Out-of-Distribution Detection with Relative Angles
Authors: Berker Demirel
Marco Fumero
Francesco Locatello
Venue: NeurIPS 2025 poster ()
Keywords: out-of-distribution
out-of-distribution detection
decision boundaries
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Deep learning systems deployed in real-world applications often encounter data that is different from their in-distribution (ID). A reliable model should ideally abstain from making decisions in this out-of-distribution (OOD) setting. Existing state-of-the-art methods primarily focus on feature distances, such as k-th nearest neighbors and distances to decision boundaries, either overlooking or ineffectively using in-distribution statistics. In this work, we propose a novel angle-based metric for OOD detection that is computed relative to the in-distribution structure. We demonstrate that the angles between feature representations and decision boundaries, viewed from the mean of in-distribution features, serve as an effective discriminative factor between ID and OOD data. We evaluate our method on nine ImageNet-pretrained models. Our approach achieves the lowest FPR in 5 out of 9 ImageNet models, obtains the best average FPR overall, and consistently ranking among the top 3 across all evaluated models. Furthermore, we highlight the benefits of contrastive representations by showing strong performance with ResNet SCL and CLIP architectures. Finally, we demonstrate that the scale-invariant nature of our score enables an ensemble strategy via simple score summation.

Out-of-Distribution Detection with Relative Angles
Berker Demirel
Marco Fumero
Institute Science and Technology Austria 3400 Klosterneuburg. Austria
Institute of Science and Technology Austria
3400 Klosterneuburg Austria marco www.ro@ist. ac.
berker.. borkkrr.emiree www.reeliist.acc.....
Francesco Locatello
Institute of Science and Technology Austria
3400 Klostemeuuurg. Austria
www.cceeo...cattelleen ac.
Abstract
Deep learning systems deployed in real-world applications often encounter data that is different from their in-distribution (ID). A reliable model should ideally abstain from making decisions in this out-of- out-of-distribution (OOD) setting. Existing state-of- the-art methods primarily focus on feature distances, such k-th nearest neighbors and distances to decision boundaries, either overlooking or ineffectively using in- distribution statistics. In this work, we propose a novel angle- nagle-based metric for OOD detection that is computed relative to the in-distribution structure. We demonstrate that the angles between feature representations and decision boundaries, viewed from the mean of in-distribution features, serve as an effective discriminative factor between and OOD data. We evaluate our method on nine ImageNet- pretrained models. Our approach achieves the lowest FPR in 5 out of 9 ImageNet models, obtains the best average FPR overall, and consistently ranking among the top 3 across all evaluated models. Furthermore, contrastive representations by showing strong performance with ResNet SCL and CLIP architectures. Finally, demonstrate that the ccale-invariant nature of our score enables an ensemble strategy via simple score summation. Code is available at http://hhh.c.moeee//ce//ee/////a -eee--D-tetiio----- Deeeectioonwwthh-eee Relative-Angle
highlight the benefits of
Introduction
A trustworthy deep learning system should not only produce accurate predictions, but also recognize when is processing an unknown sample. The ability identify when sample deviates from the expected distribution, and potentially rejecting it, plays crucial role especially in safety-critical applications, such as medical diagnosis [Fernando al., 2021]. driverless cars [Bogdoll al., 2022] and surveillance systems [Diehl and Hampshire, 2002]. The out- out-of-distribution (OOD) detection problem addresses the challenge of distinguishing between in-distributio (ID) and OOD data essentially, drawing line between what the system knows and what it does not.
Various approaches have been proposed for OOD detection, mainly falling into two categories: (i) methods that suggest model regularization during training [Lee et al., 2018, Hendrycks et al., 2019, Meinke and Hein, 2020, Liu and Qin, 2025, Ammar al., 2024], and (ii) post-hoc methods, which leverage a pre-trained model to determine if a sample is OOD by designing appropriate score functions [Peng al., 2024, Hendrycks and Gimpel, 2022, Sun al., 2022]. Post-hoc methods more advantageous for their efficiency and flexibility, as they can be applied to arbitrary pre- tre-trained models without retraining. These approaches are often categorized based on the domain of their score functions, i.c., at which representational abstraction level they assess if a sample is OOD or
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

not. Earlier techniques focus on measuring the model confidence in the logits space [Hendrycks and Gimpel, 2022, Liu et al., 2020]. while the recent works employ distance- based scores [Sun et al., 2022, Sehwag et al., 2021] I] defined in the model feature space. While logit-based methods suffer from the overconfident predictions of neural networks [Minderer et al., 2021, Lakshminarayanan et al., 2017, Guo et al., 2017], the recent success of distance-based techniques highlights that the relationships in the latent space can provide a richer analysis.
A natural approach to feature representations is by checking their proximity to the decision boundaries [Liu and Qin, 2024]. Conceptually, this can be related to identifying hard-to-learn examples in data-efficient learning [Joshi et al., 2024, Chen et al., 2023]. OOD samples can be viewed as hard-to-leame since they do not share the same label distribution as ID data. The success of this approach has been directly showed in fDBD score from Liu and Qin [2024]. However, our derivations revealed that the regularization term they use to incorporate IDD statisties introduces an additional term that does not correlate with ID/OOD separation, ultimately hindering their performance.
In this work, we present OOD Detection with Relative Angles (ORA), a novel approach that exploits the relationship between feature representations and classifier decision boundaries, in the context of the mean statisties of ID features. Unlike the earlier techniques, ORA introduces new angle-based measure that calculates the angles between the feature representations and their projection onto the decision boundaries, relative to the the mean statistics of ID features. Changing reference frame to the mean of ID features adds another layer of discriminatory information to the score, as it naturally incorporates the ID statistics to the distance notion, exploiting the disparity between ID and OOD statistics. Moreover, the scale-invariant nature of angle-based representations, similarly observed in Moschella et al. [2023], allows us to aggregate the confidence scores from multiple pre-trained models simply by summing their ORA scores. This enables to have score that can be single model based or extended to ensemble of models. In summary, our key contributions include:
We present a novel post-hoc OOD score, which computes the angles between the feature represen- tation and its projection to the decision boundaries, relative the mean of ID-features
We conduct extensive evaluation the ImageNet OOD benchmark using 9 model backbones, including modern transformer- achieves the best average FPR95 across all models, ranks the top 3 for every model, and the best- pest-performing method on 5 out of 9 models.
architectures and compare 12 detection methods. ORA
We analyze the benefits of using contrastively learned features with ORA. Our method achieves the best performance on CIFAR-10 10 with ResNet18-SCI and on ImageNet with ResNet50-SCCI reducing average FPR95 by 0.88% and 7.74% respectively. We further validate this trend with the CLIP model, where ORA achieves strong results in both zero-shot (25.85% FPR95) and linear probing (23.94% FPR95) settings.
ORA's scale- inlleinnverence allows aggregation of confidence scores from multiple pre-trat pre-trained models, enabling an effective ensemble. Our experiments show that the ORA ensemble reduces the FPR95 by 2.51 % on the ImageNet OOD benchmark compared to the best single model performance.
2 Related Work
Previous work in OOD detection falls into two categories: (i) methods that regularize models during training to produce different outcomes for ID and OOD data, and (ii) post-hoc methods that develop scoring mechanisms using pre-trained models on ID data.
Model regularization. Early methods addressing the OOD detection problem Bevandić al. [2019], Hendrycks et al. [2019] utilize additional datasets to represent out-of-distribution data, train- ing models with both positive and negative samples. This approach assumes a specific nature of OOD data, potentially limiting its effectiveness when encountering OOD samples that deviate from this assumption during inference. Malinin and Gales [2018] designed a network architecture to measure distributional uncertainty. In Geifman and El- Yaniv [2019]'s work, they provide another architecture with an additional reject option to abstain from answering. Ming et al. [2022], Du et al. [2022], fo- cused on synthesizing outliers rather than relying on auxilary datasets. On the other hand, Van Amers- foort et al. [2020], Wei al. [2022] argued that overconfident predictions of the networks on OOD data are the problem to be mitigated. For example, Van Amersfoort et al. [2020] puts additional gradient

---

M000
208
ZID
7BB
C2
C2
μID
AAID
(a)
(b) OOD
Figure I: Geometric visualization of ORA for in-distribution (left) and out-of-distribution (right) cases. ORA focuses on the angular distance between the feature representation and the decision boundary, from the perspective of the in-distribution mean. The angle 0 serves as the distinguishing factor between ID and OOD samples, with 0ID > BOOD-
penalty to limit the confidence of the network. Whereas, Wei et al. [2022] tackled the same problem by enforcing a constant logit vector norm during training. Although is natural to impose structures during training for better OOD detection, these methods face the trade-off between OOD separability and model performance. Moreover, such approaches lack the flexibility of post-hoc score functions, as they necessitate model retraining which can be both time-consuming and computationally expensive.
Score functions. Recently, developing score functions for pretrained models on ID data has gained attention due to its ease of implementation and flexibility. These methods typically either couple feature representations with distance metrics, or measure a model's confidence using its logits. Beyond canonical works such as Maximum Softmax Probability [Hendrycks and Gimpel, 2022], ODIN score [Liang et al., 2018]. Energy score [Liu et al., 2020], we observed many advancements in post-hoc score design. For example, the activation shaping algorithms such as ASH [Djurisic et al., 2023], Scale [Xu et al., 2024b], and ReAct [Sun et al., 2021], J, apply activation truncations to feature representations, reducing model's confidence for OOD data. These methods can be used in conjunction with ORA improving the performance. Recent distance- based methods KNN [Sun al., 2022], NNGuide [Park al., 2023], R-Mah [Ren et al., 2021]. Maha+ [Müller and Hein] and MBDD [Liu and Qin, 2024] successfully utilized the feature representations from networks. Both NNGuide and KNN assign a score to a sample based on the kth nearest neighbor set. R-Mah measures the relative Mahalanobis distance between class centroids and the overall data centroid. In contrast, fDBD assigns a score to a sample based on its estimate of the distance between the feature representation and the decision boundaries. Moreover, recent angle-based methods such as P-Cos [Galil et al.] and R-Cos [Bitterwolf et al., 2023) assign scores based on the cosine similarity between representations and class centroids.
training
Our work falls into the score function category. serving as a plug-in for any pre-trained model on ID data. ORA combines feature space and logit space methods by utilizing the relative angle between the feature representation and its projections to the decision boundaries. Among the existing works, the closest approach to our method is fDBD, which uses lower bound estimate to the decision boundaries. However, the regularization term they introduced inadvertently includes a term in their equation that is uncorrelated with being OOD ID and can change spuriously, impeding performance. In contrast, we provide a score function that effectively incorporates in-distribution context and maintains scale invariance, all without extra regularization terms.
3 Method
Problem Setting. We consider a supervised classification setting with input space X' and label space y, following the literature Yang et al. [2024]. Given model f X - R > pretrained on an in-distribution dataset D = {x,,, M.) where elements of DTD are drawn from joint distribution Pxy, with support x V. We denote its marginal distribution on as PtD. The OOD detection problem aims to determine whether an input sample originates from the in-distribution PID or not. Let VOOD be a set of labels such that y 0 YOOD 0. OOD samples are drawn from distribution PooD which is the marginal distribution on X' of the joint distribution over X x VOOD
3

---

i.e, they share the same imput space X' as in-distribution samples, but have labels outside y Shifting from PID to PooD corresponds semantic change in the label space.
The OOD decision can be made via the function X' - (ID, given a score function X + R such that:
ID sx 2 A s, = OOOD (x: <
where samples with high scores are classified as ID, according to the threshold X. For example, to compute the standard FPR95 metric [Yang et al., 2024]. the threshold À chosen such that it correctly classifies 95% of ID held-out data. An ideal OOD score function should capture differences in model outputs between samples drawn from PID and POOD. effectively detecting inputs from unseen classes.
3.1
Detection with Relative Angles
This section introduces our OOD score function, which leverages relative angles in feature space to relate feature representations decision boundaries, distinguishing ID from OOD samples. Figure provides a geometric visualization of our method. Our approach leverages the geometric relationships between three key points in the feature space: (i) the initial representation of sample, (ii) its projection onto the decision boundary, and (iii) the mean of in-distribution features.
We propose using the relation between feature representations and decision boundaries by deriving closed-form plane equations for the decision boundaries between any two classes. Specifically, examine the angle formed between the feature representation vector and its projection onto the decision boundary. However, this angle is sensitive to the choice of origin, creating an ambiguity the geometrie relationship between the feature representation and the decision boundary should be consslationinvariannn To address this, we propose to represent features in a reference frame relative to the mean of the in-distribution samples. Therefore, incorporate ID characteristics by centering around its mean, while ensuring scale and translation invariance.
We observe that the angle between the centered representation and its projection onto the decision boundary is larger for ID data, indicating them requiring higher cost to change their label which captures the model's confidence. In contrast, for OOD data, angle is smaller since they are expected to more unstable, as they do not contain strong clues about their predicted classes (see Figure 1 for conceptual explanation).
Our framework provides concise scoring with useful properties such as translation and scale invariance. These properties enable ORA to be used in conjunction with existing activation shaping algorithms and allow for confidence aggregation across different models through score summation.
3.2 Features on the Decision Boundary
In this section, we derive the mathematical equations and demonstrate the properties of our score. The model can be rewritten as a composed function fi fL. o g. where L the number of layers and g IR_2 RDD corresponds the last layer classification head. The function g(z) Wz b maps penultimate layer features E RRD to the logits space via W RDiiD and b E RR 11, The decision boundary between any two classes and y2 with yn # can be represented as:
DB M1.92 = (W ) ) bby byy = 0
where Wy, (or Wys denotes the the vectors of W corresponding class y1 (respectively y2) and similarly, by, by. are the bias values corresponding to classes y1 and y2. Intuitively, given a fixed classifier, this equation is satisfied for all z such that their corresponding logits for class yn1 and 3/2 are equal. Then, feature representations can be projected onto the hyperplane that defines the decision boundary:
(Wy)
W Wa TT + (by, byz) (Wy)
= 2
W
(1)
[wy
wya

---

Let MiD E RRD be the mean of the in-distribution feature representations. Centering w.r.t Mn corresponds shifting the origin to Pin- In this new reference frame, three key points form triangle in D-dimensional space: the centered feature vector (z μAD), its projection onto the decision boundary (Zdb - (DD) and the new origin (see Figure 1). Then, rather than the absolute distance between and dbb. we use the relative angle f wn (z) from the in-distribution feature representation' s reference frame. This captures the position of features and the decision boundaries relative to the in-distribution data, while also being scale invariant:
(z MID,, Zib
MID)
0n (z) arcoos
z
7ddb
FAD
Our score function captures the maximum discrepancy of the relative angles between the centered feature representation and its projections DB where ý arg maxxey g(z) is the predicted class, and y' E 3/ + Therefore for a sample X, given Si Sr, (x) we can write the score 8 sxx, f) as a function z:
(z) max ((0y.r (2))
Intuitively, our score function captures several key aspects:
Confidence measure. The angle between the feature representation and its projection onto decision boundary is proportional to the distance between them, serving proxy for the model's confidence.
In-distribution context. By centering the space using the mean of in-distribution features, incorporate ID statistics, improving angle separability across points.
Maximum discrepancy. selects the furthest decision boundary by finding the maximum angle across classes. This captures the model's confidence in the least likely class.
Scale invariance. Unlike absolute distances, angles remain consistent even if the feature space is scaled, allowing for fair comparisons between different models. See Appendix for theoretical justification of angle-based scores.
Relation with the state-of-the-art fDBD [Liu and Qin, 2024]). We now provide geometric interpretation for the score function fDBD. Using our analysis, we identified that their score can directly be mapped into the triangle we formed in Figure For a sample x E X:
IDBD(z) = d(z, Z,1h)
1z MID
where z E R. the feature representations of the input x E X' Z,6 E R its projection onto the decision boundary, and d(:,-) is the euclidean distance. Although seemingly unrelated, we can connect this score to our relative angle and demonstrate that the regularization term on the denominator brings term that does effectively discriminate between OOD and ID. Using translation invariance of the euclidean distance, the same score can be written as:
d(z MID, Zob FID
(DBD(z)
d(z z 1AD, 0)
One observe that, this is the ratio of two sides of the triangle formed between the points amp. and the origin. Using the law of sines:
Zdb Fn
d(z - MID Zibb pi))
d(z MaD. 0)
sin (0) sin (a) d(z LMD
d(z MID - pID) IDBD(z)
sin (0)
sin
(ox)
where and a are the angles opposite to the sides z FTD (Zab (T) and anD respectively. Although the observation they made comparing the distances to the decision boundaries equal
5

---

deviation levels from the mean of in dn-diisrributin is inspiring, we claim that the angle a is not very informative for ID and OOD separation. This is because a is connected to the magnitude of the feature vector relative to μiD, which may not directly correlate with OOD characteristics. On Figure 2 we show the sin (ax) values between CIFAR-10 [Krizhevsky, 2009] and Texture [Cimpoi et al., 2014] datasets, empirically justifying that including this term impedes fDBD's performance. Omitting the denominator from Equation 4 allows to effectively capture the relation between the feature representation and the decision boundary from the mean of in-distribution's 's view. See Appendix J for more detailed explanation on the performance relationship between raw distance, fDBD and ORA.
Experiments
In this section, we first test ORA on large-sale Ima- geNet OOD benchmark [Deng et al., 2009] that spans nine models -including ConvNeXt [Liu et al., 2022], Swin [Liu et al., 2021]. DeiT [Touvron et al., 2021] and EVA [Fang et al., 2023] to establish the perfor- mance beyond the usual ResNet-50 [He et al., 2016]
CIFAR-I0 vs Texture
Density
setting. We then demonstrate how ORA benefits from contrastively learned features (i) on CLIP [Rad- ford et al., 2021] in both zero-shot and linear-probe modes, and (ii) on CIFAR-10 10 [Krizhevsky, 2009] and ImageNet with ResNetl 8/50 checkpoints trained with supervised contrastive (SCL) loss [Khosla et al., 2020]. Next, we show that ORA's scale-invariant scores can be mnsemble-summee for additional gains, and that it pairs seamlessly with post-hoc activation-shaping methods such as ReAct and ASH. Finally, we present an ablation study to asses the contributions of key design choices.
6.90
(c)
Figure 2: Histogram of ID (CIFAR-10) 10) and OOD (Texture) samples with respect to the sine of the angle formed with the vector z PID- This empirically shows that sin (a) is not highly informative for distinguishing ID from OOD.
across architectures
Benchmarks. We consider two widely used benchmarks: CIFAR-10 [Krizhevsky, 2009] and ImageNet [Deng al., 2009]). We included the evaluation CIFAR-10 OOD Benchmark to show the performance on smaller scale datasets. In CIFAR-10 experiments, we use a pretrained ResNet-18 architecture He et al. [2016] trained with supervised contrastive loss [Khosla al., 2020], following previous literature Liu and Qin [2024], Sun et al. [2022], Sehwag et al. [2021]. During inference 10.000 test samples are used to set the in-distribution scores and choose the threshold value A; while the datasets SVHN [Netzer et al., 201 IJ. iSUN [Xu et al., 2015], Places365 [Zhou et al., 2017] and Texture [Cimpoi al., 2014) 4] are used to obtain cuitof-distribution scores and metric evaluation.
For the large-scale ImageNet OOD benchmark, we extend prior evaluations [Liu and Qin, 2024, Sun et al., 2022, Park al., 2023, Ren et al., 2021, Sun et al., 2021, Xu et al., 2024b] by going beyond ResNet-50 and including a diverse set of nine models, such as ConvNeXt [L.uu et al., 2022], Swin Transformer [Liu al., 2021], DeiTT [Touurron al., 2021], and EVA [Fang et al., 2023], along with their ImtgeNet-21k pretrained counterparts when available. This broader evaluation allows a more comprehensive assessment of OOD detection performance across modern architectures. A validation set of 50,000 ImageNet samples is used to set ID scores and the threshold, while the OOD datasets include iNaturalist [Van Horn et al., 2018], SUN [Xiao et al., 2010], Places365 [Zhou al., 2017], and Texture [Cimpoi et al., 2014]. Note that, in this typical OOD Detection Benchmarks the samples that have same classes as ID are removed from their OOD counterparts, following the work Huang and Li [2021] and fitting into our problem setting.
Metrics. We report two metrics in our experiments: False-positie rate at %95 true positive rate (FPR95), and Area Under the Receiver Operating Characteristic Curve (AUROC). FPR95 measures what percentage of OOD data we falsely classify as ID where our threshold includes 95% of ID data, Therefore, smaller FPR95 indicates a better performance by sharply controlling the false positive rate. On the other hand, AUROC measures the model's 's ability to distinguish between ID and OOD by calculating the area under the curve that plots the true positive rate against the false positive rate across thresholds. AUROC shows how rapidly we include ID data while paying the cost of including false positives. Thus, higher AUROC shows better result.

---

Table I: Average FPR95 (%) the ImageNet OOD detection benchmark. Each column corresponds to a different detection method, and each row to a model backbone. Lower values indicate better performance. The best result per is highlighted in bold.
Model
MSP
MaxL
Energy
R-Mah
R-Cos
P-Cos
NNG
KNN+
IDBD
NC1
Maha+
NECO
ConyNeXI
63.54
60.69
78,70
45.79
46.99
49.37
39.54
47.40
39.03
36.44
36.68
34,52
34,92
-oe
76.91
42.13
Swin
61.99
59.21
65.78
45.25
46.26
49.37
57.34
53.79
52.34
57.25
48.21
58.24
51.56
Swin-pre
46.20
40.86
42.33
39.40
35,66
33,94
44.06
51.34
38.92
39.63
42,67
36.49
35.13
DeiT
57.48
57.52
70.05
52.51
47.63
61.62
58.02
71.34
55.98
58.11
54.18
58.49
54.16
DeiT-pre
57.45
54.72
55.56
39.37
38.49
39.11
43.56
44.18
46.69
57.76
38.68
52.61
37.76
EVA
43.75
40.37
43,40
27.45
27.94
27.68
37.33
14.19
36.10
39.34
31.11
36.05
33.17
Res-50 50
66.95
64.29
58.41
83,29
59.51
45.53
55.22
53.97
51.19
63.03
49.67
56.62
43.63
Res-50
(SCL) (SCL)
50.06
97.59
98.46
77.52
48.18
31.57
98.80
38.47
32.78
96.02
45.06
97.58
25.04
Average
54.78
57.52
62.18
49.50
42.98
41.52
56.75
52.43
43,90
55.34
42.64
51.67
38.34
4.1 OOD Detection on ImageNet Benchmark
Table presents an extensive evaluation of OOD detection performance on the ImageNet benchmark, spanning diverse model backbones and 12 scoring methods. In contrast to prior work that typically centers evaluation on ResNet-50Liu and Qin [2024], Sun et al. [2022], Park et al. [2023], Ren et al. [2021], Sun et al. [2021], Xu et al. [2024b], we expand the setting include modern transformer-basee architectures ConvNeXt, Swin, DeiT, and EVA-as as well as their ImageNet-211 pretrained variants when available. This large-scale comparison provides better performance evaluation across architectures.
ORA consistently demonstrates strong performance across the board. It achieves the best average FPR95 across all models at 38,34, outperforming the second-best method by a margin of 3. 18% and the best FPR95 in 5 out of 9 model settings. Notably, ORA achieves the single best FPR95 score overall with 25.04% on the ResNet-50 (SCL) model, outperforming the next-best score of 27.45% obtained by R-Mah with EVA by margin of 2.41%.
Furthermore, the few cases where ORA is not the pe--efforming method suchhssuchhhh as with vanilla Swin or DeiT models there is no alternative method that clearly dominates. The best-perfoo rest-performing method varies across these settings (R-Mah, R-Cos and P-Cos). indicating that no other baseline consistently adapts well to different backbones. In contrast, ORA remains within the top three methods across all model architectures, demonstrating both robustness and versatility. These results highlight O'A's ability to generalize across both convolutional and transformer-bar based models, pretrained or otherwise, and establish it as a strong state-of-the-an approach for OOD detection on ImageNet.
Near-OOD Results. In Appendix I we present complementary near-OOD evaluations on the NINCO [Bitterwolf al., 2023] and SSB-Hard [Vaze et al., 2022] datasets. Because these bench- marks feature higher class similarity between ID and OOD samples, all methods show degraded separability compared to far-OOD settings and performance differences are more subtle. In this regime, approaches that explicitly use class centroids tend to be more effective (albeit with higher memory and information requirements), especially when OOD examples are visually close to certain ID classes. Although ORA does not rely on individual class means, it achieves competitive perfor- mance on par with centroid-basee methods. Consistent with Bitterwolf al. [2023], we also observe that no single method emerges as clearly state-of-the-an in this benchmark.
4.2 OOD Detection with CLIP
In this section, we evaluate the performance of post-hoc OOD detection methods on the CLIP architecture. CLIP, with its pre-trained vision-language capabilities, provides foundation for OOD detection. We explore two approaches: linear probing and a zero-shot extension that leverages CLIP's inherent structure to avoid additional training.
Linear probing with CLIP. For methods requiring decision boundaries (e.g- Hendrycks and Gimpel [2022], Liu et al. [2020], Liu and Qin [2024], and ORA), we used the vision encoder of CLIP to extract features and trained a linear probe for the classification task. While effective, this reduces flexibility due to the need for additional training.
7

