RankFeat: Rank-1 Feature Removal for Out-of-distribution Detection
Authors: Yue Song
Nicu Sebe
Wei Wang
Venue: NeurIPS 2022 Accept (2022)
Keywords: out-of-distribution detection
distribution shifts

Abstract: The task of out-of-distribution (OOD) detection is crucial for deploying machine learning models in real-world settings. In this paper, we observe that the singular value distributions of the in-distribution (ID) and OOD features are quite different: the OOD feature matrix tends to have a larger dominant singular value than the ID feature, and the class predictions of OOD samples are largely determined by it. This observation motivates us to propose RankFeat, a simple yet effective post hoc approach for OOD detection by removing the rank-1 matrix composed of the largest singular value and the associated singular vectors from the high-level feature. RankFeat achieves state-of-the-art performance and reduces the average false positive rate (FPR95) by 17.90% compared with the previous best method. Extensive ablation studies and comprehensive theoretical analyses are presented to support the empirical results.

RankFeat: Rank-1 Feature Removal for Out-of-distribution Detection
Yue Song', Nicu Sebe', and Wei Wang
! 'Department of Information Engineering and Computer Science, University of Trento, Italy "Beijig Jiaotong University, China yue. songuunitn.
Abstract
The task of out-of-distribution (OOD) detection is crucial for deploying machine learning models in real-world settings. In this paper, we observe that the singular value distributions of the in-distribution (ID) and OOD features quite different: the OOD feature matrix tends to have larger dominant singular value than the ID feature, and the class predictions of OOD samples are largely determined by it. This observation motivates us to propose RankFeat, a simple yet effective post hoc approach for OOD detection by removing the rank- I matrix composed of the largest singular value and the associated singular vectors from the high-level feature. RankFeat achieves otate-of-the-al performance and reduces the average false positive rate (FPR95) by 17.90% compared with the previous best method. Extensive ablation studies and comprehensive theoretical analyses presented support the empirical results.
Introduction
In the real-world applications of deep learning, understanding whether test sample belongs to the same distribution of training data is critical to the safe deployment of machine learning models. The main challenge stems from the fact that current deep learning models can easily give over-confident predictions for dittr---dittiittion (OOD) data [43 Recently rich line of literature has emerged to
address the challenge of OOD detection 66 27
66
15 [8]
Previous OOD detection approaches either rely on the feature distance (38. activation abnormal- ity (52). or gradient norm [27]. this paper, we tackle the problem of OOD detection from another perspective: by analyzing the spectrum of the high-level feature matrices (e.g.. the output of Block or Block 4 of a typical ResNet [19] model), we observe that the feature matrices have quite different singular value distributions for the in-distribution (ID) and OOD data (see Fig. aa)): the OOD feature tends to have a much larger dominant singular value than the feature, whereas the magnitudes of the rest singular values are very similar. This peculiar behavior motivates us to remove the rank- matrix composed of the dominant singular value and singular vectors from the feature. As displayed in Fig. [b), removing the rank-1 feature drastically perturbs the class prediction of OOD samples; majority of predictions have been changed. On the contrary. most ID samples have consistent classification results before and after removing the subspace. This phenomenon indicates that the over-confident prediction of OOD samples might be largely determined by the dominant singular value and the corresponding singular vectors.
Based on this observation, we assume that the first singular value of OOD feature tends be much larger than that of ID feature. The intuition behind is that the OOD feature corresponds to larger
Wei Wang is the corresponding author.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Gaas Prodetun or Datr Imppliblll
Glans Predectrr
000
Dora sin
fard
1150
1000 11000
11:0
1000
Sirelto
(a)
(b)
Figure 1: (a) The distribution of top-5 singular values for the ID and OOD features on ImageNet- 1 and SUN. The OOD feature matrix tends to have significantly larger dominant singular value. (b) After removing the rank-1 matrix composed by the dominant singular value and singular vectors, the class predictions of OOD data are severely perturbed, while those of ID data are moderately influenced. This observation indicates that the decisions of OOD data heavily depend on the dominant singular value and the corresponding singular vectors of the feature matrix. In light of this finding, we get motivated to propose RankFeat for OOD detection by removing the rank-1 matrix from the high-level feature. Both observations also hold for other OOD) datasets.
10M-
Energy
63.69%
73.02%
FPR95
20
ca-
1:2
600
604-
027
PectShed Stw. Tnstet
Seatraa Bure Www.Ree.....c..cccocc Bo Seater
Taet Disttaaion Testars Tabert
RenkFeat (Block 4)
scr-
EaT-
FPR96 46.51%
FPR96 27.88%
38.26%
FPR96 46.00%
540-
Figure 2: The score distributions of Energy 40 (top row) and our proposed RankFeat (bottom row)
on four OOD datasets. Our method can better separate the ID and OOD data.
PCA explained variance ratio (being less informative), and the well-trained network weights might cause and amplify the difference (see See. E of the supplementary for the detailed illustration). Hence, we conjecture that leveraging this gap might help to better distinguish ID and OOD samples. To this end, we propose RankFeat, a simple but effective post hoc approach for OOD detection. RankFeat perturbs the high-level feature by removing its rank-1 matrix composed of the dominant singular value and vectors. Then the logits derived from the perturbed features are used to compute the OOD score function. By removing the rank-1 feature, the over-confidence of OOD samples is mitigated, and consequently the ID and OOD data can be better distinguished (see Fig. 2). Our RankFeat establishes the state-of-tt of-te--o-eeeea thr- performance the large-scale ImageNet benchmark and a suite of widely used OOD datasets across different network depths and architectures. In particular, RankFeat outperforms the previous best method by 17.90% in the average false positive rate (FPR95) and by 5.44% in the area under curve (AUROC). Extensive ablation studies are performed to reveal important insights of RankFeat, and comprehensive theoretical analyses are conducted to explain the working mechanism. Code is publicly available via https:://// thub. com/ King JanesSonn/nSnn//a/mmo RRang//ann.F.....
The key results and main contributions threefold:
We propose RankFeat, a simple yet effective post hoc approach for OOD detection by removing the rank-1 matrix from the high-level feature. RankFeat achieves the state-of-the- art performance across benchmarks and models, reducing the average FPR95 by 17.90% % and improving the average AUROC by 5.44% compared to the previous best method.

---

We perform extensive ablation studies to illustrate the impact of (1) removing or keeping the rank-1 matrix, (2) removing the rank-n matrix (n>1), (3) applying our RankFeat at various network depths, (4) the number of iterations to iteratively derive the approximate rank-1 matrix for acceleration but without performance degradation, and (5) different fusion strategies to combine multi-scale features for further performance improvements.
Comprchensive theoretical analyses are conducted to explain the working mechanism and underpin the superior empirical results. We show that (I) removing the rank-1 I matrix reduces the upper bound of OOD score more, (2) removing the rank-1 I matrix makes the statisties of OOD feature closer to random matrices, and (3) both RankFeat and ReAct [52]
work by optimizing the upper bound containing the largest singular value. ReAct [52
indirectly and manually clips the underlying term, while RankFeat directly subtracts
2 RankFeat: Rank-1 Feature Removal for OOD Detection
In this section, we introduce the background of OOD detection task and our proposed RankFeat that performs the OOD detection by removing the rank-1 matrix from the high-level feature.
Preliminary: OOD detection. The OOD detection is often formulated as binary classification problem with the goal distinguish between ID and OOD data. Let denote model trained on samples from the ID) data Din- For the unseen OOD data Dout at test time, OOD detection aims to define a decision function ((-):
((x) in
S(x) > 7, S(x) < 7
(1)
out
where denotes the data encountered the inference stage, S(-) is the seeking scoring function, and y is a chosen threshold to make a large portion of ID data correctly classified (e.g., 95%). The difficulty of OOD detection lies in designing an appropriate scoring function S(-) such that the score distributions of ID and OOD data overlap as little as possible.
rank-1 feature removal. Consider the reshaped high-level feature map XERC of a deep network (the batch size is omitted for simplicity). Here 'high-level feature' denotes the feature map that carries rich semantics in the later layers of network (e.g.. the output of Block or Block of typical deep model like ResNet). Our RankFeat first performs the Singular Value Decomposition (SVD) each individual feature matrix in the mini-batch to decompose the feature:
RankFeat:
X USVT
where SERCHHW is the rectangular diagonal singular value matrix, and UERCxC and HW HHW HWW are left and right orthogonal singular vector matrices, respectively. Then RankFeat removes the rank-1 matrix from the feature
X' - --X-sjuvv S
(3)
where 8₁ is the largest singular value, and u and v1 are the corresponding left and right singular vectors, respectively. The perturbed feature is fed into the rest of the network generate the logit predictions y'. Finally, RankFeat computes the energy score of the logits for the input x as:
RankFeat(x) log Σ exp(y')
By removing the rank- matrix composed by the dominant singular value S1, the over-confident predictions of OOD data are largely perturbed. In contrast, the decisions of ID data are mildly influenced. This could help to separate the ID and OOD data better in the logit space.
Acceleration by Power Iteration. Since RankFeat only involves the dominant singular value and vectors, there is no need to compute the full SVD of the feature matrix. Hence our method can be potentially accelerated by Power Iteration (PI). The PT algorithm is originally used to approximate the dominant eigenvector of a Hermitian matrix. With a slight modification, it can also be applied to general rectangular matrices. Given the feature X, the modified Pl takes the coupled iterative update:
Xug
vT X |
T
Vk
ug+1
(5)
Xug]l
X
3

---

where Up and Vo are initialized with random orthogonal vectors and converge to the left and right singular vectors, respectively. After certain iterations, the dominant singular value is computed as 81 $1=v Xug. As will be illustrated in Sec. 4.3 the approximate solution yielded by PI achieves very competitive performance against the SVD but with much less time overhead.
Combination of multi-scale features, Our RankFeat works at various later depths of a model, i.e., Block and Block 4. Since intermediate features might focus on different semantic information, their decision cues are very likely to be different. It is thus natural to consider fusing the scores to leverage the distinguishable information of both features for further performance improvements. Let y' and y" denote the logit predictions of Block and Block 4 features, respectively. RankFeat performs the fusion the logit space and computes the score function as log Σ exp (y' +y))/2) Different fusion strategies are explored and discussed in Sec. 4.3
3 Theoretical Analysis
In this section, we perform some theoretical analyses on RankFeat to support the empirical results. We start by proving that removing the rank-1 feature with a larger $1 would reduce the upper bound of RankFeat score more. Then based on Random Matrix Theory (RMT), we show that removing the rank-1 matrix makes the statistics of OOD features closer to random matrices. Finally, the theoretical connection ReAct and our RankFeat analyzed and discussed: both approaches work by optimizing the score upper bound determined by sT. ReAct manually uses a pre-defined threshold to clip the term with S1, whereas our RankFeat directly optimizes the bound by subtracting this term.
Removing the rank-1 1 matrix with larger sı would reduce the upper bound of RankFeat more. For our RankFeat score function, we can express its upper bound in an analytical form. Moreover, the upper bound analysis explicitly indicates that removing the rank-1 matrix with larger first singular value would reduce the upper bound more. Specifically, we have the following proposition.
Proposition! 1. The upper bound of RankFeat score is defined as RankFeat(x)) < HWW [E>= s;
$1 || - -lbllo + log(Q) where Q denotes the number of categories, and W and b are the weight and bias of the last layer, respectively. larger $1 would reduce the upper bound more.
Proof. For the feature XERC its SVD USVT=X can be expressed the summation of rank-1 1 matrices X x=Σ Es..v The feature perturbed by RankFeat can computed as:
N
X
Σ s.u.v
(6)
where N denotes the shorter side of the matrix (usually N-HW). In most deep models 19 20 usually the last feature map needs to pass Global Average Pooling (GAP) layer collapse the width and height dimensions. The GAP layer can be represented by a vector
HW
The pooled feature map is calculated as X' mm Then the output logits are computed by the matrix- vector product with the classification head as:
y' wX'
Σ ss Wu.ym +
(8)
where WxR denotes the weight matrix, beRQx1 represents the bias vector, and y is the output logits that correspond to the perturbed feature X'. Our RankFeat score is computed as:
RankFeat(x) = log exp(y')
where x the input image, and Q denotes the number of categories. Here we choose Energy 40 as the base function due to its theoretical alignment with the input probability density and its strong

---

empirical performance. Eq. 9 can be re-formulated by the Log-Sum, trick
log exp(y') = log exp(y/ - max(yy) + max(y')
(10)
The above equation directly yields the tight bound as:
max(y') log Σ exp(y') < max(y') log(Q)
(11)
Since max (y')s max((>()==1>1)))) loo. we have
RankFeat(x)) = log Σ exply') < max(y') + (og(() - |y' + log(()
(12)
The vector norm has the property of triangular inequality, i.e,, ||a cl| I |a|| + ||||| holds for any vectors a and c. Moreover, since both u and v are orthogonal vectors, we have the relation |ulloo $1 and V 31. Relying on these two properties, injecting eq. (8) into eq. (12) leads to
RankFeat(x) Σ s,l Wu,v, mlll |||l log(Q)= Σ s; Wm -c +|blll log(Q) (13)
Since m is scaled all-ones vector, have [m b0 | / Nw. The bound is simplified as:
RankFeat(x)
HW Σ s; s1
| + | |bll + log(Q)
(14)
As indicated above, removing a larger 8 would reduce the upper bound of RankFeat score more.
Considering that OOD feature usually has a much larger 81 (see Fig. [a)), RankFeat would reduce the upper bound of OOD samples more.
Remark:
Notice that our bound analysis strives to improve the understanding of OOD methods from new perspectives instead of giving strict guarantee of the score. For example, the upper bound can be used to explain the shrinkage and skew of score distributions in Fig. 2 Subtracting S1 would largely reduce the numerical range of both ID and OOD scores, which could squeeze score distributions. Since the dominant singular value S contributes most to the score, removing 81 is likely to make many samples have similar scores. This would concentrate samples in smaller region and further skew the distribution. Given that the OOD feature tends to have a much larger 81, this would have a greater impact OOD data and skew the OOD score distribution more.
Block
Block
Bileety
The exemplary eigenvalue distribution of ID/OOD feature and the fitted MP distribution. After the rank-l matrix is removed, the lowest bin of OOD feature has a larger reduction and the middle bins gain some growth, making the ODD feature statistics closer to the MP distribution.
Figure 3:
Removing the rank-1 matrix is likely make the statisties of OOD features closer to random matrices. Now we turn to use RMT to analyze the statistics of OOD and ID feature matrices. For random matrix of given shape, the density of its eigenvalue asymptotically converges to the [50] Formally, we have:
Manchenko-Parn Pastur (MP) distribution 41
Theorem (Manchenko-F Pastur Law 41 501). Let X be a random matrix of shape txn whose entries are random variables with E(X,, = 0) and E(X;, = 1). Then the eigenvalues of the sample covari-
ance Y = LXX" converges to the probability density function: p()) ((x X)
for E
A
[A_, A+] where >_ -1=0((1- 2 and 24=0² + / 2
5

---

This theorem implies the possibility to measure the statistical distance between ID/OOD features and random matrices. To this end, we randomly sample 1, 000 ID and OOD feature matrices and compute the KI. divergence between the actual eigenvalue distribution and the fitted MP distribution.
Table 1: The KL divergence between ID/OOD feature and the fitted MP distribution. When the rank-1 feature is removed, the statistics of OOD matrix are closer to random matrices.
Matrix Type
Block
Block
ID
OOD
ID
OOD
Original feature matrix
18.36
18.24
11.27
11.18
Removing rank-1 matrix
17.07 ( 1.29)
15.79 () 2.45)
9.84 ( 1.45)
8.71 (U 2.47)
Fig. andd Table present the exemplary eigenvalue distribution and the average evaluation results of Block and Block features, respectively. For the original feature, the OOD and ID feature matrices exhibit similar behaviors: the distances to the fitted MP distribution are roughly the same (di fdiff.=0) f.0...). However, when the rank-1 matrix is removed, the OOD feature matrix has a much larger drop in the KL divergence. This indicates that removing the rank-1 matrix makes the statistics of OOD feature closer to random matrices, i.e., the OOD feature is very likely to become less informative than the ID feature. The result partly explains the working mechanism of RankFeat: by removing the feature matrix where OOD data might convey more information than ID data, the two types of distributions have a larger discrepancy and therefore can be beller sepurated.
Connection with ReAct [52]. ReAct clips the activations at the penultimate layer of a model to distinguish ID and OOD samples. Given the feature X and the pooling layer m, the perturbation can be defined as:
mim,Xm,7 7) = Xm max T, T.
(15)
where r a pre-defined threshold. Their method shares some similarity with RankFeat formulation Xm-sjuivi m. Both approaches subtract from the feature portion of information that is most likely cause the over-confidence of OOD prediction. ReAct selects the manually-definee threshold based on statistics of the whole ID set, while RankFeat generates the structured rank-1 I matrix from the feature itself. Taking a step further, ReAct has the score inequality following eq. (12
ReAct(x) < WXm W max max(Xm т, 7) + |/b|ls + log(Q)
(16)
Since X is non-negative (output of ReLU), we have (xm) 2 max(X)/HW Exploiting the vector norm inequality ||||>>|XX the above inequality can be re-formulated as:
||||| leads to the relation max(X) (X)2*1/ (/1))/////rTt /VeNW. Relying on this property,
N
ReAct(x)
<
Σ
s W
max
VCHW T, 0)] Wl + |lbllo + +Qg(() (17)
S1
HW
HW
As indicated above, the upper bound of ReAct is also determined by the largest singular value $1. In contrast, the upper bound of our RankFeat can be expressed as:
1 HW
RankFeat(x)
S W
W
+ ||bllo o0 + log(()
(18)
HW
The upper bounds of both methods resemble each other with the only different term boxed. From this point of view, both methods distinguish the Il) and OOD data by eliminating the impact of the term containing Sı in the upper bound. ReAct optimizes by clipping the term with a manually-den threshold, which is indirect and might be sub-optimal. Moreover, the threshold selection requires statisties of the whole ID set. In contrast, our RankFeat does not require any extra data and directly subtracts this underlying term which is likely to cause the over-confidence of OOD samples.
Experimental Results
In this section, we first discuss the setup in Sec. 4.1 and then present the main experimental results on ImageNet-Ik in See. 4.2 followed by the extensive ablation studies in Sec. 4.3

---

4.1 Setup
Datasets. In line with 26 52
we mainly evaluate our method on the large-scale ImageNet-
Ik benchmark [6]. The scale dataset is more challenging than the traditional CIFAR bench- mark [66] because the images are more realistic and diverse (i.e. 1.28M images of 1, 000 classes). For the OOD datasets, we select four testsets from subsets of iNaturalist [58). SUN (3] Places 770.
and Textures []. These datasets are crafted by (66 with non-overlapping categories from ImageNet- 1k. Besides the experiment on the large-scale benchmark, we also validate the effectiveness of our approach on Species 24 and CIFAR (36] benchmark. (see Supplementary Material).
Baselines. We compare our method with 6 recent post hoc OOD detection methods, namely MSP [22].
ODIN [3), Energy 40,, Mahalanobis (38, GradNorm 277 and ReAct [52]] The detailed illustra- tion and settings of these methods are kindly referred to Supplementary Material.
Architectures. In line with (27), the main evaluation is done using Google BiT-S model [35] pretrained on ImageNet-IK with ResNetv2-101 [20]. We also evaluate the performance on SqueezeNet [29), alternative tiny architecture suitable for mobile devices and T2T-ViT-24 (67). a tokens-to-tokens vision transformer that has impressive performance when trained from scratch.
For the implementation details and evaluation metrics, please refer to Supplementary Material.
Table Main evaluation results on ResNetv2-101 20 All values are reported in percentages, and these post hoc methods are directly applied to the model pre-trained on ImageNet-16 1k 6 The best three results are highlighted with red, blue, and cyan.
INaturalist
SUN
Places
Textures
Average
Methods
FPR95
AUROC (1)
FPR9S (1)
AUROC (1)
FPR9S (1)
AUROC
FPR95 (1)
AUROC
FPR95 (U)
AUROC
(1)
(1)
(1)
(1)
MSP
63.69
87.59
79.89
78.34
81.44
76.76
82.73
74.45
76.96
79.29
ODIN
39
62.69
89.36
71.67
83.92
76.27
80.67
81.31
76.30
72.99
82.56
Energy
40
64.91
88.48
65.33
85.32
73.02
81.37
80.87
75.79
71.03
82.74
Mahulanobis
38
96.34
46.33
88.43
65.20
89.75
64.46
52.23
72.10
81.69
62.02
GradNorm
27
50.03
90.33
46.48
89.03
60.86
84.82
61.42
81.07
$4.70
86.71
ReAct 52
44.52
91.81
52.71
90.16
62.66
87.83
70.73
76.85
57.66
86.67
RankFeat (Block 4)
46.54
81.49
27.88
92.18
38,26
88.34
46.06
89.33
39.69
87.84
RankFeat (Block
49.61
91.42
39.91
92.01
$1.82
88.32
41.84
91.44
45,80
90,80
RankFeat (Block 3
41.31
91.91
29.27
94.07
39.34
90.93
37.29
91.70
36.80
92.15
4.2 Results
Main results. Following 277, the main evaluation is conducted using Google BiT-S model 35 pretrained on ImageNet-1k with ResNetv2-101 architecture (20). Table compares the performance of all the post hoc methods. For both Block 3 and Block features, our RankFeat achieves best evaluation results across datasets and metrics. More specifically, RankFeat based the Block 4 feature outperforms the second-bes bascline by 15.01 % in the average FPR95, while the Block 3 feature-based RankFeat beats the second-best method by 4.09% in the average AUROC. Their combination further surpasses other methods by 17.90 in the average FPR95 and by 5.44% in the average AUROC. The superior performances at various depths demonstrate the effectiveness and general applicability of RankFeat. The Block feature has a higher AUROC but slightly falls behind the Block 4 feature in the FPR95, which can be considered compromise between the two metrics.
Our RankFeat is also effective on alternative CNN architectures. Besides the experiment on ResNetv2 200) we also evaluate our method on SqueezeNet (29), alternative tiny network suitable for mobile devices and on-chip applications. This network is more challenging because the tiny network size makes the model prone overfit the training data, which could increase the difficulty to distinguish between ID and OOD samples. Table Collectively, the performances of RankFeat Top top presents the performance of all the methods. fusion. Our RankFeat achieves the state-of-the baseline by 14.22% in FPR95 and by 7.48% % in AUROC.
very competitive at both depths, as well as the score performances, outperforming the second-best
Our FenkFeat also suits transformer- based architectures. To further demonstrate the applicabil- ity of our method, we evaluate RankFest Feat on Tokens-to-Toon to-Tokens Vision Transformer (T2T-VIT) (67]. a popular transformer architecture that can achieve competitive performance against CNNs when trained from scratch. Similar to the CNN, RankFeat removes the rank-1 matrix from the final token
7

---

Table 3: The results on SqueezeNet 29 and T2T-ViT-24 667. All values are reported in percentages, and these post hoc methods are directly applied to the model pre-trained on ImageNet-Ik Ik [6]. For results on SqueezeNet 22 the best three results are highlighted with red, blue, and cyan.
INaturalist
SUN
Places
Textures
Average
Model
Methods
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR05
AUROC
FPR95
AUROC
(1)
(1)
(f)
72.25
ODIN
90.79
65.75
78.32
78.37
83.23
73.31
92.25
43.43
86.15
65.17
Energy
20
79.27
73.30
$6.41
87.88
67.74
82.73
67.16
64.51
67.65
77.11
Maltalanohis
1
91.50
51.79
90.33
62. 18
92.33 26
56.63
58.60
67.16
83.17
59.
Neueezeeet
GradNorm
76.31
73,92
55
68.72
78-21
ReAct
36.78
66.37
51.05
RankFent (Blocck 4)
61.67
83.09
46.72
S8.31
61.31
80.52
38.04
$8.82
$1.94
85.19
RankPeat (Block 3)
71.04
81.50
49.18
90.43
62.94
85.82
50.14
79.32
58.33
84.28
RankIeat (Block 3 4)
65.81
83,06
46.64
90.17
61.56
84.51
42.54
$5,00
54.14
85.69
$1.37
ODIN
44.07
88.17
63.83
78.16
75.33
54.27
83.63
57.59
81.10
Energy 20
52.95
82.93
68.55
73.06
74.24
68.17
51.05
53.25
61.70
76.85
12T-V/T-24 h7
Maltalanohis
90.50
58.11
91.71
50.52
93.32
49.60
80.67
64.06
89.00
55. 15.58
GradNorm
99.30
25.86
28.06
25.71
92.68
29.61
52.17
81.03
RankFeat
50.27
87.81
57.18
84.33
66.22
80.89
32.64
89.36
$1.58
85.60
of T2T- before the last normalization layer and the classification head. Table bottom compares the performance T2T-ViT-24. Our RankFeat outperforms the second-best method by 6.11 % in FPR95 and by 2.05 % AUROC. Since the transformer models ( 67 do not have increasing receptive fields like CNNs, we do not evaluate the performance at alternative network depths.
Comparison against training-needed approaches. Since our method is post hoc, we only compare it with other post hoc baselines. MOS [26] and KL Matching [24] are not taken into account because MOS needs extra training processes and KL Matching requires the labeled validation set compute distributions for each class. Nonetheless, we note that our method can still hold an advantage against those approaches. Table 4 presents the average FPR95 and AUROC on the ImageNet- 1 benchmark. Our RankFeat achieves the best performance without any extra training validation set.
Table 4: Comparison against training-needed methods ImageNet-I1 based on ResNetv2-101 20
Method
Post hoc? Free Validation Set?
FPR95 (L)
AUROC (f)
KL Matching [4]
54.30
80.82
MOS (26
39.97
90.11
Feat
36.80
92.15
4.3 Ablation Studies
this subsection, we conduct several ablation studies based on Google-BiT-S ResNetv2-101 model.
Unless explicitly specified, we apply RankFeat the Block 4 feature by default.
Table 5: Ablation studies on keeping only the rank-1 matrix and removing the rank-n matrix.
iNaturalist
SUN
Places
Textures
Average
Baselines
FPR95
AUROC
FPR95 (1)
AUROC
FPR95 ())
AUROC
FPR95
AUROC
FPR95 (1)
AUROC
(L)
(t)
(f)
(1)
(U)
(f)
(t)
GradNorm
46.48
89.03
84.82
61.42
81.07
54,70
86.71
ReAct 53
44.52
91.81
52.71
90.16
62.66
87.83
70.73
76.85
57.66
86.67
Keeping Only Rank-1
48.97
91.93
62.63
84.62
72.42
79.79
49.42
88.86
58.49
86,30
Removing Rank-3
90.03
48.97
91.26
56.63
88.81
86.95
74.57
61.94
86.17
Removing Rank-2
50.04
89,30
48.55
90.99
56.23
88.38
76.86
81.37
57.92
87,51
Removing Rank-1
46.54
81.49
27.88
92.18
38.26
88.34
46.06
89.33
39.69
87.84
Removing the rank-1 matrix outperforms keeping only it. Instead of removing the rank- I matrix, another seemingly promising approach is keeping only the rank-1 matrix and abandoning the rest of the matrix. Table&5present presents the evaluation results of keeping only the rank-1 matrix. The performance falls behind that removing the rank-1 feature by 18.8% in FPR95, which indicates that keeping only the rank-1 feature is inferior to removing it in distinguishing the two distributions. Nonetheless,

---

it is worth noting that even keeping only the rank-1 1 matrix achieves very competitive performance against previous best methods, such as GradNorm [27] and ReAct [52].
Removing the rank-1 matrix outperforms removing the rank-n matrix 1) We evaluate the impact of removing the matrix of a higher rank, i.e., performing X Σ s;u,,; where n>1 1 for the high-level feature X. Table 5 compares the performance of removing the rank-2 matrix and rank-3 matrix. When the rank of the removed matrix increased, the average performance degrades accordingly. This demonstrates that removing the rank-1 matrix is the most effective approach to separate ID and OOD data. This result is coherent with the finding in Fig. Ta): only the largest singular value of OOD data is significantly different from that of ID data. Therefore, removing the rank-1 I matrix achieves the best performance.
Table 6: The ablation study on applying RankFeat to features at different network depths.
iNaturalist
SUN
Places
Textures
Average
Layer
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95 (.)
AUROC
FPR95
AUROC
(L)
(7)
(1)
(1)
())
(1)
(1)
(1)
(1)
Block
87.81
77.00
59.15
87.29
65.50
84.35
94.15
60.41
76.65
77.26
Block
71.84
85.80
61.44
86.46
71.68
81.65
87.89
72.04
73.23
81.49
Block
49.61
91.42
39.91
92.01
51.82
88,32
41.84
91.44
45.80
90.80
81.49
27.88
38.26
88.34
89.33
39.69
87.84
Block 3 and Block 4 features are the most informative. In addition exploring the high-level features at Block and Block 4, we also investigate the possibility of applying RankFeat to features at shallow network layers. As shown in Table the performances of RankFeat at the Block 1 and Block 2 features are not comparable to those at deeper layers. This is mainly because the shallow low-level features do not embed as rich semantic information the deep features. Consequently, removing the rank-1 I matrix of shallow features would not help to separate the ID and OOD data.
Table 7: The approximate solution by PI yields competitive performance and costs much less time consumption. The test batch size is set as 16.
Compotation Technique
Processing Time Per Image
INaturalist
SUN
Places
Textures
Average
FPR95 (.)
AUROC (f)
AUROC
FPR95
AUROC (1)
FPR95 (i)
AUROC (f)
FPRU5 (.)
AUROC
(ms)
(L)
(1)
(1)
(1)
GradNorm
27
80.01
50.03
90.33
46.48
89.03
60.86
84.82
61.42
81.07
$4.70
86,71
ReAct
8.79
44.52
91.81
90.16
62.66
87.83
20.73
57.66
86.67
SVD PI iter)
18.01
46.54
81.49
27.88
92.18
38.26
88.34
46.06
89.33
39.69
87.84
9.97
46.59
81.49
27.93
92.18
38.28
88.34
46.09
89.33
39.72
87.84
PI (3450 iter
9.47
46.58
81.49
27.93
92.17
38.24
58.34
46.12
89.32
39.72
$7.83
PI (2/20 lterr
9,22
46.58
$1.48
27.93
92.15
38,28
88.31
46
89.33
39.75
87,82
(#100 iter)
9.03
46.77
$1.29
PI (#5 iter)
9.00
48.34
79.81
30.44
89.71
41.33
84.97
45.34
89.41
41.36
85.98
The approximate solution by PI yields competitive performances. Table 7 compares the time consumption and performance of SVD and PI, as well as two recent state-of-the-en OOD methods ReAct and GradNorm. The performance of PT starts to become competitive against that of SVD (<0.1%) from 20 iterations on with 48.41 % time reduction. Compared with ReAct, the PI-based RankFeat only requires marginally 4.89% more time consumption. GradNorm is not comparable against other baselines in terms of time cost because it does not support the batch mode.
Effect of Different Fusion Strategius on FPF05
Effect of Different Fusion Strutogies on AUROC
80
85
Locks Aceeage
Tartur Average
AUROO (T)
S Loghts Averae Spore AvenEa Aveaago
20
83
SUN
Places
Tectunes
Averae Ihamuniid
SUN
Placs
Tectures
Aowrage
Figure 4: The impact of different fusion strategies on FPR95 and AUROC.
Fusion at the logit space achieves the best performance. Fig. displays the performance of different fusion strategies in combining RankFeat the Block 3 and Block features. As can be

---

observed, averaging logits outperforms other fusion strategies in most datasets and metrics. This indicates that the fusing the logits can best coordinate the benefit of both features.
5 Related Work
Distribution shifts. Distribution shifts have been a long-standing problem in the machine learning research community [T 45 34 62] The problem of distributions shifts can be generally categorized as shifts in the input space and shifts in the label space. Shifts only in the input space are often deemed as covariate shifts [2144]]
this setting, the inputs are corrupted by perturbations or shifted The aim is mainly to improve the robustness and generalization of a model (33] For OOD detection, the labels are disjoint and the main concern
by domains, but the label space stays the same 22 53
is to determine whether test sample should be predicted by the pre-trained model [39 25
Some related sub-fields also tackle the problem of distribution shifts in the label space, such as novel class discovery [16 69]. open-set recognition 488] 59], and novelty detection [[66]. These sub-fields
target specific distribution shifts (e.g., semantic novelty), while OOD encompasses all forms of shifts.
OOD detection with discriminative models. The early work on discriminative OOD detection dates back to the classification model with rejection option 4 [2]. The OOD detection methods can be generally divided into training-need methods and post hoc approaches. Compared with training- needed approaches, post hoc methods do not require any extra training processes and could be directly applied to any pre-trained models. For the wide body of research on OOD detection, please refer to (65) for the comprehensive survey. Here we only highlight the representative post hoc methods.
Nguyen et al. [43] first observed the phenomenon that neural networks easily give over-confident predictions for OOD samples. The following researches attempted to improve the OOD uncertainty estimation by proposing ODIN score [39]. OpenMax score (2]. Mahalanobis distance (38), and Energy score 40 Huang et al. (66 pointed out that the traditional CIFAR benchmark does not extrapolate to woaldworld settings and proposed large-scale ImageNet benchmark. More recently, Sun et al. [52] and Huang et al. [27] proposed tackle the challenge of OOD detection from the lens of activation abnormality and gradient norm, respectively. In contrast, based on the empirical observation of singular value distributions, we propose a simple yet effective post hoc solution by removing the rank-1 I subspace from the high-level features.
OOD detection with generative models. Different from discriminative models, generative models detect the OOD samples by estimating the probability density function [32
55 47 57
g 28 3 30).
sample with low likelihood is deemed as OOD data. Recently, multitude of methods have
utilized generative models for OOD detection 46 51 61
33 49 31. However, as pointed out in [42), generative models could assign high likelihood OOD data. Furthermore, generative
64
models can be prohibitively harder to train and optimize than their discriminative counterparts, and the performance often inferior. This might limit their practical usage.
6 Conclusion
In this paper, we present RankFeat, simple yet effective approach for post hoc OOD detection by removing the rank-1 1 matrix composed by the largest singular value from the high-level feature. We demonstrate its superior empirical results and the general applicability across architectures, network depths, and benchmarks. Extensive ablation studies and comprehensive theoretical analyses are conducted to reveal the important insights and to explain the working mechanism of our method.
Acknowledgments and Disclosure of Funding
This research was supported by the EU H2020 projects A14Media (No. 951911) and SPRING (No. 871245). We thank our colleague Zhun Zhong for the fruitful discussion and valuable suggestions.
References
[1] Davide Abati, Angelo Porrello, Simone Calderara, and Rita Cucchiara. Latent space autoregression for novelty detection. In CVPR, pages 481 481-490, 2019.
10

---

[2] Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In CVPR, pages 1563-1572. 2016.
[3] Koby Bibas, Meir Feder, and Tal Hassner. Single layer predictive normalized maximum likelihood for cutto--distribution detection. NewrIPS, 34, 2021.
[4] C Chow. On optimum recognition error and reject tradeoff. IEEE Transactions on information theory. 16 (1):41-46, 1970.
[5] Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In CVPR, 2014.
[6] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenct: A large-scale hicrarchical image databasc. In CVPR, pages 248-255, Icce, 2009.
[7] James Diffenderfer, Brian Bartoldson, Shreya Chaganti, Jize Zhang, and Bhavya Kailkhura. A winning hand: Compressing deep networks can improve out-of-distrihution robustness. NeurIPS, 34, 2021.
Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real nvp. ICLR, 2017.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words:
Transformers for image recognition at scale. In ICLR, 2021.
[10] Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. ICLR, 2022.
[11] Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of out-of-distribution detection. NeurlPS, 34, 2021.
[12] Giorgio Fumera and Fabio Roli. Support vector machines with embedded reject option. In International Workshop on Support Vector Machines, pages 68-82. Springer. 2002.
[13] Saurabh Garg, Sivaraman Balakrishnan. Zachary Lipton, Behnam Neyshabur, and Hanie Sedghi. Lever- aging unlabeled data to predict distr--distiibution performance. ICLR, 2022.
[14] Isaac Gibbs and Emmanuel Candes. Adaptive conformal inference under distribution shift. NeurIPS, 34, 2021.
[15] Eduardo Dadalto Camara Gomes, Florence Alberge, Pierre Duhamel, and Pablo Piantanida. Igcood: An information geometry approach out-of-distriburion detection. ICLR, 2022.
[16] Kai Han, Andrea Vedaldi, and Andrew Zisserman. Learning to discover novel visual categories via deep transfer clustering. In ICCV, pages 8401-8409, 2019.
[17] David Hand. Classifier technology and illusion of progress. Statistical science, 21(1):1 14, 2006.
[18] Matan Haroush, Tzviel Frostig, Ruth Heller, and Daniel Soudry. statistical framework for efficient of distrihution detection deep neural networks. In ICLR, 2022.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770-778, 2016.
[20] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In ECCV, pages 630-645. Springer, 2016.
[21] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In ICLR, 2019.
[22] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distrihttion examples in neural networks. ICLR, 2017.
[23] Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method to improve robustness and uncertainty. In ICLR, 2019.
[24] Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling disttribiti detection for real-world settings. ICML, 2022.
11

---

[25] Yen-Chang Hsu, Yilin Shen. Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of-distriiutiin image without learning from out-of-dittribution data. In CVPR, pages 10951-10960, 2020.
[26] Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space. In CVPR, pages 8710-87111 8719, 2021.
[27] Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. NeurIPS, 34, 2021.
[28] Xun Huang. Yixuan Li, Omid Poursaeed, John Hopcroft, and Serge Belongie. Stacked generative adversarial networks. In CVPR, pages 5077- 5086, 2017.
[29] Forrest N landola, Song Han, Matthew W Moskewicz, Khalid Ashraf, William J Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and< 0.5 mb model size. ICLR, 2017.
[30] Dihong Jiang, Sun Sun, and Yaoliang Yu. Revisiting flow generative models for out-of-distribution detection. In ICIRR, 2022.
[31] Keunsco Kim, JunCheol Shin, and Heeyoung Kim. Locally most powerful bayesian test for out-of- distribution detection using deep generative models. NeurlPS, 34, 2021.
[32] Diederik Kingma and Max Welling. Auto-encoding variational bayes. ICLR, 2014.
[33] Polina Kirichenko, Pavel Izmailov, and Andrew G Wilson. Why normalizing flows fail to detect out-of- distribution data, NewrIPS, 33:20578-20555 2020.
[34] Pang Wei Koh, Shiori Sagawa, Hearik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, et al. Wilds: A benchmark of in-the-wild distribution shifts, In ICML, pages 5637-5664. PMLR, 2021.
[35] Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung. Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. ECCV, 2020.
[36] Alex Krizhevsky, Geoffrey Hinton, et Learning multiple layers features from tiny images. 2009.
[37] Ananya Kumar, Aditi Raghunathan, Robbie Jones, Tengyu Ma, and Perey Liang. Fine-tuning can distort pretrained features and underperform oft-oo-distribution. ICLR, 2022.
[38] Kimin Lec, Kibok Lec, Honglak Lec, and Jinwoo Shin. A simple unified framework for detecting
samples and adversarial attacks. NeurlPS, 31, 2018.
[39] Shiyu Liang. Yixuan Li, and Rayadurgam Srikant, Enhancing the reliability of -fistribiiittnoonn image detection in neural networks. ICLR, 2018.
[40] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. NeurIPS, 33:21464-21477 2020.
[41] Vladimir A Marčenko and Leonid Andreevich Pastur. Distribution of eigenvalues for some sets of random matrices. Mathematics of the USSK--Sborite 144)4557 1967.
[42] Eric Nalisnick, Akihiro Matsukawa, Yee whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? In ICLR, 2019.
[43] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In CVPR, pages 427-436, 2015.
[44] Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, David Sculley, Sebastian Nowozin, Joshua Dillon, Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model's uncertainty? evaluating predictive uncertainty under dataset shift. NeurlPS, 32, 2019.
[45] Joaquin Quinioner--Camie Candela, Masashi Sugiyama, Anton Schwaighofer, and Neil Lawrence, Dataset shift in machine learning. Mit Press, 2008
[46] Jie Ren, Peter Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for oft-of-distribun detection. NeurIPS, 32, 2019.
[47] Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approxi- mate inference in deep generative models. In ICML, pages 1278- 1286. PMLR, 2014.
12

---

[48] Walter J Scheirer, Anderson de Rezende Rocha, Archana Sapkota, and Terrance E Boult. Toward open set recognition. IEEE TPAMI, 2012.
[49] Robin Schirmeister,, Yuxuan Zhou, Tonio Ball, and Dan Zhang. Understanding anomaly detection with deep invertible networks through hierarchies of distributions and features. NeurIPS, 33:21038-21066 2020.
[50] Anirvan M Sengupta and Partha P Mitra. Distributions of singular values for some random matrices. Physical Review E, 60(3):3389, 1999.
[51] Joan Serrà, David Álvarez, Vicenç Gómez, Olga Slizovskaia, José F Núñez, and Jordi Luque. Input complexity and out diittribbbittoo detection with likelihood based generative models. In ICLR, 2019.
[52] Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. NewrIPS, 34, 2021.
[53] Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexci Efros, and Moritz Hardt. Test-time training with seff-supervision for generalization under distribution shifts. In ICML, pages 9229-9248. PMLR, 2020.
[54] Tobias Sutter, Andreas Krause, and Daniel Kuhn. Robust generalization despite distribution shift via minimum discriminating information. NewrlPS, 34, 2021.
[55] Estehan G Tabak and Cristina V Turner. A family of nonparametric density estimation algorithms. Communications on Pure and Applied Mathematics, 66(2):145-164, 2013.
[56] Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning distributionally shifted instances. NeurlPS, 33:1 1839-11852, 2020.
[57] Aaron Van den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et al. Conditional image generation with pixelenn decoders. NeurlPS, 29, 2016.
[58] Grant Van Horn, Oisin Mac Aodha, Yang Song. Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam. Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In CVPR, 2018.
[59] Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set recognition: good closed-set classifier is all you need. ICLR, 2022.
[60] Haoran Wang, Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't know? NewrlPS, 34, 2021.
[61] Ziyu Wang, Bin Dai, David Wipf, and Jun Zhu. Further analysis of outlier detection with deep generative models. NeurlPS, 33:8982-899 2020.
[62] Olivia Wiles, Sven Gowal, Florian Stimberg, Sylvestre Alvise-Rebuff, Ira Ktena, Taylan Cemgil, et al. anc-grrined analysis on distribution shift. ICLR, 2022.
[63] Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun datahase: Large- scale scene recognition from abbey zoo. In CVPR, 2010.
[64] Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: An out-of-distribution detection score for variational auto-encoder. NeurlPS, 2-220685-2099 2020.
[65] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:21 10. 11334, 2021.
[66] Haotian Ye, Chuanlong Xie, Tianle Cai, Ruichen Li, Zhenguo Li, and Liwei Wang. Towards a thcoretical framework oui-of-distriiutiio generalization. NewrIPS, 34, 2021.
[67] Li Yuan, Yunpeng Chen, Tao Wang, Weihao Yu, Yujun Shi, Zi-Hang Jiang, Francis EH Tay, Jiashi Feng, and Shuicheng Yan. Tokens-to-token vit: Training vision transformers from scratch on imagenet. In ICCV, 2021.
[68] Alireza Zaeemzadeh, Niccolò Bisagno, Zeno Sambugaro, Nicola Conci, Nazanin Rahnavard, and Mubarak Shah. Out-of-distribution detection using union of I-dimensional subspaces. In CVPR, pages 9452-9466 2021.
[69] Zhun Zhong, Enrico Fini, Subhankar Roy. Zhiming Luo, Elisa Ricci, and Nicu Sebe. Neighborhood contrastive learning for novel class discovery. In CVPR, pages (U867-10875 2021.
[70] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE TPAMI, 2017.
13

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] We briefly discuss the slightly
higher time consumption of RankFeat Sec. 4.3
(c) Did you discuss any potential negative societal impacts of your work? [No] We do anticipate any negative societal impacts of our work.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full of assumptions all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either the supplemental material or as URL)? [Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g., with respect the random seed after running experi-
ments multiple times)? [N/A] Since our method is post hoc, it will not be influenced by random seeds.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes]
4. If you using existing assets (e.g., code, data, models) or curating/releasing assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any assets either in the supplemental material URL? [No]
(d) Did you discuss whether and how consent obtained from people whose data you's 're using/curating? [Yes]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A] The used data do not contain this kind of information.
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "SwQnIIf5TlB", "reviewer": "Reviewer_kEL5", "summary": "The paper proposes a method to predict if a sample of in distribution or out of distiribution. The authors decomposes the features via SVD and remove the largest eigenvalue and its rank-1 matrix from the features. They show the theoretical effect of their method in the bound of their log probabilities. They surpassed the baseline methods in FPR and AUROC by 7-18%, and did an ablation study for the effect of higher ranks and other feature layers.", "questions": "-In the bound (equation 13), it looks like if s1 gets closer to the other eigenvalues, the bound seems to loosen more if the sum of other eigenvalues are smaller than the s1. Is it a case not encountered in the problems?\n\n- What is the dataset you used for the Figure 1?\n\n- Did you observe any problems with the convergence of SVD decomposition?\n\n- How are your results without the fusion of 3rd and 4th block? How does the fusion help?\n\n- The algorithm does better in terms of FPR compared with AUROC, this might suggest that the distribution gets squeezed and biased. How  do you explain this?", "limitations": "The authors did not foresee any negative impacts of their work.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\nThe method is simple and intuitive, the results also align with intuitions and achieve high improvement over the current baselines. The authors supported and motivated their ideas well. for example,  Figure 1 and 2 are good motivations and pictured well. The paper is written clearly and organized. \nThe ablation study for removing rank-1 vs including only rank-1 and rank-k (swiping k) cases is very helpful to answer initial questions on the reader's mind. \n\nWeaknesses:\nAlthough the complexity of power iterations is reasonable, they may converge very slowly if the eigenvalues have close values.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "RMaIirYX2fS", "reviewer": "Reviewer_SMeo", "summary": "This paper aims to address OOD detection issue by proposing a novel method called RankFeat.\n\nBy observing the OOD feature matrix tends to have a significantly larger dominant singular value, the author believes that by removing the rank-1 feature, the over-confidence of OOD samples is mitigated, and consequently the ID and OOD data can be better distinguished.\n\nBased on the above idea, the propose RankFeat, which aims to removing the rank-1 matrix from the high-level feature.\n\nTheory has shown that it seems RankFeat achieves smaller energy score than ReAct.\n\nAdditionally, experiments have shown this method achieve a large improvement.\n\nLastly, ablation studies are conducted. ", "questions": "The basic idea of this paper does give researchers a novel perspective to understand OOD detection. I also like this idea. But I have many issues raised.\n\nIssues:\n(Major)1. In the real world applications, the OOD datasets can be changeable and diverse. Could you guarantee the observation in Figure 1(a) still holds? I would very, very much doubt this observation. I think you should conduct much more experiments to support the basic view. In fact, if you can give theory (allowed assumptions) or abundant experiments to support the basic view, I think this paper can be accepted by NeurIPS; otherwise, I may not accept it.\n\n(Major) 2. Experiments should be conducted to show why energy-based score is optimal for your method in Eq. 9.\n\n(Minor) 3. In line 222, I find you remove features from 1 to n. How about only removing features n?\n\n(Major) 4. The theory is over-claimed. Please revise it according to weakness 4 and 5.\n\nI think this paper can be accepted if the authors can address all my issues.\n\n\n\n", "limitations": "In the real world applications, the OOD datasets can be changeable and diverse. Could you guarantee the observation in Figure 1(a) still holds? I would very, very much doubt this observation. I think you should conduct much more experiments to support the basic view. In fact, if you can give theory (allowed assumptions) or abundant experiments to support the basic view, I think this paper can be accepted by NeurIPS; otherwise, I may not accept it.", "rating": 5, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 1, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. This method is easy and the idea is clear.\n2. The writing is good and organisation is also good.\n3. Experiments are rich. \n\nThe basic idea of this paper does give researchers a novel perspective to understand OOD detection. I also like this idea.\n\nWeakness:\n1. I still can not understand figure 1(b). Could you provide more detailed introduction?\n2. I am interesting in more datasets to conduct experiments in figure 1(a). \n3. According to Eq. 9, your method is based on an assumption that the energy-based score is effective. Do you have checked other score function to implement your idea? or do you have argued that energy-based score is the optimal for your method?\n4. The theory is not right The basic reason is that you cannot guarantee the bound in Eq 17 is the tightest bound, so you cannot use it to compare with your method's bound Eq 14. For example, a<1, b<2 cannot conclude that a<b. Here you have the same mistake.\n5. The theory is weak. Eq 14 has shown that  RankFeat achieves small energy score . However, you omit a basic issue that why  a small energy score is good for OOD detection. You should use theory to explain it; otherwise, I think your paper has some unmentioned assumptions.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "P4C1KC6tB4D", "reviewer": "Reviewer_dq6u", "summary": "The authors present a new OOD detection method `RankFeat`, which removes the largest singular value and the associated singular\nvectors from high-level features extracted from a classifier pre-trained on a labeled dataset (e.g. ImageNet-1k)", "questions": "All suggestions are in the weaknesses section", "limitations": "N/A", "rating": 3, "confidence": 5, "soundness": 1, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The presented method is interesting, but the evaluation is extremely limited and fails to position the performance of the proposed method in relation to all the OOD literature\n- The paper mainly evaluates on the dataset first proposed on [1]\n  - This dataset is very new, few works use it for evaluation\n  - This dataset is only a far-OOD dataset, i.e. an easy dataset where OOD samples are far from ID samples\n  - I won't be convinced until a more through evaluation is done that includes near-OOD datasets, specifically\n    -  The standard one class vs the rest [2] is done in at least CIFAR10, and CIFAR100 (prefereably also ImageNet-30), as can be seen in e.g. [3]\n    - The whole CIFAR10 vs CIFAR100 (and vice-versa)\n  - It would be very interesting to show also evaluations that try to expose usefulness of pre-trained models for OOD  \n    - The Species dataset, proposed in [4]\n    - One class SVHN, porposed in [5]\n- The paper compares only to a handful of other methods, many SotA methods in literature are ignored\n  - Paper must compare to other works that tries to adapt pre-trained classifiers, e.g. PANDA [6]\n  - Paper must compare to completely unsupervised methods, e.g. CSI [3]\n  - Paper should explore the situation where ID dataset is polluted\n- How can the method be described as post-hoc, when authors needed to fine-tune the model for 100 epochs on CIFAR before evaluation on CIFAR ?\n- I find this strange, but why the authors doesn't compare to the method described in [1] (the original paper of the evaluation dataset) ?\n- CIFAR results in the appendix aren't convincing in superiority compared to ReAct\n\n\n[1] Mos: Towards scaling out-of-distribution detection for large semantic space. CVPR 2021\n\n[2] Systematic construction of anomaly detection benchmarks from real data. In KDD 2013\n\n[3] Csi: Novelty detection via contrastive learning on distributionally shifted instances. NeurIPS 2020\n\n[4] Scaling Out-of-Distribution Detection for Real-World Settings. ICML 2022\n\n[5] No Shifted Augmentations (NSA): compact distributions for robust self-supervised Anomaly Detection. arXiv 2022\n\n[6] Panda: Adapting pretrained features for anomaly detection and segmentation. CVPR 2021", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "2ZPfigWFNi", "reviewer": "Reviewer_Ft9S", "summary": "The paper claims that OOD and IND involve different largest singular value of feature map matrix. Based on its foundational claim, the authors propose a simple OOD detection score devised by subtracting the corresponding rank-1 matrix from (the feature maps) of a given (pretrained) network.", "questions": "1. Could you specify the datasets used for ID and OOD for Figure 1 in its caption if possible? \n2. (Critical) What is B in the line 71? Is it batch size or the number of all samples? Does it include OOD samples? \n3. (Critical) Shouldn't the capital X in Eq. (4) be small x? Can RankFeat be computed for a single test sample x? What is y'? I know it is logit, but is it a set of logits of multiple samples or the logit of a single sample? How is it summed? What is the index of the sum in Eq. (4)?\n4. (Critical) Overall, I don't precisely understand on which matrix exactly SVD is applied. Is it applied to the feature maps of training (or validation) set? Or is it applied to the feature map of a single sample? Is SVD computed only once and are u_1 v_1 s_1 fixed during whole inference? Or do you have to re-compute u_1 v_1 s_1 every time you make inference on a different test sample? This is very critical for accepting the paper. In fact, X with shape [B, C, HW] is not a matrix (2d tensor) but a 3d tensor. Do the authors use torch.svd on the matrix shaped by [B, C, HW]? \n5. Doex X in line 107 have to be a batch of feature maps? Or the theory would still hold even if X is the feature map of a single sample?\n\n\n", "limitations": "The limitations are given in the above 'weaknesses' and 'questions'. Please address all my questions and the second and fourth points of the weaknesses. In particular, please focus on clarifying your method, exactly which matrix SVD is applied to, and when SVD is applied.\n\nI am quite positive with the paper except for the notation issue and the second point of the 'weaknesses'. I personally think scalar quantities should not be bold-faced; it is quite confusing. ", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "[Strengths]\n\nGood performance. It reduces FPR95 quite significantly for large-scale OOD testing environments.\n\nNovel observation. To my best knowledge, this is the first paper to study OOD samples using the singular value of a feature (map) matrix. Particularly, according to the authors' claims, IND and OOD show different behaviors in terms of the largest singular value of feature map matrix.\n\nApplication Diversity. The proposed method can be applied to both ResNet and ViT based architectures.\n\n[Weaknesses]\n\n1. The paper does not provide precise notations for the proposed method in both main paper and supplementary. Particularly, it is very important to which matrix SVD is applied, but the paper is not clear on this point. (Namely, is it applied to a mini-batch of feature maps, the feature maps of whole train set, or a the reshaped feature map of a single sample? The singular value will be completely different depending on whether the shape of X is [B, CHW] or [C, HW].) Moreover, some notations (which are critical for understanding and implementing the method) are also not clear.\n\n2. Its foundational claim (the largest singular value is larger in OOD than in IND) is not extensively validated. This is validated in only one experiment given in Figure 1(a). I am wondering if this claim would still hold even if different datasets are used for IND and OOD.\n\n3. (minor) The paper does not give a convincing explanation of its foundational claim; namely, why OOD involves a larger singular value s_1 than IND? I saw the supplementary part for this, but the explanation is not so convincing.\n\n4. (minor) Some of the given theory is not rigorous. Particularly, the convergence criterion to a random matrix given in the second part of the theory is not clear.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept