GOOD: Training-Free Guided Diffusion Sampling for Out-of-Distribution Detection
Authors: Xin Gao
Jiyao Liu
Guanghao Li
Yueming Lyu
Jianxiong Gao
Weichen Yu
Ningsheng Xu
Liang Wang
Caifeng Shan
Ziwei Liu
Chenyang Si
Venue: NeurIPS 2025 poster ()
Keywords: OOD detection
Diffusion Model
Guided Sampling
Primary area: deep_learning
TL;DR: We propose GOOD, a training-free framework that leverages off-the-shelf classifiers to guide diffusion models for generating diverse, informative OOD samples—improving outlier exposure without requiring external datasets or embedding alignment.

Abstract: Recent advancements have explored text-to-image diffusion models for synthesizing out-of-distribution (OOD) samples, substantially enhancing the performance of OOD detection. However, existing approaches typically rely on perturbing text-conditioned embeddings, resulting in semantic instability and insufficient shift diversity, which limit generalization to realistic OOD. To address these challenges,  we propose GOOD, a novel and flexible framework that directly guides diffusion sampling trajectories towards OOD regions using off-the-shelf in-distribution (ID) classifiers. GOOD incorporates dual-level guidance: (1) Image-level guidance based on the gradient of log partition to reduce input likelihood, drives samples toward low-density regions in pixel space. (2) Feature-level guidance, derived from k-NN distance in the classifier’s latent space, promotes sampling in feature-sparse regions. Hence, this dual-guidance design enables more controllable and diverse OOD sample generation. Additionally, we introduce a unified OOD score that adaptively combines image and feature discrepancies, enhancing detection robustness. We perform thorough quantitative and qualitative analyses to evaluate the effectiveness of GOOD, demonstrating that training with samples generated by GOOD can notably enhance OOD detection performance.

GOOD: Training-Free Guided Diffusion Sampling for Out-of-Distribution Detection
Xin G
Jiyao L
Guanghao Li
Yueming Lyu'
Jianxiong Gao?
Weichen Yu?
Ningsheng Xu²
Liang Wang*
Caifeng Shan
Ziwei Liu
Chenyang Si
Nanjing University Fuuda University
*Carnegie Mellon University
*Chinese Academy of Sciences
Nanyang Technological University
Abstract
Recent advancements have explored text-to-image diffusion models for synthesiz- ing out-of-distribution (OOD) samples, substantially enhancing the performance of OOD detection. However, existing approaches typically rely on perturbing text- conditioned embeddings, resulting in semantic instability and insufficient shift diversity, which limit generalization we propose GOOD, novel and flexible framework that directly guides diffusion sampling trajectories towards OOD regions using off-the-shelff in-distribution (ID) classifiers. GOOD incorporates dual-level guidance: (1) Image-level guidance based on the gradient log partition to reduce input likelihood, drives samples toward low-density regions in pixel space. (2) Feature-level guidance, derived from k-NN distance the classifier's ' latent space, promotes sampling in ceature-sparse regions. Hence, this dual-guidanee design enables more controllable and diverse OOD sample generation. Additionally, we introduce a unified OOD score that adaptively combines image and feature discrepancies, enhancing detection robust- ness. We perform thorough quantitative and qualitative analyses to evaluate the effectiveness of GOOD, demonstrating that training with samples generated by GOOD can notably enhance OOD detection performance.
realistic OOD. To address these challenges,
Introduction
Out-of-distribution (OOD) detection crucial for safely deploying machine learning systems, as neural networks often produce overly confident predictions when encountering distributional shifts [50, 69, 2, 1]. One promising approach to address this issue is Outlier Exposure (OE), which introduces auxiliary outlier datasets during training to help models learn more robust decision boundaries around in-distribution (ID) data [26, 33, 46, 48, 70]. Despite their effectiveness, OE methods depend heavily on manually selected outlier data, limiting their scalability and generalization.
Recent studies [36, 48, 7] have explored generative models scalable alternatives to manually curated outlier datasets, with text-to-image diffusion models gaining attention for their ability to generate high-quality images. Typically, these methods follow a two-stage approach, first mapping ID samples into a latent space aligned with the text-conditional space of diffusion models, and then perturbing these embeddings only incurs high computational cost but also suffers from two fundamental limitations. First, as shown in Figure (a)) small perturbations the embedding space can result in disproportionate and unpredictable shifts in the image space through diffusion process. This misalignment hinders semantic control, often generating samples that either deviate significantly from the target class or remain indistinguishable from ID examples. Second, as illustrated in Figure 1(b), they primarily introduce
generate OOD samples [15, 13, 44]. However, this embedding process not
EEqua Contribution.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

with DieariCOo
eile Outar (000))
Tiger
samples generated by tend-condiiionl space permutation
(b)
Figure 1: Limitations of text-conditioned OOD generation (e.g., Dream-OOD [15]). Left: Misalign- ment- - Latent perturbations produce samples that either deviate from target semantics or resemble ID images. Right: Limited Diversity Perturbing only semantic embeddings yields low coverage of broader distributional shifts, such as covariate or domain shift.
variation by shifting semantic embeddings, while neglecting other critical forms of distributional shift such as covariate and domain shifts [69, 6]. As result, it becomes challenging to reliably generate diverse and informative OOD samples, which are essential for learning robust detectors.
To address these limitations, we aim to directly guide diffusion sampling in pixel space toward meaningful OOD regions instead of perturbing latent embeddings. Specifically, we leverage the ID classifier to provide distributional signals without additional training, inspired by the Training- Free Guidance (TFG) framework
[71]. Unlike previous approaches that use differentiable functions primarily to ensure semantic or stylistic alignment [22, 56, 8, 4, 73], our goal is fundamentally different-to explicitly generate informative and diverse OOD samples to train robust detector.
In this context, we propose GOOD, framework for synthesizing OOD samples by explicitly guiding the denoising trajectory of diffusion models with ID classifier. GOOD introduces two guidance functions danctions-image-ee image-level and feature-level derived from differentiable OOD sores of any off-the-shele classifier. The image-level guidance uses free energy to push samples toward wow-likelihood regions pixel space, while the feature-level guidance leverages k-nearest neighbor distances in the feature space to promote sampling in feature- sparre areas. Together, these signals enable the generation of diverse and informative OOD samples that are clearly separated from the IDD distribution. We also analyze the diffusion process and show that proper initialization and step-size control are key to effective boundary sampling. These samples are then used an OE setting to enhance classifier robustness. Additionally, we introduce unified OOD score combining pixel-level likelihood and feature-space distance, which improves detection across various OOD scenarios.
We conduct extensive experiments on multiple benchmarks, including Imagenet, CIFAR- 100, CIFAR- 10, to evaluate the effectiveness of GOOD. Results show that incorporating GOOD 1000D-generated samples into OF training significantly improves detection performance, outperforming existing post-hoc and synthesized outlier-based methods. Our contributions are summarized as follows:
We propose GOOD, flexible framework that guides diffusion sampling toward OOD regions using off-the-shelf classifiers. The synthesized outliers effectively encourage classifiers to establish conservative and robust decision boundary for improved OOD detection.
Additionally, we propose an unified OOD Score, which integrates pixel-level and feature- level discrepancies, providing more comprehensive measure for OOD detection.
Extensive experiments across benchmark datasets showing that GOOD outperforms previous OOD generation and OE methods in terms of detection accuracy.
2 Preliminaries and Related Works
We consider training set {(r, " drawn i.dd from joint distribution Pxy, where I X and z y {l.... C}. Let P. be the marginal input distribution, representing the

---

(+) Guided Sampling OOD Samples Generation
(b) Outier Exposure Training
Inliar in Traising
Loss Lev ALooD
Oredica
Poceak's Foerada
Sop purs ID ww..eriaaee Outies
Syotlesized
Classifier
Latthod
Gradkent Illuacation of Dualleed Guidance Fantroeer Guidano
22
Emaggol Land Gulfane
Test-time OOD Detection
en Lowibiliood
Validation Iniiecs
Tase
Classifier
Testing Outliers
Hligh
Unified OOD Sooce Gosllig)
Imagel ikkelikndd
Martiald
Sumpling
Figure 2: Overview of the GOOD framework. (a) Guided by feature- and image-level signals, GOOD samples synthetic outliers near the decision boundary. (b) These outliers are used in Outlier Exposure training to separate ID and OOD samples via regularization loss. (c) At test time, OOD is detected using a unified score that combines feature distance and image likelihood.
in-distribution (ID). We define multi-class classifier fo : X + RC, parameterized by é, which predicts the label of each input sample.
oittr--dditiitttion Detection. In real-world applications, reliable classifier must not only make accurate predictions on in-distribution (ID) data, but also identify out-of-distribute (OOD) inputs that differ significantly from the training distribution. Such shifts may stem from changes in domain, covariates, or semantics [69, 6], rendering OOD samples incompatible with the label space V. To separate IDD from OOD samples,
OOD score function (oo X' -> R is used, where ID samples receive lower scores and OOD samples higher ones. This score is typically based on model confidence [25], likelihood estimates [46, 59], or distance-based metrics (61,38).
Generative Diffusion Model. Difftusion models generate data by reversing forward noising process. Given sample xo ~ (x). the forward (diffussion process gradually corrupts zg into noisy sample Iy over discrete time steps E [ x, = vā,zy + /1 ā,e, ~~ (O I), where {āz ) defines the noise schedule. The denoising model co(x,, t). parameterized by 6, is trained to predict the added noise e. This yields the standard noise prediction objective for training proposed in [27].
For sampling, we begin with æт N(0, /) and iteratively sample _t-1 Po-1j (1 Since this conditional probability is not directly computable, DDIM [55] approximates 54-1 as:
1 V a V1 V
Varsols TcC, VI-a.
Toje m(x:) A -i-vil
va
where di controls the stochasticity of the sampling process, and Zo is the model's estimate of the original signal at step t, given by Tweedie's formula [17].
For diffusion models such Stable Diffusion (SD) [53], which generate data from conditional distribution Po (x)cc, the condition e typically lies in a text-conditional space, enabling control over generation via descriptions. These models are trained to predict < C, t), where e may be descriptive text or left empty. During sampling, guidance is applied by modifying the predicted noise steer the output more strongly toward the conditioning signal [29, 52]:
( C, () (1 + (x,, c,t) Bea(xr Ø,
where 3 controls the strength of conditioning.
We have briefly introduced some relevant works 0OD detection and guided diffusion sampling as context for our method. For comprehensive review of related literature, please refer to Appendix 1.
3 GOOD: Guided OOD Sampling with Diffusion Models
As shown in Figure 2, our framework GOOD enhances OOD detection by generating informative synthetic outliers for Outlier Exposure training. Section 3.1 introduces two guidance- cillaance-ffttur--.. and
3

---

Algorithm Training-Frree Guidance for OOD Sampling (GOOD)
1: Input: Diffusion model co(:));), condition c, condition strength 8, ID Classifier fa. k-NN distance k, guidance strength P. Hs T, number of steps T
2: 2T ~ 10,
3: for = TT=T,... T....... do
4: Conditional Predicted Noise éo (21, c, 1) (1 ()oo(e, C, Gäs (z1, 0,
Define function f(x) Ex r). Wv1 1 āed)
TFG (a)
6: Guided function for OOD Sampling Good(; Fi:: f) Dz(=f)
7:
Z0i/ = (x;; -- (3 (Tz, t)) /
Obtain the predicted data
8:
At - pi Z
TFG (b)
9:
Åo ne zoj Good (Zuje:
D TFG (c)
10:
Øt-1 Sample(xs, ( Toje, Ae/ vo
Sample as DDIM in Eq. (1)
11:
12:
end for
13: Output: OOD sample zo with respect to fo
ussg off-the-shelff classifier to guide sampling toward OOD regions. Section 3.2 refines the sampling trajectory by adjusting step size and initialization to produce outliers with varying anomaly levels near the decision boundary. These are then used to boost model robustness, Finally, Section 3.3 proposes a unified OOD scoring function for effective detection.
3.1 Two Training-Fre Guidance for OOD Sampling
To explore how diffusion models can generate OOD samples, we visualize their sampling trajectories with gradient cues in Figure 2. In particular. we examine the transition from the noisy manifold Mr to .M,1 (shown by the blue arrow) and observe that it can be guided toward OOD regions using gradients from an ID classifier. Motivated by this observation, we introduce two comple- mentary guidance mechanisms -image-leeeel guidance (GOODimy) and feature-level guidance (GOOD leverage both likelihood and distance. These guidances can derived from any off-the-shelff classifier, making our approach both model-agnostic and training-free.
Image-Level Guidance: GOODing- Following the energy-based reinterpretation of discriminative classifiers [19], we define an energy for classifier with logits (a () as
Es(x, == -f;;x)
Eạ(x)
log Σ ca(z)))
(3)
R=1
These definitions induce the model-dependent joint and marginal densities
Po(x, e (xg(zx
Po(x)= = Σ Po(x, v) = Σn ele(and)
e Ex(xx)
(4)
Z(Ø)
Z(Ø)
Z(Φ)
where 7(0) is parameter-depennent partition function constant in Hence (x)xx) is model- defined negative log-density (up to 7()),, sometimes called the free energy [35, 46]. Intuitively, samples with larger Pa(x:) (i.e., lower energy) correspond to regions the classifier assigns high confidence to; lower (2(x) indicates atypical or OOD regions. Following [46], in-distribution samples tend to concentrate high-po(x) (low-energy) regions, as supported by their gradient-based analysis. We thus define the image-level guidance gradient as
v,E,(z) En (fc(s
Eeluro V Velltoovaaate v.f((;))).
(5)
During reverse diffuuion,, moving along + (z pushes samples from high-density (ID) toward low-density (OOD) regions in the input space of fo.
Feature-Level Guidance: GOOD foat The feature space learned by deep networks is typically lower-dimensional, more compact, and semantically richer than the raw image space. To exploit this property, define feature-level OOD guidance using the k-nearest neighbor (k-NN) distance in the

---

Wolf
Hare
Tieer
Pig
Zehn
Otter
Violin
MOSTE
Figure 3: Visualization of generated OOD samples with increasing step sizes, arranged from top to
bottom (p = μ 0.1 - 5). The samples exhibit varying degrees of anomaly.
feature space. Let f1:z の) denote the L-layer feature representation of input We construct
a normalized embedding bank z {21, 22 Jn where each 2; = f1 (x:; f) (r,; 12
For given embedding from input x, its k-NN distance to the embeddings in E is:
Da f) - 1| 2(1)) lla |f
2(x)]l2+
(6)
where 2(k) is the k-th nearest neighbor of in Z. Intuitively, embeddings located in sparse regions (i.e., large k-NN distance) are more likely to be near the distribution boundary or truly OOD, while those in dense regions are likely ID. We define feature-level guidance GOOD)eat as the gradient of this k-NN distance with respect to the input:
V DxDx [
(2 (w:d) (o,
2(0)
V (.
(7)
Along this gradient direction, we generate samples with increasingly rarer features, as depicted by the transition from smaller to larger circles in part (b) of Figure 2.
While both GOODing and GOOD defined on clean inputs zo, the diffusion sampling process operates on the noised input T4- To bridge this gap effectively, we adopt the Training-Fres Guidance (TFG) framework [71], which unifies existing training-free sampling strategies and allows their combination toward any differentiable target predictor. The overall sampling algorithm is summarized in Algorithm 1. GOOD can be seamlessly integrated into the TFG framework, with a detailed analysis provided in Appendix. This approach enables the application of GOODang ing and GOOD fear throughout the reverse diffusion process without the need for retraining the model.
3.2 Balanced OOD Sampling with Varying Degrees of Anomaly
Building on the differentiable OOD score from Section 3.1, our method captures diverse distributional shifts without manual definitions, aligning with the model's implicit understanding of OOD. However, while gradients guide the direction, the target remains uncontrolled, which may limit the algorithm's application. To improve this, we refine the process by adjusting the initial point and step size, enabling the generation of OOD samples with varying levels of anomaly.
Initialization via Conditional Generation. Unconditional generation can cause samples to deviate significantly from the original distribution due to the broad coverage of the generative model, failing to properly regularize the classifier. To mitigate this, leverage diffusion models like SD, which can incorporate class descriptions (c.g.. "A high-quality image of the <class label>") as conditional inputs. This essentially selects an initial point near the ID class, with the gradient guiding the process further from the distribution center, generating samples with increasing levels anomaly.
Step Size of Different Combinations. The hyperparameters and in Algorithm directly control the step size of the sampling trajectory and thereby influence the characteristics of OOD samples. In the TFG framework, grid search is used to identify the optimal combination based on the visual quality of the generated images. To better understand how step size affects the usefulness of samples for OOD detection, we perform empirical analysis using GOOD img defined in Eq. (3).
5

---

of Symthesized Energy
(b) of Symthesazd OCD Energy
Thining 30)
30n
Coniiiaare of coteeer Senp siove (300) Trineng Sam
1.0
Vel Serion dat
Seaind S
1.3
Vnlicetio SecitD)
2-0 Seamn 3.
2.0
Eep-- 0-1
D.De--22 2.3
2-00 3e3ie De
2Hd Expard Se
pi4 Seauid DeSo
0.4
L4
00
Energy Iragatbeely
-13
-3
0.0 -16
Energy Iregathely
-12 -32
-14 -12 -10
Enagariety ainsed knihhoed
(h)
(c)
Figure 4: Energy score analysis (inversely related to image likelihood) on ImageNet-100 ID sets and synthesized OOD samples. (a) OOD energy distributions across different p values. (b) Distributions under varying μ. (c) Balanced sampling over all p-p combinations (5 x 5 = 25).
As shown in Figure 3, increasing the step size (from top to bottom) leads to samples that diverge more noticeably in style, domain, and semantics. Figures 4(a) and (b) further provide a statistical view: the energy scores of generated samples increasingly diverge from those of the ID validation set as step size grows. The distributions shift rightward and become more peaked, with p having stronger impact than μ. This is likely because p incorporates second-order variance information, cnabling more accurate gradient directions and producing more concentrated sampling distributions.
Samples that are too close to the ID distribution may be indistinguishable from ID) data, weakening their regularization effect. Conversely, samples that deviate too far are too easy to separate, resulting in overly loose decision boundaries. To address this, we propose combining samples generated with multiple parameter settings rather than relying on a single "optimal" configuration. This produces more realistic near-OOD distribution and promotes tighter, more robust decision boundaries, as shown in Figure 4(c) and detailed in Appendix.
Outlier Exposure with Synthesized OOD data. The generated OOD samples are subsequently used for OE training improve the classifier's ability to distinguish between ID and OOD data. The OOD loss is defined as [16]:
LOOD -Eaooo
log T+exp oit ([F
En Pl.. [-log
exp de (E(f(()) T+exp ((ELs(())
(8)
where (-() is a three-layer MLP trained to predict OOD likelihood, E()) denotes the free energy in Eq. (3). The final loss function is L == LCE + X LOOD, where À is hyperparameter controlling the regularization strength. LCE denotes the cross-entropy loss on the ID training data. By incorporating both ID and synthesized OOD samples into training. the classifier learns to better differentiate their distribution, thereby improving its generalization to unseen data in real-world scenarios.
3.3 Combining Image Likelihood and Feature Distance for Unified OOD Scoring
To improve OOD detection during testing, we propose a unified OOD score that combines two complementary signals: image-level likelihood and feature-level distance.
The free energy E(x; Φ), defined in Eq. (3), represents the negative log-likelihood of an input image, reflecting how well it fits the learned image distribution. While it captures pixel-level shifts effectively, it may struggle to distinguish true OOD samples from ID inputs in low-density regions due to the high dimensionality and sparsity of image space. In contrast, the k-NN distance D(x; Φ), defined in Eq. (6), measures compactness in a dimensiooli feature space, making it better suited for detecting class and feature anomalies.
Instead of favoring one metric, we treat them as complementary, combining them to improve OOD detection across different scenarios. To adaptively weight the two signals, we estimate the distributional shift in feature space by comparing the k-NN distance distributions of the test set and held-out ID validation set. Let Test and @ID denote their empirical distributions, and compute the Kullback-Leible (KL) divergence: KL(qualIqu) A larger divergence indicates significant deviation in feature space, suggesting higher reliability of the feature-level score. Conversely, smaller divergence favors the image-level score. Thus, we define a soft interpolation coefficient: exp(- -a KL (hea)lgm))
O, which increases with the degree of shift and smoothly maps to the range [0, 1). The final unified OOD score for a test sample & is computed as:
Good(I; f) = D(z; f) + (1 w) É(z; f),
(9)

---

Table 1: Comparative evaluation of OOD detection performance on ImageNet- 100 as the in- distribution dataset (following Dream Dream-OOD OOD [15]). We report standard deviations estimated across runs. Bold numbers are superior results and underline indicates second best.
INATURALIST
PLACES
SUN
TEXTURES
Average
AUROCT
FPRU5L
AUROC1
HPRVS]
HPRU5]
AUROCTT
AUROC1
MSP [25]
94.95
47.10
90.84
47.60
90.86
65.80
83.
96.01
87
ODIN [45]
24.40
95.92
50.30
90:20
44.90
91.55
61.00
81.37
25.15
89.76
87.64
Mahalanobis [38)
91.60
75.16
96.70
60:87
97.40
62.23
36.30
91.43
80.55
12.42
87.
90.76
47.
63,80
46
87
[30]
39.90
KNN [s]]
28.67
95.57
65.83
88.72
58.08
90.17
12.92
90.37
41.38
91.20
87.64
VIM [64]
75.50
$7.18
$8.30
$1.25
$8.70
81.37
15.60
96.63
67.03
96.61
87.64
ReAct [59]
22.40
96.05
45.10
92.25
37.90
93.04
59.30
85.
41.17
91.64
87.61
[60]
92.51
Symnhesi methodds
GAN [37]
83.10
71.35
83.20
69.85
84.40
67.56
91.00
59 16
85.42
66.98
79.52
VOS [16]
43.00
93.77
47.60
91.77
39. (9.44
93.17
66.10
81.42
49.02
90.03
87.
NPOS [62]
53.84
86.52
83.50
53.
8,98
98.13
89.04
85.37
Dream-OOD [15)
93.11
NCIS [13]
20.70
96.56
34,60
94.07
35.43
94.13
44.83
88.50
33,89
93.32
87.24
BOOD [4+]
18.33
96. 96.74
33,33
91.08
37.92
93.52
$1.88
85.41
35.37
92.11
87.92
GOOD (Ours)
9.22
97.61=022
24.7950.
94.82.0.1
17.20=1.0
96.10
19.51=11
96.68 10.60=n1
17.68:007
96.30
87.16
Table Comparative evaluation of OOD detection performance on CIFAR 100 the ID dataset.
SVIN
PLACES265
LSUN-R
ISUN
TXETURES
Average
Metheds
FPR95L
AUROC1
[PR95]
AUROCT
[PR95]
AUROC
FPR95,
AUROCI
FPR95)
AUROC!
[PR95]
AUROCI
wio ODD
48 20
84.35
65.24
54.38
42.82
86.62
31.24
89.10
53.97
83.07
48.31
84.21
W0DD [15]
58.75
87.01
70.85
70:04
24.25
95.23
1.10
99.73
46.60
88.82
40.31
90.15
FodFoM [?]
33.19
94.02
42.30
98.68
28:24
95.09
33.05
94.45
35.44
93.38
34:45
93.52
GOUD 5121512)
19.37
95.34
63.85
11:11
95.98
GOOD 128-1288
98.62
87.09
98.73
where E(;; σ) is min-max normalized to [0, 1] for consistency during interpolation.
Experiment
We provide comprehensive evaluation of our proposed framework GOOD. GOOD generates meaningful pixel-level outliers that exhibit distributional shifts from ID data, resulting in significant improvements in OOD detection ImageNet [10] and CIFAR-100 [34] (Section 4.2). Ablation studies (Section 4.3) are conducted to assess the impact of various components and hyperparameters.
4.1 Experimental Setup
Dataset and Training Details. We ImageNet- 100 [10] and CIFAR-100 as the ID training datasets, following [15, 13, 44, 7J. For ImageNet- 100, the OOD test data is sourced from [32], which includes
iNaturalist [63]. SUN [66], Places [74], and Textures [9]. For CIFAR-100, we evaluate five OOD
test sets: SVHN [49], Places365 [74], LSUN-R [72], ISUN [67], and Textures [9].
ResNet-34 [21] the ID classifier for fair comparison, though method trchitecture-agnostic and works with any pretrained model on the ID dataset. To improve the classifier's s ability to differentiate between OOD and ID data, we generate OOD samples using Stable Diffusion v1.5 [52] guided by our proposed method. Specifically, we generate 12,500 images using image-level guidance (GOODamg) and 10,500 images using feature-level guidance (GOOD)eat) The detection model is fine-tuned from the pretrained classifier using these synthetic OOD samples and the loss function in Eq. (8). The loss weighting parameter À is 2.5. Optimization is performed using stochastic gradient descent with momentum (0.9) and a weight decay of x 10-4, The model trained for 50 epochs ImageNet-1000 and 200 epochs CIFAR-100, with a cosine learning rate schedule that starts with an initial learning rate of 10-4 and a batch size of 160.
Following [15],
Evaluation Metrics. We evaluate OOD detection performance using three metrics: (1) FPR95 false positive rate when the true positive rate for ID samples is 95%; (2) AUROC - area under the receiver operating characteristic (ROC) curve; and (3) ID Acc ID classification accuracy.
4.2 Evaluation of OOD Detection Performance and Comparative Analysis
GOOD significantly improve OOD detection. Table presents a comprehensive comparison of our method, GOOD, against diverse set of baselines, including score- based methods (c.g., Maximum
7

---

Class: 'Hen' Guidance: GOOD Losg
Class: 'Hen' Guidance: GOOD Feat
GoL-CAM
pepes
CodCAMM
Figure 5: Generated OOD samples using two guidance types, with Grad-CAM heatmaps highlighting regions of high gradient response. The class 'hen' is from ImageNet-100.
Softmax Probability [25], ODIN [43], Mahalanobis [38], Energy Score [46], Generalized ODIN [30], KNN Distance [61], ViM [64], ReAct [59], DICE [60]) and synthesis-bar approaches (c.g.. VOS [16]. NPOS [62], GAN-based generation [37]). We also include recent reffusiin-basee methods closely related to our work, such as DreamOOD [15], NCIS [13], BOOD [44], and FodFom [7].
On the ImageNet-100 100 dataset, GOOD significantly outperforms existing methods, achieving the lowest FPR95 (17.68) and highest AUROC (96.30), clearly surpassing the second-best method, NCIS. This demonstrates its robustness in challenging OOD scenarios such as iNaturalist, Places, and SUN. the Textures dataset, GOOD slightly trails NPOS, which operates the latent space. Notably, all pixel-level synthesis methods struggle on Textures. As detailed in the Appendix, this dataset is casily separable from ID data at the feature level, but Stable Diffusion struggles to generate OOD images with similar features due to its training distribution. GOOD mitigates this by introducing feature-level guidance during generation and combining image and feature cues at test time. This limitation can be mitigated with more powerful generative models that capture broader distributions, and our method offers a flexible framework adaptable to future advancements.
GOOD adapts with smaller diffusion models and low-resolution datasets. Table 2 compares GOOD using 512x512 and 128x1 28 diffusion models. Prior methods often use high-res models (e.g., Stable Diffusion at 512x512) on low-res datasets like CIFAR-100, causing mismatches due to up/downsampling. which misaligns pixel and feature spaces and degrades OOD image quality.
GOOD avoids this by directly guiding the denoising process via gradients. We use a high-res generator and apply differentiable bilinear downsampling to match the classifier's 32x32 input. This fully differentiable path allows gradients to emphasize key regions, producing meaningful OOD images. With 128x128 model, GOOD reduces average FPR95 from 34.5% (FodFoM) to 19.50%, and improves AUROC from 93.52 to 94.65 68. Gains are especially notable on ISUN (0.07% FPR95, 99.96 AUROC) and SVHN (6.6 6.65% FPR95. 98.62 AUROC). The 512x512 model only outperforms on the highly textured TEXTURES set (23.47% FPR95), suggesting high detail helps in specific cases. Full results are Appendix. Overall, the smaller 128x128 model consistently outperforms its larger counterpart- due to a better inductive bias for low-resolution structure and the elimination of information loss during resizing-whit requiring an order-of-man -f-ggniu-e less compute.
4.3
Ablation Study
In this section, we present additional ablation studies to further analyze the effectiveness of GOOD in generating informative OOD samples and improving detection performance.
OOD emerges from classifier-critical regions. Figure shows OOD samples generated by our two guidance strategies: GOODing img (left) and GOOD feat (right). Each image is paired with Grad-CAM heatmap, highlighting regions most sensitive to the OOD score. As previously shown in Figure 4, the guided samples are well-separated from ID data in distribution. The visualizations now reveal how this separation emerges: although the generated images remain close to the class (e hens), they exhibit subtle yet semantically meaningful deviations. These shifts often occur in key semantic

---

14.24
96.13
96.34
75.35
56.26
550
$4.09
$5.00
$6.00
96.18
06.27
56.24
1833
Ex50
kx000
33 114
08
Rag wrwwe COMTRINE
5.
12
-25
-34 -22
(b)
(5)
(6)
Figure Ablation studies on key hyperparameters: (a) regularization weight À in the OOD loss Lood; (b) interpolation coefficient in the unified OOD score (Eq. 8); (c) number of nearest neighbors K used in the KNN distance- top: for OOD scoring, bottom: for the sampling process.
sugi as the comb, feathers, and claws for hens-which are distorted or abstracted, reducing resemblance to typical ID images while preserving overall class-like structure. This suggests that gradient-based guidance focuses on classifier-critical regions, producing samples near the decision boundary rather than only perturbing semantic description, prior methods often do.
Key Components in Our Method. We further analyze the contribution of each component in GOOD through a controlled ablation study, summarized in Table 3. Rows (2)-(3) evaluate the effect of using only one type of guidance during OOD synthesis. Specifically, Row (2) uses image-level guidance (GOOD_i)) (r0OD_img) alone, and Row (3) uses feature-level guidance (GOOD_ feat) alone. Both variants employ balanced sampling across different step sizes to ensure diverse OOD generation, but they rely solely on the default energy score for detection. Row (4) rep- resents the full GOOD pipeline without the unified OOD score, i.e., both image- and feature- level guidance are used for OOD synthesis while the energy score alone (a = 0 in Fig. 6(b)) used for detection- this configuration is comparable to prior works such as DreamOOD and BOOD. Finally, Row (5) shows the complete GOOD framework, where both synthesis and detection jointly leverage image- and feature-level signals through the unified OOD score. As shown in Table removing either guidance mechanism significantly degrades performance (FPR95 rises from 17.70 over 32). although each still surpasses the baseline ID classifier. Com-
Table 3: Ablation Study of the Key Components.
Method
FPR9S1
AUROCT
ID Accf
bining both guidance types improves detection by complementing pixel-level and feature-level
ID Classifier
48.68
89.46
87.64
(2)
wlo GOOD feat
32.23
92.29
86.98
cues, and balanced sampling further stabilizes per-
w/o GOOD img
32.93
91.98
87.24
(4) Balanced Sampling
30.82
92.81
87.16
formance. The unified OOD score provides the
(5) Unified OOD Score
17.70
96.28
87.16
largest iniin-ntegrattng both signals yields the highest AUROC (96.28) and the lowest FPR95 (17.70).
Ablation on the regularization weight A. As shown in Figure 6 (a), increasing À enhances OOD detection performance, but also leads to a gradual decline in ID accuracy due to stronger regularization. choose À 2.5, which
To balance this trade-off between OOD sensitivity and ID classification, achieves a solid AUROC of 96.28 while maintaining a competitive ID accuracy of 87.16.
The coefficients of Unified OOD Score. Figure 6 (b) illustrates the impact of the interpolation coefficient w Figure 6(b), which balances image-level and fcature-level OOD scores. Adjusting allows to modulate the influence of each component. Our results demonstrate that adaptively setting w based on the KL divergence between the test and ID distributions significantly improves the robustness of GOOD across diverse OOD scenarios.
Ablation on k in calculating k-NN distance. We examine the impact of the number of nearest neighbors l used in feature-level OOD scoring. As shown in Figure 6 (c), varying lo from 50 to 500 minimal effect on OOD detection performance, with AUROC remaining consistently around 96.2. We further analyze the influence of k on the sampling results of GOOD feat- For each k we generate 3,500 OOD samples using our balanced step-size strategy. The resulting energy distributions are highly similar, indicating that the choice of has limited impact under our sampling scheme.

---

Conclusion
In this paper, we propose GOOD, a training-free framework that leverages off-the-shelf classifiers to guide diffusion models for synthesizing informative and diverse out-of-distribttion (OOD) samples. By introducing dual-level guidance image-level based on pixel-space likelihood and feature-level derived from latent-space Pearsity-GoOl avoids the instability of embedding perturbations and enables controllable sampling toward low-density, semantically meaningful OOD regions. We further propose unified OOD score that integrates both types of guidance for robust detection. Extensive experiments demonstrate that GOOD significantly improves OOD detection performance across standard benchmarks. Beyond methodological gains, our work underscores a broader insight: generative models, when steered by discriminative knowledge, offer a powerful and scalable avenue for enhancing model reliability under distributional shift.
Limitations and Future Work. GOOD relies on the distribution learned by pre-trained diffusion models, which may limit the diversity of generated outliers. Future work will explore deeper integration of diffusion features with OOD objectives, enabling joint guidance in both pixel and feature spaces for more targeted and controllable outlier synthesis.
Acknowledgement
This work was supported in part by the National Natural Science Foundation of China under Grant No. 62502200, the Jiangsu Provincial Science and Technology Major Project under Grant No. BG2024042, and the Natural Science Foundation of Jiangsu Province under Grant No. BK2025 1203. It was also supported by the Ministry of Education, Singapore, under its MOE AcRF Tier 2 programs (MOE-T2EP20221-00 1-0002 and MOE-T26P20222-00022) Additional support was provided by the Nanjing Kumpeng & Ascend Center of Cultivation.
References
[1] Momin Abbas, Munceza Azmat, Raya Horesh, and Mikhail Yurochkin. detection using synthetic data generation. In International Conference on Learning Representa- tions, 2025.
[2] Momin Abbas, Ali Falahati, Hossein Goli, and Mohammad Mohammadi Amiri. median perspective on unlabeled data for out-of-distribution detection. arXiv preprint arXiv:2510.06505. 2025.
[3] Faruk Ahmed and Aaron Courville. Detecting semantic anomalies. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 3154-3162, 2020.
[4] Arpit Bansal, Hong-Min Min Chu, Avi Schwarzschild, Soumyadip Sengupta, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Universal guidance for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 843-852, 2023.
[5] Sima Behpour, Thang Long Doan, Xin Li, Wenbin He, Liang Gou, and Liu Ren. Gradorth: A simple yet efficient dut-of-distribution detection with orthogonal projection of gradients. Advances Neural Information Processing Systems, 36:38206 -22220006-,,,, 2023.
[6] Francisco Caetano, Christiaan Viviers, Luis A Zavala-Mondrage Peter HN de With, and Fons van der Sommen. Discopatch: Batch statistics are all you need for ood detection, but only if you can trust them. arXiv preprint urXiv:2501.0800 2025.
[7] Jiankang Chen, Ling Deng, Zhiyong Gan, Wei-Shi Zheng, and Ruixuan Wang. Fodfom: Fake outlier data by foundation models creates stronger visual diitt--distriuttion detector. In Proceedings of the 32nd ACM International Conference Multimedia, pages 1981-1990, 2024.
[8] Hyungjin Chung and Jong Chul Ye. Score-based diffusion models for accelerated mri. Medical image analysis, 10:492479 2022.
10

---

[9] Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed. and Andrea Vedaldi. Describing textures in the wild. In Proceedings the IEEE conference on computer vision and paltern recognition, pages 3606-3613, 2014.
[10] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. Iece, 2009.
[11] Terrance DeVries and Graham W Taylor. Learning confidence for out-of-distribtiion detection in neural networks. arXiv preprint arXiv: 1e111800204855. 2018.
[12] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances neural information processing systems, 34:8780-878 2021.
[13] Lars Doorenbos, Raphael Sznitman, and Pablo Márquez-Neila, Non-linear outlier synthesis for out-of-distriuution detection. arXiv preprint arXiv:2411.13619 2024.
[14] Xuefeng Du, Zhen Fang, Ilias Diakonikolas, and Yixuan Li. How does unlabeled data provably help disttrriiitiiit detection? In The Twelfth International Conference on Learning Representations.
[15] Xuefeng Du, Yiyou Sun, Jerry Zhu, and Yixuan Li. Dream the impossible: Outlier imagination with diffusion models. Advances in Neural Information Processing Systems, 10900, 2023.
[16] Xuefeng Du, Zhaoning Wang. Mu Cai, and Yixuan Li. Vos: Learning what you don't 't know by virtual outlier synthesis. In International Conference on Leurning Representations, 2022.
[17] Bradley Efron. Tweedie's s formula and selection bias. Journal of the American Statistical Association, 106(496):10021666) 2011.
[18] Xin Gao and Jian Pu. Deep incomplete multi-view learning via cyclic permutation of vaes. In The Thirteenth International Conference on Learning Representations, 2025.
[19] Will Grathwohl, Cuan-Chieh Wang. Norouzi, and Kevin Swersky. Your classifier is secretly an energy based model and you should treat it like one. arXiv preprint arXiv: /9t::/9/2.000 2.03263, 2019.
Jacobsen, David Duvenaud, Mohammad
[20] Jiasheng Guo, Xin Gao, Yuxiang Yan, Guanghao Li, and Jian Pu. Dark-isp: Enhancing raw image processing for low-light object detection. IEEE International Conference on Computer Vision, 2025.
[21] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and paltern recognition, pages 770-778, 2016.
[22] Yutong He, Naoki Murata, Chieh-Hsin Lai, Yuhta Takida, Toshimitsu Uesaka, Dongjun Kim, Wei-Hsiang Liao, Yuki Mitsufuji, Zico Kolter, Ruslan Salakhutdinov, et al. Manifold preserv- ing guided diffusion. In The Twelfth International Conference on Learning Representations, 2024.
[23] Dan Hendrycks, Steven Basart, Mantas Mazeika, Andy Zou, Joseph Kwon, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-tf-distribution detection for real- world settings. In International Conference on Machine Learning, pages 7759-8773 PMLR, 2022.
[24] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and -iitr---iitriittion examples in neural networks. arXiv preprint 1601v:1610 2016.
[25] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. International Conference on Learning Representations, 2017.
[26] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arxiv preprint 1r1.v:1882..06000 2018.

---

[27] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
[28] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NeurlPS 2021 Workshop on Deep Generative Models and Downstream Applications, 2021.
[29] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv:2207. /2598, 2022.
arXiv preprint
[30] Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out- of-distribution image without learning from out-of-distribution data. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10951-10960, 2020.
[31] Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. Advances in Neural Information Processing Systems, 34:677- 689, 2021.
[32] Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 871 8710-8719, 2021.
[33] Julian Katz-Samuels, Julia B Nakhleh, Robert Nowak, and Yixuan Li. Training ood detectors in their natural habitats. In International Conference on Machine Learning, pages 10848-10865. PMLR, 2022.
[34] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[35] Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzato, Fujie Huang, et al. A tutorial on energy-based learning. Predicting structured data, 1(0), 2006.
[36] Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence--alibraaee classifiers 2017.
for detecting out-of-dinn of-distribution samples. arXiv preprint
[37] Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrate classi- fiers for detecting out-of- distrriibbbuonn samples. In 6th International Conference on Learning Representations, ICLR 2018, 2018.
[38] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting diitr---istribttion samples and adversarial attacks. Advances in neural information processing systems, 31, 2018.
[39] Guanghao Li, Yu Cao. Qi Chen, Xin Gao, Yifan Yang, and Jian Pu. Papl-slam: Principal axis-anchored monocular point-line slam. IEEE Robotics and Automation Letters, 2025.
[40] Guanghao Li, Qi Chen, Sijia Hu, Yuxiang Yan, and Jian Pu. Constrained gaussian splatting via implicit tsdf hash grid for dense rgb-d slam. IEEE Transactions on Artificial Intelligence, 2025.
[41] Guanghao Li, Qi Chen, Yuxiang Yan, and Jian Pu. Ec-slam: Effectively constrained neural rgb-d slam with tsdf hash encoding and joint optimization. Pattern Recognition, page 110044 2025.
[42] Guanghao Li, Kerui Ren, Linning Xu, Zhewen Zheng, Changjian Jiang, Xin Gao, Bo Dai, Jian Pu, Mulin Yu, and Jiangmiao Pang. Artdeco: Towards efficient and high-fidelity on-the-fly 3d reconstruction with structured scene representation. arXiv preprint arXiv:2510.08551, 2025.
[43] Shiyu Liang, Yixuan Li, and R Srikant. Enhancing the reliability of out-of-distributioo image detection in neural networks. In International Conference on Learning Representations, 2018.
[44] Qilin Liao, Shuo Yang, Bo Zhao, Ping Luo, and Hengshuang Zhao. Bood: Boundary-based out-of-distribution data generation. 2025.
12

---

[45] Jiyao Liu, Shangqi Gao, Yuxin Li, Lihao Liu, Xin Gao, Zhaohu Xing, Junzhi Ning, Yanzhou Su, Siao-Yong Zhang, Junjun He, al. Multi-modal mri translation via evidential regression and distribution calibration. In International Conference on Medical Image Computing and Computer-ssisted Intervention, pages 363-373. Springer, 2025.
[46] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. Advances neural information processing systems, 33:21464-21475. 2020.
[47] Xixi Liu, Yaroslava Lochman, and Christopher Zach. Gen: Pushing the limits of softmax-based out-of-distributtin detection. In Proceedings of the IEEE/CVF conference computer vision 2023.
and pattern recognition, pages
[48] Yifei Ming, Ying Fan, and Yixuan Li. Poem: Out-of-distribune detection with posterior sampling. In International Conference on Machine Learning, pages 16650-16665, PMLR, 2022.
[49] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, page 4. Granada, 2011.
[50] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 427-436, 2015.
[51] Jie Ren, Stanislav Fort, Jeremiah Liu, Abhijit Guha Roy, Shreyas Padhy, and Balaji Laksh- minarayanan. simple fix mahalanobis distance for improving near-ood detection. arXiv preprint (rXiv22106.0902) 2021.
[52] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and patlern recognition, pages 10684-10695, 2022.
[53] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models, 2021.
[54] Chandramouli Shama Sastry and Sageev Oore. Detecting out-of-distribution examples with gram matrices. In International Conference on Machine Learning, pages 8491-8501. PMLR, 2020.
[55] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020.
[56] Jiaming Song, Qinsheng Zhang, Hongxu Yin, Morteza Mardani, Ming- Yu Liu, Jan Kautz, Yongxin Chen, and Arash Vahdat. Loss-guided diffusion models for plug-and-play controllable generation. In International Conference on Machine Learning, pages 12488-32499 PMLR, 2023.
[57] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
[58] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2020.
[59] Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of ditoo--dittibution detection with rectified activations. Advances in neural information processing systems, 34:144-157, 157, 2021.
[60] Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-distribution detection. In European conference on computer vision, pages 691-708. Springer, 2022.
[61] Yiyou Sun, Yifei Ming. Xiaojin Zhu, and Yixuan Li. Out-of-distribuuie detection with deep nearest neighbors. International Conference on Machine Learning, pages 20827-20840. PMLR, 2022.
13

---

[62] Leitian Tao, Xuefeng Du, Jerry Zhu, and Yixuan Li. Non- non-maraittric outlier synthesis. In The Eleventh International Conference on Learning Representations, 2023.
[63] Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9769-8778, 2018.
[64] Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: cutrrf-distributtin with virtual-logit matching. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4921-4930, 2022.
[65] Jim Winkens, Rudy Bunel, Abhijit Guha Roy, Robert Stanforth, Vivek Natarajan, Joseph R Led- sam, Patricia MacWilliams, Pushmeet Kohli, Alan Karthikesalingam, Simon Kohl, et al. Con- trastive training for improved dittr---istribution detection. arXiv preprint arXiv:2007.05560 2020.
[66] Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In 2010 IEEE computer society conference on computer vision and pattern recognition, pages 3485-3492. IEEE, 2010.
[67] Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint 150..0004..555 2015.
[68] Yuxiang Yan, Boda Liu, Jianfei Ai, Qinbu Li, Ru Wan, and Jian Pu. Pointssc: A cooperative vehicle-infrastructure point cloud benchmark for semantic scene completion. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pages 17027-17034. IEEE, 2024.
[69] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized -is-of-iittribution detection: survey. International Journal of Computer Vision, 132(12):5635-566 2024.
[70] Haiyun Yao, Zongbo Han, Huazhu Fu, Xi Peng, Qinghua Hu, and Changqing Zhang. Out-of- distribution detection with diversification (provably). In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
[71] Haotian Ye, Haowei Lin, Jiaqi Han, Minkai Xu, Sheng Liu, Yitao Liang, Jianzhu Ma, James Y Zou, and Stefano Ermon. Tfg: Unified training-free guidance for diffusion models. Advances in Neural Information Processing Systems,
2024.
[72] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song. Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scal image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 1506. 03365, 2015.
[73] Jiwen Yu, Yinhuai Wang, Chen Zhao, Bernard Ghanem, and Jian Zhang, Freedom: Training- free energy-guided conditional diffuuson model. Proceedings of the IEEE/CVF International Conference Computer Vision, pages 23174-23184, 2023.
[74] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE transactions on pattern analysis and machine intelligence, 40(6)):452-1466) 2017.
14

---

A
Appendix
A.1 Related Work (Recap and Expansion)
A.1.1
Out-of-distribution (OOD) Detection
OOD robustness also critical for downstream applications [20, 42, 68, 39, 41, 40, 45]. Many early OOD detection methods rely on post-hoe processing of classifier outputs, such logits [24, 23, 43, 47], model features [38, 51, 54, 61]. or gradients [5, 31J. Other approaches directly modify classifier training by employing adjusted loss functions such energy-based objectives [46], confidence-based rejection [11, 30, 37], or auxiliary self-supervised tasks [3, 65]. Recently, Outlier Exposure (OE) has significantly improved performance by leveraging large auxiliary datasets as pseudo-OOD samples, shaping conservative and robust decision boundaries; however, its effectiveness limited by the availability and relevance of external datasets, thus motivating synthesized outlier methods. Approaches like VOS [16] and NPOS [62] generate synthetic outliers in feature space, while Dream-OOD [15] introduces two-stage diffusion-basee method that aligns and perturbs embeddings in Stable Diffusion's 's text-conditional space to produce pixel-level OOD images. Subsequent works such as BOOD [44] and NCIS [13] adopt this framework but employ adversarial perturbations and learned nonlinear invariants, respectively. In contrast, our method eliminates embedding alignment by directly guiding the diffusion sampling trajectory toward OOD regions via gradient-baas based pixel-Ievel adjustments. This single-stage strategy significantly improves efficiency, robustness, and the diversity of synthesized OOD images.
A.1.2 Guided Sampling with Diffusion Models
Generative approaches such as variational autoencoders (VAEs) and diffusion models have become fundamental tools for probabilistic data modeling [27, 18]. Diffusion models generate samples through iterative denoising, effectively estimating data gradients [57, 55], and naturally support post- hoc conditioning via optimization signals. Classifier-based guidance [58, 12] uses a noise-conditional classifier to provide gradients during sampling, while classifier-fre guidance (CFG) [28] avoids extra classifiers by interpolating between conditional and unconditional predictions. However, both approaches require task tusk-specific training, which limits scalability. In contrast, training-free free guidance (TFG) guides sampling using differentiable target functions succh as classifiers or loss wiithot additional training. While several TFG methods have been proposed [22, 56, 8, 4, 73], most remain task-specific and lack unified theoretical foundations. Recently, Ye al. [71] formalized general TFG framework to unify such strategies. Building on this, our work extends training-frre guidance to OOD samples generation by defining a target function that captures OOD signals via pre-trained classifiers and guiding the diffusion process to synthesize informative outliers.
A.2 Theoretical Analysis
A.2.1 Integration of GOOD into the TFG Framework
The key contribution of the paper "TFG: Unified Training-Fres Guidance for Diffusion Models" " [71] is the proposal of unified and extensible algorithmic framework that enables conditional generation from unconditional diffusion models using off-the-shelf, differentiable target functions [(th-w requiring any retraining. TFG generalizes and unifies several prior training-free sampling methods under a common formalism.
At each denoising step t, the diffusion model estimates the clean signal as:
2t
04 eo (12,
Toje=
Vā,
To guide sampling, TFG applies gradients of a smoothed objective function:
f(x) Eo- [f (a TV بة 5)]
which stabilizes gradients by smoothing the predictor landscape via Gaussian convolution. Guidance is introduced via two complementary strategies:
15

---

Variance guidance, second-order signal, uses gradients with respect to the noisy sample ž;;
A = Pr Vx, log ((
leveraging the covariance between Z2 and 2o to adjust the sampling trajectory.
Mean guidance, first-order signal, applies gradients with respect to the predicted clean sample
Tojei
Niar Mr
Do
zajs log [(roj Ao),
steering samples directly in data space toward higher scoring regions.
Moreover, TFG allows Recurrence- application guidance and denoising-to further refine sampling over Nrecur cycles, improving convergence and robustness to local optima.
This design space is formalized
HIG {(N Niter Y, P,P.P {.P.H)}
which subsumes prior works such as DPS [8], LGD [56], MPGD [22], FreeDoM [73], and UGD [4] special cases, enabling unified theoretical analysis and practical design.
Extension to Our Method. Our method GOOD (Guided OOD sampling) fits naturally into the TFG framework by instantiating its guidance procedure with two novel, task-driven target predictors fx) tailored for cuntof-distributtio sample generation.
Target Predictor: In line with the TFG formulation, we define a differentiable target function fx(x: X R4 (0) that evaluates how well sample aligns with OOD objective conditioned on c. Following the conditional sampling framework:
Po (o(x)
(a c)
Ja po())
we seek to guide diffusion trajectories toward low low-likelhhood, feature sparse regions representing diverse and informative OOD samples.
Inspired by post-hoc OOD scoring methods [24, 23, 43, 47, 61], we propose two concrete instantia- tions of fe(x)):
Image-Ievee Predictor (GOODimg). i: Based on free energy [46] of a pretrained classifier f. we define
Gima (x:) == ezp E
Σ ex)(fx(=)),
which approximates the negative log-likel log-likelihood of x under the classifier's predictive distribution. Its gradient v,,(<;; pushes samples from high-density ID regions low-density OOD regions in pixel space.
Feature-Level Predictor (GOOD To capture structural sparsity, we compute the h-nearest- neighbor distance in the normalized feature space:
((:))()) (
Gleat (z) = Da(æ; f) [|=(2)) 21) 2(x)
where 2*k) is the k-tth nearest feature vector from an in-distribution memory bank. Gradients of this score encourage exploration of semantically novel and underrepresented directions feature space.
These target predictors define complementary guidance signals and are differentiable, enabling their seamless integration into the TFG framework.
Instantiation within TFG. We instantiate GOOD using the following configurations in TFG:
16

---

2P03
Figure Energy distributions of 500 OOD samples generated under each (p. μ configuration on Ima- geNet (5 = 0.1). Each subplot shows the histogram of negative energy scores (i.c., log Σx exp fx())) under fixed pair of variance guidance strength ý (columns) and mean guidance strength j (rows). Higher and ji tend to produce lower-energy (more outlying) samples, while lower values yield samples closer the in-distribution manifold. This grid highlights the tradeoff between sample extremeness and diversity, supporting our use of balanced sampling across parameter combinations.
(a) Implicit Dynamic: Gaussian smoothing is applied to f via
Good(2) (z) Eo- oood + TVI ā,8)
ensure smooth and stable gradient fields; Guidance on the noisy sample dt via second-order signal (c) Mean Guidance: Guidance on the denoised estimate Top via first-order optimization
(b) Variance Guidance:
Vxc log (Zoje:
V "aa log Good(Fojp)
For computational efficiency, we omit recurrence and set Niecu = Nue = 1, since outlier training typically requires generating large number of samples, and iterative guidance would significantly slow down the sampling process.
By plugging our OOD-specifi target predictors into TFG's modular framework, GOOD enables principled, training-free guidance of diffusion sampling toward low-density and classifier-snnsitvee regions. This design allows to generate coundary-adjacent OOD samples that are diverse, semanti- cally aligned, and highly effective for outlier exposure training.
A.2.2 Hyperparameter Selection
The TFG framework introduces a structured design space:
HTFG {(Neeerr Niter Y. P. P.P.P))
where each hyperparameter governs specific guidance behavior. We now detail our choices for each component in the context of OOD sampling, balancing generation quality, diversity, and efficiency.
17

---

Recurrence (Nireur) and Mean Iteration (Nier). Recurrence amplifies the guidance signal by repeating the denoancce-eei---eeeeee to refine the clean estimate Joje. Although these operations can improve sample quality, they are computationally expensive. Since outlier exposure training typically requires synthesizing thousands of OOD samples, we prioritize efficiency and fix both to one step: Nessur = Nierr =1
cycle, while Niier controls the number of inner steps used
Smoothing Strength (7). The Gaussian smoothing in implicit dynamics stabilizes the gradient field of fx) especially in low-density regions, by averaging local variations. We select based on resolution: 0.1 for low-resolution CIFAR and 0.001 for high-resolution ImageNet. These values were determined via a lightweight beam search focused on the energy distribution of generated images.
Variance Guidance Strength (p). The coefficient scales the gradient Va, log (zooje applied in the noisy space. As variance guidance encodes second-order information, is particularly useful during early diffusion steps when is heavily corrupted and carries limited semantic content.
Following the design in the original TFG paper [71], we adopt increasing time-dependent schedule:
Cx
= p
Oxa
where controls the overall strength of variance guidance. This increasing structure has been empirically validated across multiple tasks-including Gaussian deblurring, super-resolution, label guidance, and style transfer transfer-demoneee demonstrating its effectiveness in gradually shifting the focus from low-level pixel aligmment to higher-level structural refinement as the denoising process unfolds.
Mean Guidance Strength (u). Similarly, mean guidance operates on the denoised estimate Zoj and becomes more impactful in later steps, when the sample becomes semantically clearer and closer to the data manifold. We therefore adopt the same increasing schedule:
H4 P
s=1 Ots
This schedule ensures that mean guidance remains weak during early steps, where gradients are noisy, and grows stronger as the sample becomes more refined.
Sampling with Diverse Parameter Combinations Rather than Single Optimal. Instead of search- ing for single optimal (p, ji) pair, we adopt a balanced sampling strategy using fixed grid of param- eter combinations. Specifically, we sample from the Cartesian product p. f (0.1, 0.5. 1.0, 2.0. 5.0). resulting in 25 configurations. Each configuration yields OOD samples with different anomaly intensities and semantic characteristics. Figure 7 visualizes the negative energy distributions of 500 samples per configuration on ImageNet. As p and j increase (from left to right and top to bottom), the generated samples shift toward lower energy regions, indicative of stronger outlier characteristics. Conversely, low guidance strengths produce samples closer to the in-distribution manifold. This tradeoff between semantic plausibility and anomaly severity is crucial: overly strong guidance may yield unrealistic or trivial outliers, while weak guidance may fail to leave the data manifold meaningfully.
By covering the full grid, our approach generates a continuum near-OOD samples spanning subtle to extreme shifts. This diversity enhances outlier exposure training by reducing overfitting to narrow anomaly profile and promoting robustness to real-world distributional shifts.
A.3
Implementation Details and Datasets
A.3.1 Details of Balanced Sampling
To support diverse and robust outlier exposure, we generate a wide spectrum OOD samples using a balanced grid-based strategy described earlier. Specifically, we sample a large number of images across different guidance strengths, covering both image-level and feature-level scores. The sampling setup is consistent across both ImageNet-100 and CIFAR-100.
18

---

Table 4: Comparison of computational stages required by existing outlier exposure methods. Tra- ditional approaches involve either expensive manual collection or mtlti-stage generation pipelines, while GOOD eliminates most stages by directly guiding diffusion sampling.
Method
Manual Data Collection
ID Einhedding Alignment
ODD Emhhading Sampling
0OD Sumple Generation
Training and Detection
WOODS (23)
[14]
Dremm-OOD [15]
FadFoM [?]
NCIS [13)
B0OD [44]
GOOD (Ours)
Image-level guidance (GOOD smg). For image-based guidance, we adopt a full Cartesian product of guidance strengths with p, (0.1, 2.0, 5.0}, resulting 25 unique parameter pairs. For each parameter configuration, we sample 5 images per class across 100 classes, yielding: 25 x 5 x 100 12,500 samples.
Feature-level guidance (GOOD feat). For feature-based guidance, we follow the kNN-based sparsity scoring method proposed in [61]. Unlike energy scores, kNN distances are not nor- malized to [0, 1] due to their small dynamic range; instead,
apply fixed scaling factor of 5 before computing gradients. For simplicity, we set P = fi and choose 7 representative values: {0.2, 0.4, 1.0, 1.5, 3.0, 4.0). For each configuration, we generate 15 images per class, resulting in: 7 x 15 x 100 10,500 samples.
This balanced sampling strategy ensures that our generated OOD dataset covers a rich diversity of anomaly levels raaging from near-distribution hard negatives to semantically abstract out- liers-thereby improving generalization during training and evaluation.
A.3.2 Computational Cost Comparison
Outlier exposure methods generally fall into two categories: data-collection-basee and generation- based. The former, such as WOODS [33] and SAL [14], rely on manually curated external datasets, which are costly to collect and often Nomain-dependee
The latter- incllddin Dream-OOD [15], FodFoM [7], NCIS [13], and BOOD [44] adopt multi-stage generation pipelines that incur substan- tial computational overhead. These generation- approaches typically involve: (1) constructing or aligning latent feature spaces from ID embeddings, (2) synthesizing OOD features within these spaces, (3) decoding them into images using pretrained or fine-tuned generative models (e.g., diffusion or GANs), and (4) training detection model on the resulting samples. As summarized in Table 4, all stages incur non- triviaivial computational and engineering costs.
In particular, Dream-OOD reports total compute time exceeding 16 hours on ImageNet-1000 100, including 8. 8.2h for latent space construction, 10.1h for diffusion- for training. BOOD reports similar costs, with 0.62h for building the latent space, 0.1h for OOD feature synthesis. 7.5h for image generation, and 8.5h for regularized training. NCIS requires up to 13h for ID embedding extraction alone (on 8xA 100 GPUs), plus additional time for training the cVPN projection network.
image generation, and 8.5h
In contrast, our method GOOD simplifies the pipeline by directly guiding the diffusion sampling process with gradients from a pretrained classifier. As shown in the shaded row of Table 4, GOOD bypasses most stages: it does not require latent space construction, embedding alignment, or feature synthesis. The only computational components are the forward/backwwar passes of the classifier during sampling, and the final outlier exposure training. In practice, each 512 x 512 image generated with OOD guidance (based on a 224 x 224 classifier input) takes approximately 5.7 longer than unconditional sampling. However, unlike prior methods that typically require generating over 100,000 OOD samples, our method only needs about one-fifth as many-making the total computational cost comparable or even lower. As a result, the overall computational cost remains manageable. This efficient design supports scalable, high-quality OOD sample generation and enables seamless integration into large-scalc training pipelines without retraining architectural changes.
19

---

42
12
Figure 8: Distributions of OOD detection scores across four OOD datasets (Textures, iNaturalist, Places, and SUN) and three score types: energy-based score (top row), k-nearest neighbor (KNN) distance (middle row), and a unified OOD score (bottom row) that adaptively fuses the two based on KL divergence. Each subplot compares the score distributions for the ID validation set (Imagenet- 100) and the corresponding OOD dataset. All scores are normalized to the range [0, 1].
A.3.3 Distribution Analysis across OOD Datasets
For ImageNet-100, we follow [32] and evaluate OOD detection performance on four standard benchmarks: Textures [9], iNaturalist [63], Places [74], and SUN [66]. For CIFAR-100, we use five
common OOD datasets: SVHN [49], Places365 [74], LSUN-R [72]. ISUN [67], and Textures [9].
To understand how different scoring functions separate ID and OOD samples, Figure 8 presents histograms of normalized detection scores across the four ImageNet- 100 OOD datasets. Each column corresponds different OOD dataset, and each shows different score type: energy based score (top), k-nearest neighbor (KNN) distance in feature space (middle), and our proposed unified score (bottom). We observe that the energy score distributions (top row), which reflect low image likelihood, tend to have broader spread and more overlap with ID validation scores- especialyy for iNaturalist, Places, and SUN. In contrast, the KNN-based feature distance (middle row) produces sharply peaked and better-separated distributions for certain datasets, particularly Textures, indicating that these OOD samples are more distinguishable in feature space than pixel space.
Interestingly, the separability patterns differ by dataset: Textures is clearly more separable via feature distance, while the other three datasets (iNaturalist, Places, and SUN) more distinguishable by energy score. To leverage the strengths of both signals, we compute KL divergence between ID and OOD score distributions for each type and use it adaptively weight the two, producing unified OOD score (bottom row). As shown in the last row of Figure 8, this fused score consistently improves separation across all four datasets by emphasizing the more discriminative signal for each case.
This analysis supports the use of our unified score as a reliable, adaptive OOD detection signal that balances image-space and feature-space cues.
A.4
Additional Results and Case Studies
A.4.1 Additional Results on CIFAR
To verify that our guidance directions reflect semantically meaningful trajectories relative to the classifier, we conduct two controlled experiments on CIFAR datasets, each designed to probe the behavior of GOOD in feature space.
20

---

LONE Viuaa oiter of Supcies Claather CURMirEs CIPAA Dutaret
Goaplig Lik Cleade
OOD
Figure 9: (a) OOD samples from the CIFAR-100 mouse class using Stable Diffusion (512/128) (b) I-SNE plot of samples from a 5-class CIFAR-10 classifier using DDPM: OOD guidance pushes samples toward unseen classes; ID guidance pulls them into known class regions.
1.2
0.6
0=10:pp1.0-9-0.000
p=1_0rpe=000
9m0.000
p=100gp1004p0000
1.--
0-1049=1009f=01
05
0= 0=1044-10+-=00
p=1.0.pe100-p1.00
p=1.01tp=000@@110
0.8-
0.4
Dendty
Denaty
0.6
0.3
0.4-
0.2
0.2
0.1
0.0
0.0
-14
-12
Energy Score Inegatively related log- Healholll
Energy Score (negatively related to log-litalhood)
(al
Figure 10: Energy score distributions of OOD samples generated with different values, under fixed p = j 1.0. Each curve is computed from 500 samples. (a) ImageNet- 100, (b) CIFAR-100.
(a) OOD sample diversity via Stable Diffusion. We first generate OOD samples conditioned the CIFAR-100 class "mouse" using a high-resolution Stable Diffusion model (512/128). Figure (a) showcases diverse range of mouse-related outputs. The samples vary from realistic mice abstract renderings, cartoons, and even symbolic representations- demonstrating how GOOD naturally induces both semantic preservation and controlled abstraction. This supports its ability generate meaningful OOD variants within the scope of a class concept.
(b) Semantic alignment in latent space via t-SNE. Next, we study the semantic effect of guidance using 32x32 DDPM model trained on CIFAR-10. We partition the 10 classes into two halves: five seen classes are used to train classifier, while the other five are held out. Using this setup, we perform three types of sampling: (1) unconditional generation, (2) ID-guided sampling (i.e., maximizing likelihood under the seen-class classifier), and (3) OOD- -oDddddded sampling (i.c., minimizing likelihood under the same classifier).
Figure 9(b) visualizes the resulting samples using t-SNE. Unconditional samples (green) spread across the generative manifold. ID-guided samples (blue) are pulled toward the classifier's 's known class regions, forming tight clusters. contrast, OOD-guided samples (red) are pushed away from the seen-class subspace and drift toward unfamiliar, in-between regions. This contrast highlights that GOOD's guidance directions are indeed semantically aligned: positive guidance avoids known categories, while negative guidance reinforces them.
21

---

A.4.2 Additional Ablation Study
Effect of y in TFG. The hyperparameter Fy controls the strength of Gaussian smoothing in the implicit dynamics of TFG. It determines how much noise added when computing the smoothed target function f(x), which in turn affects the stability and directionality of the guidance signal.
To evaluate its effect, we fix p Jr = 1.0 and vary 7 E (0.001, 0.01, 0.0,,.0), generating 500 OOD samples for each setting. Figure 10 shows the resulting energy score distributions on ImageNet- 100 (left) and CIFAR-100 (right). These scores are inversely related to image likelihood, and are commonly used to characterize the degree of distributional shift.
We observe that small values of T (e.g., 0.001, 0.01) produce sharp, unimodal distributions centered around typical energy range, indicating stable and consistent guidance. As increases, the distribu- tions become flatter or multimodal especiilly on CIFAR- inject noisy less directional gradients, resulting in more diverse but potentially less semantically aligned samples.
that excessive smoothing can
Overall, GOOD exhibits robustness to range of 7 values. However, we find that moderate values (e.g., 0.1 for ImageNet, 0.001 for CIFAR) provide the best trade-off between stability and anomaly diversity. These values are therefore used as default in all main experiments.
A.5 Additional Visualizations
To further illustrate the generative behavior of our approach, we present additional OOD samples produced by GOODang and GOOD on ImageNet- 100. For each of the first 72 classes, we generate one sample per class under each guidance strategy, using fixed parameters.
Figures 11, 13, and 15 show results from GOOD with ý j 5, where guidance is based on low image-level likelihood (free energy). These samples tend exhibit global shift toward abstraction-often distorting not just local texture but also the overall scene composition. In many cases, the image foreground, background, and object boundaries are all rendered with atypical patterns. surreal colors, or unnatural materials. Nonetheless, class semantics such as shape or context remain loosely preserved, resulting globally outlying yet semantically grounded samples.
In contrast, Figures 12, 14, and 16 show results from GOOD with fr = 4, where guidance targets sparsity in the deep feature space. Unlike GOOD this variant preserves the overall image realism and structure but introduces rare or atypical class-specific features- textures, poses, environmental contexts. For example, cats with distorted fur patterns birds in unfamiliar postures. These samples lie closer to the data manifold but remain feature-wise distinctive, resembling "hard negatives" rather than globally abstract outliers.
as uncommon
Together, these visualizations highlight the complementary behavior of the two guidance modes: GOOD ing encourages holistic abstraction, while GOODicat promotes subtle novelty. This duality enables us to generate a diverse spectrum of OOD examples Seamples-ranging from boundary-adjacomm to semantically without retraining, simply by switching the guidance target.
22

---

stirgray
Pan
kite
agama
Quail
humminghird
koale
jellyfish
snail
Lir
cryyish
famingo
kiler whale
Chihuahua
wall
Tabbyy
leopard
lion
tiger
lodybug
fly
ant
Figure 11: OOD samples generated by GOOD ImageNet, guided by low image likelihood (frec energy). One sample per class is shown.
23

---

stirgray
Pan
kite
agama
Quail
humminghird
koals
jellyfish
Anail
craylshh
flaminge
kiler whale
Chiuaaua
wall
tabbyy,
leopard
lion
Uger
lodybug
fly
ant
Figure 12: OOD samples generated by GOOD fear ImageNet, guided by feature-space sparsity (kNN distance). One sample per class is shown.

---

grasshapper
monarch butterlly
starfssh
hare
hamsttr
6ig
impala
mirk
otter
gorilla
giant parda
sturgenn
accordion
aircraft carrier
ambulance
backpack
balloon
bor(o
born
basebal
MII
BON
Figure 13: OOD samples generated by GOOD img ImageNet, guided low image likelihood (frec energy). One sample per class is shown.
25

---

grasshapper
monarch butterlly
starfish
hare
hamster
61g
mink
otter
gorilla
giant ponda
sturgeon
accordion
nircraft carrier
ambulance
backpack
balloon
bor(o
barn
basebal
Figure 14: OOD samples generated by GOOD fear ImageNet, guided by feature-space sparsity (kNN distance). One sample per class is shown.
26

---

basice ball
beacon
Hinder
broom
church
cinema,
cradle
dam
t
MOME
HULDA
deck
dame
drum,
ervelape
Hische- Of
Qquity Cura Ie-tery
forkiit
fountain
hammer
Jean
Je80
knot
laptop
TEL
Figure 15: OOD samples generated by GOOD img ImageNet, guided by low image likelihood (frec energy). One sample per class is shown.
27

---

basicel bal
beacon
Hinder
broom
church
cinema,
cradle
dam
Geck
dame
drum.
ervelape
forklit
fountain
Je30
Jeep
knot
laptop
Figure 16: OOD samples generated by GOOD fear ImageNet, guided by feature-space sparsity (kNN distance). One sample per class is shown.
28

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA]-
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1 (1-2 sentence) justificatin right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include it (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked While "[Yes] " is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providded a proper justification is given (e.g., "error bars expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
the checklist one of the factors in their evaluation.
reported because it would be too computationally
"[No] " or "[NA] is not grounds for rejection. While the questions are phrased acknowledge that the true answer often more nuanced, so please just use your best, judgment and write justification elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly state the paper's contributions, including the dual-level guidance for diffusion- based OOD sample generation and the unified OOD score. These claims are supported by both theoretical motivation and extensive experiments (Sections 1, 3, 4).
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
29

---

Answer: [Yes]
Justification: The paper includes a discussion on limitations in the Conclusion (Section 5), noting the reliance pre-trained diffusion models, which may constrain outlier diversity, and outlines future directions to improve controllability.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: The paper does not include formal theoretical results or proofs; is focused algorithmic methodology and empirical evaluation.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Answer:[Yes
30

---

The paper details all necessary settings for reproduction in Section 4.2, in- cluding datasets, classifier architectures, diffusion models, hyperparameters, and training schedules.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We plan to release code and instructions upon publication to support full reproducibiliity Details for reproducing results are described in Section 4 and the Appendix.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips. wttpcccppppppccctttct....c.cccct htt.///guiidee//eduuuuieeeeeeee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
31

---

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Section 4.2 provides comprehensive experimental details, including dataset splits, training epochs, optimization methods, loss functions, and hyprrparameters.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: While results are averaged across multiple runs (e.g., Table mentions standard deviation), formal statistical significance tests (e.g., t-tests) are not included due to computational cost.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
32

---

Answer: [Yes]
Justification: Section 4.2 mentions the use of Stable Diffusion and ResNet classifiers. and training time (e.g., 50/200 epochs). Specific hardware specs (e.g., GPU types) can be included in the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: / http///eerrp...ee cc/ httpe//ulcc//eeeeeeeeeeeeeeccect Spppulic/ttiicoo Etwheithhicieiie ines?
Answer: [Yes]
Justification: The research follows the NeurlPS Code of Ethics. The method does not involve human subjects or personal data, and the generated content is synthetic.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:[Yes
Potential socictal impacts are discussed implicitly throughout. The method may improve model robustness in safety-critical applications, but generative misuse (e.g.. deepfakes) is general risk of diffusion models.
Justification:
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
33

---

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks. mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (c.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification: The models and datasets used are standard and pose no specific high-risk misuse scenario. No models with high dual-use potential are released.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All datasets and models (e.g., CIFAR-100, ImageNet- 100, Stable Diffusion) used in the paper are publicly available and properly cited with adherence to their respective licenses.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not introduce new datasets or pretrained models. The synthetic data generated is derived from public models and used only for training.
34

---

Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the datasct/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The study does not involve human subjects or crowdsourcing.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: No human subjects are involved, so IRB approval is not required.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
35


Reviews:
[{"review_id": "3KzbGkdhRD", "reviewer": "Reviewer_Gz6x", "summary": "This paper proposes a framework (GOOD) for OOD detection that synthesizes diverse and informative OOD samples by directly guiding the sampling trajectory of diffusion models. GOOD leverages classifiers to provide dual-level guidance: (1) image-level guidance based on input likelihood gradients, and (2) feature-level guidance using k-nearest neighbor distances in latent space. A unified OOD score combining both guidance signals is introduced for robust detection. Experiments on ImageNet-100 and CIFAR-100 demonstrate that training classifiers with GOOD-generated samples significantly improves OOD detection performance, achieving state-of-the-art results in FPR95 and AUROC across multiple datasets.", "questions": "1. It is unclear under which assumption that  the generated OOD sample can be regarded as real OOD samples and is there  any  evidence that the generated samples by the proposed methods are approximating OOD samples in some sense?  Also visually the generated ones are semantically close to Id data, so is there any analysis/insight that what kind of OOD samples can be effectively detected by this method?\n\n2.\tCan the authors provide a comparison of the efficiency of GOOD with other OOD detection methods? A direct evaluation of runtime or resource usage would help clarify the practical cost of the proposed approach.\n\n3.   Can the method be validated on a real-world OOD detection task， for example a medical  image anomaly (rare-disease) application?\n\n4.\tIs it possible to introduce a general strategy for selecting the multiple hyperparameters involved in GOOD? Given the number of tunable hyperparameters, a general guideline would enhance the usability and robustness of the GOOD framework.", "limitations": "My main concerns are outlined in the questions above.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths: \n1.The paper is well-written and clearly structured, with comprehensive figures.\n2.The method introduces a combination of image-level and feature-level guidance for diffusion sampling, for generating OOD samples.\n3.Experiments on benchmark datasets show that GOOD achieves state-of-the-art results.\n\nWeakness: \n\n1.  The method is validated on the toy examples for OOD detection. Can it be validated on any real OOD application scenario? \n\n2. The performance of the synthesized OOD samples depend heavily on the capabilities of the pretrained diffusion model and the classification method. In particular, these models may struggle to generate OOD samples for certain domains. This likely explains its relatively lower performance on the Textures dataset.\n\n3. The method involves several tunable hyperparameters—such as guidance strengths, condition strength, k-NN neighborhood size, and OOD loss weight. While the authors conduct ablation studies to analyze their effects, the overall sensitivity to these hyperparameters remains relatively high and may hinder generalization across tasks without careful tuning.\n\n4. Despite being training-free, GOOD requires diffusion sampling, which is computationally expensive. This may limit its practicality in low-resource settings. It would be helpful if the authors provided a detailed comparison of inference time or computational cost with other OOD detection methods.", "was_revised": true, "final_justification": "Thanks the authors for the efforts on the details response and adding test on real ODD scenario. Although I am not totally convinced by the novelty and the practical value of the proposed method, I raise my score to broadline accept.", "rebuttal": "# Q1 Assumption and insights of Generated OOD Samples\n\n(Question 1)\n\nWe define OOD based on the inherent properties of the model and data:\n1. **Image-level likelihood**—OOD lies in low-density regions under the ID model;\n2. **Feature-level separation**—OOD is distant from ID semantic clusters in the feature space.\n\nThese criteria align with two well-established families of OOD scores—**logits-based** (confidence, energy) and **feature-based** (KNN distance) \\[A, B]. Prior work has also shown that OOD can result from **semantic**, **covariate**, and **domain shifts** \\[C]. Building on these insights, we guide the generator using two differentiable OOD signals, directly reflecting these criteria.\n\nRegarding the statement \"visually the generated samples are semantically close to ID data,\" this is rational, as we aim to generate challenging **near-OOD** samples. Exhaustively synthesizing all real OOD modes is impractical, so instead, we move just beyond the ID boundary to generate near-OOD samples—may be visually similar to ID data but in **low-likelihood, off-manifold** regions. Training the classifier to distinguish ID from these hard samples sharpens the decision boundary, making it more sensitive to unseen real OOD samples.\n\nOn ImageNet (Figures 4 and 8), our distributional analyses confirm the design's effectiveness. Both generated OOD and real OOD samples show clear separation from ID based on likelihood and feature-distance scores, aligning with our goal of sampling just outside the ID boundary. The exception is **Textures**, where the energy score overlaps more with ID, reducing its discriminative power. However, adding feature-level distance restores separation, showing that the combined guidance is robust across OOD types.\n\n\nRef:\n[A] Liu et al. Energy-based out-of-distribution detection. Neurips 2020\n[B] Sun et al. Out-of-distribution detection with deep nearest neighbors. ICML 2022\n[C] Yang et al. Generalized out-of-distribution detection: A survey. IJCV 2024\n\n# Q2 Practical Efficiency and Computational Cost\n\n(Question 2, Weakness 4)\n\nWe provide a detailed **computational cost comparison** in Appendix A.3.2. Existing outlier exposure methods can generally be categorized into two approaches: (1) **data collection-based** and (2) **generation-based**. The former, such as WOODS and SAL, rely on manually curated external datasets, which are costly to collect, often domain-specific, and difficult to scale. The latter, including Dream-OOD, FodFoM, NCIS, and BOOD, use **multi-stage generation pipelines** that involve significant computational and engineering overhead. \n\n| Method          | Manual Data Collection | ID Embedding Alignment | OOD Embedding Sampling | OOD Sample Generation | Training and Detection |\n| --------------- | ---------------------- | ---------------------- | ---------------------- | --------------------- | ---------------------- |\n| WOODS     | ✓                      |                        |                        |                       | ✓                      |\n| SAL        | ✓                      | ✓                      |                        |                       | ✓                      |\n| Dream-OOD |                        | ✓ (8.2 h)              | ✓                      | ✓ (10.1 h)            | ✓ (8.5 h)              |\n| FodFoM     |                        | ✓                      | ✓                      | ✓                     | ✓                      |\n| NCIS       |                        | ✓ (13 h)               |                        | ✓                     | ✓                      |\n| BOOD      |                        | ✓ (0.62 h)             | ✓ (0.1 h)              | ✓ (7.5 h)             | ✓ (8.5 h)              |\n| **GOOD (Ours)** |                        |                        |                        | ✓ (\\~7.8 h)                | ✓ (\\~5.9 h)            |\n\nIn contrast, GOOD simplifies the process by directly guiding diffusion sampling with gradients from a pretrained classifier, skipping latent space construction, embedding alignment, and OOD feature synthesis. It involves just two steps: **sampling and detection**, making the pipeline more efficient. \n\nEven without a pretrained classifier, GOOD remains efficient. For example, we trained a ResNet-34 on ImageNet-100 **from scratch** in **1.7 hours** and used it to guide OOD sampling. The OOD detector was **fine-tuned in 4.2 hours** on the same backbone following a continual learning paradigm.\n\n\n# Q3 Real-World Applicability on Medical images\n\n(Question 3, Weakness 1)\n\nFollowing the reviewer’s suggestion, we evaluate GOOD on a real clinical-style task. We use a **brain MRI tumor dataset** with three classes—**Pituitary**, **Meningioma**, and **Glioma**—and treat **Pituitary + Meningioma** as **ID** (n=1,884). We regard **Glioma** as **OOD‑1** (n=708) and add two additional real OOD sets: **Alzheimer’s brain MRI** (**OOD‑2**, n=1,280) and **intracranial bleeding CT** (**OOD‑3**, n=200). All datasets are publicly available on Kaggle; further details and dataset links will be provided in the Appendix.\n\nWe follow our pipeline and use the publicly available medical diffusion model “Nihirc/Prompt2MedImage.” Using our two guidance signals, we generate **1,000 OOD images per guidance** (total **2,000** images). \n\n|                      | Glioma FPR95$\\downarrow$ | Glioma AUROC$\\uparrow$ | Alzheimer FPR95$\\downarrow$ | Alzheimer AUROC$\\uparrow$ | Bleeding FPR95$\\downarrow$ | Bleeding AUROC$\\uparrow$ | Average FPR95$\\downarrow$ | Average AUROC$\\uparrow$ |\n| -------------------------- | -------------------------------- | ------------------------------ | ----------------------------- | --------------------------- | ---------------------------- | -------------------------- | --------------------------- | ------------------------- |\n| w/o OOD images             | 82.06                            | 63.84                          | 14.06                         | 95.69                       | 77.00                        | 68.75                      | 57.71                       | 76.09                     |\n| + unified score        | 73.31                            | 84.95                          | 0.00                          | 97.70                       | 56.00                        | 87.05                      | 43.10                       | 89.90                     |\n| w/ our OOD images          | 72.18                            | 77.03                          | 0.00                          | 99.02                       | 39.00                        | 84.02                      | 37.06                       | 86.69                     |\n| + unified score (Ours) | **15.96**                        | **96.41**                      | **0.00**                      | **99.28**                   | **25.00**                    | **94.25**                  | **13.65**                   | **96.65**                 |\n\n**Results (Table above):**\n* Using generated OOD images alone improves robustness: avg. FPR95 drops from 57.71 to 37.06, and AUROC increases from 76.09 to 86.69 across three real-OOD datasets.\n* The unified score alone improves performance (baseline → “+ unified score”), but the greatest improvements occur when combined with GOOD-generated OOD images, especially for the challenging near-OOD case, Glioma.\n\nQualitatively, as the OOD guidance strength increases, the generated images show **reduced lesion-like structures from ID classes**, **contrast/intensity redistribution** (resembling **modality or acquisition shifts**), **varying slice orientations**, and at high guidance, occasional off-manifold **artifacts**—all characteristic of OOD. These variations help the classifier learn a **sharper, more transferable decision boundary**, which explains its strong generalization to unseen real OOD in medical imaging.\n\n\n# Q4: Hyperparameter Sensitivity and Generalization\n\n(Question 4, Weakness 3)\n\n**GOOD does not require extensive hyperparameter tuning to perform well.** The key hyperparameters are the guidance strengths $\\rho$ and $\\mu$, the KNN distance parameter $k$, the regularization weight $\\lambda$, and the coefficient $a$ for the unified OOD score.\n\nThe most challenging parameters to tune are $\\rho$ and $\\mu$, as they control how much the generated samples deviate from the ID manifold. **Instead of searching for a single optimal setting, we use a balanced sampling strategy across values (e.g., {0.1, 0.5, 1, 2, 5}), as detailed in Section 3.2**. This avoids tedious tuning and helps construct a diverse OOD sample set, improving robustness and coverage.\n\nThe coefficient $a$, which balances energy-based and kNN-based scores, impacts performance depending on OOD dataset separability. While tuning $a$ can boost performance, our method performs well without it, and the unified score is a refinement, not a core dependency.\n\nFor other hyperparameters like $k$ and $\\lambda$, a sensitivity analysis in Section 4.3 and Appendix A.2.2 shows that the method is robust to a wide range of values, with default settings working well across all datasets.\n\n\n# Q5: Challenges with Pretrained Diffusion Models\n\n(Weakness 2)\n\nThank you for your insightful comment. The performance of our approach is indeed influenced by the pretrained diffusion model's capabilities. However, **our framework maximizes the use of existing generative models**, reducing the need for labor-intensive, biased OOD data collection, especially in the specific field. While performance on the Textures dataset is lower, this is mainly due to the limited overlap between the diffusion model’s distribution and the texture data. Nevertheless, GOOD tackles this by using **feature-level guidance during generation** and combining **image and feature cues during testing**. This limitation can be mitigated with more advanced generative models, and **our framework is adaptable to future advancements**."}, {"review_id": "jC3gdWPZJ9", "reviewer": "Reviewer_e319", "summary": "This paper proposes an OOD-detection method for classifiers based on two fundamental signals - the *free energy* or log-sum-exp of a classifier's logits, and proximity to in-distribution data in the model's intermediate embedding spaces. These signals are operationalized in 2 high-level ways:\n1. As guidance terms for the generation of outliers from a pretrained diffusion model and\n2. As individual scores which can be combined into an OOD detection metric.\n\nTo build an OOD detector, the authors first train a model using outlier exposure on samples generated by (1), and then detect samples using the OOD score (2). This combo yields near-uniform outperformance across ID-OOD dataset pairs.", "questions": "You have demonstrated convincingly that both guidance strategies as well as the unified OOD score are necessary for strong performance. However, I don't see much in the way of high-level takeaways from these components. How can your insights here guide the design of future OOD detection algorithms?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- A lot of care is taken to explain the idea through detailed imagery and clear writing.\n- Well-designed experiments and ablation studies.\n- The method is carefully designed and performs well across the board. In my opinion, there is genuine novelty here and it's tough to argue with these results.\n\nWeaknesses\n- Your given likelihood-based motivation needs to be recalibrated a bit for GOOD_img  and the $E$ score. Your comment (L114) that \"the negative log-sum-exp of the logits ... is proportional to the negative log-likelihood of the input\" is not true - one needs to train a discriminative model in a very specific way for this proportionality to hold (e.g. as in [A]). (The NeurIPS 2020 edition of your citation [34] makes this claim erroneously, and its April 2021 arXiv update has been revised to remove this claim.) Your argument that this term somehow represents likelihood is thus dubious.