---

Table 2: OOD detection performance the ImageNett benchmark using CLIP-VIT-HH features. We report FPR95 (%) and AUROC (%) for four OOD datasets under two regimes: linear probing (Ip)
and zero-shot (zs). The best result per column is highlighted in bold.
Method
iNaturalist
SUN
Places
Texture
Avg
FPR95]
AUROC1
FPROS
AUROC1
FPR95
AUROC1
FPR951
AUROC
FPR95,
AUROC1
MSP
15.74
46.00
$7.40
87.98
90.18
Energy/Ip
7.26
97.94
34.62
92.13
41.32
90.05
37.02
90.98
30.06
92.77
MaxL/Ip
9.02
97.91
37.15
91.70
42.25
89.86
36,37
90.80
31.20
92.57
NNG/Ip
7.26
34.62
92.12
90.05
90.98
30.06
92.77
KNN/2s
80.20
87.86
86.68
84.63
73.51
86.07
70.27
84,60
77.66
85.79
FDBD/zs
9.31
98.11
22.32
94.78
29.15
93.20
40.12
90.25
25.23
94.08
(DBDApp
5.62
98.48
32.18
93.89
35.74
92.54
27.13
93.71
25.17
94,66
Pcos/zs
19.86
96.09
28.67
93.58
36.09
91.84
45.21
88.97
32.46
92.62
MCM/2s
17.81
96.52
26.04
93.94
35.07
91.54
41.12
90,92
30.01
93.23
RMhizs
3.64
98.85
30.71
93.12
34.72
92.18
21.21
93.84
22.57
94.49
ORA/2s
14.12
97.41
22.97
94.97
28.01
93.41
38.28
90.73
25.85
94.13
ORA/Ip
6.66
98.16
30,35
94.43
33.79
93.20
24.95
94.34
23.94
95.03
Zero-shot OOD detection with CLIP. To mitigate the limitation of requiring decision boundaries, derive zero-shot extension that defines them using text embeddings. For vision-language models like CLIP, we define the decision boundaries by vectors whose cosine similarity to the text embeddings of two classes are equal. Since cosine similarity are unique up to its norm. To compute the projection of a feature representation onto the decision boundary,
scale-invariant, these vectors
normalized representations. Let Zez and Zzz be the text embeddings of classes and 022 and be the feature representation. The decision boundary between and O2 satisfies:
(i) (z, Zez) (z, Zezi (ii) (z. (Zer Zez )} = O. Define
[1(*.; -Mey'l Then, the projection onto
(2s] -Zoz)
the decision boundary is Zdb = {z, u) This projection enables zero-shot computation of the ORA score. Table 2 summarizes the performance of these methods in both linear probe and zero-shot
settings. ORA achieves strong performance on both linear probing and zero-shot settings with
23.94% and 25.85% FPR95 respectively.
Positive effect of contrastive features. An important observation from our results the positive effect of contrastive learning on ORA's performance. Contrastive ob- jeetives-whether within single modality, such as SCL, or across modalities, as in CLIP's s image-text training- -impose geomet- ric structure on the representation space that separates semantic concepts. ORA benefits particularly from this structure as confirmed by the results in Table we show that ORA delivers the lowest average FPR95 on both benchmarks, cutting the previous best score from 11.85% 10.97% on CIFAR-10 (-0.88 pp) and from 32.78% to 25.04% on ImageNet (-7.74 pp). thereby outperforming every competing method with SCL-trained ResNet- 18 and ResNet-50 backbones. Similarly, in Table 2, ORA shows strong results in both the zero-shot and linear probe settings of CLIP. These findings suggest that ORA is particularly well-suited to contrastively structured representations, hinting at deeper connection between contrastive learning and OOD detection performance.
Table 3: Average OOD performance across CIFAR- 10 (ResNet- 18) and ImageNet (ResNet-50) bench- marks. All methods are evaluated using check- points trained with SCL. Reported with FPR95 and AUROC1. Best results per column are in bold.
CIFAR-10
ImageNet
Method
FPR95.J
AUROCT
FPR95
AUROC1
SSD+
18.51
97.02
63.24
80.09
KNN+
13.35
97.56
38.47
90.91
IDBD
11.85
97.60
32.78
92.86
ORA
10.97
97.67
25.04
94.26
4.3 Model Ensembling with ORA
Recent works Xue al. [2024] and Xu al. [2024a] show that creating an ensemble of models can enhance the OOD performance. Inspired from these works, and from the observation that scale invari- ant representations are compatible between distinct models [Moschella et al., 2023], we demonstrate that scale-invariant score functions can aggregate the confidences from different models, by simply summing their scores. On Table we show the individual performances of models ResNet-50, ResNet- 50 with SCL and ViT-B/Ie BTT-//1622 well as their combined performances using the scale inee-iivvaintt ORA.

---

Note that we demonstrate the inverinnv property of fDBD in Equation 4 and include it in ensemble experiments to compare with ORA. It can be seen that for both of the score functions, the performance of ensemble better than their individual counterparts showing that score aggregation improves their OOD performance. Moreover, the ensemble with ORA achieves performance with 22.33% FPR95 and 96.41% AUROC, improving the metries compared to the best individual performer in the ensemble by 2.51% and 2.15% respectively. In summary, we demonstrate that scale-invariance of ORA allows aggregating different models' confidences to solve OOD Detection Problem.
Table 4: ORA can be used for ensemble OOD de- tection due to its scale-invariance property. Evalu- ated on the ImageNet OOD benchmark. Best perfor- mance is highlighted in bold.
Method
FPR95
AUROCT
IDBD w/ResNet50
51.35
89.20
(DBD w/ResNet50-suupcnn
32.78
92.86
IDBD w/ViT-B/16
41.55
91.05
ORA w/ResNc150
44.58
90.68
ORA w/ResNet5O-supcon
25.04
94.26
ORA w/ViT-B/16
39.92
91.38
Ensemble fDBD Ensemble ORA
31.05
95.29
22.53
96.41
4.4 ORA with Activation Shaping Algorithms
Recent methods ReAct Sun al. [2021]. ASH Djurisic et al. [2023] and Scale Xu et al. [2024b] show their success to modify the feature representations to reduce model's overconfident predictions. All three methods adopt a hyperparameter percentile choose how to truncate and scale the feature representations using ID data statistics. When combined with Energy Liu et al. [2020] score, these methods improve the OOD Detection performance. On Table we show that applying ORA scoring after activation shaping algorithms improves the performance. Specifically combining ORA with ReAct reduces FPR95 from 25.04 04.0%% to 20.36% highlighting both the flexibility and efficacy of our method. This demonstrates that ORA can flexibly be combined with activation shaping algorithms.
Table 5: ORA can be used as plug-in on top of activation shaping. Evaluated on the ImageNet OOD benchmark.
Method
FPR95
AUROC1
ORA w/ReLU
25.04
94.26
ORA w/ASH
23.47
94.58
ORA w/Scale
23.34
94.37
ORA w/ReAct
20.36
96.29
4.5 Ablation Studies
In this section, will demonstrate the effectiveness of design choices
function ORA.
We first justify our choice of centering in μnD empirically, among the candidates: μAD- Hypes Mynge and max (ZnD). Then, we compare different angle aggregation techniques across classes by replacing max (fey, y/ ao'bee /t), with mean and min across classes.
Table 6: Ablation on different centering strategies. Evaluated on both CIFAR-10 and ImageNet OOD benchmarks.
CIFAR-10
ImageNet
Method
FPR95
AUROCT
FPR95.
AUROCT
ORA w/ Pyyred
12.42
97.59
43.02
89.86
ORA w/ Pauege
13.26
97.48
28.29
93.46
ORA w/ max max(Z
13.39
97.42
32.44
92.01
ORA w/ AID
10.97
97.67
25.04
94.26
Centering with PnD incorporates ID-statistics without biasing towards one particular class. Table 6 shows the performance comparison between centerings with respect to different points. Using the relative angle with respect to the predicted (pyma) or target (Ho class centroid induce bias towards the corresponding class, which in the end hinders compatibility between angles coming across classes. On the other hand, using max (Zi) shifts every feature representation to the same orthant, reducing to simply computing the absolute distance between feature representations and the decision boundaries, which is agnostic from the in-distribution feature statistics. We observe

---

Table 7: Ablation the different score aggregations across classes. Evaluated under both ImageNet and CIFAR-10 OOD benchmarks.
CIFAR-10
ImageNet
Method
FPR95
AUROCT
FPR95
AUROC
ORA w/ min
32.02
95.23
79.15
81.38
ORA w/ mean
11.84
97.59
32.76
92.87
ORA w/ max
10.97
97.67
25.04
94.26
significant improvement in performance when computing relative angles using FID. demonstrating the importance of incorporating in pn-distribution (ID) statistics when measuring the relationship between feature representations and decision boundaries. ORA with μi centering improves the FPR95 by up to 1.45% and 7.4% on CIFAR-10 and ImageNet respectively while also improving the AUROC for both benchmarks.
Looking at the furthest class is better for ID/OOD separation. On Table 7 we explored different ways to aggregate class specific angles. Originally, we devise our score function to return the maximum relative angle discrepancy between the feature representation across decision boundaries. Intuitively, this suggests that considering the furthest possible class that a feature belongs from the mean of in-distribution's 's perspective effective distinguish OOD from ID. On the other hand, comparing the minimum focuses on the smallest relative angle, reducing the separability significantly. Table demonstrates taking the maximum across classes clearly outperforms mean and min aggregations, improving FPR95 and AUROC metries on both benchmarks. Specifically the difference is higher on our large-scale experiments reducing the FPR95 by 7. 7.72% and increasing the AUROC by 1.39% compared to the second best aggregation.
5 Conclusion
In this paper, we introduce novel angle-based OOD detection score function. As post-hoc measure of model confidence, ORA offers several key advantages: it (i) hyperparameter-free, (ii) model- agnostic and (iii) scale-invariant. These features allow ORA to be applied to arbitrary pretrained mod- els and used in conjunction with existing activation shaping algorithms, enhancing the performance. Notably, its scale-invariant nature enables simple aggregation of multiple models' confidences through score summation, allowing a creation of an effective model ensemble for OOD detection. Our exten- sive experiments demonstrate that ORA achieves state-of- offte--f-th-arr performance, using the relationship between the feature representations and decision boundaries relative to the ID statistics effectively.
Beyond the global ID mean, we tested class-centered variants (per-class means and predicted- mean) and found no consistent gains. A promising future direction is data-driven weighted combination of per-class angle scores, with weights derived from ID) statistics (e.g. inverse class-wise feature variance or proportional to class accuracy), preserving ORA's hyperparameter-fire character while emphasizing reliable anchors. We leave systematic study of this extension to future work.
Acknowledgements
Francesco Locatello's contribution to this research was funded in part by the Austrian Science Fund (FWF) 10.55776/COE12.
References
M. B. Ammar, N. Belkhir, S. Popescu, A. Manzanera, and G. Franchi. Neco: Neural collapse based out-of-distribution detection. In The Twelfth International Conference on Learning Representations, 2024.
Bevandić, S. Šegvić, Krešo, and M. Oršić. Discriminative out-of-distributtio detection for semantic segmentation, 2019. URL http:p///ppppeeeeeeeeeee/stttttt
10

---

J. Bitterwolf, M. Müller, and M. Hein. In or out? fixing imagenet out -itoof-distribution detection evaluation. In Proceedings of the 40th International Conference on Machine Learning, pages 2471-2506, 2023.
D. Bogdoll, M. Nitsche, and J. M. Zöllner. Anomaly detection in autonomous driving: survey. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 4488 4499, 2022.
X. Chen, Y. Yang. 7. Wang, and B. Mirzasoleiman. Data distillation can be like vodka: Distilling more times for better quality. In The Twelfth International Conference on Learning Representations, 2023.
M. Cimpoi, S. Maji, I. Kokkinos, Mohamed, and A. Vedaldi. Describing textures in the wild. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 3606-3613, 2014.
J. Deng. W. Dong, R. Socher, L.-J. K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255 255. Ieee, 2009.
C. Diehl and J. B. Hampshire. Real-time object classification and novelty detection for collaborative video surveillance. In Proceedings the 2002 International Joint Conference Neural Networks. IJCNN' (Cat. No. 02CH37290), volume 3, pages 2620-2625. IEEE, 2002.
A. Djurisie, N. Bozanic, A. Ashok, and R. Liu. Extremely simple activation shaping for out-of- distribution detection, In The Eleventh International Conference on Learning Representations, 2023. URL https::/oppenevalltee
A. Dosovitskiy, L.. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2020.
X. Du, Z. Wang, M. Cai, and S. Li. Towards unknown-aware learning with virtual outlier synthesis. In International Conference on Learning Representations, 2022. URL https: //tp:////ee.e.e.e..//m net/f http://rrmmd-//77555551aaaa
Y. Fang, W. Wang. B. Xie, Q. Sun, L. Wu, X. Wang, T. Huang, X. Wang, and Y. Cao. Eva: Exploring the limits of masked visual representation learning at scale. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 19358-19369, 2023.
T. Fernando, H. Gammulle, S. Denman, Sridharan, and Fookes. Deep learning for medical anomaly detection-a a survey, ACM Computing Surveys (CSUR), 54(7):1-37, 2021.
I. Galil, M. Dabbah, and R. El-iv..v. A framework for benchmarking class-out-of -ftroouutto--i-sbutitiit detection and its application to imagenet. In The Eleventh International Conference on Learning Representations.
Y. Geifman and R. El- Yaniv. Selectivenet: A deep neural network with an integrated reject option. In International conference on machine learning, pages 2151-2159. PMLR, 2019.
C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger. On calibration of modern neural networks. In ICMI., 2017.
K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
D. Hendrycks and K. Gimpel. A baseline for detecting misclassified and dut-of-distributiin examples in neural networks. In International Conference on Learning Representations, 2022.
D. Hendrycks, M. Mazeika, and T. Dietterich. Deep anomaly detection with outlier exposure. In International Conference on Learning Representations, 2019. URI. /el.htttss//oopnreviie net/ forum?ide -.imiiihh.yy

---

R. Huang and Y. Li. Mos: Towards scaling out outtof-diitriuutionn detection for large semantic space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8710-8719, 2021.
S. Joshi, A. Jain, A. Payani, and B. Mirzasoleiman. Data-efficiens contrastive language- image pretraining: Prioritizing data quality over quantity. In International Conference on Artificial Intelligence and Statistics, pages 1000-1008. PMLR, 2024.
Khosla, P. Teterwak, C. Wang, A. Samn, Y. Tian, P. Isola, A. Maschinot, C. Liu, and D. Krishnan. Supervised contrastive learning. Advances in neural information processing systems, 33:18661- 18673, 2020.
A. Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.
LAION. 1LIp---T-t-14--laioo2-----------
Clip-ii-h-144-aionb---2-----
httess//huggiigfaaeec///io
B. Lakshminarayanan, A. Pritzel, and C. Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. NeurIPS, 2017.
Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-basse learning applied to document recognition. Proceedings of the IEEE, 86( (1111))228-22222 2002.
K. Lee, H. Lee, K. Lee, and Shin. Training confidence-calibratee classifiers for detecting out-of- distribution samples. In International Conference on Learning Representations, 2018.
S. Liang, Y. Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. 6th International Conference on Learning Representations, ICLR 2018, 2018
L. Liu and Y. Qin. Fast decision boundary based out-of-distribution detector. In Forty-firt Interna- tional Conference Machine Learning, 2024. URL eQaDb4r6YC.
L. Liu and Y. Qin. Detecting out-of-distribution through the lens of neural collapse. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 55424-15433, 2025.
W. Liu, X. Wang, J. Owens, and Y. Li. Ensrgy-based neural information processing systems, 33:2 11114444445555 2020.
detection. Advances in
Z. Liu, Y. Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang, S. Lin, and B. Guo. Swin transformer: Hierar- chical vision transformer using shifted windows. In Proceedings of the IEEF/CVF international conference on computer vision, pages 10012-10022, 2021.
Liu, H. Mao, C.-Y. Wu, C. Feichtenhofer, Darrell, and S. Xie. convnet for the 2020s. In Proceedings of the IEEE/CVE conference on computer vision and pallern recognition, pages 11976-11986, 2022.
A. Malinin and M. Gales. Predictive uncertainty estimation via prior networks. Advances in neural information processing systems, 31, 2018.
A. Meinke and M. Hein. Towards neural networks that provably know when they don't know. In International Conference on Learning Representations, 2020. URL https:// net/ forum?id torun?iddByxGkyySKatt ByH
M. Minderer, J. Djolonga, R. Romijnders, E, Hubis, X. Zhai, N. Houlsby, D. Tran, and M. Lucic. Revisiting the calibration of modern neural networks. NeurlPS, 2021.
Y. Ming. Y. Fan, and Y. Li. Poem: Out-of-ddistribution detection with posterior sampling. In International Conference on Machine Learning, pages 15650-15665. PMLR, 2022.
L. Moschella, V. Maiorca, M. Fumero, A. Norelli, F. Locatello, and E, Rodolà. Relative representa- tions enable shot latent space communication. In The Eleventh International Conference on Learning Representations, 2023. URL https: h/tppr//////eeeeieewee mett/form?iid-SrO nwieGJ.
12

---

M. Müller and M. Hein. Mahalanobist+: Improving ood detection via feature normalization. In Forty-second International Conference on Machine Learning.
Y. Netzer, Т. Wang, A. Coates, A. Bissacco, Wu, A. Y. Ng. et al. Reading digits natural images with unsupervised feature learning. In NIPS workshop deep learning and unsupervised feature learning, volume 2011, page 4. Granada, 2011.
J. Park, Y. G. Jung, and A. B. J. Teoh. Nearest neighbor guidance for out-of-distribution detection. In Proceedings of the IEEE/CVF international conference on computer vision, pages 1686-1695, 2023.
A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al. Pytorch: An imperative style, seshpperformanc deep learning library. Advances in neural information processing systems, 32, 2019.
B. Peng. Y. Luo, Y. Zhang, Y. Li, and Z. Fang. Conjnorm: Tractable density estimation for out-of- distribution detection. The Tweifth International Conference on Learning Representations, 2024. htr//oormmmieeeee srrumidd=pSS2cciio.
URL https: /oppnreeeeeeeeeeeeeeeeeeeeeeeeee
A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, Clark, et al. Learning transferable visual models from natural language supervision. In International conference
machine learning, pages
PmLR, 2021.
Ren. S. Fort, J. Liu, A. G. Roy, S. Padhy, and Lakshminaraaanann simple fix to mahalanobis distance for improving near-ood detection. arXiv preprint arXiv:2106.09002 2021.
M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and puttern recognition, pages 4510-4520, 2018.
V. Sehwag, M. Chiang, and P. Mittal. Ssd: A unified framework for self-supervised outlier detection. In International Conference on Learning Representations, 2021.
Y. Sun, C. Guo, and Y. Li. React: Out-of-distribution detection with rectified activations. In
A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances in Neural Information Processing Systems, 2021. URL https: wwwpooppnneiiii...mm..m... wwt.:eeoorodnddieeeeee
sRSm.
Y. Sun, Y. Ming, X. Zhu, and Y. Li. Out-of-distribution detection with deep nearest neighbors. In International Conference on Machine Learning, pages 20827-20840. PMLR, 2022.
J. Tack, S. Mo, Jeong, and Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. Advances in neural information processing systems, 13:11839-11855 2020.
H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pages 10347-10357. PMLR, 2021.
Van Amersfoort, L. Smith, Y. W. Teh, and Y. Gal. Uncertainty estimation using single deep deterministic neural network. In International conference on machine learning, pages 9690-9700. PMLR, 2020.
G. Van Horn, O. Mac Aodha, Song, Y. Cui, C. Sun, A. Shepard, H. Adam, P. Perona, and S. Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8769-8778, 2018.
S. Vaze, K. Han, A. Vedaldi, and A. Zisserman. Open-set recognition: A good closed-set classifier is all you need? In International Conference Learning Representations (ICLR), 2022.
H. Wei, R. Xie, H. Cheng, L. Feng. B. An, and Y. Li. Mitigating neural network overconfidence with logit normalization. In International conference on machine learning, pages 23631-23644, PMLR, 2022.
R. Wightman, Pytorch image models. https://githhin httpr////////ghhhhho.o/ogggggggg pytorch- inabe-imae----a daaage-modees models, 2020. Accessed: 2025-05-20.
13

---

J. Xiao, J. Hays, K. A. Ehinger, A. Oliva, and A. Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In 2010 IEEE computer society conference on computer vision and paltern recognition, pages 3492. IEER, 2010.
C. Xu, F. Yu, Z. Xu, N. Inkawhich, and X. Chen. Out-of-distribution detection via deep multi- comprehension ensemble. In Forty-fira International Conference on Machine Learning. 2024a.
K. Xu, R. Chen, G. Franchi, and A. Yao. Scaling for training time and post-hoc diitr--distribution detection enhancement. In The Twelfth International Conference Learning Representations, 2024b. URL
net wwweeeeoooteeeeeeeeeeeeeeeeeeeoe forum? w
P. Xu, K. A. Ehinger, Y. Zhang, A. Finkelstein, S. R. Kulkarni, and J. Xiao. Turkergaze: Crowdsoure- ing saliency with webcam based eye tracking. arXiv preprint PXii::504400655: 2015.
Xue, He, Zhang, C. Xie, Li, and F. Tan. Enhancing the power of ood detection via sample-aware model selection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 17148-17157, 2024.
Yang, K. Zhou, Li, and Z. Liu. Generalized outto--distribution detection: A survey, International Journal of Computer Vision, pages 1-28, 2024.
B. Zhou, A. Lapedriza, A. Khosla, Oliva, and A. Torralba. Places: A 10 million image database for scene recognition. IEEE transactions on paltern analysis and machine intelligence, 40(6): 1452-1464, 2017.
14

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked use the checklist as one of the factors their evaluation. While "[Yes] is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providedd proper justification is given (e.g.. "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
"[No] or "[NA]" is not grounds for rejection. While the questions are phrased acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Yes, the experiments in Section 4 back up our claims
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Yes, please the section 5
15

---

Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Please see the Appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Yes, please see the implementation details in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
16

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g.. with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibilityy In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Yes, supplementary materials include the code and the environment needed to set up to faithfully reproduce our main results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: //wpss.cc/publcc//eeceee/e//p/// guwdee/eeeeeeee /CodeSubmii httpd////ggiieee//oouuuttiiiiii ssi ssionPolicy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
17

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
Yes, Appendix discusses all the implementation details.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [NA]
Justification: All the evaluations done in the paper are deterministic.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (c.g. negative error rates).
show in tables
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes. Appendix provides information the computational resources required to reproduce the results.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
18

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics pettss//neuripst Sppullc/Ethicsuutiii ines?
Answer: [Yes]
Justification: Ethics.
Yes, research conducted in the paper conform with the NeurIPS Code of
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: This paper does not include any immediate societal impact.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper does not have misuse risk.
Guidelines:
19

---

The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Yes, Appendix includes details about used assets.
Guidelines:
The answer NA means that the paper does
existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re- ce-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
20

---

Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification:
The paper does not involve LLMs as any important, original, or non- non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non- non-standard components.
Please refer to our LLM policy (https: ftteps://neurips ///nriurps...// wttp:////ooeeeeccc///eoeeaoccaee for what should or should be described.
21

