Dream the Impossible: Outlier Imagination with Diffusion Models
Authors: Xuefeng Du
Yiyou Sun
Jerry Zhu
Yixuan Li
Venue: NeurIPS 2023 poster (2023)
Keywords: Outlier imagination
machine learning

Abstract: Utilizing auxiliary outlier datasets to regularize the machine learning model has demonstrated promise for out-of-distribution (OOD) detection and safe prediction. Due to the labor intensity in data collection and cleaning, automating outlier data generation has been a long-desired alternative. Despite the appeal, generating photo-realistic outliers in the high dimensional pixel space has been an open challenge for the field. To tackle the problem, this paper proposes a new framework Dream-OOD, which enables imagining photo-realistic outliers by way of diffusion models, provided with only the in-distribution (ID) data and classes. Specifically, Dream-OOD learns a text-conditioned latent space based on ID data, and then samples outliers in the low-likelihood region via the latent, which can be decoded into images by the diffusion model. Different from prior works [16, 95], Dream-OOD enables visualizing and understanding the imagined outliers, directly in the pixel space. We conduct comprehensive quantitative and qualitative studies to understand the efficacy of Dream-OOD, and show that training with the samples generated by Dream-OOD can significantly benefit  OOD detection performance.

Dream the Impossible: Outlier Imagination with Diffusion Models
Xuefeng Du, Yiyou Sun, Xiaojin Zhu, Yixuan Li
Department of Computer Sciences
{xfdu, University of Wisconsin, Madison
sharonli)@cs wisc.
Abstract
Utilizing auxiliary outlier datasets to regularize the machine learning model has demonstrated promise for out-of-distribution (OOD) detection and safe prediction. Due to the labor intensity in data collection and cleaning, automating outlier data generation has been long-desired alternative. Despite the appeal, generating photo-realistic outliers in the high dimensional pixel space has been an open challenge for the field. To tackle the problem, this paper proposes a new framework DREAM-OOD, which enables imagining photo-realistic outliers by way of diffusion models, provided with only the in-distribution (ID) data and classes. Specifically, DREAM-OOD learns text-conditioned latent space based on II) data, and then samples outliers in the low-likelihood region via the latent, which can be decoded into images by the diffusion model. Different from prior works [1. 2]. DREAM-OOD enables visualizing and understanding the imagined outliers, directly the pixel space. We conduct comprehensive quantitative and qualitative studies to understand the efficacy of DREAM-OOD, and show that training with the samples generated by DREAM-OOD can benefit OOD detection performance. Code is publicly available at https::/gitthiie com hwe.//eeplllennnee wisc/ ///ddrammooo ood.
Introduction
Outtof-distribution (OOD) detection is critical for deploying machine learning models in the wild, where samples from novel classes naturally emerge and should be flagged for caution. Con- cerningly, modern neural networks are shown to produce overconfident and therefore untrustworthy predictions for unknown OOD inputs [3]. To mitigate the issue, recent works have explored training with an auxiliary outlier dataset, where the model is regularized to learn a more conservative decision boundary around in-distribution (ID) data [4-7]. These methods have demonstrated encouraging OOD detection performance over the counterparts without auxiliary data.
Despite the promise, preparing auxiliary data can be labor-intensive and inflexible, and necessitates careful human intervention, such as data cleaning, to ensure the auxiliary outlier data does not overlap with the ID data. Automating outlier data generation has thus been long-desired alternative. Despite the appeal, generating photo-realistic outliers has been extremely challenging due to the high dimensional space. Recent works including VOS and NPOS [1, 2] proposed sampling outliers in the low-dimensional feature space and directly employed the latent-space outliers to regularize the model. However, these latent-space methods do not allow us understand the outliers in human-compatible way. Today, the field still lacks an automatic mechanism to generate high-resolution outliers in the pixel space.
In this paper, we propose a new framework DREAM-OOD that enables imagining photo-realistic outliers by way of diffusion models, provided with only ID data and classes (see Figure 1). Harnessing the power of diffusion models for outlier imagination non-trivial, since one cannot easily describe
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Strawberry
Jellyfish
Ladybug
ID data
Imagined OOD
Figure 1: Top: Original ID training data in IMAGENET [8]. Bottom: Samples generated by method DREAM-OOD, which deviate from the ID data.
the exponentially many possibilities of outliers using text prompts. It can be particularly challenging characterize informative outliers that lie the boundary of ID data, which have been shown be the most effective in regularizing the ID classifier and its decision boundary [7]. After all, is almost impossible describe something in words without knowing what it looks like.
Our framework circumvents the above challenges by: (1) learning compact visual representations for the ID data, conditioned on the textual latent space of the diffusion model (Section 3.1), and (2) sampling new visual embeddings the rext-conditioned latent space, which are then decoded to pixel-space images by the diffusion model (Section 3.2). Concretely, learn the rext-conditioned latent space, we train an image classifier to produce image embeddings that have a higher probability to be aligned with the corresponding class token embedding. The resulting feature embeddings thus form a compact and informative distribution that encodes the ID data. Equipped with the text-conditioned latent space, sample embeddings from the low-likelihood region, which can be decoded into the images via the diffusion model. The rationale is if the sampled embedding is distributionally far away from the in-distribution embeddings, the generated image will have large semantic discrepancy from the ID images and vice versa.
We demonstrate that our proposed framework creatively imagines OOD samples conditioned given dataset, and as a result, helps improve the OOD detection performance. On IMAGENET dataset, training with samples generated by DREAM-OOD improves the OOD detection suite of OOD datasets. Different from [1. 2], our method allows visualizing and understanding the imagined outliers, covering wide spectrum of near-OOD and far-OOD. Note that DREAM-OOD enables leveraging off-the-shelf diffusion models for OOD detection, rather than modifying the diffusion model (which is actively studied area its own [9]). In other words, this work's 's contribution to leverage generative modeling to improve discriminative learning, establishing innovative connections between the diffusion model and outlier data generation.
comprehensive
Our key contributions are summarized as follows:
1. To the best of our knowledge, DREAM-OOD is the first to enable the generation of photo- realistic high-resolution outliers for OOD detection. DREAM- PREAM-OOD establishes promising performance common benchmarks and can benefit OOD detection.
2. We conduct comprehensive analyses to understand the efficacy of DREAM-OOD, both quantitatively and qualitatively. The results provide insights into outlier imagination with diffusion models.
3. As an extension, we show that our synthesis method can be used to automatically generate IDD samples, and as a result, improves the generalization performance of the task itself.
2 Preliminaries
consider a training set ((x;, drawn i.d.d. from the joint data distribution Pxy. X denotes the input space and 3 E 21, C} denotes the label space. Let P., denote the marginal distribution on X, which is also referred to as the in-distribution. Let fo X + RCC denote multi-class classifier, which predicts the label of an input sample with parameter 0. To obtain an

---

Input X
Class token
T(y)
Diffusion model
embedding
Synthetic images Xood
Synthetic embedding
Feature
encoder
Toxzn empedsing
&
Anchore
Syniesizsd untoodding Tedecneiiisinng
embeddings
Text-condiloned
Space
Downstream model
Illustration our proposed outlier imagination framework DREAM-OOD, DREAM-OOD first learns a lext-conditioned space to produce compact image embeddings aligned with the token embedding Tyy) of the diffusion model. It then samples new embeddings in the latent space, which can be decoded into pixel-space outlier images Xoo by diffusion model. The newly generated samples can help improve OOD detection. Best viewed color.
Figure 2:
optimal classifier f" a standard approach to perform empirical risk minimization (ERM) [10]: f argmin fEF 1 Σi= (x((x;) 16) where is the loss function and F is the hypothesis space.
Out-of-distribution detection. When deploying a machine model in the real world, reliable classifier should not only accurately classify known in-distribution samples, but also identify OOD input from unknown class y & This can be achieved by having an OOD detector, in tandem with the classification model fe. At its core, OOD detection can be formulated as a binary classification problem. At time, the goal is decide whether a test-time input from ID or not (OOD). We denote ge X' + {in, out} as the function mapping for OOD detection.
Denoising diffusion models have emerged promising generative modeling framework, pushing image generation [11, 12]. Inspired by non-equilibrium thermodynamics, diffusion probabilistic models [13-15] define forward Gaussian Markov transition kernel of diffusion steps to gradually corrupt training data until the data distribution transformed into simple noisy distribution. The model then learns to reverse this process by learning denoising transition kernel parameterized by a neural network.
the state-of-the
Diffusion models can be conditional, for example, class labels text descriptions [11, 16, 17]. In particular, Stable Diffusion [18] is a text-to-image model that enables synthesizing new images guided by the text prompt. The model was trained on 5 billion pairs of images and captions taken from LAION-5B [19), a publicly available dataset derived from Common Crawl data scraped from the web. Given class name y, the generation process can be mathematically denoted by:
Zg)
where Zy Tly) is the textual representation of label y with prompting (e.g.. "A high-qualite photo of Iy]"). In Stable Diffusion, T(-) is the text encoder of the CLIP model [20].
3 DREAM-OOD: Outlier Imagination with Diffusion Models
In this paper, we propose novel framework that enables synthesizing photo-realistie outliers with respect to given ID dataset (see Figure 1). The synthesized outliers can be useful for regularizing the ID classifier to be less confident the OOD region. Recall that the vanilla diffusion generation takes as input the textual representation. While it is easy encode the ID classes y E y into textual latent space via T(y), one cannot trivially generate text prompts for outliers. can be particularly challenging to characterize informative outliers that lie on the boundary of ID) data, which have been shown to be most effective regularizing the ID classifier and decision boundary [7]. After all, almost impossible to concretely describe something in words without knowing what it looks like.
Overview. As illustrated Figure 2, our framework circumvents the challenge by: (1) learning compact visual representations for the ID data, conditioned on the textual latent space of the diffusion model (Section 1), and (2) sampling new visual embeddings the text-conditioned latent space, which are then decoded into the images by diffusion model (Section 3.2). We demonstrate in Section that, our proposed outlier synthesis framework produces meaningful disti--distriuutionn samples conditioned on given dataset, and result, significantly improves the OOD detection performance.

---

3.1 Learning the Text-Conditioned Latent Space
Our key idea is first train a classifier on ID data D that produces image embeddings, conditioned on the token embeddings T Tyy) with E V To learn the text-conditioned visual latent space, we train the image classifier to produce image embeddings that have a higher probability being aligned with the corresponding class token embedding, and vice versa.
Specifically, denote hg X + R that maps an input X E X' to the image embedding ha (x)x), and 7 : + I as the text encoder that takes a class name y and outputs its token embedding (vy). Here T()) fixed text encoder of the diffusion model. Only the image feature encoder needs to be trained, with learnable parameters Mathematically, the loss function for learn- ing the visual representations is formulated as follows:
feature encoder
Tokan Embad.
exp (T(v) T2/t)
C [x.g)== log Σj=1 exp (U,))
(2)
where z = (x)))/ hl//////////////////// (x) is the no-moalle image embedding, and is temperature.
Figure 3: TSNE visualization of learned feature embeddings using L. Black dots in- dicate token embeddings, one for each class.
Theoretical interpretation loss. Formally, our loss function directly promotes the class-conditional von Mises Fisher (vMF) distribution [21-23]. vMF analogous to spherical Gaussian distributions for features with unit norms (||]|2 = 1). The probability density function of z E R in class is:
Pm (z; pe 16) = Zm (K) exp (ki z)
(3)
where ft, the class centroid with unit norm, controls the extent of class concentration, and Zm (1s) is the normalization factor detailed in the Appendix B. The probability of the feature vector belonging to class is:
P (k, = Zm (x) exp (kepe z)
E Zm (m) exp (ripe]
exp (N! 2/l)
Σ5 exp (1, 2/1)
where x 7. Therefore, by encouraging features to be aligned with its class token embedding, our loss function (Equation (2)) maximizes the log-likelihood of the class-conditional vMF distributions and promotes compact clusters the hypersphere (see Figure 3). The highly compact representations can benefit the sampling of new embeddings, as we introduce next in Section 3.2.
3.2 Outlier Imagination via Text-Conditioned Latent
Given the well-trained compact representation space that encodes the information of Pin. we propose to generate outliers by sampling new embeddings in the text-conditioned latent space, and then decoding via diffusion model. The rationale is that if the sampled embeddings are distributionally far away from the ID embeddings, the decoded images will have a large semantic discrepancy with the ID images and vice versa.
Recent works [1, 2] proposed sampling outlier embeddings and directly employed the latent-space outliers to regularize the model. In contrast, our method focuses on generating pixel-space photo- realistic images, which allows us to directly inspect the generated outliers a human-compatible way. Despite the appeal, generating high-resolution outliers has been extremely challenging due to the high dimensional space. To tackle the issue, our generation procedure constitutes two steps:
Sample OOD in the latent space: draw new embeddings v that are in the lww-likelhhood region of the text-conditioned latent space.
2. Image generation: decode into a pixel-space OOD image via diffusion model.

---

Algorithm DREAM-OOD: Outlier Imagination with Diffusion Models
Input:
In-distribution training data {x,, 1e) M:) initial model parameters for learning the text-conditioned latent space, diffusion model. Output: Synthetic images Xpod-
Phases: Phase 1: Learning the Text-conditioned Latent Space. Phase 2: Outlier Imagination via Text-Conditioned Latent.
while Phase I do
Extract token embeddings Tyy) of the label y E V.
2. Learn the text-conditioned latent representation space by Equation (2).
end
while Phase 2 do
Sample set of outlier embeddings V2 in the low-likelihood region of the text-conditioned latent space as in Section 3.2.
Decode the outlier embeddings into the pixel-space OOD images via diffusion model by Equation (6).
end
Sampling OOD embedding. Our goal here is sample low-likelihood embeddings based on the learned feature representations (see Figure 4). The sampling procedure can be instantiated by different approaches. For example, a recent work by Tao et.al. [2] proposed latent non-parametric sampling method, which does not make any distributional assumption on the ID embeddings and
offers stronger flexibility compared the parametric sampling approach [1]. Concretely, we can select the boundary ID anchors by leveraging the non-parametric nearest neighbor distance, and then draw new embeddings around that boundary point.
Denote the Izznnormalized embedding set of training data as Z (zi, ..., Zn), where z, he (xx)////aa [[2. For any embedding z' E E. we calculate the k-NN dis- tance w.r.t. Z:
ID embedding Synthesized embedding
ds ds'z''
2c))ll,
(5)
where z(k)) is the k-th nearest neighbor in Z. If embed- ding has a large k-NN distance, it is likely to be on the boundary of the ID data and vice
Given boundary ID point, we then draw new embedding sample E Rd from Gaussian kernel' centered at with covariance I²I: v ~ (2z,, o²I). In addition, to that the outliers sufficiently far away from the ID data, we repeatedly sample multiple outlier embeddings from the Gaussian kernel (Z,,, o I)), which produces set Vi, and further perform a filtering process by selecting the outlier embedding in VÚ with the largest k-NN distance w.r.t. Z. Detailed ablations on the sampling parameters are provided Section 4.2.
Figure 4: TSNE visualization of ID em- beddings (purple) and the sampled outlier embeddings (orange), for the class "hen" in IMAGENET.
Outlier image generation. Lastly, to obtain the outlier images in the pixel space, we decode the sampled outlier embeddings via the diffusion model. In practice, this be done by replacing the original token embedding T(y) with the sampled new embedding v2. Different from the vanilla prompt-based generation (c.f. Equation (1)). our outlier imagination is mathematically reflected by:
Xood P(x|v),
(6)
where Xood denotes the generated outliers in the pixel space. Importantly, S he (IPi)) is
dependent on the in-distribution data, which enables generating images that deviate from Pin- S(-)
denotes the sampling procedure. Our framework DREAM-OOD summarized in Algorithm 1.
'The choice of kernel function form (e.g.. Gaussian Epanechnikov) is not influential, while the kernel bandwidth parameter [24].
"In the implementation, we re-scale by multiplying the norm of the original token embedding to preserve the magnitude.
5

---

OOD Datasets
INATURATIST
SUNN
TEXTURES
Averago
ACC
AUROC1
AUROCT
AUTROC!
AUROCT
47.60
ODIN 126
24.40
95.92
50.30
90.20
11.90
91.55
61.00
81.37
45.15
39.76
87.64
Mahulanohis (27)
91.60
75.16
96.70
60.87
97.40
62.23
36.50
91.43
50.55
72.42
87.54
Energy [6]
32.50
94.82
50.80
90.76
47.60
91.71
63.30
90.34
43.68
89.46
87.64
GODIN (25)
$9.90
93.94
59.70
89.20
58.70
90.65
59.90
92.71
49.55
91.62
87.38
KNN (29)
28.67
95.57
65.83
58.72
58.08
90.17
12.92
90.37
41.38
91.20
$7.64
VIM [30]
57.18
88.70
67.03
87.64
ReAst [21]
96.05
41.17
DICE [32]
37.30
92.51
53,80
45.60
89.21
46.67
88.19
Synnhertt based methods
GAN [5S]
83.10
71.35
83.20
69.85
84,40
67.56
91.00
99.16
85.42
66.98
79.52
VOS [1]
43.00
93.77
47.60
91.77
39. 19.40
93.17
66. 66.10
81.42
49.02
90.03
87.50
NPOS (2)
53.84
96,52
59.66
83.50
53.54
87.99
8.98
98.13
44.00
89,04
85.37
DREAM-ODD (Ours)
24.10:01
96.10.31
39,87
93.11
36.88:0
98.31504
53.99.66
85.5645
38.76:93
92.02:91
87.54
Table 1: OOD detection results for IMAGENET- 100 the in-distribution data. We report standard deviations estimated across 3 runs. Bold numbers are superior results.
Learning with imagined outlier images. The generated synthetic OOD images Xood can be used for regularizing the training of the classification model [1]:
exp (E((o(())
exp
Lood
Exxcos
log
+ Ex-Pi
log
(7)
1
1 expx(X(ff(x))
where ((-) is three-layer nonlinear MLP function with the same architecture VOS [1], E(-) denotes the energy function, and fx( denotes the logit output of the classification model. In other words, the loss function takes both the ID and generated OOD images, and learns separate them explicitly. The overall training objective combines the standard cross-entropy loss, along with an additional loss in terms of OOD regularization LCE + 3 Land, where is the weight of the OOD regularization. Len denotes the cross-entropy loss on the ID training data. In testing, we use the output of the binary logistic classifier for OOD detection.
4 Experiments and Analysis
In this section, we present empirical evidence to validate the effectiveness of our proposed outlier imagination framework. what follows, we show that DREAM- -OOD produces meaningful OOD images, and as result, significantly improves OOD detection (Section 4.1) performance. We provide comprehensive ablations and qualitative studies in Section 4.2. addition, we showcase an extension of our framework for improving generalization by leveraging the synthesized inliers (Section 4.3).
4.1 Evaluation on OOD Detection Performance
Datasets. Following [2], the ID traiming data. For CIFAR- 100, we use a suite of natural image datasets as OOD including
the CIFAR-100 100 and the large-scale IMAGENET dataset [8] as
TEXTURES [34], SVHN [35]. PLACES365 [36], ISUN [37] LSUN [38]. For IMAGENET- 100, we
adopt the OOD test data as in [39], including subsets of INATURALIST [40], SUN [41], PLACES [36].
and TEXTURES [34]. For each OOD dataset, the categories are disjoint from the ID dataset. We
provide the details of the datasets and categories in Appendix A.
Training details. We use ResNet-34 [42] the network architecture for both CIFAR- and IMAGENET- 100 datasets. We train the model using stochastic gradient descent for 100 epochs with the cosine learning rate decay schedule, momentum of 0.9, and weight decay of 54_1, The initial learning rate is set to 0.1 and the batch size is set to 160. We generate 1, 000 OOD samples per class using Stable Diffusion v1.4 which results in 100, 000 synthetic images in total. / is set 1.0 for IMAGENET- 100 and 2.5 for CIFAR- 100. To learn the feature encoder hag we set the temperature in Equation (2) O.I. Extensive ablations on hyperparameters a,, k and are provided in Section 4.2.
Evaluation metrics. We report the following metrics: (1) the false positive rate (FPR95) of OOD samples when the true positive rate of ID samples is 95%, (2) the area under the receiver operating characteristic curve (AÚROC), and (3) ID accuracy (ID ACC).
DREAM-OOD M-OOD significantly improves the OOD detection performance. As shown in Table 1 and Table 3, we compare our method with the competitive baselines, including Maximum Softmax Probability [25]. ODIN score [26], Mahalanobis score [27], Energy score [6], Generalized ODIN [28].

---

OOD Danaet
Metbods
Scnv
PLACES365
EsUN
15UN
TOXTURIS
Average
TD ACC
FPRUS
.U/RCCT
FPR051
AUROCT
FPR554
AUROCT
FPRU5]
ALROCC
FPRO5L
AUROCT
FPRISL
AUBOCT
MSP (15)
87.35
09:15
81.48
16.71
76.80
60.12
76:10
78.90
70.35
77.45
15.15
76.65
19
ODEN (25)
90305
64.35
79.30
14.83
15.60
75.04
53.10
$1.40
12.60
79.82
74.31
76.50
79.04
Mahalaank (27)
87.80
07.98
76,00
77.90
56.80
85:83
59.20
56.46
62.45
34.43
56.45
50.2
79.0
Parrgy (6]
$4.90
70:40
76.00
78:15
73.55
18:30
80-19
79
(29)
73655
78.21
73.02
73.29
14.25
VIM [30)
$1.20
77.24
79.30
71.81
43,00
90443
74.55
83.02
61.55
55.57
67.98
$2.81
RcAkt [11)
82.85
70.12
83.75
76.25
80030
$3.05
07 40
53.28
74.50
$1.51
77.46
78.56
79
DICE 1191
72.49
75.92
73.59
76,80
$3.55
Mothens
66.95
66.76
75.87
83:45
92.80
85:36
VOS [1]
79.50
73.11
$4.55
75.35
59,55
85322
72.45
92.66
75.35
50.66
73,96
70.46
78.56
NPOS (7)
11:14
V7.84
75.08
71:30
16.37
62.43
51.77
35.48
36,30
92.44
46.08
15.90
19.23
7875
570
2425
95.33677
1.00
9811
78.91
Table 3: OOD detection results for CIFAR- 100 as the in-distribution data.
report standard deviations
estimated across 3 runs. Bold numbers are superior results.
KNN distance [29], ViM score [30], ReAct [31], and DICE [32]. Closely related to ours, we contrast with three synthesis-based based methods, including
outlier synthesis (VOS [1] & NPOS [2]), and GAN-based synthesis [33], showcasing the effectiveness of our approach. For example, DREAM- OOD achieves FPR95 of 39.87% PLACES with the ID data of IMAGENET-I00, which is 19.79% improvement from the best baseline NPOS.
In particular, DREAM-OOD advances both VOS and NPOS by allowing to understand the syn- thesized outliers in a noman-compatible way, which was infeasible for the feature-based outlier sampling in VOS and NPOS. Compared with the feature-based synthesis approaches, DREAM-OOD can generate high-resolution outliers in the pixel space. The higher-dimensee dimensional pixel space offers much more knowledge about the unknowns, which provides the model with high variability and fine-grained details for the unknowns that are missing in VOS and NPOS. Since DREAM-OOD is more photo-realistic and better for humans, the generated images can be naturally better constrained for neural networks (for example, things may be more on the natural image manifolds). We provide comprehensive qualitative results (Section 4.2) to facilitate the understanding of generated outliers. As we will show in Figure 5, the generated outliers are more precise in characterizing OOD data and thus improve the empirical performance.
Comparison with other outlier syn- thesis approaches. We compare DREAM-OOD with different outlier embedding synthesis approaches in Table 2: (I) synthesizing outlier em- beddings by adding multivariate Gaus- sian noise NO, II to the token em- beddings, (II) adding learnable noise to the token embeddings where the noise is trained to push the outliers away from ID features, (III) interpolating token embeddings from different classes by a ) + (1 (1z)). and (IV) generating outlier images by using embeddings of new class names outside ID classes. For (I), we set the optimal variance values of to 0,03 by sweeping from {0.01. 0.02, 0.03, .... 0.103. For (III), we choose the interpolation factor
Method
FPR95
AUROC 1
FPR95 L AUROC 1
IMAGENET-
100 ID
CIFAR- 100 ID
(T) Add gaussian
(II) Add Iearnable noise
42.48
91.45
48.05
87.72
(III) Interpolate embeedlings
41.35
90.82
43.36
87.09
(IV) Disjont class names
43.55
87.84
49.89
85.87
DREAM-OOD (ours)
38.76
92.02
40,31
90.15
Table 2:
Comparison of DREAM-OOD with different outlier em- bedding synthesis methods using diffusion models.
be 0.5 from {0.1, 0.2, ..., 0.9}. For (IV), we use the remaining 900 classes in IMAGENET- I (exclude the 100 classes in IMAGENET- 100) as the disjoint class names for outlier generation. We generate the same amount of images as ours for all the variants to ensure a fair comparison.
The result shows that DREAM-OOD outperforms all the alternative synthesis approaches by consid- erable margin. Though adding noise to the token embedding is relatively simple, it cannot explicitly sample textual embeddings from the low-likelihook region as DREAM-OOD does, which are near the ID boundary and thus demonstrate stronger effectiveness to regularize the model (Section 3.2). Visualization is provided in Appendix F. Interpolating the token embeddings will easily generate images that are still ID (Appendix D), which is also observed in Liew et.al. [43].
4.2 Ablation Studies
In this section, we provide additional ablations to understand DREAM-OOD for OOD generation. For all the ablations, we use the high resolution IMAGENET- 100 dataset as the ID data.
7

---

0240.2
02e02
3 04
03000
00.00
groz
(a)
Imagined outliers for ID class Jellyfish
(b) Imagined outliers for ID class Ladybug
Figure 5: Visualization of the imagined outliers w.t. jellyfish, ladybug class under different variance o².
Ablation on the regularization weight 3. In Figure 7 (a), we ablate the effect of weight / of the regularization loss Lood for OOD detection (Section 3.2) the OOD detection performance. Using a mild weighting, such as 3 = 1.0, achieves the best OOD detection performance. Too excessive regularization using synthesized OOD images ultimately degrades the performance.
Ablation on the variance value a². We show Figure (b) the effect of a² - the number of the variance value for the Gaussian kernel (Section 3.2). We vary o² E {0.02, 0.03, 0.04, 0.05, 0.06, 0.2). Using mild variance value o² generates meaningful synthetic OOD images for model regularization. Too large of variance (e.g., o² = 0.2) produces far-OOD, which does not help learn compact decision boundary between ID and OOD.
Ablation on k in calculating k-NN distance. In Figure 7 (c), we analyze the effect of k. i.e., the number of nearest neighbors for non- oonramamttric sampling in the latent space. We vary {100, 200, 300, 500) and observe that our method is not sensitive to this hyperparameter.
Visualization of the generated outliers. Figure 5 illustrates the generated outlier images under different variance o². Mathematically, larger variance translates into outliers that are more deviated from ID data. We confirm this in our visualization too. The synthetic OOD images gradually become semantically different from ID classes "jellyfish" and "ladybug", as the variance increases. More visualization results are in Appendix C.
4.3 Extension: From DREAM-OOD to DREAM-ID
Our framework can be easily extended to generate ID data. Specifi- cally, we can select the ID point with small k-NN distances w.E... the training data (Equation (5)) and sample inliers from the Gaussian kernel with small variance o² in the rext-conditioned embedding space (Figure 6). Then we decode the inlier embeddings via the diffusion model for ID generation (Visualization provided in Ap- pendix G). For the synthesized ID) images, we let the semantic label be the same as the anchor ID point. Here we term our extension as DREAM-ID instead.
Syrthebed arbedding
Datasets. We use the same IMAGENET- 100 as the training data. We measure the generalization performance on both the original IMAGENET test data (for ID generalization) and variants with dis- tribution shifts (for OOD generalization). For OOD generalization, we evaluate on (1) IMAGENET-A A [44] consisting of real-world, un- modified, and naturally occurring examples that are misclassified by ResNet models; (2) IMAGENRT-V2 [45], which created from the Flickr dataset with natural distribution shifts. We provide the experimental details in Appendix H.
Figure 6: TSNE visualization of ID embeddings (purple) and the synthesized inlier embeddings (orange), for class "hen" in IMA- GENET.

---

Different weight ş for Evel
101 Different variance of for outller synthesis
(3) Diffrrett <in KAN disance
92.5
92.5
92.5
92.07
41.5
92.02
91:85
01.55
47.47
92.0
41.5
$1.51
92.0
01.5
31.25
93.73
92.02
90.23
22.0
92.0
01,03
91.2
16.5
90.5
90.5
86.0-
05.0
895
89.5
85.0
2.0
0.02
0.03
0.04
0.05
1.00
200
569
Reguirizzalen weght
Variance
KNN distance
Figure 7: (a) Ablation study the regularization weight 3 on Lood. (b) Ablation on the variance o² for synthesizing outliers in Section 3.2. (c) Ablation on the &o for the k-NN distance. The numbers AUROC. The ID training dataset IMAGENET-100.
DREAM-ID improves the generalization performance. As shown in Table 4, we compare DREAM- ID with competitive data augmentation and test-time adaptation methods. For fair comparison, all the methods are trained using the same network architecture, under the same configuration. Specifically, our baselines include: the original model without any data augmentation, RandAugment [46], AutoAugment [47]. CutMix [48], AugMix [49], DeepAugment [50] and MEMO [51]. These methods are shown in the literature to help improve generalization. The results demonstrate that our approach outperforms all the baselines that use data augmentation for training in both ID generalization and
generalization under natural distribution shifts 010.74% vs. the best on IMAGENET-A, 10.70% vs. the
best on IMAGENET- v2). Implementation details of the baselines are in Appendix I.
Methods
IMAGENET
IMAGENET-A
IMAGENET-V2
In addition, we compare our method with using generic prompts (i.e., "A high-quality photo of [y]")) > for data generation. For fair comparison, we synthesize the same amount images (i.., 1000 per class) for both methods. The result shows that DREAM-IU out- performs the baseline by 0.72% IMAGENET test set and 0.95%. 1. 1.20% on IMAGENET-A and IMAGENET-V2, respectively.
Original (no aug)
87.28
8.69
77.80
RandAugment
88.10
11.39
78.90
AutoAugment
88.00
10.85
79.70
CutMix
87.98
9.67
79.70
AugMix
87.74
10.96
79.20
DeepAugment
86.86
10.79
78.30
MEMO
88.00
10.85
78.60
Generic Prompts
87.74
11.18
79,20
DREAM-ID (Ours)
88.46.10.1
12.13
80,40
Table 4: Model generalization performance (accuracy, in %), using IMAGENET- 100 the training data. We report standard deviations estimated across runs.
Related Work
Diffusion models have recently seen wide success in image generation [9, 52-54], which can outperform GANs fidelity and diversity, without training instability and mode collapse issues [55]. Recent research efforts have mostly focused on efficient sampling schedulers [14, 56, 57], architecture design [58], score-based modeling [59, 60], large-scale text-to-image generation [12, 1 11], diffusion personalization [61-63], and extensions to other domains [64-66].
Recent research efforts mainly utilized diffusion models for data augmentation, such as for im- age classification [67-75], object detection [76-78], spurious correlation [79] and medical image analysis [80-82] while we focus on synthesizing outliers for OOD detection. Graham et. [83] and Liu et.al. [84] utilized diffusion models for OOD detection, which applied the reconstruction error as the OOD score, and therefore is different from discriminative approach our paper. Liu ef.al. [85] jointly trained small-scale diffusion model and classifier while regarding the inter- polation between the ID data and its noisy version as outliers, which is different from the synthesis approach in DREAM-OOD. Mcanwhile, our method does not require training the diffusion model at all. Kirchheim et. [86] modulated the variance in BigGAN [87] to generate outliers rather than using diffusion models. Franco et.al. [88] proposed denoising diffusion smoothing for certifying the robustness of OOD detection. Sehwag et.al. [89] modified the sampling process to guide the diffusion models towards low-density regions but simultaneously maintained the fidelity of synthetic data belonging to the ID classes. Several works employed diffusion models for anomaly segmentation on medical data [90-92], which is different from the task considered in our paper.
0OD detection has attracted surge of interest in recent years [93-101]. One line of work performed OOD detection by devising scoring functions, including confidence-based methods [25, 26, 102),

---

energy-basee score [6. 103, 104], distance- approaches [21, 23, 27, 29, 105-108), gradient- based score [109], and Bayesian approaches [110-115]. Another promising line of work addressed OOD detection by training-time regularization [116-125]. For example, the model is regularized to produce lower confidence [4, 33] or higher energy [5, 6, 126] on the outlier data. Most regularization methods require the availability of auxiliary OOD data. [127, 128] enhanced OOD detection from the perspective of ID distribution. Several recent works [1. 2] synthesized virtual outliers in the feature space, and regularizes the model's decision boundary between ID and OOD data during training. In contrast, DREAM-OOD synthesizes photo-realistic outliers in pixel space, which enables visually inspecting and understanding synthetic outliers in human-compatible way.
Recently, there has been growing interest multi-modie OOD detection that utilizes textual informa- tion for visual OOD detection. Fort et.al. [129] proposed scheme where pretrained CLIP models are provided with candidate OOD labels for each target dataset, and show that the output probabilities summed over the OOD labels effectively capture OOD uncertainty. Esmaeilpour et.al. [1 [130] proposed train a label generator based on the visual encoder of CLIP and use the generated labels for OOD) detection. Ming et.al. [98, 99] alleviates the need for prior information on OOD by investigating pre-trained CLIP models and parfmeter-efficient fine-tuning methods for OOD detection. [131] uti- lized textual outlier exposure with vision- lasoon-aanguage models to enhance the neural network's capability to distinguish between ID and OOD data. In contrast, DREAM-OOD generates the outlier visual embeddings by training classifier conditioned on the ID texts and then uses the diffusion model for outlier image synthesis.
6 Conclusion
In this paper, we propose a novel learning framework DREAM-OOD, which imagines photo-realistic outliers in the pixel space by way of diffusion models. DREAM-OOD mitigates the key shortcomings of training with auxiliary outlier datasets, which typically require inteenintessvv human intervention for data preparation. DREAM-OOD leams text-conditioned latent space based on ID data, and then samples outliers in the low-likelihood region via the latent. We then generate outlier images by decoding the outlier embeddings with the diffusion model. The empirical result shows that training with the outlier images helps establish competitive performance on common OOD detection benchmarks. Our in-depth quantitative and qualitative ablations provide further insights the efficacy of DREAM-OOD. We hope our work will inspire future research on automatic outlier synthesis in the pixel space.
7 Broader Impact
Our project aims to improve the reliability and safety of modern machine learning models. Our study on using diffusion models to synthesize outliers can lead to direct benefits and societal impacts, particularly when auxiliary outlier datasets are costly to obtain, such as in safety-critical applications. Nowadays, research on diffusion models is prevalent, which provides various promising opportunities for exploring the off-the-shelf large models for our research. Our study does not involve any violation of legal compliance. Through our study and release of code, we hope to raise stronger research and societal awareness towards the problem of data synthesis for -uitrf-distribution detection in real-world settings.
8 Acknowledgement
We thank Yifei Ming for his valuable suggestions on the draft. The authors would also like to thank NeurIPS anonymous reviewers for their helpful feedback. Research is supported by the Jane Street Graduate Research Fellowship, AFOSR Young Investigator Program under award number FA9550-23-1-0118 National Science Foundation (NSF) Award No. IIS-2237037 & IIS-2331 669, Office of Naval Research under grant number 180014-23-1-266
Philanthropic Fund from SFF, and faculty research awards/gifts from Google and Meta. Zhu is supported in part by NSF grants 2023239, 2041428, 2202457, ARO MURI W91 1N021N1111311 10317 and AF CoE FA9550- 1-1-6166.
10

---

References
[1] Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't t know by virtual outlier synthesis. In Proceedings of the International Conference Learning Representations, 2022.
[2] Leitian Tao, Xuefeng Du, Xiaojin Zhu, and Yixuan Li. Non-parametrie outlier synthesis. In Proceedings of the International Conference Learning Representations, 2023.
[3] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pages 427-436, 2015.
[4] Dan Hendryeks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. Proceedings of the International Conference on Learning Representations, 2019.
[5] Julian Katz- Samuuls, Julia B. Nakhleh, Robert D. Nowak, and Yixuan Li. Training OOD detectors their natural habitats. In Proceedings of the International Conference on Machine Learning, pages 10848-10866 2022.
[6] Weitang Liu, Xiaoyun Wang, John Owens. and Yixuan Li. Energy-based out- -utto--distributtion detection. Advances in Neural Information Processing Systems,
2020.
Yifei Ming, Ying Fan, and Yixuan Li. POEM: out-of-distribution detection with posterior sampling. In Proceedings of the International Conference on Machine Learning, pages 15650-15665, 2022.
[8] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 248-255, 2009,
[9] Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning, pages 8162-8171, 2021.
[10] Vladimir Vapnik. The nature of statistical learning theory. Springer science & business media, 1999.
[11] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.061 2022.
[12] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo-Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic text-to-imaae diffusion models with deep language understanding. In Advances in Neural Information Processing Systems, 2022.
[13] Jascha Sohl- biil-Dicsttei, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep un- supervised learning using nonequilibrium thermodynamics. In International Conference Machine Learning, pages 2256-2265, 2015.
[14] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representattonss 2021.
[15] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:68440-6851, 2020.
[16] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Mc- Grew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. International Conference on Machine Learning, 2022.
[17] Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David J Fleet, and Mohammad Norouzi. Image super-resolution via iterative refinement. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.