\n- This paper is something of a bag of tricks and isn't firmly grounded on generalizable insights for OOD detection. Performance here is very good but the ideas in this work might have a short half-life. More extensive exposition in the intro, experiments, and conclusion about the big picture ideas driving your work, e.g. about why both \"image-level\" and \"feature-level\" signal is necessary for good OOD detection, should help here.\n\nOnce these weaknesses are adequately addressed, I'll raise my score.\n\n[A] Grathwohl, Will, et al. \"Your classifier is secretly an energy based model and you should treat it like one.\" _International Conference on Learning Representations_.", "was_revised": true, "final_justification": "All of my concerns were addressed throughout the rebuttal period. It's a good paper containing novel ideas and strong performance across baselines.", "rebuttal": "# Q1 Validity of the correlation between Free Energy and Likelihood\n\n(Weakness 1)\n\nWe would like to clarify the potential misunderstanding. Our use of the **free energy** term $E(x ; f)=-\\log \\sum_i e^{f_i(x)}$ is not intended as a direct representation of likelihood, but rather as a scoring function to differentiate between ID and OOD samples. It has a well-established relationship with the log-likelihood $\\log p(x)$, which is supported by a solid theoretical foundation, as shown in [A], [B] (LeCun et al., 2006), and the ICLR paper referenced by the reviewer [C].\n\nIn [B], the foundation of energy learning is established, demonstrating that any probability density $p(\\mathbf{x})$ for $\\mathbf{x} \\in \\mathbb{R}^D$ can be expressed as:(also Eq. (2) in [C]) $$\np_\\theta(\\mathbf{x})=\\frac{\\exp \\left(-E_\\theta(\\mathbf{x})\\right)}{Z(\\theta)}\n$$where $E_\\theta(\\mathbf{x})$ is the energy function (not to be confused with free energy). The JEM framework [C] reinterprets a classifier as a joint energy-based model over $(x, y)$. Begin with a classifier (Eq(4) in their paper) : $$ p_\\theta(y \\mid \\mathbf{x})=\\frac{\\exp \\left(f_\\theta(\\mathbf{x})[y]\\right)}{\\sum_{y^{\\prime}} \\exp \\left(f_\\theta(\\mathbf{x})\\left[y^{\\prime}\\right]\\right)} $$where $f_\\theta(\\mathbf{x})[y]$ denotes the $y^{\\text {th }}$ index of $f_\\theta(\\mathbf{x})$, i.e., the logit corresponding to the $y^{\\text {th }}$ class label. A key observation in their work is that the logits from $f_\\theta$ can be reinterpreted to define $p(\\mathbf{x}, y)$ and $p(\\mathbf{x})$ as well. Without altering $f_\\theta$, one can reuse these logits to define an energy-based model of the joint distribution of $\\mathbf{x}$ and $y$ as in (Eq(5) in their paper, following Eq. (2)):$$ p_\\theta(\\mathbf{x}, y)=\\frac{\\exp \\left(f_\\theta(\\mathbf{x})[y]\\right)}{Z(\\theta)} $$where $Z(\\theta)$ is the normalizing constant and $E_\\theta(\\mathbf{x}, y)=-f_\\theta(\\mathbf{x})[y]$. \n\nBy marginalizing out $y$, we arrive at an unnormalized density model for $\\mathbf{x}$ as described in (Eq(6) in their paper):$$ p_\\theta(\\mathbf{x})=\\sum_y p_\\theta(\\mathbf{x}, y)=\\frac{\\sum_y \\exp \\left(f_\\theta(\\mathbf{x})[y]\\right)}{Z(\\theta)} . $$This allows us to conclude that $p_\\theta(\\mathbf{x}) \\propto \\sum_y \\exp \\left(f_\\theta(\\mathbf{x})[y]\\right)$, establishing a clear connection between energy functions and probability densities. While the link between energy and likelihood may seem indirect, in practice, the energy score is still **proportional to the negative log-likelihood**, a relationship that is well-supported by existing literature. Additionally, [C] aims to optimize the joint distribution $\\log p(x,y)=\\log p(x)+\\log (y|x)$ to obtain both a generative model and a discriminative model. Their statement, \"... optimize $\\log p(x)$ using Equation (2) with SGLD, where gradients are taken with respect to $LogSumExp_{y}(f_{\\theta}(x)[y])$...\", further reinforces the strong connection between likelihood and energy, aligning with the gradient-based intuition presented in our paper.\n\nIn contrast, in [A] and our paper, we directly use the (negative) log-sum-exp of the logits—$E(x;f) = -\\log \\sum_i e^{f_i(x)}$. This term can be derived from a purely discriminative classifier for OOD detection, without the need to learn a normalized density model. This approach avoids the challenging partition-function normalization that is typical in generative energy-based models. The energy score for OOD detection is theoretically aligned with the input's probability density—samples with higher energies correspond to data points with a lower likelihood of occurrence [A, page 2, lines 1-2]. This can be rigorously proven by [B] (Page 14-15), where the theoretical basis for bridging classifiers and energy models is laid out. Specifically, the discriminative model trained with negative log-likelihood (NLL) loss will reduce the energy for in-distribution data points.\n\nWe appreciate your attention to these details and your careful review of the relevant literature. To ensure full clarity, we will include a more detailed explanation and formal derivation of these principles in the appendix.\n\n**References:**\n\n[A] Liu, Weitang, et al. \"Energy-based out-of-distribution detection.\" *Advances in Neural Information Processing Systems*, 33 (2020): 21464-21475.  \n\n[B] LeCun, Yann, et al. \"A tutorial on energy-based learning.\" *Predicting Structured Data*, 1.0 (2006).  \n\n[C] Grathwohl, Will, et al. \"Your classifier is secretly an energy based model and you should treat it like one.\" *International Conference on Learning Representations*, 2020.\n\n\n# Q2 Generalizable Insights for Future OOD Detection Algorithms\n\n(Weakness 2)\n\nOur contribution goes beyond simply combining image-level and feature-level signals for OOD detection. The **core innovation** of our work is using these two complementary signals—not only as detection cues but as **proxies for defining general OOD behavior** and, importantly, as **gradient-based guidance signals for steering generation**.\n\nThis approach enables us to **bridge discriminative and generative paradigms in a training-free manner**. Specifically, we leverage the gradients of both signals from a pretrained discriminative classifier to guide the sampling trajectory of a diffusion model, **expanding the generation boundary beyond the ID manifold**. The image-level signal captures how likely a sample is under the ID distribution, while the feature-level signal indicates how far a sample is from semantic clusters in the feature space. These gradients pull the diffusion model toward **low-density, semantically off-manifold regions**, allowing us to generate **challenging and realistic near-OOD samples** without requiring latent space alignment or adversarial optimization.\n\nOur method treats these signals **as a tightly coupled framework** where:\n1. Both signals jointly guide the generation process,\n2. Balanced sampling ensures diverse OOD samples across varying anomaly strengths,\n3. The same signals are reused during detection through a unified scoring mechanism.\n\nThis unified design ensures that the guidance used during generation aligns directly with the scoring function used during detection, resulting in a **theoretically grounded and robust OOD detection pipeline**.\n\nIn summary, we introduce a **principled, generalizable framework** that integrates discriminative modeling, generative sampling, and dual-signal detection. By unlocking the **generative capability of discriminative classifiers**, our method enables **training-free synthesis of diverse OOD samples**, eliminating the need for retraining, latent projections, or external datasets.\n\nWe sincerely appreciate the reviewer’s focus on the **long-term impact and generalizability** of OOD detection research. We believe our framework offers a **well-motivated, unified approach** that bridges generative and discriminative paradigms, defining and exposing OOD structure with model-native signals. We hope this perspective will inspire future research into safe, robust, and generalizable open-world learning."}, {"review_id": "gfq4QWq4kF", "reviewer": "Reviewer_7K8B", "summary": "This paper proposes a framework, GOOD, for synthesizing outliers for outlier-exposure based OOD detection. It generates OOD samples using text-to-image diffusion through both classifier-based pixel-level guidance and KNN-based feature-level guidance. To improve performance, GOOD uses varying sampling parameters when synthesizing samples, and uses a combination of likelihood- and distance-based OOD score at test time. Experimental results show that GOOD achieves competitive performance compared to existing methods.", "questions": "* For ablation studies in Table 3, it would be helpful to have more clarifications on what configuration each row corresponds to exactly. For (2) and (3), do they include the balanced sampling and unified OOD score components (i.e. everything without image/feature guidance), or are they ID classifier + outlier exposure with image/feature guidance samples? For row (4), is it the full GOOD framework (5) without the unified OOD score (the number seems to correspond to a=0 in Figure 6(b))? \n* GOOD involves two distinct and somewhat orthogonal aspects, outlier synthesis and OOD scoring. This could make it hard to draw direct comparisons with various existing methods by just looking at the final performance: For instance, baselines like DreamOOD focus primarily on outlier synthesis, and default to simple scorings like using the OOD classifier output for OOD detection. Meanwhile, existing works like [1] and [2] have looked into combining multiple metrics for OOD scoring, although in a different setting. Since the paper seems to be motivated from the perspective of outlier synthesis methodology, it would be helpful to see direct comparisons with the baselines by holding the scoring function constant and using different synthesized outliers, to isolate the effect of synthesizing quality.\n\n    * Specifically, what prompted this question is that in Figure 6(b), the major performance gain comes from the combination of energy and distance based OOD score. When a=0 (i.e. only free energy is used), GOOD’s performance seems only marginally better than the baselines. This raises some concerns of how much the proposed synthesis method helps vs. just combining multiple OOD metrics.\n\n[1] Bergamin et al. \"Model-agnostic out-of-distribution detection using combined statistical tests.\" AISTATS 2022.\n\n[2] Park et al. \"Nearest neighbor guidance for out-of-distribution detection.\" ICCV 2023.", "limitations": "Yes the authors have discussed limitations.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n* The proposed method is technically sound. \n* Experimental results show that the proposed method attains strong and consistent performance compared to baselines.\n* Ablation studies are extensive, and analysis and visualizations provide intuitive ways of understanding the proposed method.\n\nWeaknesses:\n* The technical novelty is somewhat limited, where various individual components of the proposed framework are built upon existing techniques. For instance, the outlier synthesis part involves a relatively straightforward application of diffusion guided generation, and the unified OOD score is an ensemble of likelihood and KNN distance, two well-established OOD scoring methods.\n* GOOD involves two orthogonal aspects, outlier synthesis and OOD scoring (the unified score). This could make comparison with some baselines like DreamOOD not immediately straightforward, as they focus primarily on outlier synthesis and default to simple metrics for OOD scoring. It would be helpful to see experiments and analysis with more direct and disentangled comparisons, e.g. by holding the OOD scoring part constant and isolating the effect of the outlier synthesis quality. (More details in Question 2 below.)", "was_revised": true, "final_justification": "Thank the authors for the rebuttal and the additional experiments. It addresses my concerns and therefore I'm raising my score to borderline accept.", "rebuttal": "# Q1 Clarification on the Ablation Study Configurations and Controls\n\n(Question 1)\n\nWe apologize for any lack of clarity in the configuration details of Table 3. Below is a clearer breakdown of each row’s design:\n\n* **Row (2)** and **Row (3)** show **ID classifiers trained with outlier exposure**, where synthetic OOD samples are generated using **one type of guidance**—image-level (Row 2) or feature-level (Row 3). Both configurations use **balanced sampling across varying guidance strengths** to promote diversity in synthesized OOD data. However, these rows **do not include the unified OOD score** and rely solely on the default energy score for detection.\n* **Row (4)** represents the **full GOOD pipeline without the unified OOD score**, where both image-level and feature-level guidance are used during sampling, but the energy score alone is used for detection (matching **a = 0** in Figure 6(b)). This setting mirrors prior methods such as DreamOOD and BOOD.\n* **Row (5)** corresponds to the **full GOOD framework**, where both synthesis and scoring leverage the joint use of image- and feature-level signals for more effective OOD detection.\n\nThe results highlight the complementary benefits of image- and feature-level guidance. Even without the unified OOD score (Rows 2-4), combining these signals outperforms prior state-of-the-art methods. The full GOOD framework (Row 5), where both synthesis and detection are guided by these signals, achieves the highest performance, providing a robust solution for OOD detection.\n\nWe will revise the text and caption of Table 3 in the final version to clearly specify these configurations and avoid ambiguity. We appreciate the reviewer’s attention to detail, which helps improve the clarity of our presentation.\n\n# Q2 Disentangling the Impact of the Unified OOD Score\n\n(Question 2, Weakness 2)\n\nWe appreciate the reviewer’s concern regarding the contributions of outlier synthesis and OOD scoring in our framework.\n\nTo address this, we contacted the authors of DreamOOD and obtained their synthesized OOD samples. Using their code, we retrained the detector and reproduced the results (FPR95: 39.39 vs. 38.76; AUROC: 91.81 vs. 92.02), confirming our reimplementation. We then applied both the **default energy-based score** (used in DreamOOD, NCIS, BOOD, and many OE methods) and **our unified OOD score** for a direct comparison under matched scoring conditions. The results are summarized below:\n\n| Best      | Unified OOD Score | INATURALIST FPR95 | INATURALIST AUROC | PLACES FPR95 | PLACES AUROC | SUN FPR95 | SUN AUROC | TEXTURES FPR95 | TEXTURES AUROC | Average FPR95 | Average AUROC |\n| --------- | ----------------- | ----------------- | ----------------- | ------------ | ------------ | --------- | --------- | -------------- | -------------- | ------------- | ------------- |\n| Dream-OOD | ×                 | 23.86             | 96.12             | 38.49        | 93.26        | 39.86     | 93.07     | 55.34          | 84.81          | 39.39         | 91.81         |\n| GOOD      | ×                 | 18.62             | 95.89             | 26.70        | 94.49        | 20.06     | 95.52     | 57.90          | 85.36          | 30.82         | 92.81         |\n| Dream-OOD | √                 | 18.41             | 96.88             | 36.12        | 93.61        | 35.25     | 93.73     | 15.62          | 95.26          | 26.35         | 94.87         |\n| GOOD      | √                 | **9.34**          | **97.60**         | **24.82**    | **94.82**    | **17.30** | **96.10** | 19.32          | **96.60**      | **17.70**     | **96.28**     |\n\n\nKey takeaways:\n* **Without the unified score**, GOOD still outperforms DreamOOD with only **\\~20%** of its synthesized samples, demonstrating the efficiency of our synthesis approach.\n* The **unified score** significantly boosts performance, especially on datasets like *Textures*, where the energy score struggles due to distribution overlap with the ID set. KNN in feature space improves separability in such cases, while the energy score excels in others, like *iNaturalist* and *SUN*.