Delving into Out-of-Distribution Detection with Vision-Language Representations
Authors: Yifei Ming
Ziyang Cai
Jiuxiang Gu
Yiyou Sun
Wei Li
Yixuan Li
Venue: NeurIPS 2022 Accept (2022)

Abstract: Recognizing out-of-distribution (OOD) samples is critical for machine learning systems deployed in the open world. The vast majority of OOD detection methods are driven by a single modality (e.g., either vision or language), leaving the rich information in multi-modal representations untapped. Inspired by the recent success of vision-language pre-training, this paper enriches the landscape of OOD detection from a single-modal to a multi-modal regime. Particularly, we propose Maximum Concept Matching (MCM), a simple yet effective zero-shot OOD detection method based on aligning visual features with textual concepts.  We contribute in-depth analysis and theoretical insights to understand the effectiveness of MCM. Extensive experiments demonstrate that MCM achieves superior performance on a wide variety of real-world tasks. MCM with vision-language features outperforms a common baseline with pure visual features on a hard OOD task with semantically similar classes by 13.1% (AUROC) Code is available at https://github.com/deeplearning-wisc/MCM. 

Delving into Out-of-Distribution Detection with Vision-Language Representation
Yifei Ming'
Ziyang Cai
Jiuxiang Gu Yiyou Sun
Wei Li Yixuan Li'
*Deparmment of Computer Sciences, University of Wisconsin-Madison
Adobe $Google Research
sharonli] wisc. edu (alvinming, zingnee, mweili@google, com
jiguGadobe. com
Abstract
Recognizing out-of-distribution (OOD) samples is critical for machine learning systems deployed in the open world. The vast majority of OOD detection methods are driven by a single modality (e.g., either vision or language), leaving the rich information in multi-modal representations untapped. Inspired by the recent success lision-language pre-training, this paper enriches the landscape of OOD detection from singlemmoda to multi-modal regime. Particularly, we propose Maximum Concept Matching (MCM), a simple yet effective zero-shot OOD detection method based on aligning visual features with textual concepts. We contribute in-depth analysis and theoretical insights to understand the effectiveness of MCM. Extensive experiments demonstrate that MCM achieves superior performance variety of real-world tasks. MCM with vision-language features outperforms a common baseline with pure visual features hard OOD task with semantically similar classes by 13.1% (AUROC). Code is available at hhtps:t////. //gi thub. com/ wisc/MCM
wide
Introduction
(OOD) detection is critical for deploying machine learning models in the wild, where samples from novel classes can naturally emerge and should be flagged for caution. Despite increasing attention, the vast majority of OOD detection methods are driven by single-modal learn- For example, labels are typically encoded as one-hot vectors image classification, leaving the semantic information encapsulated in texts largely unexploited. OOD detection relying on pure visual information can inherit the limitations, e.g., when an OOD input may visually similar in-distribution (ID) data yet semantically different from any class.
ing 26
95 28
In this paper, we delve into new landscape for OOD detection, departing from the classic single- modal toward multi-modal regime. While the motivation is appealing, core challenge remains: how to effectively utilize joint vision- sssin-language features for OOD detection? In the visual domain, existing methods typically require good feature representations 66 721. and a distance metric under which OOD data points are relatively far away from the in-distribution (ID) data 42 71]. These approaches, however, do not directly translate into the multi-modal regime. On the representation learning side, recent vision-language pre-training schemes such as CLIPP 59 and ALIGN KK have emerged as promising alternatives for visual representation learning. The main idea is to align an image with its corresponding textual description in the feature space. While the resulting representations are powerful, OOD detection based on such aligned multi-modal features is still in its infancy.
We bridge the gap by exploring a distance-basse OOD detection approach, leveraging the joint vision-language representations. Our method capitalizes on the compatibility between visual features and textual features. By defining the textual features as the "concepi prototypes" for each ID class,
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Nn
Nort
ustakgge
Image Encoder
OOD
Xin
71k)
010
7763
011
0:17
Text
MCM
"This is photo of
Encoder
71b
015
6.15
Truck
017
0.16
y
MCM distribution
Figure I: Overview of the proposed zero-shot OOD detection framework. The ID classification task defined by a set class labels Vin The goal OOD detection to detect samples that do not belong to Vin We view the textual embeddings of ID classes (wrapped by text templates) as concept prototypes. The OOD uncertainty an input image can be characterized by the distance from visual features to the closest ID prototype. By properly scaling the distance, the MCM score achieves strong ID-OOD separability. See Section 3 for details.
we characterize OOD uncertainty by the distance from the visual feature to the closest ID prototype. That is, images closer to one of the textual embeddings of ID classes are more likely to be ID and vice versa. By proper scaling of the distance, proposed Maximum Concept Matching (MCM) score achieves strong ID-OOD separability (see Figure mp. MCM stands contrast with the previous distance-basee based approaches, such as Mahalanobis [22 which defines class prototypes based pure visual embeddings. Indeed, we show later Section that MCM (with molti- vision-language features) is far while prior works of CLIP-based OOD detection [ 19 rely on a set candidate OOD labels, MCM is OaD-agnostic and alleviates the need for any prior information about test inputs.
competitive than Mahalanobis (with mogle--mddl visual features). Moreover,
Our work also advances the field by showcasing the promise of zero-shot OOD detection, which offers strong performance and generality without training on the ID samples. In particular, classic OOD detection methods often require training from scratch 27 or fine-tuning [19 32
on a given
ID dataset. In this setting, classifier and its companion OOD detector are good at only one task. Every new task (ID dataset) requires additional training and brings additional computation and storage costs. In contrast, wide variety of real-worke tasks tasks-wiin wwth just one single pre-trained model. This is encouraging given that there is training any OOD information involved. (2) On the challenging ImageNet- Ik benchmark, MCM's s zero-shot OOD detection performance favorably matches and even outperforms strong task task-specific baselines fine-tuned on BiT (32) and ViT models 19 (3) MCM remains robust against hard OOD inputs, including both semantically hard OODs
show for the first time that: (1) MCM achieves superior performance across
3 and spurious OODs (50]
We summarize our main contributions follows:
1. We propose MCM, a simple yet effective OOD detection method based on aligned vision- language features. MCM offers several compelling advantages over other OOD detection methods: generalizable (one model supports many tasks), OOD-agnostic (no information required from OOD data), training-free (no downstream fine-tuning required), and scalable to large real-world tasks.
2. We conduct extensive experiments and show that MCM achieves superior performance a wide range of real-world tasks. On ImageNet- 1k, MCM achieves an average AUROC of 11.49% outperforming methods that require training. Moreover, show that MCM remains competitive under challenging hard OOD evaluation tasks.
3. We provide in-depth empirical and theoretical analysis, providing insights to understand the effectiveness of MCM. We hope that this work will serve as a springboard for future works OOD detection with multi-modal features.

---

2 Preliminaries
Contrastive vision-language pre-training. Compared to visual representation learning models such as ViT [3. vision-language representation learning demonstrates superior performance on image classification tasks. For instance, CLIP [59] adopts a self-supervised contrastive objective (i.e., InfoNCE loss (75l) to align an image with its corresponding textual description in the feature space. Specifically, CLIP adopts a simple dual-stream architecture with one text encoder T : t - R
(e.g., Transformer (77) and one image encoder I : - R (e.g., ViT [ After pre-training dataset of 400 million text-image pairs, the joint vision-language embeddings of CLIP well associate objects in different modalities. Despite the promise, existing CLIP-like models perform zero-shot classification a closed-world setting. That is, it will match an input into a fixed set of categories, even if it is irrelevant (e.g., tree being predicted as bird in Figure D. This motivates work to leverage the multi-modal representation for OOD detection, which is largely unexplored.
Zero-shot OOD detection. Given a pre-trained model, a classification task of interest is defined by set of class labels/names Vin. which we refer to as the known (ID) classes. Here ID classes defined w.t. the classification task of interest, instead of the classes used in pre-training. Accordingly, OOD is defined w.r.f. the ID classes, not the data distribution during pre-training. The goal of OOD detection to (I) detect samples that do not belong to any of the known classes; (2) otherwise, assign test samples to one of the known classes. Therefore, the OOD detector can be viewed as "safeguard" for the classification model. Formally, we denote the OOD detector as a binary function: X' denotes test image. Our method is based only
G(x; Vi T.I): X + (in, out}, where the names of the given classes in Din and a pre-trained model. Different from standard supervised learning, there is training on the IID samples involved, hence zero-shot.
3 OOD Detection via Concept Matching
We illustrate our approach in Figure [ which derives the OOD detector G(-) based on concept matching. For a given task with label set Vin = {yı, uk.. we can construct collection of concept vectors i E {1,2, K}. where &; is the text prompt "this is a photo of (y:)" for a label y:- The concept vectors are represented by the embeddings of the text prompts.
For any test input image x', similarity between the image feature Z(x') and the concept vector T(t:): sx(x') = [[<]]])] Formally, we define the maximum concept matching (MCM) score as:
calculate the label-wise matching score based the cosine
I(x))-((t.)
(x))//
SMCM(x'; T,I) = max
(I)
K Σ (x)("
where 7 is the temperature. For ID data, it will be matched to one of the concept vectors (textual prototypes) with high score; and vice versa. Formally, our OOD detection function can be formulated as:
G(x'; T,I) - {
(x': Pi, T,I)= 2 A SMCM (x'; 3m. T,I) < X
where by convention 1 represents the positive class (ID) and 0 indicates OOD. À is chosen so that high fraction of ID data (e.g., 95%) is above the threshold. For samples that are classified as ID, one can obtain the class prediction based on the closest concept:
argmax,e 8;-
Remark: (1) Our work differs from (and is complementary to) CLIP by focusing on OOD detection rather than Alosed-world) zero-shot classification. We show new theoretical insights that softmax scaling plays unique role in zero-shot OOD detection iim-ovimiooiggge the separability between ID and OOD data. This role has not been studied rigorously for zero-shot OOD detection. Readers familiar with CLIP may notice that MCM can be used for zero-shot classification in the closed world. This also makes MCM practically convenient for dual goals: detect OOD samples and assign ID data to one of the known classes. (2) Our method in principle is not limited to CLIP; it can be generally applicable for contrastive lasion- pre-training models that promote multi-modal feature alignment.
3

---

New insights on softmax scaling for zero-shot OOD detection. We provide theoretical justifi- cations that softmax scaling improves the separability between ID and OOD data for CLIP-based OOD detection, which is contrary to models trained with cross-entropy (CE) loss. In particular, CLIP-like models are trained with multi-modal contrastive loss, which maximizes the cosine similarity between an image and its textual description in the feature space. The resulting cosine similarity scores display strong uniformity across labels, as evidenced in Figure (right). Compared to OOD inputs, the gap between the maximum cosine similarity and the average is larger for ID inputs. However, the gap can be small when the number of ID classes increases where ID samples occur with lower highest cosine similarity. As result, the highest cosine similarity for ID samples and OOD samples can be highly close (c.f. Figure (left)).
Motivated by these observations, MCM em- ploys softmax as post hoc mechanism to magnify the difference. This is fundamentally different from the softmax score derived from a model trained with cross-entropy loss, which inherently maximizes the posterior p(y]x) for the ground-truth label, and minimizes the probability for other labels. Unlike CLIP- like models, logit scores displaying uniformity would be heavily penalized by the CE loss. As the
Maximum Cosine Similarity
ODD Sumples
1311
GOD
bird
frog
X05
dog
Get
antelope
0.28
result, the logit score corresponding ground-truth label can already be significantly higher than other labels. Applying softmax on the logit scores can exacerbate overconfi- dent predictions, and reduce the separability between ID and OOD data [4.]. Indeed, for a model trained with cross-entropy loss, logit-based score such Energy more effective than the softmax score.
Figure Left: Maximum cosine similarity for ID and OOD inputs. There exists overlapping regions (shown in yellow); Right: Cosine similarities between OOD in- puts and ID concept vectors. For OOD inputs, the cosine similarities display uniformity.
48 is shown be much
Interestingly, for CLIP-like models, the trend is the opposite-applyyeeee softmax helps sharpen the uniform-like inner product scores, and increases the separability between ID and OOD data. To help readers better understand the insights, we first formalize our observations that OOD inputs trigger similar cosine similarities across ID concepts (Figure 2
right) as the following assumption:
Assumption 3.1. Let == 1 E }.n Qx denotes the out-of-distribution Px|==0 (marginal distribution of conditioned on = 0). Assume 36 > 0 such that
Qx
Si (x) - s (x)) < =
K
where ğ == a (x() and 022 == argmax (k (x() denote the indices of the largest and second largest cosine similarities for an OOD input x.
Now provide formal guarantees that using softmax can provably reduce the false positive rate (FPR) compared to that without softmax.
Theorem 3.1. Given task with ID label set V {y1, 1/2 ...: yk) ) and a pre-trained CLIP-like
model (T, Z). If Qx satisfies Assumption 3.1 then there exists constant T >(K XX"- such that for any temperature T >> T, we have
KX-1
FPR(T, X) S FPR
where FPR(7, A) is the false positive rate based softmax scaling with temperature and detection threshold X; "O (A is the false positive rate without softmax scaling based on threshold =
'This can be explained both theoretically M4 and empirically 81. It has been shown that self-supervised contrastive learning with smaller temperature (e.g.. initialized 0.07 for CLIP) promotes uniform distribution for nnrmmazllie features. Moreover, as CLIP features on a dimensiisnii space (512 for CLIP-B/16 and 768 for CLIP-L/14), uniformly distributed points in a high- figh-dimensional sphere tend to be equidistant to each other 77).. Therefore, for OOD inputs, we observe approximately uniform cosine similarity with concept vectors.

---

This suggests that applying softmax scaling with a moderate temperature results in superior OOD detection performance compared that without softmax scaling. The proof is in Appendix [ Later in Section 5 we empirically verify on real-world ImageNet dataset that our bound can indeed be satisfied in CLIP where the thresholds are chosen at 95% true positive rate.
What MCM offers: Beyond theoretical insights, would like to highlight several compelling advantages of our zero-shot OOD detection approach, owing to the strong pre-traines CLIP model:
Generalizable to many tasks: Traditional OOD detection methods are based on task-specific model. As a result, the OOD detector is not suitable for realistic online scenario where the task changes from one to another. In contrast, we will show in Section Y that MCM can perform wide variety of OOD detection tasks, with just one single model. For new task, only the names of the task's 's visual concepts Dim are required.
O0D-agnostic: Our method does not rely on any OOD information, and thus suits many real- world scenarios where one cannot anticipate what the unknowns would be ahead of time. This also mitigates the shortcoming of recent approach [99), which assumes that set of unseen labels given as some weak information about OOD data.
Training-free: MCM enables OOD detection in a zero-shot fashion. This stands in contrast to the vast majority of OOD detection literature, which often requires training from scratch fine-tuning to achieve competitive performance.
Scalable: The contrastive vision-language pre-training paradigm makes MCM scalable to large number of class labels and realistic high-resolution images.
We now proceed to the experimental results, demonstrating these advantages on real-world tasks.
4 A Comprehensive Analysis of MCM
4.1 Datasets and Implementation Details
Datasets. Most previous works on OOD detection only focus on small-scale datasets with blurry images such as CIFAR 40) and Tiny ImageNet [1]. With pre-trained models such as CLIP, OOD detection can be extended
realistic and complex datasets. In this work, we scale up evaluations in terms of (1) image resolution, (2) dataset variety, and (3) number of classes. We consider the
following ID datasets: CUB-200 [80 STANFORD- CARS 39. FOOD- 101 ( OXFORD- [57]
and variants of IMAGENET I1I For OOD test datasets, we use the same ones in 32). including
subsets of iNaturalist 76. SUN 166. PLACES 16. and TEXTURE [TO] For each OOD dataset,
the categories are not overlapping with the ID dataset. We also use subsets of ImageNet- 1 for fine-grained analysis. For example, we construct ImageNet-10 that mimics the class distribution of CIFAR-10 but with high-resolution images. For hard OOD evaluation, we curate IetgeNet-20, which consists of 20 classes semantically similar ImageNet- (e.g., dog (ID) vs. wolf (OOD)).
Model. In our experiments, we adopt CLIP (59 as the target pre-trained model, which is one of the most popular and publicly available vision-language models. Note that our method is not limited to CLIP; it can generally be applicable for contrastive vision- Languuel pre-training models that promote multi-modal feature alignment. Specifically, we mainly use CLIP-B/16, which consists of a ViT-B/16 Transformer the image encoder and masked self-attention Transformer [77 as the text encoder. To indicate the input patch size ViT models, we append "/x" to model names. We prepend -B, -L indicate Base and Large versions of the corresponding architecture. For instance, VIT-B/16 implies the Base variant with an input patch resolution of 16 x 16. We also use CLIP-L/14 which is based on ViT-L/14 representative of large models. Unless specified otherwise, the temperature is 1 for all experiments. Details of the datasets, experimental setup, and hyperparameters are provided in Appendix B
For evaluation, we use the following metrics: (1) the false positive rate (FPR95) of OOD samples when the true positive rate in-distribution samples is at 95%, (2) the area under the receiver operating characteristic curve (AUROC), and (3) ID classification accuracy (ID ACC).
Metrics.
5

---

Table 1: Zero-shot OOD detection with MCM score based on CLIP-B/16 with various ID datasets.
OOD Dataset
iNaturalist
Average
FPR95
AUROCT
FPR95.
AUROCI
FPR95,
AUROCT
FPR95
AUROCT
FPR951
AUROC
CUB-200
6.97
Stanford-Cars
0.05
99.77
0.02
99.95
0.24
99.89
0.02
99.90
0.08
99. 89
Food-101
0.64
99.78
0.90
99.75
1,86
99.58
4,04
98.62
1.86
99.43
Oxford-Pet 52
ImageNet-10
0.12
99.80
0.29
99.79
0.88
99.62
0.04
99.99 90
0.33
99.78
ImugeNet-20
1.02
2.55
99.50
4.40
99.11
2,43
99.03
2.60
99.32
ImtageNet-100
18.13
96.77
36,45
94.54
34.52
41.22
92.25
32.58
94.48
Table 2: OOD detection performance for ImageNet- Ik [ ID.
OOD Dataset
Method
INaturalist
SUN
Places
Texture
Averuge
FPR93]
AUROCT
FPR93
AUROCT
FPR93
AUROCT
FPR93
AUROCT
EPR93
AUROCT
Requires training (or w. fine-tuningi
98.
92.01
49.54
89.06
Fort
(VIE-)
15.07
84.77
88
Fost ct sl
10 (VIT-L)
15.74
96.51
52.34
87.32
55.14
86.48
51.38
85 85.54
43.65
88.96
(CLIP-B)
21.59
95.99
34.28
93.15
36.64
91.82
51.18
88.00
35.92
92.26
Energy
(CI.IP.1.)
89
MSP
(CLIP-8)
40.89
88. 63
65.81
81.24
67.90
80.14
64.96
78. 18.16
59.89
82.04
MSP
A5
(CLIP-L)
34.54
92.62
61.18
83.68
39.86
84,10
39.27
82.31
53.71
85.68
Zero-shot (no training required)
MCM (CLIP-B)
30.91
94.61
37.59
92.57
44.69
89.77
57.77
86.11
42.74
90.77
MCM (CLIP-L)
28.38
94.95
29.00
94.14
35.42
92.00
39.88
84.88
38.17
91.49
4.2
Main Results
MCM supports a diverse collection of tasks while being zero-shot. We first show that zero-shot OOD detection with MCM is effective across wide variety of tasks just one single pre-trained model. To showcase the versatility MCM, we consider the seven ID datasets here. To the best of our knowledge, this is among the first attempts to showcase the efficacy under an expansive and diverse collection ID datasets. The zero-shot OOD detection performance is summarized in Table A salient observation is that MCM can achieve superior detection performance on many tasks. For example, using S TTANFORD- CARS as ID, MCM yields an average FPR95 0.08%. Considering that there no training samples OOD information involved, these results very encouraging.
can be also seen from Table ! that MCM is promising, especially when the number of samples per ID class is limited in the training set. For example, there are only around 40 samples per class for Stanford- Cars, 100 for Oxford-Pet and 30 for CUB-200. The sample scarcity makes OOD detection methods that rely on fine-tuning difficult. For example, after fine-tuning on Food- 101, while the ID accuracy is increased from 86.3% 92.5% 1, OOD detection based on MSP is on par with MCM (99.5% vs. 99.4% in AUROC).
MCM scales effectively to large datasets. To examine the scalability of MCM, we compare with recent competitive OOD detection methods [19 32 on the ImageNet-Ik Ik dataset (ID) in Table 2 observe the following trends:
Larger models lead to superior performance. Compared with CLIP-B, MCM based CLIP-L reduces FPR95 by 4.57%. Zero-shot ID classification accuracy also improved by 6.27% with the larger model, reaching 73.28% (see Appendix D). This suggests that larger models endowed with a better representation quality, which benefits both ID classification and OOD detection with MCM. Our finding echos with the recent observations (78 that higher ID classification accuracy is correlated with stronger OOD detection performance.
MOS 22
recently demonstrated competitive performance on ImageNet- -kk which requires model fine-tuning based BiT 38 In contrast, we show that MCM (CLIP-L) outperforms MOS by
1.38% AUROC while being zero-shot (training-free)
MCM shares a softmax scaling function with the classic (visual) confidence-based score MSP To implement MSP, we adopt the commonly used linear probe approach by fine-tuning linear layer on frozen visual features of CLIP. After fine-tuning, ID accuracy significantly improves, reaching 84. 12% (CLIP-L). Interestingly, the OOD detection performance of MSP is worse than

---

Table Performance comparison on hard OOD detection tasks. MCM is competitive on three hard OOD lasks without training involved. MSP (based on fine-tuned CLIP) does not further improve performance.
ID
ImageNet-10 ImageNet-20
ImageNet-20 ImageNet-10
Waterbirds Spurious OOD
Method
OOD
FPR95 AUROC
FPR95 / AUROC
FPR95 AUROC
MSP 25 (line-tuning)
9.38 98.31
12.51 / 97.70
39.57 / 99.999
Mahalanobis
A2 (visual only)
78.32/ 85.60
43.03 89.94
2.21 / 99.55
MCM (zero-shol)
5.00 98.71
12.91 98.09
5.87 98.33
MCM by 15.54% in FPR95. Under the same model fine-tuned with linear probing, we observe that the Energy score outperforms MSP, corroborating findings in 48 We investigate more in Section
Recently, Fort et al. 19 explore small-scale OOD detection by fine-tuning the full ViT model. When extended to large-scale tasks, we find that MCM still yields superior performance under the same image encoder configuration (ViT-B or ViT-L). This further highlights the advantage of utilizing lisnon-language joint embeddings for large-scale visual OOD detection.
MCM benefits hard OOD detection. Going beyond, we investigate whether MCM is still effective for hard OOD inputs. We consider the following two categories of hard OOD:
Semantically hard OOD: OOD samples that are semantically similar to ID samples particularly challenging for OOD detection algorithms [85. To evaluate hard OOD detection tasks in realistic settings, here consider ImageNet-10 10 (ID) vs. ImageNet-20 (OOD) and vice versa. The pair
consists of high-resolution images with semantically similar categories such as dog versus wolf. As shown in Table B MCM outperforms Mahalanobis 4p2 by 73.32% in FPR95 for ImageNet-10 (ID) vs. ImageNet-20 (OOD) and 30.12% % vice versa.
Spurious OOD: Modern neural networks can exploit spurious correlations for predictions B For example, in the Waterbirds dataset [64], there exist spurious correlations between the habitat (e.g.. water) and bird types. A recent work (50) proposes a new type of hard OOD named spurious OOD and shows that most OOD detection methods perform much worse for spurious OOD inputs compared to non-spurious inputs. The spurious OOD inputs are created to share the same background (i.e., water) as ID data but have different object labels (e.g., boat rather than bird). See Appendix representations are robust to distributional shifts [59]. Therefore. while prior works [50] show that spurious OOD inputs are challenging for methods based on ResNet [23], MCM and Mahalanobis scores based on pre-trained CLIP perform much better. On the other hand, fine-tuning exposes the model to the training set containing spurious correlations. As a result, MSP performs much worse than MCM (39.57% vs. 5.87% in FPR95).
C for illustrations. The results are shown in Table 3]] It has been shown that CLIP
MCM outperforms CLIP-based baselines. Two recent
105
works also CLIP embeddings for OOD detection [6] 19I.
ZO-CLIP
However, fundamental limitations exist for both works. Fort et al. 19 assume that candidate OOD label set Yc is known, and used Eyete P(y|x) for OOD detection. Here
MCM
100
30. 1D
AUROC
05.14
the predictive probability p(y|x) is obtained by normalizing the inner products over [)in + |ic| classes. While applying softmax converts any vector to probabilities, as we show in Section 3 the converted probabilities do not necessarily correspond to P(OOD) x). Moreover, obtaining such an OOD label set is typically not feasible, which fundamentally limits its applicability. A recent work [16] realizes this idea by training an extra text decoder on top of CLIP's image encoder to generate candidate labels. However, [16] cannot guarantee the generated labels are non-overlapping with the ID labels.
iNaturalist
Places
SUN
Texture
Dataset
Figure 3: Comparison with a candi- date label-based score ZO-CLIP on ImageNet-20 20, based on our implemen- tation of [6). Implementation details are deferred to Appendix E.1
7

---

No softmax (FPR: 40.23
(F
2000
(FPR: 15.15 %6
7- 10 (EPR:15.45 15.45 %6
1703
OOD
193
.50
1380
Dasily
Deaaly
12000
1340
628 62
casa
E:DO
020m sauze setan cazon
Figure 4: The influence of softmax scaling and temperature. We use ImgeNet- 100 (ID) vs. iNaturalist
(OOD). Softmax scaling with a moderate temperature significantly improves FPR95.
We enhance the baseline with a stronger decoder and filter module (see Appendix As shown in Figure ] MCM outperforms the enhanced baseline on all OOD datasets. Moreover, MCM much simpler to ass-aallvia the need for an OOD label set or training an additional caption generator. In contrast, the caption generator's s performance largely affects OOD detection. Poor caption quality degenerates the OOD detection performance of candidate label-based methods. Moreover, obtaining reliable caption generator for any input image can significantly increase the computational overhead.
Discussion: A Closer Look at MCM
Empirical verification on the role softmax. In Section 8 we prove that softmax scaling on cosine similarity scores with moderate т improves the ID-OOD separability. Here we empirically verify our theoretical results. As shown Figure compared to directly using the maximum cosine similarity without softmax (leftmost figure), softmax scaling with temperature т = significantly improves the performance by 22.6% in FPR95, and further increasing T (e.g., T = 10) leads to similar performance. The results based on ImageNet- 100 (ID) versus iNaturalist (OOD).
Now, we verify if our theoretical bound (c.f. Theorem From the leftmost figure, we can estimate A ~ 0.26, ò z 0.03, and 8g, = 0.23. By checking the third figure (r 1 the temperature value we use for most experiments), we approximate
is satisfied empirically as well Figure
0.011.
A(K -A" -8-59)) z 0.65.
As = 100, we plug in the values and obtain the lower bound = Since 7 > 0.65, by Theorem 3.J applying softmax scaling with is provably superior to without softmax scaling for OOD detection.
KX-1
Are vision-language features better than visual fea- ture alone? MCM can be interpreted a distance-based approach-ingg images that are closer to one of the K class prototypes more likely to be ID and vice versa. Here the class prototypes are defined based on a textual encoder. Alternatively,
100
Maha
92.57
90
AUROC
define the class prototypes based
7633
T8l 55
71
05
visual features. For example, Mahalanobis [42 defines a class prototype the average of visual embeddings for images belonging to the same class. This raises the ques- tion whether MCM (with multi-modal lasion-language features) is better than Mahalanobis (with single-modal visual feature). For fair comparison, we use the same ViT image encoder from CLIP-B. Both MCM and Maha- lanobis extract visual features from the penultimate layer. On ImageNet- 1k, Mahalanobis displays a limited perfor- mance, with 73.1 14% AUROC averaged across four OOD test datasets (90.77% for MCM), as shown in Figure 5 From practical perspective, Mahalanobis requires computing the inverse covariance matrix, which can be both computationally expensive and inaccurate when the number of samples scarce and the number of ID classes grows. In contrast, MCM is easier to use and more robust.
60
iNoturalist
Places
SUN
Texture
Dutaset
Figure 5: Comparison with Mahalanobis (Maha) score on ImageNet- lk.
MCM without softmax scaling. Section we provide theoretical justifications for the necessity of softmax scaling for CLIP-like models. To further verify our observations empirically, we show OOD detection performance based on the maximum cosine similarity score (xee((''s (x::)., T,I)
maxie[K] s: sx('). The results shown in Table For easy tasks such as Food-101 [39] Stanford-

---

Table 4: Zero-shot OOD detection of SMMM based on CLIP-B/16.
OOD Dataset
iNaturalist
Texture
Average
FPR95
AUROCT
FPR95,
AUROCI
FPR95,
AUROCT
FPR95,
AUROCT
FPR951
AUROC
Stanford-Cars
3
0.00
99.99
0.00
99.98
Food-101
0.56
99.86
0.09
99.95
0.49
99.88
8.33
97.44
2.37
99.28
Oxford-Pet 3
0.02
99.98
0.05
99.97
0.20
99.94
0.27
99.91
0.14
99.95
ImugeNet-10
Net2eN
14.96
97.87
13.10
97.97
14.21
97.67
13:46
97.32
13.93
97.71
ImugeNet-II
61.66
89.31
64.39
87.43
63.67
85,95
86.61
71.68
69.08
83.59
Cars 339 and Oxford-Pet [57 as ID, the performance of maximum cosine similarity score is similar to MCM (see Table T and Table 2) However, for more challenging tasks such as ImageNet-20 and ImageNet-1k, MCM significantly outperforms that without softmax scaling. For example, the average FPR95 is improved by 11.33% % on ImageNet-22 and 26.34 % on ImageNet- 1k, which highlights the necessity of proper scaling function for CLIP-based OOD detection.
MCM for ResNet-based CLIP models. Our main results are based on the CLIP model with ViT image encoder. We additionally investigate the effectiveness of MCM on ResNet-based CLIP. Specifically, we use RN50x4 (178.3M), which shares similar number of parameters as CLIP-B/16 (149.6M). The results are shown Table 5 We can see that MCM still shows promising results with ResNet-based CLIP models, and the performance is comparable between RN50x4 and CLIP-B/16 (89.97 vs. 90.77 in AUROC).
Table 5: Comparison with ResNet-based CLIP models ImageNet-Ik (ID).
OOD Dataset
iNaturalist
SUN
Places
Average
FPR95
AUROCT
FPR95
AUROCT
FPR95,
AUROCI
FPR95
AUROC1
FPR95
AUROCT
RN50x4
44.51
91.51
35.11
92.84
43.74
89.60
57.73
85.93
45,27
89.97
CLIP-B/16
30.91
37.59
89.77
86.11
42.74
90.77
Effect of prompt ensembling, We examine MCM's per- formance with prompt ensembling. For example, Radford er al. [59] create 80 possible prompts according to the image modalities and nuances ImageNet. We experiment with the
photo of <label>,
blurry photo of a <labels.
A photo of many <label>. two prompt sets, one of size 80 as in [59]. and our own set of prompts. Ensembles are obtained by averaging the tex- tual features. As expected, using ensembles increases the ID classification accuracy on ImageNet-IK Ik (2% with CLIP-B and 3% with CLIP-L). For OOD detection, the average FPR95 is reduced from 38.17% with the default prompt to 3 with an ensemble of five prompts shown in Table 6 In addition, the detection performance with 5 prompts is slightly better than with 80 prompts. Note that prompt ensembling does not increase the inference- iierence-time cost, as the textual embeddings (across many prompts) can be pre-calculated and averaged into single embedding.
photo of the large <label>, photo of the small <label>.
Table 6: The five prompt templates.
Related Works
OOD detection in computer vision. For open-world multi-class classification, the goal of OOD detection is to derive binary ID-OOD classifier along with a multi-class classification model for visual inputs. A plethora of methods has been proposed for deep neural networks (9I) including generative model-
methods 7 20 Rd
5%
54
56 61
57 83, and discrininative-modee based
methods. For the latter category, an OOD score can be derived based on the softmax output 4 [2
24
32 46 90], energy-based based score 15
82), gradient information [31] or the &5 of model. Morteza al. (52), Fang el al.
48 50 69 70
feature embeddings 14
65 66
72
and
Bitterwolf et al. (S] provided theoretical analysis for OOD detection. Recent works [3 X also
explored OOD detection for long-tailed distributions. Works insofar have mostly focused on OOD
detection for task-specific model using only visual information. In contrast, explore novel

---

paradigm of zero-shot OOD detection that incorporates rich textual information and can perform wide variety of tasks.
OOD detection in natural language processing. Distribution shifts can occur due to the change of topics and domains, unexpected user utterances, etc. Challenging benchmarks Kt and characteri- zation of distributional shifts [ have been proposed in recent years. Compared to early language models such as ConvNets and LSTM 25 , pre-trained language models are more robust to distribution shifts and more effective at identifying OOD instances 126 58
89 Various algorithmic solutions are
proposed handle OOD detection, including outlier exposure [GO]. model ensembling [+ data
augmentation 8 93 951,
contrastive learning [34] 98]. and an auxiliary module that incorporates
domain labels 68 Tan er al. 773 also explore zero-shot OOD detection for text classification tasks.
However, prior works focus on pure natural language processing (NLP) settings, while we explore utilizing textual embeddings for zero-shot visual OOD detection.
Vision-language models. Utilizing large-scale pre-trained vision- vision-language models for multimodal downstream tasks has become an emerging paradigm with remarkable performance 22 general, two types of architectures exist: single-stream models like VisualBERT 4 and ViLT
In BS
feed the concatenated text and visual features into a single transformer- baseed encoder, dual- stre-st models such as CLIP [59], ALIGN 3K). and FILIP 92 use separate encoders for text and image and optimize with contrastive objectives to align semantically similar features in different modalities. In particular, CLIP enjoys popularity due to its simplicity and strong performance. CLIP-like models inspire numerous follow-up works 45 94 977 which aim to improve data efficiency and better adaptation to downstream tasks. This paper adopts CLIP as the target pre-trained model, but our approach can be generally applicable to contrastive models that promote vision- vision-language alignment.
Multi- modal OOD detection. Exploring textual information for visual OOD detection is new area with limited existing works. Fort er [9 propose to feed the potential OOD labels to the textual encoder of CLIP [59]. Recently, Esmaeilpour et al. [16] propose to train a label generator based on the visual encoder of CL.IP and use the generated labels for OOD detection. While both works rely on a set of candidate OOD labels, MCM is OOD-agnostic and alleviates the need for prior information on OOD, Moreover, prior works [I 59 only focus on small-scale inputs. We largely expand the scope wide range of large-scale realistic datasets, and show new theoretical insights.
7 Conclusion
In this work, we delve into a new landscape for OOD detection, departing from the classic single- modal toward multi-modal regime. By viewing the textual features the "concept prototypes", we explore a new OOD detection approach MCM, based on the joint vision-language representations. Unlike the majority of OOD detection methods, MCM offers several compelling advantages: training- free, generalizable to many tasks, scalable to hundreds of classes, and does not require any prior information OOD inputs. Moreover, provide theoretical guarantees on how softmax scaling provably improves zero-shot OOD detection. We investigate the effectiveness of MCM on a wide range of large-scale realistic tasks, including several types of hard OOD datasets. Lastly, demonstrate the advantage of vision-language features over pure visual features for OOD detection. We hope work will inspire future research toward multi-moda OOD detection.
Acknowledgement
The authors wish to thank Junjie Hu, Ying Fan, Ruisu Zhang, Andrew Geng, and Soumya Suvra Ghosal for the helpful discussions. The work is supported by Google- Research Grant, and gift funding from Adobe Research.
References
[1] Udit Arora, William Huang, and He He. Types of out-of-distribution texts and how detect them. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2021. [2] Andrei Barbu, David Mayo, Julian Alverio, William Luo, Christopher Wang, Dan Gutfreund, Josh Tenenbaum, and Boris Katz. Objectnet: A large-scale bias-controlles dataset for pushing
10

---

the limits of object recognition models. In Conference on Neural Information Processing Systems (NeurIPS), 2019.
[3] Sara Beery, Grant Van Hor, and Pietro Perona. Recognition in terra incognita. In The European Conference on Computer Vision (ECCV), 2018.
[4] Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2016.
[5] Julian Bitterwolf, Alexander Meinke, Maximilian Augustin, and Matthias Hein. Breaking down ouitt--diiti detection: Many methods based ood training data estimate combination of the same core quantities. In International Conference on Machine Learning, pages 2041-2074. PMLR, 2022.
[6] Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 101 - mining discriminative components with random forests. The European Conference on Computer Vision (ECCV), 2014.
[7] Mu Cai and Yixuan Li. Out-of-distribution detection via reequency-reguuariized generative models. In Proceedings of IEEE/CVF Winter Conference on Applications of Computer Vision, 2023.
[8] Derek Chen and Zhou Yu. Gold: improving out-of-scope detection in dialogues using data augmentation. arXiv preprint arXiv:2 109.03079, 2021.
(9] Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying out-of- distribution detection using outlier mining. In The European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD), 2021.
[10] Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In The IEEE/ (EEE/CVF Computer Vision and Pattern Recognition Conference (CVPR), 2014.
[11] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2009.
[12] Terrance DeVries and Graham W Taylor. Learning confidence for out-of-distribution detection in neural networks. arXiv preprint arXiv: 04865, 2018.
[13] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR), 2021.
[14] Xuefeng Du Gabriel Gozum, Yifei Ming, and Yixuan Li. Siren: Shaping representations for detecting ofttof-distribution objects. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
[15) Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't 't know by virtual outlier synthesis. In Proceedings of the International Conference on Learning Representations (ICLR), 2022.
[16] Sepideh Esmaeilpour, Bing Liu, Eric Robertson, and Lei Shu. Zero-shot open set detection by extending clip. In The AAAI Conference on Artificial Intelligence (AAAI), 2022.
[17] Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is out-of-disttibution detection learnable? In Advances in Neural Information Processing System (NeurIPS), 2022.
[18] Christiane Fellbaum. Wordnet. In Theory and Applications of Ontology: Computer Applications, pages 231-243, Springer, 2010.
[19] Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of outtif-dist detection. Conference on Neural Information Processing Systems (NeuriPS), 2021.
[20] Yuan Ge, Sergey Demyanov, Zetao Chen, and Rahil Garnavi. Generative openmax for multi-class open set classification. arXiv preprint arXiv: /70/:0/477.7... 2017.
[21] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations
(ICLR), 2019.
11

---

[22] Jiuxiang Gu, Jason Kuen, Shafiq Joty, Jianfei Cai, Vlad Morariu, Handong Zhao, and Tong Sun. Self-supervised relationship probing. In Conference on Neural Information Processing Systems (NeurIPS), 2020.
[23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2016.
[24] Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR, pages 41-50, 2019.
[25] Dan Hendrycks and Kevin Gimpel. baseline for detecting misclassified and out-of-distributioo examples in neural networks. In International Conference on Learning Representations (ICLR), 2017.
[26] Dan Hendrycks, Xiaoyuan Liu, Eric Wallace, Adam Dziedzic, Rishabh Krishnan, and Dawn Song. Pretrained transformers improve out-of-distribution robustness. In Association for Computational Linguistics (ACL), 2020.
[27] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In International Conference on Learning Representations (ICLR), 2018.
[28] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural computation, (18):1735-1788) 1997.
[29] Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of- distribution image without learning from out-of-distribution data. In The IEEE / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2020.
[30] Yibo Hu and Latifur Khan. Uncertainty-awar reliable text classification. In SIGKDD Confer- ence on Knowledge Discovery and Data Mining (KDD), 2021.
[31] Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. In Conference on Neural Information Processing Systems (NeurIPS), 2021.
[32] Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference (CVPR), 2021.
[33] Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoe Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision- -aiiunnl representation learning with noisy text supervision. In International Conference Machine Learning (ICML), 2021.
[34] Di Jin, Shuyang Gao, Seokhwan Kim, Yang Liu, and Dilek Hakkani- Towards textual out-of-domain detection without in in-domain labels. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 2022.
[35] Wonjae Kim, Bokyung Son, and Ildoo Kim. Vilt: Vision-and-languagge transformer without convolution or region supervision. In International Conference on Machine Learning (ICML), 2021.
[36] Polina Kirichenko, Pavel Izmailov, and Andrew G Wilson. Why normalizing flows fail to detect nut-of-distribution data. Conference Neural Information Processing Systems (NeurIPS), 2020.
[37] Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, et al. Wilds: A benchmark of in-the-wild distribution shifts. International Conference on Machine Learning (ICML), 2021.
[38] Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. In The European Conference on Computer Vision (ECCV), 2020.
[39] Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine-grained categorization. In 4th International IEEE Workshop 3D Representation and Recognition (3dRR-13) 13), Sydney, Australia, 2013.
[40] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images.
2009.
12

---

[41] Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7)3, 2015.
[42] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Conference on Neural Information Processing Systems (NeurIPS), 2018.
[43] Liunian Harold Li, Mark Yatskar, Da Yin, Cho-Jui Hsich, and Kai-Wei Chang. Visualbert: A simple and performant baseline for vision and language. arXiv preprint arXiv:1908 03557, 2019.
[44] Xiaoya Li, Jiwei Li, Xiaofei Sun, Chun Fan, Tianwei Zhang, Fei Wu, Yuxian Meng, and Jun Zhang. kfolden: k-fold ensemble for out-of-distribution detection. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2021.
[45] Yangguang Li, Feng Liang, Lichen Zhao, Yufeng Cui, Wanli Ouyang, Jing Shao, Fengwei Yu, and Junjie Yan. Supervision exists everywhere: A data efficient contrastive language-image pre-training paradigm. In International Conference on Learning Representations (ICLR), 2022.
[46] Shiyu Liang. Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of- distribution image detection in neural networks. In International Conference on Learning Representations (ICLR), 2018.
[47] Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In The European Conference on Computer Vision (ECCV), 2014.
[48] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of--istributie detection. Conference on Neural Information Processing Systems (NeurIPS), 2020.
[49] Yifei Ming, Ying Fan, and Yixuan Li. Poem: Out-of-distribution detection with posterior sampling. International Conference on Machine Learning (ICML), 2022.
[50] Yifei Ming, Hang Yin, and Yixuan Li. On the impact of spurious correlation for out-of- distribution detection. The AAAI Conference on Artificial Intelligence (AAAI), 2022.
[51] Ron Mokady, Amir Hertz, and Amit H Bermano. Clipcap: Clip prefix for image captioning. arXiv preprint arXiv:21/1.097. 2021.
[52] Peyman Morteza and Yixuan Li. Provable guarantees for understanding out-of-distribution detection. The AAAI Conference on Artificial Intelligence (AAAI), 2022.
[53] Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? In International Conference on Learning Representations (ICLR), 2019.
[54] Lawrence Neal, Matthew Olson, Xiaoli Fern, Weng-Keen Wong, and Fuxin Li. Open set learning with counterfactual images. In The European Conference Computer Vision (ECCV), 2018.
[55] Edwin G. Ng, Bo Pang, Piyush Sharma, and Radu Sorieut. Understanding guided image captioning performance across domains. arXiv preprint arXiv:2012.02339, 2020.
[56] Poojan Oza and Vishal M Patel. C2ae: Class conditioned auto-encoder for open-set recognition. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2019.
[57] Omkar M. Parkhi, Andrea Vedaldi, Andrew Zisserman, and C. V. Jawahar. Cats and dogs. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference (CVPR), 2012.
[58] Alexander Podolskiy, Dmitry Lipin. Andrey Bout, Ekaterina Artemova, and Irina Piontkovskaya. Revisiting mahalanobis distance for transformer-buse based oft-of-domain detection. In The AAAI Conference on Artificial Intelligence (AAAI), 2021.
[59] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (ICML),022
[60] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog. 1(8):9, 2019.
[61] Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakkshinnrayyaaan Likelihood ratios for out-of-distribution detection. In Conference on Neural Information Processing Systems (NeurIPS), 2019.
13

---

[62] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should trust you?" explaining the predictions of any classifier. In SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), 2016.
[63] Abbijit Guha Roy, Jie Ren, Shekoofeh Azizi, Aaron Loh, Vivek Natarajan, Basil Mustafa, Nick Pawlowski, Jan Freyberg, Yuan Liu, Zach Beaver, al. Does your dermatology classifier know what it doesn't 't know? detecting the long-tail of unseen conditions. Medical Image Analysis, 102224,,, 2022.
[64] Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization. In International Conference on Learning Representations (ICLR), 2019.
[65]
Chandramouli Shama Sastry and Sageev Oore. Detecting out-of-distributton examples with Gram matrices. In International Conference on Machine Learning (ICML), 2020.
[66]
Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. In International Conference on Learning Representations (ICLR), 2021.
[67] Joan Serrå, David Álvarez, Vicenç Gómez, Olga Slizovskaia, José F. Núñez, and Jordi Luque. Input complexity and out-of-distribution detection with likelihood-based generative models. In International Conference on Learning Representations (ICLR), 2020.
Yen-Chang [68] Yilin Shen, Yen- Chang Hsu, Avik Ray. and Hongxia Jin. Enhancing the generalization for intent classification and oft-oo-domain detection in slu. arXiv preprint arXiv:2106. 14464, 2021.
[69] Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distributie
detection with rectified activations. Conference on Neural Information Processing Systems (NeurIPS), 2021.
[70] Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-disrribution detection. In Proceedings of European Conference on Computer Vision (ECCV), 2022.
[71] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of duttof--iittrbbution detection with deep nearest neighbors. In International Conference Machine Learning (ICML), 2022.
[72] Jihoon Tack. Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. In Conference on Neural Information Processing Systems (NeurIPS), 2020.
[73] Ming Tan, Yang Yu, Haoyu Wang, Dakuo Wang, Saloni Potdar, Shiyu Chang, and Mo Yu. Out-of-domain detection for low-resource text classification tasks. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2019.
[74] Shagun Uppal, Sarthak Bhagat, Devamanyu Hazarika, Navonil Majumder, Soujanya Poria, Roger Zimmermann, and Amir Zadeh. Multimodal research in vision and language: A review of current and emerging trends. Information Fusion, 17:149-171, 2022.
[75] Aaron Van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv e-prints, pages arXiv-1807, 2018
[76] Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2018.
[77] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Conference on Neural Information Processing Systems (NeurIPS), 2017
[78) Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set recognition: A good closed-set classifier all you need. In International Conference on Learning Representations (ICLR), 2022.
[79] Roman Vershynin. High-dimensional probability: An introduction with applications in data science, volume 47. Cambridge university press, 2018
[80] C. Wah, S. Branson, P. Welinder, P. Perona, and S. Belongic. The caltech-uesd birds-200-2011 dataset. Technical Report CNS-TR-200 1-001, California Institute of Technology, 2011.
[81] Feng Wang and Huaping I Liu. Understanding the behaviour of contrastive loss. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2021.
14

---

[82] Haoran Wang. Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't know? Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), 2021.
[83] Haotao Wang, Aston Zhang, Yi Zhu, Shuai Zheng, Mu Li, Alex Smola, and Zhangyang Wang. Partial and asymmetric contrastive learning for autrof-distribution detection in long-tailed recognition. In International Conference on Machine Learning (ICML), 2022.
[84] Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through alignment and uniformity on the hypersphere. In International Conference on Machine Learning (ICML), 2020.
[85] Jim Winkens, Rudy Bunel, Abhijit Guha Roy, Robert Stanforth, Vivek Natarajan, Joseph R Led- sam, Patricia MacWilliams, Pushmeet Kohli, Alan Karthikesalingam, Simon Kohl, et al. Con- trastive training for improved out-of-distribution detection. arXiv preprint arXiv:2007.05566 2020.
[86] Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2010.
[87] Kai Yuanqing Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise or signal: The role of image backgrounds in object recognition. In International Conference on Learning Representations (ICLR), 2021.
[88] Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: An out-of-distribution detection score for variational auto-encoder. In Conference on Neural Information Processing Systems (NeurIPS), volume 33, 2020.
[89] Keyang Xu, Tongzheng Ren, Shikun Zhang. Yihao Feng, and Caiming Xiong. Unsupervised out- of-domain detection via pre-trained transformers. In Association for Computational Linguisties (ACL), 2021.
[90] Jingkang Yang, Haoqi Wang. Litong Feng, Xiaopeng Yan, Huabin Zheng, Wayne Zhang, and Ziwei Liu. Semantically coherent out -ittr--distribution detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2021.
[91] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized duttof-distribution detection: A survey. arXiv preprint arXiv:21 10. 1334, 2021.
[92] Lewei Yao, Runhui Huang, Lu Hou, Guansong Lu, Minzhe Niu, Hang Xu, Xiaodan Liang, Zhenguo Li, Xin Jiang, and Chunjing Xu. Filip: Fine-grained interactive language-image pre-training. International Conference on Learning Representations (ICLR), 2021.
[93] Li-Ming Zhan, Haowen Liang, Bo Liu, Lu Fan, Xiao-Ming Wu, and Albert Lam. Out-of-scope intent detection with self-supervision and discriminative training. Association for Computational I. Linguistics (ACI.), 2021.
[94] Renrui Zhang, Rongyao Fang, Peng Gao, Wei Zhang, Kunchang Li, Jifeng Dai, Yu Qiao, and Hongsheng Li. Tip-adapter: Training-free clip-adapter for better vision-language modeling. arXiv preprint arXiv:2111.0388
2021.
[95] Yinhe Zheng, Guanyi Chen, and Minlie Huang. Out-of-domain detection for natural language understanding in dialog systems. TASLP, 2020.
[96] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A
10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), 2017.
[97] Kaiyang Zhou, Jingkang Yang. Chen Change Loy, and Ziwei Liu. Conditional prompt learning for dision-language models. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference (CVPR), 2022.
[98] Wenxuan Zhou, Fangyu Liu, and Muhao Chen. Contrastive aut-of-disttibuttin detection for pretrained transformers. Conference on Empirical Methods in Natural Language Processing (EMNLP), 2021.
[99] Zhuotun Zhu, Lingxi Xie, and Alan Yuille. Object recognition with and without objects. In International Joint Conferences on Artificial Intelligence (IJCAI), 2017.
15

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [N/A]
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? Yess] See Section and Section
(b) Did you include complete proofs of all theoretical results? [Yes] See Section A
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or URL)? [Yes] See Section B
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See Section g and Section B
(c) Did you report error bars (e.g., with respect to the random seed after running ex- periments multiple times)? [N/A] There no training involved in MCM. For fair comparison and reproducibility, we use the publicly available checkpoints of CLIP from OpenAl.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes] See Section B
4. If you using existing assets (e.g., code, data, models) or curating/releasing
assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] See Section B
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any assets either in the supplemental material URL? [Yss]
See Section
(d) Did you discuss whether and how consent was obtained from people whose data you'le 're using/curating? [N/A]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
16


Reviews:
[{"review_id": "o1V_lBZpmzW", "reviewer": "Reviewer_Ekfu", "summary": "This paper presents an out-of-distribution(OOD) detection method for the image classification models based on the CLIP model. The authors propose Maximum Concept Matching which detects OOD by aligning visual features with textual concepts. Experiments show that this simple yet effective method can outperform many methods. Since the method does not need any training, it can be easily applied to different datasets with minimum effort.", "questions": " ", "limitations": "No limitations are discussed by the authors. ", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The method is simple and can work well without bells and whistles.\n    - There're four compelling advantages: generalizable to many tasks; OOD-agnostic; training-free; scalable.\n- The authors justify their design with theoretical proof.\n\nWeaknesses:\n- Although the definition of MCM in eq. 1 is intuitive, there could be many ways to detect uniformity of the cosine similarities. For example, entropy after softmax scaling, the variance of the cosine similarities, exp(max - second_max). More options should be compared in the experiments.\n- It will be great if the authors can try more different CLIP models like resnet CLIP, and some community open sourced CLIP-like models. Would it be possible that it is actually the vision transformer or the training data of CLIP to be the root cause of strong OOD detection performance?\n- Wrong fact: the authors claim that CLIP uses a temperature of 0.07. However, the temperature of CLIP is initialized as 0.07 and learned during training.\n\nFinal rating:\nThe authors' rebuttal addresses my questions very well. I will keep my original rating.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "MNAJ_LD2K7D", "reviewer": "Reviewer_8qRe", "summary": "The paper presents an OOD detection approach termed MCM based on vision-language pretrained models, by formatting the OOD detection as a distance-based matching problem. Specifically, they take the advantage of CLIP for distinguishing OOD data from known classes by cross-modal matching, which establishes a powerful cross-modal subspace for metric learning. The author gives some theoretical and empirical evidence to explain the superiority of MCM over cross-entropy-based models.", "questions": "1. In Table 2, why do Fort et al. (ViT-B) and MSP (CLIP-B) have the same performance on all metrics? Also, some values should not be bold.\n2. What about the variance of the experiments?", "limitations": "The paper did not describe limitations.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n* The paper is well written and mostly clear.\n* The idea of the maximum matching score is simple but effective and shows promising results compared with some baselines.\n* The theoretical explanation of softmax scaling seems reasonable and insightful.\n\nWeaknesses:\n* Missing comparisons with recent works. The compared works in Table 2 all adopt a Transformer trained on large datasets, a large portion of CNN-based methods is missing, e.g. GradNorm[R1], Energy[R2]. Note that when replacing ResNet with CLIP,  the simple baseline MSP could boost from 63.69/87.59 (reported in [R1]) to 26.65/95.25 on FPR95/AUROC on iNaturalist. I am worried that previous CNN-based methods may also benefit from a strong backbone significantly. The paper lacks a fair comparison with recent CNN-based SOTA methods (MSP and Mahalanobis are somewhat old) using a similar backbone.\n\n* Prompt ensemble. For the same datasets, I guess different prompts may produce unstable performance and thus ensemble works well. I wonder whether the authors have to design new prompts for new datasets. \n\n[R1] On the Importance of Gradients for Detecting Distributional Shifts in the Wild, NIPS 2021.\n\n[R2] Energy-based out-of-distribution detection, NIPS 2020.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}, {"review_id": "6QyAptC8YIa", "reviewer": "Reviewer_ZoJQ", "summary": "The authors proposed Maximum Concept Matching (MCM), a distance-based zero-shot OOD detection method based on aligning visual features with textual concepts, and provided theoretical justifications that softmax scaling used by MCM improves the separability between ID and OOD data for CLIP-based OOD detection. The experiments demonstrate that MCM achieves superior performance on a wide variety of real-world tasks. MCM with vision-language (multi-modal) features outperforms Mahalanobis with visual features only (single-modal) on a hard OOD task. MCM offers several advantages: OOD-agnostic (no information required from OOD data), training-free (no downstream fine-tuning required), and generalizable (one model supports many tasks).", "questions": "Can MCM be applicable for non-contrastive vision-language pre-training models?", "limitations": "Ablation study on softmax scaling should be given.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\nOriginality: the authors adopted softmax scaling, which improves the separability between ID and OOD data.\n\nQuality: MCM achieves superior performance on a wide variety of real-world tasks, compared with the state-of-the-art OOD detection methods. MCM with vision-language (multi-modal) features outperforms Mahalanobis with visual features only (single-modal) on a hard OOD task, with an improvement of 56.60% on FPR95.\n\nClarity: the manuscript is well-organized and the text is clear and concise.\n\nSignificance: The use of the powerful CLIP representation and softmax scaling, enables zero-shot OOD detection. More important, MCM is OOD-agnostic and generalizes to many tasks, making it suitable for real-world applications, where we don’t know OOD labels in prior.\n\n\nWeaknesses\n\nOriginality: the authors proposed MCM inspired by concept match which has been adopted in previous OOD detection work (Mahalanobis, which defines class prototypes based on pure visual embeddings). And multi-modal OOD detection has been practiced in previous OOD detection works yet.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}, {"review_id": "0bt8oU7Sw5i", "reviewer": "Reviewer_rjjS", "summary": "This paper proposed a new out-of-distribution (OOD) detection method based on pretrained vision-language model. Unlike previous works, this work relies on pretrained models like CLIP to infer whether a given image is in or out of the target distribution by matching the visual features to a set of concept embeddings. To mitigate the score overlap between in-domain and out-of-domain data, the authors proposed a simple but effective softmax-scaling to recalibrate the matching scores between images and texts. According to the experimental results, the proposed method called Maximum Concept Matching (MCM) achieves superior performance to previous works on a variety of benchmarks and settings. It does not need any finetuning but can be directly applied to different datasets and label spaces in a zero-shot manner thanks to the zero-shot capacity learned by vision-langauge models. ", "questions": "Questions:\n\n1. What is the performance after finetuning CLIP models for OOD detection? It would be better to show the performance after finetuning on downstream datasets.\n\n2. It is still not clear to me why vision-language pretrained model with simple softmax scaling can outperform previous work significantly. There is not much explanation in the paper about this.\n\n3. The authors should report the performance without softmax scaling for all datasets and evaluations. The role of softmax scaling is not clear to me.\n\nSuggestions:\n\n1. I do not think the claimed contributions in lines 155-168 are from the proposed MCM method. It mainly inherits from the off-the-shelf CLIP models. All methods that use vision and language encoders in CLIP are supposed to possess such properties.\n\n2. The authors should have more discussions about the contribution of proposing softmax scaling, which I think is an incremental and normal technique.\n\n", "limitations": "The authors did not discuss the limitations and societal impact in their submission.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "[Strenghts]\n\n1. This paper introduced a simple yet effective OOD detection method called MCM based on multi-modal pre-trained models. This is one of the first works that leverage vision-language multi-modal models for OOD, in contrast to previous single-modal methods.\n\n2. Based on the vision-language pretrained model like CLIP, the authors further proposed a simple softmax scaling to re-calibrate the matching scores to magnify the difference between in-distribution and out-of-distribution samples. \n\n3. Comprehensive experiments demonstrate that the proposed MCM outperforms previous work proposed by Fort et al. and MSP. The superiority is universal on both small-scale datasets and large-scale ones line ImageNet-1K. The authors further demonstrated that MCM can benefit hard OOD detection very well. \n\n[Weaknesses]\n\n1. The technical contribution in this paper is limited. First of all, using softmax on the classification logits is natural and straightforward as shown in MSP and other works. Despite the authors gave proof that softmax scaling can improve the OOD detection when using clip-based models, I think this change is incremental and should be considered as a baseline method.\n\n2. The proposed MCM is one of the first works that leveraged vision-language pretrained models. However, I do think the claims made in lines 155-168 are exaggerated. Most of the claimed merits for MCM are due to vision-language pretrained CLIP, such as generalization ability, training-free and scalable.\n\n3. In Fig.4, the authors showed the effect of softmax scaling and the corresponding FPR at different settings. For completeness, the authors should report the results on all used datasets for the proposed method without softmax scaling. \n\n4. The authors merely reported the performance on zero-shot settings, it would be better to also report the performance after finetuning. It is not clear whether after finetuning the OOD detection performance will be further improved or not. \n\n5. It is not clear in the paper why the vision-language model achieves much better zero-shot OOD detection than the single-modal method. The authors comapred with Maha in lines 289-307. However, why text features as the prototypes are supposed to be better than visual features as the prototypes? ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept