Out-of-Distribution Detection with a Single Unconditional Diffusion Model
Authors: Alvin Heng
Alexandre H. Thiery
Harold Soh
Venue: NeurIPS 2024 poster (2024)
Keywords: out-of-distribution detection
anomaly detection
diffusion model
Primary area: diffusion_based_models
TL;DR: We propose to perform unsupervised out-of-distribution detection using a single unconditional diffusion model by characterizing properties of the diffusion path.

Abstract: Out-of-distribution (OOD) detection is a critical task in machine learning that seeks to identify abnormal samples. Traditionally, unsupervised methods utilize a deep generative model for OOD detection. However, such approaches require a new model to be trained for each inlier dataset. This paper explores whether a single model can  perform OOD detection across diverse tasks. To that end, we introduce  Diffusion Paths (DiffPath), which  uses a single diffusion model originally trained to perform unconditional generation for OOD detection. We introduce a novel technique of measuring the rate-of-change and curvature of the diffusion paths connecting samples to the standard normal. Extensive experiments show that with a single model, DiffPath is competitive with prior work using individual models on a variety of OOD tasks involving different distributions. Our code is publicly available at https://github.com/clear-nus/diffpath.

Out-of-Distribution Detection with a Single Unconditional Diffusion Model
Alvin Heng', Alexandre H. Thiery?, Harold Soh
Department of Computer Science, National University of Singapore
2 Department Statistics Data Science, National University of Singapore Smart Systems Institute, National University of Singapore falvinh, harold)ccomp nus edu.sg
Abstract
distr--iisttiittion (OOD) detection is a critical task in machine learning that seeks to identify abnormal samples. Traditionally, unsupervised methods utilize deep generative model for OOD detection. However, such approaches require a new model be trained for each inlier dataset. This paper explores whether single model can perform OOD detection across diverse tasks. To that end, we introduce Diffusion Paths (DiffPath), which uses single diffusion model originally trained to perform unconditional generation for OOD detection. We introduce a novel technique of measuring the rate-of-change and curvature of the diffusion paths connecting samples to the standard normal. Extensive experiments show that with single model, DiffPath is competitive with prior work using individual models on a variety of OOD tasks involving different distributions. Our code is publicly available https: //ti thub. com/ clear-nnusddifeeeeeeee
1 Introduction
Outti--dist (OOD) detection, also known as anomaly or outlier detection, seeks to detect abnormal samples that are far from given distribution. This vital problem deep neural networks are known to be overconfident when making incorrect predictions on outlier samples [1, 2], leading to potential issues in safety-critical applications such roboties, healthcare, finance, and criminal justice [3]. Traditionally, OOD detection using only unlabeled data relies on training generative model on in-distribution data. Thereafter, measures such as model likelihood its variants are used as OOD detection score [4-6]. An alternative approach is to utilize the excellent sampling capabilities of diffusion models (DMs) reconstruct corrupted samples, and use the reconstruction loss an OOD measure [7-9].
However, these conventional methods require separate generative models tailored to specific inlier distributions and require retraining if the inlier data changes, such as in continual learning setups. This prompts the question: can OOD detection be performed using a single generative model? We answer in the affirmative and present Diffusion Paths (DiftPath) in this paper. While the use of single model for OOD detection has been proposed in the discriminative setting [10], the best of our knowledge, we are the first to explore this for generative models. We believe that the generative setting is particularly salient in light of recent trends where single generative foundation models are utilized across various tasks [11, 12].
Our method utilizes single pretrained DM. In departure from prior works that uti- lize variants of likelihoods [6, 5, 4] or reconstruction losses [7-9], we propose to per- form OOD detection by measuring characteristies of the forward diffusion trajectory, specif- ically its rate-of-change and curvature, which can be computed from the score predicted by the diffusion model. We provide theoretical and empirical analyses that motivate these
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

quantities useful OOD detectors; their magnitudes are similar for samples from the same distribution and different otherwise. We summarize our contributions follows:
DDIM Inversion
1. We introduce a novel approach to OOD detection by examining the rate-of- change and curvature along the diffu- sion path connecting different distribu- tions to standard normal.
Po (x)
dx, e Ke, fjdy
Py(x)
2. Through comprehensive experiments with various datasets, we show that single generative model is competitive with baselines that necessitates sepa- rate models for each distribution.
Figure 1: Illustration of the diffusion paths of sam- ples from two different distributions (CIFARIC 10 and SVHN) obtained via DDIM integration. The paths have different first and second derivatives (rate-of- change and curvature). We propose to measure these quantities for OOD detection.
3. We offer a thcoretical framework demonstrating that our method charac- terizes properties of the optimal trans- port (OT) path between the data distri- bution and the standard normal.
2 Background
Score-hased Diffusion Models. Let (x(x) denote the data distribution. We define stochastic differential equation (SDE), also known as the forward process, to diffuse po (x() to a noise distribution pr (x):
dx, fxx: D)dt + g())dw,, Xp ~ po()
where : - R is the drift coefficient, g(t) E RR is the diffusion coefficient and w, E R the standard Wiener process (Brownian motion). We denote pt as the marginal distribution of Eq. 1 at time t. By starting from noise samples XT pT, new samples Xo po(x) can be sampled by simulating the reverse SDE
dx, = (f( V logpi(x)) + g(t)dwe, XT (r(
(2)
where W. is the standard Wiener process when time flows backwards from T to O, and dt is an infinitesimal negative timestep. The diffusion process described by Eq. also has an equivalent ODE formulation, termed the probability flow (PF) ODE [13], given by
dx, f(xx,t)
1 ((())Vx
dt.
The ODE and SDE formulations are equivalent in the sense that trajectories under both processes share the same marginal distribution (xx)). Hence, given an estimate of the score function sy (xx,, ss vx log Pt (xt), which can be obtained using score-matchine matching approaches [14, 13], one can sample from the diffusion model by solving the reverse SDE or integrating the PF ODE backwards in time.
In this work, we focus on the variance-preserving formulation used in DDPM [15), which is given by Orastein-Uhlenben forward process
dx. - Bix,dl VB,dw., Xo (x(x)
where 3r are time-dependent constants. Under Eq. 4, diffused samples x, can be sampled analytically d via Pe (x (x)) = (xxx VāzXa, of I), where 8r = dt log ãg and of = āz. The score estimator, cx t) x - Vx log Pt (xt), can be trained via the following objective
[|1e0(x.:)) 1) - -<1/
min E2 10a
xx)
(5)
where -o, Vx
(x: -Vaxxoo0

---

CIFAR10 SVHN
Table 1:
AUROC of
statistics shown in Fig. 2.
C10 vs SVHN
Method
NLL
0.091
NLL (bits/dim)
250
270
Q|
675
1000
1200
2000
2000
(1ee f)
0.856
Σ. 110reo(xs: ())
0.965
Histograms of various statistics of the respective training sets. The NLL is calculated using diffusion model trained on CIFAR10, while the other two statistics are calculated with a model trained on ImageNet.
Figure 2:
Unsupervised OOD Detection. Given a distribution of interest p(x), the goal of OOD detection to construct scoring function which outputs a quantity So(x) E R that identifies if given test point Xiest from p(x) (x)) this work, a higher value of So (Xaaa indicates that the sample more likely to be drawn from p( xx)). We will use the notation "A vs B" to denote the task of distinguishing samples between A and B, where A is the inlier distribution and B is the outlier distribution. In unsupervised OOD detection, one must construct the function Sg using only knowledge of A.
3 Diffusion Models for OOD Detection
An overview of our method, DiffPath, is illustrated in Fig. 1. DiffPath is based the insight that the rute-of-change and curvature of the diffusion path connecting samples to standard normal differ between distributions, making them effective indicators for OOD detection. This section outlines the methodology behind DiffPath. We begin in Sec. 3.1, where we provide evidence that likelihoods from diffusion model are insufficient for OOD detection. Next, Sec. 3.2 shows that the score function is a measure of the rate-of-chang and motivates the use of single generative model. We then motivate the curvature the derivative of the score in Sec. 3.3. We consider the curvature statistic as one variation of our method and abbreviate it as DiffPath-1D. In Sec. 3.4, we contextualize our method in terms of the optimal transport path between samples and standard normal, and finally propose a higher-order, hybrid variation called DiftPath-6D in Sec. 3.5, which incorporates both the rate-of-change and curvature quantities.
3.1 Diffusion Model Likelihoods Do Not Work for OOD Detection
When leveraging likelihood-baset generative model for OOD detection, the most natural statistic to consider is the likelihood itself. As DMs are trained to maximize the evidence lower bound (ELBO) of the data, one would expect that in-distribution samples have higher ELBO under the model compared to -utto--distributiin samples. However, prior works [2, 16] have shown that the opposite behavior was observed in deep generative models, such normalizing flows, where the model assigned higher likelihoods to OOD samples.
In Fig. 2, we plot the distributions of the negative ELBO (denoted NLL) of the CIFARIO and SVHN training sets for a DM trained on CIFARI0 10. Our results corroborate earlier findings that likelihoods are not good OOD detectors; the NLL of CIFAR10 10 samples are higher than SVHN samples, meaning in-distribution samples have lower likelihoods than duitt-ddistrbbutinn samples. The poor AUROC score in Table I quantitatively demonstrates the inability of likelihoods to distinguish between inlier and outlier samples. This motivates us to search for better statistics that we can extract from DMs for OOD detection.
3.2 Scores OOD Statistic
Scores as KL Divergence Proxy.
We start by rewriting the PF ODE, Eq. 3, in the following form: dx. dt
g(1)2
f(x,, f)
20, (x()),
(6)
3

---

ImageNet Mode!
CelebA Model
Figure 3: Illustration of the forward integration of Eq. 7 on samples from CIFARIO, SVHN and CelebA. Both the ImageNet and CelebA models are able bring the samples approximately standard normal. Other than the case where the CelebA model is used to integrate CelebA samples (last row of the right figure), the samples shown here have not been seen by the models during training. While in certain cases the end result appears to contain features of the original image, thus deviating from an isotropic Gaussian (c.g.. first row of the right figure), empirically we find that the scores remain accurate enough for outlier detection; see Sec. 5 for quantitative results.
where we have parameterized the score as (x Vx log (x.).
Theorem 1. Denote o; and dh as the marginals from evolving two distinct distributions du and do via their respective probability flow ODEs (Eq. 6) forward in time. We consider the case with the same forward process, i.e., the two PF ODEs have the same f(x,, t), g(t) and o Under some regularity conditions stated in Appendix A.
1/" Ex-o
g(1/ ||o((xt,)) t) ex (x,,0)) + DEL(
DEL(Coll = 2 3.1
The term (Kl(órllTT) vanishes as ØT = vT = (O, by construction, assuming the true scores available. In practice, we rely score estimator Eş obtained via score matching approaches. Theorem suggests that the scores of the marginal distributions along the ODE path serve as a proxy for the KL divergence: DKL ( (()) increases, should the difference in the norms of their scores. Another interpretation is that this difference, (x,, t) cu (x,, 1)]))) Fisher divergence between the two distributions, which forms the foundation for score matching [17]. This motivates using the norm of the scores statistic for distinguishing two distributions.
measure of the
However, Theorem is not immediately useful as it requires priori knowledge of both distributions, whereas in unsupervised OOD detection, only knowledge of the inlier distribution is available. Interestingly, we empirically observe that it is possible to approximate the forward probability flow ODE for different distributions using single diffusion model. Recall that as the PF ODE has the same marginal as the forward SDE, if the score estimate eg has converged to the true score, then forward integration of sample xo using Eq. 6 should bring the sample approximately standard normal, Xy ~ I).
Specifically, we consider the following parameterization [18] of the PF ODE
dx, Eo (x f)dy
C. and X; = XIV X Let (x( = -o, Vx logp:(() be score model trained on po(x). It is known that the DDIM sampler [19] is Fuler's method applied to Eq. 7. In Fig. 3, we integrate Eq. 7 forward in time using DDIM for samples from various distributions, most of which are unseen by the model during training. Qualitatively, we observe the surprising fact that both the ImageNet and CelebA models are able to bring the samples approximately to the standard normal. We ablate the choice of Po in Sec. 5.2.
where 7/-
This motivates Eo as a replacement for arbitrary cø when integrating Eq. 7 forward with samples from do- In Fig. 2. we see that the distributions of v E (x,, the square root of the sum of I norms of scores over time, applied to the two datasets using single model trained on ImageNet are better separated than the likelihoods. Note that Theorem 1 tells us only that the score norms of inlier and outlier samples are different, not whether one is higher or lower than the other. Thus, we propose the following OOD detection scheme: fit Kernel Density Estimator (KDE) to VE, [|ex(x,, t) of the training set for given distribution, then use the KDE likelihoods of a test sample as the OOD score

---

Algorithm OOD detection with DiffPath
Input: Trained DM Eg. train set Xaan test samples Xiee, empty lists Lunin and Liea Output: OOD scores of test samples So (Xess)
I: for Xe in Xuii do
2: {Eo(Xi, t) DDIMLnverssonn(x, cD)
Integrate Eq. 7 from = 0 to
3: Calculate OOD statistic using (Eo(x,, f)
4: Append statistic to Linin
5: end for
Puain t- density estimate to Luain
e.g., KDE, GMM
7: Lusa f- Repeat lines 1 with Xest
8:
return Prain (1) for every / in Liest
Sg. This way, the likelihoods of outlier samples under the KDE are lower than for inlier samples, allowing compute the AUROC. We provide pseudocode in Algorithm 1. With this scheme, the AUROC scores Table show a large improvement over likelihoods; however, we would like to pursue even better OOD statistics, which discuss in Sec. 3.3.
Score as First-Order Taylor Expansion. We provide a second interpretation of the score, and subsequently motivate new statistic that can be used for OOD detection. Recall that the numerical DDIM solver is the first-order Euler's method applied to Eq. 7. In general, we can expand the ODE higher-order terms using the truncated Taylor method [20, 18]:
dx X X Xt, + hn dryc (Ri, .n))
1 d2xt
+
(ain +...
21
dn?
(8)
1 h
dEp
Xt, hn (XCe, bn)
21
d% (x.,
where fn 1/a-11 - Yt.. The norm of the first-order score. ||Eal|g. therefore measures the rate-of- change the ODE integration path. Intuitively, the ODE integration path necessary to bring different distributions to the standard normal in finite time differs (c.f. the PF ODE path is also the optimal transport path, see Sec. 3.4), hence the rate-of-change differs as well.
3.3 Second-Order Taylor Expansion (DiffPath-1D)
Based the preceding discussion, it is natural consider if higher-order terms in the ODE Taylor expansion can also serve as an effective OOD statistic. We answer in the affirmative by considering des Intuitively, the second-order term measures the curvature of the ODE the second order term, dy: integration path. We expand the derivative as follows [18]:
deg dr
δeg(xi, 1) dx.
+ dEa(Xi,t)
0x.
dr
Ot dr
1
deo(Xe,)) 1) Eg(xi,t)
7t
dea 1)
dea(Xi, dl xx
(9)
+1 T
Ox:
1 78
8x:
Ot dry
We see that the derivative contains two Jacobian-Vecoe Vector Products (JVP) and simple time derivative term. In principle, all three terms can be computed using automatic differentiation. However, this makes inference twice as costly due the need for an additional backward pass after every forward pass of the network, and significantly more memory-intent intensive due to storage of the full computation graph. Fortunately, the time derivative term can be computed using simple finite difference:
deg(x;, 1) 60(x++ + At) -x)(x
(10)
Øt
where the pairs (x,, Ar) are obtained during standard DDIM integration. Thus, no additional costs associated with gradient computation incurred.
Surprisingly, we observe that for high-dimensional distributions such as images that we consider in this work, the time derivative in Eq. 10 alone provides accurate enough estimate for OOD
5

---

detection. Using the same ImageNet model as in Sec. 3.2, we observe improvement in AUROC scores in CIFARIO vs SVHN in Table when using the second-orde statistic. Qualitatively, the distributions of v Ex [10,cn(x, 2)112 are more spread out in Fig. 2 as compared to the first-order scores, although the distinction is subtle; the quantitative results provide more reliable confirmation of the benefit of using the second-order statistic.
We thus consider the second-order statistic alone, v E (x,, Oill2 as possible statistic for OOD detection. As it is one-dimensional quantity, we abbreviate it as DiftPath- ID. We evaluate DiffPath- ID in Sec. 5.2.
3.4
Connections to Optimal Transport
Recent works have viewed DDIM integration as an encoder that maps the data distribution to standard normal [21, 22]. They prove that this map is the optimal transport (OT) path if the data distribution is Gaussian, while providing numerical results suggesting likewise for high-dimensional data like images. As a result, we view the OOD statistics proposed in Sec. 3.2 and Sec. 3.3 as characterizing different derivatives of the OT path: the score ||col|2 represents the rate-of-change of the path, while the time derivative ||0,εell represents its curvature.
To justify our proposition that derivatives of OT paths serve as meaningful OOD statisties, we consider the following toy example [21] of distinguishing two multivariate Gaussians (detailed derivation in Appendix A.2). Let the distributions be pa (x) ~ Na,, I), E {0. 1). where a, E RR and E Rd The marginal densities along the forward diffusion can be computed exactly using the transition formulas for SDEs [23] and is given by (x) N(ae I). with PF ODE dx: -a This path corresponds exactly to the OT map between pá and A/ I). In this case, the corresponding first and second-orded OOD statistics are equal and given by || de l12 -
"1 Crucially, they are proportional to ||a: meaning that as the two distributions move farther apart (i.e., as ||ag واlد increases). so should the L norms of the OOD statistics, thereby increasing their ability to distinguish samples between the two.
3.5 Higher-dimensional Statistic (DiffPath-6D)
Owing to its simplicity, the mie-dimensional statistic proposed in Sec. 3.3 may suffer from edge cases perform suboptimally as information is condensed to a single scalar. For instance, given an image X. with pixels normalized to the range [-1, 1]. one such edge case is distinguishing Xo from itself with the sign of the pixels flipped, - Xg- The two samples will produce symmetric OT paths differing only by negative sign, resulting in identical statistics after taking the L norm. We can see this from Table 2 where DifiPath- ID fails distinguish CIFARIO samples from itself with signs flipped, which we call negative CIFARIO. As such, we propose a higher-dimensions statistic that does not utilize the standard form of the L norm: ||*||, = Σ, |x We define new scalar quantity, (x), = Exxx, Pr which retains the sign information, and propose a new six-dimensional statistic we dub DiftPath-6D::
Table 2: AUROC of DiffPath ID vy 6D.
C10 vs
Method
neg. C10
ID 6D
0.500
0.994
(eo(x,, t)),, (eo((( t))2, (eo(( t)ss, (,),)xxx E, (Ore((xx t))2, (): (x0 t)ts
which concatenates scalars based on the first, second and third powers of ca and d.co into a vector. From Table 2, DiftPath-6D is able to distinguish CIFARI0 from neg. CIFAR10 near perfectly. We validate both DiffPath- ID and DiftPath-6D on wider suite of experiments in Sec. 5.
4 Related Works
Modern OOD detection can be divided roughly into three categories: feature-based likelihood- basedd reconstruction-base Feature-based methods extract features from inlier samples and fit a likelihood or distance function an OOD detector. For instance, one can obtain the latent representations of a test sample using an autoencoder and measure its Mahalanobis distance to the representations of inlier samples [24]. Distances between features derived from self-supervised learning models are

---

also utilized in similar contexts [25, 26]. Similar to our work, Xiao et al. [10] showed that one can perform OOD detection using features from single discriminative model.
Likelihood-basee approaches leverage a generative model trained on inlier samples. These methods typically employ variants of the log-likelihood of test sample under the model as the OOD detection score. Nalisnick et al. [2] first pointed out that deep generative models might erroneously assign higher likelihoods outlier samples. Several explanations have been proposed, such the input complexity [16] and typicality [27] of samples. As a result, just as we show in Sec. 3.1, vanilla likelihoods are rarely used. Instead, variants derived from the log likelihood have been proposed. such as likelihood ratios [4], ensembles of the likelihood [5], density of states [6], mnergy-baset models [28] and typicality tests [27]. Diffusion Time Estimation [29] estimates the distribution over
the diffusion time of a noisy test sample and uses the mean or mode as the OOD score. MSMA [30] uses the score function over discrete noise levels for OOD detection. One can view MSMA as a specific case of DiffPath which only utilizes the first-order statistic, while we generalize to higher- order terms. MSMA proposes to measure the score at various noise levels, while our method sums over the entire diffusion path. It is worth emphasizing that MSMA requires different models for different inlier distributions, unlike our single model setup.
Reconstruction-basee approaches evaluate how well a generative model, trained on in-distribution data, can reconstruct a test sample. Earlier works utilize autoencoders [31] and GANs [32] for reconstruction. Recent works have adapted unconditional DMs to this approach due to its impressive sample quality. A test sample is first artificially corrupted before being reconstructed using the DM's sampling process. DDPM--OD [7] noises a sample using the forward process and evaluates the perceptual quality [33] of the reconstructed sample. Projection Regret [9] adopts a similar approach, but uses Consistency Model [34] and introduces an additional projection regret score. LMD [8] corrupts the image by masking and reconstructs the sample via inpainting. Evidently, DiffPath differs from these diffusion approaches as we do not utilize reconstructions. We also stress again that these
baselines require different models for different inlier tasks.
5 Experiments
Based on our earlier analysis, we hypothesize that DiffPath can be utilized for OOD detection across diverse tasks using single model. In this section, validate our hypothesis with comprehensive experiments across numerous pairwise OOD detection tasks and compare DiffPath's 's performance against state-of-the-ar baselines.
Datasets. All experiments are conducted as of pairwise OOD detection tasks using CIFAR1O (C10), SVHN, and CelebA as inlier datasets, and CIFAR100 (C100) and Textures as additional outlier datasets. Unconditional diffusion models employed at resolutions of 32 x 32 and 64 x 64. The model utilizing ImageNet as the base distribution is trained at 64 x 64 resolution, while all other models trained at 32 x 32.
Methodology and Baselines. Our methodology features two variants of our model, DiffPath-11 1D using KDE and DiffPath-6D using Gaussian Mixture Model for OOD scoring, as outlined in Sec. 3. We compare against variety of generative baselines, including Energy-based Model (EBM) such as IGEBM [28], VAEBM [35] and Improved CD [36], as well as Input Complexity (IC) [16], Density of States (DOS) [6]. Watanabe-Aken Akaike Information Criterion (WAIC) [5]. Typicality Test (TT) [27] and Likelihood Ratio (LR) [4] applied to the Glow [37] model. Additionally, we compare against diffusion baselines such vanilla NLL and IC based on the DM's likelihoods and re-implementations
of DDPM-OOD [7], LMD [8]. and MSMA [30] based on open-source source code for full comparisons.
5.1 Main Results
Table 3 summarizes our main results, Here, we report outcomes for DiffPath-6D using ImageNet and CelebA as base distributions. SrrPaath-DD-elelee achieves an average AUROC of 0.931, comparable to the leading diffusion- based approach MSMA and outperforming all other baselines, while utilizing only single model. Similar to MSMA, we attain this result using 10 NFEs, significantly surpassing other diffusion baselines that require an order of magnitude or more NFEs. When using ImageNet as the base distribution, the average AUROC of 0.850 is competitive with LMD, which requires several
7

---

Table 3: AUROC scores for various in-distribution vs distriibbbttionn tasks. Higher is better. DiffPPah-66- 6D--mmgeNemt and DiffPPat-6D OD-CelebA denote our method using diffusion models trained with ImageNet and CelebA as base distributions respectively. Bold and underline denotes the best and second best result respectively. We also show the number of function evaluations (NFE) for diffusion methods, where lower is better.
C10
SVHN
CelebA
Method
SVHN CelebA C100 Textures C10 CelebA C100 Textures C10 SVHN C100 Textures Averuge NFE
0.863
0.736
IGEBM
0.630
0.700
0.500
0,480
VAEBM
0,830
0.770
0.620
Improved CD
0.910
0.830 0.880
DoS
0,955
0.995
0.571
0,962
1,00
0.965
0.949
0.997
0.956
0.928
WAIC!
0.143
0.928
0.532
0.802
0.831
0.507
0.139
0.535
TT
0.870
0.848
0.548
0.970
1.00
0.965
0.634
0.982
0.671
0.832
LR!
0.064
0.914
0.520
0.819
0.912
0.779
0.323
0.028
0.357
0.524
Diffusion based
NLL
0.091
0.574
0.521
0.609
0.990
0.999
0.992
0.983
0.814
0.105
0.786
0.809
0.689
1000
IC
0.921
0.516
0.519
0.553
0.080
0.028
0.100
0.174
0.485
0.972
0,510
0.559
0.451
1000
MSMA
0.957
1.00
0.615
0,986
0.976
0.995
0.980
0.996
0.910
0.996
0.927
0.999
0.945
10
DDPM-OOD
0.390
0.659
0.536
0.598
0
0.986
0.945
0.910
0.795
0.636
0.778
0.773
0.746
350
LMD
0.992
0.557
0.604
0.667
0.919
0.890
0.881
0.914
0.989
1.00
0.979
0.972
0.865
10
Ours
DinPPth-6D- Sm-gge--D 0.856
0.502
0.580
0.943
0.964
0.954
0.969
0.807
0.981
0.843
0.964
10
DifiPath-D--ellbb 0.910
0.897
0.590
0.923
0.939
0.979
0.953
0.981
0.998
1.00
0.998
0.999
0.931
10
Table 4: Ablation results when we vary (x)x), the distribution the single DM is trained on. We use DiffPath-6D with 10 NFEs. Random denotes a randomly initialized model.
C10 vs
SVHN vs
CelebA vs
(x(x)
SVHN CelebA C100
Textures
C10
CekebA C100
Textures
C10
SVHN C100 Textures Average
C10
0.939
0.484
0.604
0.870
0.961
0.961
0.973
0.982
0.719
0.997 0.796
0.950
0.853
SVHN
0.742
0.482
0.579
0.872
0.991
0.994
0.992
0.989
0.706
0.974
0.769
0.961
0.838
CelebA
0.910
0.897
0,590
0.923
0.939
0.979
0.953
0.981
0.998
1.00
0.998
0.999
0.931
ImageNet
0.856
0.502
0.580
0.841
0.943
0.964
0.954
0.969
0.807
0.981
0.843
0.964
0.850
Random
0.338
0.426
0.538
0.31
0.665
0.592
0.693
0.471
0.577
0.411
0.612
0.381
0.501
magnitudes more NFEs due to multiple reconstructions. This is despite the ImageNet model never having seen any samples from the evaluated distributions during training.
The empirical results indicate that the -based model outperforms the ImageNet-based model primarily due to its superior performance tasks involving CelebA samples, whether they in-distribution or nut-of--dsttrbuun formance all tasks where CelebA is in tn-distrributon (rightmost columns), and in the CIFAR10 vs CelebA task. On tasks that do not involve CelebA samples, the two models exhibit roughly comparable performance. This suggests that distinguishing CelebA from other samples is particularly challenging. and that DiffPath benefits from exposure to inlier samples from the respective distribu- tions during training. Next, we discuss the effect of the base datasets and other design considerations via ablations.
For instance, DiffPath-6D-CelebA. achieves near-pent near-perfect per-
Results obtained from Morningstar et al. [6].
8

---

Table 5: Ablation on the number of DDIM steps (NFE). We use DiffPat-6D-Cellbn
C10 vs
SVHN Vs
CelebA Es
NFEs
SVHN CelebA C100
Textures
C10
CelebA
C100
Textures
C10
SVHN C100
Textures Average
5
0.916
0.928
0,584
0.900
0.955
0.940
0.960
0.973
0.999
1.00
0.998
0.997
0.929
10
0.910
0.897
0.590
0.923
0.939
0.979
0.953
0.981
0.998
1.00
0.998
0.999
0.931
25
0.898
0.866
0.578
0.933
0.882
0.997
0.906
0.979
0.996
1.00
0.995
0.996
0.919
50
0.896
0.831
0.575
0.931
0.853
0.996
0.879
0.974
0.991
1.00
0.991
0.997
0.910
Table 6: Ablation results comparing DiffPath-11 1D and DiffPath-6D using models trained with Ima- geNet and CelebA base distributions.
C10 vs
SVHN
CelebA
Method
SVHN CelebA C100
Textures
C10
ColehA C100
Textures
C10
SVHN C100
Textures Average
DifiPath- 1eth--DDDmmmn ID-ImgeNett
0.965
0.394
0.551
0.685
0.971
0.986
0.972
0.949
0.693
0,991
0.721
0.797
0.806
DifiPath-6D-mmage
0.856
0.502
0.580
0.841
0.943
0.964
0.954
0.969
0.807
0,981
0.843
0.964
0.850
DifiPath-1D-Cad
0.956
0.811
0.545
0.688
0.948
0.690
0.933
0.932
0.899
0.666
0.881
0.911
0.822
DifiPth-6D-Calae
0,910
0.897
0.59
0.923
0.939
0.979
0.953
0.981
0.998
1.00
0.998
0.999
0.931
5.2 Ablations
Choice of Diffusion Training Set. We investigate the impact of the base dataset on the performance of DiffPath66D. In Table 4, we compare four different base distributions alongside a randomly initialized model. As baseline check, we observe that the average AUROC of the randomly initialized model 0.501, which is consistent with random guessing. This indicates that training on a base distribution is essential for the model to learn features for effective OOD detection.
Our ablations include CIFARIO and SVHN as base distributions, in addition to CelebA and ImageNet shown in Table 3. Among these four base distributions, CelebA yields the best performance overall. Notably, the models trained on SVHN and CelebA demonstrate superior results when the inlier data aligns with their respective training distributions. This supports the established principle of training models on in-distribution samples, and we show that DiffPath-6D similarly benefits from such training. However, we underscore the key finding of our work: while in-distribution training enhances performance, it is not strictly necessary. DiftPath-6D exhibits strong performance even on tasks involving samples from distributions that the model has not encountered during training.
DiffPath ID vs 6D. Here we ablate on the choice DiftPath- 1D and DiffPath-6D. Table 6 shows that DifiPath-6D performs better than its ID counterpart for both choices of base distributions. We attribute this to the increased robustness of aggregating multiple statisties, c.f. Sec. 3.5, and recom- mend practitioners to use DifiPath-6D in general. However, DiffPath-ID ID outperforms DifiPath-6D in certain instances. For instance, for the ImageNet model, DiffPath- LD achieves the best performance on CIFAR10 ys SVHN and in three out of four tasks where SVHN is the inlier distribution.
Number of DDIM Steps. We investigate how the performance of our method varies with the number of NFEs (DDIM steps) in Table 5. Overall, the changes in average AUROC are relatively minor as the NFEs are varied, suggesting that DiffPath is robust to the number of integration steps. The best result is obtained at 10 NFEs. While the finite difference approximation of the derivative (Eq. 10) should become more accurate as the number of NFEs increases, the aggregation of multiple statistics involving scores and its derivatives makes this effect less pronounced. We leave the investigation of this phenomena in greater detail to future work.
5.3 Proper Image Resizing with Single Model
Using single DM with fixed input resolution necessitates resizing all images to match the model's resolution during evaluation. However, when datasets have differing original resolutions, naive resizing- Biizing-upsampling lower-resolution images and downsampling higher-resolution ones-can lead