\n  \nThese results, supported by distribution analysis in Appendix A.3.3, motivate our unified score: different OOD shifts manifest in different spaces, and no single metric captures them all. We found: **Image-level likelihood** (via energy) captures pixel-space density mismatches. **Feature-level sparsity** (via KNN) is sensitive to semantic misalignment in embedding space. **Rather than treating these signals independently, we unify them—both in synthesis (via gradient guidance) and detection (via score fusion)—into a coherent, model-native framework**. This synergy is not just an add-on but **a reflection of our broader view of OOD detection**: that general OOD behavior should be modelled **holistically**, not piecemeal.\n\nWe thank the reviewer for raising this important point and will revise the manuscript to more explicitly highlight this analysis.\n\n# Q3 Novelty of combining Image-Level and Feature-Level Signals\n\n(Question 2, Weakness 1)\n\nOur contribution extends well beyond the simple combination of image-level and feature-level signals for OOD detection. The **core innovation** in our work lies in using these two complementary signals—not just as detection cues, but as **proxies for defining general OOD behavior**, and most importantly, as **gradient-based guidance signals to steer generation**.\n\nThis novel approach enables us to **bridge discriminative and generative paradigms without requiring additional training**. We leverage the gradients of both signals from a pretrained discriminative classifier to guide the sampling trajectory of a diffusion model, **expanding the generation boundary beyond the ID manifold**. The image-level signal informs how likely a sample is under the ID distribution, while the feature-level signal measures how far a sample is from semantic clusters in feature space. Their gradients pull the diffusion model toward **low-density, semantically off-manifold regions**, enabling the synthesis of realistic near-OOD samples without the need for latent space alignment or adversarial optimization.\n\nOur method does not treat these signals independently. Instead, it forms a **coherent, tightly coupled framework** in which:\n1. Both signals jointly guide the generation process,\n2. Balanced sampling over varying anomaly strengths ensures diversity in the synthesized OOD samples, and\n3. The same signals are reused during detection through a unified scoring mechanism.\n\nThis integrated design ensures that the guidance used during generation directly aligns with the scoring function used during detection, resulting in a **theoretically grounded and practically robust OOD detection pipeline**.\n\nIn summary, our work presents a **principled and generalizable framework** that tightly couples discriminative modeling, generative sampling, and dual-signal detection. By leveraging the **guided generative capability of discriminative classifiers**, we enable training-free synthesis of diverse OOD samples—without needing retraining, latent projections, or external datasets.\n\nWe thank the reviewer for emphasizing the **long-term impact and generalizability** of OOD detection research. We believe our framework offers a **well-motivated and unified approach**, bridging generative and discriminative paradigms by utilizing model-native signals to define and expose OOD structure. This perspective has the potential to inspire future research into safe, robust, and generalizable open-world learning."}, {"review_id": "RUDrqtFbnv", "reviewer": "Reviewer_5MHc", "summary": "This paper proposes a novel framework GOOD which harnesses diffusion models to generate OOD images to improve machine learning models' OOD detection performance. During the process of synthesizing images, GOOD combines image-level and feature-level guidances, forcing the diffusion model to sample towards OOD regions. Compared to previous methodologies, GOOD does not involve ID embedding alignment, which reduces computational costs. GOOD also achieve wonderful SOTA performance on ImageNet and CIFAR datasets.", "questions": "1. Could the authors clarify the potential reasons why GOOD shows comparatively worse performance on PLACES365 compared to FodFoM?\n2. Could the authors provide the performance metrics of other OOD detection methods when integrated with the proposed unified OOD score?\n3. Why generating 12500 GOOD<sub>img</sub> while generating 10500 GOOD<sub>feat</sub>? Is there a theoretical basis for this imbalance, and how does the quantity of synthesized OOD images impact overall performance?\n4. I wonder how does the choice of ID classifier affect the performance of OOD detection?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n    1. The paper provides various of high-quality images including framework and insightful visualizations.\n\n    2. The authors include clear hyperparameters analysis and ablation studies, which help to understand the effectiveness of difference sections of the framework deeply. The experimental setup also provides detailed training parameters, making the reproduction easier.\n\n    3. This methodology does not require embedding alignment, reducing computational cost in a novel way. The proposed method demonstrates superior performance compared to existing techniques on the evaluated datasets.\n\n    4. The paper provides an in-depth analysis of OOD datasets, revealing the relationship between the model's performance and the distributions of OOD datasets.\n\nWeaknesses:\n\n    1. While the explanation of the TFG framework is provided in the appendix, its inclusion in the main body of the paper is essential for clarity. A brief mention in Section 3.2 and Algorithm 1 is insufficient, leaving the methodology unclear to the reader.\n\n    2. The framework's reliance on a large number of hyperparameters may complicate the fine-tuning process, potentially hindering its practical application and adoption.\n\n    3. In table 2, the dataset \"PLACES365\" has a typo.", "was_revised": true, "final_justification": "After reading the rebuttal and other reviews, I agree that this paper has many weaknesses and decreases my rating.", "rebuttal": "# Q1 Hyperparameter Sensitivity and Generalization\n\n(Weakness 2)\n\n**We emphasize that GOOD does not require extensive hyperparameter tuning to perform well.** The hyperparameters in our method include the guidance strength $\\rho$ and $\\mu$, the KNN distance parameter $k$, the regularization weight $\\lambda$, and the coefficient $a$ for the unified OOD score.\n\nAmong all hyperparameters, the guidance strengths $\\rho$ and $\\mu$ are the most challenging to tune, as they control how far the generated samples deviate from the ID manifold during diffusion. To address this, **rather than searching for a single optimal configuration, we adopt a balanced sampling strategy across a range of values (e.g., {0.1, 0.5, 1, 2, 5}), as detailed in Section 3.2**. This approach not only avoids tedious hyperparameter tuning, but also enables us to **construct a diverse OOD sample set** that spans multiple levels of anomaly severity—leading to improved robustness and coverage.\n\nThe coefficient $a$ in the unified OOD score, which balances energy-based and kNN-based scores, has a noticeable impact on performance due to varying separability in OOD datasets. While tuning $a$ can improve performance, our method already performs well without it, and the unified score serves as a refinement, not a core dependency.\n\nFor the remaining hyperparameters such as $k$ and $\\lambda$, we conduct a detailed sensitivity analysis in Section 4.3 and Appendix A.2.2. Results show that the method is robust to a wide range of values, and default configurations suffice across all tested datasets. \n\n# Q2 Effect of OOD Sample Size\n\n(Question 3)\n\nThank you for your insightful question regarding the number of **GOOD\\_img** (12,500) and **GOOD\\_feat** (10,500) generated samples. The discrepancy in sample sizes originated from the initial experimental process. Initially, we sampled 500 OOD images for each combination of guidance strengths across both types of guidance. After analyzing the distributions of these samples, we refined the parameter ranges and completed sampling.\n\nFor **GOOD\\_img**, we used 5 guidance strengths $\\in \\{0.1, 0.5, 1, 2, 5\\}$, and for **GOOD\\_feat**, 7 strengths $\\in \\{0.2, 0.4, 1, 1.5, 2, 3, 4\\}$. **This imbalance was unintentional and arose from the exploratory phase, where we initially selected different quantities for each guidance type**. To prevent computational waste, we standardized the sample sizes to approximately 10,000 for both types.\n\nFor consistency and methodological rigor, we now use the same set of guidance strengths {0.1, 0.5, 1, 2, 5} for both **GOOD\\_img** and **GOOD\\_feat**, resulting in equal sample sizes. The results for 20,000 samples (31.13 vs. 30.82 for **GOOD\\_img** and 92.46 vs. 92.81 for **GOOD\\_feat**) demonstrate that the slight difference in sample sizes has a negligible impact on performance. However, we also observed diminishing returns with additional generated samples, underscoring the trade-off between performance improvements and computational cost.\n\nThus, we limited the generated samples to approximately 20,000, significantly reducing computational overhead compared to methods generating 100,000 samples. Our approach, which produces near-OOD samples closely aligned with ID data, ensures robust OOD detection with fewer samples, maintaining both efficiency and performance.\n\n\n\n# Q3 Impact of ID Classifier Choice\n\n(Question 4)\n\nThank you for your insightful question regarding the impact of the ID classifier choice on OOD detection performance.\n\nOur experiments indicate that different backbone architectures exhibit varying OOD detection performances across datasets. For instance, Vision Transformers (ViTs) like ViT-B16 and convolutional networks such as ConvNeXt demonstrate notably better performance on the Textures dataset compared to ResNet34. **This discrepancy can be attributed to architectural differences: ViTs leverage self-attention mechanisms that capture long-range dependencies, while ConvNeXt integrates modern design elements inspired by transformers, enhancing feature extraction capabilities.** \n\nIn contrast, ResNet34, a traditional convolutional neural network, may not capture fine-grained texture details as effectively, leading to relatively lower performance on texture-rich datasets. **We selected ResNet34 as a baseline to ensure a fair comparison with existing methods**, aligning with standard practices in the field. \n\n| Backbone | INATURALIST FPR95$\\downarrow$   | INATURALIST AUROC$\\uparrow$  | PLACES FPR95$\\downarrow$   | PLACES AUROC$\\uparrow$  | SUN FPR95$\\downarrow$   | SUN AUROC$\\uparrow$  | TEXTURES FPR95$\\downarrow$   | TEXTURES AUROC$\\uparrow$  | Average FPR95$\\downarrow$   | Average AUROC$\\uparrow$  |\n|----------|--------------------|-------------------|--------------|--------------|-----------|-----------|----------------|----------------|---------------|---------------|\n| Resnet34 | 18.62              | 95.89             | 26.70        | 94.49        | 20.06     | 95.52     | 57.90          | 85.36          | 30.82         | 92.81         |\n| Vit-b16  | 29.09              | 96.19             | 29.42        | 94.70        | 27.52     | 95.09     | 23.74          | 95.61          | 27.44         | 95.40         |\n| Convnext | 26.44              | 95.38             | 32.04        | 93.92        | 28.65     | 94.91     | 21.84          | 95.34          | 27.24         | 94.89         |\n\n\n\n# Q4 Applying the Unified OOD Score to Other Methods\n\n(Question 2)\n\nWe appreciate the reviewer’s insightful concern regarding the contributions of outlier synthesis and OOD scoring in our framework.\n\nTo address this, we contacted the authors of DreamOOD and obtained their synthesized OOD samples. Using their code, we retrained the detector and reproduced the results (FPR95: 39.39 vs. 38.76; AUROC: 91.81 vs. 92.02), confirming the consistency of our reimplementation. We then compared both the **default energy-based score** (used in DreamOOD, NCIS, BOOD, and other OE methods) and our **unified OOD score** under matched scoring conditions. The results are summarized below:\n\n| Best      | Unified OOD Score | INATURALIST FPR95$\\downarrow$ | INATURALIST AUROC$\\uparrow$  | PLACES FPR95$\\downarrow$ | PLACES AUROC$\\uparrow$  | SUN FPR95$\\downarrow$ | SUN AUROC$\\uparrow$  | TEXTURES FPR95$\\downarrow$ | TEXTURES AUROC$\\uparrow$  | Average FPR95$\\downarrow$ | Average AUROC$\\uparrow$  |\n| --------- | ----------------- | ----------------- | ----------------- | ------------ | ------------ | --------- | --------- | -------------- | -------------- | ------------- | ------------- |\n| Dream-OOD | ×                 | 23.86             | 96.12             | 38.49        | 93.26        | 39.86     | 93.07     | 55.34          | 84.81          | 39.39         | 91.81         |\n| GOOD      | ×                 | 18.62             | 95.89             | 26.70        | 94.49        | 20.06     | 95.52     | 57.90          | 85.36          | 30.82         | 92.81         |\n| Dream-OOD | √                 | 18.41             | 96.88             | 36.12        | 93.61        | 35.25     | 93.73     | 15.62          | 95.26          | 26.35         | 94.87         |\n| GOOD      | √                 | **9.34**          | **97.60**         | **24.82**    | **94.82**    | **17.30** | **96.10** | 19.32          | **96.60**      | **17.70**     | **96.28**     |\n\n\nThese results show that:\n\n* **Without the unified score**, GOOD still outperforms DreamOOD with only **\\~20%** of its synthesized samples, emphasizing the efficiency of our synthesis component.\n* The **unified score** provides a significant boost, especially on challenging datasets like Textures, where energy-based likelihood struggles due to overlap with the ID set. KNN distance improves separability, while on datasets like iNaturalist and SUN, energy-based likelihood is more discriminative.\n\nWhile the unified OOD score can also enhance exsiting methods, in GOOD it is **tightly coupled with the synthesis process**, both driven by the same underlying signals. This coupling enables us to **close the loop between generation and detection**, resulting in a more integrated and generalizable approach to OOD detection.\n\n\n# Q5 Lower Performance on PLACES365 Compared to FodFoM\n\n(Question 1)\n\nThank you for your insightful question regarding the performance difference between GOOD and FodFoM on the PLACES365 dataset.\n\n**PLACES365** is a large-scale, diverse dataset with 365 scene categories, making it a challenging benchmark for OOD detection. **FodFoM** performs particularly well on this dataset due to its use of **BLIP-2 for generating detailed textual descriptions and GroundingDINO for creating background images**. These synthetic outliers closely match the background characteristics of PLACES365, leading to stronger performance. However, FodFoM’s approach is more limited on other datasets, as its focus on background generation and textual descriptions does not capture a wide range of OOD scenarios.\n\nIn contrast, GOOD generates a broader range of OOD samples by leveraging both **image-level variations** and **feature-level sparsity**, leading to more generalized anomalies. This makes GOOD less aligned with PLACES365, resulting in comparatively lower performance on this dataset. However, GOOD offers a more **generalized approach** to OOD detection across various datasets, ensuring robustness in real-world applications.\n\nWe will revise the manuscript to clarify these dataset-specific variations, highlighting FodFoM’s strengths on PLACES365 and GOOD’s broader applicability.\n\n\n# Q6 Clarity of the TFG Framework in the Main Text\n\n(Weakness 1)\n\nWe appreciate the reviewer’s feedback. To enhance clarity, we will revise Section 3.2 to include a more detailed description of the TFG framework, covering its motivation, components, and workflow, in addition to the explanation in Appendix A.1. This will help readers better understand the framework's role without solely relying on the appendix."}]

Author rebuttal:

Meta-review: This paper initially got mixed scores: two borderline rejects, one borderline accept, and one accept. The authors have submitted a rebuttal, and after considering it, all reviewers expressed satisfaction with the responses and updated their scores to borderline acceptance (score 4/5). The AC concurs with the reviewers that this paper has the advantages of strong performance, novel idea, well-written and extensive experiments. Therefore, the AC would like to recommend acceptance to this paper and encourages the authors to incorporate the clarifications and experiments provided in the rebuttal into the final version.
Decision: Accept (poster)