Spurious-Aware Prototype Refinement for Reliable Out-of-Distribution Detection
Authors: Reihaneh Zohrabi
Hosein Hasani
Mahdieh Soleymani Baghshah
Anna Rohrbach
Marcus Rohrbach
Mohammad Hossein Rohban
Venue: NeurIPS 2025 poster ()
Keywords: Out-of-Distribution Detection
Spurious Correlations
Prototype Refinement
Robustness
Post-hoc Methods
Trustworthy AI
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We introduce a novel, post-hoc prototypical OOD detection method that counteracts unknown spurious correlations by refining class prototypes, achieving state-of-the-art performance for reliable, trustworthy AI.

Abstract: Out-of-distribution (OOD) detection is crucial for ensuring the reliability and safety of machine learning models in real-world applications, where they frequently face data distributions unseen during training.
Despite progress, existing methods are often vulnerable to spurious correlations that mislead models and compromise robustness. To address this, we propose SPROD, a novel prototype-based OOD detection approach that explicitly addresses the challenge posed by unknown spurious correlations.
Our post-hoc method refines class prototypes to mitigate bias from spurious features without additional data or hyperparameter tuning, and is broadly applicable across diverse backbones and OOD detection settings.
We conduct a comprehensive spurious correlation OOD detection benchmarking, comparing our method against existing approaches and demonstrating its superior performance across challenging OOD datasets, such as CelebA, Waterbirds, UrbanCars, Spurious Imagenet, and the newly introduced Animals MetaCoCo. On average, SPROD improves AUROC by 4.8%  and FPR@95 by 9.4% over the second best.

Spurious-Aware Prototype Refinement for Reliable Out-of-Distribution Detection
Reihaneh "ohrabi"
Hosein * Marcus Rohrbach
Mahdieh Soleymani Baghshah²
Anna Rohrbach'
Mohammad Hossein Rohban
TTU Darmstadt
Sharif University of Technology
(reihaneh. zohrabi, anna. rohrbach, marcus. rohrbachhh Baatcchhhttuueeeee aaaudddrmmtadd.. (hosein. hasani, soleymani, rohban) rohban]@sharif @sharif edu
Abstract
Out-of iitoof-distribution (OOD) detection is crucial for ensuring the reliability and safety machine learning models real-world applications, where they frequently face data distributions unseen during training. Despite progress, existing methods are often vulnerable to spurious correlations that mislead models and compromise robustness. To address this, propose SPROD, novel prototype-base tection approach that explicitly addresses the challenge posed by unknown spurious correlations. Our post-hoc method refines class prototypes to mitigate bias from spurious features without additional data or hyperparameter tuning, and is broadly applicable across diverse backbones and OOD detection settings. We conduct comprehensive spurious correlation OOD detection benchmarking, comparing our method against existing approaches and demonstrating its superior performance across challenging OOD datasets, such as CelebA, Waterbirds, UrbanCars, Spuri- ous Imagenet, and the newly introduced Animals MetaCoCo. On average, SPROD improves AUROC by 4.8% and FPR @95 by 9.4% over the second best.
OOD de-
Introduction
Machine learning systems in real-world applications often encounter out-of-distribttion (OOD) inputs, which are samples from distributions different from the training data. These inputs require cautious handling to prevent overconfident mispredictions during inference (1. This makes OOD detection crucial, as it aims to identify whether an input belongs to the known distribution or not. Yet, deep neural networks, widely used vision tasks 23. tend to make high-confidence predictions even on OOD inputs, demonstrating their inability to recognize data outside the training distribution as OOD The reliability of OOD detection especially critical in applications like healthcare and autonomous driving, where overconfident predictions on unfamiliar data could have serious consequences
Recent research on OOD detection aims to ensure the reliable deployment of DNNs ZZ 10
Despite many effective methods, their robustness can be undermined by spurious correlations in the training data [14.. Studies indicate that models often rely on features that are statistically informative but causally representative of the object itself (15 These misleading cues can as shortcuts, allowing models to achieve high accuracy without learning the core, causally relevant features [18] While spurious correlations have been well-explored in classification tasks [17 20). their impact on OOD detection remains underexplored. Recently, [14] underscores the impact of spurious correlations on OOD detection and introduces a formalization that categorizes OOD samples into two types: spurious OODs (SP-OODs), which contain spurious attributes but lack core features,
Equal contribution
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Class
SP-00D
HSP-0OD
Figure 1: The challenge of spurious correlations in OOD detection. ID classes (dog, fox, wolf) appear in correlated backgrounds (grass, autumn, snow), with majority groups relying context shortcuts (blue frames). SP-OOD samples share the same contextual backgrounds, making detection more difficult. NSP-OOD samples differ in context and lack both spurious and core features.
and non-spurious OODs (NSP-OODs), which lack both attributes and align with the traditional OOD setting. Figure shows an example of this problem setting.
Recent efforts to mitigate spurious correlations in OOD detection can be grouped into several broad categories. Outlier Exposure (OE) techniques reduce reliance on spurious correlations by incorporat- ing synthetic OOD samples in their training [21.24] Other methods focus on modifying training
objectives explicitly discourage models from depending on spurious features [25] 26). However, these methods usually require retraining and generating additional OOD data. In contrast, several post-hoc approaches have been proposed that bypass the limitations of -haii approaches and offer fast and light alternatives (2). Despite their promise, these methods are often tested on limited synthetic datasets or specific backbones, and some rely on multiple modalities.
To address these limitations, we propose Spurious-Aware Prototype Refinement for Reliable Out- of-Distribution Detection (SPROD) for robust OOD detection, especially in the presence of un- known spurious correlations. It follows a three-stage process: (1) initial prototype construction, (2) classification prototype calculation, and (3) group prototype refinement. SPROD can be easily applied to any pretrained feature extractor without fine-tume fine-tuning on target datasets, offering straightforward, hyperparameter--ree
approach that is both efficient and adaptable across diverse OOD detection tasks. Moreover, our work offers comprehensive evaluation of OOD detection in the presence of spurious correlations, benchmarking existing methods across multiple challenging datasets, including Waterbirds 333. CelebA (4.. UrbanCars (35), Spurious ImageNet (36), and the newly introduced Animals MetaCoCo. SPROD achieves state-of-the-ar performance and consistently exhibits robust behavior across wide range of benchmarks and experimental conditions. The main contributions this work are as follows:
We propose SPROD, a post-hoc OOD detection method that directly addresses unknown spurious correlations by design and outperforms the state-of-the-art, We provide theoretical insight into how the proposed method mitigates spurious bias.
SPROD fast, simple, and general approach applicable to diverse pretrained feature extractors and OOD detection settings.
SPROD does not assume access to group annotations to achieve robustness to spurious correlations and does not require either OOD ID validation data for hyperparameter tuning. Moreover, it maintains strong performance even in low-training data regimes.
This work conducts and introduces comprehensive benchmarking across multiple SP-OOD datasets, including the newly introduced Animals MetaCoCo, realistic, multiclass dataset with diverse spurious attributes.
Finally, our study sheds new light on key factors influencing SP-OOD detection, such as the impact of backbone fine-tuning and the choice of scoring mechanisms.

---

2
Related Work
OOD detection methods can be categorized into training-timn time and post-hoc approaches 37 Training- time methods leverage auxiliary OOD samples (Outlier Exposure) [12 38 39 or apply regular- ization 43 to enhance OOD detection. Post-hoc methods, in contrast, derive OOD scores from base classifiers without modifying training [37]. Overall, post-hoc methods offer simplicity and competitive performance [37], making them practical under limited data or training resources. Among post-hoc methods, several approaches apply transformations model logits to derive OOD scores. MSP 7 uses the maximum softmax probability, the energy-based method [3] computes the log-sum-exp of logits, MLS
44
uses the maximum logit and introduces KL Matching (KLM) based
on KL divergence, and GEN
45 employs generalized entropy of softmax outputs.
Another class of post-hoc methods detects OOD samples via feature-space distances. MDS [[]] fits class-conditional Gaussians to pre-logit features and computes Mahalanobis distances, refined by RMDS 446 with an unconditional Gaussian on ID data. KNN 47 uses distances to nearest ID)
samples. SHE scores samples by their distance to stored ID feature templates. NNGuide [49
leverages nearest-neighhor guidance to adjust test features toward the ID manifold. Relation [50
constructs a graph over training embeddings and detects outliers via relational anomalies. NECO scores samples by their feature alignment with class weight vectors, leveraging neural collapse geometry. SCALE [52] separates ID and OOD samples by scaling penultimate-layer activations. FDBD [53 measures features' regularized mean distance to the classifier's 's decision boundaries. NCI [54] scores samples by their distance to class weight vectors, filtered by feature norms.
Prototype-based methods shape class representations for distance-based OOD scoring. Classical approaches like MDS [1] and its variants [46] are closely related, as they model each class by a centroid in feature space, optionally using conditonnii covariances to compute Mahalanobis distances. Recent works extend this via explicit training objectives. CIDER (55] learns hyperspherical embeddings by jointly enforcing intra-class compactness and inter-class dispersion, thereby improving ID and OOD separability. PALM (56) represents each class as a mixture of learnable prototypes and optimizes a maximun-likelihen
and contrastive objective, updating prototypes and backbone features jointly during training. PROWL (57) also leverages prototype representations, but for pixel-level OOD detection in segmentation. While these methods share prototypical framework, SPROD differs as a post-hoc method operating on pretrained backbones and is explicitly designed to mitigate the negative effects of unknown spurious correlations. Appendix H further analyzes variant, SPROD-KMeans, which connects to mixture-of-proote prototypes ideas while remaining fully post-hoc.
A few methods combine information from both feature and logit spaces. ReAct (58) thresholds activations before applying energy-based scoring. ViM [59] adds a virtual logit from the resid- ual norm between input features and the ID subspace and applies softmax over extended logits. ASH (60 prunes high-magnitude activations and rescales remaining features before logit computa- tion, improving energy-based OOD separability. Some methods also exploit gradient space for OOD scoring 66 (2). GradNorm [6]] computes the KL divergence to a uniform distribution and uses the gradient norm (w..tt. the penultimate layer) as the score.
Spurious correlations in training data degrade OOD detection performance, as shown in 14. Evalua- tions of popular methods [0 performance drops, and SP-OOD samples become especially challenging to detect. Feature-based methods like MDS [I] outperform others, especially for NSP samples. Recent work addresses spurious correlations in OOD detection through various strategies. OE methods synthesize OOD samples in ways that reduce reliance on background cues, encouraging models to focus on core semantic features (21-24). Training-tima regularization mitigates spurious cues by reweighting samples augmenting non-semantic features (25] 26). Post-hoc methods improve inference by
13 63 reveal that as spurious correlations increase, detection
modifying inputs to isolate semantics or reduce background influence 22 28).
Recent advances in vision-language models [64] have led to category of zero-shot OOD detection methods 22 32 that use textual inputs, such as class names or attribute descriptions, to define ID data and identify OOD samples. While some report results on Waterbirds SP-OOD, this is not their main focus. Moreover, lacking training data with spurious correlations, their zero-shot setting does not fully capture the SP-OOD challenge. In contrast to these approaches, which rely on explicit text for OOD scoring, our method refines visual prototypes using only ID features and class labels from the training set. A detailed review of studies regarding SP-OOD can be found in Appendix B
3

---

(a)
(b)
(c)
Figure 2: (a) A far-OOD sample may receive high softmax score, similar
boundary ID
sample. (b) Distances to class prototypes offer more consistent separation of OOD samples. (c) In the SP-OOD setting, the problem is even more severe: A biased decision boundary causes the OOD sample to receive high softmax confidence, while minority ID sample receives lower confidence.
3 Preliminaries
3.1
Problem Setup
This paper addresses Out-of- Diii-off-Ditrbbtiion (OOD) detection under spurious correlations in supervised classification setting. Let X be the input space and y' (1,.... ... . the label set. The in-iittribution (ID) training data Din { yi) ] comprises samples from a joint distribution Px,.. A neural network Jo maps each input æ; to a feature embedding h; = So (zz). This network is typically pretrained or fine-tuned on the training data. OOD detection aims to identify test samples from distributions not seen during training, including those from unseen classes.
Spurious correlations in OOD detection were first formalized by [14]. According to this framework, each input can be decomposed into: (i) core features, which are causally related the label, and (ii) spurious features, which are correlated with the label but not causally relevant. Imbalances in the training data often result in dominant core core-spuree pure-ppuious combinations (majority groups), while rarer combinations (minority groups) remain underrepresented. This bias encourages models to rely disproportionately on spurious cues. In controllable settings, the proportion of majority group samples within a class is captured by the correlation rate. As illustrated in Figure [ this setup gives rise to two types of OOD examples: Spurious OOD (SP-OOD), which share spurious features with ID data but differ in core features (c.g., cat on grass, where grass is spuriously associated with ID classes dog, wolf. fox); and Non-spurious OOD (NSP-OOD), which differ both core and spurious features (e.g., cat laptop).
3.2 Score Calculation
A key element in OOD detection is the scoring function S(z). which assigns scalar value reflecting how likely an input belongs to the in-distribution (ID). This score is typically derived from a model's learned representations or its predictive outputs. OOD detection is performed based this score function. An effective OOD method offers distinct and well-separated distributions scores for ID and OOD samples.
Prior studies show that feature-based scores, derived from intermediate representations 10 13 47), typically outperform those based on output probabilities (7), especially in the presence of spurious correlations [1]. Our experiments further support this trend in certain settings, suggesting that output- based methods (especially those relying softmax probabilities) may be less reliable when model confidence is influenced by spurious features. To better understand this difference, consider two probabilistic perspectives in classification: discriminative models directly estimate p(y(z) and focus on separating classes, while generative models estimate p(øly) (y) and capture how data x is distributed for each class y. Most distance-basse OOD detection methods can be viewed as approximating generative approach in feature space.
While directly modeling p(y] is generally effective for classifying ID samples in standard settings, discriminative approaches have been reported to more sensitive under distribution shifts, such as in continual learning (65] or in the presence of spurious correlations (66). Furthermore, their utility for

---

Miseity canele class
Micertty simare dim-
Ninortly sumple 2
Eave us
(I)
Figure 3: Overview of the three main stages of SPROD. In the first stage, class prototypes are computed, though they may be biased due to spurious correlations. In the second stage, group prototypes constructed for the misclassified and correctly classified samples of each class. Finally, the third stage, class samples are reassigned to their nearest group prototypes, and based on these assignments, refined minority and majority prototypes are recalculated.
O0I) detection be limited, particularly when methods optimized solely II) data without exposure to OOD examples. The softmax function forces a normalized probability distribution over the known classes, which can degrade OOD detection performance. For instance, an OOD sample that lies far from all class distributions may receive a high softmax probability if it is only slightly distant from decision boundary. Conversely, an ID sample situated near the boundary between multiple classes could receive low maximum softmax probability, potentially leading to its misclassification
as OOD, In contrast, distance based approaches, which rely on the class- classcoonitional distribution p(xly), are by nature more robust in these scenarios. OOD samples that share few characteristics with any known class typically exhibit low likelihood under all condiccondiiinnal distributions p(xly)) and can be reliably identified, regardless of their proximity to decision boundaries.
Figure highlights the limitations of softmax-based OOD scoring in controlled toy dataset. The challenge becomes more pronounced in the presence of spurious correlations, as shown in Figure [c] In this scenario, a discriminative model, potentially biased by spurious features, may assign high con- fidence to an SP-OOD sample that shares these spurious cues with an ID class, while simultaneously assigning low confidence to minority ID sample that lacks them. Motivated by these observations, we design generative distance-based approach that is more robust to unknown spurious correlations.
4 SPROD
In this section, we introduce Spurious-Awary Prototype Refinement for Reliable Detection (SPROD). SPROD adapts the prototypical framework for robust OOD detection by constructing class prototypes designed to be resilient to spurious correlations. 'he core method involves three-stage process, which is shown in Figure 3 and detailed in the following subsections.
4.1 Stage Initial Prototype Construction
Given a pretrained feature extractor fe. we first obtain feature embeddings h; = fo(;;) for each training sample z;. To ensure uniformity feature representation, these embeddings are normalized to have unit norm = h:/l2. For each ID class E V. an initial prototype as the mean of these normalized embeddings: P. 1/No Σ Eigi= 24, where N₂ is the number of samples class Each Pe serves as an initial estimate of the class centroid in the normalized feature space. A query sample Iy (with normalized embedding 2n) is typically classified to the class e whose prototype P. the closest (c.g.. using Euclidean distance d(=Ø. P.)). We use d(zg. Pe) as the scoring function for OOD detection. While our empirical results demonstrate the effectiveness of the naïve prototypical method in both SP-OOD and NSP-OOD settings, this approach remains vulnerable to biases from spurious correlations in the training data. As result, the prototypes become skewed toward majority groups within each class (see part of Figure 3). This bias leads to a scenario where SP-OOD samples (represented by purple squares in Figure 3) may be erroneously classified as ID due to their proximity to these biased prototypes. These limitations motivate the subsequent refinement stages.
is computed
5

---

4.2 Stage 2: ClassfiicatonnAAaae Prototype Calculation
To mitigate biases from spurious correlations present the Stage prototypes, we begin by analyzing how these initial prototypes classify the training data itself. Inspired by [20] our debiasing process starts with classifying the training samples based on the initial prototypes and partitioning the samples based on their prediction outcomes. For each class c, this identifies set of correctly classified samples, SttT, and (multiple) sets misclassified samples, {St Impeo where m is the incorrectly predicted class. The core assumption is that samples St belong to subgroups of class c that share spurious features with class m, leading to their misclassification.
Formally, for each class c, we compute the prototype Pe by averaging over embeddings of correctly classified samples Searr For the misclassified samples of class we compute the set of misclassified group prototypes {p mmfe by averaging over samples in {S J mott individually. The number of misclassified group prototypes for class c, denoted by Ouiiie corresponds the number of other classes that training samples from class have been misclassified as during evaluation.
This procedure expands the number of prototypes per class from up C (total number of classes), helping incorporate diverse subgroup characteristics within each class. However, this approach has potential limitation. Specifically, samples within the minority group may still contribute to the prototype for the correctly classified (majority) group if they were initially classified correctly, resulting in slightly biased prototypes (see part II of Figure 3). Hence, we further refine the group prototypes in the third stage.
4.3 Stage 3: Group Prototype Refinement
In the third stage, we refine the group prototypes computed in Stage 2 to further reduce the remaining bias within them. Inspired by the reassignment step in K-means clustering, first reassign samples within each class {z: y/ e} to either majority Se minority groups mmcmmmm based on their proximity the corresponding prototypes (p for majority members and { 1p [ myte for minority members). Following this reassignment, refined prototypes are computed as the mean of the updated group members:
Pa
Z4s
Pe-mm
Vm $
|S
Smin
2, 2:E5
The refined prototypes Pe and piin further reduce bias through the proposed refitting process. During classification and OOD detection, the query embedding 2g is compared to all group-specific prototypes, and the final prediction is based on the nearest prototype, regardless of group type. This multiple-prototype approach reduces the likelihood of OOD samples being erroneously classified due to shared spurious attributes with any single prototype (see part III of Figure 3 For each sample, the OOD score is simply calculated based on the distance to the nearest group prototype.
Algorithm Spurious-Aware Prototype Refinement
1: Input: Training samples 81) feature extractor fo
2: Output: Refined class prototypes
3: Get feature embedding h4 = fa(ri) and zi
hy
Vz;
[[bella
4: for each class c= C:.
Stage 1: Constructing class prototypes
5:
N_ Digg 24
Classify all training samples using initial prototypes
Stage 2: Augmenting class prototypes 8: Separate samples into correctly classified S and misclassified {Sause mmppic
7: for cach class c 1,...,C. C:
Compute p. based on Scorr and ] based on { 10: for each class e = 1,...,C. C:
9:
b Stage 3: Refining group prototypes
11: Construct majority S.aa and minority hmyee groups based on proximity to p: or {p hmpli
12:
mij based on S and [pmiemmm based on (Smnn (S Compute p.
The overall procedure of our prototype refinement strategy outlined Algorithm and a theoretical justification of how the proposed procedure mitigates spurious bias is provided in Appendix A

---

5 Experiments
5.1
Experimental Setup
We evaluate our method against comprehensive suite of 19 post-hoc OOD detection approaches:
MSP 77.. MDS (T]) RMDS [46], Energy [13), GradNorm [61]. ReAct (58). MaxLogit [44]. MLS &
KLM 44 VIM (59). KNN 47I. SHE
148 ASH [60]. NECO [5T, NNGuide 49 Relation [50], We assess performance primarily using the Area Under the Receiver Operating Characteristic curve (AUROC), chresholddinddpeedeen metric, and the False
SCALE 52 fDBD 5 and NCI
54
Positive Rate at 95% True Positive Rate 95). Additional metrics, including the Area Under the Trecision-Recal curve (AUPR), are provided in Appendix G with different random seeds and report the mean and standard deviation.
We repeat all experiments five times
In this experiments section, we focus on the more challenging SP-OOD scenarios, particularly those with the highest degree of spurious correlation in each dataset, as our method achieves near perfect performance far NSP-OOD samples. Detailed results for the NSP-OOD setting are provided in Appendix E Further analyses of SPROD's stages, along with broader evaluations across various transformer-based and convolutional backbones, consistency, the results in this section primarily use the widely adopted ResNet-50 [68] backbone, with ResNet- 18 additionally used in one analysis. Beyond SP-OOD benchmarks, we also evaluate approach under conventional (standard) OOD settings to further demonstrate its general applicability.
included in Appendix F and Appendix G For
5.2 Datasets
Table I: Overview of datasets used for SP-OOD evaluation. "# Groups" denotes the number of distinct subpopulations based on class and spurious attribute combinations. "NA" indicates cases where such grouping is not explicitly defined.
Dutaset
Type
* Classes
Spurions Atte.
Groups
SP-OOD
Watethinds (WB) 53
Synthetic
2 (Dtrd Type)
Backkrrundss
Phaces [8] background
ColehA (CA) 22
Real-world
2 (Haii Color)
2 Genders
Bald male (no hair)
UrhanClex (0G) K3
Syntherie
2 (Car Type)
Rackgrounds Cihjoats
8
Backgrand// Rackground Oitject
Antmaals Co (AMC) [ours]
Real-worid
(Animal Type)
&Backgrondss
NA
Leave-2-out (cless-hased)
Sp-ImageNerii00 (5p0)
Real-world
100 (ImageNett classes)
(sparious visual features)
NA
Spurious ImageNNr
For evaluating SP-OOD detection, we utilize five diverse datasets, whose properties are summarized in Table [ Additional details and visual examples for all datasets, including the NSP datasets and their evaluation setup, are provided in Appendix [ The datasets include Waterbirds (WB) [33] and CelebA (CA) 34). While widely adopted, these datasets present limitations in terms of scale and realism (CelebA, in particular, is noted for its label noise (70),, making them insufficient for comprehensive evaluation. To address this, our evaluation incorporates three additional datasets designed test robustness under diverse conditions, including multi-class scenarios, multiple spurious attributes, and real-world complexity.
IrbanCars (UC) 35 is a binary classification dataset (urban vs. country cars) with two spurious attributes: background and a co-oceurring object, both correlated with the class, making a challeng- ing multi-spurious benchmark. Next, we introduce Animals MetaCoCo (AMC), realistic SP-OOD benchmark created by subsampling and curating animal categories from MetaCoCo 7T.. It contains 26 distinct classes, each with 8 different background types serving imbalance shortcut attributes. We use a class-level leave-2-out setting, where two classes are held out as SP-OOD and the rest are treated as ID. The significant similarity in background distributions between the ID and OOD splits makes Animals MetaCoCo a particularly challenging multi-class benehmark for SP-OOD detection (Figure D. Last, we also use the Spurious ImageNet dataset introduced in [36] as SP-OOD data. This dataset consists of real-world images that contain only spurious features, such as bird feeders or graffiti, without the actual class objects, yet are consistently misclassified specific ImageNet classes. These OOD samples are constructed for a subset of 100 ImageNet classes identified to rely on harmful spurious correlations. We refer to this subset of classes Sp-ImageNet100 (SpI), a name we use for clarity, and treat it as the ID data.
For conventional OOD evaluations, we follow the same settings as in OpenOOD 37
Specifically, we use CIFAR-10 (72), CIFAR-100 [72], and ImageNet-Ik [73], along with their respective near-OOD and Oar-ODD datasets, to ensure consistency with widely adopted benchmarks in the field.
7