---

Table 7: Difference in performance when the incorrect resizing technique used, which leads to overly optimistic results. Results on DiffPath-6D with ImageNet 64 x 64 as the base distribution. The results with asterisk (*) denote the scores that have been computed inaccurately.
C10
SVHN
CelcbA
Correct Resizing SVHN CelebA C100 Textures C10 CelebA C100
Textures
C10
SVHN C100 Textures Average
0.856
0.999
0.580
0.999
0.943
1.00
0.954
1.00
0.998
1.00
0.998
0.981
0.942
Yes
0.856
0.502
0.580
0.841 0.943
0.964
0.954
0.969
0.807
0.981
0.843
0.964
0.850
to evaluation inaccuracies. Specifically, upsampling introduces blurriness due to pixel interpolation, while downsampling does not. This discrepancy allows the model to differentiate samples based on image blur rather than semantic content, resulting in overly optimistic performance metries.
For instance, when evaluating DiffPath-6D trained at 64 pixels on the CelebA vs CIFARIO task, CIFARIC 10 images are upsampled (introducing blur) while CelebA images are downsampled. This imbalance enables trivial distinction between the samples. As illustrated the first row of Table 7, tasks where only one distribution undergoes upsampling yield artificially high AUROC scores.
To mitigate this issue, we propose equalizing the resizing process by first downsampling higher- resolution images to the lower resolution of the other distribution, then upsampling both to the model's required resolution. In the CelebA vs CIFARIO 10 example, CelebA images are downsampled to 32 32 pixels before both samples are upsampled to 64 x 64 pixels. This method ensures consistent blurring effects across all samples, reducing confounding factors. The second row of Table demonstrates more accurate evaluations using this approach. We adopt this resizing procedure in all relevant experiments to ensure fair comparisons. In short, we highlight the importance of consistent image resizing for fair evaluation in OOD detection, which we hope will guide future research.
5.4 Near-OOD Tasks
Ncar-OOD tasks refer to setups where the inlier and outlier samples are semantically similar, making them challenging for most methods. From Table 3, DifiPath, like most baselines, does not perform strongly on near-OOD tasks like CIFARIO vs CIFARIO0 This motivated us to conduct further near-OOD experiments, the results of which are presented in Table 8 of Sec. C of the appendix. Note that near- OOD tasks are not a standard evaluation on generative methods. We defer detailed analysis of the results to the appendix, and leave further investigations near-OOD tasks to future work.
6 Conclusion
In this work, we proposed Diffusion Paths (DiffPath), method of OOD detection using a single diffusion model by characterizing properties of the forward diffusion path. In light of the growing popularity of generative foundation models, our work demonstrates that single diffusion model can also be applied to OOD detection. There are several interesting future directions that arise from our work; for instance, applying DifiPath to other modalities such as video, audio, language, time series and tabular data, as well as investigating if higher-order terms of the Taylor expansion, or leveraging different instantiations of the PF ODE might lead to better performance.
Limitations and Future Work. We only calculate the simple time derivative and found that works well experimentally, although one might compute the full derivative to quantify the curvature completely. We leave this for future work. Also, we consider DMs trained on natural images like CelebA and ImageNet, which may not be appropriate for specialized applications such as medical images. For such purposes, one could consider including domain-specific data during training.
7 Acknowledgements
This research is supported by the National Research Foundation Singapore and DSO National Laboratories under the AI Singapore Programme (AISG Award No: AISG2-RP-2020-011 AHT acknowledges support from the Singaporean Ministry of Education Grant MOE-000537-01 and MOE-000618-0) We would like to thank Pranav Goyal for help with the experiments.
10

---

References
[1] Anh Nguyen. Jason Yosinski, and Jeff Clune. Deep neural networks easily fooled: High confidence predictions unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427-436, 2015.
[2] Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? In International Conference on Learning Representations, 2018.
[3] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of- detection: A survey. arXiv preprint 1eXiv2210.113366 2021.
[4] Jie Ren, Peter Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan, Likelihood ratios for out-of-distribution detection. Advances in neural information processing systems, 32, 2019.
[5] Hyunsun Choi, Eric Jang, and Alexander A Alemi. Waic, but why? generative ensembles for robust 2018.
anomaly detection. arXiv preprint
[6] Warren Morningstar, Cusuh Ham, Andrew Gallagher, Balaji Lakshminarayanan, Alex Alemi, and Joshua Dillon. Density of states estimation for out of distribution detection. In International Conference on Artificial Intelligence and Statistics, pages 3232-3240. PMIRR 2021.
[7] Mark S Graham, Walter HLL Pinaya, Petru-Daniel Tudosiu, Parashkev Nachev, Sebastien Ourselin, and Jorge Cardoso. Denoising diffusion models for out-of-distribution detection. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2947-2956, 2023.
[8] Zhenzhen Liu, Jin Peng Zhou, Yufan Wang. and Kilian Q Weinberger. Unsupervised out-of dfdittiibbuuti detection with diffusion inpainting. In International Conference on Machine Learning, pages 22528-22538. PMLR, 2023.
[9] Sungik Choi, Hankook Lee, Honglak Lee, and Moontac Lee. Projection regret: Reducing background bias for novelty detection via diffusion models. Advances Neural Information Processing Systems, 36, 2024.
[10] Zhisheng Xiao, Qing Yan, and Yali Amit. Do we really need learn representations from in-domain data for outlier detection? arXiv preprint arXiv:2105. 09270, 2021.
[11] Tom Brown, Benjamin Mann. Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems,
2020.
[12] Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bemsttein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, al. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258 2021.
[13] Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2020.
[14] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advancex in neural information processing systems, 32, 2019.
[15] Jonathan Ho. Ajay Jain, and Pieter Abbeel, Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840 6851, 2020.
[16] Joan Serrà, David Álvarez, Vicenş Gómez, Olga Slizovskaia, José F Núñcz, and Jordi Luque. Input complexity and out-of-distribution detection with likelihood-based generative models. In International Conference on Learning Representations, 2019.
[17] Aapo Hyvärinen and Peter Dayan. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6(4), 2005.
[18] Tim Dockhorn, Arash Vahdat, and Karsten Kreis. Genie: Higher-order denoising diffusion solvers. Advances in Neural Information Processing Systems, 35:30150-300 3016666 2022.
[19] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2020.

---

[20] Peter E. Kloeden and Eckhard Platen. Numerical Solution of Stochastic Differentiul Equations. Springer. Berlin, 1992.
[21] Valentin Khrulkov, Gleb Ryzhakov, Andrei Chertkov, and Ivan Oseledets. Understanding ddpm latent codes through optimal transport. The Eleventh International Conference on Learning Representations. 2022.
[22] Xuan Su, Jiaming Song, Chenlin Meng, and Stefano Ermon. Dual diffusion implicit bridges for image-to- image translation. In The Eleventh International Conference on Learning Representations, 2022.
[23] Simo Särkkä and Arno Solin, Applied stochastic differential equations, volume 10. Cambridge University Press, 2019.
[24] Taylor Denouden, Rick Salay, Krzysztof Czarnecki. Vahdat Abdelzad, Buu Phan, and Sachin Vernekar. Improving reconstruction autoencoder iitoo--distribution detection with mahalanobis distance. arXiv preprint 17x102881..00765, 2018.
[25] Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. Advances neural information processing systems, 33: 11839-11852 11852, 2020.
[26] Vikash Sehwag, Mung Chiang, and Prateek Mittal, Ssd: A unified framework for self-supervised outlier detection. arXiv preprint arXiv:2103. 12051, 2021.
[27] Eric Nalisnick. Akihiro Matsukawa, Yee Whye Teh, and Balaji Lakshminarayanan. Detecting out-of- distribution inputs to deep generative models using typicality. arXiv preprint /9t.::99900099999 2019.
[28] Yilun Du and Igor Mordatch. Implicit generation and modcling with energy based models. Advances in Neural Information Processing Systems, 32, 2019.
[29] Victor Livernoche, Vineet Jain, Yashar Hezaveh, and Siamak Ravanbakhsh. On diffusion modeling for anomaly detection. In The Twelfth International Conference on Learning Representations.
[30] Ahsan Mahmood, Junier Oliva, and Martin Andreas Styner. Multiscale score matching for out-of- distribution detection. In International Conference on Learning Representations, 2020.
[31] Chong Zhou and Randy C Paffenroth. Anomaly detection with robust deep autoencoders. In Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining, pages 665-674, 2017.
[32] Thomas Schlegl, Philipp Seeböck, Sebastian M Waldstein, Ursula Schmidt-Erfurth and Georg Langs. Unsupervised anomaly detection with generative adversarial networks guide marker discovery. In International conference on information processing medical imaging, pages 146-157. Springer, 2017.
[33] Richard Zhang, Phillip Isola, Alexei Efros, Eli Shechtman, and Oliver Wang. The unreasonable offectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018.
[34] Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. In International Conference on Machine Learning, pages 3221 1-32252. PMIR, 2023.
[35] Zhisheng Xiao, Karsten Kreis, Jan Kautz, and Arash Vahdat, Vaebm: A symbiosis between variational autoencoders and energy-based models. In International Conference Learning Reprexentations, 2020.
[36] Yilun Du, Shuang Li, Joshua Tenenbaum, and Igor Mordatch. Improved contrastive divergence training of energy-base based models. In International Conference on Machine Learning, pages 2837-2848. PMLR, 2021.
[37] Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible Ix1 convolutions, Advances in neural information processing systems, 31, 2018
[38] Yang Song, Conor Durkan, lain Murray, and Stefano Ermon. Maximum likelihood training of score-based diffusion models. Advances in neural information processing systems, 34:1415-1428, 2021.
[39] Gabriel Peyré and Marco Cuturi. Computational optimal transport. Foundations and Trends in Machine Learning, (1556))355-607 2019.
[40] Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International conference machine learning, pages 8162-81881 8171. PMLR, 2021.
12

---

[41] Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang. Guangyao Chen, Bo Li, Yiyou Sun, et al. Openood: Benchmarking generalized out-of-distribution detection. Advances in Neural Information Procexsing Systems, 35:32598-32611 2022.
[42] Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set recognition: A good closed-set classifier all you need. International Conference on Learning Representations.
[43] Julian Bitterwolf, Maximilian Müller, and Matthias Hein. out? fixing imagenet out-of-distriutiion detection evaluation. In International Conference on Machine Learning, pages 2471 2471-2500 -500. PMLR, 2023.
[44] Dan Hendrycks. Steven Basart, Mantas Mazeika, Andy Zou, Joseph Kwon, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-of-distriutiion detection for real- world settings. In International Conference on Machine Learning, pages 8759-8773. PMLR, 2022.
[45] Haoqi Wang. Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual-logit matching. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4921 19900, 2022.
[46] Yiyou Sun, Yifei Ming. Xiaojin Zhu, and Yixuan Li. Out-of-distribttion detection with deep nearest neighbors. In International Conference on Machine Learning, pages 20827-20840, PMLR, 2022.
[47] Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out out-of-distributio detection. In European Conference on Computer Vision, pages 691-708 Springer, 2022.
13

---

Supplementary Material for "Out-of-Distribution Detection with a Single Unconditional Diffusion Model"
A Proofs
A.1 Theorem
Theorem Denote Φ; and dt as the marginals from evolving two distinct distributions do and do via their respective probability flow ODEs (Eq. forward in time. We consider the case with the same forward process, i.e., the two PF ODEs have the same f(x,, (x,,t).g()) g(t) and ot. Under some regularity conditions stated in Appendix A.I.
g(t) 0t || cx 1) [ di + DKL. (KT((T)))))
(rollo))))))) J
E Ex-o
Proof. The proof is modification from Song al. [38]. Let us first state the PF ODEs of the two distributions explicitly:
dx;
dt f(x,, + g(1)
cΦl (x(x,,t), cx(xx,,) oe Vx log (x))
(11)
20,
dx: (xx;
g()2
20, EN (X,, Ex((x, -0, Vx log (x)
(12)
de
We make the following assumption about de and 1/2:
vt E [0. T). 3k s.t. (x(x) = O(e (eee-llxll)), (x(xx) = (c as ||x||2 + co.
(13)
We start by rewriting the KI. divergence between @o and who integral form: (oo( = DKL (0o (bollbbo) DKI, ( + DKL, (drll(T))
DDr..(..lvve di DKL. (|
(14)
Øt
As we can treat the ODE as special case an SDE with zero diffusion term, we can obtain the Fokker-Planck of the marginal density of the PF ODEs, also known as the continuity equation, as follows:
Vx (- (f ())((x)) (xx(x)))))(
g()2
20, (x ()) Vx (ha0)(x))
(15)
0
where define hs -f(x,,t)= g(t)² Ex( t) for simplicity. Similarly, Let us now rewrite the time-derivative DDI.((eellbb)
ad at
= Vx (x)))
( in Eq. 14 as follows: d8
ò 0t / (x(x) log
(x) (x)
dx
0t
/
0e:
log (x)
ddi dx
(x(x) @x((())
dx +
(x) Øl dx
(x)())
Øl
Vx (ho( (x) log (x dx /
(x(xx)
Vx (h (x, ()bxxxx))xx
(x)
(x()
ʃ ve (x)x)) (xx h (x, t)][[> log dx(xx V. log Uhx (x))dx
ʃ (o(x)) g(t)2 [x,((x,)) E (x,
where (i) is due to integration by parts and the fact that limg ( (x) = 0 and lim (x, tx)x(x) = 0 due to assumption 13. Combining with Eq. 14 gives the desired result:
DKL(Collukg = 1.//
/ Exwo. g())² (xx, (x,, 011 dt + DKI(OT(lET),
(16)
Tt
14

---

A.2 OT Toy Example
We derive here in detail the toy example discussed in Sec. 3.4, where we will prove the optimal transport map between multivariate Gaussian and standard normal is identical to the diffusion PF ODE path. We consider our source distribution px(x) N(a, I), Rd and gddd We choose our forward SDE to be parameterized as:
dx, -xdt + 2dwe,
(17)
which is the same Manstein-Uhlenbeeke process as the DDPM forward SDE Eq. 4 with a constant noise schedule ((t) = 2. This is also commonly referred to as the Langevin equation.
As Eq. 17 has affine drift coefficients and a starting distribution which is normal, we know that the marginal distributions intermediate times also normal, pe (x) (p((), E()). Furthermore, we can calculate the means and variances analytically using Eq. 5.50 and Eq. 5.51 of Särkkä and Solin [23]:
du((t) -m((), dt
dE(()) dt
-2 +2
(18)
with solutions
(L(1) - ((0e ae (
- 1) =1
(19)
Thus, the marginal density has the form (x) (Nae-= from which we compute the score as Vx lx) -x + ae We can substitute this into the corresponding PF ODE to obtain:
dx; dl
-x Vx (x)))
(20)
ac
The optimal transport map denoted Po (x) is obtained by solving Eq. 20 to get x, = Xo + a(e and taking the limit - co. This gives us Egg (x) (x(x) ~ N(a, I) and (O, (cf. Eq. 2.40 in Peyré and Cuturi [39]).
a, which precisely the OT map between
B Experimental Details
DiffPath. As mentioned in Sec. 5, we utilize single unconditional diffusion model trained CelebA and ImageNet at 32 x 32 and 64 x 64 resolution respectively. We train our own CelebA model and utilize the ImageNet checkpoint trained using Improved DDPM's Lhybrid objective (Eq. 16 of Nichol and Dhariwal [40]) from the official repository". Both models cosine noise schedule with total of 4000 diffusion steps. For DiffPath- ID. we fit KDE using a Gaussian kernel with a bandwith of 5. For DiftPath-6D. we fit a GMM with hyperparameters obtained by sweeping over predefined number of mixture components (c.g.. 50, 100) and covariance type (c.g., diagonal, full, tied). Both are implemented using the sklearn library.
On a single Nvidia A5000 GPU, DifiPath takes approximately 0.25s and 0.94s per integration step on 32 32 and 64 x 64 images respectively with batch size of 256.
Diffusion Baselines. For all diffusion baselines, we rely on the official GitHub repositories and open-source checkpoints where possible. The repositories are listed as follows: MSMA DDPM- OOD', LMD*. For NLL and IC, we use the pre-trained CIFAR10 checkpoint from Improved DDPM and train our own model SVHN using the same hyperparameters 32 x 32 resolution. We calculate the NL.L using the default implementation in Improved DDPM, while we compute IC using code from the LR repository due to lack of official code from the authors. We train all baselines using 1-3 A5000 GPUs.
15

---

Table 8: Average AUROC results for near-OOD tasks as proposed OpenOOD [41]. We use DiffPath-6D with ImageNet as the base distribution with 10 DDIM steps. Bold and underline denotes the best and second best result respectively. We also show the number of function evaluations (NFE) for diffusion methods, where lower is better.
Method
CIFARIO
Tinylmage
KLM
0.792
0.808
VIM
0.887
0.787
KNN
0.907
0.816
DICE
0.783
0.818
DiffPath-6D
0.607
0.845
C Near-OOD Results
To further investigate the performance DiffPath on near-OOD tasks, we ran experiments on two tasks proposed in OpenOOD [41]. The first task involves CIFAR10 as the in-distribution data with CIFAR100 100 and ImageNet (also known as ImageNer200) as out-of-distribution datasets. The second involves TinyImageNet in-distribution data and SSB [42] (hard split) and NINCO [43] as out-of-distribution data (see the official repository' for full details).
We compare our results against the four latest discriminative baselines reported in OpenOOD [41] under the "w/o Extra Data, w/o Training" category, which are KLM [44], VIM [45], KNN [46] and DICE [47]. We report the average AUROC of each task in Table 8. The results are mixed: DiffPath performs the best for the TinylmageNet task, but obtains the poorest result for the CIFARIO task.
As noted in the main text, to our knowledge near-OOD tasks are not a standard evaluation setup for generative methods. We hypothesize that such tasks are better suited discriminative methods as gradient-basee classification training enables the model to learn fine- tine-graied features specific to each in-distribution class, which believe is crucial in this context. In contrast, generative models focus on maximizing the likelihood of the overall data distribution and are not explicitly trained to identify subtle discriminative features. This could potentially lead weaker performance in tasks where the distributions exhibit a high degree of overlap. It should be noted that discriminative methods typically require class labels, while unconditional generative methods do not, thus constraining the use of the former to cases with labelled in-distribution data.
hattg://ggtthhb..ccmmaaaaaalaaaa
http:://gtttt..oo///////eraaaaaa -oggee
16

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Framework proposed in the introduction is thoroughly discussed in the methods section. Experimental results support the claim that we are competitive with baselines.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We include limitations section in the conclusion.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
17

---

Justification: Complete proofs for Theorem I and the optimal transport example are provided in the appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Full experimental details are provided main paper and appendix. Open- source code is provided.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
18

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
Open-source code is provided.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/ Sengliicgguiies/odeeSutmtm www.mmissssiioiiiiiooooooooooiii for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / cttppssccppbbccccc/peececppccclh httpppululuuusasaspp/ppppppaaaae /Ct////oooeeeeeeeeeeeeeeeee Codee//////iee//eeSuuiiiiiii
onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: Provided in the appendix and code.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to a level detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Error bars are not conventionally reported for AUROC performance. Further- more, our method is deterministic (ODE-based), repeated evaluations produce the same result (up to initialization of the EM algorithm when fitting the GMM, which is negligible in our experiments).
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
19

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Provided in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https https://nnnt :/tpp/::////////////// cc cc/public////cccccccccccccclclcl httpe//ccihiiiiennnneeee.n..eeee
Answer: [Yes]
Justification:
We believe the research conforms to the NeurIPS Code Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction..
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: While we utilize diffusion model, we are not leveraging its generation abilities, so societal impacts of generative models like biszddisnfoomaaiinddepfaaass etc are not relevant to our work.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
20

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
The diffuusin models utilized in this work are trained on standardized, publicly available image datasets (e.g., CelebA, ImageNet) that to our knowledge, do not contain risks of misuse or harmful generation.
Justification:
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Citations to relevant models and works are given.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
21

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi thcode. com/ comddatasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
Documentation is provided the appendix and open-source code.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: No human subjects are required in this work.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
No human subjects or crowdsourcing are required in this work.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
22

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
23


Reviews:
[{"review_id": "07fYJVV1Kh", "reviewer": "Reviewer_5CB8", "summary": "The paper proposes DiffPath, an OOD Detection method with foundation diffusion models (i.e., diffusion models over diverse data) that can be applied to any in-distribution dataset. By measuring properties of the diffusion trajectory mapping images to noise, the paper demonstrates some improvements on OOD detection. Notably, the method is faster than most other diffusion-based techniques for OOD detection.", "questions": "See weaknesses. \n1. What hyperparameters do you use for KDE/GMM algorithms? How to select these hyperparameters? \n2. Intuitively, why do the trajectory statistics such as norm and rate-of-change vary from class to class?\n3. Using an SVHN/CIFAR10/CELEB-A model to directly perform OOD detection was not as successful as using a diffusion model trained on imagenet. However, considering a SVHN diffusion model, if we select one of the SVHN classes as in-distribution, can we achieve effective OOD detection?", "limitations": "Yes.", "rating": 3, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The goal of being able to achieve OOD detection with a foundation diffusion model is important as this can enable modular separation of OOD detection and other downstream tasks. \n- The paper is well written, with theoretical connections wherever possible, enabling intuitive understanding and making it easy to follow. \n- The experiment in sec 3.5 is interesting and higher-order norms have also been used in the past: for example, check out the Gram Matrix paper [1]. \n\n[1] Sastry and Oore. Detecting Out-of-Distribution Examples with Gram Matrices. ICML 2020.", "weaknesses": "- Achieves lower performance for near-ood detection tasks. \n- The evaluations do not sufficiently demonstrate benefits of a single unconditional diffusion model.  Since two sets of examples are said to be OOD if there is no class-overlap between them and the diffusion model is trained on 1k Imagenet classes, I believe that some of the experiments should be focused on demonstrating ease of constructing OOD detectors for arbitrary sets of imagenet classes as in-distribution or perhaps the entire imagenet-data as in-distribution. \n- As a follow-up to the above, it seems like this technique can also be used for learning one-class classification networks. In fact, I feel that the paper should discuss the performance on this task first before considering the natural extension to OOD detection where several classes are in-distribution. It also helps understand the generality of the statistics used to identify OOD examples. \n- The use of Theorem 1 (fisher-divergence) to motivate L2-norm of score-function as an indicator for OOD detection is not entirely clear. For example, the fisher-divergence uses difference between score-function outputs estimated over a batch of examples. \n- The ablation study with resizing is useful. However, it seems like the diffusion model is trained on 64x64 images and hence, the CIFAR10, CIFAR100 and SVHN images are scaled-up to 64x64 while celeba and textures are scaled down to 64x64. For a fair comparison with methods which directly work at 32x32 resolution,  celeba and textures should be first downsampled to 32x32 and then upsampled to 64x64. Otherwise, ood detection between pixelated CIFAR10 images and comparatively high-res celeba/textures images would not be so meaningful.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for acknowledging the strong motivation, insightful writing, and interesting experiments in our paper. Below we provide our responses to the questions raised by the reviewer.\n\n>lower performance for near-ood detection tasks\n\nTo better study DiffPath's performance on near-OOD tasks, we ran additional experiments based on the benchmark proposed in OpenOOD [1] for C10 and ImageNet200 as in-distribution. We report the average AUROC along with the most recent baselines from [1]. \n\n|Methods|C10|ImageNet200|\n|:-------------:|:-----:|:-----------:|\n|KLM|0.79|0.808|\n|VIM|0.887|0.787|\n|KNN|0.907|0.816|\n|DICE|0.783|0.818|\n|DiffPath|0.797|0.906|\n\nWe see that DiffPath achieves similar performance in C10 to recent methods and achieves the strongest result in ImageNet200. We will include these results in the paper. To further improve near-OOD performance, we believe that incorporation of perceptual features [2] can help; currently, DiffPath works from a KL divergence perspective, which may be less sensitive to small pixel differences. We leave this to future work.\n\n>evaluations do not sufficiently demonstrate benefits of a single unconditional diffusion model\n\nOur evaluations show that DiffPath, with a single model, is comparable to baselines trained on in-distribution data. The benefit is therefore the reduction in resources needed to train different models for different tasks. Our work connects OOD detection with recent foundation generative models, where one model excels at multiple tasks. Further, our ablations show that the choice of base distribution matters, and one requires a diverse dataset for DiffPath to work well. \n\n> some of the experiments should be focused on demonstrating ease of constructing OOD detectors for arbitrary sets of imagenet classes as in-distribution... this technique can also be used for learning one-class classification networks.\n\nThank you for the suggestion. We conducted experiments using single ImageNet64 classes as ID against various OOD classes and report the AUROC for DiffPath-6D.  Due to limited time, we evaluate on a select but diverse set of randomly selected classes. Note that none of the diffusion baselines consider such a task. The results show DiffPath-6D performs well without hyperparameter tuning for this task. This shows DiffPath's potential for one-class classification. We will include these results in the paper.\n\n|ID (below) / OOD (right)|Daisy|Dugong|Altar|Orange|Perfume|\n|:-------------------------:|:-----:|:------:|:-----:|:------:|:-------:|\n|Airship|0.823|0.83|0.818|0.818|0.863|\n|Cheeseburger|0.768|0.86|0.727|0.786|0.958|\n|Pizza|0.824|0.9|0.692|0.842|0.959|\n\n>the fisher-divergence uses difference between score-function outputs estimated over a batch of examples\n\nThank you for highlighting this distinction, which we will highlight in the revision for clarity. First, we clarify that Theorem 1 serves as motivation and not a guarantee/proof for OOD detection, as stated in line 121 of the paper: “This *motivates* the use of the norm of the score as an OOD statistic…”. The intuition is that if L2 norms of the scores of individual samples are different, so should their expectations (the reverse may not be true). Our experiments and Fig. 2 suggests that this reasoning holds. \n\n>For a fair comparison with methods which directly work at 32x32 resolution, celeba and textures should be first downsampled to 32x32 and then upsampled to 64x64\n\nWe thank the reviewer for this suggestion. We agree that standardizing the resolution will allow for fairer comparison. Double resizing introduces twice the interpolation error, hence we retrained baselines at 64x64 resolution so every dataset is resized only once to 64x64. Due to time constraints, we report results for CelebA as ID:\n\n||CIFAR10|SVHN| CIFAR100|Textures|\n|:-----------:|:-------:|:------:|:--------:|:--------:|\n|MSMA|1|1|1|0.979|\n|DDPM-OOD|0.674| 0.463|0.644|0.841|\n|LMD|0.999|1|0.998|0.98|\n|DiffPath|0.999|1|0.998|0.943|\n\nMSMA, LMD and DiffPath have comparable performance, while DDPM-OOD suffers a performance drop. We will include these updated results and revise our claims to DiffPath ‘matches’ the performance of baselines at 64x64 resolution. Again, we emphasize that DiffPath matches the performance using a single model, while baselines require individually trained models. \n\n>What hyperparameters do you use for KDE/GMM algorithms? How to select these hyperparameters?\n\nWe mention the hyperparameter values in appendix B. Selection is done empirically via simple search over a defined set.\n\n>why do the trajectory statistics such as norm and rate-of-change vary from class to class?\n\nAs motivated by Theorem 1 and the OT example, our hypothesis is that the path connecting different distributions to standard Gaussian differs. In this work, we observe that the differences manifest in the rate-of-change and curvature of the paths. There could certainly be other measurable properties of the paths that could be explored, which we believe is an exciting future direction.\n\n> considering a SVHN diffusion model, if we select one of the SVHN classes as in-distribution, can we achieve effective OOD detection?\n\nAs we are not proposing to use a diffusion model with SVHN as the base distribution, we are unsure of the reviewer’s suggestion. In terms of single-class OOD detection, we have provided results on ImageNet above as suggested.\n\nWe hope that we have addressed the reviewer’s concerns. If so, we kindly request to consider raising your score. If you have further concerns, please do not hesitate to let us know.\n\n[1] Yang, Jingkang, et al. \"Openood: Benchmarking generalized out-of-distribution detection.\" Advances in Neural Information Processing Systems 35 (2022): 32598-32611.\n\n[2] Choi, Sungik, et al. \"Projection regret: Reducing background bias for novelty detection via diffusion models.\" Advances in Neural Information Processing Systems 36 (2023): 19230-19245.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oqmJeL8asm", "reviewer": "Reviewer_3gUh", "summary": "This paper presents a diffusion model trained on a single dataset that can also perform well in OOD detection across diverse tasks. The core concept is Diffusion Paths (DiffPath), which characterizes the properties of the forward diffusion path. Specifically, they measure the rate-of-change and curvature of the diffusion paths, using these as the derivatives of the score and contextualize regarding the optimal transport concept. The method is tested on various benchmarks and generally shows improvement over compared baselines.", "questions": "N/A", "limitations": "see weakness", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The proposed idea of defining and discriminating between ID and OOD datasets using the forward diffusion path is novel.\n- The method is comprehensible, and the illustrations are clear.\n- This framework shows good experimental results compared to several baselines.", "weaknesses": "- In Figure 3, how extensively does the diffusion model need to be trained on a large, diverse dataset?\n     - The method is limited by the coverage of the ImageNet-trained diffusion model.\n     - Ultimately, to achieve broad coverage, a large-scale pretrained diffusion model is required (e.g. more varisous OOD dataset, medical, manufacturing). Is the contribution of guaranteed generalizability compared to foundational generative models still valid?\n     - Add a single trained case that can cover datasets from different domains, not just ImageNet.\n- In Table 4, performance drops significantly compared to the baseline in hard-settings like CIFAR10 vs. CIFAR100.\n     - The proposed method struggles particularly in distinguishing between ID/OOD datasets with similar semantics.\n     - Include experiments and improvement strategies for hard-settings in OpenOOD [1].\n- Table 4, add and compare with the latest research baseline, Projection Regret [2].\n\n[1] Zhang, Jingyang, et al. \"Openood v1. 5: Enhanced benchmark for out-of-distribution detection.\" arXiv preprint arXiv:2306.09301 (2023).\n\n[2] Choi, Sungik, et al. \"Projection regret: Reducing background bias for novelty detection via diffusion models.\" Advances in Neural Information Processing Systems 36 (2023): 19230-19245.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for acknowledging the novelty, clarity and strong experimental results of our work. Below we provide our response to the questions raised by the reviewer.\n\n> In Figure 3, how extensively does the diffusion model need to be trained on a large, diverse dataset?\n\nTo clarify, we use the pretrained checkpoint from Improved-DDPM [1] trained on unconditional ImageNet 64x64, which according to the authors [2] is trained for 1.5M steps. We do not retrain/finetune the diffusion model, as the key idea is to leverage existing large pre-trained models. In terms of training duration, we did not perform ablations due to the large compute resources required for ImageNet-scale training. That said, our ablations in Table 4 suggest that a large and diverse base dataset is needed for good OOD performance.\n\n> “The method is limited by the coverage of the ImageNet-trained diffusion model.” ... “to achieve broad coverage, a large-scale pretrained diffusion model is required (e.g. more varisous OOD dataset, medical, manufacturing). Is the contribution of guaranteed generalizability compared to foundational generative models still valid?”\n\nWe agree with the reviewer that the performance is dependent on the coverage of the base distribution, in this case ImageNet. We have acknowledged this in the limitations section of the paper, where we hypothesize that the ImageNet model would likely be unsuitable for specialized applications like medical and manufacturing (c.f. Line 320-321:  “we consider a DM trained on ImageNet, which may not be general enough for specialized applications such as medical images.”). \n\nThus, we do not claim to have a model for OOD detection across *all* domains. Our main contribution is to show that a single unconditional diffusion model can be used for OOD detection across a variety of image tasks which we test in the paper. For specialized applications, one should use a base distribution that provides coverage over such cases, or consider even larger foundation models like Stable Diffusion, which we leave for future studies. \n\n> “Add a single trained case that can cover datasets from different domains, not just ImageNet”\n\nWe are unsure what the reviewer means by “a single trained case”. We believe the reviewer is suggesting that we should use a single model other than ImageNet that covers multiple datasets/domains. If so, we unfortunately do not have the computational resources to train such a model from scratch and are unaware of any other existing trained unconditional diffusion model. We would be happy to conduct further experiments if the reviewer can point us to an existing model. We have conducted ablations in Table 4 where the base distributions are CIFAR10, SVHN and CelebA. We find that the performance of these models are inferior to the ImageNet model.\n\n> “In Table 4, performance drops significantly compared to the baseline in hard-settings like CIFAR10 vs. CIFAR100.” and “The proposed method struggles particularly in distinguishing between ID/OOD datasets with similar semantics.” and “Include experiments and improvement strategies for hard-settings in OpenOOD”\n\nWe thank the reviewer for pointing OpenOOD out to us. To better study DiffPath's performance on near-OOD tasks, we ran additional experiments based on the benchmark proposed in OpenOOD [1] for C10 and ImageNet200 as in-distribution. We report the average AUROC along with most recent baselines from [1]. \n\n|Methods|C10|ImageNet200|\n|:-------------:|:-----:|:-----------:|\n|KLM|0.79|0.808|\n|VIM|0.887|0.787|\n|KNN|0.907|0.816|\n|DICE|0.783|0.818|\n|DiffPath|0.797|0.906|\n\nWe see that DiffPath achieves similar performance in C10 to recent methods and achieves the strongest result in ImageNet200. We will include these results in the paper. To further improve near-OOD performance, we believe that incorporation of perceptual features [2] can help; currently, DiffPath works from a KL divergence perspective, which may be less sensitive to small pixel differences. We leave this to future work.\n\n> “Table 4, add and compare with the latest research baseline, Projection Regret”.\n\nWe cited PR in related works but did not compare quantitatively as we were not able to find open-source code. For diffusion baselines, we endeavor to test all fairly under the same settings and ID-OOD setups, so we train and evaluate the baselines with the provided code. Given that it is non-trivial to reproduce PR’s implementation without reference code, we opt to discuss PR qualitatively. If the reviewer is aware of code for PR, please let us know and we can run the required experiments.\n\nWe hope we have addressed your concerns. If so, we hope that you would consider raising your score. If you have further concerns, please let us know.\n\n[1] https://github.com/openai/improved-diffusion\n\n[2] Nichol, Alexander Quinn, and Prafulla Dhariwal. \"Improved denoising diffusion probabilistic models.\" International conference on machine learning. PMLR, 2021.\n\n[3] Yang, Jingkang, et al. \"Openood: Benchmarking generalized out-of-distribution detection.\" Advances in Neural Information Processing Systems 35 (2022): 32598-32611.\n\n[4] Choi, Sungik, et al. \"Projection regret: Reducing background bias for novelty detection via diffusion models.\" Advances in Neural Information Processing Systems 36 (2023): 19230-19245.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AUc44L4i2H", "reviewer": "Reviewer_eKbL", "summary": "This paper looks at statistics calculated from the path through the diffusion model based on $\\int_0^T \\| \\epsilon_{\\phi}(x_t, t) - \\epsilon_{\\psi}(x_t, t)\\|dt$ and use it to discriminate between two distributions $\\psi$ and $\\phi$. A KDE of the distance of ID scores is used to compute the likelihood of the score of a new test image, and then perform OOD detection.", "questions": "1. Why use the KDE and not directly the score $\\sqrt{\\sum_t  \\| \\epsilon_{\\theta} (x_t, t) \\|^2_2}$ \n2. 3.5 why use the first-order term, which disconnects the statistics from OT theory? Why powers are chosen up to three? \n3. The method requires 50 FE, but what is the cost of one individual FE? OOD detection applications are often real-time, online or embedded so it is important to detail this point.", "limitations": "The authors have adequately addressed the limitations.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The paper is well written and easy to follow. \n* the idea of computing ID statistics using a network pretrained on a large dataset has proven successful with other techniques (SSL, or classifier trained on Imagenet) so it makes perfect sense to explore this idea with diffusion models.\n* The method seems to work better than competitors.\n* Interesting link with OT.", "weaknesses": "1. The training distribution matters (as stated by the authors themselves), so saying that the DM is an universal OOD detector is a bit of an overclaim.\n2. In 3.1, It is stated that \"likelihood does not work\", but the content does not demonstrate such a strong statement. It only shows that *likelihood obtained directly from a diffusion model does not work as is for OOD detection*. It seems from prior work that likelihood coming from the training of generative models is not suitable for OOD detection -- which is a weaker claim than \"likelihood does not work\" -- but even this weaker statement is not demonstrated properly since showing it for diffusion models is not sufficient evidence. In addition, the authors end up using a likelihood (that of the KDE) to build their score which makes this wording confusing. This part is nothing more than a motivating experiment (which is, by the way, interesting and fits well in the flow of the paper), so I would not provide such an overinterpretation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for acknowledging the motivation and importance of extending OOD detection to large pretrained generative models, as well as the quality of our writing. Below we provide our response to the reviewer’s questions and concerns.\n\n> “The training distribution matters (as stated by the authors themselves), so saying that the DM is an universal OOD detector is a bit of an overclaim.”\n\nTo clarify, we do not claim our method to be a “universal OOD detector”. Instead, we claim that *with a single model*, our method can perform OOD detection “across diverse tasks” (c.f. Line 6), “that a single model outperforms baselines that necessitates separate models for each distribution” (c.f. Lines 47-49) and that “a generalist model … can also be applied to out-of-distribution detection” (c.f. Lines 310-311).\n\nWe were careful to ensure that our claims apply only to the tasks that we have tested in the paper. Certainly, we did not expect DiffPath to be capable of “universal” OOD detection across all domains. We acknowledge this explicitly in the limitations section, where we mention c.f. Line 320-321:  “we consider a DM trained on ImageNet, which may not be general enough for specialized applications such as medical images.” \n\n> \"It only shows that likelihood obtained directly from a diffusion model does not work as is for OOD detection. It seems from prior work that likelihood coming from the training of generative models is not suitable for OOD detection -- which is a weaker claim than \"likelihood does not work\" -- but even this weaker statement is not demonstrated properly since showing it for diffusion models is not sufficient evidence. In addition, the authors end up using a likelihood (that of the KDE) to build their score which makes this wording confusing. This part is nothing more than a motivating experiment (which is, by the way, interesting and fits well in the flow of the paper), so I would not provide such an overinterpretation.”\n\nWe thank the reviewer for pointing this out, and for acknowledging the motivating purpose of Sec 3.1. We agree that a more accurate header for Sec 3.1 is that “Diffusion Model Likelihoods Do Not Work for OOD Detection”. We will make this change in the final revision.\n\n> “Why use the KDE and not directly the score”\n\nTo calculate the AUROC for OOD detection, one needs to fix a threshold and assign values lower than the threshold as OOD and higher as ID, then integrate over all thresholds. We use a density estimator like KDE because in DiffPath, Theorem 1 does not suggest that OOD samples will have lower score norms than ID samples, only that they are *different*. This is evident in Fig 2,  where all we can say is that the histograms are separated relative to each other. Hence, we fit a likelihood estimator like a KDE or GMM to the ID training samples. This way, OOD samples will have low likelihoods under the estimator, and we use those likelihoods in the AUROC computation. This is a subtle point that we believe is worth discussing in the paper for clarity. We will include this discussion in the final revision.\n\n> “why use the first-order term, which disconnects the statistics from OT theory? Why powers are chosen up to three?”\n\nWe are unsure what the reviewer means by “disconnects the statistics from OT theory”. DiffPath 1D considers first-order terms of the Taylor expansion (Eq. 8) while DiffPath 6D uses both first and second-order terms. Both first and second-order terms of the diffusion path are discussed in the OT example in Sec 3.4 (c.f. Lines 187-191: \"the corresponding first and second-order OOD statistics are equal and given by $||\\frac{dx_i}{dt}||_2 =||\\frac{d^2x_i}{dt^2}||_2 = ||a_i e^{-t}||_2...$\")\n\nIn DiffPath 6D, we combine different powers of the first and second-order terms to form a higher-dimensional statistic. This stems from a purely practical standpoint, as we found that this led to more robust OOD performance. One could in principle investigate other combinations or even higher powers, which we leave to future studies.\n\n> “The method requires 50 FE, but what is the cost of one individual FE? OOD detection applications are often real-time, online or embedded so it is important to detail this point”\n\nRunning on a Nvidia A5000 GPU, a single 64x64 sample on our model requires 0.02s (20ms) per FE of the UNet, which we will include in the paper. This is of course hardware dependent. Regardless, due to the nature of diffusion models, we do not expect DiffPath in its current iteration to be suitable for real-time/online OOD detection. This work represents a first step in showing that a single diffusion model can be used for OOD detection (which we believe to be a notable result) and we leave inference speed improvements to future work.\n\nWe hope we have resolved your concerns. If so, we kindly ask you to consider raising your score. Should you have any additional issues, please feel free to reach out to us.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UdNeiEK6Ct", "reviewer": "Reviewer_k7Q2", "summary": "This paper proposes an unsupervised anomaly detection method based on diffusion models. The core idea is to leverage the properties of the score function of a pre-trained diffusion model to distinguish samples from different distributions, rather than relying on log-likelihoods or reconstruction error. To this end, the authors first demonstrate that log-likelihoods are not a good metric for differentiating samples from different datasets.  The authors then motivate using the score function, specifically the L2 norm of the score function summed across different time steps as a statistic for differentiating OOD samples. This statistic can be interpreted as the rate of change of diffusion trajectories from the original distribution to the standard Normal distribution. Extending this observation, the authors also incorporate the curvature of the trajectory by considering the derivative of the score function. One key contribution is showing that a single diffusion model trained on a large, diverse dataset, such as ImageNet, can be used for OOD detection across multiple datasets. Experiments are performed on CIFAR-10, CIFAR-100, CelebA, and SVHN datasets, demonstrating higher average AUCROC scores compared to existing methods. Ablation experiments show the effect of various design choices.", "questions": "- The results in Table 4 are a bit surprising. Why is a model trained on ImageNet better than a model trained on the ID dataset? For example, when treating C10 as the ID dataset, shouldn’t a diffusion model trained on C10 perform better?\n- In this paper, the authors motivate the use of ImageNet due to it being a large and diverse dataset. Do the authors have some thoughts on how to pick such a ‘base’ dataset when applying this method to other domains? Is the idea that this dataset should provide coverage over the ID and OOD datasets?\n- The authors provide an explanation for why a higher number of DDIM steps slightly hurt performance, but shouldn’t a smaller time difference make the finite approximation method more accurate?", "limitations": "The authors discuss the limitations of their approach in sufficient detail. Some of my points in the weaknesses section echo this discussion.", "rating": 7, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- One central problem in anomaly detection is that the model is specific to each dataset. This paper proposes a partial solution to this problem, which is of significance to the community.\n- The proposed idea of using properties of the diffusion trajectory such as the rate of change and curvature is a novel idea, to the best of my knowledge.\n- The paper presents the approach clearly and with sufficient motivation. The writing and organization of the paper are praiseworthy, with the authors first presenting the problem, discussing failure modes of likelihood-based methods, analyzing the diffusion trajectories, and then finally introducing their approach.\n- The experimental results are strong, with good performance across datasets. Various ablation studies help understand design choices for the proposed approach.", "weaknesses": "There are certain concerns regarding the applicability of the approach to a broader range of problems, and some clarifying questions for the authors.\n\n- The method relies on the availability of a reasonably large and diverse dataset for the domain of interest. For images, ImageNet is an obvious choice, but this raises the question of the applicability of this method to tabular domains, which are especially relevant for scientific and industrial applications.\n- The connection to OT in Section 3.4 is valid only if the data distribution is Gaussian, as per my understanding. However, the data distribution, including the image datasets analyzed in this paper, is typically highly multi-modal. This invalidates the connection, and an explanation from the authors would be beneficial.\n- It is not clear how the 6D statistic introduced in Section 3.5 is used to distinguish samples since it is not a scalar value that can directly be compared.\n- Since a single diffusion model trained on ImageNet is used for the experiment, it is not clear what distinguishes an ID and OOD dataset. What makes a dataset ID in this scenario and what is the difference when evaluating C10 vs SVHN and SVHN vs C10 in Table 3?\n- There is at least one other diffusion-based anomaly detection method that leverages properties of the diffusion schedule rather than relying on reconstruction error [1]. A brief discussion on the differences between this approach and the one discussed in the paper would be beneficial.\n\n[1] Livernoche, V., Jain, V., Hezaveh, Y. and Ravanbakhsh, S., On Diffusion Modeling for Anomaly Detection. In *The Twelfth International Conference on Learning Representations*.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for acknowledging the significance of the problem, novelty of our approach, quality of our writing and strong experimental results. Below we provide our response to the reviewer’s concerns and questions.\n\n> method relies on the availability of a reasonably large and diverse dataset...this raises the question of the applicability of this method to tabular domains, which are especially relevant for scientific and industrial applications.\n\nThank you for raising this point. Our experiments focus on the image domain as diffusion models for images are more mature compared to domains such as tabular data. OOD benchmarks for generative models also mainly focus on images. We believe the general approach proposed in DiffPath would still apply, but experiments would need to bear this out. We will mention tabular data as another domain of future exploration in the conclusion, lines 312-314: \"There are several interesting future directions…such as video, audio, language time series and *tabular*…\". \n\n> connection to OT in Section 3.4 is valid only if the data distribution is Gaussian. However, the data distribution, including the image datasets analyzed in this paper, is typically highly multi-modal. \n\nWe agree that one can only mathematically prove the path is OT if the data is Gaussian, and we acknowledge this in Sec 3.4 (c.f. Line 177-178: “this map is the optimal transport (OT) path if the data distribution is Gaussian”). However, prior work has shown experimentally that for higher-dimensional mixtures and images, the paths match the OT cost up to numerical precision [1]. Hence, we discuss OT as a motivation for DiffPath. We will revise Sec 3.4 to emphasize this further.\n\n> not clear how the 6D statistic introduced in Section 3.5 is used to distinguish samples since it is not a scalar value that can directly be compared.\n\nThank you for raising this point, which we believe we should make clearer in the paper. For OOD detection, the AUROC computation requires scalar values and as such, we do not use the 6D scores directly. Rather, we fit a GMM to the 6D statistic of the ID training set. During evaluation, to obtain an OOD score for a test sample, we compute the likelihood under the GMM. A lower likelihood implies the sample is “farther” from the ID training set, hence more likely to be OOD. The procedure is shown in line 6 of Algorithm 1. \n\n> it is not clear what distinguishes an ID and OOD dataset. What makes a dataset ID in this scenario and what is the difference when evaluating C10 vs SVHN and SVHN vs C10 in Table 3\n\nAs discussed above, the ID dataset is the one whose training set’s statistics (1D or 6D) was fit to a density model (KDE or GMM). At test time, we calculate the likelihood of a sample under the density model to classify whether the sample is ID or OOD. For example, consider the task of C10 vs SVHN. If C10 is ID, we compute the statistics of C10’s training set using the ImageNet diffusion model and fit a density estimator to it, then evaluate using samples from C10 and SVHN’s test sets.\n\n> one other diffusion-based anomaly detection method that leverages properties of the diffusion schedule rather than relying on reconstruction error. A brief discussion on the differences between this approach and the one discussed in the paper would be beneficial.\n\nWe thank the reviewer for pointing out [2], which we will discuss in the paper. [2] performs OOD detection by using the distribution of the diffusion time of a noisy test sample. Anomalous samples are farther from the data manifold and have higher diffusion time. The key difference with our approach is that DiffPath computes statistics of the diffusion path rather than diffusion time, and we use a single model while [2] requires either KNN search for each sample, or a parametric model per dataset. \n\n> Why is a model trained on ImageNet better than a model trained on the ID dataset? For example, when treating C10 as the ID dataset, shouldn’t a diffusion model trained on C10 perform better?\n\nWe hypothesize that the C10 model is unable to compute the scores accurately for SVHN as the C10 model is unable to generalize to SVHN features. Meanwhile, as ImageNet is diverse, the model has broadly captured the features contained in C10 and SVHN. We note that SVHN, being digits, is not well represented in ImageNet. Yet, it appears the diversity of ImageNet allows the model to generalize beyond the training distribution, hence highlighting the importance of a large and diverse base dataset.\n\n> thoughts on how to pick such a ‘base’ dataset when applying this method to other domains? Is the idea that this dataset should provide coverage over the ID and OOD datasets?\n\nIndeed, our central hypothesis is that the base dataset should be diverse enough such that it broadly covers both ID and OOD. In this work, we chose ImageNet as this was the most readily-available large image diffusion model. Extension to even larger models like Stable Diffusion would serve as interesting future work.\n\n> shouldn’t a smaller time difference make the finite approximation method more accurate?\n\nApart from what was mentioned in the paper, we hypothesize another reason is we do not compute the full Eq. 9, but only the simple time derivative. As a result, at higher DDIM steps, we may not technically be approaching the true $d \\epsilon / d\\gamma_t$. However, at the lower steps (50/100) that we use in this work, this approximation does not seem to hinder the performance for OOD detection. We leave the investigation of full JVP computation of the derivative to future work.\n\nThank you again for your positive review. We hope that we have addressed your concerns. If you have further concerns, please let us know.\n\n[1] Khrulkov, Valentin, et al. \"Understanding ddpm latent codes through optimal transport.\" arXiv preprint arXiv:2202.07477 (2022).\n\n[2] Livernoche, Victor, et al. \"On diffusion modeling for anomaly detection.\" arXiv preprint arXiv:2305.18593 (2023).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Thank you to the reviewers for their thoughtful comments and feedback. We are glad that the reviewers found our idea of diffusion paths for OOD detection to be novel, well-motivated and that the paper is well-written. 

We find most of the reviewer’s questions revolve around method/experiment clarifications. In general, we would like to reiterate that our main contribution is in proposing statistics of the diffusion path, specifically the rate-of-change and curvature, for OOD detection. We show that these statistics are a natural result of the score-matching formulation of diffusion models, where they are derived from a Taylor expansion of the diffusion process. We further show that the statistics can be obtained from a *single* pre-trained unconditional diffusion model trained on a diverse dataset — this approach contrasts against prior work which focus on training a specific model on the in-distribution data. Our experiments serve to validate this idea and show that DiffPath is competitive with strong *individually-trained* baselines.

Based on the comments, we have made the following revisions:

1. Ran additional near-OOD experiments according to the setup in OpenOOD [1], which show significantly improved performance for DiffPath.
2. Ran additional single-class ImageNet OOD experiments.
3. Ran experiments for baselines at the same resolution for more accurate comparisons, showing DiffPath matches the baselines with only a single model.
4. Several clarifications on the theory and methodology of DiffPath to enhance clarity for the reader.

Please see below for detailed responses to each reviewer.

[1] Yang, Jingkang, et al. "Openood: Benchmarking generalized out-of-distribution detection." Advances in Neural Information Processing Systems 35 (2022): 32598-32611.

Meta-review: The paper proposes a novel approach to OOD detection using a single diffusion model trained on a diverse dataset, leveraging the rate-of-change and curvature of diffusion paths. The reviewers found the core idea innovative and the experiments generally compelling, demonstrating competitive results across various OOD tasks. Reviewer 5CB8 appreciated the theoretical connections and clear presentation but expressed concerns about resolution mismatches and the benefits of using a single model, which the authors addressed through additional experiments, showing that “DiffPath performs competitively with existing baselines” even when accounting for image resolution discrepancies. Reviewer 3gUh noted the method’s novelty and solid results but pointed out limitations related to model generalizability, which the authors acknowledged and positioned as future work. Reviewers eKbL and k7Q2 commended the clear presentation and the significance of extending OOD detection to large pre-trained generative models, with eKbL stating that “the method seems to work better than competitors” and k7Q2 highlighting the value of a solution that reduces the need for task-specific models. The authors’ comprehensive rebuttals effectively addressed the reviewers’ concerns, supporting the recommendation for acceptance due to the paper’s strong methodological contributions and potential impact on the field.
Decision: Accept (poster)