---

Table 8: ORA achieves state-of-the-an performance CIFAR-10 OOD benchmark. Evaluated on ResNet-18 with FPR95 and AUROC. f indicates that larger values are better and vice versa. Best performance highlighted in bold. Methods with are hyperparameter-free
Method
SVHN
ISUN
Place365
Texture
Avg
FPR95
AUROCT
FPR95)
AUROC1
FPR951
AUROC1
FPR951
AUROCT
FPR9S}
AUROC1
Without Contrastive Learning
x
91.29
54.57
62.55
90.14
ODIN
61.71
89.12
15.09
97.37
41.45
91.85
52.62
89.41
42.72
91.94
Energy
53.96
91.32
27.52
95.59
42,80
91.03
55.23
89.37
44.88
91.83
ViM
95.40
30.52
47.36
25.69
94.05
MDS
16.77
95.67
7.56
97.93
85.87
68.44
35.21
85,90
36.35
86.99
With Contrasivv Learning
CSI
37.38
94.69
10.36
98.01
38.31
93.04
28.85
94.87
28.73
95.15
SSD+
1.35
99.72
33,60
26.09
95.48
12.98
97.70
18:51
97.02
KNN+ 2.20
99.57
20.06
96.74
23,06
95.36
8.09
98.56
13.35
97.56
DBD 4.59
99.00
10.04
98.07
23.16
95.09
9.61
98.22
11.85
97.60
ORA *
99.16
8.36
23.40
8.58
98.34
10.97
97.67
Table 9: ORA achieves state-of-the-art performance on ImageNet OOD benchmark. Evaluated on ResNet-50 with FPR95 and AUROC. 1 indicates that larger values are better and vice versa. Best performance highlighted in bold. Methods with are hyperparameter-free..
Method
NNaturalist
SUN
Avg
FPRO5L AUROC1
FPR95
AUROC1
FPR95
AUROC1
FPR951
AUROCT
FPR9S]
AUROC1
Without Contrastive Learning
MSP *
$4.99
87.74
70.83
80.63
73.99
79.76
68.00
79.61
66.95
81.99
ODIN
47.66
89.66
60.15
84.59
67.90
81.78
50.23
85.62
56.48
85.41
Energy
55.72
89.95
59,26
85.89
64.92
82.86
53.72
85.99
58.41
86.17
ViM 71.85
87.42
81.79
81.07
83.12
78.40
14.88
96.83
62.91
85,93
MDS
97.00
52.65
98.50
42.41
98.40
41.79
$5,80
85.01
87.43
$5.17
Wish Contrastive Learning
57.16
87.77
78.23
73.10
81.19
70,97
36.37
$0.09
KNN+
30.18
94.89
48.99
88.63
59.15
84.71
15.55
95.40
38.47
90.91
DBD 17.27
96.68
42.30
90.90
49.77
88.36
21.83
95.43
32.78
92.86
ORA
12.27
97.42
40.71
94.26
A
Additional Results
A.1 OOD Detection on CIFAR-10 and ImageNet Benchmarks
Table 8 and Table 9 shows the performance of ORA along with the 9 baselines on CIFAR-10 and ImageNet OOD Benchmarks, respectively. All the baselines on CIFAR-10 use ResNet-18 18 architecture and on ImageNet use ResNet-50. Our proposed method reaches state-of-te oof-the-ar art performance on both benchmarks, reducing the FPR95 on average by 7.74% on Imagenet and 0.88% on CIFARIO. In the following, provide detailed analysis of these results.
ORA continues show the success of distance-based methods over logit-based methods. Logit- based scoring methods MSP Hendrycks and Gimpel [2022], Energy Liu et al. [2020] are one of the earliest baselines proving their success on measuring model's confidences. MSP measures the maximum softmax probability as its score while Energy does logsumexp operation the logits. Recent distance-based methods like KNN+ Sun al. [2022] and fDBD Liu and Qin [2024] outperforms the early logit-based ones. Similarly, ORA achieves significantly better performance on both benchmarks, reducing the FPR95 up to 49.81% 1 and 41.91% while improving the AUROC up to 7.53% and 12.27% CIFAR-10 and ImageNet OOD benchmarks.
ORA improves the recent success of methods using contrastively learned features. Table and show the success of recent methods CSI Tack et al. [2020], SSD+ Sehwag et al. [2021], KNN+ Sun al. [2022] and fDBD Liu and Qin [2024] that utilizes contrastively learned representations over the ones those do not use. We observe that the additional structure the supervised contrastive loss puts on the feature representations are particularly beneficial to the distance-based methods. ORA also benefits from more structured representations on the feature space, it explores the relationship between the representation and the decision boundaries. Notably, ORA improves both of the metrics on both CIFAR-J0 10 and ImageNet benchmarks, achieving the state-of-the-a art performance.
22

---

A.2 Comparison with ReAct
Tables 10 and 11 compare the performance ORA with the activation shaping method ReAct Sun et al. [2021]. ORA improves FPR95 by 1.11% on CIFARIO and 6.39% on ImageNet. Additionally, combining ORA with ReAct further enhances performance on both benchmarks across both metrics, FPR95 and AUROC.
Table 10: ORA ReAct under ImageNet OOD benchmark.
Method
INnturalist
SUN
Places
Texture
Ávg
FPR951,
AUROC1
FPR95
AUROC1
FPR95
AUROC1
FPR95
AUROCT
FPR95,
AUROCT
ReAct
20.38
96.22
33.85
91.58
47.30
89.80
31.43
ORA
12.27
97.42
31.80
92.85
40.71
90.10
15.39
96.68
25.04
94,26
w/ReAct
22.34
96.60
20.36
96.29
Table 11: ORA vs ReAct under CIFAR OOD benchmark.
SVHN
ISUN
Places
Texture
Avg
Method
FPR951
AUROCT
FPR95,
AUROC1
FPR95L
AUROCT
FPR95,
AUROCT
FPR95,
AUROC1
6.15
95.47
10.18
98.12
97.61
ORA
3,53
99.16
8.36
98.28
23.40
94.88
8.58
98.34
10.97
97.67
ORA w/ReAct
3.35
99.18
98.29
20.84
95.25
7.87
98.45
10.04
A.3
Centering with Different Statisties
Tables 12 and present the performance of the ORA score when using different class means as reference view instead of the mean of ID features. We also explored alternative centering strategies by replacing the mean of ID features with elementwise operations max, min, and median- each corresponds to using the respective statistic before calculating angles. Additionally, aggregation refers to summing scores obtained from individual class mean reference points or from these elementwise operations. Results indicate that using PiD consistently outperforms these alternatives.
Table 12: CIFARIO centering with different statistics using ResNet18 model.
Method
SVHN
ISUN
Places
Ávg
FPR951
AUROCT
FPR95
AUROC1
FPR95
AUROCT
FPR95L
AUROC1
FTR95|
AUROCT
Class mean
4.77
98.96
$.06
96.27
25.20
94,62
10.11
98.19
12.03
97.51
95.2
Class
Class mean
5.42
98.84
7.90
36
22.19
95.58
11.42
97.98
11.73
97.69
92.6
Class 3 mean
5.94
98.76
7.99
VK. 29
22.80
95.43
11.35
V7 66
12.02
97.54
88.7
Class
5.44
97.63
95.8
Class mean
6.22
98.66
7.38
23.11
11.84
97.82
12.14
97.60
88.0
Class mean
3.74
9W.82
8.50
VK. 76
97.67
20.76
12.11
95.73
11.78
97.62
97.9
Class
5,93
98.78
8.29
98.30
24.55
95.13
12.57
97.82
12.84
97.51
96.4
Class mean
6.11
98.78
9.00
99.19
24.89
94.62
11.35
97.95
12.84
97.25
96.3
Sum aggregation
5.68
98.85
8.27
98.33
23.70
95.34
11.33
97.98
12.25
97.62
Elementwise
6.28
98.73
8.28
98.30
13.79
97.57
24.35
95.21
13.18
97.45
Elementwise
3,60
14.82
9.38
27.62
Flementwise medlinn
2.33
99. 34
10,02
97.90
7.73
98.29
23.99
93.84
11.02
97.34
Sum aggrepation
5.78
98.65
20.31
95.64
10.35
97.80
30.42
91.60
16.72
95.92
23

---

Table 13: ImageNet centering with different statistics using ResNet50 model.
Avg
FPR95L
AUROC1
PPROS]
AUROCT
:PP995
AUROCT
FPRO5]
AUROCT
FPR95]
AUROC
Class
96.92
31.63
90.67
93.36
Clacs
Class 500 mean
14.87
97.08
38.97
90.52
45.80
88, 90)
26.29
93.04
31.48
92.28
60
Class 750 mean
11.57
V7 97.59
34.23
92.13
42.60
90-15
19.75
95.18
27.04
93.76
84
1030
Som aggregationn
12:40
97.48
32.47
92.36
40.42
90.53
21.38
94.52
93.72
Elementwise Max
17.10
96.76
34.22
91.73
41.88
90.14
35.09
89.84
32.07
92.
Flementisee
Elementwise Median
Som aggregiliion
21.09
95.89
49.47
88.97
$6.50
86.12
17.62
95.98
36.17
91.74
ORA
12.27
97.42
31,80
92.85
40.71
90.10
15.39
96.68
25.04
94.26
77.33
A.4 Resource Constrained Setting
Table 14 presents the performance of ORA resource-constrained setting using MobilcNetV2 Sandler et al. [2018], model designed for efficient inference with minimal resources. ORA achieves the best average performance, improving FPR and AUROC by 7.56% and 1.66%, respectively, demonstrating its adaptability to dssource-limites scenarios.
Table 14: Resource Constrained Setting: ImageNet MobileNet v2 performances.
Method
iNaturalist
SUN
Places
Texture
Avg
FPR95
AUROC1
FPR95]
AUROCI
FPR95
AUROC1
FPR95]
AUROCT
FPR95]
AUROC1
MSP
59.84
86.71
74.15
78.87
76.84
78.
70.98
78.95
70.45
80.67
Energy
55.35
59.36
86.24
54.54
86.59
KNN
85.92
72.67
90.51
65.39
93.21
60.08
14.04
96.98
70.92
73.78
IBD
53.72
90.89
68.22
82.84
73.20
80.09
37.82
91.85
58.24
86.42
46.59
91.86
61,21
85.01
27.07
94.04
88.25
B Implementation Details
We used Pytorch [Paszke al., 2019] to conduct our experiments. We obtain the checkpoints of pretrained models ResNet1 8 with supervised contrastive loss and ResNet50 with supervised contrastive loss from Liu and Qin [2024]'s work for fair comparison. the experiment where we aggregate different models' confidences, ViT-B/16 [Dosovitskiy et al., 2020] checkpoint is https//gggtuubb.oo/l/ueeeeeeee httess/PPyoooo---errrrriene
retrieved from the publicly available repository ViT/tree/master. In the experiment where merge ORA with the activation shaping algorithms ASH [Djurisic al., 2023], Scale [Xu et al., 2024b] and ReAct [Sun et al., 2021], we used the percentiles to set the thresholds 35, 90 and 80 respectively. For the extended results Table 1, we used the timm [Wightman, 2020] checkpoints for the models ConvNeXt [Liu et al., 2022], Swin [Liu et al., 2021], DeiT [Touvron al., 2021] and EVA [Fang et al., 2023], Similarly, for the CLIP experiments on Table 2, we used the huggingface checkpoint evaluated single Nvidia H100 GPU. Note that, thanks function, all experiments are deterministic given the pretrained model.
CLIP ViT-H/14 [LAION]. All experiments are hyperparameter-free post-hoc score
C Robustness of the Relative Angles
In this section, provide theoretical justification for focusing relative angles, rather than abso- lute distances, to better understand the robustness of representations under scaling transformations.
Theorem: Let Mi and M2 be two neural networks such that:
1. The encoder of M2 is a scaled version of the encoder of Mi. Specifically, there exists a positive scalar l E R2 such that the output of the penultimate layer of M2 satisfies:
M2
k. M,
2. Both networks share the same final linear layer (without bias) for classification.
24

---

Since scaling transformations do not affect the softmax decision boundaries (due to monotonicity). Mj and M2 will produce the same classification decisions. Under this setup:
The angles satisfy y1 (z On ar (z where 02 v2 (z) is the relative angle between representation and its projection onto the decision boundary.
However, the distances satisfy dyp (z dh = k dyr (z) Ms (z the Euclidean distance.
2:bb). where d(-,:) is
Proof: Let z Mi be the penultimate layer representation of M1 and let Mi denote the projection of 2 Mi onto the decision boundary between two classes y1 and Then following the Equation 1
zdb
M1 dP = z Mr (Wys
W Waz ) Th (Wyr Wyz)
81 Wyal 1|2
where Wy, and Wy, are the weight vectors corresponding to classes y1 and y/2 the shared linear layer. For M2, the features are scaled by k, 2 M., Substituting into the projection formula:
(Wys
W )Th MM
2 db
k 2 Mi
[ W 11 (Wyr Wyz)
M2 k 2
M₁ tb
z db
The angle is defined by the cosine similarity between the vectors Mi,
MiD
and zib
JM Using
the substitutions z Ma = k z Mi, 20 k zibb
and MiD k MiD
we have:
M1 HiD
Mi
M MID
cos (0y) (z)f1))
zdb
||
MiD Mr
||
||
M.
MiD M
k (z
MiD
M.
M.
MiD
May
k. k. ||
pin M6
||
Pm
M
(K: 2 M1 K M.
2
M
1m
M1.
[|k: M1 k pin ||
||ke Z
Pm
(z Ma HiD
Mr
Pin
Ma)
Mz
Ma ||
-|
FiD
M2
cos (0 (z Ma))
On the other hand, the absolute distance between and Zab scale as follows:
dy.. v2 M2 M2) dyn Mr, k. M
Zith
dyn.gr (z Mi, Ad,
Therefore, for two networks Mi and M2 with identical performance, demonstrate that relative angles remain invariant to scaling, whereas absolute distances are sensitive to it. Given that ReLU networks are commonly used in practice (where activations unbounded), scale-ines invariant, angle- based techniques provide a more robust and suitable approach for measuring confidence compared to distance-baat based methods, especially when comparing the confidences of different models.
25

---

Algorithm ORA (OOD Detection with Relative Angles)
Require: Sample x, Pretrained model f. Mean of the in-distribution features μiD
Ensure: OOD score $
1: function ORA(x, f. AID)
2: <- arg max JE foneyfls fxx
f 3: fi .... f
penultimate layer features
4: score -0
5:
for v' E y' and y/ + ÿ do
for each other class
6:
compute as in Eq.
7:
compute 0 (z) using Eq. 2
8:
compute (2) using Eq. 3
9:
((z) 2 score then
10:
score = (2)
11: end
12: end for
13: return score
maximum score across classes
14:
end function
D Algorithm Box
We present the pseudocode for ORA Algorithm Box 1. It depicts how ORA assigns score given a sample æ, pretrained model f, and the ID statistics, mean of the in-distribution features jan-
E Detailed Tables and Figures
Table 15: Extended version for the model ensemble experiment presented on Table 4. ORA can be used score function accumulate different architectures' confidences due its scale-invariance property. Evaluated under both ImageNet OOD benchmark. Best performance highlighted in bold.
Method
Naturaalist
SUN
Places
Texture
Avg
FPR95
AUROCT
AUROC1
FPR95L
AUROC1
AUROCT
IDBD w/RosNer50
40.10
93.70
60.89
86.86
66.75
84.14
37.66
92.09
51.35
89.20
IDBD w..ResNe15-supccar
17.34
96.68
42.26
90.92
49.68
88.38
21.84
95.44
32.78
92.86
12.97
ORA w/KeesNer50
34,88
94.43
54.30
88.41
61.79
85.64
27.34
94.24
44.58
90.68
ORA wReesee55-suppoon
12.27
97.42
31.80
92.85
40.71
90.10
15.39
96.68
25.04
94,26
97.85
44.31
Ensemble IDBD
4.38
98.93
42.81
V3.97
53.49
91.92
23.33
96.34
31.03
95.29
Ensemble ORA
2.77
99.29
30.21
42.52
93.39
14.63
97.59
22.53
96.41
ResNet30-supaae supcon imagenet vs inat
Model Ensemble imagenet vs inat
Denaty
Density
12
5-
032
8:44
0.00
0.33
2.10
012
824
63
ORAb))
ORAbI
Figure 3: Comparison of the score histograms on Imagenet (ID) and inaturalist Van Horn et al., 2018)(00D) of the best individual model (left) with the model ensemble (right). Model ensemble improves the ID and OOD separation.
26

---

Table 16: Extended version for the activation shaping experiment presented on Table 5. ORA be used as a plug-in on top of activation shaping algorithms. Evaluated under ImageNet OOD benchmark, 1 indicates that larger values are better and vice versa. Best performance highlighted in bold.
Method
INaturalist
SUN
Places
Texture
Arg
FPR951
AUROCT
FPR95,
AUROCT
FPR951
AUBOC1
FPR95L
AUROCT
FPR95,
AUROC1
ORA W/ReLU
12.27
97.42
31.80
92.85
40.71
90.10
15.39
96.68
25.04
94,26
ORA W/SH
11.08
97.68
27.81
36.53
91.36
18.48
96.70
23.47
94.58
ORA wiScale
14.65
97.05
25.43
94.02
36.21
90.78
17.07
95.65
23.34
94.37
w/ReAct
11.13
97.79
22.34
33.33
14.65
96.60
20.36
96.29
Plain Model Performances
Tables 17, 18. and 19 show the performance of feature-based OOD methods models trained without supervised contrastive loss. The results highlight that supervised contrastive loss significantly enhances feature quality, leading to substantial performance boost for feature-base based OOD methods.
Table 17: CIFARIO Plain ResNet18 performances.
SVHN
Places
Texture
Avg
Method
FPR951
AUROC1
FPR95
AUROCT
FPR95
AUROC1
FPR951
AUROCT
FPR95
AUROC1
27.85
95.52
24.67
95.52
44.56
90.85
37.57
94.71
33.66
94.15
IDBD
22.58
96.07
23.96
95.88
46.59
90.40
31.24
94.48
31.09
94.20
ORA
22.09
96.02
22.91
95.90
46.46
90.37
31.28
94.48
30.86
94.21
Table 18: ImageNet Plain ResNet50 performances.
Method
iNuturalist
Places
Texture
Avg
HPR951
AUROCT
MPRYS
AUROCT
HPR95]
AUROCT
EPR951
AUROCT
HPR95.
AUROCT
KNN
59.00
86.47
68.82
80.72
76.28
75.76
11.77
97.07
53.97
85.01
IDBD
40.24
93.67
60.60
86.97
66.40
84.27
37.50
92.12
51.19
89,26
ORA
38.94
93.68
59.78
86.53
66.89
83.04
31.67
93.33
49.32
89.15
Table 19: ImageNet ViT performances.
Method
INaturalist
SUN
Places
Texture
Avg
HPR95]
AUROCT
FPR95
AUROCT
HPR95.
AUROCT
FPRY5]
AUROCT
HPR95]]
AUROCT
KNN
11.41
97.65
56.91
86.39
63.76
82.61
42.23
89.61
43.58
89.07
IBDD
12.86
97.72
50.86
89.74
56,28
87.44
45.74
89.41
41.44
91.08
11.00
97.86
48.81
90.14
54.32
87.88
44.56
89.75
91.41
27

---

G
Histogram Plots for ID/OOD Separability
Figures and shows the score distributions on the Tables 8 and respectively.
CIFAR-I0 10 vs SVHN
CIFAR-I0 ISUN
Denity
Density
15
CIFÁR-I0 vs places365
CIFAR-IO vs Textue"
Density
Densty
ORA(
ORA(K)
Figure 4: Score distributions of ID and OOD datasets in CIFAR-10 OOD Benchmark.
imagenet
imagenet
Density
12
Imagenet
Imagenet Texture
Density
ORA(x)
ORA(x)
Figure 5: Score distributions of ID and OOD datasets in ImageNet OOD Benchmark.
28

---

H
Comparison of Different Angles
Figure presents the score distributions for different angles discussed in Section 3.1. The results show that sin (a) does not provide good ID/OOD separation, whereas sin (f) and sin (0)/ sin (a) present significantly clearer distinctions. Additionally, incorporating sin (a) into sin (0)/ sin (a)
hinders its performance compared to using sin (0) alone.
imagenet
imagenet sun50
1403
1350
1460
1200
Density
1,000
0032
093
0993
sin(a)
sin(a)
imagenet
imagenet
10-
Donsity
Density
0.5 sin(e)
sin(e)
imagenel
imagenet vs
34
10-
Densiry
Demsity
6.0
2:33
0.20 C22 sinlel/iin(e)
sin(@)/sin(a)
Figure We demonstrate the ID/OOD separability sin(a), sin(O) and sin(a) Columns show the performances on iNaturalist and SUN datasets respectively. It can be seen that the ID/OOD class separability is the best when sin(0) is used: considering sin(a)) impedes the performance as confirmed quantitatively in terms of FPR95 and AUROC metrics in Table 9.
sim(P)
29

---

I Near OOD Results
In Table 20, we report ORA's FPR and AUROC on NINCO [Bitterwolf et al., 2023] and SSB- hard [Vaze et al., 2022] datasets, along with average scores and in-distribution (ID) classification accuracy.
NINCO dataset: We observe that models pretrained on ImageNe12Ik generally outperform their non-pretrained counterparts terms of FPR95, consistent with the observations in Bitterwolf al. [2023]. However, no single method, including ORA, dominates across all architectures. For example, ORA attains the best results the plain ConyNeXt Liu al. [2022] backbone, while Reos [Bitterwolf et al., 2023] outperforms others on DeiT [Touvron et al., 2021] and ResNet50 [He et al., 2016]. Interestingly. Energy [Liu al., 2020] performs best on Swin-pretrained [Liu al., 2021].
SSB-Hard dataset: A similar trend is evident: ORA outperforms other methods on plain Con- vNeXt [Liu al., 2022] and offers strong performance SWIN-pre [Liu et al., 2021], ConvNeXt- pre [Liu et al., 2022], and DeiT--rr [Touvron et al., 2021], where it outperforms Reos [Bitterwolf et al., 2023], RMaha [Ren et al., 2021], and Pcos [Galii al.]. However, it is worse than naive baselines like Energy [Liu et al., 2020] in certain pretrained settings. In contrast, for models without pre-training, naive methods degrade significantly while ORA remains par with the top baselines.
Discussion. These findings underscore a fundamental distinction between far- and near-OOh BOD detection. Identifying completely novel inputs (as in far-OOD) is fundamentally different problem from determining how much deviation is acceptable within or between known classes (as in near- OOD). Consequently, methods designed for detecting novelty semantic outliers- such those based on global uncertainty or energy scores do not necessarily excel near-OOD settings. This makes direct comparisons across these tasks potentially misleading. In near-OOD scenarios, where finegrained class separation is critical, approaches that explicitly incorporate class-wise feature statistics-sut
Rcos, Pcos, RMah [Bitterwolf et al., 2023, Galil et al., Ren al., 2021] to have a clear advantage. These methods are better equipped to handle intra-class variance and subtle distributional shifts, highlighting the need for tailored evaluation and method design across OOD) subtypes.
Table 20: OOD performance across benchmarks. FPR and AUR are reported for NINCO and SSB-Hard. The last two columns show the average performance and ID classification accuracy.
NINCO
SSB-Hard
Average
Model
ID Acc (%
FPR
AUR
FPR
AUR1
FPR
AUR
ResNet-50
68.31
85.89
85.65
71.17
76.98
78.53
76.12
ResNet-50-SCL
54.39
86.50
79.09
71.35
66.74
78.93
77.31
ConvNeXt
48.04
89.17
70.90
75.47
59.47
82.32
84.84
ConyNeXt-pre
45.54
90.56
68.82
77.13
57.18
83.84
85,49
DeiT
71.76
78.47
83.07
69.38
77.42
73.93
83.13
DeiT-pre
60.07
86.40
80.40
72.40
70.24
79.40
84.79
Swin
66.91
84.00
81.28
73.95
74.10
78.98
84.49
Swin-pre
52.62
88.25
77.45
74.76
65.04
81.51
85,73
EVA
46.61
88.15
67.86
75.65
57.24
81.90
87.88
30

---

Relation to [Liu and Qin, 2024]
In this section we are going to describe the methodology relation of our method with respect the method of Liu and Qin [2024], explaining the performance gap in favor of ORA.
Let E RP be feature, Zub its orthogonal projection onto the decision boundary given in (I), and let μm E IR? denote the in-distribution mean. Define centered quantities
MID:
dd
7d6
PID-
In the triangle with vertices {0, ]. the law of sines gives
sin
z
2, ||
(5)
sin (a)
where 0 is the angle at (discriminative ID/OOD signal, measured in the ID-centered frame) and a is the auxiliary angle at the origin O; the radial term brightness/contrast).
| captures nuisance scale (e.g., global
The fDBD score normalizes out the scale term:
|| - Zaoll
sin
(DBD(z)
|
sin
((x)
which makes the score invariant uniform rescaling of features and improves over raw distance.
Empirically, (a) is nearly identical for ID and OOD (see Fig. 2), adding variance without separation. ORA therefore retains only the informative angular component in the ID-centered frame:
SORA 2
Hierarchy. Raw distance = |z zab is confounded by the ID-centered norm || = -| Mn ||-
The fDBD score removes this scale confound but still carries the factor 1/ sina. ORA discards that factor and retains only the discriminative angle, which explains its per-model gains and suitability for scale-invariant ensembling.
K Results on small datasets
To confirm empirically the hypothesis that ID points lie further from the decision boundary holds even for simple datasets and models, trained a LeNet-5 [LeCun et al., 2002] architecture on MNIST and measured the distance to the decision boundary for MNIST (ID) and Fashion-MNIST (OOD).
Dataset
Mean
Std
Min
Max
MNIST
5.86
0.62
2.69
7.49
FaShion-MNIST
4.77
0.82
1.99
6.66
Table 21: Distance to the decision boundary for MNIST (ID) and Fashion-MNIST (OOD).
ID samples are, on average, 1.1 units further from the decision boundary than OOD samples.
Discussion.
Cross-entropy training maximizes dlas--onditional log likeliiiehood, which drives fea- tures to align strongly with their corresponding weight vectors (confident regions). This places ID features deep inside their class cones and therefore further from the boundary. In contrast, OOD images do not match strong class-specific patterns, so their features align less and end up closer to the boundary, as reflected in the distance statistics.
This experiment supports empirically the assumption on the distribution of in-distribution points with respect to the decision boundaries which is at the core of our method and IDBD Liu and Qin [2024].
31


Reviews:
[{"review_id": "nfDIvjkPm4", "reviewer": "Reviewer_JVzv", "summary": "This paper provides a new distance based out-of-distribution (OOD) detection method that extends the prior work by Liu and Qin 2024 called fDBD which utilizes the distance to the decision boundary as the OOD detection score. In particular, the proposed method centers the penultimate layer features then calculates the angle between the current sample’s feature and its projection onto the decision boundary. The OOD detection score named ORA is constructed to be the maximum of these angles over classes. The paper claims ORA’s scale invariance makes it a suitable post-hoc OOD score for a wide array of feature extractors. An exhaustive set of experiments is provided to support this claim across ensembles, CLIP models, transformer architectures, and contrastive training losses. Ablation experiments are also provided that show the impact of choice of center and OOD scoring method.", "questions": "Please see the strengths and weaknesses section.", "limitations": "The authors briefly address a limitation and future work for this method in the conclusion. A discussion on future works based on the experimental findings of this paper would improve the impact and reach of this paper.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\nThe paper provides an effective yet simple extension to fDBD based on an intuitive geometric argument centered around providing scale invariance. The extensive set of experiments in both the main text and the supplement provide support for their claim that ORA is more effective across different feature extraction methods. \n\nWeaknesses:\n\nWhile the extensive experiments show the ability of the proposed method to adapt to a wide range of feature sets, a discussion of the findings and takeaways from these experiments would improve the impact of this paper on future development of OOD detection methods. \n\nAlso, the main text does not discuss the near-OOD performance. Several works have shown that the near-OOD scenario is more challenging and potentially more realistic [1-4]. The supplement provides results on SSB-Hard  [3] and NINCO [4] in Table 20. However, the performance of ORA on near-OOD datasets (average **78.53**% AUROC) is on par with or slightly below state-of-the-art OOD detection methods which can be found in the associated public leaderboard to [2] (see link [8]) such as [6] and [7] ~~such as ASH [5] which attains 78.17% AUROC on this task with a ResNet-50 feature set~~. It would be helpful for the paper to comment on the near-OOD performance of the method in the main text due to the importance and difficulty of near-OOD scenarios. \n\n[1] Yang, J. et al. “OpenOOD: Benchmarking Generalized Out-of-Distribution Detection.” NeurIPS Datasets and Benchmarks 2022. \n\n[2] Zhang, J., et al. \"Openood v1. 5: Enhanced benchmark for out-of-distribution detection.\" arXiv preprint arXiv:2306.09301 (2023).\n\n[3] Vaze, S. et al. “Open-Set Recognition: A Good Closed-Set Classifier is All You Need.” ICLR, 2022.\n\n[4] Bitterwolf, J. et al. “In or Out? Fixing ImageNet Out-of-Distribution Detection Evaluation.” ICML 2023.\n\n[5] Djurisic, A. et al. “Extremely simple activation shaping for out-of-distribution detection.” ICLR, 2023.\n\n[6] Mueller M. and Hein M. \"Mahalanobis++: Improving OOD Detection via Feature Normalization.\" ICML, 2025.\n\n[7] Xu K. et al. \"Scaling for Training Time and Post-hoc Out-of-distribution Detection Enhancement.\" ICLR, 2024.\n\n[8] https://zjysteven.github.io/OpenOOD/#div_imagenet1k_heading", "was_revised": true, "final_justification": "The author responses during the discussion period largely address my concerns. However, the current version would benefit from a discussion of the near-OOD performance and any potential limitations of ORA that could inspire future work. The paper presents a  new distance based OOD detection method building on prior work with extensive experimental results that would be of interest to the NeurIPS community.", "rebuttal": "We sincerely thank the reviewer for the detailed and constructive feedback. \nBelow we address each concern in turn.\n\n\n---\n\n\n## 1 Main‐text discussion of experimental findings \n*Reviewer comment (Weakness #1):* *“A discussion of the findings and takeaways from these experiments would improve the impact of this paper on future development of OOD detection methods.”*\n\n\n**Response.** \nIn the camera‑ready version we will add a concise “Take‑aways” paragraph at the end of Section 4 that *briefly* summarizes what each block of experiments teaches us:\n\n\n* **9 ImageNet models (Section 4.1).** Angle‑based scores (RCOS, PCOS, **ORA**) and R‑Mahalanobis rank consistently among the top performers. Importantly, R‑Mah, RCOS, and PCOS require *per‑class* means, whereas **ORA** needs only the *global* in‑distribution mean, reducing memory/compute overhead. \n* **CLIP zero‑shot (Section 4.2).** The structured latent space of CLIP favors decision‑boundary‑aware metrics (FDBD, **ORA**) and R‑Mah, again reflecting ORA’s ability to exploit well‑separated features. The same trend is observed with the ResNet‑SCL backbone, reinforcing that *better‑structured latents amplify ORA’s gains*. This also hints that contrastive models are “safer” for OOD alarms.\n* **Model ensembling (Section 4.3).** Scale‑invariant angle scores make different models' scores comparable. An ORA ensemble outperforms every single backbone, suggesting that *ensemble‑based OOD detection is a promising, under‑explored direction*.\n\n\nThese clarifications will be inserted without expanding the page budget.\n\n\n&nbsp;\n\n## 2 Near‑OOD performance \n*Reviewer comment (Weakness #2):* *“The performance of ORA on near‑OOD datasets (average 76.12 % AUROC) is on par with or slightly below state‑of‑the‑art … It would be helpful for the paper to comment on the near‑OOD performance in the main text.”*\n\n\n**Response.** \nWe agree that near‑OOD detection deserves explicit discussion and will add a short subsection summarizing our findings:\n\n\n* The quoted 76.12% refers to the **ID accuracy** column; the correct mean AUROC of **ORA** on SSB‑Hard + NINCO is **78.53 %**, slightly *above* ASH’s 78.17 % (ResNet‑50). \n* In near‑OOD regimes the ranking of methods fluctuates noticeably across backbones, making it hard to argue there is a state-of-the-art method. We view near‑OOD detection as a *complementary* task to far-OOD and will make this distinction explicit.\n\n\n&nbsp;\n\n## 3 Future‑work discussion \n*Reviewer suggestion (Limitations):* *“A discussion on future works based on the experimental findings of this paper would improve the impact and reach of this paper.”*\n\n\n**Response.** \nDuring preliminary trials we experimented with several alternative “reference frames” for the angle computation: (a) centering w.r.t. **each individual class mean** and (b) centering only on the **predicted class’s mean**. Neither variant yielded consistent gains over our global‑mean formulation. \n\n\nA natural next step is therefore to move from an *either‑or* choice to a **weighted combination** of per‑class angle scores. The weights could be set heuristically or learned from held‑out ID data, for example\n\n\n* inversely proportional to the *in‑distribution feature variance* of each class, or \n* proportional to the *ID accuracy* (or confidence) for that class.\n\n\nSuch a weighting scheme retains ORA’s hyper‑parameter‑free spirit when the weights are derived from readily available ID statistics, allowing the detector to adaptively emphasize the most reliable class anchors. We leave a systematic exploration of this idea to future work.\n\n\n---\n\n\nWe hope these revisions address the reviewer’s concerns and clarify the contribution of **ORA**."}, {"review_id": "xv4czIx7qB", "reviewer": "Reviewer_nGso", "summary": "The problem of out-of-distribution detection for deep learning models is considered. This work introduces OOD Detection with Relative Angles (ORA), a novel approach that uses an angle-based metric calculated relative to the in-distribution structure, demonstrating that angles between feature representations and decision boundaries, when viewed from the mean of in-distribution features, effectively distinguish between ID and OOD data. ORA achieves SOTA performance on different OOD benchmarks.", "questions": "Comments  \n1. The title isn't really long and there is no need to use acronym OOD instead of Out-of-distribution.\n2. Year for [Galil et al.] is missing.", "limitations": "yes", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strenghs  \n1.ORA achieves SOTA performance on different OOD benchmarks.   \n2. ORA's scale-invariant nature allows for an ensemble strategy by simply summing scores from multiple models, further enhancing OOD detection performance  \n\nWeaknesses  \n\t1. Lack of theoretical justification  \n\t2. More recent SOTA OOD detection algorithms (e.g. NECO [T1], Mahalanobis++ [T2], NCI [T3]) are not compared to.     \n\n[T1] NECO: NEural collapse based out-of-distribution detection. ICLR'24.   \n[T2] Mahalanobis++: Improving OOD Detection via Feature Normalization. ICLR'25.   \n[T3] Detecting Out-of-distribution through the Lens of Neural Collapse.", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the constructive review. \nWe respond to each point below.\n\n\n---\n\n\n## 1 Lack of theoretical justification\n\n\n*Appendix C* already contains a proof that **relative angles are invariant to any positive‑definite scaling of the feature space**. In other words, if the feature extractor is perturbed by arbitrary class‑agnostic affine re‑weightings the ORA score is unchanged. We will make this proof more visible by briefly referencing it in Section 3 and adding an intuitive one‑sentence takeaway: *“ORA is provably robust to all invertible diagonal scalings and global translations, two transformations that leave ID decision boundaries intact but can derail norm‑based scores.”*\n\n\nWe acknowledge that Appendix C stops short of a **formal risk bound** on false positives; to our knowledge, **no existing OOD detector that operates on fixed, pretrained features offers such a guarantee**. Nonetheless, our analysis clarifies *why* ORA’s scale-invariant property is less susceptible to manipulation than norm-based scores, and we will highlight this perspective in the revised draft.\n\n\nIf the reviewer has a specific type of theoretical result in mind we are happy to explore it for future work.\n\n\n&nbsp;\n\n\n## 2 Missing comparisons to NECO [T1], Mahalanobis++ [T2], and NCI [T3]\n\n\n\n\n**Table 1. FPR95 (↓) on ImageNet‑based OOD benchmark**\n\n\n| Backbone | NCI | Maha++ | NECO | **ORA (ours)** |\n|----------|-----|--------------|----------------|----------------|\n| ResNet‑50          | 63.05 | 49.67 | 56.61 | **43.63** |\n| Swin‑B pre | 39.62 | 42.67 | 36.48 | **35.13** |\n| DeiT‑B pre | 57.86 | **37.66** | 52.60| 37.76 |\n| Avg | 53.51 | 43.33 | 48.56 | **38.84** |\n\n\nWe evaluated recent state-of-the-art methods NCI, Mahalanobis++, and NECO on the three backbones and OOD splits used in our main paper. Due to time constraints, results for the remaining backbones will be included in the final version. All detectors were evaluated on the four standard OOD datasets (iNaturalist, SUN, Places, Textures). Results show that **ORA achieves the lowest average FPR95**, outperforming NCI, Mahalanobis++ and NECO by a margin of **4.49% on average**.   ORA performs best on two out of three backbones (ResNet‑50 and Swin‑B), and is almost on par with Mahalanobis++ on DeiT‑B.\n\n\n\n\n&nbsp;\n\n### *Minor comments* \n\n\n* **Title.** We will expand the acronym and rename the paper **“Out‑of‑Distribution Detection with Relative Angles (ORA)”** as suggested. \n* **Reference year.** The missing year for *Galil et al.* will be added (2023).\n\n\n---\n\n\nWe hope these revisions address the reviewer’s concerns and improve the clarity and completeness of the paper."}, {"review_id": "nhj8DsOZg5", "reviewer": "Reviewer_9YWP", "summary": "This paper proposes ORA, a novel angle-based metric for OOD detection that leverages that exploits\nthe relationship between feature representations and classifier decision boundaries, viewed from the mean of in-distribution data. The authors demonstrate ORA's effectiveness across nine ImageNet-pretrained models, achieving top or near-top false positive rates in most cases.", "questions": "Please respond to the points raised  in weakness section.", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n* The paper presents a novel post-hoc OOD detection method that leverages relative angles in feature space to relate feature representations to decision boundaries. These angles are computed with reference to the mean of in-distribution samples. \n\n* The paper provides strong empirical validation of the proposed method across established benchmarks. This includes strong performance in OOD detection on the ImageNet benchmark and with CLIP. Furthermore, the method demonstrates benefits when used in model ensembles or as a plug-in module with existing activation shaping algorithms.\n\nWeaknesses: \n\n* ORA and the role of ID classes: Since the method uses the mean of ID samples as a reference, it is unclear how ORA performs on the best- or worst-performing classes. Additionally, it's worth questioning whether using the ID mean remains valid for minority classes. Given that the score function is dependent on the predicted class, the paper also lacks analysis comparing correctly versus incorrectly predicted samples and their effect on ORA. \n\n* The paper refers to ORA as a “confidence measure,” but this aspect is not clearly explained and feels somewhat hand-wavy.\n \n* It is not clear how the analysis presented in Fig. 2 supports ORA. It seems this analysis may be included because the method is similar to fDBD. Clarifying this connection would be helpful.", "was_revised": true, "final_justification": "The authors have addressed all my concerns.", "rebuttal": "Thank you for the thoughtful comments. \nWe reply to each weakness in the same order.\n\n\n---\n\n\n## 1 ORA, minority/majority classes and per‑class behavior \n\n\n**Per‑class centering experiment.** \nTo test whether ORA favors or penalizes specific classes, we present the scores on CIFAR‑10 and ImageNet while centering each time on *one* class mean (instead of the global mean). The table below reports, for every class, OOD performance (FPR95 ↓, AUROC ↑) and the corresponding in‑distribution accuracy (“ID Acc”) of that class’s classifier outputs:\n\n\n| Mean used for centering | FPR95 ↓ | AUROC ↑ | ID Acc |\n|------------------------|---------|---------|--------|\n| Class 0 | 12.03 | 97.51 | 0.952 |\n| Class 1 | 13.27 | 97.41 | 0.985 |\n| Class 2 | 11.73 | 97.69 | 0.926 |\n| Class 3 | 12.02 | 97.54 | 0.887 |\n| Class 4 | 12.06 | 97.63 | 0.958 |\n| Class 5 | 13.00 | 97.36 | 0.880 |\n| Class 6 | 12.11 | 97.62 | 0.979 |\n| Class 7 | 13.25 | 97.54 | 0.964 |\n| Class 8 | 13.26 | 97.26 | 0.970 |\n| Class 9 | 12.84 | 97.25 | 0.963 |\n| **ORA (global mean)** | **10.97** | **97.67** | 0.946 (overall ID Acc) |\n\n\n\n\n| Method          | FPR95↓ | AUROC↑ | ID Acc |\n|-----------------|--------|--------|--------|\n| Class 1 mean    | 28.22  | 93.36  | 0.9200 |\n| Class 250 mean  | 25.59  | 93.99  | 0.6600 |\n| Class 500 mean  | 31.48  | 92.28  | 0.6000 |\n| Class 750 mean  | 27.04  | 93.76  | 0.8400 |\n| Class 1000 mean | **24.75**  | **94.26**  | 0.6000 |\n| ORA (global mean) | 25.04 | **94.26** | 0.7733 (overall ID Acc) |\n\n\n*Takeaway.* \n(i) There is **no clear correlation** between a class’s ID accuracy and its OOD performance when used as the reference; and (ii) using a *single global mean* (ORA) is slightly *better* most of the time than any individual class, supporting our choice. \nFor **imbalanced datasets** the global mean can be replaced by a weighted mean or by the weighted combination of per‑class angles discussed in our response to Reviewer JVzv (future work).\n\n\n\n\n&nbsp;\n\n## 2 “ORA as a confidence measure” \n\n\nWe agree that the wording was hand‑wavy. Our intended meaning is:\n\n\n* Angle‑based scores naturally convey **model confidence**: for ORA a *large* angle (relative to the global mean) implies the feature lies well inside its class cone, hence is likely ID; a *small* angle indicates uncertainty. \n* Because angles are scale‑invariant, **ORA detection scores from different backbones can be summed directly**. Meaning that, a model with a low confidence contributes a small value, while a high confidence one contributes a large value. This underpins the ensemble experiment.\n\n\nWe will replace “confidence measure” with the more precise phrasing above in Section 3.2.\n\n\n&nbsp;\n\n## 3 Clarifying the role of Fig. 2 \n\n\nFigure 2 compares the density of $\\sin\\alpha$  for ID versus OOD data, where $\\alpha$ is the auxiliary angle that appears in the geometric derivation of fDBD. In our formulation the ORA score is proportional only to **$\\sin\\theta$** ($\\theta$ = relative angle to the decision boundary); we justified *omitting* sin α because Fig. 2 shows that ID and OOD distributions of $\\sin\\alpha$ almost perfectly overlap, therefore, $\\alpha$ carries no discriminative signal and can even impede the performance. This directly motivates why ORA outperforms fDBD while remaining simpler. We will add two clarifying sentences before Fig. 2 to make this link explicit.\n\n\n---\n\n\nWe believe these additions address the reviewer’s concerns and will further clarify ORA’s design and empirical behavior."}, {"review_id": "mltRzJbA9k", "reviewer": "Reviewer_1FkU", "summary": "This paper introduces a new OOD detection metric called ORA, which uses relative angles between two vectors: (1) the vector from the mean of in-distribution dataset features to the feature point, and (2) the vector from the mean of in-distribution dataset features to the feature point's projection onto the decision boundary. The authors argue that the angular distance provides better discrimination between ID and OOD samples compared to previous distance-based approaches, particularly the closely related fDBD method. They evaluate their method extensively across various pretrained architectures, including convolutional and transformer-based models, reporting modest improvements over existing methods.", "questions": "1. In the conclusion, three key advantages of ORA are: (i) hyperparameter-free, (ii) model-agnostic, and (iii) scale-invariant. It would be useful to clarify whether fDBD shares these properties. If fDBD does not exhibit these attributes, please specify explicitly what distinguishes ORA from fDBD regarding each of these aspects.\n\n2. The original fDBD paper emphasized the importance of the regularization term through an ablation study. However, in this submission, this regularization term is geometrically reinterpreted as $\\sin \\alpha$, and Figure 2 suggests that its contribution may be insignificant. Clarification on how this apparent contradiction can be reconciled or further contextualized would enhance the consistency and coherence of the interpretation presented.\n\n3. Both this study and the original fDBD approach rely on the observation that \"ID data are mapped further from the decision boundary.\" Although the fDBD paper supports this claim with limited experimental results provided in Appendix J, additional insights or theoretical justifications would significantly strengthen the argument. It would be valuable to discuss whether this observation consistently holds for simpler datasets, such as MNIST, or simpler network architectures, such as LeNet, and provide reasoning or evidence explaining why this might be the case.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n\n1. The paper is clearly written.\n\n2. Extensive experiments have been conducted.\n\n3. The interpretation of fDBD from a geometric perspective is highly interesting. Specifically, leveraging the law of sines to accurately highlight the connection between fDBD and the proposed method is insightful and appealing.\n\n**Weaknesses**\n\n1. This paper closely resembles fDBD. Fundamentally, both papers rely on the same core insight that \"ID data are mapped further from the decision boundary.\" The primary difference is that this paper explains the same phenomenon from a geometric perspective.\n\n2. The empirical results do not demonstrate significant improvements.\n\nIn conclusion, although this paper presents some noteworthy insights, it does not meet the standards required for NeurIPS.", "was_revised": true, "final_justification": "Thanks to the author for the concise and precise response. I acknowledge that my understanding of ORA in the initial review was incorrect. Now, I would like to reassess this work: The geometric interpretation of fDBD is highly interesting. In particular, leveraging the law of sines to clearly illustrate the connection between fDBD and the proposed method is insightful and appealing. Moreover, this new perspective provides important practical guidance - the empirical observation of $\\sin \\alpha$ revealed it to be an insignificant term that can be eliminated. Indeed, removing $\\sin \\alpha$ resulted in a stable improvement in OOD detection performance. Although this work extends fDBD, it introduces an intriguing perspective, and this novel viewpoint effectively enhances performance, making it strong work overall. Therefore, I have increased my rating.", "rebuttal": "Thank you for the careful reading and for highlighting the geometric link we drew between fDBD and ORA. \nWe address each point below.\n\n\n---\n\n\n## 1 Clarifying the regularization term \n### How raw distance, fDBD, and ORA relate\n\n\n---\n\n\n#### **A. From distance to angles**\n\n\nRaw distance to the decision boundary is $d(z,z_{db})$.\n\n\nby shifting all points by the ID mean $\\mu$ and applying the law of sines, this distance can be written as:\n\n\n\n$d(z, z_{db}) = \\||z - \\mu\\|| \\cdot \\frac{\\sin\\theta}{\\sin\\alpha}$\n\n\n* $\\theta$ – angle between **z** and its projection on the boundary (contains ID/OOD signal). \n* $\\alpha$ – auxiliary angle at the origin (Fig. 2 shows almost no ID/OOD signal). \n* $\\||z − \\mu\\||$ – feature distance to the ID mean; varies with image scale, brightness, etc.\n\n\n---\n\n\n#### **B. Why fDBD beats raw distance**\n\n\nfDBD divides by the feature distance to the ID mean:\n\n\n\n$\\text{fDBD} = \\frac{d(z, z_{db})}{\\|| z - \\mu \\||}\n= \\frac{\\sin\\theta}{\\sin\\alpha}$.\n\n\n*Dividing removes the scale term*, so scores are no longer sensitive to simple rescalings of the feature vector. \nThis alone improves AUROC / FPR95 compared with raw distance.\n\n\n---\n\n\n#### **C. Why ORA beats fDBD**\n\n\nEmpirically, $\\sin \\alpha$ is nearly identical for ID and OOD (Fig. 2), so the factor ($\\sin\\alpha$) adds variance but no separation. \nORA therefore keeps only the informative part:\n\n\n$\\text{ORA} \\propto \\theta$\n\n\n---\n\n\n#### **D. Resulting hierarchy**\n\n\n\n$\\boxed{\\text{raw distance} < \\text{fDBD} < \\text{ORA}}$\n\n\n* Raw distance suffers from scale noise. \n* fDBD fixes scale noise but still carries $\\frac{1}{\\sin\\alpha}$ noise. \n* ORA fixes both, explaining its per‑model gains **and** its suitability for scale‑invariant ensembling.\n\n\n> **Q:** *Do hyper‑parameter‑free, model‑agnostic, scale‑invariant also apply to fDBD?*\n\n> **A.** Yes—fDBD shares these three traits, and for that reason it is our primary baseline throughout Tables 1, 2, 3, 4, 8, 9, 14, 15, 17, 18, 19. Across all experiments **ORA never trails fDBD and often surpasses it.**\n\n\n&nbsp;\n\n## 2 “Modest improvements” \n\n\nOn ImageNet OOD (nine architectures) ORA is **#1 on 5/9 backbones, never worse than top‑3, and reduces mean FPR95 by $3.18 \\%$ versus the next best method (Pcos)**. ORA also achieves the single best score overall ($25.04 \\%$ FPR95 on ResNet‑SCL), motivating our deeper dive into contrastive features (CLIP, Section 4.2). Similar gains appear for model ensembles and activation‑shaping plug‑ins.\n\n\n&nbsp;\n\n## 3 Extra evidence on “ID points lie further from the decision boundary”\n\n\nTo confirm that the observation holds even for very simple data / models, we trained a **LeNet‑5** on MNIST as suggested by the reviewer and measured the distance to the decision boundary for MNIST (ID) and Fashion‑MNIST (OOD). \n\n\n| Dataset | Mean | Std | Min | Max |\n|---------|------|-----|-----|-----|\n| **MNIST** | **5.86** | 0.62 | 2.69 | 7.49 |\n| Fashion‑MNIST | 4.77 | 0.82 | 1.99 | 6.66 |\n\n\n*ID samples are, on average, **1.1 units further** from the decision boundary than OOD samples.*\n\n\n**Intuition.** Cross‑entropy training maximizes class‑conditional log‑likelihood, which drives features to align strongly with their corresponding weight vectors (confident regions), i.e. deep inside their class cones and therefore *away from the boundary*. OOD images do not match strong class‑specific patterns, so their features align less and end up nearer to the boundary, exactly as the distance statistics show.\n\n\nThis experiment supports the geometric premise shared by fDBD and ORA on the toy dataset.\n\n\n---\n\n\nWe hope these clarifications resolve your concerns and underscore how ORA both simplifies and strengthens the fDBD insight."}]

Author rebuttal:

Meta-review: This paper proposes a new metric to detect OOD samples, based on angles between feature representations and decision boundaries. This perspective is new and interesting. In the initial reviews, reviewers have novelty concerns regarding this paper. Then, the authors addressed it during the rebuttal. Reviewer nGso had some concerns, but, after checking by the area chair, the concerns are addressed and minor. Thus, this paper is in good shape for publication. However, the area chair suggests adding a comparison or discussion on some representative baselines of zero-shot OOD detection (e.g., NegLabel) to further strengthen this paper.
Decision: Accept (poster)