Watermarking for Out-of-distribution Detection
Authors: Qizhou Wang
Feng Liu
Yonggang Zhang
Jing Zhang
Chen Gong
Tongliang Liu
Bo Han
Venue: NeurIPS 2022 Accept (2022)
Keywords: OOD Detection

Abstract: Out-of-distribution (OOD) detection aims to identify OOD data based on representations extracted from well-trained deep models. However, existing methods largely ignore the reprogramming property of deep models and thus may not fully unleash their intrinsic strength: without modifying parameters of a well-trained deep model, we can reprogram this model for a new purpose via data-level manipulation (e.g., adding a specific feature perturbation). This property motivates us to reprogram a classification model to excel at OOD detection (a new task), and thus we propose a general methodology named watermarking in this paper. Specifically, we learn a unified pattern that is superimposed onto features of original data, and the model's detection capability is largely boosted after watermarking. Extensive experiments verify the effectiveness of watermarking, demonstrating the significance of the reprogramming property of deep models in OOD detection.

Watermarking for Out-of-distribution Detection
Qizhou Wang'* Feng Liu Yonggang Zhang' Jing Zhang?
Chen Gongl.5 Tongliang Liu Bo Han-t
1 Department of Computer Science, Hong Kong Baptist University
School of Mathematics and Statistics, The University of Melbourne
School of Computer Science, The University of Sydney
*PCA Lab, Key Lab of Intelligent Perception and Systems for High-Dimensiona, Information of MoE "Jiangsu Key Lab of Image and Video Understanding for Social Security,
School of Computer Science and Engineering, Nanjing University of Science and Technology
6TML Lab, The University of Sydney
csqzwang, esygzhang, bhanml| @ comp, cromp.hbb.... hhbb..dd..b..........cccccc fengliu.ml @ gmail. com chen. gong @ enjust.eeuu edu.en Jiig.zhangl, tongliang liu @syddney.edu. edu.aa
Abstract
Out-of-din di-disttiitttinn (OOD) detection aims to identify OOD data based on represen- tations extracted from well-trained deep models. However, existing methods largely ignore the reprogramming property of deep models and thus may not fully unleash their intrinsic strength: without modifying parameters of well-trained deep model, we can reprogram this model for new purpose via data-level manipulation (e.g.. adding a specific feature perturbation to the data). This property motivates us to reprogram a classification model to excel at OOD detection (a new task), and thus we propose a general methodology named watermarking in this paper. Specifically, we learn unified pattern that is superimposed onto features of original data, and the model's 's detection capability is largely boosted after watermarking. Extensive experiments verify the effectiveness of watermarking, demonstrating the signifi- cance of the reprogramming property of deep models in OOD detection. The code is publicly available at: www//izhowwwng/wwaeeeeee.ooe
Introduction
Deep learning systems in an open world often encounter duftof-disttibbutin (OOD) inputs whose label spaces are disjoint with that of training data, known in-distribution (ID) data. For safety- critical applications, deep models should make reliable predictions for ID data, meanwhile detecting OOD data and avoiding making predictions for the detected ones. This leads to the OOD detection task [28, 38, 41, 50], which has attracted intensive attention in the real world.
Identifying OOD data remains non-trivial since deep models can be overconfident with them [40]. As a promising technique, the classification-buse functions derived by classification models well trained with ID) data (i.e., well-trained models). taking those inputs with small scores as OOD cases. In general, the scoring functions can be defined by logit outputs [17, 33], gradients [21], and embedding features [28, 44]. Without interfering with the well-trained models or requiring extra computation, they exploit the inherent capability of models leamne from only ID data. In general, these advantages can be critical in reality, where the cost of re- re-training is prohibitively high and the acquisition of true OOD data is very difficult [58].
OOD detection [58] relies on various scoring
Equual contributions. 'oorespondencc to Bo Han (bhanml @ wwwp..kku.cc....ooooooooooooo (dk.b.eddu.kk) and Tongliang Liu (tongliang liu @sydnney.cdu.uu))
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Although promising progress has been achieved, previous works largely ignore the reprogramming property [9] of deep models: well-trained model can be repurposed for a new task by a proper transformation of original inputs (e.g., a universal feature perturbation), without modifying any model parameter. For example, a model pre-trained on ImageNet [6] dataset can be reprogrammed for classifying biomedical images [49]. This property indicates the possibility of making well-trained model adapt for effective OOD detection, motivating us to make the first attempt to investigate if the reprogramming property of deep models can help to address OOD detection, i.e., can reprogram well-trained deep models for OOD detection (a new task)?
In this paper, we propose novel method, watermarking, to reprogram a well-trained model by adding a watermark to original inputs, making the model can help detect OOD data well. The watermark has the same shape with original inputs, which is static pattern that can be added for test-time inputs (cf., Figure 1). The pre-defined scoring strategy (e.g.. the free energy scoring [33]) is expected to be enhanced, with an enlarged gap of OOD scores between the watermarked II) and OOD data (cf., Figure 2).
It is non-trivial to find the proper watermark due to our lack of knowledge about unseen OOD data in advance. To address the issue, we pro- pose a learning framework for effective water- marking. The insight is to make a well-trained model produce high scores for watermarked ID inputs meanwhile regularize the watermark such that the model will return low confidence with- out perceiving ID pattern. In this case, the model will have a relatively high score for a water- marked ID input, while the score remains low for OOD data (cf., Figure 2). The reason that the model encounters a watermarked input but not seeing any ID pattern. In our realization, we adopt several representative scoring strategies, devising specified learning objectives and proposing reliable optimization algorithm to learn an effective watermark.
Figure I: Watermarking on CIFAR-10 [26] with free energy scoring [33]. The left figure is the learned watermark; the middle figure is an original
input; the right figure is the watermarked result.
To understand our watermarking, Figure 1 depicts the watermark learned on CIFAR-10 [26] dataset, with the free energy scoring [33]. As we can see, the centre area of the learned watermark largely preserves the original input pattern, containing the semantic message that guides the detection primitively. By contrast, the edge area of the original input is superimposed by the specific pattern of the watermark, which may encode the knowledge once hidden by the model in boosting OOD detection. Overall, watermarking can preserve the meaningful pattern of original inputs in detection, with the improved detection capability that is learned from the trained model and ID data.
Figure 2 demonstrates the effect of our learned watermark, which is an example with the free energy scoring. After watermarking, the scoring distributions are much concentrated, and the gap between ID (i.e., C1FAR-10) and OOD (i.e., SVHN [39] and Texture [4] datasets) data enlarged notably. We conduct extensive experiments for wide range of OOD evaluation benchmarks. and the results verify the effectiveness of our proposal.
The success of watermarking takes roots in the following aspects: (1) a well-trained model on classification has the potential be reprogrammed for OOD detection since they are two related tasks; (2) reprogramming has been widely studied, ranging from image classification to time series analysis [6. 49], making our proposal general across various domains: and (3) OOD detection suffers from the lack of knowledge about the real-world OOD distributions. Fortunately, with only data-level manipulation in low dimensions, watermarking can largely mitigate this issue of limited data. Overall, this data-level manipulation is orthogonal to existing methods, and thus provides new road in OOD detection and can inspire more ways to design OOD detection methods in the future.
2 Related Works
To begin with, we briefly review the related works OOD detection and model reprogramming. Please refer to Appendix A for the detailed discussion.

---

Texture
Texture
Density
Density
SVHN
SVHN
CIFAR-10
CIFAR-10
15
10 15
Free Energy S Score
Free Energy Score
(a) before watermarking
(b) after watermarking
Experimental results before (a) /after (b) watermarking with CIFAR-10 being the ID dataset, SVHN and Texture being the OOD datasets. Data with large (small) OOD scores should be taken as ID (OOD) data, and larger distribution gap of scoring between ID and OOD data ensures better detection performance. After watermarking, the gap between ID and OOD data is enlarged, demonstrating the improved capability of the original model in OOD detection. The horizontal axes are ignored for illustration, please refer to Figure 4 for completed version.
Figure 2:
OOD Detection discerns ID and OOD data by their gaps regarding the specified metrics/scores. and existing methods can be roughly divided into three categories [58]. the classification-bast based methods, the density-based methods, and the distance-based methods. Specifically, the classification- based methods [17, 21, 33, 44] use representations extracted from the well-trained models in OOD scoring: and the distance-bart based methods [2, 20, 60] measure the distance of inputs from class centers in the embedding space. Moreover, the density-based bassed methods estimate input density with probabilistic models [28, 41, 45], identifying those OOD data with small likelihood values. Distance- based and density-based methods may suffer from complexity in computation [28] and difficulty in optimization [62]. Therefore, more researchers focus on developing classification-bast methods and have made big progress benchmark datasets recently [21, 33).
Model Reprogramming repurposes well-trained models for new tasks with only data-level ma- nipulation [9], indicating that deep models are competent for different jobs without changing any model parameter. In previous works, the data-level manipulation typically refers to a static padding pattern (different from our proposal) learned for the target task, which is added to the test-time data. The effectiveness of the model reprogramming verified across image classification [9, 49] and time-series analysis [13, 57]. In this paper, use the reprogramming property of deep models for effective OOD detection, which has been overseen previously.
Preliminary
Let X' C qd be the input space and ) (I,....c) be the label space. We consider the ID distribution Di defined over X' x y, the training sample S, {( y/) )=)) of size n independently drawn from D and a classification model f + E (with logit outputs) well-trained on S,.
Based on the model f-)). the goal of the classification-bu based OOD detection is to design a detection model g X + {0, 1} that can distinguish test-time inputs with the ID distribution D from those with the OOD distribution DOOD, In general, DOOD is defined an irrelevant distribution of which the label set has no intersection with V, and thus should not be predicted by f(-). Overall, with denoting the OOD case and the ID case, the detection model 9(-) is defined as
= {
<x;; 2 s(x; <
g(x: T) g(x;T)=
(I)
where E R. is threshold and X + R is the scoring function defined by ʃ(-) whose parameters are fixed. Here, we focus on two representative methods in the classification-base. OOD detection, namely, the softmax scoring and the free energy scoring.

---

Softmax Scoring Function [17] uses the maximum softmax prediction in OOD detection, of which the scoring function (-M(-) is given by
8SM f) max softmax: f(x),
where softmax; denotes the k-th element of the softmax outputs. In general, with a large (small) (2; f), the detection model will take the input æ as an ID (OOD) case.
Free Energy Scoring Function [33] adopts the free energy function for scoring, defined by the logit outputs with the logsumexp operation, namely,
Spp x: f) = log Σ exp fx(2)/T. A
where T > O is the temperature parameter, fixed to 1 [33]. It aligns with the density of inputs to some extent, and thus less susceptible to the overconfidence issue than the softmax scoring [33].
4
Watermarking Strategy
This section introduces the key concepts of watermarking for classification-based OOD detection.
Definition. A watermark E Rd is unified pattern with the exact shape original inputs. It added to test-time inputs statically, and we refer w + æ a watermarked input for Væ E X. In expectation, regarding the specified scoring function s(.), our watermarking should make the model excel at OOD detection for watermarked data.
Learning Strategy. Given the scoring function s()), it is challenging to devise the exact watermark pattern by predefined rules. Therefore, for the proper watermarks OOD detection, we need to devise learning objectives with respect to watermarks, which consider both ID and OOD data.
We generally have information about the OOD distribution D while still want the model excels in discerning ID and OOD data from scoring. For this challenge, make the model produce high scores if watermarked ID data are observed; meanwhile, we regularize the watermark such that the model will return low scores when IDD patterns do not exist. From the lens of model, the scores should remain low if a watermarked OOD input is given since the watermark not trained to perceive OOD data, of which the patterns are very different from the ID data.
Benefits of Watermarking. Watermarking directly reprograms the model to make an adaptation to our specified task of scoring, such that the detection capability of the original model is largely improved. By contrast, previous methods typically adapt to their specified tasks by only the threshold in Eq. (1), However, it requires the trade-off between false positive (ID) and false negative (OOD) rates when densitics of scoring are non non-separable (cf., Figure 2(a)).
Further, watermarking enjoys the benefits of previous classification- based methods in that we do not modify the original training procedure in classification, making our proposal easy be deployed in real-world systems. Although the watermark also should be learned, the parameter space is in low dimension, and the learning procedure could be conducted post-hoc after the systems are deployed.
Comparison with Existing Works. In OOD detection, this paper is a first attempt in using the reprogramming property of deep models, leading an effective learning framework named water- marking. At first glance, our methodology is seemingly similar to ODIN [32]. which also conducts data-level perturbation for OOD detection. However, their instance-specified perturbation relies on extra backward- forwardd iterations during the test, which is not required in our method. Further, ODIN designed for the softmax scoring, but our proposal is much general in OOD detection.
5 Realizations of Watermarking Strategy
In this section, we discuss our learning framework watermarking in detail.
Learning Objectives. As mentioned above, we need to consider the ID and OOD situations separately, with the associated loss functions denoted by (I)(.) and (.))..). For the case, the ID training data required, where we make the high scores for their watermarked counterparts. By contrast, since

---

we typically lack knowledge about the test-timm timt-time OOD data, only the watermark is used here, and we expect the model produce the score as low as possible when only perceiving the watermark.
Further, since only the watermark is adopted for training in the OOD case, the learned watermark is pretty sensitive regarding the detection model, i.e., the model may return different predictions when facing small perturbations. Thus, the watermarked OOD inputs may not guarantee the low scores. To this end, the watermark is further perturbed during training. Here we adopt the Gaussian noise, leading to the perturbed watermark of the form e + w with e ~ (O a Ia) the independent and identically distributed (i.i.d.) Gaussian noise of d-dimension (the mean 0 and the standard deviation on oyTa). Then, the overall risk can be written as,
C. (w)
eD (az, w. Uc: f) f1+ Σ GOOD (c, + wi w)
1 (t))
1000 (e)
with 3 2 0 the trade-off parameter, (w) the risk for ID data, and CoOD (w) the risk for OOD data.
Optimization. To find the proper watermark, we use the first-order gradient update to iteratively update watermark's 's elements. However, data-level optimization remains difficult in deep learning, of which the results may get stuck suboptimal points [52]. common approach is to use the signum of first-order gradients, guiding the updating rule of the current watermark via
w t w asign V (w)),
(5)
where sign(-) denotes the signum function and a >> 0 is the step size [35].
Further, for generality and insensibility, we prefer the solution that lies in the neighbourhood having uniformly low loss, i.c., with smooth loss landscape [24]. Therefore, we adopt the sharpness-awar minimization (SAM) [10], an effective optimization framework in the seek of both the low loss value and the smooth loss landscape. Specifically, given the original risk L, (w)) the SAM problem is:
SAM 12
max [... |
+ k) L. (w)) + Ln (w) = max Lnw + K)
(6)
||<|||
sbarpaess
where p 2 0 is constraint. For efficiency, the SAM makes the first-order Taylor expansion w.r.t. around 0, obtaining the approximated solution of the form 3;
(wLa (I (w) (1)) 1/p"
K = psignn V (ww)
where 1/p + 1/9 = 1 and we set = q = 2 for simplicity. Therefore, the estimation form of the SAM is written (w k), with corresponding updating rule of
- w asign V W,C,, x)),
yielding an efficient optimization algorithm that induces the effective watermark.
The Overall Algorithm. In summary, we describe the overall learning framework. To begin with, the watermark is initialized by the i.i.d. Gaussian noise with the O mean and a small standard deviation ozLn and the learning procedure consists of three stages for each updating step:
Negative sampling: a set of noise data e is sampled, assuming be of the size m as that of the mini-batch regarding the ID sample;
Risk calculating: the risk for IDD and OOD data computed, and the overall risk is given by their sum with a trade-off parameter 33 as in Eq. (4);
Watermark updating: the first-order gradient guides the pixcl-level update of the watermark,
using the signum of gradients and the SAM to make reliable update in Eq. (8).
The learned watermark is added to test-time inputs for OOD detection, and the detection model with the pre-defined scoring function then deployed. Appendix B summarizes our learning framework of watermarking, Moreover, two specifications of watermarking are discussed in the following.
With abuse of notation, denote the estimated solution in the SAM as K for simplicity.
5

---

Two Realizations. Here, we focus on two representative methods in OOD detection, namely, the softmax scoring and the free energy scoring. For other representative methods in OOD detection. please refer to Appendix C for their descriptions and the experiments.
Sofimax scoring-based Watermarking. Following [18), we set C (.) to be the cross entropy loss and (.) to be the cross entropy regarding the uniform distribution, namely,
SSM (z, yi f) log sof tf and SM (a; 1) E log sof softmax;/( (9)
specifying the learning objectives in Eq. (4) for the softmax scoring- watermarking.
Free- Bnee-Energy Scoring-bused Watermarking. [33] use a set of learning objectives for model re-training with free energy scoring. However, their logsumexp operation originating from the free energy function is difficult for optimization, posing notorious computing issues [36]. To this end, we drop the log operation and make the overall risk always positive by the following learning objectives:
ID (x: f)
exp - fx( and
gOOD FF.
(z; f) Σ
exp fx(2)/T,,
(10)
k
realizing the learning objectives in Eq. (4) for the free energy scoring.
6 Experiments
In this section, we conduct extensive experiments for watermarking OOD detection. Specifically, we demonstrate the effectiveness of our method on wide range of OOD evaluation benchmarks; we conduct experiments for the important hyper-paramest further experiments for an improved interpretation of our proposal.
in our learning framework; and we provide
Baselines results are achieved by re-run of the publicly available codes. The source code of www.///oowwwaggwwaeettoooooooeee
our proposal is released at Pytorch 1.81 with CUDA 11.1, where we use several machines equipped with GeForce RTX 3090 GPUs and AMD Ryzen Threadripper 3960X Processors.
All the methods are realized by
ID and OOD Datasets. We use CIFAR- 10, CIFAR-100 [26], and ImageNet [42] datasets as three ID datasets, with data pre-processing including horizontal flip and normalization. Furthermore, for the OOD datasets, we adopt several commonly-used benchmarks, including Textures [4], SVHN [39], Places365 [63], LSUN [59], and iSUN [56]. Referring to Appendix C.7 for
settings. Evaluation Metrics The performance in OOD detection is measured via three representative metrics, which are all threshold-independent [5]: (1) the false positive rate of OOD sample when true positive rate of ID data is at 95% (FPR95); (2) the area under the receiver operating churacteristic curve (AUROC), interpreted as the probability that an ID input has a greater score than an OOD one; and (3) the area under the precision-recad recall curve (AUPR), which further adjusts for different base rates.
Configuration. Following previous works [33], we employ WideResNet [61] (WRN-40-2) as the backbone model. For the CIFAR benchmarks, the models are trained for 200 epochs via the stochastic gradient descent, with the batch size 64, the momentum 0.9, and the initial learning rate 0.1. The learning rate is divided by 10 after 100 and 150 epochs. For the ImageNet Benchmark, the model is trained for 120 epochs via the stochastic gradient descent, with the batch size 32, the momentum 0.9 and the initial learning rate 0.05. The learning rate is divided by 10 after 60 and 90 epochs.
CIFAR Benchmarks. We depict the learned watermarks in Figure 3. As we can see, the centre areas maintain the pattern of original inputs, which are helpful in OOD detection primitively. By contrast, the edge areas of the watermarks distort the original features, superimposed with the pattern that may further boost the capability of the original models in OOD detection.
Then, we demonstrate the improvement of watermarking For the results of the softmax scoring in Table 1, our watermarking reduces the average FPR95 by 2.99 12.84, boosts the average AUROC by 3.09 3.69 and the average AUPR by 1.10 1.18. Moreover, for each of the considered test-time OOD dataset, there also exist stable improvements after watermarking, except for the comparable results regarding Places365 CIFAR-100 dataset.
CIFAR-10 and CIFAR-100 datasets.
For the results of the free energy scoring in Table 2, the improvement via watermarking is also substantial, with 4.54 13.98, 3.43 4.65, and 1.13 1.37 better performance regarding the

---

(a) softmax scoring CIFAR-10
(b) softmax scoring on CIFAR-100
(c) free energy scoring on CIFAR-10
(d) free energy scoring on CIFAR-100
Figure 3: The learned watermarks (left) and the example images with (middle) and without (right) the watermarks. All the pictures clamped between 0 and 255 for the purpose of illustration.
Table 1: Softmax scoring with/without water- marking CIFAR benchmarks. 4 (f) indicates smaller (larger) values are preferred.
Table 2: Free energy scoring with/without wa- termarking CIFAR benchmarks. & (f) indi- cates smaller (larger) values are preferred.
TPR95
AUROC +
AUPR 1
FPR95 4
AUROC1 f
AUPR
(Wio) watermark
(WVO) watermark
CIFAR-10
CIFAR-10
ISUN
43.60 43.60 (55.55)
93.53 (90.14)
98.67 (97.84)
ISUN
16.30 (32.10)
96,97 (92.84)
99.39 (98.33)
Places365
60.75 (62.50))
87.85 (87.4) .11
96.98 (96.94)
Places365
36.25 (41.45)
91.87 (89.65)
97.94 (97.21)
Texture
42,00 (59.30)
92.83 (88.37)
98.43 (97.14)
Texture
32,60 (52.05)
93.14 (85.43)
98.08 (95.52)
SVHN
27.25 (49.10)
96.00 (91 (6)
99.17 (96.54)
SVHN
16.45 (35 25)
97.11 (90.91)
99.39 (97 68)
LSUN
(52.05)
(91.50)
(98.16)
LSUN
(27.50)
(93.98)
(98.59)
averuge
42,86 (55.70)
92,91 (89.82)
98.42 (97.32)
average
23.69 (37.67)
95.21 (90.56)
98,83 (97.46)
CIFAR-100
CIFAR-100
iSUN
(83.35)
(75.28)
(94.00)
(81.80)
(79.04)
(94.98)
Place3365
83.25 (82.20)
74.28 (74.40)
93.47 (93.44)
Places3GG
80.45 (80.50)
77.78 (74.99)
94.45 (93,37)
Texture
79.10 (83.80)
77.14 (72.83)
94.26 (92.81)
Texture
75.15 (80.20)
79.55 (76.00)
94.79 (93.53)
SVIIN
82,95 (85.05)
76.92 (70.64)
94,72 (92.61)
SVIIN
82,85 (85.10)
75.26 (74.20)
94.18 (93.70)
L.UIN
76.75 (80.45)
79.60 (76.25)
95.27 (94.32)
LSU
71.85 (80.45)
84.01 (78.29)
96.33 (94.69)
average
79.98 (82.97)
77.57 (73.88)
94.61 (93.43)
average
77.07 (81.61)
79.93 (76.50)
95.18 (94.05)
average FPR95, AUROC, and AUPR. Overall, Table and Table 2 not only justify the effectiveness of watermarking and also demonstrate the generality of the proposed watermarking. Further, comparing between CIFAR-10 10 and CIFAR-101 datasets, the improvements of watermarking on CIFAR-10 is much greater than that of CIFAR-100, aligning with the previous observations [22] that a large semantic space can exaggerate the challenge in effective OOD detection.
Figure 4 illustrates the scoring distributions before (a) and after (b) watermarking on CIFAR-10. where we take the free energy scoring as an example. Due to the space limit, we only consider two test-time OOD datasets, namely, Texture and SVHN. As can see, after watermarking, the distribution gap between the ID (i.e., CIFAR-10) and the OOD (i.e., Texture and SVHN) data is enlarged, and thus the detection capability improved.
ImageNet Benchmark. Huang and Li [22] show that many advanced methods developed on the CIFAR benchmarks hardly work for the ImageNet dataset due to its large semantic space with 1 classes. In order to verify the power of watermarking in large semantic space, we conduct experiments with ImageNet being the ID dataset, and the results regarding the softmax scoring and the free energy scoring are summarized in Table 3 and Table 4. For the softmax scoring, we decrease the average FPR95 from 54.93 40.50 after watermarking: for the free energy scoring, reduce the average FPR95 from 52.73 to 43.23. It demonstrates that our watermarking still works well in the case of the large semantic space, with considerable improvements OOD detection power.
7

---

dataset
lexture 5VHN
Texture
SVMN
Density
Density
CIFAR-10
0.4
0.2
0.2
Free Energy Score
Free Energy Score
(a) w/o watermarking
(b) w/ watermarking
Figure 4: An illustration on CIFAR-10 dataset regarding the free energy scoring, (a) depicts the scoring distributions before watermarking, and (b) is the scoring distributions after watermarking.
Table The softmax scoring with/without wa- termarking on ImageNet. The notion & (f) indi- cates smaller (larger) values are preferred.
Table 4: The free energy scoring with/without watermarking on ImageNet. The notion & (t) indicates smaller (larger) values are preferred.
FPR95
AUROC ? (w//)) watemmark
AUPR
FPR95 4
AUROCT 1
AUPR
iSUN
11.54 (52.45)
(92.52)
(98.70)
iSUN
32,83 (45 40)
(94.00)
(98.20)
Places365
70.59 (73.25)
82,03 (80.78)
95.62 (94.58)
Places365
71.85 (75.01)
79.85 (78.54)
94,65 (94.40)
Texture
61.20 (67.18)
84.00 (82.27 (82.27)
98.60 98.60 (97. 85)
Texture
67.75 (68.77)
80.80 (80.22)
97.00 (96.51)
SVHN
44.58 (28.49)
93.56 (95.60)
98,70 (99.00)
SVHN
12.85 (27
97.68 (95.17)
99.45 (99.00)
LSUN
11.84 (54.62)
97.97 (91.52)
99.57 (98.25)
LSUN
33,75 (46.47)
93.71 (90.59)
98,80 (97.94)
averuge
40.50 (54.93)
91,22 (88.57)
98.42 (97.69)
average
(52.73)
89.10 (86.14)
97.73 (97.15)
Near OOD Detection. The above experiments focus on the far OOD detection setups where ID and OOD data different regarding semantics and styles. Now, we further demonstrate the power of our wa- termarking strategy in near OOD situation [54], covering a challenging situation where ID and OOD data have similar styles (i.e., near OOD data). Except for the common learning setup in Section 5, we fur- ther consider the use of shifting augmentations [47], which are data augmentations that are harmful to the standard contrastive learning but be used con- struct near OOD data similar to ID data. We consider two representative shifting augmentations: "permute" (permute evenly partitioned data) and "rotate" (rotate 90 degrees of original data). The shifting-augmentt ID data are taken as OOD data fed into good() along with random Gaussian noise.
Table 5: The performance of our watermark- ing on near OOD detection regarding the soft- max scoring and the free energy scoring.
FPR95
AUROC
AUPR
softmax scoring
w/o watermark
90.10
55,47
86. 16
common
88.23
33.16
84.75
permute rotate
86.45
60.04
86.33
81.50
65.69
88.67
free energy scoring
w/o watermark
52.25
86.49
96.44
common
49.75
88.52
96.98
permute
48.55
88,40
97.03
rotate
47.85
88.90
97.08
The near OOD experiments are summarized in Table 5, where we take CIFAR-10 as ID data and CIFAR-100 as OOD data. Here, the common learning setup (common) already leads to improved performance compared to the cases without watermarking (w/o watermark). Moreover, watermarking with shifting augmentations (permute and rotate) can further boost the detection power of the models, leading to at most 8.60 and 4.70 improvements in FPR95 for the softmax and the free energy scoring.
Effect of Hyper- pappe-parameter.. To further interpret learning framework, compare the per- formance of the learned watermarks regarding various setups of hyper-parametts parameters, focusing on the standard deviation 01 in the Gaussian noise and the perturbation constraint p in the SAM, which both critical. As a case study, we conduct experiments regarding the softmax scoring on CIFAR-10. For detailed results about the ablation study, please refer to Appendix C.
Table lists the results with various values of σ1, ranging from 0.00 2.00. Note that a is the standard deviation of the Gaussian noise added to the watermark, with different values indicating
8

---

Table 6: The average performance of the soft- max scoring on CIFAR-10 dataset with various values of the parameter ø1. The notion (1) indicates smaller (larger) values are preferred.
Table 7: The average performance of the soft- max scoring on CIFAR-IO 10 dataset with various values of the parameter p. The notion / (1) in- dicates smaller (larger) values are preferred.
1
FPR95 4
AUROC1 f
AUPR t
p
FPR95
AUROC f
AUPR
2,00
42.11
92.01
98.24
5.00
60.02
87.36
97.15
1.60
41.41
92.14
98.25
1,000
39.12
92.96
98.42
1.20
41.98
91.91
98.20
0,50
43.55
92.38
98. 34
0.80
43.38
91.89
98.21
0.10
41,99
92.77
98.4 98.41
0.40
38.66
93.03
98.45
0.05
42.06
92.84
98.42
0.00
48.71
91.43
98.11
0.00
43,04
92.44
98.32
various degrees of the perturbation. As see, a mild perturbation of the watermark (e.g., T1 = 0.40) can truly lead to improved results in detection, with 10.05, 1.60, and 0.34 improvements regarding the average FPR95, AUROC, and AUPR. It indicates that the learned watermark is sensitive when facing small perturbations, if the Gaussian noise is not applied during training. However, some extreme values (e.g., 0 2.00) may overwhelm the watermark pattern and thus be detrimental.
In Table 7, we summarize the experimental results given by various values of for the SAM. Overall, large value of p indicates that wide range in the solution's 's neighbours should be smooth, and thus the stability of the result is expected to be improved. However, such solution may consume too much capacity of the watermark, misleading the learning procedure some unsatisfactory results. On the other side, our watermarking truly benefits from the SAM with a mild choice of the syper-parameter Specifically, comparing with the results without the SAM (i.e., P 0.00), the detection capability of the watermark with a suitable (i.e., P = 1.0) is largely improved, with 3.92, 0.52, and 0.10 better results regarding the average FPR95, AUROC, and AUPR.
Transferability of watermarking. Further, we ex- plore the transferability of the watermarking strat-
egy learned with different scoring functions, e.g., we study the effect of the watermark learned with the softmax scoring when it is deployed with the free energy scoring. The results are summarized in Ta- ble 8. Note that, a "learn" with FE and "score" with SM indicates that the watermark is learned with the free energy scoring and tested regarding the softmax scoring. As we can see, the watermarks learned with the free energy scoring can be reused for the softmax scoring (even with better results), while the reverse leads a deterioration. It indicates that our learning objectives in Eq. (10) are general and effective for both the softmax scoring and the free energy scoring. However, we do not observe any transferability be- tween different datasets. For example, for the softmax scoring, when the watermark learned on CIFAR-10 is adopted for CIFAR- 100, there is drop of perfor- mance with 51.93 (from 42.86 to 79), 35.29 (from 92.91 to 57.62) and 12.00 (98.42
Table 8: Transferability of watermarking
across scoring functions. SM denotes softmax scoring and FE denotes free energy scoring.
leurn
score
FPR95 1
AUROCT
AUPR 1
CIFAR-10 10
SM FE
SM
42,86
92.91
98.42
SM
40.19
94.83
98,99
FE
FE
23.69
95.21
98.83
SM
FE
28.22
94.70
98.81
CIFAR- 100
SM
SM
79.98
77.57
94,61
FE
SM
77.07
76.27
94.02
FE
FE
77.07
79.93
95.18
SM
FE
78.48
79.24
94.56
42 to 86.42)
regarding the average FPR95, AUROC, and AUPR. Further studies may be required here.
7 Conclusion
This paper demonstrates that the model's inherent capability in OOD detection can be largely improved with only data-level manipulation, where we propose a general and effective methodology named watermarking. Overall, we learn discriminative pattern that could be superimposed onto original inputs, such that the OOD scores become much separable between ID and OOD data. Our results indicate promising direction in OOD detection that warrants our exploration in the future. Further investigation should focus on the stability in optimization and general learning objectives regarding advanced OOD detection methods.