---

Table 2: Comparative performance of post-hoc OOD detection methods on SP-OOD benchmarks using a ResNet-50 backbone. Left: AUROC scores (higher is better); Right: FPR @95 scores (lower better). reature-based methods are indicated blue, output-based methods in red, gradient-basee in black, and hybrid methods in green. For each experiment, the top-performing method is shown in bold, and the second-best underlined.
AUROC
95
Method
WB
Spl
Avg.
Method
AMC
Spl
Avg.
MSP
46.0.14
Suca
7977
$3.1
MSP
57.0.0m
17.3
83.8
74.1.3.
58.4
Enary
62.0.4
45....4
80.6
61.3
Energy
80.2.a.
08.6.
1...
84.8ccs
76.5.n.
MLS
45.3.37
N1.
6LB
MLS
88.11.2
U8.8.00
M6.7.
84.416.
N8.5
KL
51.2.9
4177233
60.7
KL
80. 1m
87 1a
80.5an
70.1211
83.3
GEN
0233.3
460.14
38 3..5
61.6
GFN
67.9.u
87.3.
84.8
70.5.107
89.0
GNorm/bi
79.5.54
38.0.1.1
36.6.5.4
T4.2
85.2.122
64.7
GNorm 60
24.2
08.5 08.8
07 Lm
84.2am
54.7
53.8
55
T29
45.6.5.3
43 41.3.1.1
N0.1 M0.1
K36
64.7
RcAc
00.0
06.3.2.4
05. 05.5
65.9
57.5
$1.0
VIM 59
50-4.:1
60-7g177
28
77.4
VIM 59
61.4
98322 10.
69.0
79.5.
78.5
ASH 620
78.5.10
47.5
30 30.6.17
86.
66.0
ASH 600
65-2.7 0
96.0
96 1.
87.9
62.9
83.6
MES
9032..51
07.5.8:3
91 8.5.1
025
72.2
MDX 11
18.2.03
96.0.1
39.0
90.52163
75.5
RMDS 5b
59.4:
33.6
37 A7
$12
58.2
RMDS 06
91.7293
99.6.n.1
05.2 35.3
63.4
88.1
91.6
KNN
08.6..
54.5
01 01.1
7977
77...
50.3
KN
4.8
04.A
42.5
20.9
70.4
58.4
SHE
88.3
02.7 42.7-34
T3.2.c.1
S3.0.51
68.4
SHE
98.4
76.5.0
52.0
70.5
NECO 31
13.5.1
39.5-3.
35, 35.1215
07.2.33
B6.1
NECO
90.5
08.6.94
96 96.7.1.
T8.2
89.9...
90.8
706.19
49.5 89.8.111
43.6111
79.4.5
85.1
66.7
NNGunde GM
77.7
07.6.1.1
01.5 01.6:83
86.3
$2.2.1.4
81.1
Relatin 50
06.0.sa
74.
818.37
78.7
Relation 50
73.8
05.4.n3
24.2.17
84.6
78.0.1.1
71.2
SCALE
04.9.3.2 9.33
G44.11
T84
11.5
SCALE 5
98.7
94.8.3.
79.0
IDDD53
T1.1
51.3.113
47.4
79.9
84.2
66.8
[T
6..6.
87.3
SC
NCT
41.1
99.4.
86.8.03
76.5
SPROD
85.3.2
SPROD
47
69.5
08.0.n
49.0
Spurious Correlation: 50%
Spurious Correlation: 90%
Pretralned
Fretralned Finataned
AUROC Inteo (04
Finetuned
AUROc mmnn akc
SPROD
SHE
KnW
RMOS
vite
Retet
Citrm
KLH
MLS
Energy
SPROD
SHE
RMDS
MDS
vie
Resket
Goennn
KLM
M8.
Energy
(a) ResNet- 50 backbone.
Spurious Correlation: 50%
Spurious Correlation: 90%
Pretrolned Finetuned
Fretrained Finetaned
AUROI CHANO 1841
sto)
AUROC
SPROD
SHE
KNW
RMDS
MDS
VIM
Rerect
Giarm
KLH
MLS
Energy
MSP
SPROD
SHE
KNW
RINS
MDS
Vid
Goerm
KUM
NL5
Energy
MSP
Re
(b) ResNet- 18 backbone.
Figure 4: Effect of backbone fine-tuning and spurious correlation SP-OOD detection using the
Waterbirds dataset. Left: ResNet-50; right: ResNet-18. Each pair shows results under 50% (left) and 90% (right) spurious correlation in ID data. Fine-tuned models are marked with hatch texture.
5.3 Results
The primary results, summarized in Table 2 demonstrate the efficacy of SPROD across various datasets using a ResNet-50 backbone, evaluated with both AUROC and FPR metrics. Additional results on other backbone architectures are provided in Appendix G SPROD consistently achieves superior performance compared the 19 post-hoc baselines in all conducted experiments. In contrast, competing methods exhibit more variable performance, excelling in only a subset of the experimental settings. Generally, feature-bass based OOD detection methods tend to outperform output-basee based methods; however, this advantage appears to diminish on larger- scale datasets with multiple classes. Overall, the average performance across all datasets reveals a notable margin by which SPROD surpasses the other evaluated baselines: Specifically, SPROD reaches an average of 85. 1 1% AUROC, 4.8% higher (absolute) than the second best, KNN. For FPR @95, SPROD reaches 49. 1% error rate on average, 9.3% better than the second best, KNN. All other compared approaches are more than 20% worse.
8

---

Generative
Disctminative
Gemera PC
223r2
322r
ANC
(a)
(b)
Figure 5: Comparison of generative and discriminative scoring for OOD detection using SPROD.
(a) Histograms of ID and OOD sample scores using the distance-based generative approach and the softmax-bast based discriminative approach, both computed with SPROD on the Waterbirds dataset. (b) Performance comparison between the generative (distance-based) and discriminative (softmax-bas scoring variants of SPROD across the five SP-OOD benchmark datasets.
Table 3: Comparison with the best-performing methods reported in the OpenOOD 37 tional (standard) OOD datasets (AUROCT). The highest scores are highlighted in bold.
on conven-
Method
CIFAR-10 Near
CIFAR-10 Far
CIFAR-100 Near
CIFAR-IOU Far
ImageNet Near
ImageNet Fur
Arg
RMDS
4D
89.80
92.20
80.15
82,92
76.99
86.
84.74
MLS
1
87.52
91.10
81.05
79.67
76.46
89.57
84.23
KNN
90.64
92.96
80.18
82.40
71.
90 18
84.58
ASH
75.12
78.49
78.20
80.58
78.17
95.74
81.05
SPROD
89.04
91.78
81,80
79.93
75.06
95.29
85.15
Next, we investigate the impact of backbone fnn-ttuiin and correlation rate on OOD detection performance, using the Waterbirds dataset with ResNet-50 (Figure 4al and 18 (Figure 4b) backbones. Fine-tuning the backbone on this dataset generally degrades OOD detection performance, finding that contrasts with some common assumptions. This negative effect appears to be more pronounced for feature-based methods. As expected, increasing the spurious correlation rate of ID data from 50% to 90% leads to general decline in performance across methods; however, this degradation is more noticeable for output-based techniques. Furthermore, the results suggest that employing lighter, less expressive backbone (ResNet- 18 compared ResNet-50) does not lead to a substantial performance drop in OOD detection. Across these variations, SPROD demonstrates consistent robustness and maintains its performance the spurious correlation rate increases.
To investigate the impact of the scoring mechanism, as discussed in Section 3.2 we conduct an ablation study using SPROD the base method. This controlled experiment compares the effec- tiveness deriving OOD scores a discriminative manner p(y]=) versus a generative manner p(zly). Both baselines utilize the same samples, feature embeddings, and refined prototypes from SPROD. For the discriminative score, we apply a softmax function to the negative distances between sample's 's embedding and the class prototypes. The default SPROD approach, which uses the negative of the minimum distance to class prototypes, serves as the generative baseline (aligning with ligelikel under exponential family distribution assumption).
Figure presents histograms of the scores generated by both approaches, showing that the generative scoring method yields more distinctly separated distributions for ID and OOD samples. Furthermore, Figure 5b compares the OOD detection performance these two scoring variants across our five SP- OOD benchmark settings. The results indicate that applying the softmax function for discriminative scoring substantially degrades performance, particularly in WaterBirds, CelebA and UrbanCars datasets. Conversely, on Animals MetaCoCo and Spurious ImageNet, the performance degradation from using softmax is less pronounced. This observation aligns with the trends in Table where traditional output-based methods tend to perform relatively better in these datasets.
To further assess the generality of SPROD beyond spurious correlation settings, we evaluate on conventional OOD benchmarks using the standardized OpenOOD protocol [37]. We compare SPROD with the top-performing post-hoc methods reported in the OpenOOD study. 3 that SPROD attains performance comparable to or exceeding these methods and achieves the highest average score across all settings, confirming that SPROD performs reliably on standard OOD benchmarks and is not limited to spurious correlation scenarios.

---

While the simplicity of its prototypical framework makes SPROD a computationally efficient post-hoe method, its sample efficiency in SP-OOD settings also deserves investigation. To this end, we evaluate SPROD alongside the second top-performing method from Table under low-shot conditions. In this setup, we reduce the number of ID training samples while carefully preserving the original level of spurious correlation present in the experimental setting. The results, presented in Figure [ demonstrate that both SPROD and KNN maintain strong performance even in this data-scarce regime, highlighting the sample efficiency of these post-hoc approaches. Interestingly, for the CelebA dataset, both methods exhibit improved OOD detection performance in the low-shot setting compared to when trained the full dataset.
Waterbirds
Celeea Blond
carrs
AUNOC (mron
ABOC Imoon
FAH (ke da-0
APPOC
CAN (1:3
SPRCO pults SPRCO (om start
SPROO Lin 16-0
Numberof Shot per Misority
Number
Numberal Ninuriyy Group
Figure 6: Performance of SPROD and KNN in low-shot SP-OOD settings across three datasets. Dashed lines indicate performance with the full training set, while solid lines show performance using varying numbers of samples per minority group.
Zero-shot OOD detection methods have reported results Waterbirds using CLIP-B/16, but since they operate in a zero-shot setting, spurious correlations in the training set are not meaningful for them. Still, compare: MCM 29 and CMA [32] achieve 98.36 and 98.62 AUROC using text inputs, while our text-free, vision-only method outperforms both with 99.01. COVER (28) also evaluates this setting but over a different operating range, achieving lower AUROC scores (90.52 vs. 90.31 for MCM), highlighting our method's superior performance. Additional comparisons with existing SP-OOD methods (specifically CLiP-based approaches) are provided in Appendix
Discussion
This paper introduces SPROD, a prototype-based method enhancing out-of-distribttion (OOD) detection robustness against unknown spurious correlations. SPROD refines class prototypes by identifying and then adjusting for potential subgroups influenced by spurious features, thereby aligning representations with core, invariant class characteristics. A key strength is SPROD's efficiency and adaptability: a post-hoc method, it integrates with various pre-trained feature extraction models without requiring retraining, additional OOD data, or hyperparameter tuning.
Experimental results consistently demonstrate the superiority of SPROD across ten convolutional and transformer-basee based backbones and five diverse SP-OOD benchmarks, including the newly introduced Animals MetaCoCo dataset. Our evaluations also reveal that fine-tuning the feature backbone on ID data can degrade SP-OOD detection performance. Furthermore, investigations into scoring mechanisms highlighted the advantages of distance- approaches over softmax-based scoring for SP-OOD detection, particularly affirming the design choices in SPROD.
SPROD offers scalable solution for improving robustness in OOD detection. While demonstrating significant advancements. SPROD's current formulation relies on class labels from the ID training data to construct class-conditional prototypes. This reliance aligns with the typical assumptions of the spurious correlation setting, which presumes access to data samples with spuriously correlated labels. SPROD is not always the single best-performing method on every metric or in every setting (particularly in the conventional setting), but remains competitive with the best-performing ap- proaches. Such trade-offs are common in robustness research, where minor reductions in overall accuracy are often accepted to attain higher worst-group performance. Future work could explore theoretical justifications for the robustness of the generative-like scoring mechanism or investigate more expressive approaches for modeling class-conditional distributions.
10

---

Acknowledgments
The research at TU Darmstadt was partially funded by an Alexander von Humboldt Professorship in Multimodal Reliable AI, sponsored by Germany's 's Federal Ministry for Education and Research.
References
[1] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images, 2015. URL httphhhtp/aaattt orgoogg///aa.. 1412. 1897
[2] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. CoRR, 502.1502. 2015. URL http::/arxiv org/ httgg/ab//550..1111 01852
[3] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. Commun. ACM, 60(6):84-99)) 90, may 2017. ISSN 0001-0782. doi: 10536056365386..
[4] Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. CoRR, abs/ abs//804.00o 100.0027777
2018. URL htk.hhtpp//arxiv http:://aaaii..or/abb///////e
abaaa/a///10 wwwp:///..r/aa///0...... 02767
[5] Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. Faster R-CNN: towards real- time object detection with region proposal networks. CoRR,
497,, 2015. URL
http://arxiv.cr http://.rrg/bbb/////aaa/e aas////s//115/.. 1106/5066.00 01497
[6] Anh Mai Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. CoRR, abs/1412.1897, 2014. URL 1897
attp://aarxiv.org/bbs///ee
[7] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and ofttof-distriibttion examples neural networks. CoRR, abs/1610.021366 2016. URL http:://axii/ orgoorgg/aa....oo. / 1610. 02136
[8] David Zimmerer, Peter Full, Fabian Isensee, Paul Jager, Tim Adler, Jens Petersen, Gregor Kohler, Tobias RoB, Annika Reinke, Antanas Kascenas, Bjorn Jensen, Alison O' Neil, Jeremy Tan, Benjamin Hou, James Batten, Huaqi Qiu, Bernhard Kainz, Nina Shvetsova, Irina Fedulova, and Klaus Maier-Hein. Mood 2020: A public benchmark for out-of-distributin detection and localization on medical images. IEEE Transactions on Medical Imaging, PP:1-1, 04 2022. doi: 1111999TM..002.1170007
[9] Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are we ready for autonomous driving? the kitti vision benchmark suite. In 2012 IEEE Conference Computer Vision and Puttern Recognition, pages 3354-3361, 2012. doi: 10. 00.1099/CPRR22212.2248000
[10] Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distriburt image detection in neural networks, 2020. URL hhttps://arxiii wwtp://r//bbbbbbbbbabs/ees. 02690
[11] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting out-of- -fi-ofiibdttttiionnnn samples and adversarial attacks, 2018. URL https://arx:: ///axiv org/ hrggabss1800 1807 038888
[12] Dan Hendrycks, Mantas Mazeika, and Thomas G. Dietterich. Deep anomaly detection with outlier exposure. CoRR, abs/1812.04606, 2018. httpat::p//aaiiv.or/aa//e//////e 04606
[13] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based -it--idiittoo detection. Advances neural information processing systems, 33:21464-21475, 2020.
[14] Yifei Ming, Hang Yin, and Yixuan Li. On the impact of spurious correlation for out-of- distribution detection. CoRR, abs/a109.00sseee 09642422 2021. URL 05642)

---

[15] Sara Beery, Grant Van Horn, and Pietro Perona. Recognition in terra incognita. In Proceedings of the European conference on computer vision (ECCV), pages 456-473. 2018.
[16] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix Wichmann, and Wieland Brendel. tmagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprini arXiv: 12231, 2018.
[17] Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization. CoRR, abs//911.000
2019. URL http::tttt/tttti wttg//g//////aeee/o/ee 08731
[18] Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann. Shortcut learning in deep neural networks. CoRR, abs/2004.07780, 2020. URL htttttts///rxiiii http:////waxaxar.r/aaae/ http://www.rggb///20...... http//bbs/204..0700 07780
[19] Polina Kirichenko, Pavel Izmailov, and Andrew Gordon Wilson. Last layer re-training sufficient for robustness to spurious correlations, 2022. URL htttp:://rxivv orge /bb/ 1204.02937
[20] Evan Zheran Liu, Behzad Haghgoo, Annie S. Chen, Aditi Raghunathan, Pang Wei Koh, Shiori Sagawa, Percy Liang, and Chelsea Finn. Just train twice: Improving group robustness without training group information, 2021. URL https: //apx::://rxxv.../
httgg/bb/21000 .9044
[21] Rundong He, Zhongyi Han, Xiankai Lu, and Yilong Yin. Ronf: Reliable outlier synthesis under noisy feature space for out-of out-of-distributie distribution detection. In Proceedings of the 30th ACM International Conference on Multimedia, MM '22, page 4242-4251 New York, NY, USA, 2022. Association for Computing Machinery. ISBN 978 9781450392037. doi: 00.1145/503361135477888
URL htt.ttttt///ooiii.. org/
/ 10. 1145/353331111111 .554///3311111113381155 3547815
[22] Jaeyoung Kim, Seo Taek Kong, Dongbin Na, and Kyu-Hwan Jung. Key feature replacement of in-distribution samples for out-of-distribution detection, 2022. URL https/////ar
abs/2301.
[23] Kai Liu, Zhihang Fu, Sheng Jin, Chao Chen, Ze Chen, Rongxin Jiang, Fan Zhou, Yaowu Chen, and Jieping Ye. Rethinking out-of-distibbttion detection on imbalanced data distribution, 2024.
httttppp:/aaii.oo///aaaaaaeeeeee 26433
[24] Yu Wang, Junxian Mu, Hongzhi Huang, Qilong Wang, Pengfei Zhu, and Qinghua Hu. Backmix: Regularizing open set recognition by removing underlying fore-background priors. IEEE Transactions on Pattern Analysis and Machine Intelligence, pages 1-12, 2025. doi: 10.1109/ TPAMI.2025.3550770.
[25] Lily H. Zhang and Rajesh Ranganath. Robustness to spurious correlations improves semantic out-of-distribution detection, 2023.
[26] Zhen Fang, Jie Lu, and Guangquan Zhang. diist--iiittitutio detection with non-semantic exploration. Information Sciences, 705:12 2025. ISSN 0020-0255. doi: https://doi.org 10. p11/500200552500225
www.ssceiieieccccccco.me.o com wwtp///ciiinn/eerriiiee UtL.rtttee////rrrr.caaaaaacrrrrr
[27] Sungik Choi, Hankook Lee, Honglak Lee, and Moontae Lee. Projection regret: Reducing background bias for novelty detection via diffusion models, 2023.
org/
abs/2312.000
[28] Boxuan Zhang, Jianing Zhu, Zengmao Wang. Tongliang Liu, Bo Du, and Bo Han. What if the input is expanded in ood detection?, 2024. htttts//////xii org/ abs/ /a///bb//24// 24100 1810018477 18472
[29] Yifei Ming. Ziyang Cai, Jiuxiang Gu, Yiyou Sun, Wei Li, and Yixuan Li. Delving into out-of-distribution detection with vision-language representations, 2022.
[30] Yi Dai, Hao Lang, Kaisheng Zeng, Fei Huang, and Yongbin Li. Exploring large language models for multi-modal nut-of-distribution detection. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023, pages 5292- 5305, Singapore, December 2023. Association for Computational Linguistics. doi: 10.18653/
12

---

v1/2023. v1/2023.findingg 1oadding--emll33511 URL
findings-ddnnin emnlp
351
[31] Xue Jiang, Feng Liu, Zhen Fang, Hong Chen, Tongliang Liu, Feng Zheng, and Bo Han. Negative label guided ood detection with pretrained vision-language models, 2024. URL
[32] Yuxiao Lee, Xiaofeng Cao, Jingeai Guo, Wei Ye, Qing Guo, and Yi Chang. Concept matching with agent for out-of-distribution detection, 2025. URL https://arre ptapsi///axiv..oo www.i.oog.................ooooot abs/ 2405
16766
[33] Shiori Sagawa, Pang Wei Koh, Tatsunori B. Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization, 2020. URL //apx:
http//ab/1111..000 08731
[34] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference computer vision, pages 3730-3738, 2015.
[35] Zhiheng Li, Ivan Evtimov, Albert Gordo, Caner Hazirbas, Tal Hassner, Cristian Canton Ferrer, Chenliang Xu, and Mark Ibrahim. whac-a-mole dilemma: Shortcuts come in multiples where mitigating one amplifies others. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20071-20082, 2023.
[36] Yannic Neuhaus, Maximilian Augustin, Valentyn Boreiko, and Matthias Hein. Spurious features everywhere large-scale detection of harmful spurious features in imagenet, 2023. URL
https://aarat /ttp/v/axvvvvvv/a www.ii..rg//ee.. org///////oo. httg/abb/2212/ 04871
[37] Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, al. Openood: Benchmarking generalized out-of- distribution detection. Advances in Neural Information Processing Systems, 35:32598-324 32611, 2022.
[38] Qing Yu and Kiyoharu Aizawa. Unsupervised out-of-distribution detection by maximum classifier discrepancy. In Proceedings of the IEEE/CVF international conference computer vision, pages 9518 9526, 2019.
[39] Jingkang Yang, Haoqi Wang. Litong Feng, Xiaopeng Yan, Huabin Zheng, Wayne Zhang, and Ziwei Liu. Semantically coherent ofiistriiitiitttionn detection. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 8301-8309, 2021.
[40] Terrance DeVries and Graham W Taylor. Learning confidence for out-of-distribution detection in neural networks. arXiv preprint /02.v0/80..04866. 2018
[41] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances neural information processing systems, 32, 2019.
[42] Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distiibution detection for large semantic space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8710-8711 2021.
[43] Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In International conference machine learning, pages 23631-23644 PMLR, 2022.
[44] Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. A benchmark for anomaly segmentation. CoRR, ats//191..1111 2019. URL
[45] Xixi Liu, Yaroslava Lochman, and Christopher 7ach. Gen: Pushing the limits of softmax-based out-of-distribution detection. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pages 23946-23955, 2023.
13

---

[46] Jie Ren, Stanislav Fort, Jeremiah Liu, Abhijit Guha Roy, Shreyas Padhy, and Balaji Laksh- minarayanan. simple fix mahalanobis distance for improving near-ood detection, 06 2021.
[47] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In International Conference on Machine Learning, pages 20827-20840. PMIR, 2022.
[48] Jinsong Zhang. Qiang Fu, Xu Chen, Lun Du, Zelin Li, Gang Wang, Shi Han, Dongmei Zhang, al. out-of-disttibution detection based on in-distribution data patterns memorization with modern hopfield energy. In The Eleventh International Conference on Learning Representations, 2022.
[49] Jacwoo Park, Yoon Gyo Jung, and Andrew Beng Jin Teoh. Nearest neighbor guidance for out-of-distribution detection, 2023. URL betttpp://ariii.rg//abb////
14888
[50] Jang- Hyum Kim, Sangdoo Yun, and Hyun Oh Song. Neural graph: A unified framework for identifying label noise and outlier data, 2023. URL attps://arxiv. wwwpi/v...gg///////eeeee
12321
[51] Mouin Ben Ammar, Nacim Belkhir, Sebastian Popescu, Antoine Manzanera, and Gianni Franchi. Neco: Neural collapse based out-of-distributin detection. arXiv preprint 2XXiv:3310006822 2023.
[52] Kai Xu, Rongyu Chen, Gianni Franchi, and Angela Yao. Scaling for training time and post-hoc out-of-distrbbution detection enhancement, arXiv preprint arXiv:2310.00227, 2023.
[53] Litian Liu and Yao Qin. Fast decision boundary based -ittof-distribution detector. arXiv preprint 23. 2023.
[54] Litian Liu and Yao Qin. Detecting out-of-distiin distriiiittiittonn through the lens of neural collapse. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 15424-15433 2025.
[55] Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embed- dings for out-of-distribution detection?, 2023. URL https://arxii: org/ arrg/ba///
[56] Haodong Lu, Dong Gong, Shuo Wang, Jason Xue, Lina Yao, and Kristen Moore. Learning with mixture of prototypes for out-of-distribution detection, 2024. URL WRL.https:/ pnttps///arxiin h/ta:://aaxvvvooe org/ abs/2400..2665
[57] Poulami Sinhamahapatra, Franziska Schwaiger, Shirsha Bose, Huiyu Wang, Karsten Roscher, and Stephan Günnemann. Finding dino: A alug-and-play framework for zero-shot detection of -it-of-distribution objects using prototypes. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 1474-8483 IEEE, 2025.
[58] Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. CoRR, abs/2111.1.. 11.977 2021. URL https//s://arxii org/ aabb///111 2111.12797
[59] Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: distriiittti with virtual-logit matching. 2022. https://: http://xxivv..o/ abs/ 10807
[60] Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activa- tion shaping for out-of-distributian detection, 2023. URI. httpthtss///aiiioorg/////// http://iw...r///////220///
09858
[61] Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. CoRR, abs/21 10.00021,. 2021. URL htt.tttsss//axi.....
abs/2110.000
[62] Chirag Agarwal and Sara Hooker. Estimating example difficulty using variance of gradients. CoRR, abs/2008. 11600, 2020. URL https:tp::/ //aaxis org/ aa//abb//20000 11600
14

---

[63] Chandramouli Shama Sastry and Sageev Oore. Detecting out-of-distribution examples with in-distribution examples and gram matrices. CoRR, abs/1912. 12510, 2019. URL http
19t.. 12510
[64] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal. Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748-8768 PmLR, 2021.
[65] Mohammadamin Banayeeanzade, Rasoul Mirzaiezadeh, Hosein Hasani, and Mahdieh Soley- mani. Generative vs. discriminative: Rethinking the meta-continual learning. Advances in Neural Information Processing Systems, 34:21592-21604, 2021.
[66] Alexander Cong Li, Ananya Kumar, and Deepak Pathak. Generative classifiers avoid shortcut solutions. In The Thirteenth International Conference on Learning Representations, 2024.
[67] Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical networks for few-shot learning. Advances neural information processing systems, 30, 2017.
[68] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016.
[69] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 40(6):1452 1464, 2018. doi: 10. 201.TAAAM...1...223222
[70] Bryson Lingenfelter, Sara R. Davis, and Emily M. Hand. A quantitative analysis of labeling issues in the celeba dataset. In George Bebis, Bo Li, Angela Yao, Yang Liu, Ye Duan, Manfred Lau, Rajiv Khadka, Ana Crisan, and Remco Chang, editors, Advances in Visual Computing. pages 129-141, Cham, 2022. Springer International Publishing. ISBN 978-3-031-20713-4
[71] Min Zhang, Haoxuan Li, Fei Wu, and Kun Kuang. Metacoco: A new few-shot classification benchmark with spurious correlation, 2024. URL https://arxix: wwtp:/org/ab///////o/e 19644
[72] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny (2009). 2009.
[73] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei Imagenet large scale visual recognition challenge, 2014. URL BRLLhttps:// httttpp:/aarxvvorrr org/ /ba/ 1409.0575)
[74] C. Wah, S. Branson, P. Welinder, P. Perona, and S. Belongie. Cub dataset. Technical Report ONS-TR-2011-001, California Institute of Technology, 2011.
[75] Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3d object representations for fine- grained categorization. In 2013 IEEE International Conference on Computer Vision Workshops, pages 554-561, 2013. doi: 10. 1 1091000W.2011....
[76] Agrim Gupta, Piotr Dollár, and Ross Girshick. Lvis: dataset for large vocabulary instance 03195.
segmentation, 2019. URL
[77] Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Kamali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, Tom Duerig, and Vittorio Ferrari. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. International Journal of Computer Vision, 128 179119,6-1881, March 2020. ISSN 1405- doi: 10. 10.1000//1166-0200 223-000-00036--- URL http://dx doi org/ 10. 100.11007/111200 0000--22---11100 021112222200000001---2---
[78] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Ng. Reading digits in natural images with unsupervised feature learning. NIPS, 01 2011.
15

---

[79] Fisher Yu, Yinda Zhang, Shuran Song, Ari Seff, and Jianxiong Xiao. LSUN: construction of large-scale image dataset using deep learning with humans in the loop. CoRR, abs/1506.03365, 2015. URL CRRLhttp:://// http://arxiv http:/iwwwrg/a/////////oe
03365
[80] Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R. Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking, 2015.
httpthtttt:aaatt org/ abs/ 1504. 06755
[81]
Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby. Mahmoud Assran, Nicolas Ballas, Wojciech Galuba, Russell Howes, PaoYao Huang, Shang-Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Hervé Jegou, Julien Mairal, Patrick Labatut, Armand Joulin, and Piotr Bojanowski. Dinov2: Learning robust visual features without supervision, 2024.
[82] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale, 2021. URL httpthttss////aeee wrw. awrg/abs/2010 11929
[83] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows, 2021. URL
https://arxiv. org/ /tbb//2/33 14030
[84] Zhuang Liu, Hanzi Mao, Chao-Yua Wu, Christoph Feichtenhoffrr, Trevor Darrell, and Saining Xie. A convnet for the 2020s, 2022. URL htt.:tpp///ziii.orr///aaas wwtp:/orwggaaab......oo. 03545
[85] Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Large scale learning of general visual representations for transfer. CoRR, abs/1912. 2019. URL httt::/ttt::xiii wwwpxiiv.org//baa. wwwgg/a/////....a 19t.:.19112..111 11370
(86) Jingyang Zhang, Jingkang Yang, Pengyun Wang. Haoqi Wang, Yueqian Lin, Haoran Zhang, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, Yixuan Li, Ziwei Liu, Yiran Chen, and Hai Li. Openood v v1.5: Enhanced benchmark for out-of-distribution detection, 2023.
[87] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized dittiiiiiooonooiiii detection: A survey. CoRR, abs/21 1334, 2021. URL htt.ibttee//axxiiooo/////////// 11334
16

---

A Theoretical Analysis of SPROD
SPROD employs a two-step prototype refinement strategy to approximate group-specific represen- lations within each class. The first step creates new prototypes for misclassified training samples, motivated by the observation that minority group instances (those that deviate from dominant spurious patterns) are more prone to misclassification. However, some correctly classified minority samples may still be incorrectly assigned to biased prototypes.
To address this, the second step reassigns each training sample to its nearest prototype and recalculates prototypes based these updated assignments. This reassignment helps produce cleaner subgroup representations by reducing the influence of spurious-majority samples on minority feature structure.
By applying these two steps, SPROD aims obtain nearly pure group-specific prototypes. In the remainder this section, we provide a theoretical formulation to explain why such subgroup-specific prototypes improve robustness to spurious OOD (SP-OOD) samples.
A.0.1 Feature Decomposition
Without loss of generality, we assume a binary classification problem with classes c E {0, 1]. Each normalized feature embedding 2, E Rd We consider a general decomposition of 2; into three features. We model 2; linear combination of three functionally distinet components that span the embedding space:
input sample 2; mapped semantically distinct components: spurious, core, and irrelevant
SP
gcare 1
1i.
where the sets {u"") }. (u J, and {ū]") form orthonormal bases for the spurious, core, and irrelevant subspaces, respectively. Each set of coefficients {aTgh. {Brgee and {nlly) } is specific to instance i.
These subspaces span mutually exclusive semantic roles:
Spurious subspace: captures features correlated with the label during training but not causally predictive.
Core subspace: captures features that are causally predictive of the label.
Irrelevant subspace: captures features unrelated to the task.
By definition, the basis vectors across subspaces orthogonal: if an irrelevant basis vector were correlated with a core basis, it would be predictive and thus belong in the core subspace.
This decomposition can be expressed compactly in matrix form:
2, = U a
Ueaoe ccure
+ Uim 7
where each (+) pd is matrix of orthonormal basis vectors for the corresponding subspace, and each coefficient vector (e.g., a; E IR. "..") represents the coordinates of z; in that subspace.
A.0.2 Distributional Assumptions
We assume the coefficient vectors for each instance drawn from class-conditional distributions:
30
psp
B
core
peore
where p.P and peore are distributions over the spurious and core subspace coefficients for class c.
The irrelevant component is shared across classes:
im pin
17

---

A.0.3 Group Definitions
Within each class we define majority and minority groups based on the alignment of spurious features.
Majority group samples z; E Ste satisfy:
B,
scure
peere
Minority group samples 2 E Stmn satisfy:
pap
B
oore
peore
Let C. denote the number of samples class c, and St the number of majority samples. Then:
Smaa To
E [0
C.
quantifies the class-conditional spurious correlation strength.
A.0.4 OOD Sample Definition
OOD samples may contain components beyond the core, spurious, and irrelevant subspaces. To model this, extend the feature decomposition to include additional subspace (rea capturing external factors not observed during training. We define an OOD sample as:
USD &ooD + U
-ir TOOD + Uex Sext
FOOD
where 2.
-inr FOOD pir and gext is unconstrained. Hard OOD samples may also include gome core components drawn from a shifted distribution BOoD ~ Q + peare Although it is possible to analyze the general form with and external components, for simplicity we focus on near-OOD samples with no core or external components, i.e.,
P.P.
200D U. GODD
U wirr YOOD:
with gcure
Ö, zext Ö.
We define spurious- OOD groups based on the source of the spurious component:
SOOD
{
FOOD
OOD
psp
iir YOOD
pim J.
{0,
These near-OOD samples resemble class only through spurious features and match the in-distribution (ID) irrelevant component distribution.
A.0.5 Prototype Calculation
We define the expected coefficient vectors for each subspace:
core
E
Paae [3],
Ea [a),
nT
Eg 17].
Using these, we define the majority and minority subgroup prototypes for class E {0, 1) as:
mmaj Pe =
USp
sp ftc + U ccore
+ U
min
mmin Po
U p + U
f
-core
U wim
18

---

The overall class prototype is convex combination of subgroup prototypes:
P
rePe
mmaj
+ (1 re) Pe
min
where To E [0, 1] denotes the proportion of majority group samples class c.
A.0.6 Bias in Prototype Distances Under Strong Spurious Correlation
In standard prototype-based OOD detection, the class prototype Pe is a convex combination of majority and minority subgroup prototypes. In spurious-dominated regimes where = 1, we have:
Pe R P.
U pe + Ucore P + U
Case I: Spurious-OOD Sample. Let FOOD E SOUD be an OOD sample with spurious alignment to class but no core features:
ZOOD
U
dooD
U
TooD= with dOoD
Pip, FOOD pit
The expected squared distance to the biased class prototype becomes:
E
||| 200D
p-ll
Tr core spurious variance
11
11
TrE
irrelevant variance
Case 2: Minority In-Distribution Sample. Now consider an ID sample from the minority group:
Zmin
U.
Clmin
Uewo Bmin + U
mins
with:
mnin
Pip
peore
Amin ~ pir
--
min
Its expected squared distance to the majority prototype is:
&min
P
12]
1
Tr
Tr
spurious
variance
irrelevant
Key Insight: Although Amin is ID sample, its distance to the biased prototype includes a spurious bias term, while the OOD sample differs only in the core direction. Depending on the relative magnitudes of the core and spurious bias terms, this highlights the potential for erroneous OOD detection when prototype estimates are biased toward spurious features.
For example, in the Waterbird dataset, the background (water land) represents the spurious feature dimension characterized by distinct mean vectors ft and fT The difference || - -= may exceed the bias in OOD distances, causing minority samples with conflicting backgrounds to lie farther from prototypes than some OOD samples.
A.0.7 Why SPROD Mitigates Distance Bias
prototypes can be accurately estimated match each group's distribution, then each sample E Sy can be compared to its corresponding prototype p(2.) pg. where (maj. min).
Because the prototype shares the same spurious basis alignment, the spurious bias is eliminated. The expected squared distance becomes:
E [||= p(=))1 Tr(E."") + Tr(E"").
In contrast, the standard prototype-based approach introduces a systematic bias for minority samples:
F
Emin
p.
[
1. Tr(2."") + Tr(L"").
19

---

For an SP-OOD sample, the prototype it is compared against (either group) contains a core component it lacks, Hence the expected distance becomes:
E FOoD - pp1*] = || I Tr( + Tr(E"").
This is strictly greater than the refined ID distance, which includes neither the spurious bias nor the core bias term:
E [|00 -b1 > E [[|= p(=)]
Conclusion: SPROD removes the spurious bias term for ID samples and reduces overlap with OOD samples by accounting for their missing core features. This systematic (in expectation) bias elimination leads tighter ID clusters and more reliable OOD detection.
B Spurious Correlation in OOD Detection: Literature Review
This work [4] was the first introduce the problem of spurious correlations in OOD detection, showing that detection performance degrades as spurious correlation increases, especially for SP- OOD samples. It also encouraged the community to report results of OOD methods under this challenging setting. Recently, several works have addressed the challenge of spurious correlations out-o--diitributton (OOD) detection, employing different strategies that can be broadly categorized into outlier exposure based, training-time -time regularization, and post-hoc methods.
Outlier exposure based methods include RONF (21, which improves synthetic outlier generation and model fine-tuning using only ID data. It introduces Boundary Feature Mixup to create more realistic virtual outliers by interpolating near decision boundaries, and Optimal Parameter Learning to suppress spurious feature learning during training. At inference, it uses a custom Energy with Energy Discrepancy score better separate ID from OOD samples without relying on external OOD datasets. Similarly, KIRBY (22) generates hard negative samples by removing dlus-discriminative regions identified via Class Activation Maps (CAM) and inpainting these regions with background like content, creating semantically degraded but visually plausible images as surrogate OOD examples. lightweight rejection network trained on features from both clean and modified images enables strong OOD detection without requiring real OOD data or backbone retraining. Although not directly targeting spurious correlations, ImOOD 23 evaluates robustness under spurious settings, focusing on long-tailed datasets where class imbalance biases OOD detection toward frequent (head) classes. learns a bias correction term to shift OOD scores per input, improving separation especially for rare (tail) classes.
Training-time regularization methods seek to reduce reliance on spurious cues during model training. BackMix (24) regularizes models by mixing foreground objects with different backgrounds, breaking spurious correlations between objects and backgrounds. Using CAM to estimate foreground regions, it replaces background patches with those from other images while preserving labels, thus improving robustness primarily against background spuriousity. RW 25 introduces nuisance- aware training framework that reweights the training loss to reduce correlations between class labels and nuisance attributes. It further applies penalty based on the Hilbert- -chhmidt Independence Criterion (HSIC) to explicitly remove nuisance information from learned features, enhancing semantic OOD detection under shared nuisance conditions. NsED 26 decomposes images into semantic (phase) and style (amplitude) components via Discrete Fourier Transform, generating augmented samples by mixing amplitude spectra across images. Training with a robust loss that minimizes worst-case classification eтrоr over these augmented samples results in features less sensitive to style variations.
Post-hoc methods operate after model training to improve OOD detection. Projection Regret (PR) 27 uses partial diffusion and denoising to project inputs onto the ID manifold, measuring semantic novelty by comparing the original image with its projection. second projection step recursively removes background bias, isolating true semantic differences and enabling object-level OOD detection focused on meaningful changes rather than background similarity. CoVer [28] enhances detection by evaluating model confidence across multiple corrupted versions of the same input ge.g., fog, blur, contrast shifts). Instead of relying on a single prediction, it averages confidence scores over these variants, improving robustness.
20

---

Finally, several zero-shot OOD detection approaches, while not explicitly targeting spurious correla- tions, report results under limited spurious settings. Maximum Concept Matching (MCM) [29] leverages CLIP's s vision-language embeddings for zero-shot detection without fine-tuning or extra data. Each ID class is represented by text prompt encoded as a concept prototype, and test images are scored based on cosine similarity with these prototypes. A softmax scaling sharpens distinctions between ID and OOD samples. Another zero-shot multimodal method [30] improves performance by prompting large language model to generate rich descriptors for each ID class, filtered by consistency on retrieval tasks to reduce hallucinations. It combines CLIP-based similarity scores between test images, filtered descriptors, and detected object labels to compute robust matching score. NegLabel [31] defines negative labels semantically distant from ID classes and computes baftmax-baseed similarity scores that favor ID labels while penalizing negatives, optionally averaging over label groups to reduce noise. Lastly, CMA [32] embeds both ID class labels and neutral, class-agnostic Agents in shared semantic space, leveraging triangular similarity relationship to reduce confidence on OOD images while maintaining high confidence on ID data.
Together, these approaches represent diverse strategies to tackle the spurious correlation problem in OOD detection, from data augmentation and loss regularization to post-hoc corrections and zero-shot semantic reasoning.
While existing approaches have made significant strides in mitigating spurious correlations in OOD detection, each comes with certain rrde-ooffs and constraints. Outlier exposure and training- time regularization methods often involve non-trivial training overhead, including access to auxiliary data or retraining backbone models with certain objectives, which limits their practicality in deployment settings. Moreover, some of these methods, such as Mic (24), primarily address specific types of spurious features (e.g., background), which may not generalize to more complex real-world scenarios involving multiple or less structured spurious cues. Post-hoc methods offer a more efficient alternative by avoiding retraining and operating directly pre-trained models. However, many still rely on careful tuning of multiple hyperparameters or complex transformation pipelines (e.g.. Cores'' corruption sets (28] or PR's s iterative projections (27)), making them sensitive to design choices and dataset specifics. Furthermore, several zero-shot approaches utilize Easion-language models like CLIP, benefiting from rich semantic priors but introducing dependencies on text prompts and external descriptors, which can be limiting when only visual features are available or when text-image alignment is imperfect.
C Comparison with SP-OOD Methods
Most existing OOD detection methods are not directly comparable to SPROD, as they often rely on different assumptions, such as access to auxiliary OOD data, or necessitate retraining the feature backbone with specific objectives. These design choices contrast with SPROD's post-hoc nature and its objectives of simplicity, efficiency, and broad applicability without model retraining, Nonetheless, to provide a broader context, we include results from a selection of methods that, while not perfectly aligned, have been evaluated under similar SP-OOD conditions. For fairness and consistency, we report the results as published in their original papers, rather than re-implementing them, thereby representing each method according to its best-reported performance. As shown in Table 4 under the most comparable conditions presented, SPROD achieves highly competitive performance, notably without requiring model retraining (when using a ResNet-18 backbone, as applicable to some comparisons) or access to an auxiliary text modality (in the case of methods leveraging CLIP).
To further investigate the sample efficiency of SPROD, conduct low-shot experiment using feature embeddings from a frozen CLIP ViT-B/16 vision encoder, evaluated on the Waterbirds dataset. Two experimental settings for spurious correlation are considered: a 50% correlation rate (where majority and minority group sample sizes are equal) and 90% correlation rate (where majority group samples are nine times more numerous than minority group samples). Within each setting, we vary the number of available samples per minority group and evaluate performance using both Euclidean and cosine distance metrics for score calculation. The results are presented in Figure 7 Initially, with very few samples per minority group, the 90% correlation setting exhibits slightly higher performance, which may be due to the larger initial population of majority group samples aiding prototype stability. However, as the number of samples per minority group increases (e.g., to four samples), the 50% correlation setting surpasses the 90% setting in performance. Notably, the performance in both sow-shot variants quickly becomes competitive with the performance achieved
21

---

Table 4: A comparative analysis of AUROC and FPR@95 performance metries for different methods and models evaluated on the Waterbirds dataset. To ensure a fair comparison, we report our results using both the pretrained CLIP and ResNet-18 models, aligning with the settings of the compared methods.
Method
Backbone
AUROC
FPR@95 L
Notes
Backmix 24
Energy
Nede
80.6
81.7
ImOOD
83.27
$7.69
RW 25
MD
ResNet-18
<90
Exact AUROC not clear from plots
SPROD
98.28
7.27
CoVer 28
90.52
33.17
Also reports MCM: 90.31 25.66
MCM 29
98,36
5.87
Dai et al.
30
98.62
4.56
CLIP-B/16
Neglabel 31
94.67
9.5
Also reports MCM: 93.30 / 14.45
CMA 32
99.01
3.22
SPROD
99.01
2.94
Low-Shoi 0CD Delect with Embeddingg
Low Shot DCD Dececiion with Embeddingg
Diiore Mini
14.2%
Coers Cata
48.0
A.002
40.0
87.0
Compaton
Ciaarco Maric
Mumberr Stallpper Mineity Crow
Numbor Shits Mevority Group
(a) AUROC
(b) FPR
Figure 7: Low-shot SP-OOD detection performance of SPROD on the Waterbirds dataset using features from frozen CLIP ViT-B/16 vision encoder. Performance (AUROC and FPR @95) is shown as a function of the number of samples per minority group for two spurious correlation rates (50% and 90%) and two distance metrics (Euclidean and Cosine). Dashed lines indicate performance with the full training set.
Low Chhl OCD Derection Softrex Scoms
Low-Snil 0.0 Detecion wit Softaa Scorss
100
Colire (nert) Caliner Eaildorn pmoiin)
60
20
60
4.800
70
40 Sptr a: Caodeed (rark)
2
10
Choop
AUROC
(b) FPR@95
Figure 8: Impact of softmax normalization on low-shot SP-OOD detection performance of SPROD on the Waterbirds dataset using features from a frozen CLIP ViT-B/16 vision encoder. OOD scores derived by applying softmax to the negative distances. Performance (AUROC and FPR (95) is shown as a function of the number of samples per minority group for two spurious correlation rates (50% and 90%) and two distance metrics (Euclidean and Cosine). Dashed lines indicate performance with the full training set using coftmax-normalle scores.
using the full dataset, underscoring the sample efficiency of the prototypical approach, even with CLIP features.
We extend this low-shot analysis by examining the impact of applying a softmax normalization to the bistance-based OOD scores. Figure 8 illustrates the results of this modification. A considerable
22

---

performance degradation is observed when softmax normalization is applied to the distance scores, further highlighting the potential sensitivity of dettmax-basee scoring mechanisms. In this softmax- normalized setting, Fuclidean distance appears to yield relatively better performance compared to cosine distance, an observation that differs from the direct distance-based scoring results shown in Figure 7 where both distance metrics performed equally.
D Dataset Details and Examples
Datasets available for studying spurious correlations are generally limited. In the context of OOD detection, this limitation becomes even more pronounced, as the task requires datasets with SP-OOD samples. As a result, the datasets employed must be thoughtfully considered to ensure meaningful evaluation. In this study, our goal is to address broader range of spurious features present in data, beyond just background features. A distinctive aspect our experimental design is the inclusion of three additional settings to explore:
Multi-spurious feature setting: Scenarios where multiple spurious features (e.g., both background and co-occurring objects) are simultaneously present, increasing the complexity of the detection task. To the best of our knowledge, this is the first time such a setting has been explored in the context of OOD detection.
2. Multi-class setting: Scenarios with more than two classes, where inter-class relationships and spurious correlations introduce additional challenges.
3. Realistic dataset setting: Beyond existing datasets in the literature, where spurious correla- tions are often predefined and controlled, we also focus on scenarios leveraging realistic datasets such as AnimalsMetaCoCo and Sp-ImageNet100 [36]. These datasets include
diverse spurious correlations and more closely mimic real-world data distributions.
These aspects are relatively underexplored in the context of SP-OOD detection. By incorporating these settings, we aim to demonstrate the effectiveness of our proposed approach.
To evaluate the proposed approach, used the following datasets:
Waterbirds 17 This synthetic dataset is generated by combining the CUB 774 (bird classes) and the Places [69] (background scenes) datasets for a binary classification task, with labels E /waterbird, landbird]. Spurious correlations are introduced between the background E { (water, land] and the label. The dataset consists of four groups, depicted in Figure 9 with the minority and majority groups highlighted by red and green borders, respectively. Two different correlation values, E {0.5, 0.9), are employed, where r denotes the probability that the environment aligns with the label y. Specifically, we have:
P(e water y waterbird) P(e land y landbird).
The distribution of samples within each group and class is provided in T For SP-OOD, select samples from the Places dataset [69]. following the previous works 14 25
This dataset is used for a binary classification task with labels E (blond hair, non-blond hair), where spurious correlations with gender E (male, female) are present. It is real-world dataset, making it suitable for evaluating models in realistic settings. In the dataset, most females have blond hair, and most males have non-blond hair, forming the majority groups, as shown in Figure 10 with colored borders. The minority groups are the opposite combinations. The distribution of groups across classes with varying correlation levels is presented in Table 6 In this setting, SP-OOD samples are those with no hair, but still exhibiting the spurious gender-related features. For our SP-OOD samples, we used bald males, who lack core features but retain spurious (gender) cues.
CelebA
34
UrbanCars 351: This dataset, introduced in [35. is synthetically generated by combining the Stanford Cars dataset [75] (which includes both urban and country cars) with co- occurring objects from either urban or country environments, sourced from the LVIS dataset (76). The co-oceurring objects are positioned to the right of the cars, and both the car and the object are placed onto background images from the Places dataset (99 representing either urban or country scenes. The dataset is considered particularly challenging due to the presence of two spurious features. By varying the combinations of cars, co-occurring
23

---

objects, and backgrounds, the dataset is divided into eight distinct groups, as illustrated in Figure [T] Notably, the "all-country" and "all-urban" groups dominate the dataset, while the other groups are underrepresented, as highlighted by the border colors. The exact number of samples in each group of our generated dataset, which exhibits a 95% correlation, detailed in Table 7 with two groups being especially underrepresented. For the SP-OOD analysis, we sample combinations of backgrounds and co-occurring objects, called the BG & CoObj setting, as well as backgrounds alone, referred to as the BG setting, In the results section, we reported the more challenging scenario(BG & CoObj) as presented greater difficulty, expected.
AnimalsMetaCoCCo To create multi-class, multi-valued spurious attribute setting that reflects realistic and challenging scenarios, we selected a subset of 26 animal classes from the MetaCoCo dataset [7]]. The samples were first cleaned through relabeling, removal of duplicates, and deletion of irrelevant images. Subsequently. we defined subattributes to create a total of major concepts for modeling attribute imbalance and spurious features, as illustrated in the first Figure of the paper. We introduce this new dataset as AnimalsMeta- CoCo, refined subset tailored for multi-class, nulti-valued spurious feature scenarios. Details of the classes, attributes, and group sample distributions are provided in Table g This dataset represents a more realistic scenario, where each class associated with at least one spurious feature similar to those present in ID data. While the strength of spurious correlations may not as pronounced as in the other three datasets, AnimalsMetaCoCo introduces several unique and challenging aspects. Specifically, its spurious attributes can take on multiple distinet values, each exhibiting varying degrees of imbalance across classes. Moreover, the class distributions themselves are inherently imbalanced. To construct SP- OOD scenarios, we adopt a leave-2-out strategy: in each round, two classes are treated as SP-OOD, characterized by semantic shifts while retaining at least one spurious attribute shared with ID data, and the remaining classes serve as ID. This setup significantly increases the difficulty of the detection task due to overlapping spurious patterns across environments.
Sp-ImageNet100: We evaluate models on the Spurious ImageNet (SpI) dataset introduced in [36]. This dataset contains real-world images (from Openlmages [77] and Flickr) that include only spurious features, such as bird feeders or graffiti, without the actual class object. These images are consistently misclassified as specific ImageNet classes, revealing harmful spurious correlations.
SpI focuses on 100 ImageNet classes (we call Sp ImageNet100) where such correlations are prevalent. The authors distinguish between two types of harmful spurious features:
Spurious Class Extension: A spurious feature alone causes a class prediction (e.g.. bird feeder -> humminghird).
Spurious Shared Feature: feature shared across classes biases prediction toward one due to imbalance (e.g., water jet + fireboat over fountain).
We note that most spurious features in Spl are of the class extension type. This is less aligned with our goal of identifying underrepresented groups based on shared spurious features and misclassification signals (20), and without group supervision.
Nevertheless, we include Spl as a challenging, naturally occurring OOD benchmark for evaluating model robustness spurious correlations.
For NSP-OOD, we utilized the SVHN 78 LSUN 79..
and iSUN 80 datasets, which are commonly
employed in prior works 14 25 These datasets are used consistently as NSP-OOD for all the mentioned ID datasets.
E Performance on Non-Spurious OOD Datasets
We evaluate the performance of post-hoc methods in the non- con-spurious OOD (NSP-OOD) detection setting. For this evaluation, the OOD samples are drawn from a collection of standard benchmark datasets: SVHN 78. LSUN (resized)(79), and iSUN 8O) The ID context for each evaluation varies across the five datasets used in our primary spurious correlation experiments: Waterbirds (WB), CelebA (CA), UrbanCars (UC), Animals MetaCoCo (AMC), and Spurious ImageNet (SpI). Specifically, for each of these five ID contexts, the pretrained ResNet-50 backbone is employed, and
24

---

y: waterbird water
y: waterbird land
Spurious OOD-land
y: landbird e: water
y: landbird land
Spurious OOD-water
Figure 9: Representative examples from the Waterbirds 17] dataset. The dataset consists of four groups: (Waterbinl, Water), (Waterbird, Land), (Landbird, Water), and (Landbird, Land). Minority groups, indicated with red borders, are underrepresented, while majority groups, indicated with green borders, are more prevalent. Spurious OOD samples include only background features (land or water) without core bird-related features.
TELEVIS
AWAR
ation's
and
y: blond hair e: female
y: blond hair e: male
Spurious OOD-female
DGA HONO
rk C
DRS
iry
y: non-blond hair e: male
y: non-blond hair e:
male
Spurious OOD-male
Figure 10: Representative examples from the CelebA 34 dataset, which is divided into four groups: (Blond hair, Female), (Blond hair, Male), -Non-blone Female), and (Non-blond, Male). Minority groups, marked with red borders, are underrepresented, while majority groups, highlighted with green borders, are more prevalent. Spurious OOD samples contain only spurious features (gender) without core hair color attributes.
25

---

Table Group-wise distribution of the Waterbirds 17 training set across land and water attributes at varying correlation levels. The distribution reflects the degree of alignment between bird classes (landbird waterbird) and their respective backgrounds, with higher correlation level indicating stronger dependence between the bird label and the background.
Correlation
SP-Feature
Landbird
Waterbird
Total (Row)
Land
544
1853
2397
50%
Water
545
1853
2,398
Total (Col)
1089
3706
4795
Land
997
369
13366
90%
Water
111
3318
3429
Total (Col)
1108
3687
4795
Table 6: Distribution of the CelebA 34
training set across male and female attributes varying correlation levels. The correlation levels indicate the strength of the spurious relationship between gender and the presence of blond hair, with higher correlations reflecting stronger association between these attributes in the dataset.
Correlation
SP-Feature
Blond
Non-blond
Total (Row)
Malc
1387
1387
2774
50%
Female
1387
1387
2774
Total (Col)
2774
2774
5548
Male
296
2468
2764
90%
Female
2474
310
2784
Total (Col)
2770
2778
5548
Table 7: Distribution of Urban Cars
35 training samples with 95% correlation across groups,
categorized by background and co occurring object features within each class. This dataset features six minority groups out of eight possible combinations, highlighting its challenging nature due the underrepresentatiin of most groups
SP-Features
Country Car
Urban Car
Total (Row)
Country BG, Country CoObj
3606
10
3616
Country BG. Urban CoObj
190
190
380
Urban BG, Country CoObj
190
189
379
Urban BG, Urban CoObj
3605
3615
Total (Col)
3996
3994
7990
the post-hoc OOD detection methods are subsequently set up using the features derived from this backbone.
The performance metrics reported in Tan TQ the average performance when distinguishing each ID dataset from the NSP-OOD samples, averaged across SVHN, LSUN, and iSUN. This setup assesses the general OOD detection capability of the post-hoe methods when the primary challenge is not spurious correlations shared between ID and OOD, but the ID datasets still contain inherent biases. As observed in the tables, distance-based methods such as SPROD and KNN consistently achieve near-perfect scores across all metries (AUROC, @95, AUPR-In, and AUPR-Out) and ID contexts. Other methods like VIM and MDS also show strong performance.
F
Ablation Study on SPROD Stages
To understand the contribution of each stage in our proposed SPROD method, we conduct an ablation study, We evaluate the performance of:
Stage 1: Initial Prototype Construction
26

---

Table 8: Group-wist distribution of 26 selected animal classes from the MetaCoCo
71
dataset called
Animals MetaCoCo across various environments.
Class AAttribute
at home
autumn
dim
grass
in cage
on snow
rock
water
Total
bear 284
0
109
76
219
0
98
362
962
cat cow crab dog
159
150
121
386
1736
57
137
119
693
122
38
221
1387
0
0
43
73
0
153
102
371
106
221
174
561
111
208
145
440
1966
dolphin
0
0
113
15
425
553
elephant
108
98
247
434
38
375
1359
fox
0
195
62
367
66
160
136
145
1131
frog
0
232
3
530
0
322
342
1429
giraffe
0
479
150
397
78
227
1331
goose
105
135
378
83
263
1018
horse
57
366
128
672
129
59
457
1868
kangaroo
0
84
190
214
0
55
61
97
701
lion
0
560
58
537
36
79
275
171
1716
lizard
0
130
42
303
35
302
242
1054
monkey
183
84
592
76
100
463
255
1753
ostrich
0
164
125
235
159
76
73
144
976
owl
0
141
147
131
36
92
78
87
712
rabbit
0
147
31
637
105
134
91
73
1218
rat
0
123
66
392
seal
0
57
31
158
19
266
240
547
1318
sheep
0
626
30
865
0
99
207
237
2064
squirrel
0
212
32
418
132
188
118
1100
tiger
0
212
14
435
66
176
236
323
1462
tortoise
129
140
284
234
944
wolf
0
192
97
198
90
151
188
188
1104
Total
722
4938
2421
9893
1000
2279
3845
6527
31625
STOP
STOP
y: country
y: country el: country bg e2: urban obj
y: country el: urban bg e2: country obj
y: country
Spurious OOD
BG CoObj urban bg
el: country bg
el: urban
BG
e2: country obj
e2: urban obj
urban bg
urban obj
urban urbun
urban el: urban bg
urban car
Spurious OOD BG country bg
BG & CoObj country bg country obj
el: country bg e2: country obj
el: country bg urban obj
el: urban bg
e2: country obj
urban obj
Figure 11: Representative examples from the UrbanCars (35] dataset, which has 8 groups. each pairing country and urban car classes with two spurious features: background and co-occurring object, both of which can be urban country related. The "all-country" and "all-urban" groups (green borders) dominate the dataset, while the remaining groups are significantly underrepresented (red borders). Spurious OOD samples, containing only spurious features (no cars), consist of combinations of background and co-occurring objects (BG & CoObj) as well as background-only (BG) samples.
27

---

Table 9: Average NSP-OOD detection performance (AUROC and @95) using ResNet-50 backbone. Cell values are performance metrics averaged over SVHN, LSUN, and iSUN as OOD.
AUROCA
EPR@95L
Medhod
Spl
Avg
Method
WR
CA
UC
AMC
Spl
Avg.
MSP
26....
77.5
52.6
v2.6.11
04.9
MSP
76.5.1.
35.0,n
g6.1g1
34.8
07.8
Energy
85.0.a.
T5.4s6.3
63.2
07.7a8-3
Energy
74.5
S1.4-145
90.8
19.0
13. 13.4.1.2
56.0
MLS
N0-7-42
70.4
96.2
96633...3
MLS
15..8...
26.3
24.5...3
61.6
KLM
67.7
62.5
47.0g11
90.1
966.
80.5.1
05.5
67.8
25.5.1-3
CiNom
70.8
64.1
07.3
89.0ge.
GNomm
66.4.9.7
85.2
u3.2....
13.8.9
4.8.0.3
52.7
06.1
20.0
96-3
99.0
75.8
REALE
T3.0
91.6
23.3
4.3-2.0
56.1
VIM
100.0.10
10000022 23.0
20.6
16.0
Bani
90:8
VIM
0.0.0.0
0.0 10.0
1.9
0.0 10.0
0.0
01.8
MDS
10000...
100.0
20.0
100.0.c0
07.5 07.5
05.4
MDS
0.0
0.8.0.0
0.7.00
11.9
2.5
RMDS
58.6.34
08.5
1233
20.
33.0
73..2
RMDS
90.5.n6
69.2
95,4
51.3
17.7
08.8
KNN
100.0.10
1000:000
10000
20.0
100.0.00
100.0.0.
99.8
100.0
KNN
0.0
0,0
0.0.000
0.0
01.1
SIE
96.4 233
98.6 4G22
g9.1
94.3
g8.
97.4
15.9
7.0l...
12.1
SPROD
100.0
100.0
mm.0
100.0.c.
100.0
99.9.c.
100.0
SPROD
2010
0.0
Table 10: Average NSP-OOD detection performance (AUPR-In and AUPR-Out) using a ResNet-50 backbone. Cell values are performance metrics averaged over SVHN LSUN, and iSUN as OOD.
AUPR-IN,
AUPR-OUT!
Method
WB
CA
UC
AMC
Spl
Avg.
Methol
WB
UC
Spl
MSP
85.5.0.
67.7.1.4
48.4
06.0...
70.7
MSP
$5.82:.9
65.9.mm
65.0.m11
85.4
03.9..s
17:2
Energy
A0.5
60.2.1.0
44.2
585 28
117.3
50.4
Energy
56.4
85.6..ca
05.3..5
92. 92.6.c..
07-5.03
19.3
MILS
85-2e1
60.5.1.
43.0
06.0
96.S.e.3
50.2
MI.S
96.3.12.3
84.7
65-7.n.5
91.S1c.4
05.7
18.7
KLM
77.3
97.8,3a
$4.421.3
53.9.x1
96.6.s.4
06.0
KLM
38.4::.7
76.9.009
62.7.xm
70.6
70.5
GNorm
07:2
49.7.3.5
59.6.22
08.4.s1
09.0as.
GNNorn
65.1.:.7
71.1.1.5
90.2
82.6
ReAct
06. 08.821.5
65.9.44
40.6
06.0
16.0..10
00.0ce.1
77.5
57 97.9-10.5
78.6-74
63.0gxc
91.820.7
00.0.33
18.5
VIM
100.0
100.0
50.2.m.
100.0.03
00.7
09:8
VIM
100.0
100.0
09.8
90.9.c.
00.2 00.2.a.
09.8
MDS
106.0
100.0.00
MIDS
100.0
100.0
100.0.03
98.811.
96.5.0m
99.1
RMDS
78.0
35.8.66
RMDS
31.3.1.3
81.8
64.0.x
50.5
71.4
KNN
1000
100.0
KNN
100.0
108.0.00
100.0.03
100.0
108.0
08.7
58.6
20.6
S11
91.6
09.5.m
96.0
08.3..9
SPROD
100.0
99.9.cm
SPROD
100.0
100.0
100.0
90.9.cm
100.0
100.0
Stage 2: Classification Aware Prototype Calculation
Stage 3: Group Prototype Refinement
For this analysis, we select the Waterbirds dataset, as its synthetic nature allows for precise control over spurious correlations and clearly exemplifies the SP-OOD challenge by design. We evaluate on two versions of Waterbirds: one with a 50% spurious correlation rate (where spurious features are less effective) and another with a 90% correlation rate (representing strong spurious bias). Experiments are conducted using features from pretrained ResNet-50 and ResNet-18 backbones, without fine-tuning on Waterbirds, to isolate the effect of the prototype refinement stages.
The results of this ablation study are presented in Figure 12 Figure 13 As seen, the performance of the simple initial prototypical approach (Stage 1) performs competitively, especially on the 50% correlation setting. This suggests that a basic prototypical method, which computes distances to class means in feature space, is a competitive baseline for OOD detection that has been somewhat overlooked in existing literature. When the spurious correlation rate is increased to 90%, we observe a general reduction in OOD detection performance across all three variants. This is expected, as stronger spurious correlations make it more difficult to distinguish true class features from misleading cues. However, Stage 3 (the full SPROD method) is significantly more robust to the increase of spurious correlation.
G Backbone Experiments
To assess the generality and robustness of SPROD across different neural network architectures, we evaluate its performance using wide range of feature backbones. This analysis complements the main paper's results, which primarily rely on ResNet-50 [68], and demonstrates that our method remains effective across both convolutional and wansformer-basee representations.
We include a comprehensive selection of backbones commonly used in the OOD detection liter- ature. This includes all major variants of the ResNet [68] family, ResNet- 18 (R18), ResNet-34 (R34), ResNet-50 (R50), and ResNet-101 (R101), owing to their widespread adoption and varying representational capacities. Alongside these, we evaluate several modern transformer-basee architec- tures with diverse embedding sizes and training paradigms, such as the self-supervised DINOv2-S (DINOv2) [81), the standard supervised ViT-S (VIT) (2) and more hicrarchical or data-efficient
28

---

AUROC across SPROD stages
FPR across SPROD slages
SPao Strge
SPA2O Shyer
26.2
SPADD
SPROD
SPROD-2
SPROD-2 2
00.2
SPROD-3
SPROD 3
AURCC (Iro0) can 5181
FRRgOO (mean
20.4
4.-
26.2
06.2
5-50%
r-90%
5=50%
r-90%
(a) AUROC
(b) FPR
Figure 12: Ablation study of SPROD stages the Waterbirds dataset using ResNet-50 features. Results are shown for two spurious correlation settings: 50% and 90%.
AUROC SPROD
FPR@95
SPROD stages
SPRCO Stape
SPRCD Suge
00.0
SPROD-1
SPROD-1
SPROD-2
SPROD-2
$8.6
68.4
AUROC
FFROyOS
68.2
$7.0
n 50%
F- 90%
r=50%
r- 90%
(a) AUROC
(b) FPR@95
Figure 13: Ablation study of SPROD stages on the Waterbirds dataset using ResNet-18 18 features. Results are shown for two spurious correlation settings: 50% and 90%.
designs like Swin-B (Swin) [83 DeiT-B (DeiT) (BiT) [85].
82 ConvNeXt-B (CvNXt) 84). and BiT-R50x1
We analyze the performance of each method using four complementary metrics (AUROC, FPR@P AUPR-IN, and AUPR-OUT) to evaluate different aspects of OOD detection performance. Tables [T]
12
and 14 summarize the performance of our post-hoc method across various backbone archi- tectures, averaged over the five SP-OOD datasets studied in this work. Detailed results for each individual backbone across the different datasets are presented in the subsequent tables.
13
Overall, observe that SPROD consistently achieves strong performance across all backbone architectures, often with a notable margin. KNN emerges as the second-best method, suggesting that simpler approaches can be counterintuitively effective; however, its performance is highly sensitive to the choice of hyperparameters. MDS is also among the top-performing methods; it is a metric- based approach similar SPROD but employs a more complex model by estimating class-specific covariance matrices. This added complexity, while potentially beneficial, may increase the risk of overfitting, especially in OOD settings. In addition, output- based methods show notable drops in performance on several benchmarks, highlighting their susceptibility to distributional shifts. Notably, SPROD the only method that maintains stable performance across evaluated settings, without experiencing major degradation under any backbone or dataset configuration. Among the evaluated backbones, ConvNeXt-B and Swin-B stand out as frozen feature extractors with superior performance for host-hoc OOD detection.
29

---

Table 11: AUROC performance of evaluated methods across various backbone architectures.
Results are averaged over five SP-OOD datasets.
Method
R18
R34
R101
DINOv2
ViT
Swin
DeiT
CvNXt
BiT
Avg.
MSP
61.1
61.9
61.9
63.3
70.2
65.4
70.8
69.7
72.0
65.0
66.1
Energy
61.5
61.6
61.3
62.7
70.5
65.8
70.4
70.0
71.5
64.7
66.0
MLS
61.7
61.9
61.6
63.1
70.5
65.8
70.7
70.1
71.3
64,8
66.2
KL.M
56.6
58.8
60.7
61.5
70.2
64.5
68.6
62.4
69.3
60.6
63.3
GNorm
64.3
64.2
64.7
66.4
69.9
66.4
56.7
62.1
67.8
54.2
63.7
ReAct
62.4
64.7
64.1
70.0
67.3
72.1
69.8
70.7
60.5
VIM
66.1
68.0
69.3
72.1
78.2
73.5
77.6
72.9
80.0
77.8
73.5
MDS
65.6
70.5
72.2
74.2
83.1
82.9
80.0
71.3
84.8
84.2
76.9
RMDS
54.8
57.2
60.2
58.3
63.3
61.1
69.6
65.5
69.5
66.5
62.6
KNN
77.7
78.6
80.3
79.9
79.7
80.3
84.3
78.9
86.1
81.6
80.7
SHE
69.4
72.4
68.4
73.5
83.0
79.8
84.9
81.8
84.6
73.5
77.1
SPROD
83.0
83.2
85.1
85.9
87.2
85.1
90.1
84.6
89.8
87.1
86.1
Table 12: FPR performance of all evaluated methods across various backbone architectures.
Results are averaged over five SP-OOD datasets.
Method
R18
R34
R101
DINOv2
Swin
DeiT
CvNXt
BiT
Avg.
MSP
90.8
88.9
88.4
86.5
81.1
86.4
71.7
80.4
67.8
84,2
82.6
Energy
88.5
86.9
88.9
87.5
77.9
84.9
73.7
78.6
68.2
82.8
81.8
MLS
89.6
87.4
88.5
86.8
78.3
84.9
71.5
78.2
67.8
82.7
81.6
KLM
91.3
90.3
88.3
87.4
80.6
85.7
72.6
80.5
66.8
83.5
82.7
GNorm
86.1
84.0
83.8
82.9
80.2
85.3
79.2
82.3
70.7
87.7
82.2
ReAct
85.6
84.4
84.0
83.5
78.3
86.8
72.6
78.3
69.4
86.1
80.9
VIM
83.0
81.9
78.5
74.3
56.7
75.0
68.3
82.6
47.4
61.8
71.0
MDS
82.0
80.8
73.5
67.7
51.4
61.9
70.7
82.6
50.4
48.4
66.9
RMDS
93.2
92.2
91.6
89.4
81.0
83.8
72.9
85.2
67.7
82.2
83.9
KNN
64.7
62.4
58.4
57.3
51.8
66.7
53.4
71.9
46.9
51.0
58.5
SHE
68.2
65.7
70.5
67.0
54.2
63.1
46.4
66.9
50.5
74.0
62.6
SPROD
53.1
54.6
49.0
46.6
43.0
51.1
35.3
55.1
35.2
42.9
46.6
H Analysis of Mixture of Prototypes
To evaluate the role of prototype augmentation and refinement, here we analyze two new variants of SPROD, comparing them against standard method (referred to SPROD-Defaul in this section). The first is PPRnDs, a clustering baseline where embeddings of training samples within each class are clustered using K-Means. The number of centroids per class is set match the number of group prototypes that SPROD-Defaul would derive. This tests whether the benefits of SPROD- Default stem solely from using multiple prototypes per class or from its proposed classification-drivee refinement strategy. Recent works, such as Prototypical Learning with a Mixture of Prototypes (PALM) [56], demonstrate the importance of multiple prototypes capture intra-class diversity. SPROD-Kmeans serves as a simpler post-hoc method based on the K-Means algorithm in this context.
We also introduce SPROD-Converge
which iteratively refines the group prototypes derived from SPROD-Default's Stage by repeatedly applying the Stage 3 reassignment and recalculation steps until centroid convergence, similar the K-Means algorithm. The centroid initialization mechanism distinguishes SPROD-Converged from SPROD-Kmean Kmeans, where K-Means clustering is typically initialized using method like K-Means++ directly the raw class samples.
As shown in Tables 35 and 36] SPROD-Defaul generally outperforms the two other variants when the amount of spurious correlation in the ID data is high (e.g., Waterbirds, CelebA, and UrbanCars); on other datasets, their performances are competitive. Proto-KMeans slightly less effective in separating SP-OOD samples, likely due to its reliance on purely geometric clustering, whereas SPROD with classification-awwe refinement slightly enhances the robustness when the spurious correlation is high.
30

---

Table 13: AUPR-IN performance of evaluated methods across various backbone architectures.
Results are averaged over five SP-OOD datasets.
Method
R18
R34
R101
DINOv2
Swin
DeiT
CvNXt
BiT
Avg.
MSP
48.4
49.3
49.8
50.9
59.3
54.4
61.1
59.0
64.1
51.3
54.8
Energy
47.9
48.3
48.7
50.1
59.9
54.8
59.3
58.7
63.1
50.4
54.1
MLS
48.4
48.6
49.3
50.6
59.2
54.8
60.1
59.0
63.0
50.6
54.4
KI.M
41.0
43.8
45.2
45.2
56.1
49.3
52.4
48.4
52.8
45.5
48.0
GNorm
50.3
50.2
$1.0
51.3
58.5
55.5
38.8
42.9
51.5
40.5
49.0
ReAct
49.9
50.7
52.7
53.1
59.6
63.0
59.3
62.6
47.8
VIM
51.6
53.9
55.4
59.7
66.7
62.1
68.9
63.1
72.5
64.4
61.8
MDS
52.2
60.2
61.6
64.1
71.8
74.5
72.0
60.8
77.0
75.3
67.0
RMDS
42.2
45.3
45.1
45.5
50.2
49.5
59.0
53.7
59.2
48.8
49.9
KNN
63.6
68.0
67.7
64.6
70.8
74.6
69.2
76.5
69.8
69.1
SHE
52.8
57.2
52.5
56.6
75.1
71.5
75.0
73.5
80.1
61.2
65.5
SPROD
72.7
74.0
76.5
77.1
78.9
77.1
84.1
76.5
84.3
78.3
78.0
Table 14: AUPR-OUT performance of all evaluated methods across various backbone architectures.
Results are averaged over five SP-OOD datasets.
Method
R18
R34
R50
R101
DINOv2
ViT
Swin
DeiT
CvNXt
BiT
Avg.
MSP
72.2
73.0
73.0
74.3
79.9
75.3
81.3
78.9
81.9
76.3
76.6
Energy
73.1
73.6
73.0
74.0
80.4
76.1
81.5
80.0
81.9
76.6
77.0
MLS
74.2
80.4
76.0
81.6
79.8
81.8
KLM
70.8
71.5
73.0
73.8
79.3
74.5
79.6
75.4
80.9
74.0
75.3
GNorm
74.3
74.8
75.0
76.1
79.5
76.0
76.1
76.6
79.2
71.8
75.9
ReAct
73.8
74.1
75.2
75.4
80.2
76.7
82.1
80.0
81.4
73.5
77.2
VIM
77.8
79.0
80.1
81.8
86.6
82.5
84.8
80.2
89.2
86.1
82.8
MDS
77.8
79.7
82.6
88.7
83.9
78.3
90.3
88.5
RMDS
68.9
70.4
71.8
72.4
76.4
74.0
79.8
75.7
80.7
74.9
74.5
KNN
85.6
85,9
87.4
87.7
89.4
86.9
90.7
85,8
91.1
89.5
88.0
SHE
80.1
82.6
79.1
82.6
88.3
86.4
90.7
84.6
87.6
82.4
84.4
SPROD
88.8
88.7
90.1
90.7
92.9
90.3
93.9
90.7
93.8
92.7
91.3
I Reproducibility and Resources
The data (cleaned AnimalsMeta dataset) and code for approach are available at the following GitHub repository: htttps://githie com//eeiaaeeZoorrab/ SPROD In our benchmarking, we utilized components of the OpenOOD v1.5 886 37 87 Iramework to obtain results for previously proposed OOD detection methods.
Our experiments were designed to be post-hoc and computationally efficient. All experiments were conducted on a single GeForce RTX 3090 Ti GPU, demonstrating the method's practicality in terms of resource requirements.
31

---

Table 15: AUROC and & performance of all methods using ResNet- the feature backbone.
AUROCA
FPR @95
Mathod
CAA
UC
Spl
Avg.
Method
WB
CA
AMC:
Spl
Avg.
MSP
68.1.07
4
72.420
17.3_..
MSP
88.7.n0
020.5
95.5un
50.2
81.7
90.8
Energy
09:4.4.3
4-.5
43.2
15.6_..3 ..a
61.5
Energy
65.7 k5.7
96.9
91.3
90.8 u0.4
77.9 1.3
83.5
MLS
69:2:38
16. 16.1aco
12. 42.7
z1.6
76.8-no
61.7
MLS
86.72w
97 8
93.0esa
90.3
80.3-06
89.6
KLM
43.9.005
41 41.1
57.7
68.2 08.2
-2.3_.64
56.6
KLM
91.2.105
95 020.5
95. 95.5.p
85.8
86.0
91.3
GNorm
81.9.63
42.
67.5_5. 48.5.n.1
62.0....
61.3
GNorm
85.9...
98.1
95.1go.3
91.4.0.1
00.1
86.1
75.9
40.8as57
44.0
-1.3
79.8
ReAct
62.0
26.0
92.1gaa
90.9
04.8-1.5
VIM
77:2:a0
63. a
-1
64.8_6.
66.1
VIM
68.0.5.
96. 1
71 71.45577
50.8 c0
80.8
83.0
MDS
74.4...1
15.9
00.1
20.5
44.9 40.9_..1
65.6
MDS
09.1..0
94.5
58.5un.5
92.8 20.3
91.9 00.0
$2.0
RMDS
06.3
37.1
g4.7
74.8
11.0
51.8
RMDS
95.0
97. 97.2 99.0
85.8
89.2
93.2
KNN
08.9.00
66.8..
92.1
73.3
70.3 -0.3--.1
77.7
KNN
26.
93-7.1.1
41:7a:1
55.7
77.2-609
64.7
SHE
47.4.0
74.2
52.3
82.3
27.7
68.4.0.1
56.6_6.5
68.2
98.3.n.
63.6.10
97.3.00
75.5 00.3
80.1.0.0
SPROD
7.3
91.8
18.8 Lo.4
00.4
07.9
Table 16: AUROC and @95 performance of all methods using ResNet- 34 as the feature backbone.
AUROCT
F9R
Method
CA
Spl
Avg.
Method
AMC
Spl
Avg.
MSP
66.0aar
41.9
42. y0.7
27.5
81.6...2
MSP
91.2.114
95 05.5
T3.7.22.5
Energy
64.9.sm
43.2
42. 42.0
28.2
79.4-.02
61.6
Energy
87.12292
97.35 2.
53. 58.1
$5.3 20.7
71.6
86.9
MLS
65.0.5.7
42.6 22.6....1
42.5 42.5
18.4
80.8
61.9
MLS
88.6.7.0
96. Onn.
94.1
S4.T.0.7
71.8.1.3
87.4
KLM
42.2:10
45.0c1.3
56.2.0.3
72.2
78.2-6.8
58.8
KLM
92.9-u.
96.4.so.
95.5
St.1oo.
80.0-2.7
90.3
GiNcem
77.9..m4
35.4.u0
50.0
73:7=::4
84.1 -..1
GNorm
#8.2....
98.52mm
95.3
52.1
84.0
ReAct
72.3.15.
34.4.5.
43.5
77.9
82.4
ReAct
86.2...s
96.3
94.5u44
85.5
69.6-1.7
84.4
VIM
80.8.4.3
50.3:52
62 (2.4
75.5
70.9
68.0
VIM
64.6...5
95.4g0.
72.2
89.7
87.8-0.3
81.9
MDS
86.7.00
60.8.08
80.8
61.4
64.8-..1
70.5
MDS
61.9
96-1an.
50 50.6am.1
93.8
03.8
80.8
RMDS
62.4
33.3
44.1
79.3
77.0
57.2
RMDS
94.2.n.1
g9.1
96.4go.1
63.5 a5.5
88.0
92.2
KNN
97.8.00
56.4.97
88.8.0.2
15.9
KNN
9.3gn.1
94.9:00.
50.2:0.3
73.6-661
62.4
SHF
87.0.02
40.8.
81.2
08.5
83.4.02
32.7.m5
06.62n2
00.5xx07
03.4
65.7
SPROD
98.2.00
61.4.10
95.3 1m
78.1 g04
83.0
SPROD
7.5 1o
94.5.0
31.6
78.4 m0
60.8_..
54.6
Table 17: AUROC and FPR @95 performance of all methods using ResNet-50 as the feature backbone.
AUROCT
Mathod
CA
UC
AMC
Spl
Aug.
Mathod
WB
CA
AMC
Spi
Avg.
MSP
02.3.n6
46.0
38.5 5
79.7 L0.4
63.1
61.9
MSP
87.9.ns
96.7in.
97 97.3
55.8
74.1 1..5
$3.4
Energy
62.0.
45.4 15.4
38
41a.1
79.0 u..
80.6
61.3
Energy
89.2.53
96.6
95.5 95.5un.1
84.8
76.3 0.0
88.9
MI.S
62.2,na
4
38 38-4
50.2
81.9
61.6
ML.S
88.12.0
98 88.8
96.72n0
24.4
74.6_..
88.5
KLM
51.2.07
41.7
57.0in
74.2
79.6
60.7
KLM
89.1.07
96.7
97.1.0.
80.5
70.1.1.7
88.5
GNorm
79.5..0
0.1.
46.6.0.4
-0.3
85.2 ...
64.2...
97. 97.1.n.1
uc.
54.7.0.6
ReAct
72.0
45.6.5.
4l.3gm
$0.1 204
83.6...7
64.7
ReAct
86.0.70
96.3 96.3
95 95.5g.17
53.9 m)
57.5_116
84.0
VIM
79.6.995
50.4ga.1
(0.7g177
78.6 --44
77.4_..
60.3
VIM
61.4
96-2.0.1
60.0g1.5
96-6 20.7
79.5 79.5_0.5
00.5
78.5
MDS
90.2
62.9 91.8
58.4
72.2
MDS
19.2 19.2
96.0
39.0
95.0
90.5
73.5
RMDS
59.4..1
33.6 23.6
47
$1.0-01
68.8
58.2
RMDS
91.7.009
09.61..
95 95.3
88.1
91.6
KNN
64.5
gn.
70.7
77.4_..
1.8
04.4g1
42.5
58.4
SHI
88.3
54.8 .0.7
6.1
33.2
46.4
76.5,n.3
93.9 60.3
6.8
SPROD
98.8....
61.6
97.4.00
82.4.1.
85.3
85.1
SPROD
4.7.1.
93.7.09
19.0
69.5
58.0
49.0
Table 18: AUROC and FPR@95 performance of all methods using ResNet-101 as the feature
backbone.
AUROC*
FPR@95
Mathod
WB
CA
UC
AMC
Spl
Avg.
Mithod
WB
CA
UC
AMC
Spl
Avg.
MSP
65.5
41.9
41.3
81.2
83.8...
87.7a07
95.5 2a.
$1.0
09.0-1.1
86.5
Energy
60.9..0
45.5gam
41.1g35
81.8
$1.3..14
Energy
90.4.50
96.2.on
95.2
79.2
14.4_1.
87.5
MLS
64...a
45.3
41.2ga.
82.0
82.7 82.7_6s
63.1
MLS
89.4.as
96.7 96.8.n..
79.2
70.9 0.7
36.8
KLM
19.7am7
15.0 45.0az2
56 2.
76.1
80.1
61.5
KLM
89.0
96.99 96.9amx
95.58 95.8ama
78.6
74.5-1.1
87.4
GNorm
70.5.00
45.4
30.0g.0
75.120
85.0_ass
08.4
GNorm
85.7.00
98. 98.San
S0.2
53.9
82.9
ReAct
72.0.a.
39.0grm
43.5
81.3
84.9
ReAct
86.9...7
97.2
94.8
19.9
58.0
83.5
VIM
88.5.1.7
35.3
63.8
79.4
80.5-
42.2-42
97.2
68 33.3
$7.0
70.9-6.
74.3
06.1.00
53.4.o
50.2
03.7-20 20.4
66.7-111
23.6.00
96.88 86.8gmn
40.4gna
85.8-60
67.7
RMDS
00.4..1
31.1g04
43.2
83.8 .0.5
13.2 (-)
58.3
RMDS
89.3..o
99.5
96.0ga.
79.4
82.7 82.7-60
89.4
KNN
98.9 98.9
19.6
89.5 89.5
$1.5a5
80.2 80.2-
79.9
KNN
3.1
91...1
43. 43.2
76.8
08.3-001
57.5
SHE
83.5.04
64.6..1
30.3
57.9
81.0
73.5
SHE
41.5.00
89.0
59.4
90.1
55.0
67.0
SPROD
99.0..m
62.8
97.9
$3.1
86.8
85.9
SPROD
3.3
94.8.1.
11.4.02
70.6.12
52.9
46.6
32

---

Table 19: AUROC and FPR@95 performance of all methods using DINOv2-S as the feature backbone. FPR #951
AUROCT
Mathod
WiB
CA
UC
AMC
Spl
Avg.
Mathod
WB
CA
UC
AMC
Spi
Avg.
MSP
80:1.80
34.0,aa
64.3 G4.3
87.6
84.9
70.2
MSP
50.1
91 S11
71.0aa
63 0220
81.1
Energy
36.5
63.2
88.8
86.6
70.5
Energy
97.9
87.5gr0
63.3
56.0
77.9
MLS
78002.
Sum.
86.5....
7822.722
28..4.1.0
88.0
09.3
57.5 57.8t5.1
78.3
KLM
64.7.14
64.1 33.
65.2
82.8
84.4-6a
KIM
82.7.27
98.0am2
03.2a:52
63.7
64.4g22
80.6
GNoem
82.7 11.5
12.8
k..5
83.4 10.7
86.9 6.6
69.9
GNorm
79.G.0.7
58.0an.
01.311.
73.1 13.1
57.312.3
80.2
ReAct
76.5.2.6
35 3an.
62.9 62.9
86.7 66.7.6.7
70.0
RoAst
79.8
97.8.1.
87.7
08.0g1.
68.0
57.2
78.5
VIM
87.8.04
39.0.8.-
83-0g7-
90.5.50
84.9
78-2
VIM
6.0.1-7
97.4g1-
06.6
67.1 22.
56.6.1
56.7
MDS
65.0.m.7
43.8 14.1
83.7
MDS
2.5
96.4.0.
30.4
69.2
58.6.00
51.4
RMDS
65.2.nn1
26.4.n9
50.3...2
69.8
65.0
RMDS
59.8.11
94.8201
69.7-22
G4.6203
81.0
KNN
09.3..00
43.4
91.2
80.5
70.7
1.6.o.1
96.9
44.3:14
48.8
82..
51.8
SHF
99:1 10.0
64.6
92.5 92.5g9.3
84.3 0:3
84.7 84.7.008
83.0
2.
28.2
35.4g05
72-7
54.2
SPROD
99.6
63.4.12
96.1in0
91.3
85.5 65.5...1
87.2
SPROD
1.3
94.7.67
24.4.09
40.0g1
54,4.09
43.0
Table 20: AUROC and FPR @95 performance of all methods using ViT-S as the feature backbone.
AUROCY
FPR
Mathod
WB
CA
UC
AMC
Spl
Avg.
Mathod
WR
CA
IC
AMC
Spi
Avg.
MSP
g1.5gi
30.2.1/
47.8_.044
85, a
65.4
MSP
88.7-1.3
90.0..om
96.0
31.3
67 1
86.4
Energy
69.0.na
10.3 10.3.10.5
18.9
85.4
85.6 65.6
65.8
Energy
87.9
98.3.1.5
53.6....
78.2
68.5 68.5
82.0
MLS
29.8
48.7-4.
85.3
85.72m
85.3
78.6
05.0g1
$4.9
KLM
02.66.2.5
47.22-1.6
77.9
$4.4106
KLM
19.7
90:3..02
166.2-2.5
78.3u5.7
00.4
85.7
GNNrr
75.0
38-4-1.8
47.9..c.
83.0
86.7
66.4
GNNorm
98.4.3.2
00.0cma2
95.9
$0.6
62.5 02.5
85.3
ReAct
70.3
40.1 L9.4
40.0 2..
84.9
83.4110
67.3
RoAct
S5.4111.2
97.00..
94.1.3.0
70.6
76.712.
86.9
VIM
$4.5a2.9
$4.0
67.8
85.0a3.4
85.5
73.5
VIM
63.6.15.1
97.5
78.
g2.
63.811.
75.0
MDS
95. 95-1:00
20
04.3_.0
81.6235
83.0.00
82.9
MDS
30.9
96.6.10
42.3_.6-
75.6
65.1100
61.9
RMDS
00.5.n.1
29.2
12.1
87.2
86.4
RMDS
01.2
99.8..01
96.8....
21.0
60.110
83.8
KNN
94.02.0
23.2
91.2-000
83.
20.7
95.8.1
L
75.0 4at.
72.7a02
SHE
94.5gm9
61.5
91.2_.0
g8.
83.4
28.0
58..2.0
42.2 1.6
80.2
06.3g1 4
63.1
SPROD
97.0.n.
60.9 1.1
96.3 .0.
85.0g3.3
86. 1..1
85.1
SPROD
9.1 00.2
.n.
25.0 03.1
66.6
60.0,02
51.1
Table 21: AUROC and FPR@9 performance of all methods using Swin- as the feature backbone.
AUROC*
FPR
Method
WB
CA
UC
AMC
Spl
Avg.
Method
WB
CA
UC
AMC
Spl
Avg.
MSP
82.8..0
30.9
57. 57.2
92.7
90.6....
70.8
MSP
76.1.22
90.7...
50.0
21.8
38.1 22.0
71.7
Energy
82. 82.4.:.5
31.00 11.0
57.5s2.7
93.6.0.1
87.6
70.4
Energy
76.3
59. 13.3
91.9as.
47.3
63.5-1.
73.7
MI.S
82.6.1.5
30.9.22
57.5 57.5
22.0
89.6
70.7
MI.S
76.7-477
00.6.02
92.3 92.9uza
48.5-22
41.0-1.4
71.5
KLM
57.3
22.8
50.52
92.5
68.6
KLM
79.3
09.7.u1
52.9
72.6
GNorm
63.4
27.6.1.2
52.410.4
$1.0.0.5
56.00.c.
75.9
99.7.n.
50.1
46.5
80.9-1.2
79.2
ReAct
83.6-117
34.3
$8.0gz2
93.6.s1.1
90.8-004
72.1
ReAct
75.9
99.0gm.a
91.8s22
48.0
08.3-:.4
72.6
VIM
90.6.00
19.8
76.9g1.4
$8.1
92.6
77.6
VIM
68.2.22
97 7.n
65.0g1.
$2.7 $2.7...2
37.8 37.8-005
68.3
MDS
85.9...1
60.8
86.7 86.7.0.3
74.7.0.5
92.1
S0.0
MDS
67.5.n.
94.3
07.310.3
92.9
41.5
70.7
RMDS
29.9
49.5.0.1
93.2
92.8
RMDS
67.4
99.9...
95.4:0.3
61.3-2.
37.7-0.2
72.9
KNN
65-4.ms
91.8
92.5
91.3-g.
KNN
43.5-10.1
90.9-0m
42.2
20.7
53.4
SHE
07.3.10
49.6
96.4.6.1
92.9 L0.4
85.2 6.1
16.4.04
06.6
24.1,0.
60.4
42.4 0.5
46.4
SPROD
66.6 99.0.000
98.7 (0.0
92.7
93.7 6.0
90.1
SPROD
2.8 (0.1
92.3
8.4.0
43.6
29.6 0.2
35.3
Table 22: AUROC and @PS performance of all methods using DeiT-B as the feature backbone.
AUROCA
FPR
Method
WB
CA
UC
AMC
Spl
Avg.
Method
WB
CA
UC
AMC
Spl
Avg.
MSP
75.6
43.4az2
53.3
88.5...4
87.8.u.4
69.7
MSP
86.7
96.5 2.12
94. 94.9amn
58.9
02.5.2.5
$0.4
Energy
77.2.s.
44.3
12.4gz.
90.01
86.2
70.0
Energy
80.3..0
96. 2..
94.3
$1.5
88.6_15
78.6
MLS
76.9225
44.0.5.
52.6:2.
89.6
87.4-6.4
MLS
82.0.s.9
96.5
94.Te2a
52.7
63.2-1.
78.2
47.0amm
43.2
49.8a0.1
85.8
80.0
87.3
96.8.m02
94.92.4
61.2-...
60.2-4.
80.5
GNoem
07.3..88
43.2
53.3
76..5..3
T0.3
GNoem
84.4...
96.9202
94.6
12.5
$1.0-1
82.3
ReAct
77.1-3.
41.9aL.
52.7 52.Tu3.3
90.2 :0.4
$7.3
69.8
ReAct
80.6.7.
96.4
50.55.3.7
52.7.12
66.2-44
78.3
VIM
82.7
46.2
82.5.0044 65.8a2/4
87.4
72.9
VIM
79.3-224
96.7
$3.0e.4
89.1.0.
64..8
82.6
MDS
74.9.01
50.82.0
65.6 78.2am.
87.2
71.3
MDS
81.3...1
96.6gum
76.02m0
94.3
01.8-0.
82.6
RMDS
31.7an3
30.00g0
87.3
65.5
RMDS
86.9..
99.5
95.
86.6
58.0-6.
85.2
90.0ga.
46.4
45.9
86.5
58.6-20
95.3
57.8
16.0
71.9-61
71.9
SHF
88.0
64.1 1p07
94.0gm
90.1
86.9 86.9
81.8
44.0.umb
06.3
38 1g0.
92.1
02.1 11.
05.3
SPROD
94.1 .0.0
:488
95.8 0 $8.0
89.5
84.6
SPROD
42.3 0.8
95.3
30.6
13
54.1 64.1.6.1
55.1
33

---

Table 23: AUROC and FPR @95 performance of all methods using ConvNeXt-B as the feature backbone.
AUROCT
FPR
Mathod
CA
UC
AMC
Spi
Avg.
Matiod
WB
CA
UC
AMC
Spl
Aug.
MSP
88.1.07
30.4
57. 57.5
91.1
93.1 ...8
72.0
MSP
59.0
96.0...1
.0.7.1.3
g5.0
31. 11.5
67.8
Energy
86.1.40
29.1
05-7a5.7
93.6
92.9...3
71.5
Energgy
63.1..00
90.4.00
91.1
b1.3
32 32.3,1
68..2
MLSS
86.6 86.6as8
28.0 28.2..5
56.0.s.0
01.7.5.
05.1
71.3
MLS
62.4:9.2
92.1
52.9g14
32.0:2.
67.8
48.2,a8
50.0,n.1
92.6.0.3
G8.7
53.6.1.9
41.6g1.
39.3 39.725-4
66.8
GNoem
71.6.1.
47.0
46.1.0.1
45.0
80.4
CNorm
2.5
98.Gun.
94.4..55
60.5
12.0
70.7
ReAct
85.4:42
1.3.7
65.7
03.2
92.9
70.7
ReAcT
07:2
00.3.n.4
91.5
50.3 S1.4
32- 422.
60.4
VIM
07.6
32. 4.2
82.6 82.6g5.2
94.7 2012
92.7
50.0
VIM
9.4
08. 98.6200
61.5-663
37.5 37.5
30.8
47.4
MDS
97.7
02.3 12.3
88.4
89.7
85.8
MDS
10.0
96.5g1.0
28.3 .644
03.8 03.8
53.2
50.4
RMDS
85-4am1
26.90 26.9.na
48.9 48.9.0.3
06.1a53
02.4...0
69.5
RMDS
50.6
90.9...1
94.9
54.0
38.5
67.7
KNN
22.7
22.1
03.1 -8.0
KNN
23.8..6v
48.9
SHF
06.1.61
62.0
50.1 k00
75.4 00.5
91.5
$4.8
22.0
97.0ga5
3.6.0.5
91.5ga4
28.4
50.5
SPROD
99.1 .0.0
64.0
99.7 10.0
92.0
94.3 ..0
89.8
SPROD
2.6
93..117 117
0.5 .6.0
51.4g1
27.
35.2
Table 24: AUROC and @95 performance of all methods using BiT-R50x1 as the feature
backbone.
AUROCT
FPR
Mathod
CA
AMC
Spi
Aug
WB
AMC
Spi
Avg.
MSP
60.5.117
41.8
46.8...0
84.3
82.5
65.0
MSP
84.7
98.5 6
95.2
76.0 76.0
66-7gin
$4.2
Energy
66.8.s.
L9.4
10.2
87.6.0.3
S1.6,06
62.7
Energy
89.2
97.8
94.9
64.2
68. 11.
82.8
MLS
67.0
22.0
14.4-633
87.4=34
82.2:95
64.8
MLS
83.2.22
98. 18.1
95. 95.1asa
65. 65.4
66.6 66.622
82.7
KLM
48.
41.9
78.6
60.6
KLM
98.4
95.1an8
74.8
63.8
83.5
GNNorm
35.7-225
71.3-34
53.9g1.
98.62u
95.0g0
80.621.
87.7
ReAct
57.0g.3
36.00
46.0 7.5
81.9 63.3
$1.4110
ReAct
94.3
97.4s1.
95.2147
74.2
00.413.
86.1
VIM
03.8.1.6
48.0..0.2
73.3
87.5
86.6.0
77.8
VIM
27.9
97.2a1.3
61.0 61.0
72.0a:.4
51,0,00
61.8
MDS
99.1.00
61.9 61.9
98.5..00
78.2 2/.
83.3 13.3
84.2
MDS
2.5
96.7 75.5
5.9
83-4g/
54.6
45.4
RMDS
70.0
37.2
55.4
85.4
$4.5
68.5
RMDS
S3,3.o.1
98.5 98.5..0
90.4,0
82.1
36.8 $6.8
82.2
KNN
98.5
09.5 20.5
65.4_.0
85.2
79.3.a
81.6
KNN
3.7
95.5.104
22/4
66.8
68.35 68.9201
51.0
SHE
97.1
29.
63.6
73.5
83.5g0
84.6g
88.3,0
74.0
SPROD
98.3gmm
67.1.1
.0.0
87.4
84.3
4.9.o.1
96.6.0o
5....
51.2
36.810a
42.9
Table 25: AUPR-IN and AUPR-OUT performance of all methods using ResNet-18 as the feature backbone.
AUPR-INT
AUPR-OUT
Method
CA
Syl
Aug.
WB
AMC
Spl
Avg.
MSP
02.2.00
23.1aga
28.9...
20.8
47.2
72.7.mm
27.3
50.7and
10.1
92.4 92.4_0.3
72.2
Energy
02.7.40
23.6
30.2
79.8
43.9_..5
47.9
Energy
74.5
75.3
63.0g5
57.3
92.4 02.4_6.1
73.1
MLS
62.0.4.
23.5as5
30.0
80.2
65.9-m.5
$8.4
MLS
743-442
77.7
62.2c4.
58.0...
92.4
72.9
KLM
34.4.08
16.8
40.9
70.9
41.8_1.0
41.0
KLM
60.6.0.
75.0gus
68 68.82..
10.4...
90.4-003
70.8
GNoem
76.0..4
16.7
35.1gn
13.7
GNorm
82.5.08
75.8
62.9gn
55.3
05.2
74.3
ReAct
71.6:59
18.1
30.7=2.2
80.4
48.7
ReAct
79.2-5.0
75.0=1.
63.1es.3
57.3-...
91.3-6.1
73.8
VIM
71.6as.
25.3
90.6
35.5
83.3
80.9.1.
79.4
18.3
87.3
77.8
MDS
61.6.01
29.9
86.8
67.0
15.9
52.2
MDS
$2.8.0
83.4 83.4.00
52. 52.5am
49.9
80.4
77.8
RMDS
36.0.011
15.3
33 33.1
82.5 00.4
49.7
42.2
RMDS
59.4:0.
72.8.0.4
60.9ta.1
62.3
89.0
68.9
KNN
88.1202
27.4
88.7
S0.3
33.4
63.8
KNN
84.1 96.2..00
95.0gm
61.8 61.8-2.
90.7 90.7-0..
85.6
SHE
57.
47.9
80.6
84.8
97.1 m0.
96.6.0.1
81.0
48.4...
SPROD
98.9 0.0
10.6
98.1 10.0
66.9 .0.7
94.4..o 0.0
Table 26: AUPR-IN and AUPR-OUT performance of all methods using ResNet-34 as the feature
backbone.
AUPR-INT
AUPR-OUTY
Method
CA
Spl
Avg.
Spl
Avg.
MSP
60.1.nm
18.6
30.7
81.0gsa
52.0
49.3
MSP
70.9
74.
60.8ann
61.1
94.3-01
73.0
Energy
67.8
19.0ggm
30.4g.1
S5.42)
48.8 48.8_n
48.3
Energy
71.4.76
76.2
61.Tg5.1
64.9
93.8 90.8 10
75.6
MLS
$7.8
18.8in8
30.4
81.8
51.3
48.6
MLS
71.3...
75.5
61.4g:0
65.1_"
94.1
73.5
KLM
33.9..4
18.3ana
10.1
74.3
52.2
43.8
KLM
58.5
76.3
67.5
62.7
02.6-1.4
71.5
GiNcem
14.5am
36.8
78.5
51.7
GNorm
73.0
G3.62n.
62.6-..
74.8
ReAct
08.0..%
14.3g1
32.0gp
85.4
53.3
ReAct
75.0
74.1g0
61.3
64.4
05.2_6.
74.1
VIM
74.8:19
24.7a40
42.5 12.5g223
$3.9
43.7-0.5
53.9
VIM
85.7
80/2
78.7a22.1
80.8 $0.8
89.0-0.1
79.0
MDS
R2.3
33.9
87. 8.1.
71.2 71.2-21
25.9 25.9--011
601.2
MDS
88.8
84.0gmm
52 5/..2am.1
49.7 29.7
88.6
70.7
RMDS
41.1:01
14.4.00
31.T
86.2
53.2
45.3
RMDS
63.0...
71.0 71.0.05
00.4gn0
80.5
91.3
70.4
KNN
96.5.01
83.6.0.3
83.2
39.6-6.2
66.0
KNN
98.5...0
82.7.0.4
92.7.n.1
63.5
92.1-6.0
85.9
SHE
76.9gus
15.3gm
00.0g04
74.2
51.6
77.0gm
58.6 25.
95.7
82.6
SPROD
97.0
40.4...
94.5
$4.6
53.4
SPROD
98.9...
84.3gu
96.3
68.5 68.5
95.4-p.0
88.7
34

---

Table 27: AUPR-IN and AUPR-OUT performance of all methods using ResNet-50 as the feature
backbone.
AUPR-INT
AUPR-OUTT
Mathod
WB
CA
UC
AMC
Spl
Avg.
Mathod
WB
CA
UC
AMC
Spl
Avg.
MSP
52:4.1.1
28.5 v8.5
66.4
58.2
69.8
MSP
u0.9.m.4
75.8
57.9
66.5
03.9
73.0
Energy
22.1284
23.4
26-7
62.9
Energy
70.4.94
75-8.1.
58
66.5
73.0
62.1.88
23.4
28.22 (0.3
55.8
70.8.18
76.6.1.7
58.1
06.9
94.0-6.1
73.1
KLM
39.5.n.
11. 17.1
52.3
1.2
45.2
KLM
a4.7
1..
66.8.n.3
65.7
03.3 0.3
73.0
GNorm
70:2.005
15.8.n.
34. S4.5
78. 78.4
56.3
51.0
GNerm
81.5.a.5
733
73-7an
60.7ao.3
63.1
96.1
75.0
RoAct
67.8.99
20.2.na
29. 21111
87.0
58.7
52.7
RoAct
76.2.4.
77.7
69.0ga4
66.5
05.5_.03
75.2
VIM
72.7
23.3
39.2 39.2,1.3
86.5
51.5
$5.4
VIM
65.9.1.
78.7 19.5
64.2
92.4
80.1
MDS
8800...
30.2,n.5
4m..
72.0.0.7
28.9
92.5...
62.8...3
51.2
85.6.6.0
81.3
RMDD
45.3...
14.4
34.4.n.1
58.5
-0.1
45.1
RMDS
68.0.n
70.7.00
62.8an
68.3 mm
80.0-6.0
71.8
KNN
97.8 m0.1
24.4
S5.8
86.2
46.0 06.0.... 0.8
68.0
KNN
99.1
82.3.o.1
94.7.00
67.6 g/.6
93.4 93.4_0. 0.0
87.4
SHI
77.0.o.4
16.3
58.2 -
61.6
09.4.6.3
52.5
SHI
90.5....
77.4.0.3
82.6.o.1
06.4
05.6
79.1
SPROD
98.
20.6.1:2
96.7
88.9
58.3
76.5
SPROD
99.2....
34.
98.1
73.0
06.0...v
90.1
Table 28: AUPR-IN and AUPR-OUT performance of all methods using ResNet-101 as the feature backbone.
AUPR-INT
AUPR-OUT!
Mathod
WB
CA
UC
AMC
Spl
Avg.
Method
WB
CA
UC
AMC
Spl
Avg.
MSP
66.8.00
23.6 G
29.5
28.0
57.4
50.9
MSP
12.7.00
09.8
68.8
94.9_..1
74.3
Energy
50.9.a
23.9
29.6
88.0
55.0....
50.1
Ensrgy
70.7.a.
76.0
60.0g..
09.6
74.0
MLS.
54.1229
23.8as.
29.7
88.1
57.5
71.-22
75.6.x.7
59.8
01.5-0.1
74.2
38.1.004
18.7g1
50.6..s
KLM
64.2...
75.8
G7.3
87.9
03.6_00
73.8
GNoem
64.2..6
19.0
37.5
28.8
57.1_66
51.3
GNoem
79.8..0
70.1.11
63.0g1.0
65.6
96.0 96.0 0.1
26.1
ReAct
07.2
16.7
31. 31.4s1.4
87.6 87.6
62.8
53.1
ReAct
75.5
75.0
61.4es.
09.2-...
95.7 95.7
75.4
VIM
83.7=29
27.1
27.
43.4
S7.2
56.9
20.7
VIM
92.3.11
78.4g1.
50.0.1.
64.8
81.8
MDS
86.2..
24.4.05
91.5
73.9
36.6
MDS
97.0..0
81.5
95.2
51.3
82.6
RMDS
41.8:0.
13.8
31.8.9.1
21.1
47.4
RMDS
09.9-..1
09.8.0.2
60.2
71.2-..
90.8-0.0
72.4
KNN
07.9
20.2
82.3
$8.0
49.9-.02
99.4
80.9.1
23.7
70.0
94.3-000
87.7
SHE
08.0.00
34.9
06.8
65.7 g0
47.1 -63
56.6
SHE
90.8 90.8.00
87.1
58. 2
51.6
96.1
82.6
SPROD
98.1 :6.1
44.2
97.3
87.8
58.0
77.1
SPROD
99.4
84.8
98.5 :0.0
74.5
96.5
90.7
Table 29: AUPR-IN and AUPR-OUT performance of all methods using DINOv2-S as the feature
backbone.
AUPR-INT
AUPR-OUTT
Method
WB
CA
UC
AMC
Spl
Avg.
Method
WB
CA
OC
AMC
Spl
Avg.
MSP
76.8.24
14.8
54.0z0.5
g2.1
60.0
50.3
MSP
82.3....
71.00 71.9
72.8
27.1
05.5
95.5
70.0
Energy
71.7
15.9
53.1 53.1
93.4
67.6-1.5
50.3
Energy
81.1-82
73-724.
73.9
78.0=...
96.1
80.4
MLS
72.2.5.0
15.7.2.
63.3
93.4
61.4
MLS
81.7.28
73.1
73.3
18.2
96.9
80.4
64.7.1.
23.5a1.
47.2
84.4
60.8-..6
75.7435
79:2
09.2s5.1
17.4
95.1-6.2
79.3
Giece
70-4-117
13.8
47.1 43.1
96.3
66.0
58.5
Gieem
83.8
71.5.a.1
72.7
23.6...
96.1 16.1
70.5
ReAct
10.7.2.0
15.2
52.9.n.3
93.4 a0.3
65-6 1.3
50.6
ReAct
80.5-33.
73.3
73.1
78.0
96.0 0.4
S0.2
VIM
96.8...9
16.8
74.4
91.9
58.7
06.7
VIM
98.5
75.1
88. $8.9
74.T....
95.9
86.6
MDS
88.8.00
20 2207
91.9.a.1
80.0
48.7
71.8
MDS
90.3..0.
81.2 81.2
95. 95.3290
72.3 72.3-..
05.6-0.0
88.7
RMDS
35.5.n.3
93.9
RMDS
65.0.o.1
76.4
08.9.n.1
16.0.n.2
08.5 6..3
94.2.0.3
45.6
98.5.10.0
77.8
50..9.o.2
$4.5 00.5
94.3-6.3
89.4
SHE
08.6.0.
73
88.0 2.0
85.3
58.1
75.1
98.4.n.
70. 70.0
95.3
72.3
05.5
88.3
SPROD
99.4.00
45.0.11
95.3 0
03.0g1
61.1-68
78.9
SPROD
99.7
84.6.0
97.1,00
87.3
06.0_6.
92.9
Table 30: AUPR-IN and AUPR-OUT performance of all methods using ViT-S as the feature backbone.
AUPR-INT
AUPR-OUT!
Method
WB
CA
UC
AMC
Spl
Mathod
WB
CA
UC
AMC
Spl
Avg.
MSP
67.1-2.3
89.4g5
63.9g1
54.4
MSP
25.0
73.4
62.4.n3
70.5
95.2
75.3
Energy
(1.1
19.0
35.5..2.
u3.3
65.6g11
Energy
73.4.a.
74.5
64.3
72.9 00.5
05.4.6.3
MLS
63.3
18.8.am
35.4.2.0
80.5 90.5
66. 1a1.
56.8
MLS
73.6
74.0
64.0gs1
72.8
05.5_..
76.0
KTM
63.6....
21.7an
31.2_.3.
79.3
60.5ga
40.3
KLM
71.1260
77.8.n.
59.21:1
09.3
-9.3
95.3 00.
74.5
GNerm
73.1...4
16. 16.4.n5
34.6
87.8
65.6,n6
55.5
GNorm
77.5
73.2
62.5.n.5
70.8
95.9
76.0
RoAcE
61.0...1
24.4.0
35.5-229
90.8 90.8
65.8
56.1
ReAce
74.5.
78.5
64.1asa
72.0
04.3-004
76.7
VIM
21 2..
51.7_14
64.6g1
87.1.11
76.4.-
79.2
95.6_6.
82.5
MDS
91.4
38.1.1.2
90.8-.0.1
#7.
38.9 58.9
95.7.no
$3.1.n5
95.2,n0
05.9_60.
87.9
RMDS
46.6gp3
18.G
30.0-...
2:12
64.5an22
49.5
RMDS
69.3
8
59 59.1am.
76.7
05.0-0.0
74.0
KNN
82.8 g2.
30.6...
80.3-63
88.9
52.8
70.8
KNN
94.4.00
80.8
50.4..0
72.1
93.6_0.0
86.9
SHF
02.1 1663
38.99 13.0
87.8
80.4
58.51n
71.5
SHI
96.3
77.7
93.8
70.1
95.0
86.4
SPROD
95.1
42.0
98.5
88.433
64.4
77.1
SPROD
97.8
83.3
97.2:00
77.0
96.0.s..
90.3
35

---

Table 31: AUPR-IN and AUPR-OUT performance of all methods using Swin-B as the feature
backbone.
AUPR-INT
AUPR-OUT!
Method
CA
UC
Spl
Avg.
WB
Spl
Avg.
MSP
79.8
14.0ams
47.1
24.8
10.0
MSP
84.5.m
08.7aux
00.0gna
26.2.0.
97.3
81.3
Energy
19.0.1.
14.0gmc
47.5g25
60.3..1
1/8
59.3
Energy
84.4.10
g0.0g1
03.5gg
96.1
96.1
81.5
MLS
79:2:1.6
14.0am7
47.5a2.3
95.0
64.9-1.
00.1
MLS
84.6.144
09.Sa1.2
09.3s2.2
S7.1
97.0
S1.8
KLM
40.2.110
24.9221
35.9
94.02203
67:2-
12.4
KLM
72.6.15
77.4.1.
65.62aa
25.2.04
07.0-.02
79.6
GNoem
12.7.m
35.1
$3.8_.4
19.2
GÑorm
76.3...
09.2.00
67.9
$1.3
76.1
ReAct
80:9.1.7
18.2
48.5.2.3
26.1...
T4.5-1.4
ReAct
85.2-2.1
71.4
09.8u2.7
57.0as.s
97.0-602
82.1
VIM
89.5-a04
18.3
65.9.2.1
03.66.0.
77.0
VIM
91.7
74.8.1.
55.0gga
73.5
07.9-000
84.8
MDS
83.7
24.4.0
29.
55.3
76.6 76.6-203
72.0
MDS
28.1
84.229.7
91.1a9.1
18.3
97.8-0.0
83.9
RMDS
72.7.61
13.7
35.4
a6.4
39.0
RMDS
86.5.0.0
09.0
63.9to.1
81.8 00.
98.0
79.8
KNN
86.8.01
29.5 8.0.
88 2..
05.2
73.0
74-6
KNN
93.3..00
82. 22.5
94. 94.8
85.5
07.4
90..7
SHP
27.2
95.4
95.9
59.7 20
98.0.u0
77.2
97.5
83.8
96.8...
SPROD
98.3
47.8
98.3,00 (o.0
95.4
80.9 0.3
SPROD
99.3...
10.6
j0.
96.6 20.4
98.1 6..0
93.9
Table 32: AUPR-IN and AUPR-OUT performance of all methods using DeiT-B as the feature
backbone.
AUPR-INT
AUPR-OUTT
Method
WB
CA
UC
AMC
Sp1
Avg.
Method
WB
CA
UC
AMC
Spl
Avg.
MSP
72.9
21.4
40.5-n2
92 22.4
67.9
50.0
MSP
77.9.m
74-7a1.
66.1
94.9
78.3
Energy
73.7
22.2
29.8-2.4
92.4
65.6
Energy
80.1
70.6u2.2
65.7.3.3
83.5 ino
94.9.0.5
50.0
MLS
73.0-552
22.2as.4
39.9-2.2
02. 42.4::15
67.1=1.3
39.0
MLS
79.0-2.
75.2as..
65.8-2.5
80.9
95.1.9.2
79.8
KLM
35.3
18.6
35.7
87.5
65.1=1.7
48.4
KLM
64.3.2.
74-7a112
64.0.n.
78.3ams
05.8 05.8
75.4
GNorm
61.7.111
17.1
3g.1
77.9.1
30.9
42.9
GNom
75.5
75.6 75.6208
68.6-n5
76.121
90.3211
76.8
ReAct
70.6:5.4
20.3:22
40.0=2..
93.1:n
69.4
ReAct
74.7722
08.1-3.5
83.5
95.4
50.0
VIM
81.7-1.
23.5as54
52.1=2.7
20.1
68.0.s.7
63.1
61.2-1.5
9.....
77.3-2.0
06.1an9
95.7
80.2
68:6.112
19.4...1
08.7 29.5
79: 230.
07.0...3
78.8-20.1
80.8
84.4.m.
50.8
95.7.9.0
78.3
RMDS
56.3
13.9 20.
36.2 0.3
92.55 22
69.3
69.3
53.7
RMDS
75.5
70.1 1g
66.1-669
72.3.00
96.6 96.6.9.
75.7
KNN
88.0
18.5
82.9.6.
89.5 80.5
60.7 .0.3
09.2
KNN
91.4.05
21.
91.3
72.0
95.1
85.8
SHB
93.8.00
35.3.u
92. 1.01
80,6210
65.4
65.
73.5
SHB
91.3.0
79.
96.0.n.
57.6.1.1
95.7
S1.8
98.6.0.1
190.
95.2
92. 1z02
20.3
94,8
81.9
83.3 97.0.a..
96.7
Table 33: AUPR-IN and AUPR-OUT performance of all methods using ConvNeXt-B as the feature backbone.
AUPR-INT
AUPR-OUT!
Method
WB
CA
UC
AMC
Spl
Avg.
Method
WB
CA
UC
AMC
Spl
Avg.
MSP
85.4.1.
14.1asa
48.5.n8
91.
78.2
61.1
MSP
80.6
29.5
68.6-n.
81.
97.7-s.
81.9
Energy
82.7
13.5
46.00.4.1
96.1an1
77.3-1-3
Energy
88.42s.
50.5
67.9.s.1
07.0.a.1
81.9
63.1.4.7
13.4
68.1gas
96.1
77.5.1.
88.9.a.
09.3g1
68.0.s.1
85.0
98.0.a.1
81.8
KLM
41.3 1.2
23.9.1.a
35.0 [0.5
91.1ina
66.2 2o.
52.8
KLM
BIL0: 11.1
75.0
65.4...3
87.6
96.7
30.9
GNomm
51.0.a14
21 21.0
$1.1..02
87.8
66. 66.4
51.5
GNorm
82.1
75 75.0.n.5
64.0
18.1ann
96.9.s.1
79.2
ReAct
82.1
12.81007
46.1
96. 1.
75.8
62.6
ReAct
87.7
68.3
67.9_5.
150
97.0.s.1
81.4
VIM
96.6.066
96.8
71.513.
88.9.05
07.6.6.1
MDS
97.0...1
25.0..oa
92.6.n0
.83
10.0
80.5.0.7
96.7 .6.
79:2
96.8.8.0
90.3
RMDS
13.0
34.4 20.3
96.8.n1
6...2
30.2
RMDS
8U 80.6-10.0
9...3
63.0-02
84.4.n5
07.7
30.7
KNN
94.3.01 10
28.3 3.0.3
85.7 0.0
04.9.02
79.9.6.3
76.5
KNN
97.8
82. 7.0
96.6
80.5.177
08. 1000
91.1
SHE
02.8
49.7
98.7
83.5
75.6
80.1
SHE
96.8
82.5 1.0.7
99.5
61.1
97.7
87.6
SPROD
98.4 m1
45.0,0a
99.6
96.3
83.2
84.3
SPROD
99.4
85,3
99.8
86.0
98.4.o
93.8
Table 34: AUPR-IN and AUPR-OUT performance of all methods using BiT-R50x1 as the feature backbone.
AUPR-INT
AUPR-OUTT
Method
WBB
CA
UC
AMC
Spl
Avg.
Method
WB
CA
UC
AMC
Spl
Avg.
MSP
59.3...
18.8
33.4 33.4
89.8
55.4
51.3
MSP
76.0
62.8.n.
13.5 v3.5
98.8
76.5
Energy
56-4.29
20.5
32.0
32.0
01.3
52.0
50.4
Energy
72.8
75.7
60.5 60.8
79.5
04.33..3
76.6
MI.S
20.5.7.5
32.0g1
01.3
73.3.99
75.5
60.0g5
78.7
76.6
35.7
18.9
36.8.o.
29.7.0.
56.5_,1.0
KLM
65.3.n5
74.2
61.5.nn
.022
74.0
GNorm
38.2 38.2.n.
14.8
55.0.1.a
74.1
20.5 20.5...7
40.5
GNorm
65.6
72.9.1.7
68 68.1a1.0
67.6 uc.4
84.6 0.8
71.8
ReAct
47.6.29
14.9
33 7
96.0
55.9
47.8
RoAct
64.7.20
74:2g--
0
61.7gm.
72.6
94.2
73.5
VIM
90.7 90.7.99
25-7 7nn
53.3.n.
92.3
5K.1
64.4
VIM
96.8.1.0
84.8 75.0.-.
75.4
96.5
86.1
MDS
98.8
41.00..1
98,3,00
85.5
52.7
75.3
MDS
99.4
98.5 83.9.0.
65.
05.5
88.5
RMDS
47:2.011
13.5
21
RMDS
73.4.01
111
64.72m0
71.4
05.8_6.0
KNN
07.4...
20.9
93. 11.1
80.4
48.2
60.8
KNN
98.0..0
80.3.08
97. 97.2
76.9
03.9
80.5
SHE
75.5
24. 1..
95.8
79.0
30.7
6.8
61.2
SHI
81.9
76.7 10.3
98 j..
67.6 5..
87.6 0.2
82.4
SPROD
97.3
49.8
98.3
89.9 29.9
56.1
78.3
SPROD
99.1
85.5
99.0
83.8
95.9
92.7
Table 35: Comparison of SPROD variants on SP- datasets using AUROC and FPR@95 metrics. All methods utilize pretrained ResNet-50 backbone. Values are averaged over five runs.
AUROCT
FPR
Method
CA
UC
AMC
Avg.
Method
AMC
Avg.
98.8
61.6..
03.4..1
85.5 85-3
85.0
4720r
982.00
190...
580
49.1
SPRCE Converged
58.5 58.5.ns
20 10.
07.1
$30..5
85.8..0
8L.6
SPROD Comerggdd
6.4
02.
19.1
710
49.7
SPROT-KMonn
08 S
373
08.8
62 80.
88....
81.2
SPROD KMeass
6.0
937.1.
193,04
714
564.01
40.3
36

---

Table 36: Comparison of SPROD variants on SP-OOD datasets using AUPR-IN and AUPR-OUT
metrics. All methods utilize a pretrained ResNet-50 backbone. Values are averaged over five runs.
AUPR-INT
AUPR-OUTT
Method
WB
CA
UC
AMC
Spt
AVE.
Medhed
WB
CA
UC
AMC
Spt
AVE.
98.
$8....
84.3
98.1.1
73.0
95.0..m
Cosverged
97.5
36.0112
06.0.03
52.812
Couverged
83.0
08.0.0
SPROD-KMatn
SPROO-KMatn
37

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly state the paper's main contributions, which include: (1) the proposal of SPROD, novel post-hoc prototype-based OOD detection
method designed to be robust against unknown spurious correlations; (2) the method's ability to operate without additional OOD data, hyperparameter tuning, or group annotations; (3) its broad applicability and superior performance, demonstrated through comprehensive periments on diverse SP-OOD datasets, including the newly introduced AnimalsMetaCoCo dataset; and (4) insights into factors like backbone fine-tuning and scoring mechanisms in the context of SP-OOD. These claims are consistently addressed and supported by the
methodology (Section 4). experimental results (Section 5.3 Table
Figures 4 66. and
dataset descriptions (Section 5.2)
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Section 6 discusses limitations.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best
38

---

judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: The paper proposes an algorithmic method (SPROD) and provides extensive empirical validation. It does not present new theoretical results in the form of theorems or formal proofs. The motivation Section 3.2 discusses probabilistic concepts does not derive new theoretical claims. Section suggests that theoretical justifications are direction for future work.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yss]
The paper provides substantial information to facilitate the reproduction of its main experimental results. 1. The proposed SPROD algorithm is described in detail in Section [and [ with its three stages (Initial Prototype Construction, Classification-AAe Prototype Calculation, and Group Prototype Refinement) clearly outlined. Algorithm [] provides pseudocode for SPROD. 2. Section 5.1 details the 11 baseline methods used for comparison, the evaluation metrics (AUROC, FPR @95), the primary backbone (ResNet-50,, with ResNet-18 also mentioned for some analyses), and the fact that experiments were repeated five times with different random seeds for statistical robustness. 3. Section 5.2 thoroughly describes the five SP-OOD datasets used, including references to established ones (Waterbirds, CelebA, UrbanCars, Spurious ImageNet) and a description of the newly introduced Coiaals dataset, clarifying the SP-OOD setup for each. Table summarizes these datasets. 4. key aspect aiding reproducibility is that SPROD presented hyperparameter-fiee method. 5. The authors state their intention to release the code. The implementation is based on the OpenOOD codebase, which is open-source and the code for SPROD and the experiments will be made publicly available. This will significantly aid in direct replication of the reported results.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, may
39

---

be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibilityy In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We will make the code publicly available. The implementation is based on the open-source OpenOOD codebase, and the new method (SPROD) and experimental scripts will be added to this and released. For an anonymized version of the code refer the supplementary material. The datasets used are: 1. Waterbirds [33, CelebA (34, UrbanCars (35), and Spurious ImageNet (36) are existing publicly available benchmarks, with references provided for access. 2. CoimalsMetaCoCC is new benchmark dataset introduced in this paper, curated from MetaCoCo [7]] (which is publicly available). The paper describes its construction 5.2 and its release implied part of the contributions and benchmarking efforts. Sufficient instructions for reproducing results are provided in the supplemental material and will accompany the code release. The paper itself (Sections 5.1 5.2 and Algorithm I details the method and experimental setup.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c ec/
public/guides lobllic//uudess/dddesbbsisssssss
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
40

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
The paper specifies the training and test details necessary understand and reproduce the results. It outlines the datasets used (Section 5.2)). their spurious correlation structure, evaluation metrics (e.g., AUROC, FPR @95), and competing baselines. The main experimental Setup is in Section 5.1 and further details are provided in the Supplemental.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We repeat all experiments five times with different random seeds and report the mean and standard deviation, as stated in Section 5.1 Experimental results reported primarily in Section 5.3 and supplemental.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma еrror bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
41

---

Justification: Experiments were designed to be post-hoe and computationally efficient. All experiments were conducted on single GeForce RTX 3090 Ti GPU, demonstrating the method's practicality in terms of resource requirements. Detailed information on compute resources, including execution setup and runtime considerations, provided the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't It make it into the paper).
9. Code of ethics
Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https::/neurips... http://wuwrrpccppppllieleeeeeeee http:puwll..eiiisciuuiedeeceeede
Question:
Answer: [Yes]
Justification: Research presented in this paper fully conforms the NeurIPS Code of Ethics. All datasets used are publicly available and widely adopted in the community. The methodology does not involve human subjects, personally identifiable information, or any potentially harmful applications. Efforts were made to ensure transparency, reproducibility. and fairness throughout the study.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The Paper highlights positive societal impacts such as improving reliability and fairness in safety-critical applications in the introduction. While no direct negative impacts are identified, responsible deployment is encouraged. Additional discussion is provided in the supplementary material.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinfornation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
42

---

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e-g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
The paper does not involve releasing models datasets with high risk for misuse. It builds on publicly available datasets and does not introduce generative models or large pretrained components requiring additional safeguards.
Justification:
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (c.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The paper uses publicly available datasets and models (c.g., ResNet, Water- birds, CelebA, etc.), all of which are properly cited in the main text License information and usage terms for these assets are respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, pawerssipppwewwiiae...... thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
43

---

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
The paper introduces a new benchmark dataset, AnimalsMetaCoCo which is well documented. Details about its construction, structure, and intended use are provided in the main tex 5.2 and supplementary material. Documentation will be made available alongside the dataset release.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/mooell as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve any crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve research with human subjects and therefore does not require IRB equivalent approval.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
44

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The methodology and contributions of the paper do not involve the use of LLMs in any important, original, or non-standard way.
Guidelines:
The answer NA
that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
45


Reviews:
[{"review_id": "iRWWP4trh0", "reviewer": "Reviewer_zHbK", "summary": "This work defines two ood categories, namely SP-OOD and NSP-OOD. In response to SP-OOD, the paper proposes that SPROD is a use of three stages to solve the SP-OOD problem which has spurious correlations. It strives to conduct reinforcement learning on the samples misclassified by the classifier and construct more detailed minority group prototypes to enhance the learning ability of the model for SP-OOD. In the experiment, five OOD datasets were defined for NSP-OOD as the ood evaluation datasets for SP-OOD, and it was verified that the conventional softmax score was not suitable for them, while the likehood score was more suitable for them.", "questions": "1. Why is the performance of ImageNet100 lacking on the more common OOD datasets? Is it related to the number of categories or for other reasons? It is suggested that the authors conduct an analysis.\n\n\n2. Currently, the application of CLIP in OOD detection is a research hotspot. I wonder how the proposed method can be used in OOD detection based on CLIP. Because the comparison method in the article lacks the comparison of 2023-2025 methods in recent years.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "## Strengths:\n\n1. The paper proposes a set of post-hoc methods for SP-OOD. This method uses the class labels of each image to enhance the classification error of the training samples through sample reinforcement learning to construct more detailed minority group prototypes.\n\n2. The article presents the suitable OOD score forms for their post-hoc method and experimentally presents the results of the generative score and discriminative score, explaining the reasons why the softmax OOD score is not suitable.\n\nWeaknesses:\n1. Although the article pays more attention to the experimental performance of SP-OOD, we still hope that the author can provide some experimental results on the NSP-OOD and conventional OOD datasets. The real-world OOD dataset should be a combination of multiple OOD data. We can see that this method in the paper can improve the detection performance of SP-OOD without sacrificing the detection performance of other OOD types.\n\n2. The article lacks some ablation experiments. The author can supplement some relevant ablation experiments, such as proving the effectiveness of stage 2 and stage 3.\n\n3. In Figure 3 of the article, the square ICONS and other items are not specified.\n\n4. The most recent competing methods are missing in this work, such as CLIP-based methods.", "was_revised": true, "final_justification": "My concerns have been addressed.", "rebuttal": "> **Reviewer Comment**: Although the article pays more attention to the experimental performance of SP-OOD, we still hope that the author can provide some experimental results on the **NSP-OOD and conventional OOD datasets**. The real-world OOD dataset should be a combination of multiple OOD data. We can see that this method in the paper can improve the detection performance of SP-OOD without sacrificing the detection performance of other OOD types.\n\n**Response**:\n\nWe thank the reviewer for highlighting this important point. We agree that demonstrating robustness beyond SP-OOD serves as a valuable complementary analysis to further validate the general applicability of our method.\n\n**Regarding NSP-OOD**, we refer the reviewer to the dedicated section titled *\"Performance on Non-Spurious OOD Datasets\"* (line 200) in the supplementary materials. As shown in **Table 6**, SPROD consistently achieves near-perfect detection performance across all NSP datasets, further supporting its broad robustness.\n\n**Regarding conventional OOD datasets**, we initially focused on SP-OOD-related benchmarks due to their alignment with our problem setting and the extensive number of experiments required. However, we have now extended our evaluation to conventional datasets including **CIFAR-10**, **CIFAR-100**, and **ImageNet-1k** to demonstrate the reliability and generality of SPROD. We follow the OpenOOD benchmark protocol for post-hoc methods. For fair comparison, we selected the best-performing methods for each dataset as reported in Table 2 of the OpenOOD paper:\n\n* **CIFAR-10**: KNN and VIM for near-OOD and far-OOD, respectively\n* **CIFAR-100**: MLS and RMDS for near-OOD and far-OOD, respectively\n* **ImageNet-1k**: ASH as the top-performing method\n\nThe following table reports SPROD’s performance alongside these methods, with values for baselines taken directly from the OpenOOD paper:\n\n\n\n\n| Method    | CIFAR-10 Near | CIFAR-10 Far | CIFAR-100 Near | CIFAR-100 Far | ImageNet Near | ImageNet Far | **Avg (%)** |\n|-----------|---------------|--------------|----------------|----------------|----------------|----------------|------------|\n| RMDS      | 89.80         | 92.20        | 80.15          | **82.92**          | 76.99          | 86.38          | 84.74   |\n| MLS       | 87.52         | 91.10        | 81.05          | 79.67          | 76.46          | 89.57          | 84.23   |\n| VIM       | 88.68         | **93.48**        | 74.98          | 81.70          | 72.08          | 92.68          | 83.27   |\n| KNN       | **90.64**         | 92.96        | 80.18          | 82.40          | 71.10          | 90.18          | 84.58   |\n| ASH       | 75.12         | 78.49        | 78.20          | 80.58          | **78.17**          | **95.74**          | 81.05   |\n| **SPROD**     | 89.04         | 91.78        | **81.80**          | 79.93          | 75.06          | 95.29          | **85.15**   |\n\n\nThese results show that SPROD remains competitive with the best-performing methods on general OOD benchmarks and achieves the **highest average performance across all settings**.\n\n\n\n\n&nbsp;  \n___\n\n> **Reviewer Comment**: The article **lacks some ablation experiments**. The author can supplement some relevant ablation experiments, such as proving the effectiveness of stage 2 and stage 3.\n\n**Response**:\nWe agree that ablation studies are important for understanding the effectiveness of individual components. In Section *Ablation Study on SPROD Stages* (Supplementary, line 216), we include a dedicated analysis isolating each of the three stages of SPROD on the Waterbirds dataset under varying spurious correlation strengths (50% and 90%). Results in Figures 6 and 7 show that while Stage 1 provides a strong baseline, Stages 2 and 3 further enhance robustness under stronger spurious correlations.\n\n\n\n\n\n&nbsp;  \n___\n\n> **Reviewer Comment**: Currently, the application of CLIP in OOD detection is a research hotspot. I wonder how the proposed method can be used in **OOD detection based on CLIP**. Because the comparison method in the article **lacks the comparison of 2023-2025 methods** in recent years.\n\n**Response**:\n\n### Regarding CLIP-based methods\n\nWe appreciate the reviewer’s interest in recent CLIP-based approaches, which indeed represent an important direction in OOD detection research. We would like to clarify that our submission **includes a dedicated comparison with CLIP-based methods** in the supplementary material, specifically in **Subsection A.1 (line 75)**. In this subsection, we present both **quantitative results** (Table 1) and **detailed performance plots** (Figures 1 and 2). Our results show that **SPROD achieves state-of-the-art performance in this CLIP-based setup**, further validating its generality and robustness.\n\nAdditionally, in both this subsection and the main paper (**line 251**), we briefly discussed our reasons for not focusing extensively on CLIP-based experiments. In particular, the zero-shot setup of CLIP tends to bypass the effects of spurious correlations in the training data (which are central to our study) making it less suitable for analyzing how methods handle spurious attributes during learning. \n\n### Regarding 2023-2025 methods\n\nIn our main experiments, we selected 11 prominent post-hoc OOD detection methods, aiming to cover a broad range of representative techniques and to highlight their limitations in the **spurious-OOD** setting.\n\nTo further address the concern regarding **more recent methods (2023–2025)**, we additionally evaluated SPROD against **8 state-of-the-art post-hoc methods** on the pretrained ResNet-50 backbone (mirroring our second table in the main paper). The results are summarized below:\n\n| Method | WB | CA | UC | AMC | SpI | Avg |\n| --------- | ------------- | ------------- | ------------- | ------------- | ------------- | -------- |\n| NNGuide | 70.6 ±2.9 | 49.8 ±4.2 | 43.6 ±2.1 | 79.4 ±0.0 | 85.1 ±0.8 | 65.7 |\n| Relation | 80.7 ±0.2 | 60.4 ±2.5 | 96.0 ±0.5 | 74.5 ±0.3 | 81.8 ±0.7 | 78.7 |\n| ASH | 78.5 ±3.2 | 47.3 ±2.8 | 39.6 ±1.7 | 78.0 ±0.2 | **86.6 ±0.7** | 66.0 |\n| GEN | 62.3 ±0.6 | 46.0 ±1.4 | 38.5 ±0.3 | 80.2 ±0.0 | 80.8 ±0.4 | 61.6 |\n| NECO | 53.5 ±1.6 | 39.5 ±3.2 | 35.1 ±1.5 | 80.2 ±0.1 | 67.2 ±0.3 | 55.1 |\n| SCALE | 89.0 ±2.9 | 44.9 ±3.2 | 54.4 ±2.1 | 78.4 ±0.4 | 86.2 ±0.5 | 70.6 |\n| fDBD | 71.1 ±0.5 | 51.3 ±1.3 | 47.4 ±0.2 | 79.9 ±0.0 | 84.2 ±0.3 | 66.8 |\n| NCI | 84.0 ±0.1 | 46.4 ±2.4 | 54.8 ±0.8 | 78.5 ±0.1 | 84.9 ±0.2 | 69.7 |\n| **SPROD** | **98.8 ±0.0** | **61.6 ±0.9** | **97.4 ±0.0** | **82.1 ±0.5** | 85.3 ±0.0 | **85.0** |\n\nSPROD maintains consistently strong performance across all tasks and achieves the highest average AUROC among all methods. \n\n1. NNGuide: *Nearest Neighbor Guidance for Out-of-Distribution Detection*, ICCV, 2023\n2. RELATION: *Neural Relation Graph: A Unified Framework for Identifying Label Noise and Outlier Data*, NeurIPS, 2023\n3. ASH: *Extremely Simple Activation Shaping for Out-of-Distribution Detection*, ICLR, 2023\n4. GEN: *Pushing the Limits of Softmax-Based Out-of-Distribution Detection*, CVPR, 2023\n5. NECO: *NEural Collapse Based Out-of-distribution Detection*, ICLR, 2024\n6. SCALE: *Scaling for Training Time and Post-hoc Out-of-distribution Detection Enhancement*, ICLR, 2024\n7. fDBD: *Fast Decision Boundary based Out-of-Distribution Detector*, ICML, 2024\n8. NCI: *Detecting Out-of-distribution through the Lens of Neural Collapse*, CVPR, 2025\n\n\n&nbsp;  \n___\n\n> **Reviewer Comment**: In Figure 3 of the article, the square ICONS and other items are not specified.\n\n**Response**:\n\nThank you for pointing this out. The purple squares in Figure 3 represent spurious OOD samples. We labeled them in Figure 2 but inadvertently omitted the legend in Figure 3. We will correct this oversight in the camera-ready version."}, {"review_id": "sUKTfbbwzJ", "reviewer": "Reviewer_jXq2", "summary": "The paper presents a prototype-based OOD detection approach explicitly designed to address the challenge posed by unknown spurious correlations. The proposed method, SPROD, is a post-hoc technique that refines class prototypes to mitigate potential bias. For each test sample, the distance to the nearest prototype is used as the score for OOD detection. Comprehensive experiments on spurious correlation OOD detection benchmarks demonstrate superior performance compared to several standard OOD detection methods.", "questions": "Suggestions: It is recommended that the authors explicitly define the score function used in SPROD, rather than merely stating it.", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n* The paper is well-written and easy to follow. It clearly demonstrates the problem and will serve as a valuable resource for the OOD detection community.\n\n* The proposed method is straightforward and, in that sense, simple: it involves refining prototypes (similar to K-means clustering) and using the distance to the nearest prototype as the score function.\n\n* The presented experiments highlight the strength of the proposed approach, showing consistent improvements over 11 post-hoc baselines. The paper also includes other useful analyses, such as investigations into the scoring mechanism.\n\nWeaknesses:\n\n* My main concern is the lack of discussion or comparison with prior prototype-based OOD detection work. In recent years, several studies have explored prototype-based frameworks, and in this context, the proposed method does not appear significantly novel. The main contribution seems to lie in its focus on spurious OOD detection, rather than in introducing a fundamentally new technique.\nSome relevant examples include:\n1. Finding Dino: A Plug-and-Play Framework for Zero-Shot Detection of Out-of-Distribution Objects Using Prototypes\n2. Prototype-Based Optimal Transport for Out-of-Distribution Detection\n3. Learning with Mixture of Prototypes for Out-of-Distribution Detection\n\n* While the empirical results demonstrate the effectiveness of the method, it is not entirely clear how or why the group prototype refinement specifically helps in addressing spurious OOD detection. A deeper theoretical or conceptual justification would strengthen the contribution.", "was_revised": true, "final_justification": "The authors have addressed the concerns regarding the discussion with prior works and clear justification on the group prototype refinement.", "rebuttal": "### Discussion of prior work:\n> **Reviewer:** My main concern is the lack of discussion or comparison with prior prototype-based OOD detection work. In recent years, several studies have explored prototype-based frameworks, and in this context, the proposed method does not appear significantly novel. The main contribution seems to lie in its focus on spurious OOD detection, rather than in introducing a fundamentally new technique.\n\nWe appreciate the reviewer’s comment and agree that prototype-based approaches form a relevant and valuable category in OOD detection research.\n\nWe would like to clarify several points regarding both novelty and comparison:\n\n* In our main paper (line 171), we **explicitly highlight the strength of the pure prototypical method** (SPROD-1), which we believe has been **overlooked in prior post-hoc OOD literature**. To the best of our knowledge, no previous work presents this vanilla prototypical approach as a standalone post-hoc baseline for OOD detection.\n\n* We build upon this **strong baseline** by introducing two further stages that aim to reduce the effect of spurious biases through prototype splitting and refinement, resulting in a novel three-stage post-hoc framework.\n\nRegarding the third cited work, **Learning with Mixture of Prototypes (PALM)**, we were indeed aware of it. However, PALM involves a heavy training procedure with a specifically designed objective and therefore is **not compatible with our post-hoc setting**. That said, we found its ideas inspiring and included a **dedicated section** in the supplementary material titled *\"Analysis of Mixture of Prototypes\"* (line 265). In this section, we introduce a KMeans-based variant of SPROD that mirrors PALM’s core idea of intra-class prototype diversity, but implemented in a **fully post-hoc** manner without any retraining. Results in Tables 32–33 show that this KMeans variant achieves competitive performance, especially on datasets where spurious correlations are less prominent (e.g., Spurious ImageNet, where the main bias is class-extension and does not induce inter-class confusion).\n\n**Finding DINO (PROWL)** also leverages prototype ideas, but it is designed for a different domain (**pixel-level OOD detection in segmentation**), making it less comparable to our classification-based setting. While **POT** is another recent work using prototypes, it is not peer-reviewed, and we could not find a working **public implementation**.\n\n&nbsp;  \n___\n\n###  Theoretical or Conceptual justification:\n\n> **Reviewer:** While the empirical results demonstrate the effectiveness of the method, it is not entirely clear how or why the group prototype refinement specifically helps in addressing spurious OOD detection. A deeper theoretical or conceptual justification would strengthen the contribution.\n\nSPROD employs a two-step prototype refinement strategy to **approximate group-specific prototypes** within each class. First, it defines prototypes for correct and misclassified training samples, motivated by the observation that minority group instances are more prone to misclassification [JTT paper]. However, some correctly classified from minority samples may still be incorrectly assigned to biased prototypes. To address this, SPROD reassigns all training samples to their nearest prototype and recalculates the prototypes, reducing the majority prototype influence (see Figure 3).\n\nBy applying these two steps, SPROD aims to obtain nearly pure group-specific prototypes. We now provide a **theoretical overview**, to illustrate the systematic bias introduced by standard prototypical methods under strong spurious correlations, motivating the refinement of group-specific prototypes to **eliminate this bias**.\n\n* \\[1] *Just Train Twice*, ICML 2021\n\n### Feature Decomposition\n\nWithout loss of generality, we assume a binary classification problem with classes $c \\in \\{0,1\\}$. We consider a general decomposition of embeddings $z_i$ into three semantically distinct components: spurious, core, and irrelevant features. We model $z_i$ as a linear combination of three functionally distinct components that span the embedding space:\n\n$$\nz_i = \\sum_{j=1}^{n_{u_c^{sp}}} \\alpha_{i,j}^{sp} u_{c,j}^{sp} +\n\\sum_{j=1}^{n_{u_c^{core}}} \\beta_{i,j}^{core} u_{c,j}^{core} +\n\\sum_{j=1}^{n_{u^{irr}}} \\gamma_{i,j}^{irr} u_{j}^{irr},\n$$\n\nwhere the vector sets $\\{u_{c,j}^{sp}\\}$, $\\{u_{c,j}^{core}\\}$, and $\\{u_{j}^{irr}\\}$ form orthonormal bases for the spurious, core, and irrelevant subspaces. Each coefficient set $\\{\\alpha_{i,j}^{sp}\\}$, $\\{\\beta_{i,j}^{core}\\}$, and $\\{\\gamma_{i,j}^{irr}\\}$ is specific to instance $i$. This decomposition can be expressed compactly in matrix form:\n\n$$\nz_i = U_c^{sp} \\alpha_i^{sp} + U_c^{core} \\beta_i^{core} + U^{irr} \\gamma_i^{irr},\n$$\n\nwhere each $U^{(\\cdot)} \\in \\mathbb{R}^{d \\times n_u^{(\\cdot)}}$ is a matrix of orthonormal basis vectors. \nWe assume the coefficient vectors for each instance $z_i$ are drawn from class-conditional distributions: $\\alpha_i^{sp} \\sim P_c^{sp}$ and $\\beta_i^{core} \\sim P_c^{core}$, while the irrelevant component is shared across classes, i.e., $\\gamma_i^{irr} \\sim P^{irr}$.\n\n### Group Definitions\n\nWithin each class $c$,\n**Majority group** samples $z_i \\in S_c^{maj}$ satisfy\n$\\alpha_i^{sp} \\sim P_c^{sp}$,\n$\\beta_i^{core} \\sim P_c^{core}$.\n**Minority group** samples $z_i \\in S_c^{min}$ satisfy\n$\\alpha_i^{sp} \\sim P_{1-c}^{sp}$,\n$\\beta_i^{core} \\sim P_c^{core}$.\n\nThe ratio\n$r_c = \\frac{|S_c^{maj}|}{|S_c^{maj}| + |S_c^{min}|}$\nquantifies the class-conditional spurious correlation strength.\n\n### OOD Sample Definition\n\nWe define an OOD sample as:\n$$\nz_{OOD} = U_c^{sp} \\alpha_{OOD}^{sp} + U_c^{irr} \\gamma_{OOD}^{irr} + U^{ext} \\delta_{OOD}^{ext},\n$$\nwhere $\\alpha_{OOD}^{sp} \\sim P_c^{sp}$, \n$\\gamma_{OOD}^{irr} \\sim P^{irr}$, \nand $\\delta_{OOD}^{ext}$ and $U^{ext}$ capturs external factors not observed during training.\n\nHard OOD samples may also include core components drawn from a shifted distribution\n\n$$\n\\beta_{OOD}^{core} \\sim Q^{core} \\neq P^{core}_c.\n$$\n\nFor simplicity, we focus on near-OOD samples with no core or external components with\n$\\beta_{OOD}^{core} = 0$\nand\n$\\delta_{OOD}^{ext} = 0$.\n\nFor spurious-OOD groups, $\\alpha_{\\text{OOD}}^{\\text{sp}}$ is non-zero; in challenging cases, it follows the same distribution as the class spurious component $\\alpha_{\\text{OOD}}^{\\text{sp}} \\sim P_c^{\\text{sp}}$.\n\n### Prototype Calculation\n\nWe define the expected coefficient vectors for each subspace:\n\n$$\n\\mu_c^{core} = \\mathbb{E}_{\\beta \\sim P_c^{core}}[\\beta],\n$$\n\n$$\n\\mu_c^{sp} = \\mathbb{E}_{\\alpha \\sim P_c^{sp}}[\\alpha]\n$$\n\n$$\n\\mu^{irr} = \\mathbb{E}_{\\gamma \\sim P^{irr}}[\\gamma].\n$$\n\nUsing these, we define the majority and minority group prototypes for class $c \\in \\{0,1\\}$ as:\n\n$$\np_c^{maj} = U_c^{sp} \\mu_c^{sp} + U_c^{core} \\mu_c^{core} + U^{irr} \\mu^{irr},\n$$\n$$\np_c^{min} = U_c^{sp} \\mu_{1-c}^{sp} + U_c^{core} \\mu_c^{core} + U^{irr} \\mu^{irr}.\n$$\nThe overall class prototype is a convex combination of subgroup prototypes:\n$$\np_c = r_c p_c^{maj} + (1 - r_c) p_c^{min}.\n$$\n### Bias in Prototype Distances Under Strong Spurious Correlation\nConsider spurious-dominated regimes where $r_c \\approx 1$, then we have\n\n$$\np_c \\approx p_c^{maj}.\n$$\n\nLet $z_{\\text{OOD}} \\in S_c^{\\text{OOD}}$ be an OOD sample with spurious alignment to class $c$. The **score** is defined as the negative Euclidean distance to the nearest prototype. The expected squared distance to the biased class prototype is:\n$$\n\\mathbb{E}[\\|z_{OOD} - p_c\\|^2] = \\|\\mu_c^{core}\\|^2 + \\mathrm{Tr}(\\Sigma_c^{sp}) + \\mathrm{Tr}(\\Sigma^{irr}).\n$$\n\nHere, the first term corresponds to **core bias**, the second to spurious variance, and the third to irrelevant variance.\nNow consider an in-distribution sample from the minority group. Its expected squared distance to the majority prototype (biased class prototype) is:\n$$\n\\mathbb{E}[\\|z_{min} - p_c^{maj}\\|^2] = \\|\\mu_{1-c}^{sp} - \\mu_c^{sp}\\|^2 + \\mathrm{Tr}(\\Sigma_c^{core}) + \\mathrm{Tr}(\\Sigma^{irr}).\n$$\n\nIn this case, the first term represents **spurious bias**, followed by core variance and irrelevant variance, respectively.\nAlthough $z_{min}$ is an in-distribution sample, its distance to the biased prototype includes a spurious bias term, while the OOD sample differs only in the core direction. Depending on the relative magnitudes of the core and spurious bias terms, this highlights the potential for erroneous OOD detection.\n\nFor example, in the **Waterbird dataset**, the background (water or land) represents the spurious means $\\mu_c^{sp}$ and $\\mu_{1-c}^{sp}$. The difference $\\|\\mu_c^{sp} - \\mu_{1-c}^{sp}\\|$ may exceed the core bias in OOD distances, leading to incorrect OOD detection.\n\n### Why SPROD Mitigates Distance Bias\nIf prototypes can be accurately estimated to match each group's distribution, then each in-distribution sample $z_i \\in S_c^g$ can be compared to its corresponding prototype $\\hat{p}(z_i) = p_c^g$, where $g \\in \\{maj, min\\}$.\nBecause the prototype shares the same spurious basis alignment, the spurious bias is eliminated. The expected squared distance becomes:\n\n\n$$\n\\mathbb{E}[\\|z_i - \\hat{p}(z_i)\\|^2] = \\mathrm{Tr}(\\Sigma_c^{core}) + \\mathrm{Tr}(\\Sigma^{irr}),\n$$\n\nreflecting variance only, **with no bias terms**. In contrast, the **standard prototype-based approach** contains a **spurious bias** for minority samples:\n\n$$\n\\mathbb{E}[\\|z_{min} - p_c^{maj}\\|^2] = \\|\\mu_{1-c}^{sp} - \\mu_c^{sp}\\|^2 + \\mathrm{Tr}(\\Sigma_c^{core}) + \\mathrm{Tr}(\\Sigma^{irr}).\n$$\n\nFor a spurious-OOD sample, we also observe a **core bias** component:\n\n$$\n\\mathbb{E}[\\|z_{OOD} - \\hat{p}\\|^2] = \\|\\mu_c^{core}\\|^2 + \\mathrm{Tr}(\\Sigma_c^{core}) + \\mathrm{Tr}(\\Sigma^{irr}).\n$$\n\nComparing this to the expected squared distance of in-distribution samples using group-specific prototypes, we also conclude:\n\n$$\n\\mathbb{E}[\\|z_{OOD} - \\hat{p}\\|^2] > \\mathbb{E}[\\|z_i - \\hat{p}(z_i)\\|^2].\n$$"}, {"review_id": "HmEIQ703M4", "reviewer": "Reviewer_rDjS", "summary": "This work tackles the problem of OOD detection considering the OOD samples that share spurious features with the ID samples but differ in semantic labels. Specifically, the samples belong to the same classes are grouped into 1)  a group of correctly classified samples 2)  multiple groups of misclassified samples depending on which classes they are misclassified.  Following that, prototypes are calculated for all groups.  Subsequently, all samples are reassigned to each group depending on the proximity to the corresponding prototypes. Finally, the refined prototypes are computed as the mean of updated group members. During inference, OOD score is calculated based on  the distance to the nearest group prototypes.", "questions": "See weaknesses.", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- The paper is well-written, and the proposed Spurious-Aware Prototype Refinement for Reliable Out-of-Distribution 159 Detection (SPROD) is well-motivated. \n- The experiments on spurious OOD (SP-OOD) benchmark are comprehensive, and the performance is significant.\n\nWeaknesses:\n-   The results on non-spurious OOD (NSP-OOD) is missing. I understand that this work mainly focuses on the SP-OOD, however, i am wondering that whether the proposed SPROD is also effective on NSP-OOD, or at least maintain the performance on NSP-OOD.  This would significantly improve the contribution of this work. Therefore, the results on NSP-OOD are expected to present.  I will raise the score once this concern is addressed.\n- To demonstrate the generalization of proposed methods, the evaluate across different models such as ViT and BiT are expected to present. \n- Some baseline methods are missing such as GEN [1], NN-Guide [2], NECO[3] and FDBD[4]. \n- What is the (synthetic) datasets and model utilized to produce Figure 2?\n\n[1] GEN: Pushing the Limits of Softmax-Based Out-of-Distribution Detection, CVPR, 2023.\n\n[2] Nearest Neighbor Guidance for Out-of-Distribution Detection, ICCV, 2023.\n\n[3] NECO: NEural Collapse Based Out-of-distribution detection, ICLR, 2024.\n\n[4] Fast Decision Boundary based Out-of-Distribution Detector, ICML, 2024.", "was_revised": true, "final_justification": "Thanks for conducting the experiments. All my concerns are addressed.", "rebuttal": "> **Reviewer:** The results on non-spurious OOD (NSP-OOD) is missing. I understand that this work mainly focuses on the SP-OOD, however, i am wondering that whether the proposed SPROD is also effective on NSP-OOD, or at least maintain the performance on NSP-OOD. This would significantly improve the contribution of this work. Therefore, the results on NSP-OOD are expected to present. I will raise the score once this concern is addressed.\n\n**Response**:\n\nWe sincerely thank the reviewer for pointing this out. We agree that performance on standard non-spurious OOD (NSP-OOD) datasets is an important aspect, as it helps demonstrate the broader applicability and robustness of our method.\n\nWe would like to clarify that we have already included a dedicated section titled **“Performance on Non-Spurious OOD Datasets”** (Line 200 in the supplementary material). As shown in **Table 6**, SPROD consistently achieves near-perfect performance on all NSP datasets. However, the ID datasets in these experiments are the five datasets we used in the main paper (which have some degrees of spurious correlations). We focused on these datasets since they align with our core problem setup and we already had extensive experiments based on them.\n\nIn light of the reviewer’s helpful suggestion, we conducted **additional experiments** on three widely-used Standard OOD benchmarks: **CIFAR-10, CIFAR-100, and ImageNet-1k**, following the **OpenOOD benchmark setup**.\nBased on **Table 1** of the OpenOOD paper, the in-distribution and corresponding OOD datasets are:\n\n* **CIFAR-10**:\n* Near-OOD: CIFAR-100, TinyImageNet\n* Far-OOD: MNIST, SVHN, Textures, Places365\n* **CIFAR-100**:\n* Near-OOD: CIFAR-10\n* Far-OOD: MNIST, SVHN, Textures, Places365\n* **ImageNet-1k**:\n* Near-OOD: SSB-Hard, NINCO\n* Far-OOD: iNaturalist, Textures, OpenImage-O\n\nTo provide a meaningful comparison, we include results from **the top-performing methods per dataset** as reported in **Table 2 of the OpenOOD paper**:\n* CIFAR-10: **KNN**, **VIM**\n* CIFAR-100: **MLS**, **RMDS**\n* ImageNet-1k: **ASH**\n\nBelow we present the OOD detection performance of SPROD alongside these methods:\n\n| Method    | CIFAR-10 Near | CIFAR-10 Far | CIFAR-100 Near | CIFAR-100 Far | ImageNet Near | ImageNet Far | **Avg (%)** |\n|-----------|---------------|--------------|----------------|----------------|----------------|----------------|------------|\n| RMDS      | 89.80         | 92.20        | 80.15          | **82.92**          | 76.99          | 86.38          | 84.74   |\n| MLS       | 87.52         | 91.10        | 81.05          | 79.67          | 76.46          | 89.57          | 84.23   |\n| VIM       | 88.68         | **93.48**        | 74.98          | 81.70          | 72.08          | 92.68          | 83.27   |\n| KNN       | **90.64**         | 92.96        | 80.18          | 82.40          | 71.10          | 90.18          | 84.58   |\n| ASH       | 75.12         | 78.49        | 78.20          | 80.58          | **78.17**          | **95.74**          | 81.05   |\n| **SPROD**     | 89.04         | 91.78        | **81.80**          | 79.93          | 75.06          | 95.29          | **85.15**   |\n\n\nThese results indicate that SPROD performs **on par or better** than existing top methods in both near and far-OOD settings for standard benchmarks. Specifically, SPROD shows consistent performance across all datasets without any unusual degradation. We hope this addresses the reviewer’s concern and helps clarify the general applicability of our method beyond spurious OOD scenarios.\n\n\n\n\n\n\n&nbsp;  \n___\n> **Reviewer:** To demonstrate the generalization of proposed methods, the evaluate across different models such as ViT and BiT are expected to present.\n\n**Response**:\n\nThank you for the suggestion. We have evaluated SPROD across a wide range of backbone architectures, including both convolutional (e.g., ResNet-18/34/50/101, BiT-R50x1) and transformer-based models (e.g., ViT-S, DeiT-B, DINOv2, Swin-B, ConvNeXt-B), as detailed in the *Backbone Experiments* section (Supplementary, line 237). Tables 8–31 report extensive results across four OOD metrics and five datasets. Specifically, Tables 8–11 present aggregated results, showing that SPROD consistently ranks among the top performers across all backbones, further demonstrating the method’s reliability.\n\n\n\n&nbsp;  \n___\n> **Reviewer:** Some baseline methods are missing such as GEN [1], NN-Guide [2], NECO[3] and FDBD[4].\n\n**Response**:\n\nWe thank the reviewer for pointing out the absence of several recent post-hoc OOD detection methods, such as GEN, NNGuide, NECO, and fDBD. We agree that incorporating these methods strengthens the comprehensiveness and fairness of our evaluation.\n\nTo address this concern, we have conducted additional experiments on several state-of-the-art post-hoc techniques published between 2023 and 2025. The evaluations were performed using the **same pretrained ResNet-50 backbone** as in our main experiments (Table 2), ensuring a consistent comparison setting. The updated results are shown below:\n\n| Method | WB | CA | UC | AMC | SpI | Avg |\n| --------- | ------------- | ------------- | ------------- | ------------- | ------------- | -------- |\n| NNGuide | 70.6 ±2.9 | 49.8 ±4.2 | 43.6 ±2.1 | 79.4 ±0.0 | 85.1 ±0.8 | 65.7 |\n| Relation | 80.7 ±0.2 | 60.4 ±2.5 | 96.0 ±0.5 | 74.5 ±0.3 | 81.8 ±0.7 | 78.7 |\n| ASH | 78.5 ±3.2 | 47.3 ±2.8 | 39.6 ±1.7 | 78.0 ±0.2 | **86.6 ±0.7** | 66.0 |\n| GEN | 62.3 ±0.6 | 46.0 ±1.4 | 38.5 ±0.3 | 80.2 ±0.0 | 80.8 ±0.4 | 61.6 |\n| NECO | 53.5 ±1.6 | 39.5 ±3.2 | 35.1 ±1.5 | 80.2 ±0.1 | 67.2 ±0.3 | 55.1 |\n| SCALE | 89.0 ±2.9 | 44.9 ±3.2 | 54.4 ±2.1 | 78.4 ±0.4 | 86.2 ±0.5 | 70.6 |\n| fDBD | 71.1 ±0.5 | 51.3 ±1.3 | 47.4 ±0.2 | 79.9 ±0.0 | 84.2 ±0.3 | 66.8 |\n| NCI | 84.0 ±0.1 | 46.4 ±2.4 | 54.8 ±0.8 | 78.5 ±0.1 | 84.9 ±0.2 | 69.7 |\n| **SPROD** | **98.8 ±0.0** | **61.6 ±0.9** | **97.4 ±0.0** | **82.1 ±0.5** | 85.3 ±0.0 | **85.0** | \n\nAs evident from the results, **SPROD is consistently among the best-performing methods** across all datasets. We will include extended results in the final version and revise the manuscript to compare against these additional baselines. \n\n* \\[1] *NNGuide: Nearest Neighbor Guidance for Out-of-Distribution Detection*, ICCV 2023\n* \\[2] *RELATION: Neural Relation Graph*, NeurIPS 2023\n* \\[3] *ASH: Activation Shaping for OOD Detection*, ICLR 2023\n* \\[4] *GEN: Pushing the Limits of Softmax-Based OOD Detection*, CVPR 2023\n* \\[5] *NECO: Neural Collapse Based OOD Detection*, ICLR 2024\n* \\[6] *SCALE: Scaling for Training Time and Post-hoc OOD Detection*, ICLR 2024\n* \\[7] *fDBD: Fast Decision Boundary-Based OOD Detector*, ICML 2024\n* \\[8] *NCI: Detecting OOD through Neural Collapse*, CVPR 2025\n\n\n\n\n&nbsp;  \n___\n\n>  **Reviewer:** What is the (synthetic) datasets and model utilized to produce Figure 2?\n\n**Response**:\n\nThank you for the question. For Figure 2, we use a synthetic dataset where class-conditional distributions are **symmetric Gaussians in 2D**. In the **SP-OOD setting**, each class contains two subgroups (majority and minority), each modeled as a **Gaussian with different means and proportions** to simulate spurious correlations. We will clarify these details in the final version."}, {"review_id": "5zHRQJ4vP8", "reviewer": "Reviewer_ryHv", "summary": "This paper addresses spurious OOD and non-spurious OOD where the former contains spurious contexts combined with lack of features, and latter lacks both in an OOD setup. The authors suggest SPROD, a method which seeks a robust prototypes of ID classes in a 3 stage manner: seeking initial prototype, discovering minor prototype, and refining prototypes.", "questions": "1. Compared baselines in Table 2 are outdated. The latest work is done on 2022 while the submission date was mid 2025. Comparing with recent methods which are published since 2023 must be done. Especially, there is a github repository with numerous recent methods on https://github.com/Jingkang50/OpenOOD such as CombOOD, SCALE, AdaSCALE, NNGuide, ASH, GEN, RELATION, and more must be conducted and added to all Table 2. These should be done on general OOD test datasets (CIFAR10, CIFAR100, ImageNet) as well.\n2. OOD fundamentally deals with “unknownness” without any given prior knowledge related with OOD  samples which show up on testing. However, this work only conducts experiments on a strong prior OOD test dataset, where the datasets are designed explicitly related with “spurious” features. Only testing on datasets with such strong assumption hinders the practicality and fundamental reason of researching OOD detection. If SPROD works only well on spurious OOD setup, I doubt the practicality of the method as OOD samples wouldn’t be labeled as “spurious” when they are tested. Therefore, experiments on CIFAR10, CIFAR100, and ImageNet must be conducted in order to prove the robustness and show that SPROD is not only limited to spurious OOD dataset, but also robust on general OOD datasets.\n3. In table 2, results of FPR95 of SPROD is only the 4th comparing with other methods for the most complex dataset which is hard to insist it is the SOTA method.\n4. Figure 4 doesn’t represent well how much the correlation between spurious correlation rate and performance drop as the results aren’t presented numerically. It doesn’t look like the best way to present the correlation as a reader.\n5. The authors argue that generative scoring is better than discriminative scoring and present proper experimental configurations. However, results show no difference when datasets get more complex. Showing better performance only on simple dataset doesn’t indicate it is a better scoring method. Therefore, I doubt the fact of this statement.\n6. Table 1 in Supplementary should be in the main manuscript as it is comparing with related methods.\n\nOverall, my biggest concerns are 1. and 2. whose experiments should be done. Change of review results would highly depend on the results of these two questions.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengthness\n1. The paper brings up a less discussed topic, spurious OOD, which tackles to decrease the misleading correlation between spurious features and the object itself. \n2. Proper experiments were conducted to support the argument in the paper.\n3. Authors have conducted extensive amount of experiments.  \n\nWeakness\n1. Authors do not compare with recent baseline methods.\n2. This work should conduct experiments on general OOD datasets where the reasons are stated below.", "was_revised": true, "final_justification": "I increase the ratings for the following reasons\n\n1. I acknowledge the novelty of the work in terms of suggesting a new dataset and benchmarking regarding spurious correlation and also the effectiveness of the method on SP-OOD benchmarking.\n\n2. Also, the primary concerns regarding the performance of general OOD is important as it implies the general robustness on general OOD samples. However, SP-OOD has different goals, which is detecting worst cases which might cause critical issues or consequences. Despite that, the general performance is fair enough.", "rebuttal": "> **Reviewer:** Authors do not compare with recent baseline methods…\n\nWe appreciate the reviewer for pointing this out and fully agree that benchmarking against more recent methods is important for a comprehensive evaluation.\n\nIn our main experiments, we included **11 prominent post-hoc OOD detection methods**, selected to represent a broad spectrum of prior approaches and to highlight their limitations under the **spurious-OOD** setting. We acknowledge, however, that several recent state-of-the-art methods from top-tier conferences have been proposed since 2023, many of which are available in the OpenOOD repository, as the reviewer correctly points out.\n\nUsing the **same protocol and pretrained ResNet-50 backbone** as in Table 2 of our main paper, the results are summarized below:\n\n| Method | WB | CA | UC | AMC | SpI | Avg |\n| --------- | ------------- | ------------- | ------------- | ------------- | ------------- | -------- |\n| NNGuide | 70.6 | 49.8 | 43.6 | 79.4 | 85.1 | 65.7 |\n| Relation | 80.7 | 60.4 | 96.0 | 74.5 | 81.8 | 78.7 |\n| ASH | 78.5 | 47.3 | 39.6 | 78.0 | **86.6** | 66.0 |\n| GEN | 62.3 | 46.0 | 38.5 | 80.2 | 80.8 | 61.6 |\n| NECO | 53.5 | 39.5 | 35.1 | 80.2 | 67.2 | 55.1 |\n| SCALE | 89.0 | 44.9 | 54.4 | 78.4 | 86.2 | 70.6 |\n| fDBD | 71.1 | 51.3 | 47.4 | 79.9 | 84.2 | 66.8 |\n| NCI | 84.0 | 46.4 | 54.8 | 78.5 | 84.9 | 69.7 |\n| **SPROD** | **98.8** | **61.6** | **97.4** | **82.1** | 85.3 | **85.0** | \n\nAs seen, SPROD is consistently among the top-performing methods across datasets.\n\n* \\[1] *NNGuide*, ICCV 2023\n* \\[2] *Relation*, NeurIPS 2023\n* \\[3] *ASH*, ICLR 2023\n* \\[4] *GEN*, CVPR 2023\n* \\[5] *NECO*, ICLR 2024\n* \\[6] *SCALE*, ICLR 2024\n* \\[7] *fDBD*, ICML 2024\n* \\[8] *NCI*, CVPR 2025\n\n&nbsp;  \n___\n> **Reviewer:** This work should conduct experiments on general OOD datasets where the reasons are stated below…\n\nWe thank the reviewer for raising this important point. We agree that evaluating performance on widely used benchmarks provides a good indication of the general applicability of OOD detection methods.\n\nWhile our primary focus is on the SP-OOD problem setup, we would like to clarify that SPROD is not limited to spurious OOD settings. In fact, our method does not make any assumption about the presence of spurious correlations. If unknown spurious correlations exist in the training data, SPROD aims to discover them for more robust OOD detection. This is further supported by our ablation study using datasets with only 50% spurious correlation, where SPROD still demonstrates strong performance, indicating its robustness across varying levels of spuriousness.\n\nFollowing the reviewer’s concern, we have conducted additional experiments using CIFAR-10, CIFAR-100, and ImageNet-1k as in-distribution datasets. These experiments follow the standardized OpenOOD benchmark setup, where OOD datasets are selected according to Table 2 of the OpenOOD paper.\n\nWe report SPROD's performance alongside top-performing baseline methods, using values directly taken from the OpenOOD paper for fair comparison. The results are summarized in the table below:\n\n| Method    | CIFAR-10 Near | CIFAR-10 Far | CIFAR-100 Near | CIFAR-100 Far | ImageNet Near | ImageNet Far | **Avg (%)** |\n|-----------|---------------|--------------|----------------|----------------|----------------|----------------|------------|\n| RMDS      | 89.80         | 92.20        | 80.15          | **82.92**          | 76.99          | 86.38          | 84.74   |\n| MLS       | 87.52         | 91.10        | 81.05          | 79.67          | 76.46          | 89.57          | 84.23   |\n| VIM       | 88.68         | **93.48**        | 74.98          | 81.70          | 72.08          | 92.68          | 83.27   |\n| KNN       | **90.64**         | 92.96        | 80.18          | 82.40          | 71.10          | 90.18          | 84.58   |\n| ASH       | 75.12         | 78.49        | 78.20          | 80.58          | **78.17**          | **95.74**          | 81.05   |\n| **SPROD**     | 89.04         | 91.78        | **81.80**          | 79.93          | 75.06          | 95.29          | **85.15**   |\n\nThese results show that SPROD remains competitive with the best-performing methods and achieves the **highest average performance** across all settings.\n\n&nbsp;  \n___\n> **Reviewer:** In table 2, results of FPR95 of SPROD is only the 4th comparing with other methods for the most complex dataset which is hard to insist it is the SOTA method.\n\nWe fully acknowledge that our method does not outperform all others across every scenario. However, a core strength of SPROD lies in its **consistency** across a wide range of datasets and model backbones. While some methods may excel on specific benchmarks, they often suffer from performance drops elsewhere. In contrast, SPROD consistently ranks among the top-performing methods across various settings. This is more comprehensively illustrated in Tables 8–11 of the supplementary material, which highlights SPROD’s stability and reliability.\n\nOne central goal of our paper is to **broaden the experimental scope** of Spurious-OOD detection. Prior work often focused on one or two datasets, limiting generalizability. We introduced the **Animals MetaCoCo** dataset to encourage evaluation under more diverse and realistic conditions. While this dataset enriches the benchmark space, it is **not fully aligned** with our method's assumptions: SPROD relies on **misclassification signals** to detect unknown spurious features. As shown in Table 5 (supplementary), the attribute imbalance in Animals MetaCoCo is highly entangled and lacks clear spurious correlations, unlike datasets such as Waterbirds or UrbanCars. \n\nThe **SpuriousImageNet** dataset poses additional challenges. As noted in line 192 of the supplementary material, many spurious correlations here fall under the **\"Class Extension\"** type (shortcut features that appear in one class but are not shared across others), thus not increasing misclassification risk. Since SPROD detects unknown spurious features via their impact on misclassification, it is inherently limited in such settings. We believe future methods with partial group supervision may be better suited for this dataset and further advance trustworthy AI. Nonetheless, we included SpuriousImageNet to promote **more diverse evaluations**, even though it is **less compatible with our group-supervision-free framework**. \n\n\n&nbsp;  \n___\n> **Reviewer:** Figure 4 doesn’t represent well how much the correlation between spurious correlation rate and performance drop as the results aren’t presented numerically. It doesn’t look like the best way to present the correlation as a reader.\n\nThe figure combines multiple dimensions of comparison into a single visualization (different baselines, two model backbones, two types of correlation metrics, and two training settings) and may have become too complex to clearly convey the correlation between spurious correlation rate and performance drop. To address this, we will revise the presentation by including a dedicated figure or table that focuses specifically on the correlation, with numerical values to improve clarity and interpretability for the reader. While our original intent was to offer a compact representation for breadth, we agree that a focused presentation would better serve the reader.\n\n&nbsp;  \n___\n> **Reviewer:** The authors argue that generative scoring is better than discriminative scoring and present proper experimental configurations. However, results show no difference when datasets get more complex. Showing better performance only on simple dataset doesn’t indicate it is a better scoring method. Therefore, I doubt the fact of this statement.\n\nWe agree that in some datasets, even for a fixed method such as SPROD, the difference between discriminative and generative scoring is negligible. Indeed, we do not claim that the generative approach will *always* outperform the discriminative one. As we indicated in line 132, we indicate that softmax-based (discriminative) scoring fails in **certain cases**.\n\nA trivial but illustrative case is presented in Figure 2 (a), which shows a scenario where OOD samples lie far from all class distributions. In such cases, discriminative scoring, which **only relies on distance to the decision boundary**, may incorrectly identify far-away OOD samples as in-distribution, simply because they are marginally far from the decision boundary than some ID samples.\n\nIn contrast, as shown in Figure 2 (b), generative scoring (based on distributional distance) can easily detect these far-OOD samples. Further in the SP-OOD setting, we highlight an additional risk introduced by biased decision boundaries. A recent study also emphasizes that discriminative classifiers are particularly sensitive to spurious shortcuts \\[1].\n\nFinally, we would like to point out that this discussion primarily serves as a motivational context for our proposed method and is not a core axis of the paper. We believe this direction deserves a dedicated study to fully explore its theoretical and experimental implications.\n\n\\[1] Generative Classifiers Avoid Shortcut Solutions, ICLR 2025 \n\n&nbsp;  \n___\n> **Reviewer:** Table 1 in Supplementary should be in the main manuscript as it is comparing with related methods.\n\nWe agree that **Table 1 in the Supplementary** provides a valuable comparison in the multi-modal domain. The main reason we did not focus on CLIP-based experiments is explained in both Section A.1 of the Supplementary and in the main paper (line 251). For example, the zero-shot setup of CLIP often bypasses spurious correlations in the training data, which limits its usefulness for studying how methods respond to spurious attributes during learning, which is a primary concern of our study.\n\nThat said, given the increasing attention on CLIP-based settings in recent research, we will include a small comparison table in the main paper for the final version."}]

Author rebuttal:

Meta-review: This paper introduces a post hoc prototype refinement framework for OOD detection, handling spurious OOD scenarios. Reviewers appreciated the clarity and motivation of the work, and the thorough experimental evaluation. Additional experiments were provided during rebuttal and addressed the main concerns with the new results. 
Another part of major concerns were raised regarding incremental novelty and overlap with existing prototype-based methods, especially the prototype-based and mixture of prototype-base methods, as mentioned by jXq2 and some relevant baseline models mentioned by rDjS. The AC also recognized this issue and thinks this is crucial. The rebuttal gave clarification and satisfied reviewers. The AC strongly encourages the authors to incorporate the additional results into the paper. In particular, the work should include clearer discussion of the most relevant **prototype-based** methods (e.g., PALM, CIDER [ICLR’23], etc) in the suitable position of the **main paper**, considering the obvious connections, even if these require training or target different applications, to place the contribution in proper context. 

Overall, despite some limitations, the paper is well executed and presents a practical and effective solution. The AC recommends acceptance and suggests the authors to integrate these revisions into the final version, including *discussions with related works*, *added comparisons*, and *others addressed during rebuttal*.
Decision: Accept (poster)