Learning to Augment Distributions for Out-of-distribution Detection
Authors: Qizhou Wang
Zhen Fang
Yonggang Zhang
Feng Liu
Yixuan Li
Bo Han
Venue: NeurIPS 2023 poster (2023)
Keywords: OOD Detection

Abstract: Open-world classification systems should discern out-of-distribution (OOD) data whose labels deviate from those of in-distribution (ID) cases, motivating recent studies in OOD detection. Advanced works, despite their promising progress, may still fail in the open world, owing to the lacking knowledge about unseen OOD data in advance. Although one can access auxiliary OOD data (distinct from unseen ones) for model training, it remains to analyze how such auxiliary data will work in the open world. To this end, we delve into such a problem from a learning theory perspective, finding that the distribution discrepancy between the auxiliary and the unseen real OOD data is the key to affect the open-world detection performance. Accordingly, we propose Distributional-Augmented OOD Learning (DAOL), alleviating the OOD distribution discrepancy by crafting an OOD distribution set that contains all distributions in a Wasserstein ball centered on the auxiliary OOD distribution. We justify that the predictor trained over the worst OOD data in the ball can shrink the OOD distribution discrepancy, thus improving the open-world detection performance given only the auxiliary OOD data. We conduct extensive evaluations across representative OOD detection setups, demonstrating the superiority of our DAOL over its advanced counterparts.

Learning to Augment Distributions for Out-of-Distribution Detection
Qizhou Wang's Zhen Fang2' Yonggang Zhang' Feng Liu Yixuan Li
Bo Han
Department of Computer Science, Hong Kong Baptist University
2 Australian Artificial Intelligence Institute, University Technology Sydney
School of Computing and Information Systems, The University of Melbourne
Department of Computer Sciences, University of Wisconsin-Madison [csqzwang, esygzhang, bhanml) @wwmp.ckbu.eeeee edu.hk zhen.fang @ udu.ed fengliu.ml gmail.com sharonli @ cs. os.wisc.edu
Abstract
Open-world classification systems should discern out-of distiiibiitiitiinn (OOD) data whose labels deviate from those of in-distribution (ID) cases, motivating recent studies in OOD detection. Advanced works, despite their promising progress, may still fail in the open world, owing to the lack of knowledge about unseen OOD data in advance. Although one can access auxiliary OOD data (distinct from unseen ones) for model training, it remains to analyze how such auxiliary data will work in the open world. To this end, we delve into such problem from a learning theory perspective, finding that the distribution discrepancy between the auxiliary and the unseen real OOD data is the key to affecting the open-world detection performance. Accordingly, we propose Learning (DAL), alleviating the OOD distribution discrepancy by crafting OOD distribution set that contains all distributions in a Wasserstein ball centered on the auxiliary OOD distribution. We justify that the predictor trained over the worst OOD data in the ball can shrink the OOD distribution discrepancy, thus improving the open- world detection performance given only the auxiliary OOD data. We conduct extensive evaluations across representative OOD detection setups, demonstrating the superiority of our DAL over its advanced counterparts. The code is publicly available at: https: //gi gith.u..c.. com/tmlr- tt/r goollr-ggouppDA....
prrriiutional-Augmeennn OOD
1 Introduction
Deep learning in the open world often encounters out-of-distribution (OOD) data of which the label space is disjoint with that of the in-distribution (ID) cases (Hendrycks and Gimpel, 2017; Fang et al., 2022). It leads to the well-known OOD detection problem, where the predictor should make accurate predictions for ID data and detect anomalies from OOD cases (Bulusu et al., 2020; Yang al., 2021). Nowadays, OOD detection has attracted intensive attention in reliable machine learning due to its integral role in safety-critical applications (Cao al., 2020; Shen al., 2021).
OOD detection remains challenging since predictors can make over-confidence predictions for OOD data (Hendrycks et al., 2019), motivating recent studies towards effective OOD detection. Therein, outlier exposure (Hendrycks et al., 2019; Ming et al., 2022) among the most potent ones, learning from auxiliary 0OD data discern ID and OOD patterns. However, due the openness of the OOD task objective (Wang et al., 2023), auxiliary OOD data can arbitrarily differ from the (unseen) real OOD data in the open world. So, to formally understand their consequences, model the difference
"quual contributions. Correspondence Bo Han (bhanml (bhaml@@comp.hhbuucdduu.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

between auxiliary and real OOD data by their distribution discrepancy, mea- sured by the Wasserstein distance (Vil- lani, 2021, 2008). Then, we reveal the negative impacts of such OOD distri- bution discrepancy on the real detec- tion power, with larger distribution discrepancy indicating a lower perfor- mance real OOD data, cf., Eq. (4).
Real OOD Data
Original Distribution Discrepancy
Distribution Discrepancy after DAL
Auxiliary OOD Data
Wasserstein Ball
The OOD distribution discrepancy threatens the open-world detection performance for outlier exposure. Therefore, we raise natural ques- tion how to alleviate such an OOD distribution discrepancy. Hence, this paper establishes a promising learn- ing framework named Distributional- Augmented OOD Learning (DAL). Therein, we augment the auxiliary OOD distribution by crafting an OOD distribution set containing all distributions in Wasserstein ball (Villani, 2021, 2008), centered on the auxiliary OOD distribution. Then, by making the predictor learn from the worst OOD distribution in the set, cf., Eq. (8), one alleviate the negative impacts of the distribution discrepancy. Moreover, our proposed framework enjoys the learning guarantees towards the expected risk with respect to the real OOD distribution, making OOD detection stay effective when facing unseen data (cf., Theorem 3). Figure provides a conceptual explanation: learning from the worst OOD distribution ensures the uniformly well performance inside the Wasserstein ball, enlarging the influence of the auxiliary OOD distribution. Thus, one can shrink the OOD distribution discrepancy between the auxiliary and the real OOD data and improve OOD detection.
Figure A heuristic illustration for our DAL. large dis- tribution discrepancy between the auxiliary and the unseen OOD data will hurt the real detection effectiveness. However, by ensuring uniformly well performance inside the Wasser- stein ball, we can mitigate the distribution discrepancy and thus improve the detection power in the open world.
In realization, the primal learning objective in Eq. (8) is generally intractable due to the infinite- dimensional optimization for the worst OOD distribution search. Instead, we adopt the dual form with respect to the original learning problem (cf., Theorem 1), transforming it into a tractable problem of the worst OOD data search in dimensoammniional space. Furthermore, following Du et al. (2022a); Mehra et al. (2022), the data search procedure is conducted in the embedding space, which can benefit the open-world performance of OOD detection with decent costs of additional computation.
We conduct extensive experiments over representative OOD detection setups, revealing the open- world performance of our method toward effective OOD detection. For example, DAL reduces the average FPR95 by 1.99 to 13.46 on CIFAR benchmarks compared with the conventional outlier exposure (Hendrycks et al., 2019). Overall, we summarize contributions into three folds:
We measure the difference between the auxiliary and the real OOD data by the Wasserstein distance, and establish an effective learning framework, named DAL., to mitigate the OOD distribution discrepancy issue. We further guarantee our performance with respect unseen real OOD data via Theorem 3, which is new to previous works.
DAL leads to a practical method Algorithm 1, learning from the worst cases in the Wasserstein ball improve the open-world detection performance. Overall, method solves the dual problem, which performs the worst-case search in the embedding space, which is simple to compute yet effective in OOD detection.
We conduct extensive experiments in Section 5 to evaluate our effectiveness, ranging from the well-known CIFAR benchmarks the challenging ImageNet settings. The empirical results comprehensively demonstrate our superiority over advanced counterparts, and the improvement is mainly attributed to our distributionalauggeene
learning framework.
detailed overview of existing OOD detection methods and theories can be found in Appendix A, and summary of the important notations can be found in Appendix B.

---

2
Outlier Exposure
Let X' denote the feature space and y y distribution. We consider the ID distribution D a joint distribution defined over X' J where X1 and Yi are random variables whose outputs are from spaces X' and y. We also have an OOD joint distribution Yo where Xo is random variable from X, but Yo is a random variable whose outputs do not belong J/ i.e., Yo $ y (Fang al., 2022).
(1,.... C} denote the label space with respect to the II
:
The classical OOD detection (Hendrycks and Gimpel, 2017; Yang et al., 2021) typically considers an open-worte world setting, where the real OOD data drawn from Do.Yo Yo unseen during training. Recently, Fang et al. (2022) have provided several strong conditions necessary to ensure the success of the classical OOD setting. Furthermore, increase the possibility of success for OOD detection and weaken the strong conditions proposed by Fang et al. (2022), advanced works (Hendrycks et al., 2019; Chen al., 2021) introduce a promising approach named outlier exposure, where set of auxiliary OOD data is employed as a surrogate of real OOD data. Here, we provide a formal definition.
Problem 1 (OOD Detection with Outlier Exposure). Let DxiYi- Dxo= and Dx, be the ID joint distribution, the OOD distribution, and the auxiliary OOD distribution, respectively. Given the sets of samples called the ID and the auxiliary OOD data, namely,
S = {xx], (irt,v))... vi...., (xf. v()) ~ D',,, i.i.d., T (xA x ~ D i.i.d.,
outlier exposure trains predictor f by using the training data S and T, such that for any test data x: 1) if x is an observation from Dx the predictor f can classify into its correct ID label; otherwise 2) if x an observation from Dxo the predictor can detect as an OOD case.
OOD Scoring. Many existing methods detect OOD data by using various score-based strategies (Hendrycks and Gimpel, 2017; Lee et al., 2018a; Liu et al., 2020; Sun et al., 2022). In general, given a model X' -> and a scoring function s(: f) : X -> IR, the OOD detector Ox is given by:
gx(x) = ID, if s(x; f) 2 X; otherwise, 9x(x OOD,
where À is a given threshold. For example, as a well-known baseline scoring function, the maximum softmax prediction (MSP) (Hendrycks and Gimpel, 2017) is given by:
SMSP x: f) max softmax; f(x),
kEy
with sof softma (-) denoting the k-th dimension of the softmax output.
Model and Risks. We denote fw X + RCC the predictor with parameters w E W. with W the parameter space. We consider the loss functions and fog w.r.t. the ID and the OOD cases, respectively. Then, the expected and the empirical ID risks of the model fw can be written as:
(w) (xxx)) ((fwix, x, and (w) 1
Σ
n
(ffws vi).
The expected and the empirical auxiliary 00D risks are then given by
1 m Σ Cor (fw;
RA (w) Ex~Dxx lor (or((w; (fw; x) and RA (w)
and the expected real OOD risk given by Ro(w) = Exx Dxo (fw(fw:s) x). Accordingly, we can define the expected detection risk with respect to real OOD data, following
Ro(w) Rí (w) ) (R))
where a is the trade-off parameter.
Learning Strategy. After the scoring function is selected, one can obtain the OOD detector the model fwr is given. Under the Problem 1 of outlier exposure, common learning strategy to optimize the empirical ID and auxiliary OOD risk jointly (Hendrycks et al., 2019), namely,
min WEW
[i((w) (w)]
Note that the auxiliary OOD data are employed in Eq. (3), which can arbitrarily differ from the real OOD cases. Then, is generally expected that the predictor fw: trained over the auxiliary OOD data, can perform well even unseen OOD data, i.c., small value of Rp(w) is expected.
3

---

3
Motivation
To the general learning strategy in Eq. (3), intuitively, if the auxiliary data are sampled from distribution similar to real ones, the predictor will perform well for real OOD data. However, auxiliary and real OOD data differ in practice, posing us suspect their open-world detection performance. To formally study the problem, we measure the difference between auxiliary and real OOD data in the distribution level, motivating our discussion of OOD distribution discrepancy.
Distribution Diserepancy. In this paper, we adopt a classical measurement for the distribution discrepancy--Opinaa Transport Cost (Sinha al., 2018; Mehra et al., 2022).
Definition 1 (Optimal Transport Cost and Wasserstein-1 Distance (Villani, 2021, 2008)), Given cost function e X x R2,, the optimal transport cost between two distributions D and D' is
W"( = inf =EII(D,D)) (xxxx))==<xxxxxx;
where II(D, D`) is the space of all couplings for D and D Furthermore, if the cost is a metric, then the optimal transport cost is also called the Wasserstein-I distance.
Based on Definition 1, we use the distribution discrepancy measure the difference between the auxiliary and the real OOD data, namely, We(Dx,, ). Then, we can formally study the impacts of such discrepancy the detection performance of the predictor. Under certain assumptions (cf., Corollary 1), we can prove that with high probability, the following generalization bound holds:
RD w) < min (R((w) + aRA (w)) + aLee Wa(xoo Dx.) + 0(1 + 0(1/mm) (4) WEW
where w is the parameter learned by Eq. i..., w E arg wiw [((w) ) + cR&(() (w), Le is the Lipschitz constant of loe w.r.t. the cost function o)- (see Theorem 3). In general, the expected detection risk RD(w) measures the expected performance on unseen OOD data given the predictor trained the auxiliary OOD data. Then, due the upper bound, the impacts of the OOD distribution discrepancy are reflected by the Wasserstein-1 distance between the auxiliary and the real OOD data, i.e., (D. Dx,), ). Therefore, although classical outlier exposure can improve OOD detection to some extent, it fails to ensure reliable detection of unseen OOD data, in that larger distribution discrepancy generally indicates worse guarantee for open-world OOD detection.
The key to improve the detection performance is mitigating the negative impact induced by the OOD distribution discrepancy. To tackle this problem, a simple lemma inspires us:
Lemma 1. Let .) be the distance to measure the discrepancy between distributions. Given space D consisting of some OOD distributions, if Dx, D, then
inf d(Dx', Dxo) S (Dxx,DDol DxE
(5)
If d(((:)) is the Optimal Transport Cost in Definition I, the cost function is continuous metric, and D is the Wasserstein-1 ball with a radius > 0, i.e., D = DDx: Wo(Dx', Dxx) S p), then
inf W Wo(Dx,, Dx.) max(W. Dxo) p, 0}. DxIDD
(6)
In the light of Lemma we introduce specific set of distributions D, augmented around the auxiliary OOD distribution. It makes it possible to mitigate the distribution discrepancy, following Eqs. (5) and (6). Therefore, instead of choosing model fw that directly minimizes the empirical risk in Eq. (3), we target augmenting the auxiliary OOD data within the distribution space D, namely,
Ri (W) + a sup Ex~D Roe (fo[(f:x)]] subject to DXA E D, WEW
min
DXIED
where Dx, the empirical form of Dx,, i.e. DX,= 1 m Em 8xg and oxg is the dirac measure.
4 Learning Framework
This section proposes general learning framework to mitigate the OOD distribution discrepancy. As aforementioned, we consider an augmented set of OOD distributions to improve OOD detection, thus named ceterrbbutionn--Augmmnttnt OOD Learning (DAL).

---

To begin with, we need to select a suitable distribution space D for the tractable solutions of Eq. (7). Generally, the choice of influences both the richness of the auxiliary data well as the tractability of the resulting optimization problem. Previous works have developed series of distribution spaces, e.g., the distribution ball based on f-divergences (Namkoong and Duchi, 2016; Michel al., 2021) and maximum mean discrepancy (MMD) (Staib and Jegelka, 2019). However, there are several drawbacks for the distribution balls based on f-divergences and MMD: 1) any f-divergence-bar based space contains only distributions within the same support set as Đ xx: and 2) the effective solutions in the MMD-based space have not been provided (Staib and Jegelka, 2019).
Instead, motivated by Sinha al. (2018); Mehra et (2022); Dai et (2023) and Theorem 1, we consider the Wasserstein ball. For any p > O, we define the augmented OOD distribution set
2 = Dxx We(xx', Dx,) S p): and consider the following optimization problem:
min RD(w;p) min [R((w) + (B)(w: WEW
(8)
wEW
where
Ro (w:
sup
Dx loe (fw;(fx)))
(9)
W.(Dxx.Dx,3
However, the optimization problem in Eq. (8) is intractable due to the infinite dimeite-ad search for the distribution Dx Fortunately, the following dual theorem provides a solution:
Theorem (Blanchet and KarthyckRajhaaA. (2016)). Let d(.-) be a continuous metric and
Φ, (w; x) supxex (f(wfi: 7o(x' x)} be the robust surrogate function. Then, for any > 0,
m
RD(w:p) Ri(w) + inf +xp+ 720
(w:(x)))) m
(10)
Theorem provides a feasible surrogate for the original optimization problem in Eq. (8), transforming the infinitediimensinnal problem to its finite counterpart, i.e., the data feature search. We use Eq. (10) to design our algorithm, cf., Section 4.2.
4.1 Theoretical Supports
This section provides the theoretical support for our DAL. Specifically, 1) Theorem shows that the empirical model given by Eq. (8) can achieve consistent learning performance, and 2) Theorem further demonstrates the expected detection risk estimation, i.c., RD (w), with respect to the empirical model given by Eq. (8). All the proofs can be found Appendix C. To state our theoretical results, we use the notation Rp (w; p) to represent the ideal form of RD(w;; p), which is defined by Rn(w: Rí R((w) + aRo(w; (w:,),
where
Ro
sup DxxDxr.Dx,So
Ex-Dy (fF(([xx]))
Similar to Sinha et (2018), our results rely on the covering number (cf., Appendix C.1) for the model classes F (f(fwi)) w E W) and For = (foo(fww.)) complexity. Intuitively, the covering numbers NFF, e, I and [[FoE, T. are the minimal numbers of _ balls of radius > 0 needed to cover the model classes F and FOE, respectively. Now, we demonstrate that DAL can achieve consistent performance under mild assumptions.
E W] to represent their
Theorem 2 (Excess Generalization Bound). Assume that S E(fw; x, y) S Mr. 0 < (ow(fwi x) < Mtog and c) X x X R4 is a continuous metric. Let w be the optimal solution of Eq. (8), i.e. W E arg min Rw(w;)) Then with the probability at least RD(w:p)
4e 0,
min RD(w:; p) S E(n, m;; m);), weW
(11)
for any p > 0, where
c(n, m;;) = Me
(' VlogN(FF (e,gN,F,Me,. Loo de + 2M
Vn
Ma +ab1 V
2t
Mozz, L Los aby V
ppm
m
where bo. b, and b2 uniform constants.
5

---

Algorithm DistrbutionallAugmmntted OOD Learning (DAL)
Input: ID and OOD samples from Dx,y, and DxA:
for st = 1 to num_step do
Sample SB and TB from D and Dx,;
Initialize p¹ ~ (0, aT), Vi E (I....,,ThT.
earnnuummereee for 1 to num search do
4 = Vp for (h(e(x) +
- ||p' [| Vie [Tn]]:
p' < p' psup', ViE (l..... [b
end for
7 < min max (7 3(p Tel fo ( (b(g(x)) + +')) - a [sa] Σ 18al
Σ Tal lIp'll 7max), 0):
Ele
77l
w + w 1r 77 Σ ==
((Ew x bf)]
==1
end for Output: model parameter W.
Furthermore, under proper conditions, one can show that the bound in Eq. (11) can attain O(1/vn) O(1 (01//m),,i., i.e., Rp( W: p) -mi (w(:;))))) p) O(1/vn)++ /m). Corollary in Appendix C.5 gives an example to support the above claim. Next, we give a learning bound to estimate the expected detection risk in Eq. (2) w.r.t. the model fw given by Eq. (8).
Theorem 3 (Risk Estimation). Given the same conditions in Theorem and let w be the solution of Eq. (8), which is given by w E arg wew RD(w:p)) p). If Loz (o is Le-Lipschitz w.r.t. c(.,) )), Le., (fo x) (oo(fw::') S Looo(x x'), then with the probability at least 4e 1 0.
approximate
RD(W)- min RD (w: S aLe max We(xxo Dxx) + enn, m;t).
WEW
extimation ermo
for any p > where e(n, m; is defined in Theorem 2.
The bias term ahe max ( WW[Dxo. Dx,) p, = 0 when is large enough. Hence, a large p implies small estimation error. Although larger p leads to better generalization ability, the approximate risk min (D(w;p) may become larger. It implies that for practical effectiveness, i.e. small (D( there is a trade-off between the approximate risk minwew RD(w (w; p) and the bias aLe max W (WeDDx Dxx) - p, 0} across different choices of p. Hence, we need to choose a proper p for open-worls detection with unseen data (cf., Section 5.3).
4.2 Proposed Algorithm
In this section, we introduce the algorithm design for DAL, summarized in Algorithm 1. Due to the space limit, we provide further discussions in Appendix E.
Losses and Cost Function. Following Hendrycks et (2019), we adopt the cross entropy loss to realize l and the Kl-divereence between model predictions and uniform distribution for log. We also define the cost function e by the I norm, namely, c(x, = -|x-x'li>>
Algorithm Design. By Theorem 1, we can address the primary problem in Eq. (8) by the dual problem in Eq. (9). Additionally, following Du al. (2022a), we perturb for the worst OOD data in the embedding space. Denote the model fw h o with h the classifier and e the feature extractor, we find the perturbation p for the embedding features, i.c., e(x), of the associated data x. The perturbation p should lead to the worst OOD case for the surrogate function in Theorem 1, namely,
dy (w; e(x))
sup (fom(h(e()) + e):)(x)) >||p]|
Per
where E denotes the space of embedding features. Note that we abuse the definition of foe, empha- sizing that perturb the embedding features of c(x) by p.
Training and Inference. Our definition of cb,, (w; e(x)) leads to a particular realization of Eq. (10), which is the learning objective of our DAL. It can be solved by stochastic gradient optimization for deep models, e.g., mini-batch stochastic gradient descent. After training, we use the MSP scoring function by default and discuss the possibility of other scoring functions in Appendix F.3.

---

Stochastic Realization, Algorithm 1 gives stochastic realization of DAL, where ID and auxiliary OOD mini-batches are randomly sampled in each stochastic iteration, denoted by Sp and TB respectively. Therein, we first find the perturbation p that leads to the maximal (w, e(x)). The value of p is initialized by random Gaussian noise with the standard deviation a and updated by gradient ascent for num_ samm_ssaarrci ch steps with the perturbation strength ps. Then we update y by one step of gradient descent with the learning rate B, and further clipping between 0 and "max to avoid extreme values. Finally, given the proper perturbations for the auxiliary OOD data in TB. we update the model parameter w by one step of mini-batch gradient descent.
Experiments
In this section, we mainly test DAL on the CIFAR (Krizhevsky and Hinton, 2009) benchmarks (as ID datasets). To begin with, we introduce the evaluation setups.
OOD Datasets. We adopt the 80 Million Tiny Images (Torralba et al., 2008) as the auxiliary OOD dataset; Textures (Cimpoi et al., 2014), SVHN (Netzer et al., 2011). Places365 (Zhou et al., 201 1)), LSUN (Yu et al., 2015), and iSUN (Xu et al., 2015) as the (test-time) real OOD datasets. We eliminate those data whose labels coincide with ID cases.
Pre-training Setups. We employ Wide ResNet-40-2 (Zagoruyko and Komodakis, 2016) trained for 200 epochs via empirical risk minimization, with a batch size 64, momentum 0.9, and initial learning rate 0.1. The learning rate is divided by 10 after 100 and 150 epochs.
Hypae-pasammeers Tuning Strategy. The hyper- parameters are tuned based on the validation data, separated from the training ID and auxiliary OOD data, which a common strategy in OOD detection with outlier exposure field (Hendrycks et al., 2019; Chen et al., 2021). Specifically, we fix 0.001, num search
10, and adopt the grid search to choose Timxx from {0.1, 0.5, 1, 5, 10, 50);
3 from {1e-3 3 5- 3 1e-2, 5e 5 1e-1,__000 5e 1, 1,53; / from {1e-2 1e-1_______ 1, 10, 100]; ps from {le -3
3,ee 1e le 1, 10, 100}: a from {0.1, 0.5, 1.0, 1.5, 2.03.
Hyper-parameters Setups. For CIFAR-10, 10, DAL is run for 50 epochs with the ID batch size 128, the OOD batch size 256, the initial learning rate 0.07, Tmmax 10, B = 0.01, p = 10, ps 1, and a 1. For CIFAR-I00, DAL is run for 50 epochs with the ID batch size 128, the OOD batch size 256, the initial learning rate 0.07, Timax 10, 0.005, p == 10, and ps 1, and a 1. For both cases, we employ cosine decay (Loshchilov and Hutter, 2017) for the model learning rate.
Baseline Methods. We compare DAL with representative methods, including MSP (Hendrycks and Gimpel, 2017), Free Energy (Liu et al., 2020), ASH (Djurisic et al., 2023), ReAct (Sun et al., 2021), Mahalanobis (Lee et al., 80), KNN (Sun et al., 2022), KNN+ (Sun et al., 2022), CSI (Tack et al., 2020), VOS (Du et al., 2022a). Outlier Exposure (OE) (Hendrycks et al., 2019), Energy-OE (Liu et al., 2020), ATOM (Chen et al., 2021). DOE (Wang et al., 2023), and POEM (Ming et al., 2022). We adopt their suggested setups but unify the backbones for fairness.
Evaluation Metries. The detection performance is evaluated via representative metrics, which are both insspeddd-ndeeeedenn: the false positive rate of OOD data when the true positive rate of ID data is at 95% (FPR95); and the area under the receiver operating characteristic curve (AUROC), which can be viewed as the probability of the ID case having greater score than that of the OOD case.
Due to the space limit, we test our DAL with more advanced scoring strategies in Appendix F.3 and conduct experiments on the more complex ImageNet (Deng al., 2009) dataset in Appendix F.10.
5.1
Main Results
The main results are summarized in Table 1, where we report the detailed results across the considered real OOD datasets, First, we reveal that using auxiliary OOD data can generally lead to better results than using only ID information, indicating that outlier exposure remains a promising direction worth studying. However, as demonstrated in Section 3, the OOD distribution discrepancy can hurt its open- world detection power, while previous works typically oversee such an important issue. Therefore, our DAL, which can alleviate the OOD distribution discrepancy, reveals large improvement over the original outlier exposure. Specifically, comparing with the conventional outlier exposure, our method reveals 1.99 and 0.13 average improvements w.r.t. FPR95 and AUROC on the CIFAR- 10 dataset, and 13.46 and 3.65 of the average improvements on 100 dataset. For advanced works that consider the OOD sampling strategies, e.g., ATOM and POEM, DAL can achieve much better results, especially for the CIFAR- 100 case. The reason is that these methods mainly consider the situations
7

---

Table 1: Comparison between method and advanced methods the CIFAR benchmarks. & (or 1) indicates smaller (or larger) values are preferred, and bold font indicates the best result a column. Methods grouped based 1) using ID data only and 2) using additional information about auxiliary OOD data. Two groups are separated by the horizontal line for each ID case.
Methed
FPR95 AUROCT
SYHN
FPROS
LSUN
AUROCT
FPRO5
ISU
AUROCT
FIROS
Textures
AUROCT
FPR95 AUROC
PlacesS65
FPR9S
Average
AUROCT
LIFAR-UU LU
Using data only
MSP Free Energy
56.44
59.08
88.
52.46
90103
91.64
ASII
50.90
Mahalanobis
79.74
KNN
41:67
91:21
KNN+
3.28
99.33
2.24
90.90
17.83
95.65
10.87
97.72
30.63
98.98
12.97
97.32
CSI
17.37
97. 07.699
6.75
99
12.5%
97.95
25.65
94.70
40.00
92.05
20.44
96.17
VOS
36.55
93.30
9.98
98.03
28.93
94.25
$2.83
85.74
39.56
89.77
33.57
92.31
Using ID dota and austliary OOD data
OF
2.36
19.27
1:15
191.88
2,48
5:35
98.85
11.90
97.23
4.87
95.88
Energy OE
1,00
2.32
27
3.42
99.18
97.44
98.91
ATOM
2.15
2.53
98.97
DOB
CIFAR-100
Using LD data only
MSP
84.39
71:18
660.36
85.39
82.63
75,80
83.32
73.59
52.31
15.30
78.61
75:05
Free Energy
85.24
73.71
23.05
93.88
81.11
79.02
79.63
76.35
80.18
75.65
69.84
80.12
ASH
83.56
69:35
63.009
63.59
14.46
Mahulanobis
82:70
KNN
KNN+
47.41
91.12
CSI
64.50
84.62
70.62
80.83
61.30
36.
83.08
77.
61.12
95.05
VOS
78,05
92.39
40.40
92.90
85-77
70.20
82.46
71.22
$2.31
75.47
73,80
91.67
Using TD data and auxiliory OOD data
OE
46.73
90.31
16.30
99.99
47.97
$3,33
50.29
38.27
$4.30
87.11
43.14
90227
Enery-CIE
35.34
94. 74
16.27
93.
33.21
93.25
46.13
98.62
50.45
90.04
36.28
93.18
ATOM
24.80
95.15
17.83
96
47.83
91.06
44.86
91.80
53.92
88
37.84
92.73
DOE
40.95
960.9
PORM
93.78
where the model capacity is not enough to learn from all the auxiliary OOD data, deviating from our considered issue in OOD distribution discrepancy. Moreover, for the previous works that adopt similar concepts in the worst-case OOD learning, c.g.. VOS and DOE, DAL also reveals better results, with 1.29 and 30.89 improvements on the CIFAR- 10 dataset and 11.27 and 44. 12 improvements on the CIFAR-IOS 100 dataset w.r.t. FPR95. It indicates that our theoretical-dre algorithm designs with practical effectiveness. Note that many previous works use advanced scoring strategies other than MSP, and thus experiment above is not completely fair to Therefore, in Appendix F.3, we also combine DAL with many advanced scoring strategies other than MSP, which further improve our performance.
scheme can also guide the
5.2 Hard OOD Detection
We further consider hard OOD sce- narios (Sun al., 2022), of which the test OOD data are very similar that of the ID cases. Follow- ing the common setup (Sun et al., 2022) with the CIFAR-10 dataset be- ing the ID case, we evaluate our DAL on three hard OOD datasets, namely, LSUN-Fix (Yu et al., 2015), ImageNet-Resizz (Deng et al., 2009), and CIFAR-100. Note that data in ImageNet-Resize (1000 classes) with the same semantic space as Tiny- ImageNet (200 classes) are removed. We select set of strong baselines that are competent in hard OOD detection, summarizing the experiments Table 2. As we can see, our method can beat these advanced methods across the considered datasets, even for the challenging
Table 2: Comparison between our method and advanced
methods on hard OOD detection. J. (or 1) indicates smaller
larger) values are preferred, and bold font indicates the best result in column.
LSUN-Fix
ImageNNi-Ress
CIFAR-100
FPRS5 1 AUROC
FPRU5 L AUROC
FPR95 J
AUROCT
Using ID data only
Energy ASH
4,00
98.20
46.18
88.85
54.31
83.71
KNN-
24.88
95.75
30.52
94.85
40.00
89.11
39.79
37.47
Using I1) data auxiliary OOI data
OE
1.75
99.17
6.76
98.38
29.40
91.20
5.98
POEM
1.24
98.0
6.56
98.17
35.11
91 80
DAL
1.39
99.47
5.60
98.80
25.45
94_34

---

DAL Toining
(50 Teatiing
130
10
4020
50
FPR35
12
137
100
101
1072
107
104
Figure 2: Illustrations of embedding features for the ID, the auxiliary OOD (A-OOD), and the worst OOD (W-OOD) data. We adopt the t-SNE visualization the CIFAR-10 10 dataset and illus- trate the results before and after DAL training.
Figure 3: FPR95 curves across various on the CIFAR-100. We report both the results for the average real OOD data (REAL) and the auxiliary OOD data (AUXI), where we consider
hyper-
parameter setups, i.e., ps = 1 and ps = 10.
CIFAR-10 versus CIFAR-100 setting. The reason is that our distributional augmentation directly learns from OOD data close to ID pattern, which can cover hard OOD cases.
5.3 Ablation Study
We further conduct an ablation study to demonstrate two mechanisms that mainly contribute to our open-world effectiveness, namely, OOD data generation and Wasserstein ball constraint.
OOD Data Generation. DAL learns from the worst OOD data to mitigate the OOD distribution discrepancy. To understand such OOD generation scheme, we employ the t-SNE visualiza- tion (Van der Maaten and Hinton, 2008) for the ID, the auxiliary OOD, and the worst OOD data. Figure summarizes the results before and after DAL training. Before training, the ID and auxiliary OOD data overlap largely, indicating that the original model is not effective at distinguishing between them. Then, DAL does not directly train the model on auxiliary OOD data but instead perturbs it to further confuse the model beyond the overlap region. After DAL training, the overlap region between ID and auxiliary OOD data shrinks. Additionally, perturbing the original OOD data becomes more difficult, indicating that the model has learned to handle various worst-case OOD scenarios.
Wasserstein Ball Constraint. The choice of p determines the radius of the Wasserstein ball. Larger values of reduce estimation error and improve model generalization, as stated in Theorem 3. However, larger values of p also increase the approximate risk minwew RD((w; p) as it becomes more challenging to ensure uniform model performance with increased distributional perturbation. Figure 3 shows the FPR95 curves on the CIFAR-100 dataset for both the real and the surrogate OOD data, revealing the tradc-off in selecting Here, we consider two setups of p. i.c., ps 1 (default) and ps 10 (large perturbation strength). First, when the perturbation strength is very large (i.e., ps 10), the model can easily fail for training if the value of p is also large (e.g., P 100), indicating that large value of p can lead large approximation error. However, such an issue can be overcome by selecting a relatively small value of p (e.g., = 0.5).
6 Conclusion
Outlier exposure is one of the most powerful methods in OOD detection, but the discrepancy between the auxiliary and (unseen) real OOD data can hinder its practical effectiveness. To address such an issue, we have formalized it as the OOD distribution discrepancy and developed an effective learning framework to mitigate its negative impacts. Specifically, we consider specific distribution set that contains all distributions in a Wasserstein ball centered on the auxiliary OOD distribution. Then, models trained over worst-case OOD data the ball can ensure improved performance toward open-word world OOD detection. Overall, as pioneers in critically analyzing the open-world setting with theoretical analysis, we are committed raising attention to the OOD distribution discrepancy issue and encouraging further research in this direction.

---

Acknowledgments and Disclosure of Funding
QZW, YGZ. and BH were supported by the NSFC Young Scientists Fund No. 62006202, NSFC General Program No. 62376235, Guangdong Basic and Applied Basic Research Foundation No. 2022A151501 1652, HKBU Faculty Niche Research Areas No. RC-FNRA-IG/2--MMMCIA, and HKBU CSD Departmental Incentive Scheme. FL was supported by Australian Research Council (ARC) under Award No. DP230101540, and by NSF and CSIRO Responsible AI Program under Award No. 2303037. YXL was supported by the AFOSR Young Investigator Program under award number FA9550-23-1-00 1-0184, National Science Foundation (NSF) Award No. IIS-2237037 IIS-2331669, and Office of Naval Research under grant number N00014-23-1-2643.
References
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and -uttt--diitri examples in neural networks. In ICLR, 2017.
Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is cittof-disttibbtiin detection learnable? In NeurlPS, 2022.
Saikiran Bulusu, Bhavya Kailkhura, Bo Li, P Varshney, and Dawn Song. Anomalous instance detection deep learning: A survey. Technical report, Lawrence Livermore National Lab., 2020.
Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized ont-of-distribution detection: survey, arXiv preprint 1tti::2110.11334. 2021.
Tianshi Cao, Chin- Wei Huang. David Yu- Tu-T Hui, and Joseph Paul Cohen. A benchmark of medical out of distribution detection. arXiv preprint arXiv:2007.042555 04250, 2020.
Zheyan Shen, Jiashuo Liu, Yue He, Xingxuan Zhang, Renzhe Xu, Han Yu, and Peng Cui. Towards out-of-distribution generalization: survey, arXiv preprint arXiv:2108.1 13624, 2021.
Dan Hendrycks, MMntas Mazeika, and Thomas G. Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019,
Yifei Ming, Ying Fan, and Yixuan Li. POEM: Out-of-distribution detection with posterior sampling. In ICML, 2022.
Qizhou Wang. Junjie Ye, Feng Liu, Quanyu Dai, Marcus Kalander, Tongliang Liu, Jianye Hao, and Bo Han. out-of-distributie detection with implicit outlier transformation. In ICLR, 2023.
Cédric Villani. Topics in Optimal Transportation. American Mathematical Society, 2021.
Cédric Villani. Optimal Transport: Old and New. Springer, 2008
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. VOS: Learning what you don't know by virtual outlier synthesis. In ICLR, 2022a.
Akshay Mehra, Bhavya Kailkhura, Pin- Yu Chen, and Jihun Hamm. On certifying and improving generalization to unseen domains. arXiv preprint wwXiv:2206./23644 2022.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. ATOM: Robustifying out-of- distribution detection using outlier mining. In ECML., 2021.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurlPS, 2018a.
Weitang Liu, Xiaoyun Wang. John Owens, and Yixuan Li. Energy based -iittriiiitiiitto detection. In NeurlPS, 2020.
Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. ICML, 2022.
Aman Sinha, Hongseok Namkoong, and John C. Duchi. Certifying some distributional robustness with principled adversarial training. In ICLR, 2018.
10

---

Hongseok Namkoong and John C. Duchi. Stochastic gradient methods for distributionally robust optimization with f-divergences. In NIPS, 2016.
Paul Michel, Tatsunori Hashimoto, and Graham Neubig. Modeling the second player in distribution- ally robust optimization. In ICLR, 2021.
Matthew Staib and Stefanie Jegelka. Distributionally robust optimization and generalization in kernel methods. In NeurIPS, 2019.
Rui Dai, Yonggang Zhang, Zhen Fang, Bo Han, and Xinmei Tian. Moderately distributional exploration for domain generalization. In ICML,, 2023.
José H. Blanchet and M. KarthyekRajhaaa. Quantifying distributional model risk via optimal transport. Risk Management eJournal, 2016.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical Report TR-2009, University of Toronto, 2009.
Antonio Torralba, Rob Fergus, and William T Freeman. 80 million tiny images: A large data set for nonparametric object and scene recognition. IEEE transactions on pattern analysis and machine intelligence, 30(1 1):1958-11 1970, 2008
Mircea Cimpoi, Subhransu Maji, lasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. De- scribing textures in the wild. In CVPR, 2014.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop, 2011.
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 40(6):1452-14644 2018.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. LSUN: construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 03366., 2015.
Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev Kulkarni, and Jianxiong Xiao. Turkergaze; crowdsourcing saliency with webcam based eye tracking. arXiv preprint arXiv:1504.06755 2015.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC, 2016
Ilya Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with warm restarts. In ICLR. 2017.
Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection. ICLR, 2023.
Yiyou Sun, Chuan Guo, and Yixuan Li. ReAct: out-of-distribution detection with rectified activations. In NeurlPS, 2021.
Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. CSI: novelty detection via contrastive learning on distributionally shifted instances. In NeurlPS, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: a large-scale hierarchical image database. In CVPR, 2009.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-SNE. Journal of machine learning research, 911):2559-220 26019,2262222220 2008
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection neural networks. ICLR, 2018
Haoran Wang, Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't 't know? In NeurIPS, 2021a.

---

Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. NIPS, 2017.
Rui Huang and Yixuan Li. MOS: towards scaling out-of-distribun detection for large semantic space. In CVPR, 2021.
Chandramouli Shama Sastry and Sageev Oore. Detecting out-of-distribution examples with gram matrices. In ICML, 2020.
Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. VIM: Out-of-distribttion with virtual- logit matching. In CVPR, 2022a.
Ziqian Lin, Sreya Dutta Roy, and Yixuan Li. MOOD: Multi-level out-of-distribution detection. In CVPR, 2021.
Peyman Morteza and Yixuan Li. Provable guarantees for understanding out-of-distribution detection. In AAAI, 2022.
Yadan Luo. Zijian Wang, Zhuoxiao Chen, Zi Huang, and Mahsa Baktashmotlagh. Source-free progressive graph learning for open-set set domain adaptation. JEEE Transactions on Pattern Analysis and Machine Intelligence, 45(9):
2023.
Rui Huang, Andrew Geng, and Yixuan Li. On importance gradients for detecting distributional shifts in the wild. In NeurlPS, 2021.
Conor Igoe, Youngseog Chung, Ian Char, and Jeff Schneider. How useful are gradients for ood detection really? arXiv preprint arXiv:2205. 10439, 2022.
Jianing Zhu, Hengzhuang Li, Jiangchao Yao, Tongliang Liu, Jianliang Xu, and Bo Han. Unleashing mask: Explore the intrinsic out-of-distribution detection capability. In ICML, 2023a.
Vikash Sehwag, Mung Chiang, and Prateek Mittal. SSD: A unified framework for self-supervised outlier detection. In ICLR, 2021.
Haotao Wang, Aston Zhang, Yi Zhu, Shuai Zheng, Mu Mu Alex Smola, and Zhangyang Wang. Partial and asymmetric contrastive learning for out-of-distributio detection in long-tailed recognition. In ICML, 2022b.
Haotian Zheng, Qizhou Wang, Zhen Fang, Xiaobo Xia, Feng Liu, Tongliang Liu, and Bo Han. out-of-distribution detection learning with unreliable nutoo-ddistributinn sources. In NeurIPS, 2023.
Xuefeng Du, Gabriel Gozum, Yifei Ming, and Yixuan Li. SIREN: Shaping representations for detecting out-of-distributio objects. In NeurlPS, 2022b.
Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embeddings for out-of-distribution detection? In ICLR, 2023.
Alireza Zaeemzadeh, Niccolò Bisagno, Zeno Sambugaro, Nicola Conci, Nazanin Rahnavard, and Mubarak Shah. Out-of-distribution detection using union of I-dimensional subspaces. In CVPR, 2021.
Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In ICML, 2022.
Zhuo Huang, Xiaobo Xia, Li Shen, Bo Han, Mingming Gong, Chen Gong, and Tongliang Liu. Harnessing out-tf--iittibution examples via augmenting content and style. In ICLR, 2023a.
Jianing Zhu, Geng Yu, Jiangchao Yao, Tongliang Liu, Gang Niu, Masashi Sugiyama, and Bo Han. Diversified outlier exposure for out-of-distribution detection via informative extrapolation. In NewrIPS, 2023b.
Yi Li and Nuno Vasconcelos. Background data resampling for outlier-awaae classification. In CVPR, 2020.
12

---

Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high- confidence predictions far away from the training data and how to mitigate the problem. In CVPR, 2019.
Taewon Jeong and Heeyoung Kim. OOD-MAMI: Meta-learning for few-shot out-of-distribution detection and classification. In NewrlPS, 2020.
Joost Van Amersfoort, I Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using single deep deterministic neural network. In ICML., 2020.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting oustoo--iitribuutin samples. ICLR, 2018b.
Sachin Vernekar, Ashish Gaurav, Vahdat Abdelzad, Taylor Denouden, Rick Salay, and Krzysztof Czarnecki. Out-of cuttof-distribbutinn detection in classifiers via generation. In NeurlPS Workshop, 2019.
Leitian Tao, Xuefeng Du, Xiaojin Zhu, and Yixuan Li. Non-parametric outlier synthesis. In JCLR, 2023.
Yadan Luo, Zijian Wang, Zi Huang, and Mahsa Baktashmotlagh. Progressive graph learning for open-set domain adaptation. ICML., 2020.
Lily H. Zhang, Mark Goldstein, and Rajesh Ranganath. Understanding failures in out-of-distributin detection with deep generative models. In ICML, 2021.
Zhen Fang, Jie Lu, Anjin Liu, Feng Liu, and Guangquan Zhang. Learning bounds for open-set learning. In /CML., 2021.
Julian Bitterwolf, Alexander Meinke, Maximilian Augustin, and Matthias Hein. Breaking down out-of-distribution detection: Many methods based OOD training data estimate combination of the same core quantities. In ICML., 2022.
Roman Vershynin. High- High--Dimensioal Probability. Springer, 2018.
Jose Blanchet, Yang Kang, and Karthyek Murthy. Robust wasserstein profile inference and applica- tions to machine learning. Journal of Applied Probability, 56(3):830-857 2019.
Noah Golowich, Alexander Rakhlin, and Ohad Shamir. Size-independent sample complexity of neural networks. In COLT, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018.
Qizhou Wang, Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, and Masashi Sugiyama. Probabilistic margins for instance reweighting in adversarial training. In NeurlPS, 2021b.
Zhuo Huang, Miaoxi Zhu, Xiaobo Xia, Li Shen, Jun Yu, Chen Gong, Bo Han, Bo Du, and Tongliang Liu. Robust generalization against photon-limited corruptions via worst-case sharpness minimiza- tion. In CVPR, 2023b.
Risheng Liu, Jiaxin Gao, Jin Zhang, Deyu Meng, and Zhouchen Lin. Investigating bi-level optimiza- tion for learning and vision from unified perspective: A survey and beyond. IEEE Transactions 2021.
on Patlern Analysis and Machine Intelligence, 14(11):00455-0000
Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Schölkopf, and Kun Zhang. Adversarial robustness through the lens of causality. In ICLR, 2022.
Tal Ridnik, Emanuel Ben-Baruch, Asaf Noy, and Lihi Zelnik-Manor. ImageNet-21k pretraining for the masses. arXiv preprint arXiv:21044 10972, 2021.
Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alexander Shepard, Hartwig Adam, Pietro Perona, and Serge J. Belongie. The iNaturalist species classification and detection dataset. In CVPR, 2018
Dan Hendryeks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song, Scaling out-of-distributtin detection for real-world settings. In ICML, 2022.
13


Reviews:
[{"review_id": "2GZNjOw0vP", "reviewer": "Reviewer_REz1", "summary": "The paper aims to tackle the problem of out-of-distribution (OOD) detection in supervised learning through a learning theoretic approach. The authors propose a method termed DAL, which intends to reduce the discrepancy between the detector's training distribution (auxiliary OOD distribution) and true OOD distribution by expanding the set of auxiliary distributions over which the detector is trained. The paper outlines a rigorous approach to open-world OOD detection. DAL is evaluated experimentally and shown to outperform competing techniques.\n\nPost-rebuttal update: increasing score to 7", "questions": "Questions:\n1. Line 88: Does this mean that the labels in ID and OOD are mutually exclusive? Could you please explain if this is a significant assumption\n2. Line 124: Please provide references for the statement \"the auxiliary and the real OOD data differ largely in practice\". I would like to understand how significant is the typical difference.\n3. As a follow-up, how large can the upper bound in (4) grow? Are there any standard assumptions made for theoretical analysis?\n4. What does the assumption in Theorem 2 regarding l <= M imply- suppose l is cross-entropy or exponential loss, does the bound mean that f_w needs to be a reasonably good solution? Otherwise, the loss function could be unbounded, if I am not mistaken. How mild are these assumptions?", "limitations": "It would be useful if the authors discussed a few most relevant open challenges, in light of their findings", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Strengths:\n1. The authors recognize the shortcomings in prior work on OOD detection and motivate the problem towards their proposed solution\n2. While I am not an expert in the area, using Wasserstein type metrics and controlling the distribution discrepency between true and auxiliary OOD distributions appeals to mean\n3. Through Theorems 2 and 3, the paper shows that DAL has a theoretical grounding and gives an algorithm to achieve the DAL objective\n4. While I have not checked the proofs in sufficient detail, I believe that the analysis is rigorous\n5. The experiments show the improvements achieved by DAL over several recent competing approaches", "weaknesses": "Weaknesses:\n1. Theorems 2 and 3 can benefit from a detailed discussion in the main body\n2. This could be a question as well - are common corruptions of CIFAR10 or Imagenet not used as standard datasets for OOD detection?\nAlso, please comment on my questions below", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your constructive comments and generous supports! Please find our responses below.\n\n> Q1. Theorems 2 and 3 can benefit from a detailed discussion in the main body.\n\nA1. Theorem 2 justifies that when the model complexity and the sample size are large enough, the empirical solution given by our DAL risk will converge to its optimal value, i.e., $\\min_\\mathbf{w} R_D(\\mathbf{w};\\rho)$. Therefore, the difference between the expected and the empirical error is bounded w.r.t. the DAL risk. \n\nTheorem 3 goes one step further, studying the detection risk w.r.t. (unseen) real OOD data. It states that the open-world performance of our DAL depends on both the approximate risk and the estimation error. The former models the best performance (i.e., Bayes optimal) that our DAL can achieve, and the latter depends on the OOD distribution gap, the radius, and the excess error introduced in Theorem 2. \n\n\nIn summary, **Theorem 2 considers the convergence for DAL itself, while Theorem 3 justifies that DAL can mitigate the OOD distribution discrepancy in the open world**. We will add the related discussion in the Appendix for our revision.\n\n\n> Q2. This could be a question as well - are common corruptions of CIFAR10 or Imagenet not used as standard datasets for OOD detection?\n\nA2. To our knowledge, ID feature corruptions are typically not considered in OOD detection [1]. Such anomalies may violate the standard definition of OOD data in that the ID features can still conceive ID semantics after common corruptions [2,5]. However, we are sure that detecting common corruption is also essential, which may motivate generalized OOD detection in the future that can handle varying abnormal cases. It remains an open question that we will study.\n\n> Q3. Line 88: Does this mean that the labels in ID and OOD are mutually exclusive? Could you please explain if this is a significant assumption.\n\nA3. Yes, the label space between ID and OOD data should be disjoint---a standard definition that clarifies the problem setup in OOD detection [2,5]. Such a definition is introduced in our paper for concreteness and clarity.\n\n> Q4. Line 124: Please provide references for the statement \"the auxiliary and the real OOD data differ largely in practice\". I would like to understand how significant is the typical difference.\n\nA4. It is a standard learning setup in OOD detection since the seminal work of outlier exposure [1] states, \"In real applications, it may be difficult to know the distribution of outliers one will encounter in advance.\" It is well-adopted in the following works [3,4,5]. However, seldom work attempted to address the OOD distribution discrepancy issue in a systematic way, highlighting the contribution of our paper. \n\n\n> Q5. As a follow-up, how large can the upper bound in (4) grow? Are there any standard assumptions made for theoretical analysis?\n\nA5. For **sample sizes**, the generalization error decreases w.r.t. the reciprocal for the square root of sample sizes; For **distribution discrepancy**, the upper bound grows liearnly w.r.t. to the Wasserstein distance between auxiliary and real OOD data. \n\nMoreover, Eq. 4 is a particular case of Theorem 2 given $\\rho=0$, thus following the same assumptions in Theorem 2, all commonly used in the literature [7]. In A6, we further explain that these assumptions are reasonable in practice. \n\n> Q6. What does the assumption in Theorem 2 regarding l <= M imply- suppose l is cross-entropy or exponential loss, does the bound mean that f_w needs to be a reasonably good solution? Otherwise, the loss function could be unbounded, if I am not mistaken. How mild are these assumptions?\n\nA6. One can prove that the cross-entropy and the exponential losses are bounded and lipschitz w.r.t. $\\mathbf{w}$ for deep models with softmax outputs [6], if\n\n- (1) activation functions are 1-Lipschitz;\n- (2) inputs are from bounded feature space $\\mathcal{X}$; \n- (3) parameter space $\\mathcal{W}$ is bounded (e.g., using regularization to ensure). \n\nMore specifically, when the F-norm bounds parameters, softmax output $\\mathbf{f}$ is continuous and never attains infinity. If we further assume that inputs are from a bounded feature space, then $\\mathbf{f}$ is a continuous function over the bounded space, implying that $\\mathbf{f}$ has upper and lower bounds. **Thus the cross-entropy and the exponential loss can be bounded in practice and our assumptions are practical.**\n\n> Q7. It would be useful if the authors discussed a few most relevant open challenges, in light of their findings.\n\nA7. OOD distribution discrepancy is critical in OOD detection, yet little work has tried to handle it. Although DAL provides a systematic method to mitigate such a critical problem, the trade-off between the estimation and the approximation errors may limit further improvement. Moreover, other data augmentation approaches, which may lead to semantic diversity, are also open challenges. Our future studies will focus on novel learning schemes that can address the above issues. \n\n---------------\n\n[1] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. \"Deep anomaly detection with outlier exposure.\" ICLR, 2018.\n\n[2] Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, Feng Liu. \"Is out-of-distribution detection learnable?\" NeurIPS, 2022. \n\n[3] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. \"Out-of-distribution detection with deep nearest neighbors.\" ICML, 2022.\n\n[4] Yiyou Sun, Chuan Guo, and Yixuan Li. \"React: Out-of-distribution detection with rectified activations.\" NeurIPS, 2021.\n\n[5] Yifei Ming, Ying Fan, and Yixuan Li. \"POEM: Out-of-distribution detection with posterior sampling.\" ICML, 2022.\n\n[6] Noah Golowich, Alexander Rakhlin, and Ohad Shamir. \"Size-independent sample complexity of neural networks.\" COLT, 2018.\n\n[7] Tong Zhang. \"Mathematical analysis of machine learning algorithms.\"\" Cambridge University Press, 2023."}, {"review_id": "JQHwKZj9H1", "reviewer": "Reviewer_xghg", "summary": "This paper aims to address the outlier exposure in OOD detection from theoretical perspective. By developing a novel generalization bound based on the distributional augment principle, the paper proposes a novel outlier exposure method. Experiments indicate the effectiveness of the proposed method.", "questions": "Please answer the questions in Weakness. ", "limitations": "N/A", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. A novel generalization bound to understand outlier exposure. It seems this theory is the first theory in outlier exposure field.  \n2. The proposed algorithm is theoretical guided and guarantee. From my personal view, this is important  to reliable ML.\n3. The features trained based on proposed DAL can be used with other post-hoc OOD detection method. This method can be combined with previous works well and naturally.\n4. Extensive experiments have shown the effectiveness of the method. It seems the performance has achieved SOTA performance compared with latest works. ", "weaknesses": "1. I am confused that it seems the radius rho becomes larger, the estimation error in Theorem 3 will decrease. So, from the theoretical view, why not selected rho larger enough? \n2. How to tune the parameters rho, gamma….? Validate set is allowed in outlier exposure?\n3. It seems your algorithm and theory have a small gap. Could you clarity why you do that? It is better to give more clear explanations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your constructive comments and generous supports! Please find our responses below.\n\n> Q1. I am confused that it seems the radius rho becomes larger, the estimation error in Theorem 3 will decrease. So, from the theoretical view, why not selected rho larger enough?\n\nA1. As demonstrated in Theorem 3 and Figure 3, **there is a trade-off between the approximation and estimation errors**. Although a larger $\\rho$ leads to a closer bound (i.e., a smaller estimation error), the approximate risk will become larger. Therefore, we should choose a proper $\\rho$ to balance the approximation and estimation errors.\n\n\n> Q2. How to tune the parameters rho, gamma? Validate set is allowed in outlier exposure?\n\nA2. As described in Section 5, **our hyper-parameters are tuned based on validation data, separated from the training ID and auxiliary OOD data**. In fact, outlier exposure [1] valso adjusts the hyper-parameters with such validation data, stating that \"the $\\lambda$ coefficients were determined early in experimentation with validation $\\mathcal{D}_\\text{out}^\\text{val}$ distributions described in Appendix A.\" Therefore, using the validation data to tune the hyper-parameters in OOD detection is proper.\n\n\n> Q3. It seems your algorithm and theory have a small gap. Could you clarity why you do that? It is better to give more clear explanations.\n\nA3. Perturbing features in the embedding space in Algorithm 1 leads the gap between our realization and theories. However, when applying our theories to the embedding space, the gap can be addressed. \n\nWe would like to further explain that **computational efficiency is our primary consideration in using embedding perturbation**. With ten searching steps for data augmentation, computing in the input space (ten times of full backward propagations per step) takes about ten times as long as that in the embedding space. Moreover, directly optimizing input features can easily get stacked at local solutions [2] and may require complex generative models [3], leading to unnecessary troubles.\n\n--------------------------------\n\n[1] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. \"Deep anomaly detection with outlier exposure.\" ICLR, 2019.\n\n[2] Qizhou Wang, Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, and Masashi Sugiyama. \"Probabilistic margins for instance reweighting in adversarial training.\" NeurIPS, 2021.\n\n[3] Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. \"The secret revealer: Generative model-inversion attacks against deep neural networks.\" CVPR, 2020."}, {"review_id": "iVytxj1Wq8", "reviewer": "Reviewer_UEQu", "summary": "This paper proposes a theory and an algorithm to address the OOD detection problem better. The whole paper is well-structured, and the algorithm is designed via the developed theory. The basic idea is to simulation the OOD distributions as representative as possible, thus we can expect that the detector can work well in the most scenarios. Experiments verify the effectiveness of the proposed method. All theoretical results are proved in the appendix.", "questions": "See the weakness. ", "limitations": "N/A", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper's structure is very clear, and readers enjoy reading this paper. It starts from a classical but powerful solution of OOD detection problem. Then, a theory follows to demonstrate the effectiveness of this kind of solution. Finally, am algorithm is designed via the proposed theory.\n  \n2. The proposed algorithm is verified in many benchmark datasets, including hard OOD situation, which is a strong evidence to support the claims made in this paper.\n\n3. The studied problem is very important, and the focused research direction is practical. Although there are many non-outlier methods used to detect OOD data, we can always obtain some outliers to help our training, which is practical.\n ", "weaknesses": "1. There might be some gaps between the algorithm and theory. One might be addressed during the response phase: In Theorem 2, there are two assumptions regarding the loss function. How are the both assumptions satisfied in your algorithm? Some discussions should be added here.\n\n2. In lines 218-219, the reason why we need to perturb data in the embedding space should be clarified. You indeed follow previous work, but more explanations are needed here.\n\n3. In lines 228-235, more justifications should be added here. I did not see any support (from literature or experiments) for this kind of design.\n\n4. Experiments regarding CIFAR-10 can be moved to appendix, as all methods have good performance. It is not meaningful to see that one method is better than the other by 0.2%. In this way, more experiments in appendix can be moved back to the main content.\n\n5. It is very interesting to see the real validation set here, more details can be included in the main content.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your constructive comments and generous supports! Please find our responses below.\n\n\n> Q1. In Theorem 2, there are two assumptions regarding the loss function. How are the both assumptions satisfied in your algorithm? Some discussions should be added here.\n\nA1. One can prove that the cross-entropy and the exponential losses are bounded and lipschitz w.r.t. $\\mathbf{w}$ for deep models with softmax outputs [1], if\n\n- (1) activation functions are 1-Lipschitz; \n- (2) inputs are from bounded feature space $\\mathcal{X}$;\n- (3) parameter space $\\mathcal{W}$ is bounded (e.g., using regularization to ensure). \n\nMore specifically, when the F-norm bounds parameters, softmax output $\\mathbf{f}$ is continuous and never attains infinity. If we further assume that inputs are from a bounded feature space, then $\\mathbf{f}$ is a continuous function over the bounded space, implying that $\\mathbf{f}$ has upper and lower bounds. **Thus the cross-entropy and the exponential loss can be bounded in practice and our assumptions are practical.**\n\n\n> Q2. In lines 218-219, the reason why we need to perturb data in the embedding space should be clarified. You indeed follow previous work, but more explanations are needed here.\n\nA2.  **Computational efficiency is our primary consideration**. Taking ten searching steps for data augmentation, computing in the input space (ten times of full backward propagations per step) takes about ten times as long as that in the embedding space. Moreover, directly optimizing input features can easily get stacked at local solutions [3] and may require complex generative models [4], leading to unnecessary troubles. \n\n> Q3. In lines 228-235, more justifications should be added here. I did not see any support (from literature or experiments) for this kind of design.\n\nA3. We follow previous works that using min-max learning schemes in deep learning, e.g., [4,5]. Such an end-to-end realization is easy to follow and efficient in practice, which motivates our stochastic realization of DAL. \n\n> Q4. Experiments regarding CIFAR-10 can be moved to appendix, as all methods have good performance. It is not meaningful to see that one method is better than the other by 0.2%. In this way, more experiments in appendix can be moved back to the main content.\n\nA4. Sincere thanks for your suggestion. We will re-organize the experimental parts in our revision, moving the CIFAR-10 results to the Appendix.\n\n> Q5. It is very interesting to see the real validation set here, more details can be included in the main content.\n\nA5. As described in Section 5, **our hyper-parameters are tuned based on the validation data, separated from the training ID and auxiliary OOD data**. For example, for CIFAR-10, the validation data consist of 10K images from training set of CIFAR-10 and 10K images from Tiny-ImageNet-200 (i.e., auxiliary OOD data).\n\nSelecting a part of training data for validation is a common practice in machine learning, and such a tuning strategy is also used in many previous works [6,7]. We will discuss more about the validation set in our revision.\n\n------------------------\n\n[1] Noah Golowich, Alexander Rakhlin, and Ohad Shamir. \"Size-independent sample complexity of neural networks.\" COLT, 2018.\n\n[2] Qizhou Wang, Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, and Masashi Sugiyama. \"Probabilistic margins for instance reweighting in adversarial training.\" NeurIPS, 2021.\n\n[3] Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. \"The secret revealer: Generative model-inversion attacks against deep neural networks.\" CVPR, 2020.\n\n[4] Akshay Mehra, Bhavya Kailkhura, Pin-Yu Chen, and Jihun Hamm. \"On Certifying and Improving Generalization to Unseen Domains.\" 2022.\n\n[5] Tuan Anh Bui, Trung Le, Quan Tran, He Zhao, and Dinh Phung. \"A unified wasserstein distributional robustness framework for adversarial training.\" ICLR, 2022.\n\n[6] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. \"Out-of-distribution detection with deep nearest neighbors.\" ICML, 2022.\n\n[7] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. \"Deep anomaly detection with outlier exposure.\" ICLR, 2019.\n"}, {"review_id": "4tctOwyS7E", "reviewer": "Reviewer_3p7h", "summary": "This paper noticed that the discrepancy between the auxiliary and (unseen) real OOD data hindered the effectiveness of outlier exposure, which is a potential method for OOD detection. To tackle this issue, the authors proposed a learning framework that augments the auxiliary OOD dataset using a Wasserstein ball. By training the model on the worst-case OOD data in the ball, the performance of the model toward open-world OOD detection will be improved.", "questions": "- Given the Wasserstein ball is applied to the feature distribution, is it possible to train the classifier only and leave the encoder as pre-trained?\n- Will the false negative rate of ID samples be increased under DAL, i.e., ID samples being misclassified as OOD samples, especially in hard OOD detections?\n- Why choose 10 searches in experiments? Will increased searches improve performance? How long does it take for the DAL training?", "limitations": "The authors do not address the limitations of the method. Possible improvements can be: can the model be easily applied to (1) regression tasks? (2) models that are hard to be fully fine-tuned, i.e., transformers.", "rating": 7, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "- The paper is well-motivated: the authors formalized the challenges in existing outlier exposure methods for OOD detection and provide a solution to the challenges.\n- The proposed DAL framework is proposed with firm theoretical support with a convergence guarantee.\n- Experiments show that using ID and OOD auxiliary samples and using the proposed DAL can effectively improve the performance of OOD detection, even when ID and real OOD samples are very close. The results confirm the design of DAL.", "weaknesses": "- Experiments are conducted on relatively simple datasets and models. It is worth to be shown that the proposed method still has improvements on more complicated samples.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "e sincerely thank you for your constructive comments and generous supports! Please find our responses below.\n\n> Q1. It is worth to be shown that the proposed method still has improvements on more complicated samples.\n\nA1. We have tested our DAL for some challenging setups in the literature [1,2], and some of the results can be found in the Appendix. For example, we evaluate on hard OOD detection in Section 5.2 and on ImageNet benchmark in Appendix F. In the future, we will contribute to the community to collecting new datasets for more complicated OOD detection evaluations.\n\n> Q2. Given the Wasserstein ball is applied to the feature distribution, is it possible to train the classifier only and leave the encoder as pre-trained?\n\nA2. Yes, we can fine-tune only the fully connected layer. However, the performance gain for OOD detection is more or less limited. Since traditionally trained models (e.g., cross-entropy loss on ID data) possess misleading representations that can degrade OOD detection, training only with the fully connected layer is insufficient. We conduct experiments on CIFAR-100 to support the above claims, summarized in the following table (fully training as \"fine tuning\" and training only with the FC layer as \"linear probe\"). As we can see, for the linear probe setup, DAL can still improve the OE counterpart, while the performance gain is largely limited compared to that of the fully training. We will add the related discussion in the Appendix.\n\n| FPR-95 | Linear Probe | Fine Tune |\n|:------:|:------------:|:---------:|\n|   OE   |     50.09    |   **43.14**   |\n|   DAL  |     43.37    |   **29.68**   |\n\n> Q3. Will the false negative rate of ID samples be increased under DAL, i.e., ID samples being misclassified as OOD samples, especially in hard OOD detections?\n\nA3. Many thanks for your constructive comments. We list the results of common OOD detection on the CIFAR benchmarks and the challenging CIFAR-10 vs. CIFAR-100 setup. The results are summarized in the following table. As we can see, the FNR decreases for all the three considered cases, further demonstrating the effectiveness of our method. \n\n| FNR-95 | CIFAR-10 common | CIFAR-100 common | CIFAR-10 vs. CIFAR-100 |\n|:------:|:---------------:|:----------------:|:----------------------:|\n|   MSP  |      33.02      |       64.83      |          43.01         |\n|   OE   |       5.04      |       41.31      |        26.38      |\n|   DAL  |    **3.89**    |     **26.87**   |          **22.81**         |\n\n\n\n> Q4. Why choose 10 searches in experiments? Will increased searches improve performance? How long does it take for the DAL training?\n\nA4. num_search} is a hyper-parameter that validation sets can tune. In Appendix F.5, we validate DAL across various num_search, finding that too larger values of  num_search can degrade the performance and num_search is a proper choice.\n\nMoreover, since data are augmented in the embedding space, each search step only takes one layer of backward propagation. Even with large values (e.g., num_search=50), its computation cost is still negligible compared to model updates. \n\n\n> Q5. The authors do not address the limitations of the method. Possible improvements can be: can the model be easily applied to (1) regression tasks? (2) models that are hard to be fully fine-tuned, i.e., transformers.\n\nA5. We discussed the limitation of our method in Appendix E.2, where the trade-off between the estimation error and the approximation error may limit the further improvement of our method. Moreover, other data augmentation approaches, which lead to complex augmentation or consider semantic diversity, are also open challenges. \n\nApplying our method to regression tasks and transformer fine-tuning is also attractive, while seldom work has studied these challenging setups. Some seminal works may include [3,4]. We will add the related discussion in the Appendix. Moreover, how to generalize our method for other problem setups in machine learning is also interesting.\n\n-----------------------\n\n[1] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. \"Out-of-distribution detection with deep nearest neighbors.\" ICML, 2022.\n\n[2] Rui Huang and Yixuan Li. \"Mos: Towards scaling out-of-distribution detection for large semantic space.\" CVPR, 2021.\n\n[3] Geoff Pleiss, Amauri Souza, Joseph Kim, Boyi Li, and Kilian Q. Weinberger. \"Neural network out-of-distribution detection for regression tasks.\" 2019.\n\n[4] Yunhao Ge, Jie Ren, Andrew Gallagher, Yuxiao Wang, Ming-Hsuan Yang, Hartwig Adam, Laurent Itti, Balaji Lakshminarayanan, and Jiaping Zhao. \"Improving Zero-shot Generalization and Robustness of Multi-modal Models.\" CVPR, 2023."}]

Author rebuttal:

Meta-review: The paper presents DAL, a learning-based solution for out-of-distribution (OOD) detection in supervised learning. By expanding the set of auxiliary distributions and reducing distribution discrepancy, DAL outperforms existing techniques, as confirmed by positive feedback from all reviewers. The proposed method is well-motivated, has theoretical grounding, and demonstrates its effectiveness through extensive experiments. Given the resolution of raised concerns and the unanimous positive reviews, the paper is accepted for publication.
Decision: Accept (poster)