---

[18] Robin Rombach, Andreas Blatimann. Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[19]
Christoph Schuhmann, Romain Beaumont, Richard Veneu, Cade W Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa R Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmar- ezyk, and Jenia Jitsev. LAION-5b: An open large-scale dataset for training next generation image-text models. In Advances Neural Information Processing Systems, Datasets and Benchmarks Track, 2022.
[20] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In Proceedings of the International Conference Machine Learning, pages 9748-8763, 2021.
[21] Xuefeng Du, Gabriel Gozum, Yifci Ming, and Yixuan Li. Siren: Shaping representations for detecting out-of-distribution objects. Advances in Neural Information Processing Systems, 2022.
[22] Kanti V Mardia, Peter E Jupp, and KV Mardia. Directional statistics, volume 2. Wiley Online Library, 2000.
[23] Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embed- dings for cut-of-diistrbuutio detection? In Proceedings of the International Conference on Learning Representations, 2023.
[24] Larry Wasserman. Lecture notes of statistical methods for machine learning. 2019.
[25] Dan Hendryeks and Kevin Gimpel. A baseline for detecting misclassified and out-of- distribution examples in neural networks. Proceedings of the International Conference on Learning Representations, 2017.
[26] Shiyu Liang Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of- distribution image detection in neural networks. In Proceedings of the International Conference on Learning Representations, 2018
[27] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting duitt--disttiuution samples and adversarial attacks. Advances Neural Information Processing Systems, 31, 2018.
[28) Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out- of-distribution image without learning from out-of -it-o--distrbuttion data. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 10951-10960, 2020.
[29] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. cuttof--iitributiin detection with deep nearest neighbors. In Proceedings of the International Conference on Machine Learning. pages 20827-20840, 2022.
[30] Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distributioon with virtual-logit matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4921-4930, 2022.
[31] Yiyou Sun, Chuan Guo, and Yixuan Li. React: -ut-o--dis detection with rectified activations. In Advances in Neural Information Processing Systems, volume 34, 2021.
[32] Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-distributtio detection. In Proceedings of European Conference on Computer Vision, 2022.
[33] Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibratd classifiers for detecting out-of-disttibuttin samples. In Proceedings of the International Conference on Learning Representations, 2018.
12

---

[34] Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos. Sammy Mohamed, and Andrea Vedaldi. Describing textures the wild. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3606-3613, 2014.
[35] Yuval Netzer, Tao Wang. Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
[36] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE transactions on pattern analysis and muchine intelligence, 4006);1452-1466 2017.
[37] Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint arXiv:/504.06755, 2015.
[38] Fisher Yu, Ari Seff, Yinda Zhang. Shuran Song. Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: : 03365, 2015.
[39] Rui Huang and Yixuan Li. Mos: Towards scaling diittr--dsttitttiinn detection for large semantic space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 87 8710-8719, 2021.
[40] Grant Van Horn, Oisin Mac Aodha, Yang Song. Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 8769-8778, 2018
[41] Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey zoo. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3485-3492, 2010.
[42] Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[43] Jun Hao Liew Hanshu Yan, Daquan Zhou, and Jiashi Feng. Magicmix: Semantic mixing with diffusion models. arXiv preprint arXiv:22 00.2000.60666 2022.
[44] Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15262 15271,,
[45] Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International Conference on Machine Learning, pages 5389-5400, 2019.
[46] Ekin Cubuk, Barret Zoph, Jonathon Shlens, and Quoc Le. Randaugment: Practical automated data augmentation with reduced search space. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition workshops, pages 702-703, 2020.
[47] Ekin D. Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoe V. Le. Au- toaugment: Learning augmentation strategies from data. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019.
[48] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF international conference computer vision, pages 6023-6033 2019.
[49] Dan Hendrycks*, Norman MU Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple method to improve robustness and uncertainty under data shift. In International Conference on Learning Representations, 2020.
13

---

[50] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang. Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli,, Mike Guo, et al. The many faces of robustness: A critical analysis of out-o--distribution generalization. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 8340-8349, 2021.
[51] Marvin Zhang. Sergey Levine, and Chelsea Finn. Memo: Test time robustness via adaptation and augmentation. Advances in Neural Information Processing Systems, 2022.
[52] Jonathan Ho, Chitwan Saharia, William Chan, David J Fleet, Mohammad Norouzi, and Tim Salimans. Cascaded diffusion models for high fidelity image generation. J. Mach. Learn. Res., 2022
[53] Chitwan Saharia, William Chan, Huiwen Chang, Chris Lee, Jonathan Ho, Tim Salimans, David Fleet, and Mohammad Norouzi. Palette: manage-t--image diffusion models. In ACM SIGGRAPH 2022 Conference Proceedings, pages 1-10, 2022.
[54] Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey Gritsenko, Diederik P Kingma, Ben Poole, Mohammad Norouzi, David Fleet, et al. Imagen video: High definition video generation with diffusion models. arXiv preprint 1rXiv:2210.02303, 2022.
[55] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, 34:8780-877 2021.
[56] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 2022.
[57] Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. In International Conference on Learning Representations, 2022.
[58] William Peebles and Saining Xie. Scalable diffusion models with transformers. arXiv preprint arXiv:2212.097488 2022.
[59] Yang Song, Conor Durkan, lain Murray, and Stefano Ermon. Maximum likelihood training of acore-based diffusion models. Advances Neural Information Processing Systems, 34:1 1415- 1428, 2021.
[60] Yang Song. Jascha Sohl- Dick-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.
[61] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit Haim Bermano, Gal Chechik, and Daniel Cohen-or. An image is worth one word: Personalizing text-to-image using textual inversion. In International Conference on Learning Representations, 2023.
image generation
[62] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aber- man. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. arXiv preprint arXiv: 12242, 2022.
[63] Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun- Zhu. Multi- concept customization of text-to-image diffusion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
[64] Ben Poole, Ajay Jain, Jonathan T Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. arXiv preprint arXiv:2209. /4988, 2022.
[65] Shoufa Chen, Peize Sun, Yibing Song, and Ping Luo. Diffusiondet: Diffusion model for object detection. arXiv preprint arXiv:2211.0997272 220.29981.0988 2022.
[66] Daniel Watson, William Chan, Ricardo Martin Brualla, Jonathan Ho, Andrea Tagliasacchi, and Mohammad Norouzi. Novel view synthesis with diffusion models. In International Conference on Learning Representations, 2023.
[67] Hritik Bansal and Aditya Grover. Leaving reality to imagination: Robust classification via generated datasets. arXiv preprint arXiv:2302.02550, 2023.
14

---

[68] Sven Gowal, Sylvestre-Alvis Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy Mann. Improving robustmess using generated data, Advances in Neural Information Processing Systems, 34:4218 4-233, 2021.
[69] Ruifei He, Shuyang Sun, Xin Yu, Chuhui Xue, Wenqing Zhang, Philip Torr, Song Bai, and Xiaojuan Qi. synthetic data from generative models ready for image recognition? In International Conference on Learning Representations, 2023.
[70] Jianhao Yuan, Francesco Pinto, Adam Davies, Aarushi Gupta, and Philip Torr. Not just pretty pictures: Text-to-image generators enable interpretable interventions for robust representations. arXiv preprint ar..i:221221122333 2022.
[71] Brandon Trabucco, Kyle Doherty, Max Gurinas, and Ruslan Salakhutdinov. Effective data augmentation with diffusion models. arXiv preprint arXiv::3302.07944 2023.
[72] Yifan Zhang, Daquan Zhou, Bryan Hooi, Kai Wang, and Jiashi Feng, Expanding small-scale datasets with guided imagination. arXiv preprint arXiv:2211..3377, 2022.
[73] Shekoofeh Azizi, Simon Korbblith, Chitwan Saharia, Mohammad Norouzi, and David J Fleet. Synthetic data from diffusion models improves imagenet classification. arXiv preprint arXiv:2304.0844 2023.
[74] Max F Burg, Florian Wenzel, Dominik Zietlow, Max Horn, Osama Makansi, Francesco Locatello, and Chris Russell. A data augmentation perspective on diffusion models and retrieval. arXiv preprint arXiv:2304. 10253, 2023.
[75] Mert Bulent Sariyildiz, Karteek Alahari, Diane Larlus, and Yannis Kalantidis. Fake it till you make it: Learning transferable representations from synthetic imagenet clones. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
[76] Yunhao Ge, Jiashu Xu, Brian Nlong Zhao, Laurent Itti, and Vibhav Vineet. Dall-e for detection: Language-driven context image synthesis for object detection. arXiv preprint arXiv:2206.09592, 2022.
[77] Yunhao Ge, Jiashu Xu, Brian Nlong Zhao, Laurent Itti, and Vibhav Vineet. Em-paste: Em-guided cut-paste with dall-e augmentation for image-level weakly supervised instance segmentation. arXiv preprint arXiv:2212.07623) 2022.
[78] Minheng Ni, Zitong Huang, Kailai Feng, and Wangmeng Zuo. Imaginarynet: Learning object detectors without real images and annotations. In International Conference Learning Representations, 2023.
[79] Saachi Jain, Hannah Lawrence, Ankur Moitra, and Aleksander Madry. Distilling model failures directions in latent space. In International Conference on Learning Representations, 2023.
[80] Hazrat Ali, Shafaq Murad, and Zubair Shah. Spot the fake lungs: Generating synthetic medical images using neural diffusion models. arXiv preprint arXiv:22 1.0090,, 2022.
[81] Walter HL Pinaya, Petru-Daniel Tudosiu, Jessica Dafflon, Pedro F Da Costa, Virginia Fernan- dez, Parashkev Nachev, Sebastien Ourselin, and M Jorge Cardoso. Brain imaging generation with latent diffusion models. In MICCA/ Workshop on Deep Generative Models, pages 117-126, 2022.
[82] Luke W Sagers, James A Diao, Matthew Groh, Pranav Rajpurkar, Adewole S Adamson, and Arjun K Manrai. Improving dermatology classifiers across populations using images generated by large diffusion models. arXiv preprint arXiv:2211.1331
2022.
[83] Mark S Graham, Walter HL Pinaya, Petru-Daniel Tudosiu, Parashkev Nachev, Sebastien Ourselin, and M Jorge Cardoso. Denoising diffusion models for out-of-distribution detection. arXiv preprint arXiv:2211.001 1.007740 2022.
[84] Zhenzhen Liu, Jin Peng Zhou, Yufan Wang, and Kilian Q Weinberger. Unsupervised out-of- distribution detection with diffusion inpainting. Proceedings of the International Conference Machine Learning, 2023.
15

---

[85] Luping Liu, Yi Ren, Xize Cheng, and Zhou Zhao. Diffusion denoising process for perceptron bias in diist---iittittti detection. arXiv preprint arXiv:2211.11255, 2022.
[86] Konstantin Kirchheim and Frank Ortmeier. On outlier exposure with generative models. In NeurIPS ML Safety Workshop, 2022.
[87] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In International Conference on Learning Representations, 2019.
[88] Nicola Franco, Daniel Korth, Jeanette Miriam Lorenz, Karsten Roscher, and Stephan Guenne- mann. Diffusion denoised smoothing for certified and adversarial robust out-of-distribution detection. arXiv preprint arXiv:2303. 14961, 2023.
[89] Vikash Sehwag, Caner Hazirbas, Albert Gordo, Firat Ozgenel, and Cristian Canton. Generating high fidelity data from low-density regions using diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1 11492-11501, 2022.
[90] Julia Wolleb, Florentin Bieder, Robin Sandkühler, and Philippe Cattin. Diffusion models for medical anomaly detection. arXiv preprint arXiv:2203.044 2022.
[91] Walter HL Pinaya, Mark S Graham, Robert Gray, Pedro F Da Costa, Satrel Tudosiu, Paul Wright, Yee H Mah, Andrew D MacKinnon, James Teo, Rolf Jager, et al. Fast unsupervised brain anomaly detection and segmentation with diffusion models. arXiv preprint arXiv:2206. (.X1:22206.03661, 2022.
[92] Julian Wyatt, Adam Leach, Sebastian M. Schmon, and Chris G. Willcocks. Anoddpm: Anomaly detection with denoising diffusion probabilistic models using simplex noise. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, pages 650 656, 2022.
[93] Zhen Fang. Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is outto--diitributtio detection learnable? Advances in Neural Information Processing Systems, 2022.
[94] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized -iit----iistibutionn detection: A survey, arXiv preprint arXiv:2110.1 1134,, 2021.
[95] Ido Galil, Mohammed Dabbah, and Ran El- Yaniv. A framework for benchmarking class- out-of-distribution detection and its application to imagenet. In International Conference on Learning Representations, 2023.
[96] Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple ac- tivation shaping for out-of-distribution detection. In International Conference on Learning Representations, 2023.
[97] Haoyue Bai, Gregory Canal, Xuefeng Du, Jeongyeol Kwon, Robert D Nowak, and Yixuan Li. Feed two birds with one scone: Exploiting wild data for both -utoo--distriuttion generalization and detection. International Conference on Machine Learning, 2023.
[98] Yifei Ming and Yixuan Li. How does fine-tuning impact nut-of-distribure detection for vision-language models? International Journal of Computer Vision, 2023.
[99] Yifei Ming, Ziyang Cai, Jiuxiang Gu, Yiyou Sun, Wei Li, and Yixuan Li. Delving into out-of-distribution detection with vision-language representations. In Advances in Neural Information Processing Systems, 2022.
[100] Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng. Haoqi Wang. Guangyao Chen, Bo Li, Yiyou Sun, et al. Openood: Benchmarking generalized out-of-distribution detection. Advances in Neural Information Processing Systems, 35:32598- 2022.
[101] Jingyang Zhang, Jingkang Yang, Pengyun Wang, Haoqi Wang, Yueqian Lin, Haoran Zhang, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, et Openood vl. 5: Enhanced benchmark for out-of-distribution detection. arXiv preprint a0Xiv:2306.099 09301, 2023.
16

---

[102] Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1563-1572, 2016.
[103] Haoran Wang, Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't know? Proceedings of the Advances in Neural Information Processing Systems, 2021.
[104] Qitian Wu, Yiting Chen, Chenxiao Yang, and Junchi Yan. Energy-based -iitri--dittiittionnn detection for graph neural networks. In International Conference on Learning Representations, 2023.
[105] Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. In Advances in Neural Information Processing Systems, 2020.
[106] Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self- supervised outlier detection. In International Conference Learning Representations, 2021.
[107] Jie Ren, Jiaming Luo. Yao Zhao, Kundan Krishna, Mohammad Salch, Balaji Lakshmi- narayanan, and Peter J Liu. Out-of-distribution detection and selective generation for condi- tional language models. In International Conference on Learning Representations, 2023.
[108] Rheeya Uppaal, Junjie Hu, and Yixuan Li. Is fine-tuning needed? pre-trained language models are near perfect for out-of-domain detection. In Annual Meeting of the Association for Computational Linguistics, 2023.
[109] Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. In Advances in Neural Information Processing Systems, 2021.
[110] Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In Proceedings of the International Conference Machine Learning, pages 1050-1059, 2016.
[111] Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. In Advances in Neural Information Processing Systems, volume 30, pages 6402-6413, 2017.
[112] Wesley J Maddox, Pavel Izmailov, Timur Garipov, Dmitry P Vetrov, and Andrew Gordon Wilson. A simple baseline for bayesian uncertainty in deep learning. Advances in Neural Information Processing Systems, 52:13153-13164 2019.
[113] Andrey Malinin and Mark Gales. Reverse kl-divergence training of prior networks: Improved uncertainty and adversarial robustness. In Advances in Neural Information Processing Systems, 2019.
[114] Yeming Wen, Dustin Tran, and Jimmy Ba. Batchensemble: an alternative approach to efficient ensemble and lifelong learning. In International Conference on Learning Representations. 2020.
[115] Agustinus Kristiadi, Matthias Hein, and Philipp Hennig. Being bayesian, even just a bit, fixes overconfidence in relu networks. In International conference on machine learning, pages 5436-5444 2020.
[116] Petra Bevandić, Ivan Krešo, Marin Oršić, and Siniša Šegvić. Discriminative out-of detection for semantic segmentation. arXiv preprint arXiv: 1808. 07700, 2018
[117] Andrey Malinin and Mark Gales. Predictive uncertainty estimation via prior networks. Ad- vances in Neural Information Processing Systems, 31, 2018
[118] Yonatan Geifman and Ran El- El-Yaniv. Selectivenet: A deep neural network with an integrated reject option. In Proceedings of the International Conference on Machine Learning, pages 2151-2159 2019.
17

---

[119] Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high-come cesh-confidence predictions far away from the training data and how mitigate the problem. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 41 41-50, 2019.
[120] Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't know. In Proceedings of the International Conference on Learning Representations, 2020.
[121] Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 5216-5223, 2020.
[122] Taewon Jeong and Heeyoung Kim. Ood-maml: Meta-learning for few-shot out-of distrbbbbbtttonn detection and classification. Advances in Neural Information Processing Systems, 33:3907- 3916, 2020.
[123] Joost van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation us- ing single deep deterministic neural network. In Proceedings of the International Conference Machine Learning, pages 9690-9700, 2020.
[124] Jingkang Yang, Haoqi Wang, Litong Feng, Xiaopeng Yan, Huabin Zheng, Wayne Zhang, and Ziwei Liu. Semantically coherent ouitrf-dis detection. In Proceedings of the International Conference on Computer Vision, pages 8281-8288 2021.
[125] Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In Proceedings of the International Conference on Machine Learning, pages 23631 2022.
[126] Xuefeng Du, Xin Wang, Gabriel Gozum, and Yixuan Li. Unknown-aware object detection: Learning what you don't know from videos in the wild. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, 2022.
[127] Julian Bitterwolf, Maximilian Müller, and Matthias Hein. In or out? fixing imagenet out-of- distribution detection evaluation. In International Conference Machine Learning, pages 2471-2506, 2023.
[128] Jianing Zhu, Hengzhuang Li, Jiangchao Yao, Tongliang Liu, Jianliang Xu, and Bo Han. Unleashing mask: Explore the intrinsic out-of-distribtiion detection capability, arXiv preprint arXiv:2306.03715, 2023.
[129] Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of out-of- distribution detection. Advances Neural Information Processing Systems, 34:7068-708.. 2021.
[130] Sepideh Esmaeilpour, Bing Liu, Eric Robertson, and Lei Shu. Zero-shot out-of-distribution detection based on the pre-trained model clip. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pages 6568 6576, 2022.
[131] Sangha Park, Jisoo Mok, Dahuin Jung, Jangho Lee, and Sungroh Yoon. On the powerfulness textual outliers for visual ood detection. In Advances in Neural Information Processing Systems, 2023.
18

---

Dream the Impossible:
Outlier Imagination with Diffusion Models ( (Appendix)
A
Details of datasets
ImageNet- We randomly sample 100 classes from IMAGENET- IK [8] to create IMAGENET- -IN 100.
The dataset contains the following categories: n01498041, n01514859, n01582220, n01608432, n01616318, n01687978,
1716331 n01806567, n01833805, n01882714, n01910747, n01944390, n01985128, n02007558, 12207 n020R5620, 14215
a02123045, 002128385, 002129165, 002129604, n02165456, 002190166, n02219486, nU22264429, nU/229997, nU2317335, nl22226432.
202342885, 002363005, 002391049, 002395406, n02403003, n02422699, n02442845, n02444819, n02480855, n02510455, n026400422
n02672831, 002687172, 002701002, 002730930, n02769748, 002782093, n02787622. n02793495, n02799071, n02802426, nU28118800
m02840245, n02906734, m02948072, 002980441, n02999410, n03014705, n03028079, n03032252, n03125729, n03160309, n03179701,
m03220513, m03249569, n03291819, n03384352, 003388043, n03450230, n03481172, n01594434, n03594945, m03627232, n03642806.
H03649909, n03661043, n03676483, n03724870, m03733281, n03759954, n03761084, n03773504,, n03804744, n03916031, n01938824,,
m04004767, n04026417, m04090263, n04133789, n04153751, n04296562, n04330267, n04371774, n04404412, n04465501, n04485082,
mo4507 155, n04536866, n04579432, n04606251, n07711499 n07745940.
OOD datasets. Huang et.al. [39] curated diverse collection of subsets from iNaturalist [40], SUN [41], Places [36], and Texture [34] as large-scale OOD datasets for IMAGENET- Ik, where the classes of the test sets do overlap with IMAGENET-IK. We provide a brief introduction for each dataset as follows.
iNaturalist contains images of natural world [40]. It has 13 super-categories and 5,089 sub- categorigees covering plants, insects, birds, mammals, and so on. We use the subset that contains 110 plant classes which do not overlap with IMAGENET- 1k.
SUN stands for the Scene UNderstanding Dataset [41]. SUN contains 899 categories that cover more than indoor, urban, and natural places with or without human beings appearing in them. We use the subset which contains 50 natural objects not in IMAGENET-IK.
Places is a large scene photographs dataset [36]. It contains photos that are labeled with scene semantic categories from three macro-classes: Indoor, Nature, and Urban. The subset use contains 50 categories that are not present in IMAGENET- K..
Texture stands for the Describable Textures Dataset [34]. It contains images of textures and abstracted patterns. As no categories overlap with IMAGENET- K, we use the entire dataset as in [39].
IetgeNet-A contains 7,501 images from 200 classes, which are obtained by collecting new data and keeping only those images that ResNet-50 models fail to correctly classify [44]. In our paper, we evaluate on the 41 overlapping classes with IMAGENET- 100 which consist of a total of 1,852 images.
ImageNet-v2 used in our paper is sampled to match the MTurk selection frequency distribution of the original IMAGENET validation set for each class [45]. The dataset contains 10,000 images from 1,000 classes. During testing, we evaluate on the 100 overlapping classes with total of 1,000 images.
B Formulation of Zm
The normalization factor Zm (k) in Equation (3) is defined as:
k m/2211
Z mm/ 1 (R)
(8)
where I, is the modified Bessel function of the first kind with order v. Zm,x) can calculated in closed form based on and the feature dimensionality m.
C Additional Visualization of the Imagined Outliers
In addition to Section 4.2, we provide additional visualizations on the imagined outliers under different variance a² in Figure 8. We observe that larger variance consistently translates into outliers that are more deviated from ID data. Using a mild variance value o² 0.03 generates both empirically (Figure (b)) and visually meaningful outliers for model regularization on IMAGENET- 100.
19

---

0102
[4] imagendd ID dass Beaver
Iraginsd octinrs
daas Apren
outhers chasa Sir Strawberry
Figure 8: Visualization of the imageined outliers for beaver, apron, strawberry class with different variance values o².
D Visualization of Outlier Generation by Embedding Interpolation
We visualize the generated outlier images by interpolating token embeddings from different classes in Figure 9. The result shows that interpolating different class token embeddings tends to generate images that are still in-distribution rather than images with semantically mixed novel concepts, which is aligned with the observations in Liew et. al. [43]. Therefore, regularizing the model using such images is not effective for OOD detection (Table 2).
a * strawberry + (1 a) * jeep
a * hare + (1 -a) * broccoli
a=0.1
Q=0.1
0=0.3
Q=0.3
0=0.5
0=0.5
0=0.7
a=
Q=0.9
a.9
Figure 9: Visualization of the generated outlier images by interpolating token embeddings from diffcrent classes. We show the results with different interpolation weights a.
E Visualization of the Outlier Generation by Adding Noise
As in Table 2 in the main paper, we visualize the generated outlier images by adding Gaussian and learnable noise to the token embeddings in Figure 10. We observe that adding Gaussian noise tends to generate either ID images or images that are far away from the given ID class. addition, adding learnable noise to the token embeddings will generate images that completely deviate from the ID data. Both of them are less effective in regularizing the model's decision boundary.
F Comparison with Training w/ real Outlier Data.
We compare with training using real outlier data on CIFAR- 100, i.e., 300K Random Images [4], which contains 300K preprocessed images that not belong to CIFAR- classes. The result shows that DREAM-OOD (FPR95: 40.31%, AUROC: 90.15%) can match or even outperform outlier exposure with real OOD images (FPR95: 54.32%, AUROC: 91. 01.34%) under the same training configuration while using fewer synthetic OOD images for OOD regularization (100K in total).
20

---

(8) Generated oulliers by adding Gauesian ncise (b) for cless Beaver
Generated outiers by adcing Gauesian noise (c) Generated outliers by adding Gaussian noise
for ID class Apron
for ID cless Strawberry
BIGGI Mo
HIH ORG
ADH aid
A HiiqhHiyay DLLLE YIRA
CHE SHIDEM
ORL EA HAS
HGAGHA
HIGH KLille
ORÅIT
(d) Generated outliers by adding leamable naise (e) for class Beaver
outtions by adding learnable noise for ID dees Apron
(1)
Generoted outliers by adding leamaale noise
for ID clese Strawberry
Figure 10: Visualization of the generated outlier images by adding Gaussian and learnable noise to the token embeddings from different classes.
G Visualization of Generated Inlier Images
We show in Figure 11 the visual comparison among the original IMAGENET images, the generated images by our DREAM-ID, and the generated ID images using generic prompts "A high-quality photo of [cls]" where "[cls]" denotes the class name. Interestingly, generation produces object-centric and distributionally dissimilar images from the original dataset. In contrast, our approach DREAM-ID generates inlier images that resemble the original IID data, which helps model generalization.
observe that the prompt-based
H Experimental Details for Model Generalization
We provide experimental details for Section 4.3 in the main paper. We use ResNet-34 [42] as the network architecture, trained with the standard cross-entropy loss. For both the CIFAR- 100 and IMAGENET- 100 datasets, we train the model for 100 epochs, using stochastic gradient descent with the cosine learning rate decay schedule, momentum 0.9, and a weight decay of 5e -4 The initial learning rate is set to 0.1 and the batch size is set 160. We generate 1, 000 new ID samples per class using Stable Diffusion v1.4, which result in 100, 000 synthetic images. For both the baselines and method, train combination of the original IMAGEnET/CIFAR samples and synthesized ones. To learn the feature encoder hg, we set the temperature in Equation (2) to 0.1. Extensive ablations hyperparameters and i are provided in Appendix J.
I Implementation Details of Baselines for Model Generalization
For fair comparison, we implement all the data augmentation baselines by appending the original IMAGENET- 100 dataset with the same amount of augmented images (i.e., 100k) generated from different augmentation techniques. We follow the default hyperparameter setting as their original papers.
21

---

AnsggeNat
'Hen"
Goneri
Pronpo
AnggeNir
"Balloon"
Gomert::
Prongh
Amagehte
GAADE
"Basketball"
Goner Pronze
Obrr
"Strawberry"
Geneie Prouser
Ovrz
Figure 11: Visual comparison between DREAM-ID prompt-based image generation four different classes.
For RandAugment [46], we set the number of augmentation transformations to apply sequentially 2. The magnitude for the transformations set to
For AutoAugment [47], we set the augmentation policy as the best searched IMA- GENET.
For CutMix [48], we use a CutMix probability of 1.0 and 9 in the Beta distribution to 1.0 for the label mixup.
For Aux [49], we randomly sample augmentation chains and set a for the Dirichlet distribution to mix the images.
22

---

For DeepAugment [50], we directly use the corrupted images for data augmentation provided their Github repo
For MEMO [51], follow the original paper and use the marginal entropy objective for test-time adaptation, which disentangles two distinct self-supervised learning signals: encouraging invariant predictions across different augmentations of the test point and encouraging confidence via entropy minimization.
Methods
IMAGENET
IMAGENET-A
IMAGENET-V2
Original (no aug)
87.28
8.69
77.80
RandAugment
87.56
11.07
79.20
AutoAugment
87.40
10.37
79.00
CutMix
87.64
11.33
79.70
AugMix
87.22
9.39
77.80
DREAM-ID (Ours)
88,46
12.13
80,40
Table 5: Model generalization performance (accuracy, in %), using IMAGENET-100 as the training data. The basclines are implemented by directly applying the augmentations on IMAGENET-I00
We also provide the comparison Table with baselines that are directly trained by applying the augmentations on IMAGENET without appending the original images. The model trained with the images generated by DREAM-ID can still outperform all the baselines by considerable margin.
Ablation Studies on Model Generalization
In this section, we provide additional analysis of the hyperparameters and designs of DREAM-ID for ID generation and data augmentation. For all the ablations, the IMAGENET-I00 dataset the in-distribution training data.
Ablation the variance value o². We show in Table 6 the effect of の² the number of the variance value for the Gaussian kernel (Section 3.2). We vary o² f0.005, 0.01, 0.02, 0.03J. A small-mild variance value o² is more beneficial for model generalization.
IMAGENET
IMAGENET-A
IMAGENET-V2
0.005
87.62
11.39
78.50
0.01
88.46
12.13
80.40
0.02
87.72
10.85
77.70
0.03
87.28
10.91
78.20
Table 6: Ablation study the variance value o² in the Gaussian kernel for model generalization.
Ablation k in calculating k-NN distance. In Table 7, analyze the effect of k. i.e., the number of nearest neighbors for non-parametric sampling in the latent space. In particular, we vary k {100, 200,300, 400, 500). We observe that method is not sensitive to this hyperparameter, as le varies from 100 to 500.
k
IMAGENET
IMAGENET-A
IMAGENET-V2
100
88.51
12.11
79,92
200
88.35
12.04
80.01
300
88.46
12.13
80.40
400
88.43
12.01
80.12
500
87.72
11.78
80.29
Table 7: Ablation study on the & for k-NN distance for model generalization.
23

---

K
Computational Cost
We summarize the computational cost of DREAM-OOD and different baselines on IMAGENET- 1 100 as follows. The post hoc OOD detection methods require training classification model on the ID data (~8.2 h). The outlier synthesis baselines, such as VOS (~8.22 h), NPOS (~8..4 h), and GAN (~-13.4 h) incorporate the training- time regularization with the synthetic outliers. Our DREAM-OOD involves learning lext-conditioned latent space (~8.22 h), image generation with diffusion models (~10.11 for 100K images), and training with the generated outliers (~8.5 h).
L Software and hardware
We run all experiments with Python 3.8.5 and Py PyToch 1.13.1, using NVIDIA GeForce RTX 2080Ti GPUs.
24


Reviews:
[{"review_id": "EykoigPS5f", "reviewer": "Reviewer_Qkax", "summary": "This paper proposes DREAM-OOD, a new diffusion-models-based framework to enable the generation of photo-realistic high-resolution outliers for OOD detection. DREAM-OOD works by training a text-conditioned latent space using ID data and then samples the outliers in the low-likelihood region of the latent space. Empirical results demonstrate the effectiveness of the proposed framework in enhancing the performance of OOD detection.", "questions": "1. The paper suggests learning a text-conditioned latent space based on ID data, which is task specific. I wonder how the method is superior to directly leveraging the visual latent space of the pre-trained vision-and-language model CLIP. \n2. What is the three-layer nonlinear MLP function φ(·) used for in equation (7)? Is it the binary logistic classifier for OOD detection?", "limitations": "The authors have not addressed the limitations and potential negative social impacts of their work. And I do not see any obvious negative social impacts specific to this work.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-written with clear and detailed explanations.\n2. The paper proposed an effective and reasonable framework for generating high-quality outliers images for OOD detection and achieves good empirical performance.\n3. Comprehensive and extensive experiments were conducted to compare the performance of DREAM-OOD to other existing OOD detection models and provide deep insights on the efficacy of the proposed method.", "weaknesses": "1. The paper only emphasizes that the proposed method can allow us to understand the outliers in a human-compatible way compared to other synthetic methods such as VOS and NPOS, but it is not very clear why the proposed method can achieve better OOD detection compared to others. And there is no related theoretical analysis.\n2. It does not mention the computational cost when comparing the proposed method with other OOD detection methods.\n3. It will be better if the related works can be placed before section 3.\n4. The novelty of the paper is not strong enough since it is not the first work to leverage diffusion models or visual latent space to generate outliers to promote  OOD detection.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are encouraged that you recognize our method to be new, effective, and reasonable, and with comprehensive and extensive empirical results. We thank the reviewer for the thorough comments and suggestions, which we address below:\n\n**A1. Discussion on DREAM-OOD versus feature-based outlier synthesis**\n\nGreat point! Compared with the feature-based outlier synthesis approaches, DREAM-OOD enables generating photo-realistic high-resolution outliers in the pixel space. The higher-dimensional pixel space can offer much more knowledge about the unknowns, which provides the neural networks with high variability and fine-grained details for the unknowns that are missing in the feature-based synthesized outliers  (such as VOS and NPOS). Since our method is more photo-realistic and better for humans; the generated images can be naturally better constrained for NNs -- that's not available in old methods (for example, things may be more on the natural image manifolds). As shown in Figure 5, the generated outlier images demonstrate reasonably creative OOD visual representations, which are more precise in characterizing OOD data and thus improve performance.\n\nMoreover, we would like to clarify that our paper focuses on *demonstrating the feasibility and promise of generating photo-realistic outliers in the high dimensional pixel space by way of diffusion models*. We provide comprehensive quantitative and qualitative analyses to understand the efficacy of DREAM-OOD. While we position DREAM-OOD as a methodology rather than a theory paper, we do agree it will be a meaningful direction. One plausible direction can be analyzing the generalization error bound for the OOD detector [1] trained with the ID and the generated outlier images. One can use the probably approximately correct (PAC) learning theory and analyze the key concepts, such as sample complexity, in the setting of learning with the auxiliary outliers and compare our approach against the feature-based synthesis approaches. We believe our current work serves as a key cornerstone to enable such theoretical analysis next. \n\n[1] Fang et.al., Is Out-of-Distribution Detection Learnable?, NeurIPS 2022.\n\n**A2. Discussion on the computational cost**\n\nAs suggested, we summarize the computational cost of DREAM-OOD and different baselines on ImageNet as follows.\n\n\nSpecifically, the post hoc OOD detection methods require training a classification model on the ID data ($\\sim$ 8.2 h). The outlier synthesis baselines, such as VOS ($\\sim$ 8.2 h), NPOS ($\\sim$ 8.4 h), and GAN ($\\sim$ 13.4 h) incorporate the training-time regularization with the synthetic outliers. Our DREAM-OOD involves learning the text-conditioned latent space ($\\sim$ 8.2 h), image generation with diffusion models ($\\sim$ 10.1 h for 100K images), and training with the generated outliers ($\\sim$ 8.5 h). We use 8 NVIDIA GeForce RTX 2080Ti GPUs for our experiments.\n\nWe have included the computational cost in the revised manuscript. \n\n**A3. Novelty**\n\nTo the best of our knowledge, DREAM-OOD is the first work to leverage diffusion models for synthesizing high-quality outliers in the pixel space. We conducted an extensive literature survey (see L307-320), where no existing work is similar to ours in terms of scope and methodology. While Graham et.al. [2] and Liu et.al. [3] utilized diffusion models for OOD detection, they directly applied the reconstruction error as the OOD score and did not focus on outlier synthesis. In contrast to the feature-based outlier synthesis methods, DREAM-OOD enables the new capability of synthesizing in the high-dimensional pixel space, which not only offers better empirical performance but also much more visual interpretability on the generated outliers.\n\nWe believe the major differences w.r.t. literature support the meaningful contributions of our proposed approach. At the same time, the novelty of our learning framework is recognized by several other reviewers, for example:\n\n> 1) \"_The paper is the first to generate high-resolution outliers for OOD detection task. It is a novel use of diffusion models_.\" from reviewer 3rTL\n> 2) \"_This paper proposes a new framework, i.e., DREAM-OOD, for image synthesis, which is the first method for generating photo-realistic high-resolution outliers and owns high originality_.\" from reviewer 94Wq\n\n\n[2] Graham et.al., Denoising diffusion models for out-of-distribution detection, CVPR VAND Workshop 2023\n\n[3] Liu et.al., Diffusion denoising process for perceptron bias in out-of-distribution detection, arXiv preprint 2211.11255.\n\n**A4. Experiments on the text-conditioned latent space versus the visual latent space of CLIP**\n\nThat's an interesting idea. As suggested, we have implemented sampling by directly using the latent space of the pre-trained CLIP model (ViT-L/14 as the backbone). All other settings are kept the same as the DREAM-OOD. The results comparison on ImageNet is shown below:\n\n| | INATURALIST | |PLACES ||SUN||TEXTURES||Average ||ID ACC|\n| ------ | ----- | ----- |  ----- | ----- |----- | ----- |----- | -----|----- |----- |----- |\n| Method | FPR95 | AUROC | FPR95 | AUROC | FPR95 | AUROC |FPR95 | AUROC | FPR |  AUROC ||\n |DREAM-OOD   |  **24.10** | **96.10** | **39.87** | **93.11** | **36.88** | **93.31** | **53.99** | **85.56** | **38.76** | **92.02** | 87.54| \n| CLIP as latent |47.28  | 88.80| 47.23|84.22  |39.09 |85.82 | 68.75| 79.69| 50.57|84.63 | 86.92 | \n\nAs we can observe, using the pre-trained CLIP latent for sampling achieves a worse performance compared to our text-conditioned latent space because the pre-trained CLIP latent is suboptimal compared to ours. \n\n**A5. Clarification on the three-layer nonlinear MLP function**\n\nThe three-layer nonlinear MLP function is the binary logistic classifier for OOD detection as you concur.\n\n**A6. Position of the related work section**\n\nWe will rearrange the sections based on your suggestion. Thank you for pointing that out!"}, {"review_id": "rjWlruwa4q", "reviewer": "Reviewer_94Wq", "summary": "This paper focuses on utilizing auxiliary outliers for the OOD detection task. Specifically, different from other works using the collected outliers, this work studies generating photo-realistic outliers in the high dimensional pixel space. This paper proposes a new framework, namely, DREAM-OOD, which utilizes diffusion models to generate outliers with only in-distribution data and classes. Comprehensive analyses and experiments are conducted to demonstrate the effectiveness of the proposed method.", "questions": "1. Apart from involving the diffusion model, what is the difference in technical level between the previous methods (like VOS and NPOS) on outlier synthetics with the proposed method in image synthetic?\n2. This method may be affected by the quality of the pre-trained diffusion models. What if the diffusion model can not generate high-resolution images?", "limitations": "There is no discussion of the limitations of the current work.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. This paper proposes a new framework, i.e., DREAM-OOD, for image synthesis, which is the first method for generating photo-realistic high-resolution outliers and owns high originality.\n2. The outlier imagination with diffusion models utilizes the text-conditioned latent space and has the theoretical interpretation of the loss, the presentation is good and easy to understand.\n3. The experimental parts include analyses of different perspectives, and the performance of DREAM-OOD is promising. ", "weaknesses": "1. Apart from involving the diffusion model, what is the difference in technical level between the previous methods (like VOS and NPOS) on outlier synthetics with the proposed method in image synthetic?\n2. This method may be affected by the quality of the pre-trained diffusion models. What if the diffusion model can not generate high-resolution images?\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are glad that the reviewer finds our work new, owns high originality, and is easy to understand, with promising results and analyses. We thank the reviewer for the thorough comments and suggestions, which we address below:\n\n**A1.Technical differences between DREAM-OOD and related work**\n\nGreat point! Technically, there are two main differences between DREAM-OOD and the mentioned related works, such as VOS and NPOS. \n\n- First, DREAM-OOD introduces a crucial step to align the in-distribution visual embeddings with the corresponding textual embeddings from the diffusion model (see Section 3.1). Learning the text-conditioned latent space is the key to leveraging diffusion-based models for decoding and generating photo-realistic outliers in the pixel space. In contrast, VOS and NPOS do not leverage diffusion models, and directly sample outliers in the feature space of the image classifier. \n- Secondly, DREAM-OOD decodes the sampled OOD embeddings via the diffusion models to obtain the outlier images in the pixel space, which are then used for model regularization. Instead, VOS and NPOS directly separate the outliers and the ID in the feature space. \n- Thirdly, DREAM-OOD can also be extended to augment ID data distribution, enriching the data diversity for better generalization (Section 4.3). This was not demonstrated in either VOS or NPOS. \n\n**A2. Discussion on the quality of the pre-trained diffusion models**\n\nAnother great point! The landscape of AI has been rapidly changing in the last year. In particular, the recent rise of large-scale generative models has provided researchers in the community with many powerful diffusion models that can produce high-resolution images. The wide availability of strong diffusion models is a key reason why DREAM-OOD becomes possible (which admittedly, would have been difficult in the past). Notably, there are more than thousands of research projects built on top of them, such as subject-driven generation [1], open-vocabulary segmentation [2], spurious correlation [3], etc., to name a few. In a similar spirit, DREAM-OOD explores the promise of diffusion models for improving OOD detection, which shows strong results both quantitatively and qualitatively. We will discuss the reliance of our approach on the diffusion models in the revised version.\n\n\n[1] Ruiz et.al., DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generation, CVPR 2023.\n\n[2] Xu et.al., Open-vocabulary panoptic segmentation with text-to-image diffusion models, CVPR 2023\n\n[3] Jain et.al., Distilling model failures as directions in latent space, ICLR 2023."}, {"review_id": "qoTPkzyBSe", "reviewer": "Reviewer_thbj", "summary": "This paper proposes DREAM-OOD. \nIt constructs a text-conditioned latent space by learning an image encoder $h_\\theta$ with a pretrained text encoder $\\mathcal{T}$ and a contrastive loss.\nDuring OOD generation, DREAM-OOD first generates outliers in the latent space according to the k-NN distance in Eq. (5), and then decodes them to the pixel space using a pretrained diffusion model. \nDREAM-OOD can also be extended to ID data synthesis. \nExperiments show that DREAM-OOD provides benefits for OOD detection tasks.", "questions": "1. How does DREAM-OOD scale to larger datasets? The ID datasets used in this paper are quite small.", "limitations": "There is no discussion on the limitation.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-organized, and the method is easy to follow.\n2. The t-SNE visualizations in Figure 3 and 4 clearly demonstrate the quality of the learned latent space and the feasibility of filtering latent outliers using Eq. (5).\n3. DREAM-OOD outperforms selected baselines using CIFAR-100 or ImageNet as the ID dataset.\n4. This paper includes ablation studies on the selection of some hyperparameters. Figure 7 shows that DREAM-OOD is robust to these hyperparameters.", "weaknesses": "1. There is neither a complexity analysis nor a report on the computational resource cost.\n2. Although ablation studies on hyperparameters are included, the range of the candidates is still problematic. For example, the range of $k$ is too small compared to the dataset size.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are happy to see that the reviewer finds our work easy to follow with appropriate visualizations & ablations and that our paper is organized. We thank the reviewer for the thorough comments and suggestions, which we address below:\n\n\n**A1.Discussion on the computation cost**\n\nAs suggested, we summarize the computational cost of DREAM-OOD and different baselines on ImageNet as follows.\n\n\nSpecifically, DREAM-OOD involves learning the text-conditioned latent space ($\\sim$ 8.2 h), image generation with diffusion models ($\\sim$ 10.1 h for 100K images), and training with the generated outlier images ($\\sim$ 8.5 h). We use 8 NVIDIA GeForce RTX 2080Ti GPUs for our experiments. \n\nWe have included the computational cost in the revised manuscript. \n\n**A2. Discussion on the range of k in the ablation**\n\nThanks for your suggestion! Since we calculate the $k$-NN distance between each sample and the remaining samples belonging to the same class in implementation, and there are approximately 1,000 samples **per class** for the ImageNet dataset and 500 samples per class for the CIFAR-100 dataset, we set the limit of $k$ to 500. For the ImageNet dataset, we additionally experimented with larger values below, with $k=600,700,800,900,1000$, which shows less superior OOD detection results. \n\n| $k$  | AUROC |\n| ------ | ----- |\n| 300 (best) | **92.02**|\n| 600   | 91.34| \n| 700   | 91.06  |  \n| 800   |  90.08 |  \n| 900   |  89.18 |  \n| 1000   |  88.27 |  \n\n**A3. Scalability of DREAM-OOD on larger ID datasets**\n\nGreat point! The largest ID dataset we used in the experiments contains approximately 100K images. For larger ID datasets, DREAM-OOD scales well for the steps of learning the text-conditioned latent space and learning with imagined outlier images. For generating the OOD images with the Stable Diffusion model, the cascaded diffusion backward sampling procedure will take longer time as they generally need more sequential function evaluation steps of large neural networks. \n\nTherefore, *the scalability of DREAM-OOD essentially hinges on the scalability of large denoising diffusion models*. In practice, we have implemented our algorithm using multiple optimized engineering techniques, such as fast sampling schedulers (i.e., PLMS [1]) with only 50 backward iterations. We have also implemented the Flash Attention [2] for the Stable Diffusion model to speed up image generation. As a next step, we will be very interested in testing DREAM-OOD on larger datasets, such as ImageNet-1k as ID, which is  10 times larger than the ID datasets used in our paper.\n\n[1] Liu et.al., Pseudo Numerical Methods for Diffusion Models on Manifolds, ICLR 2022.\n\n[2] Dao et.al., Flashattention: Fast and memory-efficient exact attention with io-awareness, NeurIPS 2022."}, {"review_id": "0aV5w7zwGm", "reviewer": "Reviewer_3rTL", "summary": "The paper tackles OOD detection in the image space and proposes to generate outliers with diffusion models. Specifically, the authors find embeddings in the text-conditioned latent space that are on the boundary of in-distribution embedding clusters. These embeddings are likely to be those of strong outliers. By performing denoising with diffusion models, outlier images can then be generated and used for OOD classifier training. Empirical results show that the approaches perform better than many baselines.", "questions": "1. Can the authors provide possible explanations on why the proposed approach performs consistently worse than baselines on the texture OOD dataset? Would some visualization help explain what happened?\n1. There exists an unsupervised OOD detection setting where the labels of in domain data are not provided. How would the proposed approach be extended in this setting?\n1. The authors might also consider using negative prompts to find additional outliers. That is, instead of specifying what the outlier should look like, it might be possible to avoid the class by pushing the embedding away from that class. Currently, all outliers are somewhat associated with in-domain data classes. It would be ideal to be able to generate outliers from additional classes.\n", "limitations": "No limitations mentioned in the main text.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* The paper is the first to generate high-resolution outliers for OOD detection task. It is a novel use of diffusion models.\n* The paper is well-written with clear method and experiment presentation.", "weaknesses": "* It seems that by adding simple Gaussian noise to the text label embedding space instead of training a classifier can already be quite strong. Is the classifier necessary here? Nevertheless, I appreciate the detailed ablation on this.\n* Please see Questions section for additional comments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are encouraged that the reviewer found our approach novel and the paper well-written. We address comments in detail below:\n\n**A1. Clarification on adding simple Gaussian noise to the latent space**\n\nThanks for acknowledging our ablations on different outlier image synthesis methods!  We agree with your opinion that adding the Gaussian noise to the textual embeddings is a strong synthesis baseline. \n\nIn contrast to pure noise, our framework DREAM-OOD learns a text-conditioned latent space for outlier generation, which can *sample low-likelihood embeddings based on the learned feature representations* and is more principled than adding Gaussian noise. The rationale of such a design is that if the sampled embeddings are distributionally far away from the ID embeddings, the decoded images will have a large semantic discrepancy with the ID images and vice versa. Adding Gaussian noise does not necessarily guarantee that the sampled outliers are in the low-likelihood region. Therefore, our approach is theoretically more sound and leads to **consistently better** OOD detection performance than adding noise to the textual embeddings across different ID datasets. \n\n**A2.Explanations of the worse performance on the texture OOD dataset**\n\nDuring the rebuttal, we examined the penultimate-layer features for the ID data and the OOD Textures dataset. We found that after regularizing the neural network using the generated outlier images, the ID and OOD features are somewhat overlapped. \n\nWe hypothesize the reason might be that the generated outlier images usually have diverse backgrounds/objects, either with indoor or outdoor environments/objects. When regularizing the classification model using such images, the model might be more confident in recognizing the images with similar background/objects as OOD while the real OOD texture images deviate from such synthesized outlier image distribution, which leads to inferior OOD detection performance. \n\n**A3. Discussion on the extension in the unsupervised OOD detection setting**\n\nSince the vast majority of OOD detection literature focuses on the supervised setting (see related work L321-L331), DREAM-OOD considers the ID labels. Without ID semantic labels provided, one simple extension to the unsupervised setting can be (1) firstly generating the captions for the unlabeled ID dataset using a state-of-the-art image-captioning model, such as [1]; (2) Collecting the object names in the generated captions; (3) Learning the text-conditioned latent space and then synthesizing the OOD outlier images as in DREAM-OOD.\n\n\n[1] Li et.al., BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models, ICML 2023.\n\n**A4. Additional design choices of the OOD embedding synthesis**\n\nYou raised a great point! To respond to your suggestions:\n\n- Your idea of pushing the embedding away from that class coincides with the baseline *(II) Add learnable noise* in Table 2 of the submission :) In this baseline, we add learnable noise to the token embeddings where the noise is trained to push the outliers away from ID features. Though adding noise to the token embedding is relatively simple, it cannot explicitly sample textual embeddings from the low-likelihood region as DREAM-OOD does, which are near the ID boundary and thus demonstrate stronger effectiveness to regularize the model. For your reference, prior work [2] showed that near-boundary outliers are the most informative for OOD detection since they help learn a decision boundary that's tightly surrounding ID data. \n- As for the idea of generating outliers from additional classes, we have implemented it during rebuttal and compared it with our DREAM-OOD. Specifically, we use the remaining 900 classes in ImageNet-1k (exclude the 100 classes in ImageNet-100 and CIFAR-100) as the disjoint class names for outlier generation. We generate the same amount of images as our DREAM-OOD to ensure a fair comparison. The OOD detection results are summarized in the following table, where we observe worse performance. We hypothesize that the generated outlier images are relatively far away from the decision boundary between the in-distribution and OOD.\n\n| Method | FPR95 | AUROC | FPR95 | AUROC |\n| ------ | ----- | ----- |  ----- | ----- |\n|  | ImageNet-100 | |CIFAR-100 |\n |DREAM-OOD   |  **38.76**| **92.02** |**40.31** |**90.15** | \n| Using other classes  | 43.55 | 87.84| 49.89| 85.87 |\n\n[2] Ming et.al., POEM: Out-of-Distribution Detection with Posterior Sampling, ICML 2022."}, {"review_id": "oUoUjeZOQu", "reviewer": "Reviewer_i54j", "summary": "The paper proposes a learning framework to generate outliers in the pixel space by way of diffusion models with only the in-distribution data. By learning a text-conditioned latent space based on  in-distribution data, the methods further sample outlier latents in low-likelihood regions. The empirical result shows that training with the generated outlier images helps establish competitive performance on common OOD detection benchmarks.", "questions": "- The OOD sampling methods are proposed in [1]. [1] uses the sampled latent for direct training while the method in this paper uses diffusion for further training. The key idea is incremental.\n- About the generator: The proposed method generates OOD samples based on a powerful stable diffusion model, which is trained on a large-scale dataset. It is much easier to generate unseen-class images. Is there any possibility for data leakage? The prior method[2] uses the diffusion trained on the original dataset. Does improvement over[1] come from the strong diffusion model?\n- How is the feature encoder designed? Have you tried a pre-trained CLIP image encoder for initialization? Considering that  the ability of the feature encoder has a direct impact on the sampling of OOD latent.\n- The cifar10 and imagenet are also commonly-used benchmarks. Besides cifar100 and imagenet100,  I wonder if there are any other results for these two more challenging datasets.\n\n[1] Tao, L., Du, X., Zhu, X. and Li, Y., 2023. Non-parametric outlier synthesis. \n\n[2] Liu, L., Ren, Y., Cheng, X. and Zhao, Z., 2022. Diffusion denoising process for perceptron bias in out-of-distribution detection.", "limitations": "The authors have adequately addressed the broader impacts.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-written and clear to me.\n- The ablation studies are sufficient.", "weaknesses": "Please refer to the questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thorough comments, which we address below:\n\n**A1. Clarification on our contribution**\n\nWe summarize the non-trivial differences between NPOS and DREAM-OOD below:\n\n- First, our key contribution is to enable the generation of high-resolution outliers for OOD detection, which was impossible with NPOS. DREAM-OOD advances the field by helping researchers visualize and understand the imagined outliers in the pixel space, **which not only offers better empirical performance but also much more interpretability on the generated outliers**. We believe this is a meaningful scientific contribution w.r.t. prior work. \n- Second, our paper contributes non-trivial technical solutions to enable using a diffusion model for outlier synthesis. Naively taking the outliers generated by NPOS won't work for the diffusion model, because NPOS generates visual latent embedding whereas the diffusion model expects a textual latent as input. While the idea of DREAM-OOD may seem natural in hindsight, it wasn't obvious to us how to generate meaningful text-latent-based outliers that one can not only use for the diffusion model but also effectively regularize the classifier. To resolve this challenge, a key intellectual design of DREAM-OOD as you recognized, is to learn a text-conditioned latent space for sampling OOD embeddings, so that the visual embeddings are aligned with the corresponding textual embeddings. Moreover, looking at the overall method design, DREAM-OOD is much more challenging than NPOS, since it encapsulates seamlessly multiple key components including learning text-conditioned latent space, sampling, decoding, and finally learning with the imagined outliers. The entire intellectual and experimental effort to make things work wasn't trivial :)\n- Lastly, our method can be used to generate ID data and improves the model generalization performance, which is not explored in NPOS. We show stronger performance than the most popular data augmentation methods, which will benefit an even broader community.\n\nWe believe the major differences support the novel contributions of our approach. Meanwhile, the novelty of our framework with diffusion models is recognized by other reviewers, such as:\n\n> 1) \"_The paper is the first to generate high-resolution outliers for OOD detection task. It is a novel use of diffusion models_.\" from reviewer 3rTL\n> 2) \"_This paper proposes a new framework...which is the first method for generating photo-realistic outliers and owns high originality_.\" from reviewer 94Wq\n\n**A2. Discussion on data leakage with diffusion models**\n\nThe recent rise of large-scale generative models has enabled thousands of research projects, such as subject-driven generation [1], open-vocabulary segmentation [2], etc. Data leakage is common in all research projects that are built on modern diffusion models. Ours perhaps is not an exception. Although this is outside the focus of our current research scope, we do believe it is an important issue for the research community. \n\nTo mitigate the possible data leakage concern, one can potentially replace the diffusion model to be trained from scratch. In this vein, [3] provides a promising route. We are happy to incorporate your opinion in the revised draft with proper citations including [3].\n\n[1] Ruiz et.al., DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generation, CVPR 2023.\n\n[2] Xu et.al., Open-vocabulary panoptic segmentation with text-to-image diffusion models, CVPR 2023.\n\n[3] Liu et.al., Diffusion denoising process for perceptron bias in out-of-distribution detection, arXiv preprint 2211.11255.\n\n**A3. Discussion on the improvement over NPOS**\n\nCompared with NPOS, DREAM-OOD can generate high-resolution outliers in the pixel space. The higher-dimensional pixel space offers much more knowledge about the unknowns, which provides the model with high variability and fine-grained details for the unknowns that are missing in NPOS. Since our method is more photo-realistic and better for humans, the generated images can be naturally better constrained for NNs (for example, things may be more on the natural image manifolds) – that’s not available in NPOS. As shown in Figure 5, the generated outliers are more precise in characterizing OOD data and thus improve the empirical performance.\n\n**A4. Experiments on using CLIP for feature encoder**\n\nWe use a ResNet architecture for the feature encoder. As suggested, we tried fine-tuning the CLIP visual encoder (ViT-L/14), while keeping other parts unchanged. The comparison is shown as follows, where using CLIP as the initialized feature encoder achieves similar performance as DREAM-OOD.\n\n| | INATURALIST | |PLACES ||SUN||TEXTURES||Average ||ID ACC|\n| ------ | ----- | ----- |  ----- | ----- |----- | ----- |----- | -----|----- |----- |----- |\n| Method | FPR95 | AUROC | FPR95 | AUROC | FPR95 | AUROC |FPR95 | AUROC | FPR |  AUROC ||\n |DREAM-OOD   |  24.10 | 96.10 | **39.87** | 93.11 | **36.88** | 93.31 | 53.99 | 85.56 | **38.76** | 92.02 | 87.54| \n| CLIP as initialized latent |  **21.60**| **96.36**|43.82 | **93.20** | 38.00| **94.58**| **52.94**| **87.64**|39.09 | **92.94**| 87.06| \n\n**A5. Results on additional datasets**\n\nAs suggested, we compare DREAM-OOD with the baselines on an additional CIFAR-10 dataset. We use ResNet-18 for training. Other training details are kept the same as CIFAR-100. The result is shown in **Table 1 in the [PDF](https://openreview.net/attachment?id=vmDoMZMncP&name=pdf)**, where the strong performance of DREAM-OOD still holds.\n\nDue to the synthesis task being more challenging, literature including NPOS has primarily focused on ImageNet-100, which we closely follow and adopt as well. Given ImageNet-100 consists of high-resolution images, we believe the results and improvement over NPOS can already meaningfully support the benefits of DREAM-OOD on real-world datasets. We plan to include the full ImageNet-1k results in our revision."}]

Author rebuttal:
We thank all the reviewers for their time and valuable comments. We appreciate that reviewers find our approach DREAM-OOD **novel** and **effective** (Qkax, 94Wq, 3rTL), and the results are **comprehensive**, **extensive** and **promising** with **detailed** and **sufficient** ablations (Qkax, 94Wq, thbj, 3rTL, i54j). We are glad that all reviewers found the paper **well-written** and **easy to follow** (Qkax, 94Wq, thbj, 3rTL, i54j).  

As endorsed by multiple reviewers, the work makes important contributions to the field for the following reasons:

- DREAM-OOD is the first to generate photo-realistic high-resolution outlier images for OOD detection by way of diffusion models. DREAM-OOD advances the field by helping researchers visualize and understand the imagined outliers in the pixel space, which was impossible in the past with feature-based synthesis methods (e.g., VOS or NPOS). 
- Moreover, DREAM-OOD offers strong empirical performance with extensive results, which are recognized by all reviewers.
- Lastly, going beyond outlier imagination, our framework can be extended to generate inliers to improve model generalization. We demonstrate stronger performance than some of the most popular data augmentation methods, which we believe will benefit an even broader community and ML applications.

We respond to each reviewer's comments in detail below. We will also revise the manuscript according to the reviewers' suggestions, and we believe this makes our paper much stronger. 

Meta-review: This paper studies the setting of generating out-of-distribution data with diffusion models. The model is trained with in-distribution data and then low-density latent samples are obtained to generate OOD data. The reviews are unanimous, and the rebuttal have addressed the concerns of the reviewers. Acceptance is recommended.
Decision: Accept (poster)