---

Acknowledgments and Disclosure of Funding
QZW, YGZ and BH were supported by the RGC Early Career Scheme No. 22200720, NSFC Young Scientists Fund No. 62006202, Guangdong Basic and Applied Basic Research Founda- tion No. 2022A151501 1652, RGC Research Matching Grant Scheme No. RMGS2022 11_10000 1_02 and No. RMGS2022_ 13 06, and HKBU CSD Departmental Incentive Grant. CG was supported by NSF of China No. 61973162. NSF of Jiangsu Province No. BZ2021013, NSF for Distinguished Young Scholar of Jiangsu Province No. BK20220080, and the Fundamental Research Funds for the Central Universities No. 30920032202 and No. 30921013114, 14. TL was partially supported by Australian Research Council Projects DPI80103424 1E-190101473 IC-190100031, DP-220102121, and FT-220100318.
References
[1] Bitterwolf, A. Meinke, and M. Hein. Certifiably adversarially robust detection of out-of- distribution data. In NeurIPS, 2020.
[2] X. Chen, X. Lan, F. Sun, and N. Zheng, A boundary based out-of-distribution classifier for generalized zero-shot learning. In ECCV, 2020.
[3] S. Choi and Chung. Novelty detection via blurring. In ICLR, 2020.
[4] M. Cimpoi, S. Maji, I. Kokkinos, S. Mohamed, and A. Vedaldi. Describing textures in the wild. In CVPR, 2014.
[5] J. Davis and M. Goadrich. The relationship between precision-recall and ROC curves. In ICML,
2006.
[6] Deng, W. Dong, R. Socher, L. Li, K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009,
[7] T. Veiries and G. W. Taylor. Learning confidence for out-of-distribution detection in neural networks. arXiv preprint arXiv: 04865, 2018.
[8] A. Dosovitskiy, L. Beyer, Kolesnikov, D. Weissenborn, Zhai, T. Unterthiner, M. Dehghani. M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. ICLR, 2021.
[9] G. F. Elsayed, I. Goodfellow, and Sohl-Dicksteins Adversarial reprogramming of neural networks. In ICLR, 2019.
[10] P. Foret, A. Kleiner, H. Mobahi, and B. Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In ICLR, 2021.
[11] J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[12] T. Gu, K. Liu, B. Dolan- and S. Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230 47244, 2019.
[13] K. Hambardzumyan, H. Khachatrian, and May. Warp: Word-level adversarial reprogramming. In ACL, 2021.
[14] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In CVPR, 2016.
[15] M. Hein, M. Andriushchenko, and J. Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In CVPR, 2019.
[16] D. Hendrycks, S. Basart, M. Mazeika, A. Zou, J. Kwon, M. Mostajabi, and J. Steinhardt. Improving and assessing anomaly detectors for large-scale settings. 2021.
[17] D. Hendrycks and K. Gimpel. baseline for detecting misclassified and out-of- examples in neural networks. In ICLR, 2017.
10

---

[18] D. Hendrycks, M. Mazeika, and T. G. Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019.
[19] D. Hendrycks, N. Mu, E. Cubuk, B. Zoph, Gilmer, and Lakshminarayanan. Augmix: simple data processing method to improve robustness and uncertainty. In ICLR, 2020.
[20] H. Huang. Z. Li, L. Wang, S. Chen, B. Dong, and X. Zhou. Feature space singularity for out-of-distribution detection. In safeAl, 2021.
[21] R. Huang, Geng, and Y. Li. On the importance of gradients for detecting distributional shifts in the wild. In NeurlPS, 2021.
[22] R. Huang and Y. Li. MOS: towards scaling out-of-distribution detection for large semantic space. In CVPR, 2021.
[23] Z. Huang, X. Xia, L. Shen, B. Han, M. Gong, C. Gong, and T. Liu. Harnessing out-of- distribution examples via augmenting content and style. arXiv preprint arXiv:2207.03162, 2022.
[24] N. S. Keskar, D. Mudigere. J. Nocedal, M. Smelyanskiy, and P. T. Tang. On large-batch training for deep learning: Generalization gap and sharp minima. In ICLR, 2017.
[25] P. Kirichenko, P. Izmailov, and A. G. Wilson. Why normalizing flows fail to detect out-of- distribution data. In NeurlPS, 2020.
[26] A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. Technical Report TR-2009, University of Toronto, 2009.
[27] Y. Le and X. Yang. Tiny imagenet visual recognition challenge. CS 23/N, 7(7):3, 2015.
[28] K. Lee, K. Lee, H. Lee, and Shin. A simple unified framework for detecting out-of distrbbbiii samples and adversarial attacks. In NeurIPS, 2018
[29] Li Y. Jiang, Z. Li, and S.-T. Xia. Backdoor learning: A survey. IEEE Transactions Neural Networks and Learning Systems, pages 1-18, 2022.
[30] Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu. Invisible backdoor attack with sample-specific triggers. In ICCV, 2021.
[31] Y. Li, C. Wang, X. Xia, T. Liu, X. Miao, and B. An. Out-of-distribution detection with an adaptive likelihood ratio on informative hierarchical vae. In NeurIPS, 2022.
[32] S. Liang, Y. Li, and R. Srikant. Enhancing the reliability of out-of-distribttion image detection in neural networks. In ICLR, 2018.
[33] W. Liu, X. Wang, J. D. Owens, and Y. Li. Energy-based out-of-distribution detection. In NeurlPS, 2020.
[34] Y. Liu, X. Ma, J. Bailey, and F. Lu. Reflection backdoor: natural backdoor attack on deep neural networks. In ECCV, 2020.
[35] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[36] Mann. Numerically stable hidden markov model implementation. An HMM Scaling Tutorial, pages 1-8, 2006.
[37] P. Morteza and Y. Li. Provable guarantees for understanding out-of-distribution detection. In AAAI, 2022.
[38] E. Nalisnick, A. Matsukawa, Y. W. Teh, Görür, and B. Lakshminarayanan. Do deep generative models know what they don't know? In ICLR, 2019.
[39] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng. Reading digits in natural images with unsupervised feature learning. In NeurIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.

---

[40] A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In CVPR, 2015.
[41] J. Ren, J. Liu, E. Fertig, J. Snoek, R. Poplin, M. A. DePristo, J. V. Dillon, and B. Lakshmi- narayanan. Likelihood ratios for -fitt--iiistiuutiinn detection. NeurIPS, 2019.
[42] O. Russakovsky. J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. In IJV, 2015.
[43] A. Saha, A. Subramanya, and H. Pirsiavash. Hidden trigger backdoor attacks. In AAAI, 2020.
[44] C. S. Sastry and S. Oore. Detecting out-of-distribution examples with gram matrices. In ICML, 2020.
[45] Serrå, D. Álvarez, V. Gómez, O. Slizovskaia, F. Núñez, and Luque. Input complexity and out-of-distribution detection with likelihood-based generative models. In ICLR, 2020.
[46] Y. Sun, C. Guo, and Y. Li. React: Out-of-distribution detection with rectified activations. In NeurlPS, 2021.
[47] Tack, S. Mo, Jeong, and Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. In NeurlPS, 2020.
[48] S. Thulasidasan, Chennupati, J. A. Bilmes, T. Bhattacharya, and S. Michalak. On mixup training: Improved calibration and predictive uncertainty for deep neural networks. In NeurIPS, 2019.
[49] Y. Tsai, P. Chen, and T. Ho. Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources. In ICML, 2020.
[50] S. Vernekar, A. Gaurav, V. Abdelzad, T. Denouden, R. Salay, and K. Czarnecki. Out-of- distribution detection in classifiers via generation. In NewrlPS, 2019.
[51] H. Wang, W. Liu, A. Bocchieri, and Y. Li. Can multi-label classification networks know what they don't know? In NeurlPS, 2021.
[52] Q. Wang, F. Liu, Han, T. Liu, C. Gong, G. Niu, Zhou, and M. Sugiyama. Probabilistic margins for instance reweighting in adversarial training. In NewrlPS, 2021.
[53] Y. Wang, B. Li, T. Che, K. Zhou, Z. Liu, and D. Li. Energy-based open- uncertainty modeling for confidence calibration. In ICCV, 2021.
[54] Winkens, R. Bunel, G. Roy, R. Stanforth, V. Natarajan, J. Ledsam, P. Mac MalWilliass, P. Kohli, A. Karthikesalingam, and S. Kohl. Contrastive training for improved out- distrriiiti detection, arXiv preprint arXiv:2007.05566 2020.
[55] Z. Xiao, Q. Yan, and Y. Amit. Likelihood regret: An out-of-distributioo detection score for variational auto-encoder. In NeurIPS, 2020.
[56] P. Xu, K. A. Ehinger, Y. Zhang, A. Finkelstein, S. R. Kulkarni, and J. Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint 2015.
[57] C. H. Yang, Y. Tsai, and P. Chen. Voice2series: Reprogramming acoustic models for time series classification. In ICML. 2021.
[58] J. Yang, K. Zhou, Y. Li. and Z. Liu. Generalized out-of-disttrbution detection: A survey. arXiv preprint arXiv:21 2021.
[59] F. Yu, A. Seff, Y. Zhang, S. Song, T. Funkhouser, and J. Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans the loop. arXiv preprint arXiv: 1506. 0365, 2015.
12

---

[60] A. Zacemzadeh, N. Bisagno, Z. Sambugaro, N. Conci, N. Rahnavard, and M. Shah. Out-of- distribution detection using union of I-dimensional subspaces. In CVPR, 2021.
[61] Zagoruyko and N. Komodakis. Wide residual networks. BMVC, 2016.
[62] L. H. Zhang, M. Goldstein, and R. Ranganath. Understanding failures in out-of-distribttion detection with deep generative models. In ICML, 2021.
[63] B. Zhou, A. Lapedriza, A. Khosla, A. Oliva, and A. Torralba. Places: million image database for scene recognition. IEEE Transactions Pattern Analysis and Machine Intelligence, 40(6))1452-1146) 1464, 2018.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [No]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material URL)? [Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes]
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [N/A]
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any assets either in the supplemental material URL? [No]
(d) Did you discuss whether and how consent was obtained from people whose data you'l 're using/curating? [No] We use only standard datasets
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [No] We use only standard datasets
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent participant compensation? [N/A]
13


Reviews:
[{"review_id": "OujBX2wyvwJ", "reviewer": "Reviewer_qcRd", "summary": "This paper presents an out-of-distribution (OOD) detection method called “watermarking”, inspired by adversarial reprogramming. Given a scoring function that measures how in-distribution an image is, the method is to learn a fixed additive perturbation, later applied to test images, such that in-distribution images have high scores, and the perturbation has a low score. The authors claim that this will translate to being able to distinguish in vs out (i.e. OOD images with the additive perturbation will yield lower score) since OOD data was not observed during training, only the watermark. With the addition of some tricks (sign gradient descent and sharpness-aware minimization), watermarking is shown to improve OOD detection performance compared to not using watermark, on various scoring functions, and on various in-distribution datasets.", "questions": "- Could the authors elaborate on the motivation behind watermarking? \n- What was the validation OOD dataset used to tune the hyperparameters?\n- It seems like the sign is off for Equation 3 and Equation 11 (the higher the energy, the more OOD it should be). It seems like the sign is correct for the code though.\n- Figure 5 seems to be missing something. The text refers to LSUN-C and LSUN-R, but there is only LSUN in Figure 5.\n- The experiments testing watermarking’s impact on test accuracy (lines 272-279) doesn’t seem very relevant, since watermarking is only used to detect in vs out.\n- Lines 283-284 “watermark is learned with the softmax scoring and tested regarding the free energy scoring” -> “learned with free energy and tested with softmax scoring”?\n- The experiments testing the effect of masking my thresholding (lines 292-308) doesn’t seem very surprising, because the watermarks were trained to be a certain way, so there is no guarantee that changing parts of it abruptly, would do anything meaningful.\n", "limitations": "The authors have adequately addressed limitations of their work.", "rating": 4, "confidence": 4, "soundness": 1, "presentation": 2, "contribution": 1, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- To the best of my knowledge, the idea of learning an additive perturbation to improve OOD detection is novel.\n- The method is relatively simple, and doesn’t involve training a classifier or generative model.\n- The method can be used with various scoring functions, and it improves the OOD detection performance most of the time.\n\nWeaknesses:\n- The method is a bit ad hoc and the motivation is unclear. The authors claim that watermarking works because “the learning procedure does not see any OOD data during training”. If the only difference between test ID and OOD is that OOD data were not seen before, then why is watermarking necessary?\n- The method involves, and is sensitive to hyperparameters. Furthermore, unsurprisingly, the optimal hyperparameter setting seems to depend on the test OOD data. This limits the usage of this method. Additionally, the authors seem to have tuned the hyperparameters on a separate validation OOD dataset disjoint from the ones used to evaluate the tables, however, there is no mention of this validation dataset in the main paper of the appendix. Since the quality of the hyperparameters should depend on the validation dataset, it’s important to know how the performance changes depending on different choices of the validation datasets.\n- The evaluation of the method is limited. The evaluated ID and OOD pairs are very easy to distinguish, especially since CIFAR and ImageNet are very object-centric, while the OOD datasets are mostly scenery-based (except for SVHN, which are all numbers). I would like to see at the minimum, harder problems like CIFAR-10 vs CIFAR-100, which many papers already include, or ImageNet 1k vs ImageNet 21k (excluding ImageNet 1k). It would be great to see other more difficult datasets, like the ones used in open set recognition (e.g. the semantic shift benchmark from [1]) with bigger models like the Vision Transformer.\n\n[1] Vaze, Sagar, et al. \"Open-set recognition: A good closed-set classifier is all you need.\" \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "BPD9S8oB4bZ", "reviewer": "Reviewer_dM3K", "summary": "The paper proposes a method to improve the OOD detection capability of the existing OOD methods. The paper relies on the \"reprogramming\" property of DNNs and learns watermarks that, when applied, can better separate the ID and OD data as in existing methods. The paper proposes an algorithm to learn these watermarks more effectively. Experimental results demonstrate that the proposed method can improve the OOD performance of the existing OOD detection methods. The paper also includes several qualitative analysis to study various aspects of the proposed method, including ablation studies, and transferability. ", "questions": "In general, I find the study of reprogramming in the context of OOD interesting. However, I'm concerned about the practicality of the proposed method as mentioned in the weakness comments. ", "limitations": "The paper does not explicitly mention the limitation but I think it is discussed in some parts. I would appreciate it if the paper could provide a dedicated section to discuss the limitation of the method.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper proposes an interesting approach to improve the performance of the existing OOD methods. In general, I find the paper's contribution novel:\n1) A nice motivation for the study of reprogramming in the context of OOD. I can see that the proposed method helps improve the separation of ID and OD data.\n2) The proposed algorithm seems to be effective in learning the watermarks.\n3) The experiments at least demonstrate the core results of the task, and the benefits of the proposed approach.\n\nI, however, also have some concerns/comments:\n\n1) I can see that in practice, we don't have access to the OD dataset. And there's a large variation in the OOD performance as reported in the ablation study. How exactly do we choose the hyperparameters? Will selecting the wrong hyperparameters can even hurt OOD performance. I'm also not sure about the detail of the ablation experiments (I don't seem to be able to find it in appendix). What OD dataset is used?\n2) The previous comment is particularly important when the performance improvements of the proposed method saturate when the dataset has more classes or becomes more complex (e.g., cifar100 or imagenet). This makes the proposed method not favorable to be used in practice. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "07-0TcR_qU", "reviewer": "Reviewer_WTn8", "summary": "OOD detection aims to detect OOD data given only ID data or ID classifier. Since OOD data may cause risks when deploying the deep learning models into the real world, it is important to detect OOD data (like this paper considering). Based on my experience, this paper considers a setting where only ID classifiers are available and it is unavailable to see the ID data. Thus, the performance on ID classes will be maintained naturally. Given only the models, previous methods proposed score functions to determine if a data point is OOD, which is a natural way to utilize the models’ information. However, this paper argues that there might be another way to use the models, i.e., reprograming the models via changing data slightly. Compared to previous methods, this paper considers using the models from a higher level (based on the model reprograming property of deep models), which is very novel and interesting. \n\nFrom the technical level, the proposed watermarking strategy is also novel and different from previous reprograming methods. Extensive experiments verify that the proposed OOD detection methods are useful and performs better in general.", "questions": "Please see weakness.", "limitations": "The authors have addressed the limitation part. There are no ethical concerns regarding the proposed strategy.", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Pros:\n\n1.  Reprogramming property of deep models is first used for OOD detection, which makes good contributions to the field of OOD detection. Previous methods only use models’ outputs and do not fully use the reprogramming property of deep models. This paper considers this property and successfully uses this property to address the OOD detection problem, which is novel. \n\n2. In previous post-hoc OOD detection methods, there are no tuning parameters after selecting a score function, which does not fully use the models’ information. However, this paper breaks through this situation and shows that we can further utilize the models’ information.\n\n3. Previous reprogramming methods cannot be directly used for OOD detection, and this paper makes a new contribution to this field by proposing the watermarking strategy, which is novel.\n\n4. Experiments verify the performance of the watermarking strategy, which is solid evidence that the reprogramming property of deep models can also help address the OOD detection problem. This finding will motivate more work in this field. It is appreciated that the performance is also tested on ImageNet benchmark datasets.\n\nCons:\n\n1. When training the watermarks, additional noise is introduced. The proposed methods seem to use more information than previous methods. Why do previous methods not use this information? Are your methods the only methods that can use this information in post-hoc OOD detection? More explanations are required here. \n\n2. It is better to explain the use of Eq. (6). This optimization procedure seems very important to the method but lacks enough explanation. \n\n3. In the free-energy version, how to set the hyperparameter T? How does the value of T influence the performance of free-energy watermarking method?\n\n4. The results regarding ImageNet benchmark should be moved into the main context instead of the appendix, which can help demonstrate the performance of watermarking strategy better.\n\n5. In the whole paper, the data use ID and OOD to represent the ID or OOD data. While the loss functions use IN and OUT to present parts regarding ID and OOD. Keeping both consistencies is a better option.\n\n6. Adding some specific noise into data can have a great impact on the model’s output, which has been verified in many areas. Watermark is one of them. How to analyse the power of watermark in math? Necessary discussions are required. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept