label is one of those outcomes will lead to a higher regret. For more information see Fogel and Feder (2018).
L
The PNML regret is associated with the model complexity (Zhang 2012). This complexity measure formalizes the intuition that model that fits almost every data pattern very well would be much more complex than model that provides relatively good fit to small set of data. Thus, the pNML incorporates a trade-off between goodness of fit and model complexity as measured by the regret.
Online update of a neural network. Let X and YN be the data and label matrices N training points respectively
X = [a]
32
]N E NXM YN = [yn
uN] R NXC.
(8)
such that the number of input features and model outputs are M and respectively. Denote X as the Moore-Penne Peorose inverse of the data matrix
x = [( Rank(x] = M
(X
otherwise,
S(-) and f-)()) as the activation and inverse activation functions, and 0 MC as the learnable parameters. The ERM, that minimizes the training set mean squared error (MSE), is
0 = X (YYw) = arg min - f(Xx0)
(10)
Recently, Zhuang et al. 2020) suggested a recursive formulation of the DNN weights. Using their scheme only training sample is processed at time: Denote the projection of sample onto the orthogonal subspace of the training set correlation matrix as
I (I Xx) x
(1I)
the update rule when receiving new training sample with data with label y
((DN:z,))) 0N ( (f) TTN). g A 1 T 11
* 0 x, #1 = 0 (12)
X
In their paper, Zhuang et al. 2020 applied this formulation for DNN, layer by layer.

---

The pNML for a single layer NN
Intuitively, the pNML as stated in 7 can be described as follows: To assign a probability for potential outcome, (i) add it to the training set with an arbitrary label, (ii) find the best-suited model, and (iii) take the probability it gives the assumed label. Follow this procedure for every label and normalize to get a valid probability assignment. Use the log normalization factor as the confidence measure. This method can extended any general learning procedure that generates a prediction based on training set. One such method is a single layer NN.
single layer NN maps input E RRMx using the softmax function a probability vector which represents the probability assignment to one of C classes
6..x
po(i)z) = f(x O); En
iE (1....,C.
(13)
To align with the recursive formulation of (22.. . the label y is one-hot vector with C elements and represented by row vector in the standard base { (the i-th element is and all others are 0), stands for the true test label such that e is the one-hot vector of the true label. Also, the learnable
parameters [0:]r=1 are the columns of the parameter matrix of (1)..
We would like that the probability assignment of the true label to be 1. We define the following MSE minimization objective
min BEE
(1 yn (0 xr)))²
(14)
Minimizing this MSE objective is equivalent to constrain the genie to the following Gaussian family
1 exp
{
1 2x (ee (u f(x s(x (1)]))))]] 0 &RMxCC }
Po po(u)
(15)
V2TO2
and minimizing the log loss with respect to More details are appendix A The inverse of the activation function is
f-1 (pe (ilz)) In (ilx) In
(16)
To compute the genie, we assume that the label of the test sample is known and add it to the training set. We fit the model by optimizing the learnable parameters to minimize the loss of this new set.
Lemma 1. Given test data a with label = Ec. the genie prediction of the true label is
Po(Dwss.yee.) (c(x) =
Pe.
(17)
Pe + Pa.
TT
(1-pe)*
(1-
where Pe is the probability assignment of the ERM model of the label c, and is defined in (12
Proof. Using 12 the probability assignment of the genie can be written as follows.
@(Driwwzo
[0o+o(=-0Taa)
Po. (cxx= E oJ + ((DDNwEee. DS oJ eT + e Acto(s- m)
(18)
The genie knows the true test label e,. The inverse activation function can be written where S A Eg oJ The simplified numerator is
In S
0 " a(=-000 = eT Se o. Spa"" xx 'pe-
(19)
Substituting to (18) and divide the numerator and denominator by S provides the result.
The true test label is not available to legit learner. Therefore, in the PNML process, every possible label taken into account. The PNML regret is the logarithm of the sum of models' prediction, each one trained with a different test label value.
5

---

Theorem 2. Denote ps as the ERM prediction of label i, the pNML regret of single layer NN is
Pj 9 $(1 ps) Ps
r= log 2m P:
(20)
Proof. The normalization factor is the sum of the probabilities assignment of models that were trained with a specific value of the test sample K = > Pá Po(Dwsx.y=ej) (i]z). Using Theorem the log normalization factor is the pNML regret. With lemma 1 we get the explicit expression.
The PNML probability assignment of label i {L...., CJ is the probability assignment of model that was trained with that label divided by the normalization factor 9pvmz. (ilx) k Pa (nwy) (y/z).
Let um and hm be the m-th eigenvector and eigenvalue of the training set data matrix X such that for r = 0, the quantity x² is
N Em=1 hi (x (mm)
F
x
(21)
1+
x 1+ Di=1 mz (x (uTum) um
We make the following remarks.
1. If the test sample lies in the subspace spanned by the eigenvectors with large eigenvalues, x g is small and the corresponding regret is low T I log Σ Ps 0. In this case, the pNML prediction is similar to the genie and can be trusted.
2. Test input that resides is in the subspace that corresponds to the small eigenvalues produces
x' TTy y = and large regret is obtained lim, g->1 P log Σ 1
2-p? The prediction for
this test sample cannot be trusted. In section 5 we show that in this situation the test sample can be classified as an OOD sample.
3. As the training set size (N) increases x' becomes smaller and the regret decreases.
4. If the test sample is far from the decision boundary, the ERM assigns to one of the labels probability 1. In this case, the regret 0 matter in which subspace the test vector lies.
4.1 The pNML. regret characteristies using a low-dimensional dataset
We demonstrate the characteristics of the derived regret and show in what situations the prediction of the test sample can be trusted. To visualize the pNML regret on low-dimensional dataset, we use the Iris flower data set (Fisher, 1936). We utilize two classes and two features and name them C2. and feature 1, feature respectively.
Figure shows the ERM probability assignment of class 02 for a single layer NN that was fitted to the training data, which are marked in red. At the top left and bottom right, the model predicts with high probability that a sample from these areas belongs to class e₁ and 02 respectively.
Figure Tb presents the analytical PNML regret. At the upper left and lower right, the regret is low: Although there are no training samples there, these regions are far from the decision boundary, adding one sample would not alter the probability assignment significantly, thus the pNML prediction is close to the genie. At the top right and bottom left, there are no training points therefore the regret is relatively high and the confidence in the prediction is low. In section S we show that these test samples, which are associated with high regret, can be classified as OOD samples.
In addition, we visualize the regret for overlapping classes. In figure Ic the ERM probability assignment for inseparable class split is shown. The ERM probability lower than 0.7 for all test feature values. Figure ld presents the corresponding PNML regret. The PNML regret is small in the training data surroundings (including the mixed label area). The regret large in areas where the training data is absent, in the figure edges.

---

4.00
Training
4.00
0.04
X
Training C2
0.80
0.03
Feature
3.50
0.60
P x
Feature
3.50
0.02
Regret
0..01
3.00
0.40
3.00
2.50
0.20
2.50
2.00
Feature
Feature
(a) ERM probability for the separable split
(b) PNML regret for the separable split
5.00
0.60
5.00
0.04
Feature 2
4.00
0.50
Feature 2
4.00
0.03
Regret
PERM
3.00
0,40
3.00
0.01
2.00
0.30
1.00
1.00
8
8
Feature
Feature 1
(c) ERM probability for the inseparable split
(d) pNML regret for the inseparable split
Figure 1: A single layer NN fitted to low dimensional data (the Iris flower set (Fisher 1936)). (a) and (c) show the ERM probability assignment class c2 for separable split and inseparable split respectively. The derived pNML regret for the separable split is shown in (b) and for the inseparable split is shown in (d). The training data class Ci and 0g are marked with red circles and red crosses respectively. Low regret is associated with the training data surroundings. See section
4.2 Deep neural network adaptation
In previous sections, we derived the pNML for single layer NN. We next show that our derivations can, in fact, be applied any pretrained NN, without requiring additional parameters or extra data.
First extract the embeddings of the training set: Denote <b.) as the embedding creation (feature extraction) using a pretrained ERM model, propagate the training samples through the DNN up the last layer and compute the inverse of the data matrix of x (XNN)++_ Then, given a specific test example x, extract its embedding ((z) and its ERM probability assignment J Finally calculate the regret as described in Theorem usiig the training set and test embedding vectors.
We empirically found that norms of OOD embeddings are lower than those of IND samples. The regret depends on the norm of the test sample: For < a < b, the regret of az is lower than the regret of bx. Hence, normalize all embeddings (training, IND, and OOD) have L norms equal to 1.0.
Samples with a high regret value are considered samples with a large distance from the genie, the learner that knows the true label, and therefore the prediction cannot be trusted. Our proposed method utilizes this regret value to determine whether a test data item represents a known or an unknown.
5 Application to out-of-distribution detection
We rigorously test the effectiveness of the pNML regret for OOD detection The motivation for using the individual setting and the pNML as its solution for OOD detection is that in the individual setting there no assumption on the way the data generated. The absence of assumption means that the result holds for wide range of scenarios (PAC, stochastic, and even adversary) and specifically to OOD detection, where the OOD samples are drawn from an unknown distribution.
'Code available in httpps///ggthtll..c////ybbbbbb/p

---

Table 1: OOD detection for DenseNet-BC- model, comparing our pNML-based approach to leading methods. Results reported using AUROC show our method enhances previous work to 69.4%, 49.4%, 3.1%, 1%, and 2.2%. See section 5.2 for more details.
IND
OOD
Basclinc/+pNML
ODIN/+NNML
Gram/+pNML
OECC/+pNML
iSUN
69.7 / /9.4 96,4
84.5 / 96.7
99.0/
99.2/99.5
LSUN (R)
70.8 96.6
86.0 96.9
99.3/ 99.7
99.4 99.6
LSUN (C)
80.1 93.1
91.5 /9.1
91.4/ 94.5
93.9 96.1
Imagenet (R)
71.6 97.4
85.5 / 97.6
99.0/ 99.5
99.0/ 99.5
CIFAR-100
Imagenet (C)
76.2 95.7
88.8 / 96.0
97.7 98.7
98.2 99.0
Uniform
/ 100
83.7 100
100 / 100
99.9/ 100
Gaussian
30.6 100
50.6 100
100 / 100
100 100
SVHN
82.6/ 96.2
92.5 96.2
97.3 98.4
97.0 97.5
iSUN
94.8 98.7
98.9
99.8 100
99.9/
LSUN (R)
95.5 98.9
99.2 / 99.2
99.9/ 100
99.9/ 100
LSUN (C)
93.0/96.4
95.8 / 96.4
97.5 98.7
98.9 99.9
Imagenct (R)
94.1 98.8
98.5 / 99.0
99.7 99.9
99.8 / 99.9
CIFAR-10
Imagenct
93.8 97.7
97.6 97.9
99.3 99.7
99.9
Uniform
96.6 100
100 100
100 100
100 100
Gaussian
97.6/ 100
100 100
100 100
100 100
SVHN
89.9 98.4
94.6/ 98.7
99.1 / 99.6
99.6/ 100
iSUN
94.4 98.7
92.8 / 99.1
99.8 99.9
100 100
LSUN (R)
94.1 98.4
92.5 / 98.9
99.8 100
100 100
LSUN (C)
92.9 98.0
88.6 98.1
98.6 99.4
99.8 100
Imagenet (R)
94.8 98.6
93.3 99.0
99.7 99.9
100
SVHN
Imagenet (C)
94.6 98.6
92.8 / 98.8
99.4 99.8
100 100
Uniform
93.2 99.8
91.6/ 100
99.9 100
100 100
Gaussian
97.4 99.8
98.9 99.9
100 100
100 100
CIFAR-10
91.8 96.7
88.9 97.8
95.4
99.5 / 100
CIFAR-100
91.4 / 96.7
88.2 97.8
96.4 98.0
99.6/ 100
5.1 Experimental setup
We follow the standard experimental setup (Liu et al. 2020 2018). All the assets we used are open-sourced with either Apache-2.0 License or Attribution- NonCommercial 4.0 International licenses. We ran all experiments on NVIDIA K80 GPU.
Sastry and Oore 2020 Lee et al.
CIFAR-IO0 CIFAR-10 Krizhevssy et al. 2014) and SVHN (Netzer et al. 2011). These sets contain RGB images with 32x32 pixels. In addition, to evaluate higher resolution images,
IND sets. For datasets that represent known classes,
ImageNet-30 set (Hendrycks al. 2019b).
OOD sets. The OOD are represented by TinylmageNet (Liang al. 2018), LSUN Yuu et al. 2013). iSUN (Xu et al. 2015). Uniform noise images, and Gaussian noise images. We use two variants of TinyImageNet and LSUN sets: 32x32 image crop that is represented by "(C)" and resizing of the images to 32x32 pixels that termed by "(R)". We also used CIFAR- 100, CIFAR- 10, and SVHN OOD for models that were not trained with them.
Evaluation methodology. We benchmark our approach by adopting the following metrics (Sastyy and Oore 2020 Lee et al. 2018): (i) AUROC: The area under the receiver operating characteristic curve threshold-based detector. perfect detector corresponds to an AUROC score 100%. (ii) TNR at 95% TPR: The probability that OOD sample is correctly identified (classified negative) when the true positive rate equals 95%. (iii) Detection accuracy: Measures the maximum possible classification accuracy over all possible thresholds.
5.2 Results
We build upon the existing leading methods: Baseline (Hendrycks and Gimpel| 2017 7 ODIN (Liang al. 2018), Gram (Sastry and Oore 2020), OECC (Papadopoulos |
(021), ), and Energy (Lm 2020). We use the following pretrained models: ResNet-34 (He et al. (016). Be.
al.

---

Table comparison our pNML regret based detection to leading methods for ResNet-34 model. Results measured by the AUROC metric show that our technique offers significant improvements over previous work up to 41.5% 11.9%, 2.4%, and %. See section 5.2 for more details.
IND
OOD
Baselinc/+pNML ODIN/+NNML
Gram/+pNML
OECC/+pNML
iSUN
75.7 83.0
85.6 87.6
98.8/ 99.1
99.0/99,
LSUN (R)
75.6 83.8
85.4 88.0
99.2/ 99.4
99.3 / 99.6
LSUN (C)
75.5 83.1
82.6 88.1
9 94.6
95.7 97.8
Imagenet (R)
77.1 84,4
87.7 / 88.5
98.9 99.2
98.7 98.9
CIFAR-100
Imagenet (C)
79.6 85.8
85.6 88.6
97.7 98,4
97.9 98.1
Uniform
8 98.1
99.0 99.4
100 100
100 100
Gaussian
45.0 86.5
83.8 95.7
100 100
100 100
SVHN
79.3 90.9
94.0 95.4
96.0 97.9
97.0/ 97.6
iSUN
91.0/ 96.4
99.8 100
99.9 99.9
LSUN (R)
91.1 96.6
94.1 97.7
99.9/ 100
100 / 99.9
LSUN (C)
91.8 / 95,4
93.6/95.6
97.9/ 99.1
99.1 99.5
Imagenct (R)
91.0 95.4
93.9 96.6
99.7 99.9
99.9 99.9
CIFAR-10
Imagenct
/ 95.4
93.3 96.2
99.3 99.7
99.7 99.8
Uniform
96.1 99.8
99.9/ 100
100 100
100 100
Gaussian
97.5/ 100
100 100
100 100
100 100
SVHN
89.9/95.1
/ 97.9
/9.5/99.8
99.8 99.8
iSUN
97.1
91.4 98.0
99.8 1 99.9
100 100
LSUN (R)
91.5 96.7
90.6 97.7
99.8 100
100 100
LSUN (C)
92.8 97.0
92.3 97.1
9 99.6
99.7 99.9
Imagenet (R)
93.5 97.5
92.8 / 98.3
99.8 99.9
100 100
SVHN
Imagenet (C)
94.2/ 97..5
93.7 / 98.2
99.5 99.9
99.9 / 100
Uniform
96.0/985.
95.5 / 99.5
100 100
100 100
Gaussian
96.1/981
96.1 99.6
100 100
100 100
CIFAR-I0
93.0 97.4
92.0 98.0
97.4/ 99.3
99.4 99.8
CIFAR-100
92.5 / 97.1
91.7 97.8
97.5 99.2
99.4 99.8
100 (Huang et al., 2017) and WideResNet-40 (Zagoruyko and Komodakis 2016). Training was performed using CIFAR-I00 CIFAR-I0 and SVHN, each training set used separately to provide complete picture of our proposed method's capabilities. Notice that ODIN, OECC, and Energy methods use OOD sets during training and the Gram method requires IND validation samples.
Table and Table 2 show the AUROC of different OOD sets for DenseNet and ResNet models respectively. Our approach improves all the compared methods in nearly all combinations of IND- OOD sets. The largest AUROC gain over the current state-of-the-an is of CIFAR- as IND and I.SUN (C) OOD): For the DenseNet model, we improve Gram and OECC method by 3.1% and 2.2% respectively. For the ResNet model, we improve this combination by 2.4% and 2.1% respectively. The additional metrics (TNR 95% FPR and detection accuracy) are shown in appendix
The Baseline method uses a pretrained ERM model with no extra data. Combining the PNML regret with the standard ERM model as shown in the Baseline+NNML column surpasses Baseline by up to 69.4% and 41.5% for DensNet and ResNet, respectively. Also, Baseline+pNMLL is comparable to the more sophisticated methods: Although it lacks tunable parameters and does not extra data, Baseline+pNMLL outperforms ODIN most DenseNet IND-OOD set combinations.
Table the results of the Energy method and our method when combined with the pretrained Energy model (Energy+pNMLL with WideResNet-40 model on CIFAR 100 and CIFAR-10 10 as IND sets. Evidently, method improves the AUROC of the OOD detection task in 14 out of 16 IND- OOD combinations. The most significant improvement is in CIFAR- 100 as IND and ImageNet (R) and iSUN as the OOD sets. In these sets, improve the AUROC by 15.6% and 15.2% respectively, For TNR at TPR 95%, the pNML regret enhances the CIFAR-100 and Gaussian combination by 90.4% and achieves perfect separation of IND-OOD samples.
For high resolution images, we use Resnet-18 utilize the ImageNet-30 training set for computing Φ(X,, XN +xxxx) All images were resized to 254 x 254 pixels. We compare result the Baseline method Table The table shows that the pNML outperforms Bascline by up to 9.8% and 8.23% for ResNet- 18 and ResNet- 101 respectively.
ResNet-101 models trained on ImageNet. We

---

Table 3: OOD detection for WideResNet-40 model. Results show our method improves the En-
ergy (Liu et al. 2020) method up to 15.6%. 90.4%, and 15.9% for AUROC, TNR at TPR 95%, and Detection accuracy respectively. See section 5.2 for more details.
IND
OOD
AUROC
TNR at TPR 95%
Detection Acc.
Energy/+pNML
ISUN
78.4 93.6
30.7 / 62.5
71.1 / 87.0
LSUN (R)
80.3 94.1 94.1
31.2 / 65.5
73.1 87.5
LSUN (C)
9
80.0 / 79.3
89.3 89.1
Imagenet (R)
71.4/87.0
22.1 /
66.1 79.9
CIFAR-100
Imagenet (C)
/
36.9 / 49.4
72.8 79.7
Uniform
97.9/99.8
95.2 / 100
95.8 / 99.6
Gaussian
92.0/99.8
9.6/ 100
92.3 99.8
SVHN
96.5
79.2/ 82.8
90.5/
iSUN
/
98.3 98.7
96.7 /9.00
LSUN (R)
99.3 99.5
98.6
97.0 99..3
LSUN (C)
99.4/999 99.5
98.6 / 98.6
97.0 97.1
Imagenet (R)
98.1 / 98.1
92.0 / 92.4
94.0/ / 94.0
CIFAR-10
Imagenet
98.6 98.6
94.4 / 94.6
94.9 / 94,9
Uniform
99.0 99.9
100 100
98.7 99.8
Gaussian
99.1/99.9 99.9
100 100
98.7 / 99.8
SVHN 99.3/99.6
98.3 / 98.9
96.9 97.6
Table 4: OOD detection with ImageNet- as the IND set. Results show that the pNML outperforms
the Baseline (Hendrycks and Gimpel 2017) method up to 9.8% and 8.23% for ResNet-18 and ResNet- 101 models respectively. See section 5.2 for more details.
IND
OOD
ResNet-18
ReseNct- 101
Baseline/+pNML
Baseline/+pNML.
iSUN
95.58 99.74
96.26 / 99.54
LSUN (R)
95.51 99.72
95.77 / 99.43
LSUN (C)
96.89 / 99.77
98.00 / 99.86
Uniform
99.35 99.99
98.70 100
ImageNet-30
Gaussian
98.78 100
98.61 100
SVHN
99.18 99.99
98.94 99.98
CIFAR 10
89.99 / 99.79
91.24 99.47
CIFAR- 100
92.15 / 92.15
93.39 99.58
6 Conclusions
We derived the analytical expression of the pNML regret for single layer NN. We showed that the model generalizes well when the test data resides in either a subspace spanned by the eigenvectors associated with the large eigenvalues of the training data correlation matrix or far from the decision boundary. We showed how to apply the pNML for any pretrained DNN that uses the softmax layer with neither additional parameters nor extra data. We demonstrated the effectiveness our pNML regret-based approach on 74 IND-OOD detection benchmarks. Compared with the recent state of the art methods, our approach elevates absolute AUROC values by up 15.6%
For future work, in our regret derivation we constrained the genie hypothesis set to the Gaussian family and a single layer NN. We would like to extend the derivation larger hypothesis and more layers, believing it would improve performance. Furthermore, the pNML regret can be used for additional tasks such active learning, probability calibration, and adversarial attack detection.
Societal impacts. The negative social impact of this work depends on the application. For instance, in surveillance camera scenario, person from minority group can be flagged as OOD if the minority group was not included in the training set. We recommend that when OOD flagged human will intervene rather than algorithmic response since the nature of the OOD is unknown.
10

---

References
Bartlett, P. L.., Foster, D. J., and Telgarsky, M. (2017). Spectrally margin bounds for neural networks. In Neural Inform. Process. Syst., pages 6240 6249..
Belkin, M., Hsu, D., Ma, S., and Mandal, (2019). Reconeiling modern machine-learinng practice and the classical tlas-variance trade-off. Proceedings of the National Academy of Sciences, 116632):18449-1854
Bibas, K. and Feder, M. (2021). The predictive normalized maximum likelihood for over- parameterized linear regression with norm constraint: Regret and double descent. arXiv preprint arXiv:2102.07181.
Bibas, K., Fogel, Y., and Feder, M. (2019a). Deep pnml: Predictive normalized maximum likelihood for deep neural networks. arXiv preprint arXiv: 12286.
Bibas, K., Fogel. Y., and Feder, M. (2019b). A new look at an old problem: A universal learning approach linear regression. Int. Symp. on Information Theory.
Bibas, K., Weiss-Dicker, G., Cohen, D., Cahan, N., and Greenspan, H. (2021). Learning rotation
invariant features for cryogenic electron microscopy image reconstruction. In International Symposium on Biomedical Imaging (ISBI), pages 563-566. IEEE.
Fisher, R. A. (1936). The use of multiple measurements in taxonomic problems. Annals of eugenics, 1(2):179-188
Fogel, Y. and Feder, M. (2018). Universal batch learning with log-loss. In Int. Symp. on Information Theory, pages 21-25, IEEE.
Fu, J. and Levine, S. (2021). Offline model-based optimization via normalized maximum likelihood estimation. In Int. Conf. on Learning Representations.
Gal, and Ghahramani, Z. (2016). Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In Int. Conf. Mach. Learning.
He, K., Zhang, X., Ren, S., and Sun, J. (2016). Deep residual learning for image recognition. In Proc. Conf. Comput. Vision Pattern Recognition, pages 770-778.
Hendrycks, D. and Gimpel, K. (2017). A bascline for detecting misclassified and out-of-distribution examples in neural networks. Int. Conf. on Learning Representations.
Hendrycks, D., Mazeika, M., and Dietterich, T. G. (2019a). Deep anomaly detection with outlier exposure. Int. Conf. on Learning Representations.
Hendrycks, D., Mazeika, M., Kadavath, S., and Song, D. (2019b). Using self supeevupe learning can improve model robustness and uncertainty. In Neural Inform. Process. Syst.
Huang, G., Liu, Z., van der Maaten, L., and Weinberger, K. Q. (2017). Densely connected convolu- tional networks. In Proc. Conf. Compul. Vision Pattern Recognition.
Jiang, Y., Neyshabur, B., Mobahi, H., Krishnan, D., and Bengio, S. (2020). Fantastic generalization measures and where to find them. In Int. Conf. on Learning Representations.
Kaufman, D., Bibas, K., Borenstein, E., Chertok, M., and Hassner, T. (2019). Balancing specialization, generalization, and compression for detection and tracking. In Proc. British Mach. Vision Conf.
Krizhevsky, A., Nair, V., and Hinton, G. (2014). The cifar- 10 dataset. online: http://www. cs. toronto. edukrrizcifar. html."
Lakshminarayanan, B., Pritzel, A., and Blundell, C. (2017). Simple and scalable predictive uncertainty estimation using deep ensembles. In Neural Inform. Process. Syst.
Lee, K., Lee, K., Lee, H., and Shin, (2018). A simple unified framework for detecting out-of- distribution samples and adversarial attacks. In Neural Inform. Process. Syst.
11

---

Liang, S., Li, Y., and Srikant, R. (2018). Enhancing the reliability of out-of-distribution image detection neural networks. Int. Conf. on Learning Representations.
Liu, W., Wang, X., Owens, J. and Li, Y. (2020). Energy-based out-of-distribution detection. Advances in Neural Information Processing Systems.
Malinin, A. and Gales, M. J. F. (2018), Predictive uncertainty estimation via prior networks. In Neural Inform. Process. Syst.
Merhav, N. and Feder, M. (1998). Universal prediction. Trans. on Inform. Theory, 44(6):2124-21 21477
Mohseni, S., Pitale, M., Yadawa, J. B. S., and Wang, Z. (2020). Self-supervised learning for generalizable out-of-distribution detection. In AAAI Conf. on Artificial Intelligence.
Nandy, J., Hsu, W., and Lee, M. (2020). Towards maximizing the representation gap between in-domain & out-of-distribution examples. In Neural Inform. Process. Syst.
Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., and Ng, A. Y. (2011). Reading digits in natural images with unsupervised feature learning. In Neural Inform. Process. Syst. Workshops, page 5.
Neyshabur, B., Bhojanapalli, S., and Srebro, N. (2018). A pac-bayesian approach to spectrally- normalized margin bounds for neural networks. In Iut. Conf. on Learning Representations.
Papadopoulos, A.-A., Rajati, M. R., Shaikh, N., and Wang. (2021). Outlier exposure with confidence control for out-of-distribution detection. Neurocomputing.
Pesso, U., Bibas, K., and Feder, M. (2021). Utilizing adversarial targeted attacks to boost adversarial robustness.
Rissanen, J. and Roos, Т. (2007). Conditional nml universal models. In 2007 Information Theory and Applications Workshop, pages 337-341. IEEE
Roos, and Rissanen, J. (2008). On sequentially normalized maximum likelihood models. Compare, 27(31):256.
Rosas, F. E., Mediano, P. A., and Gastpar, M. (2020). Learning, compression, and leakage: Minimizing classification error via meta-universal compression principles. arXiv preprint arXiv:2010.07388.
Sastry, C. and Oore, (2020). Detecting dut-o--distribution examples with Gram matrices. Int. Conf. Mach. Learning.
Singh, A., Sengupta, S., Rasheed, M. A.. Jayakumar, V., and Lakshminarayanan, V. (2021). Un- certainty aware and explainable diagnosis of retinal disease. In Medical Imaging 2021: Imaging Informatics for Healthcare, Research, and Applications.
van Amersfoort, J., Smith, I.,, Teh, Y. W., and Gal, Y. (2020). Uncertainty estimation using a single deep deterministic neural network. In Int. Conf. Mach. Learning.
Vapnik, V. N. and Chervonenkis, A. Y. (2015). On the uniform convergence of relative frequencies of events to their probabilities. In Measures of complexity, pages 11-30. Springer.
Vyas, A., Jammalamadaka, N., Zhu, X., Das, D., Kaul, B., and Willke, L. (2018). Out-of- distribution detection using ensemble of self supervised leave-out classifiers. In European Conf. Comput. Vision, pages 560-574.
Willers, O., Sudholt, S.. Raafatnia, S., and Abrecht, S. (2020). Safety concerns and mitigation approaches regarding the use of deep learning in safety-critical perception tasks. In International Conference Computer Safety, Reliability, and Security, pages 336-350. Springer.
Xu, P., Ehinger, K. A., Zhang, Y., Finkelstein, A., Kulkarni, S. R., and Xiao, J. (2015). Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint 067.5
12

---

Yu, F., Zhang, Y., Song, S., Seff, A., and Xiao, J. (2015). Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365.
Zagoruyko, and Komodakis, N. (2016). Wide residual networks. In Proc. British Mach. Vision Conf.
Zhang, J. (2012). Model selection with informative normalized maximum likelihood: Data prior and model prior. In Descriptive and normative approaches to human behavior, pages 303-319. World Scientific.
Zhong. K., Song, Z., Jain, P., Bartlett, and Dhillon, I. S. (2017). Recovery guarantees for one-hidden-layer neural networks. In Int. Conf. Mach. Learning, pages 4140-4149.
Zhou, A. and Levine, S. (2020). Amortized conditional normalized maximum likelihood. arXiv preprint arXiv:201 I. 1.02696.
Zhuang, H., Lin, Z., and Toh, K.-A. (2020). Training a multilayer network with low-memory Gemel-and-rang projection. Journal of the Franklin Institute, 357(1):522-550
13


Reviews:
[{"review_id": "w8CezmNVa6C", "reviewer": "Reviewer_A4Wx", "summary": "The paper analytically derived the pNML regret for the single layer neural network, and apply it to any pre-trained NN by treating the layers as feature extractor and the last layer as a single layer NN for classification. Experimental results show that it can significantly improve the OOD detection performances of pre-trained classifiers.", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is well written, with a good balance between theoretical analysis and experimental evaluation. Although the analysis is a simplified version as it only considers single layer case, but it is good that the same method can be applied to any classifiers by looking at the last layer. The empirical results arecomprehensive and impressive, as it shows significant improvements over different models and datasets.\n\nMy only concern is that, it would be nicer to include experiments on larger dataset instead of only focuses on 32 resolution images. Recently, some paper on OOD detection include results on both small and large images (such as ImageNet-30 dataset, a subset of ImageNet), and this would make the results more convincing. \n\nIn general, I think the paper is theoretically sound and the results are convicing, therefore I vote for accept.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "yes", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "1.5"}, "extra_text": {}}, {"review_id": "uty6XHrJqGS", "reviewer": "Reviewer_t8Jy", "summary": "This paper derives an explicit expression of the predictive normalized maximum likelihood (pNML) learner a single layer neural network probability assignment and regret (Eq. 7). This derived pNML regret expression is applied for the OOD detection task from pre-trained NN models. The authors also connect their pNML framework for single layer NN with soft-max activations and demonstrate that it can be applied for DNN models to obtain consistent improvements for the OOD detection performance.\n\n\n----------------------\nAfter rebuttal:- Overall, I am satisfied with the paper. I am increasing my final score to 7 for the paper.\n\nFew additional comments:- \n\"... more closely related to the domain of adversarial attacks\": \nI am not sure about this comment. Typically adversarial examples deal with minor perturbations. However in this case, I was talking about \"any input sample that is far away from the training distributions\". I think that should be part of out-of-distribution. \n\n\"synthetic dataset\":- Please label Feature 1 and Feature 2 values in the plot.\n\n\n", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Overall, the paper is well-written and the idea of pNML is nicely motivated. I have a few questions and suggestions as follows:\n\n1. Related works:- \n\n[Line 81] Lee et al. (2018) work with pre-trained models. They do not require to retrain their model. Also, there are a number of models that explicitly retrain their OOD detection models using additional OOD training datasets (e.g. [1-4]).\nIn contrast, frameworks such as ODIN, Mahalanobis, etc. do not retrain the model. Instead, they fine-tune/compute some hyper-parameters during inference.\nAlso, some other Bayesian-NN models do not use any additional data [5-7]. Please clearly mention these related works and the differences in Section 2.\n\n\n2. compute the inverse of the data matrix (Line 216):-\n\nIt seems that you need to compute the inverse of the data matrix to obtain the regret score (Eq. 20 and 21). Does it lead to a bottleneck for scalability when the training size becomes very large? Please comment.\n\n\n3. \"If the test sample is far from the decision boundary, the ERM assigns to one of the labels probability 1. In this case, the regret is 0 no matter in which subspace the test vector lies.\" (Line 195-196)\n\nTypically, any input sample that is far away from the training distributions is expected to produce high uncertainty scores and should be detected as OOD. Such data points can be also far away from the decision boundary. For example, see Figure 1 in [7]. However, this seems to be contradicting the idea of OOD. Please comment.\n\n(Continued from the previous question) The analysis shown in Figure 1 is useful to understand the behavior of the proposed framework.\nHowever, according to your claim, as we move top-left or bottom-right, we should never get an OOD data point with high regret. This does not seem to be right. \n\nSo, can you please expand the rectangular space and show the values of the regret as we move far away from the original training data points? \nAlso, can you please also consider an overlapping synthetic dataset and demonstrate the regret scores? (e.g., as in [3] Figure 5).\n\n \n[1] Deep Anomaly Detection with Outlier Exposure, ICLR 2019\n\n[2] Predictive Uncertainty Estimation via Prior Networks, NeurIPS 2018\n\n[3] Towards Maximizing the Representation Gap between In-Domain & Out-of-Distribution Examples, NeurIPS 2020\n\n[4] Self-Supervised Learning for Generalizable Out-of-Distribution Detection, AAAI 2020\n\n[5] Simple and scalable predictive uncertainty estimation using deep ensembles, NeurIPS 2017\n\n[6] Dropout as a bayesian approximation: Representing model uncertainty in deep learning, ICML 2016\n\n[7] Uncertainty Estimation Using a Single Deep Deterministic Neural Network, ICML 2020\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "I did not find any direct limitations and potential negative societal impact of this work.", "review_text": "", "extra_scores": {"ethical_concerns": "N/A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "~10 hours."}, "extra_text": {}}, {"review_id": "caP5zn2s4a", "reviewer": "Reviewer_43yn", "summary": "This paper propose using Predictive Normalized Maximum Likelihood (pNML) as the score for deep OOD prediction. The pMNL score is derived by computing the worst-case regret with respect to a oracle under MSE loss and with the model class constrained to a single-layer NN. Authors tested the effectiveness of pNML score for OOD detection by building it on top of various other works (Baseline, ODIN, Gram, OECC), showing consistent improvement over the baseline approaches.", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Originality & Significance**:\nDecent. The author derived a closed-form expression for pNML regret and empirically illustrated consistent improvement over recent approaches. The proposal appears to be simple and effective, and should be of interest to the NeurIPS community.\n\n**Quality**: The derivation appears to be technically sound. The experiment setup used is standard among the OOD community. \n\n**Clarity** \nThe paper is well structured and clearly written. However, the description of experiment setup can be improved. Specifically, please provide sufficient detail about how pNML is built on top of each methods (e.g., ODIN+pNML, Gram+pNML, etc). Specifically, it is not clear to me how the score for Gram+pNML is generated, since this method does not seems to modify the base architecture. If author is building on Gram method by simply computing pNML score by using the last layer of the architecture used by Gram, should the result be same as Baseline+pNML?\n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes", "review_text": "", "extra_scores": {"ethical_concerns": "N/A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "2"}, "extra_text": {}}, {"review_id": "Xz7gqqOozxv", "reviewer": "Reviewer_fLaK", "summary": "This paper studies out-of-distribution detection with single-layer neural networks. There are theoretical and experimental results - for theoretical contributions the authors derive the analytical form of the NML regret, and for experimental contributions the authors run their method on top of a pre-trained neural network, where they achieve superior performance in out-of-distribution data collection for the CIFAR and SVHN datasets. ", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is overall well written and well-motivated and the contributions are clear. \n\nI have some concerns with the magnitude and significance of the contributions in the paper, but of course these are my own opinions and I would like to hear the authors opinions. The \"single-layer\" neural network discussed in the paper is really just a softmax linear classifier/multi-class logistic regression. In terms of writing, to avoid potential confusion for readers I believe it should just be referred to by a more standard name, such as logistic regression. The application for DNNs also only applies to training the final layer, which reduces the problem to logistic regression since the static network is just a fixed feature transform, in contrast to actually training the entire network. This aspect seems slightly swept under the rug, and maybe deserves more insight into the tradeoffs in the two potential approaches. The theory presented in the paper also seem more suited to be labeled corollaries rather than substantial theoretical contributions - they involve plugging the results derived in one paper (Zhuang et. al 2020) into the definitions for logistic regression and the NML distribution. \n\nThe experimental results seem solid, although I am not familiar with prior work in OOD detection, the metrics used, and what numbers constitute a strong result. Therefore, I will not make a strong claim in this area.\n\nEven though the theoretical results do not hold in this case, have the authors compared fine-tuning the last layer of the neural network with NML, versus training the all layers of the network? This would also be an interesting ablation study because the full neural network would have higher regret due to the more expressive model class, and it would be interesting to see how this plays together with OOD detection. Is a more expressive class better or worse for this task?", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes, the authors discussed several limitations and potential negative societal impacts in the conclusion. ", "review_text": "", "extra_scores": {"ethical_concerns": "N/A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "1"}, "extra_text": {}}, {"review_id": "09rxVFcVTH", "reviewer": "Reviewer_Bp5r", "summary": "This paper generalizes the *predictive normalized maximum likelihood (pNML)* learner to single-layer neural network (linear regression with softmax) and show its application to detect out of distribution test samples for neural networks. The pNML learner can output a regret value (defined with respect to the learner that knows the actual test label) for each testing sample and this regret value is used for classifying the testing samples as out-of-distribution. The proposed method achieves strong empirical performance on image recognition tasks and can be further combined with existing OOD methods. \n\nI find the proposed method to be novel and empirically strong. Therefore, I am leaning toward accepting. I think the authors have done a good job setting up the intuition and explaining the pNML learner. However, I wish the authors had done more analysis for the proposed method when combined with neural network.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros\n\n- the proposed method is novel\n- the proposed method is empirically strong\n- the submission is well-written and clear\n- the proposed method doesn't not introduce high computational overhead unlike methods that require retraining\n- the proposed method does not require additional data\n\nCons/Questions\n\n- Can the authors clarify how pNML is used together with other OOD detection methods in Table 1 and Table 2?\n- Fundamentally the success of this method relies on the quality of the feature extractor. After all, a feature extractor that maps any input into the same output is hopeless for OOD detection. I think the authors should acknowledge this fact in their discussion in section 4.2\n- I wonder if there are more analyses the authors can do to support their empirical evaluation. For example, qualitatively, how is this proposed method different from existing measures such as the Baseline method?", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "I do not see any immediate negative societal impact from this work", "review_text": "", "extra_scores": {"ethical_concerns": "I don't have ethical concerns with this submission", "needs_ethics_review": "No", "ethics_review_area": ["I don’t know"], "time_spent_reviewing": "6"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes to use predictive normalized maximum likelihood (pNML) for detecting out-of-distribution inputs.

Overall, the reviewers found it be a well-written paper. The idea of pNML for OOD detection is novel and the empirical results show consistent improvements over baseline. The authors did a good job of addressing major reviewer concerns. During the discussion phase, the consensus decision learned towards acceptance. I recommend acceptance and encourage the authors to address the remaining comments in the camera ready version.

Other suggestions to improve the final version:
- I'd encourage the authors to evaluate the technique on harder OOD pairs (e.g. https://arxiv.org/abs/2007.05566 define near-OOD pairs such as CIFAR-100 vs CIFAR-10) as it would be interesting to see how the method performs on more difficult benchmarks.
- Section 4: The idea of weighting Eigen directions with large Eigen values seems related to variants of Mahalanobis distance such as marginal Mahalanobis distance https://arxiv.org/abs/2003.00402 and Relative Mahalanobis distance https://arxiv.org/abs/2106.09022 It would be interesting to add a discussion and potentially compare pNML to these methods. 
Decision: Accept (Poster)