WeiPer: OOD Detection using Weight Perturbations of Class Projections
Authors: Maximilian Granz
Manuel Heurich
Tim Landgraf
Venue: NeurIPS 2024 poster (2024)
Keywords: OOD detection
weight perturbations
KL divergence
image data
Primary area: safety_in_machine_learning
TL;DR: We present the out-of-distribution detection method WeiPer that improves detection by projecting the penultimate space of a network on perturbations of class directions.

Abstract: Recent advances in out-of-distribution (OOD) detection on image data show that pre-trained neural network classifiers can separate in-distribution (ID) from OOD data well, leveraging the class-discriminative ability of the model itself. Methods have been proposed that either use logit information directly or that process the model's penultimate layer activations. With "WeiPer", we introduce perturbations of the class projections in the final fully connected layer which creates a richer representation of the input. We show that this simple trick can improve the OOD detection performance of a variety of methods and additionally propose a distance-based method that leverages the properties of the augmented WeiPer space. We achieve state-of-the-art OOD detection results across multiple benchmarks of the OpenOOD framework, especially pronounced in difficult settings in which OOD samples are positioned close to the training set distribution. We support our findings with theoretical motivations and empirical observations, and run extensive ablations to provide insights into why WeiPer works. Our code is available at: https://github.com/mgranz/weiper.

WeiPer: OOD Detection using Weight Perturbations of Class Projections
Maximilian Granz
Manuel Heurich
Institute for Computer Science
Institute for Computer Science
Free University Berlin
Free University of Berlin
Arnimallee 7 14195 Berlin
Arnimallee 7 14195 Berlin
maximiliam
wtwpllliannnnnaauaaaeaa granz@fu-berlin
manuel. heur -
Tim Landgraf'
Institute for Computer Science
Free University of Berlin
Amimallee 7 14195 Berlin
tim. wan.laangrafffr leaadggra@fu--erlin... wertuuubbrrin.... de
Abstract
Recent advances in oitoo--diittrbutionn (OOD) detection on image data show that pre-trained neural network classifiers can separate in-distribution (ID) from OOD data well, leveraging the class discriiiiriiiiaeive ability the model itself. Methods have been proposed that either logit information directly or that process the model's penultimate layer activations. With "WeiPer", we introduce perturbations of the class projections in the final fully connected layer which creates richer representation of the input. We show that this simple trick can improve the OOD detection performance of variety of methods and additionally propose distance- based method that leverages the properties of the augmented WeiPer space. We achieve state-of-the-arr OOD detection results across multiple benchmarks of the OpenOOD framework, especially pronounced in difficult settings in which OOD samples are positioned close the training set distribution. We support our findings with theoretical motivations and empirical observations, and run extensive ablations to provide insights into why WeiPer works. Our code is available httm//gganz/neeepp
Introduction
Out-of-Distribution (OOD) detection has emerged as pivotal area of machine learning research. It addresses the challenge of recognizing input data that deviates significantly from the distribution seen during training. This capability is critical because machine learning models, particularly deep neural networks, are known to make overconfident and incorrect predictions on such unseen data Hendrycks Gimpell (201)). The need for OOD detection is driven by practical considerations. In real-world applications, model frequently encounters data that is not represented in its training set. For instance, in autonomous driving, system trained in one geographic location might face drastically different road conditions another. Without robust OOD detection, these models risk (2016).
making unsafe decisions Amodei
Over last few years, the field has made significant steps towards setting up benchmarks and open baseline implementations. Thanks to the efforts of the OpenOOD team Zhang et al. (2023b); Yang
"qqual contribution.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

0.5
Wp +
0.09
Density
mP0
0.59
0.2
W
(100 + 17)
FPR5
ID
Threshold at TPR5
0OD
Why random perturbations? Left: We visualize densities of CIFARIO (ID, blue) and CIFARIO0 (OOD, red) contour plots along the two logit dimensions spanned by wo and wi, zoomed in on the positive cluster of class zero. The blue axis denotes the vector associated with that class, and one of its perturbations is depicted by the turquoise line. Right: When projecting the data onto both vectors, vertical blue lines mark the S-percentile (highest 5%) of the true ID data (CIFARIO 10, blue). At this decision boundary, the classifier would produce false positives in the marked dashed red tail area. single perturbation
Figure 1:
obtain the densities shown in the top and bottom panel, respectively. The
the class-associated vector yields already a reduction of the false positive rate (FPR) from 1.34% to 0.79%. Visually, confirm that OOD data mostly resides close to O, extending into the positive cluster in a particular conical shape, which exploited by the cone of WeiPer vectors.
et al. (202)), we can evaluate new methods across CIFARIO, CIFARI00 and ImageNet, and compare them against variety of methods, on the same network checkpoints. To this date, however, there no single method outperformig the competition on all datasets lajwar et al. (202T), which indicates variety of ways in which OOD data differs from the training set. Here, we introduce WeiPer, method that can be applied to any pretrained model, any training loss used, with no limitation on the data modality to separate ID and OOD datapoints. WeiPer creates representation of data by projecting the latent representation of the penultimate layer onto cone of vectors around the class caassprojecttons of the final layer's 's weight matrix. This allows extracting additional structural information the training distribution compared to using the class projections alone and specifically exploits the fact that the OOD data often extends into the cluster of positive samples of the respective class in conical shape (sce Figure T. In addition WeiPer, our KL-divergence-based method WeiPer+KLD represents a novel OOD detection score that is based on the following observation:
When ignoring the individual dimensions and examining the activation distribution across all di- mensions, we observe that ID samples exhibit a similar "fingerprint" distribution. The more feature dimensions there are, the better our estimate of this source distribution becomes. We demonstrate that measuring the discrepancy between the per-sample distribution and the training set's mean distribution in the augmented WeiPer space leads to improved OOD detection accuracy. We evalu- scoring function (KLD), MSP conduct ablation
ate WeiPer on OpenOOD using our proposed KL-divergence--ait Hendrycks & Gimpel (2016), and ReAct (Sun al. 2021). Additionally, study to understand the influence each component of WeiPer and analyze WeiPer's 's performance. Our results confirm that the weight perturbations allow WeiPer to outperform the competition two out of eight benchmarks, demonstrating consistently better performance on near OOD tasks. WeiPer represents versatile, off-the-shee method for oate-of-the-an post-hoc OOD detection. However, the performance of WeiPer comes at a cost: The larger the WeiPer space, the more memory is required.

---

In summary, we present the following contributions:
We discover that OOD detection can be improved by considering linear projections of the penultimate layer that correlate with the final output, ie.,, the class representations. We construct these projections by perturbing the weights of the final layer.
We uncover fingerprint-like nature of the ID samples in both the penultimate space and our newly found perturbed space, proposing a novel post-hoc detection method that leverages this structure. The activation distributions of the penultimate space and our WeiPer space over the dimensions of each sample are similar for each ID input, yielding distributions in both spaces that we compare to the mean ID distribution using KL divergence.
We evaluate our findings by testing the proposed methods and two other MSP-based methods on the perturbed class projections using the OpenOOD benchmark, achieving state-of-the-art performance on near OOD tasks.
2
Related work
OOD detection. Generally, we can distinguish two types of OOD detection methods one that requires retraining of the model, including novel loss variants, data augmentations, or even outlier exposure settings. Here, focus on post-hoc methods that can be added with little effort to any existing pipeline. They can be applicd to any pretrained model, irrespective of its architecture, loss objective data modality. Post-hoc methods can be distinguished further in:
1) Confidence- -based methods Guo et al. (2017); Hendrycks et al.] (202aa by: Liu et al. (2033 2020);
Wang et al.] (2022) process samples in the model's logit space, using the network directly to detect ID/OOD data points. A prominent example is the Maximum Softmax Probability (MSP) (Hendrycks & Gimpel| 2016) which simply uses the maximum logit as the main OOD decision metric. Some methods Ahn et al. (2023): Djurisic et al. (202)): (Sun et al. (2021) additionally introduce transformations such as cutofts of the features in the penultimate layer masks on the weight matrix Sun & Li (222) to allocate where ID data resides and combine these with confidence metrics. Several recent methods have employed f-divergences to improve OOD detection, focusing on enhancing the boundary definition between ID and OOD samples Darrin et al. (2022); Picot et (2022).
2) Distance-based methods [Bnddle & Boult (2015); Lee et al. (2018); [iu et al. (2023b); |enn et al. 2022); Sastry & Oore (2020); [Snn et al. (2022); Zhang et al. 2023a) define distance measures between the training distribution and an input sample latent space, i.e. primarily the penultimate layer of the network. Deep Nearest Neighbors (Snn et al. (2022) uses the distance to the k-th closest neighbor in latent space, while MDS Lee et al. (2018) models the data as Gaussian and uses the Sewioonniii--iitaannce
Models of the data distribution can improve the OOD detection performance, e.g. using histograms to approximate the training density and then define a distance measure on them. A recent work Liu et al. (2023b) proposed creating histogram- based distribution on the product of the penultimate activations and the gradient of a separate KL-loss and then defined a metric on these modified discrete densities.
Both approaches of 1) and 2) are not exclusive. NNGuide Park et al. 2023) combines both confidence and distance measures into joint score, improving performance in case of the scores fails.
Random weight perturbations and projections. Weight perturbations, i.c. adding noise values to the weights of a network, have been used for a variety of applications: in sensitivity analyses Cheney et al. (2017); Xiang al. (2019), for studying robustness against adversarial attacks Rakin et al. (2018) }): Wu et al. (2020). and as training regularization Khan et al. (2018); Wen et al.] 2018). Random projections from the latent space of the neural network have been described in the context of generative modeling Bonneel et al. 2014);; Jerome H. Friedman & Schroeder (1984); Kolouri al. (201)); Liutkus et al. (2019) Nguyen et al. (202 Paty (2019) e.g. to improve the Wasserstein distance calculation or for robustness. A previous work described random projections samples with a normalizing flow Kuan &
from the penultimate layer to detect
Mueller 2022).
3

---

3 Method
3.1 Preliminaries
We consider a pretrained neural network classifier f: x: R that maps samples x from an input
space X' E Rº to a logit vector f fxx E RR, by applying linear projection Wt. to to the feature representation in the penultimate layer
(21 2x) = === h(x))()))))))( = (xx)
(I)
such that f(x) = z with D, K and C representing the dimensionality of the input, the penultimate layer and the output layer, respectively. We define the rows of the final weight layer be wi,..., WC-
In the following it is useful to introduce Z random vector from which we draw our latent samples. We denote the densities of the latent activations of the training data with 77 of the test data with Pz.:: and those of OOD samples with Pz.. admitted by the random vectors Zuain Zust and Zood. respectively. To case notation, we will treat Z and all its subsets, both as sets, e.g. Zuain is the set of all training activations in the penultimate layer.
An OOD detector is a binary classifier O that decides if samples are drawn from an ID or OOD distribution by usually only considering samples drawn from pz or Piaa Commonly, this is achieved by thresholding a scalar score function S.
ID OOD
S(x) >>
O(x)
(2)
otherwise
For MSP, the score function is simply the maximum softmax probability
e(a)s Σラ= (a)) MS)(f(#)).
S(x) MSP(#)
max
Note, that for clarity, we define MSP also as function of the logits. Other methods propose metrics on the penultimate layer, e.g. by incorporating distance measures between a given latent activation z of new sample and the distribution of activations p7... of the training set.
3.2 WeiPer: Weight perturbations
neural network classifier maps the data distribution to the distribution of the logits W Z. The training objective of the network ensures optimal separation of classes and lets the model learn to exploit features in Z specific to the training distribution. OOD samples, hence, often yield lower logit scores. Confidence methods leverage this property, but could potentially be improved by capturing more of the underlying distribution of the penultimate layer. A confidence score measures properties of the logit distribution W Z. Is there additional information in the penultimate layer of the network, and if so, how can we utilize it?
Applying the weight matrix W to the penultimate space can be understood as C projections of Z onto the row vectors w. According the Sramer-Wold theorem (Cramér & Wold (1936), ), we can reconstruct the source density pz from all one-dimensional linear projections, and Cuesta- Aresta-Albertte Albertos ct al. (2077) has shown that a K-dimensional subset of projections suffices (for more details see Appendix A.I.I. The question remains which projections extract the most relevant information?
Drawing vectors w W- (0, I) from a standard normal and projecting onto them often results in similar densities for ID and OOD data, i.e. w Zimin ~ w Zuod. deteriorating detection performance (see Table [. RP). This aligns with Papyan et al. (2020), suggesting limited information in the penultimate layer compared to the logits. We hypothesize that the latent distribution shows relevant structure only along certain dimensions. We applied PCA to the latent activations and inspected the resulting projections. This analysis supports the notion that the informative dimensions lie in the directions of the class projections W ..., we (see Appendix A.1.3). Hence, we construct projections that correlate with these vectors but at the same time deviate enough to obtain new information.

---

Weight Perturbations
KLD
MSP
W
We
Piv
Px
(
MSP (eiPer))))aa))
Wi
rC() samples
The
Tke
MSP (Wiz)
2
DKL
BEEZ(1=) Tki (Pwa)
The (p=)
Figure 2: WeiPer perturbs the weight vectors of Wie by an angle controlled by 6. For each weight, we construct perturbations resulting in weight matrices W W..... Wr. KLD: For WeiPer+KLD, we treat 21, .... 2g ps and wf,, "f., w w Pw: as samples of the same distribution induced by and = respectively. We approximate the densities with histograms and smooth the result with uniform kernel TE,- Afterwards, we compare the densities Tr, (4=) with the mean distribution over the training samples Z (1z) for lz /z and f= > respectively. MSP: For a score function S on the logit space IºC, define the perturbed score SweiPer as the mean over all the perturbed logit spaces Wz. We choose S MSP and call the resulting detector MSPweiPer.
Definition WeiPer We define perturbations 7), drawn from a standard normal and add them to Wi. To ensure that all perturbed vectors have the same angular deviation from the original weight vector, we normalize the perturbations to be the same length as their corresponding row vector and multiply them by factor 5:
w w 77 w |na
w, + 7. n. ~0
for 1,.... r, where ó represents the length ratio between w, and the perturbation 77 For large K dim (2), W, and 7, are almost orthogonal and thus 5 actually adjusts the angle RJ arctan ()) of the perturbed vector bundle. We set 8 to constant across all 1, I..,, K and treat both d and as hyperparameters. This proceedure is related to the Distributional Sliced Wasserstein distance Nguyen al. (202I) as they sample projections from a distribution such that the mean angle between the projections is greater than arccos (") for a constant C.The whole set of vectors we define is
W [i1,1,.... $1,C, .... w
We can think of the resulting weight matrix W as r repetitions of the weight matrix Wie on which we add perturbation matrices H, The j-th row Hi5 corresponds to a perturbation vector f7,, normalized match the respective Wj.
W1 1
W + H1
W =
(6)
W + H
Since W,z W H,Z. we call WZ the perturbed logit space. Our weight perturbations method, we call WeiPer, essentially increases the output dimension of model. Hence, it can be combined with many scoring functions. We demonstrate this with the two following postprocessors.
3.3 Baseline MSP scoring function
the perturbations do not deviate too much from the class projections Wj, i.e. the row vectors the final layer, the class cluster will still be separated from the other classes in the new projections and we can apply MSP on the perturbed logit space. In fact, we find that class clusters on the perturbed projections can be better distinguished from the OOD cluster than the original class projection
5

---

Mean
sample: #7285
Mian
sample: #8888
Train
0OD
Test
Figure 3: Histogram of all 512 activations in the penultimate layer (left pair) and the activations in WeiPer space (right pair) of a ResNet18 trained CIFARIO. We perturb the weight matrix 100 times to produce 10 100 = 1000-dimensional perturbed logit space. For each pair, the left panel shows the mean distribution over all samples (ID CIFAR 10, OOD CIFAR 100). The right panels show the distribution p= and Pw respectively, for two randomly chosen samples with smoothing applied (s)
defined by Wie (see improvements of WeiPer+MSP(zz) over MSP in Table 2 visual example. We calculate the MSP on the perturbed logit space as
Figure illustrates
WeiPer+MSP(z)) == MSP MSPWeirer (2) = Σ MSP(W;22
the mean over all the maximum softmax predictions of the perturbed logits. We analyze why MSP could be capable of capturing more of the penultimate layer distribution than MSP in Appendix
A.122 A.1.2
3.4
Our KL divergence score function
Following our line of argument motivated by Theorem A.1 it seems natural choose density-based based score function. When pooling all activations of the penultimate layer, an ID sample's activation distribution exhibits remarkable differences to that of an OOD sample. We observe the following properties:
The majority of samples exhibit bimodal distribution of their penultimate activations. An activation either belongs to the mode close to zero, to the second mode (and rarely takes values in between).
ID samples share similar activation distribution. The mean activation distribution serve as a prototype see the upper left panel in Figure
The activation distribution specific the ID samples, i.e. the activation distribution of OOD samples differs from its distribution of ID samples and thus from the ID prototype.
Concluding on all three points, we make the assumption that all features z = h(()) of an ID input x can be thought of as samples
ZK ~ Pz. where (2i, 2x) z,
(8)
of the same underlying activation distribution px. Furthermore, the density of matches the mean distribution over all ID samples
P= R Ezrez.m.pp [p=.]
(9)
We assume, the same true for the logits. They naturally separate into non-class cluster and class cluster with the ratio 1: C - 1. Here, we could apply the same procedure, but especially for datasets with a small number of classes we would only get C' samples. This is where the cone of WeiPer vectors creates an advantage: They sit at fixed angle to class projection and thus preserve the class structure similarly across each projection onto one vector of the cone (e.g., like Figure right bottom panel). Analogous to Equation
( we treat each projection
I ...., w 2 ~ Pw*
(10)
as sample of the same underlying distribution and observe that
Pw R Ezre [w
(11)

---

We demonstrate both behaviors in Figure 3
In practice, discretize Pz and Pw= histogram-based densities by splitting the value range into Thins bins (see Equation (21 in the Appendix). Compared to the mean distribution, Pz and Pw still have a sparse signal. We smoothen the densities with function
Tk. (p())) == normalize kt)(t) +))
(12)
by convolving p with a uniform kernel Kg of size s and prevent densities from being zero by adding > 0 which we set to the fixed values == 0.01 for the penultimate layer and == 0.025 for the WeiPer space. Note, that tuning both epsilons might increase performance as we observed in early stages of our experiments, but will add two additional hyperparameters. We normalize the density to sum up to one again, here defined by normalize. Afterwards, we compare each of the densities with the KL divergence, respectively:
(ar Q2, 6) = (Tx, (g=) || E (q=)) (T, [-=] Tx, (q=)),
(13)
where Oe is either ps or Fw= We discuss why our method does not suffer from the curse-of- dimensionality in contrast to other methods as investigated by Ghosal et al. (2023) in Appendix A.115
WeiPer+ KLD combines the KL divergence on the penultimate space, the KL. divergence and MSP on the perturbed logit space into one final score:
WeiPer+KLD (x) := DKL Pz, $1) + X DxL Pw s2) X2 MSPweiPerrae (x))er(a))
(14)
The full list of hyperparameters is and ö for the WeiPer application and Ybins A )2, , 82 for the KL divergence score function. Figure 2 provides a visual explanation and quick overview WeiPer and both its postprocessors.
4 Experiments
Setup. We evaluate WeiPer using the O0enOOD al. (2023b) framework that includes three vision benchmarks: CIFARIO Krizhevsky 2009). CIFARI00
(2009), and ImageNer Deng et al. (2009). Each of them contains a respective dataset Din and several OOD datasets, subdivided into near datasets Deear and far datasets Dtar (see Table D The terms near and far indicate their similarity to Dm and, therefore, the difficulty of separating their samples.
OpenOOD also provides three model checkpoints trained on each CIFAR dataset whereas for ImageNet the methods are evaluated on a single official torchvision Marcel & Rodriguez (2010)
checkpoint of ResNet50 He et al. (2016) and V/T-B/16 Dosovitskly et al. (2020) respectively. We report our scores together with the results of Zhang et al. (2023b) Table
Due to resource constraints, we only evaluate our methods on the models trained with the standard preprocessor, that includes random cropping, horizontal flipping and normalizing, on the cross entropy objective. Additionally to the KL divergence score function and MSP, we evaluate WeiPer on ReAct. But instead of combining ReAct with the energy-based score function Liu et al. (2020) as in OpenOOD, we apply WeiPe and call it WeiPer+ReAct. The hyperparameters of our methods were tuned by finding the best combination over predefined and discrete range of values on the OpenOOD validation sets to assure a fair comparison to the competition (see Table 8). For ImageNet, results are based on a subset of the training data, comprising
300,000 randomly selected, balanced samples (300 per class). For an anal-
Table 1: The individual benchmark datasets.
ysis across different training set sizes, refer to Table 6
Dmn
CIFARIO
CIFAR100
ImageNet-Ik
CIFAR100,
CIFAR1O,
ssb-hard,
Dacu
TinylmageNet
TinyImageNet
ninco
Metrics. We evaluate the methods with the Area Under the Receiver Op- erating characteristic Curve, AUROC, Bradley (1997) metric as a threshold- independent score and the FPR95 as quality metric. The FPR95 score reports the False Positive Rate at the True Positive Rate threshold 95%.
MNIST,
MNIST.
iNaturalist,
Dfa
SVHN,
SVHN,
Texture,
Texture,
Texture,
OpenImage-O
Places365
Places365

---

Table 2: OOD Detection results of top performing methods the CIFARIO, CIFAR100 and ImageNet- benchmarks (For comparison with every other evaluated method of OpenOOD and standard deviation over the CIFAR models, see Appendices A.5 A.6)) The top performing results for each benchmark are displayed in bold and we underline the second best result. Due to WeiPer's random nature, report the median AUROC score over 10 different seeds. For easy comparison, we portray the following ablations for CIFARIC which are seperated by a line: The KL.D results are the WeiPer+KIDD results without MSP and RP is WeiPer+KID with weight independent random projections drawn from standard Gaussian. While WeiPer+KLD performs strongly especially on near datasets using ResNet backbones, its performance deteriorates with ViTs (see Section for
discussion).
D Deear
Daar
D near
D Dar
Method
AUROC1
FPR95
AUROCT 1 FPR9S
AUROC
FPRU5
AUROC 1
FPR95
Benelmark: CIFARIO/ Backhone: ResNet18
Benchmork: CIFAR100/ Backbone: ResNer18
NAC
94,60
86,98
RMDS
92.20
55.46
52.81
ReAct
87.11
44,90
80.77
54.1
VIM
88.68
44.84
93.48
25.05
74.9%
81,70
50.74
KNN
90.64
34,01
92.95
24.27
80.18
61.22
82.40
$3.65
ASH
75.27
$6.78
78.49
79.03
78.20
65.71
80,58
$9.20
GEN
68.20
53.67
91.35
34.73
81331
$4.42
79.68
$6.71
MSP
88,03
48.17
90.73
31.72
80.27
54,80
77.76
$8,70
WeiPer+ReAct
88.83
42.84
91.23
29.50
$1.20
$5.03
80.31
$5.61
WelPer-KLD
90.54
34.06
93.12
23.72
81.37
$4.34
79.01
$7.96
KLD
90.53
34.12
93.15
23.58
76.68
66.41
68.95
71.70
69.62
87.72
75.83
75.66
70.68
73.98
67.23
77:25
D near
Dtar
D near
D
Method
AUROCT
EPR9S
AUROCT 1
FPR95 1
AUROCT
FPR95
AUROC 1
HPR95
Benchmark:
ImageeNet 1K Backbone: ResNer50
Benchmark:
ImageNet. IK/ Backhone:
WT-B/16
NAC
95. 29
93.16
RMDS
76.99
65.04
86, 38
40.91
$0.09
65.336
92.60
28.76
Reaet
77.38
66.69
93.67
26.31
69. 26-26
84,49
85,68
53.93
VIM
72.08
71.35
68
24.67
77.03
73.73
29.18
ASH
28.17
63.32
95.74
19.49
$3.21
94.43
$1.56
96.77
GEN
76.85
65.32
89.76
35.61
76.30
70.78
91.35
32.23
MSP
76.02
65.6%
85.23
51.45
73.52
$1.85
86.04
$1.69
WeiPer-MSP
77.68
63.84
89.33
41.56
74.82
74.97
89.15
43.49
WelPerRReAct
76.85
66.87
93.09
29.83
74.79
74.08
89.45
41,22
Table reports the performance of WeiPer in comparison to the state-of-the-art OOD detectors on each benchmark. We compare our approach based on the Dnear and Dtar detection performances and report the mean over all datasets in each category. Table portrays the mean relative performance on Dnear and Dtar of every postprocessor. The score calculated as follows:
Results.
1 = (AcHARiO(P)) + ACUARIOO + ( (Aliage + (mng)Narvrrs(P)))) (15)
See =
where
AUROC D Deace
(P)
Ap(P) max PEP AUROC CEIROOraarts (P)
(16)
It is designed such that each result each dataset D is equally weighted and scoring 1.0 means that the postprocessor P is top performing across all datasets.
WeiPer+KLD achieves three out of eight top AUROC scores and the best performance on all near benchmarks, establishing new state of the art performance by a significant margin (see Table B).
Especially for the most challenging benchmark, separating D Duear on ImageNet with ResNet50, we outperform our strongest competitor, ASH Djurisic al. (2022), by 1.88% AUROC (we even achieve AUROC score of 80.29 when using 1M training samples instead of 300k, see Table 6). Additionally. WeiPer+KLD performs well on many far benchmarks, being the best method for ResNet50 on ImageNet, reaching into the top three positions on CIFAR10 far and into the top three on the CIFARIO 100 benchmark. With relative performance Table WeiPer+KLD reaches 3rd place overall in the far benchmark.
Only on Vit-B/16 trained on ImageNet, WeiPer+KI.D shows a significant performance dent, especially on the far benchmark. VIT-B/16 B/16 uses comparably narrow penultimate layer having fewer features

---

Table 3: Mean relative scores of all the postprocessors (post-hoc methods), see Equation
13
Duear
Dtar
Postprocessor
Sia
Postprocessor
Sidl
Postprocessor
Siel
Postprocessor
Sial
WeDPer+KLD
0.988
OpenMax
0.943
NAC
0.999
MI.S
0.932
RMDS
0.984
VIM
0.943
VIM
0.970
TempScale
0.929
WeiPer+MMSP
0.977
EBO
0,940
KNN
0.963
EBO
0.924
GEN
0.975
SHE
0.934 WeiPer+KLD
0,959
MSP
0.920
WeiPer+ReAct
0.974
KLM
0.918 RMDS
0.959
SHE
0.919
TempScale
0.967
DICE
0.901
WeiPer+ReAct
0.951
DICE
0.909
KNN
0.963
ASH
0,870
GEN
0.947
KLM
0,893
MSP
0,963
MDS
0.829
WeiPer+MSP
0,944
MDS
0.877
ReAct
0.955
GradNorm
0.722
ReAct
0.943
ASH
0.844
MLS
0.954
NAC
OpenMax
0.935
GradNorm
0.700
than classes and therefore compresses the class clusters. Some dimensions may thus compress two classes while others represent a feature specific only one class. This introduces more noise into Pz which could impair the detection performance. Future experiments will reveal whether WeiPer benefits from higher dimensionalities of the latent space.
WeiPer on existing methods. Additionally, WeiPer enhances the MSP performance by 1-4.1% AUROC across all benchmarks and WeiPer+ReAct consistently outperforms ReAct with an energy- based score, although their evaluation, this variant was better than ReAct+MSP (see Table
Ablation study. We determine the effect of each hyperparameter in Figure 4 by freezing single hyperparameters and optimizing only the one in question. As expected, increasing the number of random perturbations leads to better median performance, while the standard deviation decreases for larger r. Note, that possible have better performance for lower by rerolling the weights few times and choosing the best performing ones. All methods show a significant performance boost compared using no perturbations 8 and seem be best at å for WeiPer+KLDD, which corresponds to angle of 2s 63 and 5 = 4 (a R 76%) for MSP and ReAct.
On CIFAR10, WeiPer+KLD only improves marginally by applying MSP which the for the other benchmarks (see Table(7, where A > 0. Furthermore, we study the performance of random projections that are independent from the weights Wie We show that using only random projections (RP, see Table 2 without adding MSPwaiPer. we are hardly able to detect any OOD samples. This supports the claim that utilizing the class directions necessary. The supplementary material presents all the other KLD-specifi hyperparameters and we also investigate their influences the performance in Figure We outline the selected parameters for each benchmark in Table 7
81.0
00
AUROC
0.
72.5
86
-1
8
KLD MSP
ReAct
Figure 4: We investigate the effect of WeiPer hyperparameters r and on the performance of the three postprocessors. The left pair shows results CIFAR1O, the right pair corresponds to ImageNet (using ResNet18 for both). Models were tested using their respective near OOD datasets. The panels corresponding depict AUROC performance minus the initial AUROC performance å 0. The graphs show the mean over 25 runs and the shaded area around them represents the value range (min max) over those runs. All other parameters of the methods were fixed the optimal setting.

---

Limitations
WeiPer+KLD has more hyperparameters than other competitors: 6 total. As discussed in the previ- ous section, r can be seen memory/ / performance trade-off (see Figure 4). In the supplementary we investigate the other parameters and find that they all have only one local maximum in the range
material (see Figure 6
searching and should thus be easy to optimize. We tried to choose the same smoothing size $1 = $2 for both densities, but the ablations show that both are optimal at different sizes. While WePPea is not really used for CIFARIO (A2 0) it is beneficial for CIFAR 100 and ImageNet. As WeiPer blows up the dimension we also conduct a memory and time comparison to other methods in Table 4 and Table 5 We demonstrate that with combination of confidence and a distance based metric it is possible to achieve competitive near results across the board where all other methods seem to deteriorate in at least one benchmark.
Conclusion
We show that multiple random perturbations of the class projections in the final layer of the network can provide additional information that we can exploit for detecting out-of-distribution samples. WeiPer creates representation of the data by projecting the latent activation of sample onto vector bundles around the class-specific weight vectors of the final layer. We then employ a new approach to construct score allowing the subsequent separation of ID and OOD data. relies on the fingerprint- like nature of features of the penultimate and the WeipPer-eprresetattions by assuming they were sampled by the same underlying distribution. enhances MSP and ReAct+MSP performance significantly and show that WeiPer+KLD achieves top scores most benchmarks, representing the new state-of-the-art solution in post-hoc OOD methods on near benchmarks.
thorough evaluation, we first show that WeiPer
7 Acknowledgements
We appreciate the reviewers' comments, which greatly helped enhance this manuscript and inspired us to conduct additional key experiments. Maximilian Granz was supported by the -eumaann Scholarship from the state of Berlin, which provided essential funding for the initial stages of this research. We also thank Lcon Sixt and Manolis Panagiotou for their feedback throughout the project.
References
Ahn, Y. H., Park, G.-M., and Kim, S. T. Line: Out-of-distributis detection by leveraging important neurons. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp- 19852-19862, 2023. https:ss: wwtppp/sssaaaatscch.oooemem www.oolarrrrrroooooeeoeeoooooeet CorppsrD :1: 257757417
Amodei, D., Olah, C., Steinhardt, J., Christiano, P. F., Schulman, J., and Mané, D. Concrete problems in safety. ArXiv, 2as/1606.065655 2016. URL https://api http://ppp.smmatiicccccocmo semanticscholar
org/Corpus ID: 10242377
Bendale, A. and Boult, T. E. Towards open deep networks. 2016 IEEE Conference on Com-
puter Vision and Pattern Recognition (CVPR), pp. 1563-1572, 2015. URL //tpp: semanticscholar org/ CorpusID:1122003:
Bonneel, N., Rabin, J., Peyré, G., and Pfister, H. Sliced and radon wasserstein barycenters of measures. Journal of Mathematical Imaging and Vision, 51:22 45, 2014. Utt/stts:://aa semanticscholas org/ herg/Corpusllue ID: 1907942
Bradley, A. P. The use of the area under the roc curve in the evaluation of machine learning algorithms. Pattern Recognit, 30:1 14591159, 1997. URL http://app..emmnnicccchooo.ooo org/CorpusID: 13806304
Cheney, N., Schrimpf, M., and Kreiman, G. On the robustness of convolutional neural networks to internal architecture and weight perturbations. ArXiv, abs/1703.08825, 2017. URL, https
sempimiissnniiccoo..... wrw/CorppsID 132174484
10

---

Cramér, H. and Wold, H. Some theorems on distribution functions. Journal of the London Mathemat- ical Sociery, s1-11(4):290- 294, 1936. doi: www.//oo/aabaaa abspii/aas////// /10. /ttp///111/1m//m111m111111
URL https
com
Cuesta-Albertos, J., Fraiman, R., and Ransford, T. A sharp form of the cramér- theorem. Journal of Theoretical Probability, 20:201 06 2007. doi: 10. 100000776110995-00000000----
Darrin, M., Piantanida, P., and Colombo, Rainproof: An umbrella to shield text generators from out- out-of-distribution data. arXiv preprint arXiv:22/2.09177. 2022.
Deng. J., Dong, W., Socher, R., Li, I..J., Li, K., and Fei-Fei, L.. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Puttern Recognition, pp- 255-255, 2009. doi: 10. 10.1109/CVPR.2099.22666
Djurisic, A., Bozanic, N., Ashok, A., and Liu, R. Extremely simple activation shaping for out-of- distribution detection. ArXiv, abs/2209.09855 2022. URL, https://api. lww.apppssmaaitisccciiieeee
org/Corpus 252383259
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenbom, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An Image is Worth 16x16 Words: Transformers for Image Recognition Scale. arXiv e-prints, art. arXiv:2010.11929, October 2020. doi: 10.48550/arxiv22110 11929.
Ghosal, S. S., Sun, Y., and Li, Y. How to overcome curse-of-dimmnssionaltty for out-of-distributiin detection?, 2023.
Guo, C., Plciss, G., Sun, Y., and Weinberger, K. Q. On calibration of modern neural networks. In Precup, D. and Teh, Y. W. (eds.), Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pp. 1321-1330 PMLR, 06-11 Aug 2017. URL
mlr. waar.ppess/vv00 guol7a. htmml
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In 2016 IEEE Conference Computer Vision and Pattern Recognition (CVPR), pp- 770-778, 2016. doi: 10.1 109/CVPR.2016.900
Hendrycks, D. and Gimpel, K. A baseline for detecting misclassified and out-oo--distribuutii examples in neural networks. ArXiv, abs/1610.02136,, 2016. URI.tttss: httpp:://ppp..smmttticccooollll org/
CorpusID: 13046179
Hendrycks, D., Basart, S., Mazeika, M., Mostajabi, M., Steinhardt, J., and Song, D. X. Scaling out-of-distribution detection for real-world settings. In International Conference on Machine Learning, 2022a. httthttts///appp www.steeaaoooollaa...o..
warg/CorpusID-... :27:07277799999
Hendrycks, D., Basart, S., Mazeika, M., Zou, A., Kwon, J., Mostajabi, M., Steinhardt, J., and Song, D. Scaling nut-of-distribution detection for real-world settings. In Chaudhuri, K., Jegelka, S., Song. L., Szepesvari, C., Niu, G., and Sabato. S. (eds.), Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research. pp. 8759-8773, PMLR, 17-23 Jul 2022b. URL https:://proceedingg mlr press/v162/ hendrycks22a. html
Jerome H. Friedman, W. S. and Schroeder, A. Projection pursuit density estimation. Journal of the American Statistical Association, 79(387):599 608, 1984. doi: 10. 1001000000122400 621599, 10478086. 1984. 10478086
URL httpp:://wwttt tandfon cow httm//do//bbs//00 1ttpb///00.1000000111111100001
Khan, M. E., Nielsen, D., Tangkaratt, V., Lin, W., Gal, Y., and Srivastava, A. Fast and scalable bayesian deep learning by perturtpnnt in adam. In International Conference on Machine Learning, 2018 URL https: //api. semanti cacholarr wtg/CorrpslD::491880
Kolouri, S. Zou, Y., and Rohde, G. K. Sliced wasserstein kernels for probability distributions. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2266- 2016. doi: 10.11099
Krizhevsky, A. Learning multiple layers of features from tiny images. pp. 32-33, 2009. URL https://www. ca. toronto. edw/ htt////kri/leeriii
-00---009---10 pd.
11

---

Kuan, J.-L. and Mueller, J. W. Back to the basics: Revisiting out-of- detection base- lines. ArXiv, abs/2207.03061 2022. URL https://api. 250334470
Lee, K., Lee, K., Lee, H., and Shin, J. A simple unified framework for detecting out-of-
distribution samples and adversarial attacks. ArXiv, abs/1807.03885, 2018. URL https
org/ Corpus ID: 49667948
Liu, W., Wang. X., Owens, J. D., and Li, Y. Energy-based out-of-distribution detection. ArXiv, abs/2010.03759, 2020. URL (ttpst : http://ap..eeee.. semanticscholar wwwaaaoooo/oooooooaaao :222000700
Liu, X., Lochman, Y., and Chrsitopher, Z. Gen: Pushing the limits of softmax-based out-of- distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023a.
Liu, Y., Tian, C. X., Li, H., Ma, L., and Wang, S. Neuron activation coverage: Rethinking out-of- distribution detection and generalization. ArXiv, abs/2306.02879, 2023b. URL htttps///ppp semanticscholar org http/CCrpuuSDDD I2:
Liutkus, A., Simsekli, U., Majewski, S., Durmus, A., and Stöter, F.-R. Weeseed-Wssersttein flows: Nonparametric generative modeling via optimal transport and diffusions. In Chaudhuri, K. and Salakhutdinov, R. (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 4104-4113, PMLR, 09-15 Jun 2019. URL WtRLhttps://// httpps://proceddiiiiiie mlg....mr....mm wwwps/eee/e////p htt.9////iuuull111 19a. html
Marcel, S. and Rodriguez, Y. Torchvision the machine-vision package of torch. In Proceedings of the 18th ACM International Conference on Multimedia, MM 100 pp. 1488- New York, NY, USA, 2010. Association for Computing Machinery. ISBN 978 9755693593336. doi: 10.1145/1873951.
1874254. URL httph:ttt:////tt //doi org/ 10. 1145/187395111.1 1874254
Nguyen, K., Ho, N., Pham, T., and Bui, H. Distributional wiise--wasserstein and applications to generative modeling. In International Conference Learning Representations, 2021. URL https://openrevien net QY-3J0AAAA
Papyan, V., Han, X., and Donoho, D. L. Prevalence of neural collapse during the terminal phase of deep learning training. Proceedings of the National Academy Sciences of the United States of America, 11:246552 - 24663, 2020. URL wtt.hhttt///aaaa semanticscholas org/ Chrppsrruuss 221172897
Park, J., Jung, Y. G., and Teoh, A. J. Nearest neighbor guidance for out-of distrriiitiiiooonnn detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1686-1695, 2023.
Paty, F.-P. and Cuturi, M. Subspace robust Wasserstein distances. In Chaudhuri, K. and Salakhutdinov, R. (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 5072-508 5081. PMLR, 09-15 Jun 2019. URL https://proceeednggs mlr arres//89/ppayy19/ httm html
Picot, M., Noiry, N., Piantanida, P., and Colombo, P. Adversarial attack detection under realistic constraints. 2022.
Rakin, A. S., He, 7.,, and Fan, D. Parametric noise injection: Trainable randomness to im- prove deep neural network robustness against adversarial attack. 2019 IEEE/CVF Confer- ence Computer Vision and Pattern Recognition (CVPR), pp. 588-597, 2018. URL https
arppi.semanticccheee wwcpllaarrrg/roooooeeee heg//orrusII::::33 53716271 oor.aaarrrrroropupu--/3/111111
Ren, J., Fort, S., Liu, 7 Roy, A. G., Padhy, S., and Lakshminarayanaa, B. simple fix to mahalanobis distance for improving near-ood detection. ArXiv, abs/2106.09022, 2021. URL
https://api.. www.sseemaaaanol..eeeeeeeeetee httpccooo....oorrroorrpaaaeaaa1. 235458597
Sastry, C. S. and Oore, S. Detecting out-of-distribution examples with Gram matrices. In III, H. D. and Singh, A. (eds.), Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 8491-8501. PMLR, 13-18 Jul 2020. URL htRps:tps:/ hattps://proceee http:::://ppooeeings...m mlr mlr arress/v19//asseei
html
12

---

Sun, Y. and Li, Y. Dice: Leveraging sparsification for out-of-distribution detection. 2021. URL https://api. www.nticscoooar................. org.aar.rrrr/oooee 02F2002222
Sun, Y., Guo, C., and Li, Y. React: Out-of-distributionn detection with rectified activations, Neural
Information Processing Systems, 2021. URL WRL.https://app. wwtpppsssmatccccolll.eeoee wtwp:laaar..r/oouusolll... | 244709089
Sun, Y., Ming, Y., Zhu, X., and Li, Y. Out-of-distribution detection with deep nearest neighbors. In International Conference Machine Learning, 2022. URL https//p:://p wttp...sstttnnsccoll..a..
Ptg//orpusliln ID: 248157551
Tajwar, F., Kumar, A., Xie, S. M.. and Liang, P. No true state-of-the-art? ood detection methods are in- consistent across datasets, ArXiv, abs/2109.05554, 2021. /ttptttss///pp. http:p/ss/.ppi..emmmttcccccccooo
org/CorpusID: (tt.orppuSID:2272400011 237264010
Wang. H., Li, Z.,, Feng, L.,, and Zhang. W. Vim: Out-of-distribution with virtual-logit matching.
2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4911-49201 2022. URL/https: sww.ppiissmmiicccho........ org/ Corpus ID: 247595222
Wen, Y. Vicol, P., Ba. J., Tran, D., and Grosse, R. B. Flipout: Efficient pseuudo-independent weight perturbations on mini-batches. ArXiv, abs/1803.04386, 2018. URL https://api semanticscholar. org/ CorpusID:3361111
Wu, D., Wang. Y., and Xia, S. Revisiting loss landscape for adversarial robustness. ArXiv, abs/2004.05884 2020. WRLLhttps:///// sas.pppssssa.atccchooor.rrra.rrr wtt.r//ccccaaaaorroorrooaaDaaaaa
Xiang, L., Zeng, X., Niu, Y., and Liu, Y. Study of sensitivity to weight perturbation for convolution neural network. IEEE Access, PP:1-1, 07 2019. doi: 10.1 00.1109/CCESSS2019999909 2919699267.....
Yang. J., Wang, P., Zou, D., Zhou, Z., Ding, K., Peng, W., Wang, H., Chen, G., Li, B., Sun, Y., Du. X., Zhou, K., Zhang, W., Hendrycks, D., Li, Y., and Liu, Z. OpenOOD: Benchmarking generalized out-of-distribution detection. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022. URL httttttss://peee//tt/e wwt./neemeddddggieoeoo.. - tskUt.
Zhang, J., Fu, Q., Chen, X., Du, L., Li, Z., Wang, G., xiaoguang Liu, Han, S., and Zhang, D. Out-of-distribution detection based in-distribution data patterns memorization with modern hopfield energy. 2023a. URL
Zhang, J., Yang, J., Wang, P., Wang, H., Lin, Y., Zhang, H., Sun, Y., Du, X., Zhou, K., Zhang, W., Li, Y., Liu, Z., Chen, Y., and Hai, L. Openood v1.5: Enhanced benchmark for out-of-distribun detection, arXiv preprint ar 2xX1v22306.09330,,, 2023b.
13

---

A Appendix
A.1 WeiPer: Theoretical details
A.1.1 Weight perturbations
Theorem A.1 (Cuesta-Albeross et al. 2007 ). Let X and Y be two R -valued random vectors.
Suppose the absolute moments my == (1)) are finite and Σk=1 (1==)m))-1/// -1/k cc. If the set
Wxy = fw E RKK w wn has positive Lebesgue measure, then X Y.
We provide simple proof for the case that Wxy R2 For the complete proof, we refer to Cuesta-Albertos et al. (2007).
Proof. The characteristic function of random vector X is defined as
Φx (w) = / e To dx
(17)
By the uniqueness theorem, every random vector X has unique characteristic funtion øx. If the assumption in the theorem holds, then for all realizations æ X (w) and = Y (w)), we have
w
w
(18)
and thus Øx py Therefore we have X Y by the uniqueness.
Note, that is enough cover all the directions in RK instead of covering the whole space with the set of projections W. Since if tw & W for t E R. but w E W n Wxy then tw E Wxy. For our set of perturbed class projections indeed covers the all directions if 00.
To generally apply the theorem, Z must be defined on a bounded with finite measure (Hausdorff moment problem). which is true for virtually all practical problems. More importantly, W needs to be a K-dimensional subset of gK Note that the theorem also applies for a set of weight matrices
{ e R RxK
W
(19)
when their row vectors form K dimensional set their marginal distributions w. X _ w would be equal for 1,... K. We are using this theorem solely as motivation since is not possible to draw direct implications. However, with score function S we measuring properties of the logit W 7 = {w) Zuain...., w Zuain) and check if they match the properties of some unknown logit distribution W that might be test data OOD data. In the ideal case the logits match distribution
distribution of the training data W
W to Zuran 1 W te and only if S is maximized,
(20)
e.g. if D a distance and = D, S(W fc Zress) = and S(W feZood) < Now the theorem says that if we chose K -dimennsional set W of projections and we had score function SwaPer that fulfills the property of Equation (20) on the infinite dimensional space spanned by the projections of W. not just the distributions the projection would be equal when SweiPer is minimized but also the penultimate distributions Zurain Ziest-
A.1.2 MSP on the perturbed logit space
Continuing from the previous section, SweiPer MSP WelPer is a score function on the infinite dimensional space spanned by W for r + co, so ideally MSP WesPee (Ziea) = 0 then not only the logit distributions match Wt: Zumin á W ic Zest. but also their penultimate distributions Zrrann & Ziea which would make MSP WeiPer a stronger metric than MSP.
A.1.3 PCA on the penultimate space
We draw the following conclusions from Figure 5 The OOD and ID distributions differ much stronger along the first C principal components, and they are more similar for the other components. This indicates, most of the signal may lie in the C-dimensional subspace.
14

---

dim:
dii::
dim: 9
Decx
dim:
dim: 15
dlim: 19
15
020 000
180
04
Figure 5: We applied PCA to Trainn of CIFARIO and projected Zuain (blue), Zest (purple) and Zood (red, CIFAR the first principal components. We observe density spikes the first 10 dimensions, likely corresponding the class clusters. Thee dimensions 10-19 exhibit less structure as their densities appear to Gaussian. Along these directions the and OOD data are more similar compared to the first ten principal components.
We argue that instead of taking random projections, we can utilize the class projections. Since have a trained classifier at hand, it is likely that the informative dimensions are: span(w1.-. wc). the span of the row vectors of W fc- Hence, a better choice than Gaussian vectors for the set of projections W are vectors w that correlate with these basis vectors in Wi but at the same time deviate enough such that we obtain new information from projections onto them.
A.1.4 KL divergence: Density definition
We gave brief description of our construction of the densities in the main paper. The formal definition is:
K
P2(1) = Kl. Σ 2 E b()).
(21)
Here 4, is the bin length, b(t) is the bin range in which falls, and [.] is the Iverson bracket which evaluates if true zero if the statement is false. Note that we are dividing by lo such that the density integrates to one. This is the usual definition for descretizing a density into equal sized bins.
A.1.5 Curse of dimensionality
In contrast to other distance-based methods, our KL divergence score does not suffer from the muuse-of-dimensionad
which deteriorates the performance of methods like KNN Sun et al. (2022) as investigated by Ghosal al. 2023). We disregard the dimension and only consider the activations in the penultimate space or in the perturbed logit space. In our case, more dimensions means more samples approximate the activation distribution Pz. We believe that our method thrives when applied to networks with higher dimensional penultimate space, but this still needs to be evaluated in future experiments. However, in the perturbed logit space, we can control the size of the space with (see Fi Our ablation results show that increasing and thus blowing up the dimensionality only increases performance.
15

---

A.2 Memory and Time Analysis
Table 4: Time taken in seconds to setup the method or for inference. More precisely, we mea- sure the time of postprocessor.. ( and postprocessor inference O) in OpenOODs evaluator py We take the mean over 20 iterations and denote the standard deviation after the # sign. We mark the maximal time in bold and underline the second longest time taken. We compare WeiPer+KLD (r = 100 as the paper) to its closest competitors and show that it is competitive with other methods in terms of computation time. While WeiPer+KLD is the higher end of the spectrum terms of computation time, it remains comparable to other methods. It's worth noting that computation time can be adjusted by trading off performance with lower values.
Time
Weiper+KLD
NAC
KNN
RMDS
VIM
Setup
CIFARIO
21.2 = 0.09
24.4 = 0.35
10.5 = 0.03 10.5 = 0.04
11.2 0.04
11.1 0.05
CIFAR 100
25.2 + 0.06
24.3 + 0.24
11.3 11.3 1631.7
11.1 + 0.05
ImageNet
1975.1 7.4
5676.9 34.6
1599.1 6.5
1636.1 1.9
Inference
CIFARIO 10
63.2 0.88
4
71.2 = 0.62 70.9 + 0.98
47.9 0.2
53.1 0.44
CIFAR 100
104,6 + 1.37
4.18
97.2 + 1.05
53.4 0.7
ImageNet
882.0 4.5
2
14507.0 # 86.6
1167.7
273.3 + 1.1
Table 5: Memory consumption in MiB to setup the method or for inference. More precisely, we compare the memory of postprocessor setup and postprocessor inference () in OpenOODs evaluator, py before and after its execution with psutil We take the mean over 20 iterations of the data between the 20% and 80% quantile diminish the effect of outliers (e.g., caused by interfering processes) and denote the standard deviation after the # sign. We mark the maximal memory in bold and underline the second highest demand. WeiPer+KLDs (r 100) memory consumption for its setup is among the lower demanding methods while has a comparably high demand for inference. Note that for optimal results choose 100, but smaller values of r also provide competitive results (see Figure 4). Thus memory can be traded against performance
where resources constraint.
Memory
Weiper+KI.D
NAC
KNN
RMDS
VIM
Setup
CIFARIO
2602.6 + 1
2557.3 +
2736.6 + 10
2806.0 = 31
2725. + 13
CIFARI00
2717 # 10.2
2556.7 +4
2732.8
2763.5 27
2726.3
ImageNet
1464. +
1871.6 28
31744.9 + 18
14965.1 + 72
13025.0 #
Inference
CIFARIO
5.7 0.3
7.6
12.0 + 1.0 11.0 + 1.3
5,4
4.9 1.7
CIFAR100
18.2 + 8.9
5.6 + 2.5
4.3 + 0.8 1.11
3.1 0.1
ImageNet
0.4
20.7 0.1
19.0 + 4.4
6.6 6 0.2
Table 6: AUROC results ImageNet with ResNet50 on the near and far benchmark with different training set sizes. Each split a random sample the data set with each class appearing exactly as often as each other class. We chose the optimal set of hyperparameters ImageNet, but reduced the number repeats r to 50 instead 100.
#Samples
lk
5k
10k
50k
100k
500k
IM
Duear
69.46
72.57
74.46
77.61
77.70
79.65
80.29
D
85.76
89.79
91.90
94.53
94.47
95.51
95.56
16

---

A.3 Hyperparameters
AUROC
100
16C
71bins
A1
A2
AUROC
-1
CIFAR10
ImageNet
Figure 6: KLD specific hyperparamters: We fixed the optimal hyperparameters and varied the one parameter in question by conducting 10 runs over the same fixed parameter setting on CIFAR1O 10 and ImageNet as ID against their near OOD datasets. We report the mean and the minimum maximum range (transparent). We set 5 instead of r 100 for ImageNet to save resources. Thus the noise on the results is stronger for the ImageNet ablations. All of the parameters except the kernel sizes only have single local maximum which indicates that they should be easy to optimize. The most important parameters seem to be the kernel sizes 3 and 82 that we use smoothing followed by Ybbins Note that 8 and 82 have different optimum, which means it is not possible to simply choose 51 = 82 and reduce the count hyperparameters. X is the score function without the KLD specific WeiPer application. Xe is the application of MSP which is not beneficial for CIFAR1O, but shows to be effective on ImageNet.
Table 7: The hyperparameter sets for each experiment. The number of repeats was predefined since we found increasing it always boosts the performance the cost of time and memory consumption.
Hyperparameter
CIFARI0
CIFAR100
ImageNet-1K (ResNet50)
ImageNet-IK
(ResNet18)
(ResNet18)
(ViT-B/16)
100
100
100
100
1.8
2.4
2.4
2.0
Thhin
100
100
100
80
A1
2.5
0.1
2.5
2.5
Aa
0.25
0.1
81
40
40
15
40
15
15
17

---

Table 8: Set of values for the hyperparameter search.
Hyperparameter
Values
100
[1.8, 2.0, 2.2, 2.4]
7bbins
[60, 80, 100]
X
[0.1, 2.5,, 4]
X2
[0.1, 0.25, 1, 2.5,
$1
8, 12, 20, 40]
82
[15, 25, 40]
A.4 Penultimate layer distribution
CIFARIO saghl
CIFAR100
send 2005
WWA.P.
sughl
www 2000
Teals 0000
Tea
T CCO
Figure 7: Density plots for CIFARIO and CIFAR100 of a ResNet18 trained for 300 epochs. We present the densities as in Figure 3 but this time we show it for more datasets and for two different samples 21. in the penultimate and the perturbed logit space, respectively. The OOD set for the ID CIFARIO CIFAR100 and vice versa for CIFAR 100. The range of the y-axis adjusted such that the differences between ID and OOD become visible. We therefore report the mean over the maximum density maxp of the penultimate dimensions to show, up to which value the maximum would go. We apply smoothing over k neighbors in each plot and construct the histograms with Tains bins. We report the parameters Table The class clusters and the activation clusters are clearly visible for CIFARI0 and merge into the bigger cluster for CIFAR1O0 1000 probably because of the lower class to non-class ratio. It harder see for CIFARI00 but for both datasets, it seems harder for OOD data to sample in the class cluster the activated feature cluster.
18

---

ResNet50
ViT-B/16
2
4200
1050
Figure 8: Density plots for ImageNet (ResNet50 and VIT-B/16), We chose SSB-hard OOD set and apply the same plotting procedure as defined for CIFARIO/CIFAR 100. For the respective plotting parameters, see Table 9 For ViT-B/16, the class clusters distinguishable from the non-class clusters but not for ResNet50. Still, the difference between and OOD is captured in the higher activations which could explain why activation shaping Djurisic et well for ImageNet.
(002
Sun al. 2021 works
Table 9: Plotting parameters: 8 is the kernel size for the uniform kernel that was used for smoothing. and maxp max, E [t=](t) denotes the maximum of the mean density of the penultimate densities pr. The perturbed densities Pw are scaled similarly.
7bins
maxp
CIFAR10 CIFAR100
1000
2
364.22
1000
32.85
ImageNet (ResNet50)
100
4
1.78
ImageNet (ViT-B/16)
100
0.89
19

---

A.5 Full CIEAR results
Table 10: Full CIFARIO postprocessor results on the three ResNet18 checkpoints provided by OpenOOD trained with Cross Entropy and standard preprocessing. The + indicates the standard deviation of all methods over three different model checkpoints.
CIFAR100
TIN
D near
Method
AUROCT
PPR95
AUROCT
HPR95
HPR95
Benehmarks CIFARIO/ Backhone: RevNer18
OpanMax
48.06:2..25
88.3240032
30.18:2
87.6220.29
43.0::2:27
MSP
87.19:1:033
53.08:14.6
88.871:0.00
43.27:1.3000
08.03:1::225
48 18:17:39
TemgSicale
87 17:17:4:.40
55.0
89.00:20:23
46:11:363
88 88.09100.31
50.96-2-411 10
ODIN
12.18:4:1157
5.700:4.74
13.55-11884
75.38:66.22
82.87=1.88 85
76 19:26088
MDS
63.59:1:2.27
84.8112..33
10.90:13.90
MDSFas
61:29:1:0:23
01.87-00110
50.57
02:66:10:22
60:43:00.26
92.36-10330
RMDS
08.83-20.35
43.86:23.49
90. 0.7
1.391
89.80
28.80-22.39
Gram
58.33:1:449
2.:22:22.24
58 59.9815.119
90.06:1:1.55 1.59
58, 66
90
ERO
66.0014444
OpenGAN
52.81.1.7.69
94.84:13383
51.62.1:7.68
91.11:144.21
53.71
94.48:14.001
GualNorm
$4.43-11..9 59
$4.54 1.11
55.37110441
94.89:20.00
54.90120.398
94.72:1:..2
ReAct
85:97:200:3
7.33
HR 44
50.71
0.661
63.56-2-.331
MLS
61.32.1-4.6
KLM
77.89:1:077
50.55-1.883
80.49110.85
18:17:1
79. 79.19 80
67.86:1-337
VIM
87.75:2:0028
1.11
89 53.52
40 1.55
88.68 08.68.0.33
44 24
KNN
89.73:10.14
07.66:10.31
91.56:10:226
00.37.100.55
90.66100.20
34.1 1:038
73.71=17.67
67
04.74
70.04
RankFeal
77.98:1:2244
65.32-13.44
80.94:1-2.80
56.44:1..76
79.06 2:255
60.88 1:4.00
ASII
74.11:1:..55
$7.31:1:2.06
76.4410..11
$6.25.11.55 1.58
75.27
96.78 1.878
SHE
80.31::0.69
31,00:13:42
82,76::043
73. 3.55
0.555
79
WeiPereMSP
2::17:100000
24.99
02
36 16.12.11:4 1:47
09.00
1.771:1:.72
WeiPe+RRAct
88.02.1:0:47
4..8715.09
55.0
88.83
52.84:2.111
WelPer=KLD
09.701:0.27
37.42
91.38
10.40
90.561..29
34.06:10.49
MNIST
SVHN
Textures
Places365
D Dtar
Method
AUROC
A
AUROC
FPR95
AUROC1
Benchmurh: CIFARIO/
Bochboner
RewNer88
NAC
94 1.36
15.14:2..0
96
14.33:1
95.64:0.44
17.83
0.28
26.7310
94.000035 50
18.31
OpanMax
90.50 90.50:20:44
23.33224.67
99.7740445
25 1:47
00.58
51.50:24-55
0..63
38.5222.27
69.62:009
10.69:1.221
MSP
92.6311:.57
23.64:1:.81
91,46:::40
25.2:1 1.64
09.89
34 64
88 08492:0:47
42.47-3388
90:73:10:33
31,72.1..88 1,84
TempScale
13.11:1::777
23.53:17005
91 51.66.0553
26697226.5
90:01:0074
18.16:88
0:.11
45.27114.50
90.97:0522
23.4812.39
ODIN
95.24-1:1106
13.37
84.58.20.77
68.1110.52
86.9422.26
67.70::1106
15.07=1224
20.36:66.66
K7.96261
$7.6224.24
MDS
90.10:1:::41
27.30.11.55
91.18:1::47
25.96:12.52
92.69:11006
27.94:2:2200
24.90=2.54
47.67.1..54
89.72:1:1366
32.22.13.40
MDSFas
99.17:1:044
1.3020511
66. $6-20.55
74.34:1:00
77 07
76.0720.17
52.47=0.15
94.1622.33
73 23:90:2227
61,47:20.48
RMDS
91.81:10.26
92.23-1:.23
Gram
72.64:1:2.34
70.30:18.96
52:14:44
33.911117.35
62.34:18.27
94.64::2771
30.44:2441
90
71.73:1::200
6..34
ERO
94. 23
24 12:29
01. 79:19:00006
15.12:26
89.47:00:70
$1 80:26:::11
80.2 00.25_0.78
$4.85:16.52
01:21:2:022
41 41.69
OpenGAN
56.14:1:24.08
19.76
52.81
75.27-1-2693
18.26
13.95-1.14439
53.34:1.779
95.32
15.51
13.52:11163
OudNNrm
63.73:1-7.37
65.41:14.885
92.46.12.28
57.55:1:222
21.00
ReAct
92.81:13303
18.07
19
50.33:1 15.98
89.3821
$1,47::111
0.77
34.30
40:22:141
44.00
MLS
91.15:1:2448
23 13.06:111..87
35.09:16.00 9:.99110.94
89, 89.71
51.73:16.13
89. 08.1
51.81116.55
91.10:10.99
1168::5.27
KLM
85:00:1:2.04
76 1209
84
1.1
59 79.47:17.06
02.35:00335
81 91.95-19995
0:33
55.58:12.12
82.68 22:612221
78.31
VIM
05.15
41.42.2.117
93.48.024
KNN
94.26:1:038
1..05:11.36
92.57 1:0.3
62:60:1113 1.26
93.16.10.24
24 24.06:10.55
9.277-0.23
30.38-1:0.63
9296610.11
24.27
DICE
90.37:1:5.07
10.83:1:0.54
9.70
36.61:47774
81 2.31
62.42:224477 70
7A67-4996
17.19
$4.23:1:1.88
51.76:24.45
RankFeal
75.87-6-5.22
12.78
68.15-17.44
64.19:17.30
66.06
19.71
83,99 3.04
7..30
75.87-15.06
57.44
63.16:1:4.66
73.461641
SHE
9043:1:476
22.22:120.59
86 1.33
62.74:14.01
11.57
04.00:5500
82
76.36115.30
45
66.48:15.95
GEN
93.83:::..1
23.00:27.75
1-.56
28.14:12.59
90.14:10.76
60.74166.11
0.65
4:.20-13..22
9..35
1.55
WelPersMMP
92.761:1449
24.21:14.35
92.05-00.00
2.33
91.29110.58
28.35
09.57
38.06.12.96
91442-0.41
28.87
WelPeeRReAct
92.43:1::588
25.33115117
9.
91.18:0.88
28.64
65.64-22.66
23
39.50
WeIPer+KDD
94.40:1:.477
19.98:14.08
91.301:0.1
19.18:1-4.00
93.20110.56
19.48 10.18
90.60:10.44
3..80
93.12:1034
23.72
20

---

Table 11: Full CIFARIO0 postprocessor results the three ResNet18 checkpoints provided by OpenOOD trained with Cross Entropy and standard preprocessing.
CIFARIO
TIN
D near
Method
1
AUROCT f
AUROCT
Benolmark:
CHEARTO0/
Rodhowe: ResNerf8
OpenMax
52.99-0.51
76,41::0.25
MSP
78.47:20.07
5891
81.07:0117
50.70:2:334
80.27:20.11
54.0020335
TempSeale
79.02:0.06
58.7200.11
82.79:0009
50.26:00.16
80.90200.07
$4,49:00.88
ODIN
78.18:20.14
60.6410.56
616631:0088
55.19:10:57
79.90:10.11
$7.9110:51
MDS
55:87:0022
88.00
61.50:2-78
70:05::11
98.69:20.00
83.5140000
MDSEns
43.85:20.31
95.4420.16
19.78::0.19
05.8220.12
46.31:211.24
05.88-0004
RMDS
17.75::0.19
61.37
K2.55:1:002
49 0.996
80, 15
55.46:00441
40.41:20.88
02.71
$3.01
92.08-10.20
EBO
79:05:00111
52.03-20.50
80.91400.55
OpeGGAN
63.23:1:..4 44
78.81
68 26.7422229
74.21:2
65.96:1.226
76.5 50.51.2..0
GradNoon
00
84, 0.5
60 90779
0665
70.1540047
55.58100.4
61:30-1033
80,77:10.05
MI.S
10:21:20.10
00:00000
01.7
81.05:00.07
05
KLM
73.91::0.25
24.77
29
01.07:2.599
76.56220.25
77.0241.311
VIM
72.21:10.41
70.5911043
77 76.10.16.16
54.66:10:42
74,9810.13
62.63-10.27
KNN
02:40:0:44
49.65.20.37
80.1810.11
61.22:10114
DICE
78.04:20.32
10.95:1110
30.72:0000
04.5
79.38:0.25
57.95
Rankfeest
58.04:12.366
8..76:11556
65.72:1:22
78 0.95
61.8811.228
80.59:11.10
ASH
76.48:20.30
6840620444
70 00
63 0.
15
65.71
18.15:20.03
604120.51
07.74
78.5520.18
59.07::0.25
GEN
79.38:10.04
13
09.98:10005
81.31:10.08
54.42:1:0333
WeiPesMMP
70 70:24:20.20
59.69130 20
83 30100066
40.28:10.26
81.3220010
44.491:0633
Welfer-Recdt
79.00-10.188
60.4111100
83
00.0000005
19.65.1.333
81,20:10.09
55.00-10.52
WelPo-KLD
59.9010622
83541007
48.78.10.24
54,3110299
MNIST
SVHN
Textures
Places365
Dtar
Method
AUROC1 1
FPR95 4
AUROC 1
FPR95
AUROC 1 FPR95 4
AUROC
FPR95
AUROC
FPR95 J
Aendmork:
CHEAROON/ Rodhhoe:
ResNorR
NAC
23.15:1..33
92.40++1220 26627
24.30:44666
39.32
4065:1994
00
73.57=1-16
86.98.0035
40.14
OpenMax
1.30
4.8224774
82.07--1.53
53.20
00.56
16.12:1991
79.29:0.40
5488=142
79.49-0.41
54.50:4 14.50:00.08
MSP
47.332668
76.424009
50.0712.53
77.3220711
61.88113
70
TempScale
77.271
10
57.71-26.8
78.11:0072
61
00:00:0025
06.46-0944
78.74-0051
57.941111
ODIN
63.79:11.31
35.9413299
74.411776
67.1111888
19.35:2:100
62.37:12.06
79.45:10226
54.71-0.92
79:28:10:21
58.86:10779
MDS
67.47:20.11
71.7222994
67.21226.99
76.262:000
N0.4922.48
63.15:0049
79.61=0.34
69.59
19.59:1130
1:30
72 76-2
MDSEn
98.1120078
2.85-0.66
63.7661663
82.57
84.4430333
42.27:20.73
96.61-011
66.74:1
RMDS
79.74:12.49
62.05-66228
14:111111
51.65:33.88
83.6520.51
53.09:1.000
83,40:1046
53,57-0443
82.92:1043
Gram
10.7122:.15
59.511745
05
20.06::
1.96
70.70:1..32
29.51
46.11:12211
46
04.67_060
73.5611100
64.44.2..31
EBO
79.18:11.37
12
82.03
1.744
53
3.14
78.35-0088
62.35-2.006
79.52-0211
57.75-086
79.77=0011
56.99:111
OpenGAN
6..14118.76
23.09:22325
45
20.
65.84-1:433
74.771
131100
GrodNom
65.35:2:.12
86.97
76.05:1:773
60:90:2:944
64.5820.15
02.511:061
60.00:0017
05.12-0.44
00.14:1.00
ReAct
18.37:1:1.59
56.01115666
83.01
1:997
50.11:1::02
80.15:10.46
55.0411:000
50.08.10.11
55,30-0.41
10.391:0.9
54 $4.20:11
MLSS
78.91:1:447
12
RI 65:::111 49
53
904
78
88
12.39:22:13
74
57.68-091
79.67
71 1
KLM
2..55:2.55
73.096667
34:1:4444
75.77:0045
51:50:55000
75.70022033
81.4
76.2420.55
251
VIM
1..89:11.02
1..50:1:007
1413.11
46.22:1..66
85.91
26.1222222
05.
0,77
00
74.14:1100
KNN
1..26:11.52
48 48.58
84 15:1:11100
75:11:11122
83.66.20.8
53.56-12.50
40
60,70
1.03
82
401
17
DACE
7986:2
11.792167
84 2000
49.58-2..12
77.6320.33
64-23-1110
166
78
0666
99.
-9,39-1.25
1.25
80.01
-0 18
56
05
RankFest
ASH
77.23:10:6
66.55 16.58
85
60:60-114
46.0-22..7
0.
21.2722.74
76:0011
03.9
80.
SHE
76.76:11.07
28.76:1..70
$0.97
79.1
73.64
13:29
76.30
00555
65.21-0.95
0.96
1
64 12:1:..00
GEN
78.29:1:2.05
53.9215571
41 50
23.4512.66
78.74
61
27
56
56.25
1.1
09
56
7:
WePPer-MP
70.11:1..37
12.312165
17
Weler-ReAct
79.09-11.36
53.91
501104
56.00:13.22
09.77.0.36
56.88119
10.19
0.43
80.31
1:039
10.79
WoiPe-KLD
77.93:12.009
55.51
79 5511997
59 2..70:2..70
78.56.10779
53.6315555
50.00:10.44
0.89
79.01
57.96 57
21

---

A.6
Full ImageNet results
Table 12: Full ImageNet postprocessor results ResNet50 trained with Cross Entropy and standard preprocessing. We achieve three out five best AUROC performances outperforming the competi- tion.
SSB-hard
NINCO
D near
Method
AUROCT
FPRS5
AUROC
FPR95
AUROC
FPR95
Menchmark:
ImaggeNet-1k JK Backbone: ResNet30
OpeaMax
60881
TempScale
72.87
73.90
$1.41
55.10
77.14
64,
GDIN
71.74
76.83
77.77
68.16
74.75
72.50
MDSS
$5.45
93.52
RMDS
71.77
77.88
82.22
52 20
76.99
63.04
Gram
57.39
39.39
66.01
83.87
61.70
86.63
FBO
ReAcI
73.03
77.55
$1.73
55.80
77.38
66.
MI.S
72.51
76.20
$0.41
90.44
3.46
67.82
KLM
72.54
VIM
65.54
62.29
71.35
KNN
62.57
83.36
70.64
$8.39
71.10
70.87
DICE
70.13
77.96
76.01
66.90
73.07
72.43
RankFeal
$2.97
SHE
71,08
76.30
76.40
09:72
73.78
73.01
GEN
72,01
75.75
$1.70
$4.90
76.85
65.32
WePPorMMP
WeiPer-ReAct
71,20
80.39
53.36
66.87
WeiPer+KLD
74.73
74.12
85.37
48.67
80.05
61.39
iNaturalist
Textures
Openimage-00
D
Method
AUROCT
FPR95
AUROC
FPR95
AUROC
FPR95
AUROC
FPR95
Benchmark: InsggeNet. Bachious: RevNer50
NAC
UpeaMax
MSP
88.41
43.34
$3.43
60.87
84.56
50.13
83.23
$1.45
TempScale
90.50
37.63
34.55
56.90
87.22
45, $5.40
87.56
46.64
ODIN
MISSES
61.82
84,25
79.94
73.31
66,30
90.77
67.52
K2.77
RMDS
87.24
33,67
$6.08
43,80
85.84
40
86.
40.91
GradNorm
03.80
32.05
92.05
43.37
84.82
68 46
90.25
47 02.92
ReAct
96.34
16.72
92.79
20
91.87
32,58
93.67
26.31
MLS
38.52
48
VIM
89.56
30.68
97.97
10.51
90.50
32.82
92.68
24.67
KNN
86.41
40.80
97.09
17.31
87.04
44.27
90.18
34.13
ASH
97.07
14.04
96,90
15.26
93.26
29.15
95.74
19.49
SHF
92.65
34.06
93.60
35.27
85.52
$5.02
90.92
41.45
WrPPerMMP
29.77
55.16
39.75
WeParrRRAct
95.75
21.03
91.88
34.95
91.64
31.53
93.09
20.83
WelPer+KLD
97.49
13.59
96.18
22.17
30.49
95.54
22.08
22

---

Table 13: Full ImageNet postprocessor results ViT/16-B trained with Cross Entropy and standard preprocessing.
SSB-hard
NINCO
D Deaar
Method
FPR95
FPROS
FTR95
Beachmark:
IosggoNer-1k
Baskboue:
V1116-8
OpenMax
MSP
68.94
36.41
78.1
77.28
73.52
81.85
TemyScale
68.55
87.35
77.
$1.88
73.18
84.62
MDS
11.57
$6.52
79.04
72.87
EBO
58 80
92.24
66.02
94, 14
62.41
93.19
GradNorm
42.96
93.62
35.
95.81
79.25
94.71
$4.49
KL.M
68.14
88.35
50.68
66.14
74.41
77.25
VIM
69.42
90.04
34.64
57.41
77.03
73.75
KNN
71.67
ASH
$3.90
93.50
52.51
95.37
53.21
94.43
SHE
68.04
85.73
84.18
$6.02
76.11
70.88
GEN
70.09
WiiPer-MSP
68.98
$0.66
74.82
74.97
WoiPer-ReAd
68.52
85.48
K1.07
62.67
74.79
74.08
WeIPer<KLD
68.26
85.60
81.23
60.45
75.00
73,02
iNaturalist
Textures
Openimage-0
D
Method
FDR95
FPR95
Brachmark: InsogeNet-1K Backbone: VI216-8
93.72
OpenMax
94.95
19.62
73.07
40.26
87.36
73.82
89:27
$5.50
MEP
88.19
42.40
35.06
50.46
$4.36
56.19
$6.04
51.09
$3.74
MDS
RMDS
96.10
19,47
39.38
57.22
92.32
29.57
91.60
28.16
FRO
79.30
83.56
81.17
83.66
76.48
88.82
73
85.35
GradNoom
44.99
94.53
ReAct
86.
$6.66
84.29
$7.6
ML.S
85.20
72.94
83.74
78.04
81,60
85.82
$3.54
79.23
KLM
89.59
43.48
$6.49
50.12
87.03
51.75
$3.70
48.45
VIM
DICE
82.50
47.90
$2.21
54.83
N2.22
52.57
$2.31
51.77
ASH
50.62
97.02
48.53
98.50
55.51
94.79
51.56
96.77
93.57
27.12
GEN
93.54
22.92
90.23
90.27
35.47
91.35
32.23
WaPPrsMSS
91.23
35.55
$8.08
48.62
88.15
46.30
89:15
43.49
WePPerRRAct
91.49
33.04
88.31
47.37
88.56
43.26
82:45
41.22
A.7 Compute resources
All experiments are conducted on a local machine with the following key specifications: AMD EPYC 7543 (32-Core Processor) with 256GB RAM and Ix NVIDIA RTX A5000 (24GB VRAM). To streamline the experimental process, we pre-compute the penultimate output of each backbone model and dataset combination. This is possible achieving a reduction of disk usage to <2.8 2.8GB when stored as FP16 tensors compared to sum of the original dataset sizes of CIFAR10, CIFAR100 and ImageNet-1K.
do not alter the training objective for our evaluation,
For all benchmarks, the 24GB VRAM suffices for both, the model inference and postprocessor optimization. Depending on the chosen batch size, this offers runtime / VRAM trade-off and is therefore well achievable on smaller GPUs.
Excluding the inference step for the penultimate output, we report an inference time for the postpro- cessor optimization of 18 seconds for CIFARIO and <10 minutes for ImageNet-IKK per iteration. An iteration refers to processing the full dataset starting from the penultimate layer output. For the full duration without pre-pree proceecssssng one would add the inference time of the respective ResNet[18/50) or ViT/16-B model.
23

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract introduces the key contribution WeiPer, the KL- EL-Divergence-bast
scoring function and the setting in which outperforms its competition. Furthermore, introduction briefly presents methods mechanism and lists contributions and mentions its limitations.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: In the Limitations section, address two points of critique that we feel most relevant: the number of hyperparameters and the memory consumption (also analyzed in T5. In our methods section, we clearly state our assumptions which are be justified by observations (e.g. in the figures) and by the empirical results.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specificattin, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

---

3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: Our paper only includes one theoretical result (Theorem A.1 which is proofed in Aleesa-AAberree al. (2007). However, provide proof for our case.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
With the use of the standardized OpenOOD benchmark. the results of our paper are well reproducible. We provide details the hyperparameter choices in Table and Table 8 and
Justification:
and the exact code to reproduce the results with the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
25

---

(d)
reproducible, they We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: We provide our implementation in the supplementary material. It is integrated in the OpenOOD framework, which makes it easy to setup. All required packages will be installed when setring up OpenOOD. The benchmark datasets publicty available. When published, we will release a public GitHub repository with our implementation.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/
mublic/guidess Sttal///uuddes/Coeeuubiiisse
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
7 wtips.cc/pubbll. http:////eggiiess//oteeteaeaieea SwwoodeSummissiooooo...o
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/eetails
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We describe the training details of the used baseline models and their check- points in the Experiments section. With our method functioning in a post-hoc fashion, these training checkpoints remain unchanged. The optimization details for our postprocessor also located section 4. For the specific hyperparameter ranges and found configurations see Table and Table
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
26

---

Answer: [Yes]
Justification: Due to WeiPers random nature our results exhibit noise dependent on the hyperparameter and display the minimum to maximum range in Figure(aand Figure We chose minimum to maximum results instead of standard deviation as the maximal performing perturbations could be strategically sampled.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We report the memory usage / performance trade-off in Figure 4 In Ap- pendix A.7 we report on specifications of our machine, GPU usage and execution times.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics http://///eeaaeps.cpppcppeet////
Answer: [Yes]
Justification: Our research does not involve human subjects or participants. The datasets conform with the NeurIPS Code of Ethies, specifically, the listed concerns. Our work does not introduce new data.
Our work aims to contribute to safety in AI. It proposed a method that is applicable to various applications that utilize Machine Learning, but is neither obstructing nor contributing to areas with larger societal impact.
Finally, research conforms with the NeurIPS Code of Conduct.
27

---

Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: We classify our contribution as foundational research, as it is tool to improve Machine Learning models in various use cases. Hence, specific assessment of the societal impact is difficult.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA].
Justification: Both, data and models, are not prone to high risk of misuse, see questions 9, and 10. Hence, we propose no safeguards in our work.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
28

---

12. Licenses for existing assets
Question:
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Our work builds data, the evaluation framework OpenOOD and previous OOD detectors that are introduced and cited in the Experiments section and Related Work section, respectively. Our contribution is licensed by CC BY 4.0.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the thcode. package should be provided. For popular datasets, pawerssiiiiaiiiiiae..... theoe com/ datasets
has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The implementation of our contribution is well annotated and provide optimization details as well as thorough description of our method, as it is the key contribution of our work.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mooel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
29

---

According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/teview based on the requirements of your country institution) were obtained?
Answer: [NA]
Justification: Our work does involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
30


Reviews:
[{"review_id": "0hhoAEAWHv", "reviewer": "Reviewer_QiAi", "summary": "The paper introduces \"WeiPer,\" a method that improves existing out-of-distribution (OOD) detection techniques by perturbing class projection weights. This method leverages the class-discriminative ability of pre-trained neural network classifiers by introducing weight perturbations in the final fully connected layer, creating richer representations of the input. The authors demonstrate that this technique significantly enhances OOD detection performance across multiple benchmarks, especially in challenging near-OOD scenarios. Additionally, a KL-divergence-based scoring method is proposed to utilize the properties of the augmented WeiPer space, supported by theoretical motivations and empirical observations.", "questions": "Can you provide more discussion on the motivation of the approach and its contribution to making the OOD field more robust?", "limitations": "The authors have addressed the limitations.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. WeiPer introduces a novel and effective technique for OOD detection by incorporating weight perturbations, broadening the scope of current methods.\n\n2. The paper provides extensive experimental evidence demonstrating the superior performance of the WeiPer method across multiple benchmarks and includes detailed ablation studies to validate the contributions of each component.", "weaknesses": "1. WeiPer introduces additional computational complexity and memory requirements, which might limit its applicability in resource-constrained environments.\n\n2. The proposed method involves several hyperparameters that need tuning, potentially increasing the difficulty of practical implementation.\n\n3. Compared with other methods, the superior performance is not very stable. While the method performs well across several benchmarks, additional validation on a wider variety of datasets would further demonstrate its generalizability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for taking the time to assess our work.\n\n> WeiPer introduces additional computational complexity and memory requirements, which might limit its applicability in resource-constrained environments.\n\nThat is true for virtually every method. WeiPer+KLD is comparable to other methods in both time and memory consumption (see Table 1 and 2 of the rebuttal PDF). Memory consumption and computational complexity scale linearly with $r$, all the other hyperparameters have no significant influence (see also the Limitations section in the paper). \nThe proposed method involves several hyperparameters that need tuning, potentially increasing the difficulty of practical implementation.\nThis is correct, however, most methods that perform competitively come with hyperparameters that need to be tuned. WeiPer+KLD has more hyperparameters than its competitors, but optimizing a single digit number of hyperparameters is common practice in Machine Learning. WeiPer+KLD can be optimized with OpenOODs hyperparameter search to a specific use case, and our experiments show that the optimization surface is smooth (see Figure 6 in the Appendix), i.e. other optimization methods should be easily applied. \n\n> Compared with other methods, the superior performance is not very stable. While the method performs well across several benchmarks, additional validation on a wider variety of datasets would further demonstrate its generalizability\n\nWe disagree. In fact, WeiPer+KLD is the most robust method for near OOD detection tasks (harder than far) in our study (see Table 3 in the paper). We would like to mention that we use OpenOOD [2] who built a unified benchmark. OpenOOD includes 22 benchmarks (6 for CIFAR10, 6 for CIFAR100, 5 for ImageNet in ResNet50, and 5 for ImageNet on ViT-B/16), and each method is evaluated across all of them. Compared to other methods, we think WeiPer+KLD has been evaluated with the highest scrutiny. OOD detection is still hard, hence the seemingly mixed results.   \n\n> Can you provide more discussion on the motivation of the approach and its contribution to making the OOD field more robust?\n\nThe motivation of using the WeiPer space is that this extracts structural information that can be leveraged for ID / OOD detection. (see Theorem 1). The way most classifiers end up being trained is that  the OOD set reaches into the positive class cluster in a conical shape (see Figure 1). Since, with weight perturbations, we project the data from a different angle, we can exploit this property which should be fairly generic throughout datasets.\nWe kindly ask the reviewer to clarify what they believe is missing in the motivation of our approach.\n\n[1] Zhang et al. “OpenOOD v1.5: Enhanced Benchmark for Out-of-Distribution Detection”\n\n[2] Sun et al. “Out-of-Distribution Detection with Deep Nearest Neighbors”, ICML 2022", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "M1amojOKpp", "reviewer": "Reviewer_T1ji", "summary": "The manuscript proposes a post-hoc OOD detection method, which is broadly applicable and can improve existing OOD detection methods.", "questions": "How does your methodology compare to the state-of-the-art in terms of required memory and time?", "limitations": "The authors clearly stated the method's limitations.", "rating": 7, "confidence": 2, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- The methodology is post-hoc, making it more practical.\n\n- Results for near OOD evaluation are promising.\n\n- The method can be combined with existing OOD detection strategies and improve their performance, thus increasing the potential impact of this work.", "weaknesses": "Since memory usage is a limitation of the proposed methodology, the manuscript should present a comparison of computational cost (time and memory) between the multiple OOD detection methodologies that are considered.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank reviewer for examining our paper, highlighting strengths, and indicating weaknesses to improve our contribution.\n\nWe provide a memory and time analysis comparing WeiPer+KLD to its closest competitors in Table 1 and Table 2 in the rebuttal pdf. Our method is on par with the other methods. WeiPer+KLD currently uses the whole training set to calculate the mean distribution of the activations and the WeiPer space. We see that a far smaller sample is sufficient and will conduct an experiment in the camera-ready version of the paper.\n\nUnfortunately, we did not yet succeed in collecting all the results of the memory and time comparison on ImageNet, which are particularly insightful since WeiPer blows up the 1000 dimensional logit space even more than on CIFAR100 ($r\\cdot 1000$ instead of $r\\cdot 100$). We will provide them as soon as possible. Note that the memory information in Figure 4 might be misleading (e.g., 80.24 GiB for ImageNet with $r=100$) since these numbers would apply when we calculate all training, test, and OOD scores in parallel instead of using a batch-wise procedure. We will add this to the figure description.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "r1z69HgxCs", "reviewer": "Reviewer_bFW6", "summary": "This work proposes a component, WeiPer, that can benefit OOD detection. WeiPer adds random perturbations (sampled from standard normal) to the class projection weight vectors and essentially expands the output dimension (compared to the original logit space). WeiPer can be combined with multiple existing OOD detection scoring functions (e.g., MSP, ReAct). The authors further propose a KL-divergence-based scoring mechanism that works particularly well with WeiPer. Experiments show that WeiPer+KLD yields state-of-the-art results on the challenging OpenOOD benchmarks, including the near-OOD one on ImageNet-1K.", "questions": "Since WeiPer essentially expands the output logit space and is expected to encode richer information, is it possible to leverage WeiPer for other tasks such as OOD generalization, beyond OOD detection?", "limitations": "The authors adequately addressed the limitations.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed WeiPer is to my knowledge novel. It also has generality since it can be combined with many existing OOD scoring functions.\n\n2. Extensive analyses are presented along the introduction of the method, which well justifies each design choice and makes the underlying intuition/insight clear.\n\n3. Most importantly, unlike many other papers that use arbitrary or easy OOD benchmarks for evaluation, this work demonstrates notable improvements on the challenging OpenOOD, especially with the ImageNet-1K near-OOD benchmark (with ~2% AUROC increase over the previous SOTA ASH).", "weaknesses": "A few weaknesses have been discussed by the authors in Sec. 4 and 5, e.g., WeiPer is less powerful on ViT and could induce higher memory consumption.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for taking the time to assess our paper and following up with a thought-provoking question.\n\n> Since WeiPer essentially expands the output logit space and is expected to encode richer information, is it possible to leverage WeiPer for other tasks such as OOD generalization, beyond OOD detection?\n\nThis is an interesting direction for future research. As [1] showed, the penultimate features or more precisely the neural activation states with narrow coverage, i.e. peaky distributions, lead to weak OOD generalization abilities. The Neural Collapse theory [2] states that with continued training, the features converge to the class mean. We also observe that thereby the activation distributions become more narrow (see supplementary material `ResNet18_penultimate_layer_resize.gif`). This would result in the mean activation distribution and WeiPer space distribution becoming peaky. We believe that this could be connected to overfitting and measuring this could be effective in selecting more robust models. WeiPer could assist in detecting the collapse in the logit layer as the features converge to the class means not only along the weight directions.\n\n[1] Liu et al.,  Neuron activation coverage: Rethinking out-of-distribution detection and generalization. 2024\n[2] Papyan et al., Prevalence of neural collapse during the terminal phase of deep learning training. 2020", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wHOliplYdq", "reviewer": "Reviewer_ak1i", "summary": "The paper introduces WeiPer, an post-hoc method for out-of-distribution (OOD) detection that leverages weight perturbations in the final layer of neural networks to enhance detection performance. \n\nContributions:\n\n1. Introducing linear projections of the penultimate layer by perturbing the final layer's weights to improve OOD detection.\n\n2. Discovering a fingerprint-like nature of in-distribution (ID) samples in both penultimate and newly perturbed spaces, leveraging this structure for a novel detection method.\n\n3. Proposing a KL-divergence-based scoring function and evaluating it alongside MSP and ReAct methods, showing state-of-the-art performance on near OOD tasks using the OpenOOD benchmark.", "questions": "1. Why did you not mention the data depths and only rely on Mahanalobis?\n2. Why not use information projections?\n3. Can you compare against the baselines previously introduced?\n\n**I thank the authors for their rebuttal, i have increased my grade.**", "limitations": "NA", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Simple methods with good empirical results. Technical novelty is limited but this is not a concern if it outperforms previous methods.", "weaknesses": "**Related Work Missing Strong Baselines: Data Depths and Information Projections**\n\nData depths and information projections are gaining significant interest in the OOD detection community. However, these approaches are notably absent in the related work section. It is essential to address these gaps to provide a comprehensive overview of the field.\n\nRelevant works include:\n\nM. Darrin. \"Unsupervised Layer-wise Score Aggregation for Textual OOD Detection.\"\n\nM. Darrin. \"Rainproof: An Umbrella To Shield Text Generators From Out-Of-Distribution Data.\"\n\nM. Picot. \"Adversarial Attack Detection Under Realistic Constraints.\"\n\nM. Picot. \"A Simple Unsupervised Data Depth-based Method to Detect Adversarial Images.\"\n\nM. Picot. \"A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection.\" TMLR 2023.\n\nP. Colombo. \"Beyond Mahalanobis Distance for Textual OOD Detection.\" NeurIPS 2022.\n\nP. Colombo. \"Toward Stronger Textual Attack Detectors.\"\n\n**Lack of Strong Baselines for Empirical Comparison**\n\nThe current work lacks strong baseline comparisons, particularly those involving data depth methods. This omission undermines the robustness of empirical evaluations. Incorporating these baselines is crucial for a fair and thorough comparison with existing methods.\n\nKey references that should be considered for baseline comparisons include:\n\nE. Gomes. \"A Functional Perspective on Multi-Layer Out-of-Distribution Detection.\"\nM. Picot. \"A Simple Unsupervised Data Depth-based Method to Detect Adversarial Images.\"\nM. Picot. \"A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection.\" TMLR 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for reading our paper and analyzing the strengths and weaknesses of our approach.\n\n> \"Related Work Missing Strong Baselines: Data Depths and Information Projections\"\n\nMany  methods have been developed for OOD detection, even when only considering image classification. The papers the reviewer referenced mainly concern adversarial attack detection and textual OOD detection. For clarity and readability, we chose the scope of our related work section to include only image OOD detection, and we are aware that it comes short of many impactful publications in related fields. In terms of methodology, [1] and [2] are partially similar to our approach. They also use an f-divergence as a score function (although on the softmax output) and compare input distributions to train set distributions. We agree that these works should be mentioned and will add a paragraph to the Related Work section about methods that utilize f-divergences, including the papers [1] and [2].\n\n> Why did you not mention the data depths and only rely on Mahanalobis?\n\nOur method is not based on Mahalanobis distance. We cited publications working with Mahalanobis distance, but we are not aware of other methods that consider data depth. Our KLD method is a density-based score function. Although density and data depth are related concepts, we are unaware of a closer connection to data depth that would justify mentioning it.\n\n> Why not use information projections?\n\nWe tried to formalize the score as information projection, but early testing showed that comparing to the mean training distribution was superior to comparing to the minimal distribution. Since conducting rigorous experiments on that matter did not fit our paper's scope, it is possible that different information measures, e.g., a different f-divergence and other ways of choosing a distribution to compare to, perform better than our choice. This is a promising idea for future work.\n\n\n> Can you compare against the baselines previously introduced?\n\nAs we chose OpenOOD as a benchmark framework, we are only comparing methods that have already been evaluated there. Because of time and resource constraints, we were not able to compare it to other work originating from OOD detection on images or any other modality. The papers the reviewer mentioned mainly introduce adversarial attack detectors or textual OOD detectors, and we are unaware of their application to image OOD detection or that they are evaluated on OpenOOD. The only evaluation that overlaps with [3] is the ViT-B/16 on far OOD ImageNet benchmarks. We agree with OpenOOD [4] that the field of OOD detection is suffering from inconsistency in evaluation, as it is not possible to compare every method when results are reported on different datasets/models/checkpoints/training algorithms. \n\n[1] Darrin et al. \"Rainproof: An Umbrella To Shield Text Generators From Out-Of-Distribution Data.\"\n\n[2] Picot et al. \"Adversarial Attack Detection Under Realistic Constraints.\"\n\n[3] Gomes et al. \"A Functional Perspective on Multi-Layer Out-of-Distribution Detection.\"\n\n[4] Zhang et al. “OpenOOD v1.5: Enhanced Benchmark for Out-of-Distribution Detection”", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Memory and time comparison to other methods.

Meta-review: The paper introduces a novel approach to enhance out-of-distribution detection by perturbing the weight vectors in class projections, expanding the output dimension, and enabling richer representation extraction from neural networks. The authors have presented a significant amount of empirical evidence demonstrating improved performance across challenging benchmarks, particularly in near-OOD scenarios.

The primary concerns raised in the reviews centered around the additional computational and memory requirements of the WeiPer method, its stability across various datasets, and the need for tuning multiple hyperparameters. The authors' rebuttals have addressed these concerns satisfactorily. Given the unanimous support, the decision is to accept this paper. The authors are encouraged to incorporate the suggested enhancements in their final version.
Decision: Accept (poster)