OmniInput: An Evaluation Framework for Deep Learning Models on Internet-Scale Data
Authors: Weitang Liu
Yuelei Li
Ying Wai Li
Zihan Wang
Yi-Zhuang You
Jingbo Shang
Venue: Accepted by TMLR ()

Abstract: Evaluating machine learning models is important yet challenging in many real-world scenarios. Traditional analysis is dataset-driven, that is, models are evaluated on predefined benchmark datasets. However, these datasets can only cover a limited scope, leaving unanticipated inputs untested and weaknesses of the model unrevealed. To overcome this problem, we propose OmniInput, a novel approach to evaluate models comprehensively using an input space (i.e. internet-scale data). Our method entails efficient sampling of the inputs from the model and estimation of its corresponding output distribution, and an innovative way to calculate the model’s precision and recall curve from the output distribution with only modest human annotation effort. In our experiments, we first validate the correctness of OmniInput within a small input space where brute-force enumeration is still possible. We then show that OmniInput can quantitatively evaluate more complex models such as language models (various versions of GPT2, OLMo, and DistilBERT) and computer vision models, and analyze interesting patterns in an input space.

Published in Transactions on Machine Learning Research (08/2025)
Omnilnput: An Evaluation Framework for Deep Learning Models on Internet-Scale Data
Weitang Liu'; Yuelei Li', Ying Wai Li²; Tianle Wang', Zihan Wang', Yi-Zhuang You', Jingbo Shang! UUniversity of California, San Diego, 2 Los Alamos National Laboratory
Reviewed on OpenReview: http:://ppparerrie.eaa./////ooop
Abstract
Evaluating machine learning models important yet challenging in many real-world sce- narios. Traditional analysis is dataset-driven, that is, models are evaluated on predefined benchmark datasets. However, these datasets can only cover a limited scope, leaving unan- ticipated inputs untested and weaknesses of the model unrevealed. To overcome this prob- lem, propose OMNIINPUT, novel approach to evaluate models comprehensively using an imput space (i.e. Internet-scale data). Our method entails efficient sampling of the imputs from the model and estimation of its corresponding output distribution, and an innovative way to calculate the model's prccision and recall curve from the output distribution with only modest human annotation effort. In our experiments, we first validate the correctness of OMNIINPUT within small input space where brute-force enumeration is still possible. quantitatively evaluate more complex models such as
We then show that OMNIINPUT language models (various versions of GPT2, OLMo, and DistilBERT) and computer vision models, and can discover and analyze interesting input patterns in an input space.
1
Introduction
Traditional ways of evaluating machine learning (ML) models mostly rely on the use of a pre-defined dataset (Dosovitskiy et. al.
2021
Tolstikhin et al. 2021 Steiner al. 2021:
Chen et al. 2021
Zhuang al.
2022
He al. 2015; Simonyan & Zisserman 2014
Szegedy et al.] 2015
Huang et al.
2017
Zagoruyko &
Komodakis
2016 Liu al.,
2020
Hendrycks & Gimpel 2016
Hsu et al.
2020
eee et al.
Liang Rozsa et al. 2016
2017
2018
et al.
2018 Mohseni et al.) 2020 Ren et al. 2019
Cao et al. 2022 Sun & Li 2022
Miyato et al.) 2018 Kurakin et al. 2016 Xie et al. 2019) Madry et al.) 2017p. Depending on how these
datasets are constructed, many of them can only cover a limited scope among all possible inputs. Models lested against pre-defined datasets might generalize poorly to unseen inputs a real-world scenario; hence the weaknesses of the model remain unnoticed. For example, data collected in a lab environment cannot certify the performance of real-world environment which tends to have more out-of-distribution data. This problem becomes more severe large language models (LLMs) have become widely accessible to the public, allowing users to input virtually any type of prompt, potentially causing the models to behave unpredictably. Besides, modern models are believed to perform similarly to humans. We explore an evaluation method that measures if the model predictions and human annotations remain similar regardless the type of data fod into the model. Models with human-level performance should not make simple mistakes that humans would not make. This requires models to be tested, beyond pre-defined datasets, against much more diverse and extensive amount of inputs.
To overcome this issue, we propose evaluating models comprehensively using the datasets drawn from Internet-scale data where annotation of each data point is infeasible. We consider discrete and finite impul space in this work. For example, the input space of a large language model can be all the sequences
"These authors made substantial contributions this work.

---

Published in Transactions on Machine Learning Research (08/2025)
of possible combinations of tokens given sequence length. Whereas traditional evaluations typically use small-scale dataset whose data points can be labeled by humans and fed to the model to calculate the values of the evaluation metrics, our framework considers a much larger dataset with extensive large-scale data (input space). In this scenario, brute-force enumeration and annotation of each data point in such input spaces is lypically computationally intractable. An alternative approach is to uniformly sample data from the internet and evaluate the model's predictions on those inputs. This uniform sampling strategy is also impractical due to the vast number of potential inputs most of which the models do not predict with high confidence. They tend to assign high confidence to small subset of inputs that they are familiar with, such as those from their training distribution. However, evaluation of the model should be able to demonstrate how the model performs as its confidence changes. Therefore, a more computationally efficient approach is needed to approximate the evaluation results that would be otherwise obtained from a long-time uniform sampling over the input space.
To tackle this challenge of comprehensive model evaluation with very large "dataset" (input space with a large number of data), we propose OMNIINPUT, novel approach to calculate the precision and recall curve of model over input space with modest human annotation effort. The key to estimating the precision and recall when input space enumcration is infeasible lies in the output distribution of the model (Liu et al. 2023). The output distribution is the proportion of inputs corresponding to each output value showing the (relative) difference in the number of inputs for different. outputs (e.g.. 10% of inputs have output values equal to 1, 25% of inputs have output values equal to 2, etc.). Specifically, we first sample the inputs and estimate the output distribution of the model under evaluation. We then calculate the model's precision and recall at different output values using the output distribution and selective annotations, constructing precision-reeall curve over the input space. As shown in Fig. I it consists of four steps:
(a) We employ a well-established sampling and histogram reweighting algorithm (Hukushima & Nemoto, 1996; Swendsen & Wang, 1986) to obtain the output distribution p(z) of a trained model (where a denotes the output value of the model), and efficiently sample the inputs from different output value bins (e.g., waadiii--lo--ikellhoeee
or NLL for language models). In model evaluation, all possible inputs in the input space should be evaluated with equal importance.
(b) We annotate the sampled inputs. Using language models as an example, we rate how likely the inputs are understandable sentences using score from 0 to 1 for language models. This is in contrast to the traditional dataset-driven evaluation setting where the entire testing dataset is annotated beforehand. Annotations of data in our scheme take place after the data are sampled by the model of interest. Because the sampling algorithm reliably selects representatives from all possible inputs given an output value, our limited annotations offer meaningful and relevant insights to the model itself.
(c) We compute the precision for each bin as r(z), then estimate the precision and recall at different threshold values X. When aggregating the precision across different bins, weighted average of r(2) by the output distribution p(z) is required. See Sec. 2.2 for details.
(d) We finally put together the precision-reeall curve for comprchensive evaluation of the model per- formance.
OMNIINPUT enables the comparison of different models beyond pre-defined datasets selected from a limited input space. The resulting procision-recall curve can help decide the limit of the model in roal-world deploy- ment. A model with a high Area Under the Precision-Recall (AUPR) curve in OMNIINPUT is expected to agree closely with human judgment. As OMNIINPUT evaluates the model by having the test data sampled uniformly from the input space, it mitigates potential human biases introduced by the test data collection
process {Luo et al. 2023 Prabhu et al. 2023 Shu et al. 2020 Leclerc et al. 2022).
We first validate the correctness of OMNIINPUT on a model with a small input space where brute-force enumeration is still possible. We then conduct extensive experiments using OMNIINPUT to evaluate different models with a large input space where brute-force enumeration becomes impossible. Specifically, we show
For language models, we the pegppecpyy (or looktiie-ll the output. We do not treat them language generators but language modelers, where good language model should assign higher scores (low perplexity) inputs that humans see as reasonable and fluent, and low scores (high perplexity) inputs that nonsensical unreasonable. For computer vision models in MNIST, logit can be used the output value be sampled from.
2

---

Published in Transactions on Machine Learning Research (08/2025)
(
Rec,
Σr(x)p() Ereeiptn E
precision
Inputs
label
Precy
cat cat
[0.3]
[3,6]
[6.9]
Z
We dog cat
have cat
áz [0,3]
áz (3,6)
dz = (6,9)
aa lamlam lam
cat
have cat
We dog cat
Tlike
(3.6)
llike
car we no
car we no
not buman understan dable imputs
recall
bumatt seness-undesttanndbbele inputs
(a)
(b)
(c)
(d)
Figure An overview of our novel OMNINNPUT framework for language models as an example. (a) Use
efficient sampler to obtain the output distribution p(z) and the sampled inputs for each bin Az; (b)
Annotate the sampled imputs; (c) Calculate the precision and recall at different thresholds À that distinguish different classes. r(z) denotes the precision of the model within the bin of output value z; (d) Construct precision-recall curve.
that OMNIINPUT applies to (large) language models, such as GPT2 (Radford et al. 2019), OLMo Groeneveil et al. 2024), and DistilBERT (Sanh) 2019) for text sentiment classification. We also provide an in-depth analysis computer vision models on the MNIST dataset. All these experiments lead to interesting and sometimes surprising observations. For example, a generalive model with a ResNet architecture correctly learns the patterns of the digit "1," However, its recall is significantly lower than that of a simpler multi- layer perceptron classifier, which instead learns "1" by mercly inverting the foreground and background of the digit "0." This means the metrics defined in this work (precision and recall) are not indicative of which training method or model architecture is better. Instead, they prioritize other aspects (e.g. reasoning ability, aligmment with human intuition, safety, etc) when comparing models. Hence OMNIINPUT, as a proof of concept, paves the way for future research that seeks to better evaluate models by incorporating aspects htr than just accuracy. Our new contributions are:
We propose novel dataset-free framework, OMNIINPUT, evaluate machine learning models by esti- mating the precision-recall curve of the model.
Our novel evaluation paradigm samples the test data from the model's input space, which goes beyond the use of pre-defined datasets. It includes all possible evaluation perspectives and climinates possible human biases introduced by the test data collection process.
OMNIlNPUT leverages the output distribution of a model to carefully select reasonable number of representative samples for humans to annotate. This can reduce human effort in the annotation process, while covering larger and unbiased input space.
We empirically validate the correctness of OMNIINPUT and show that it can evaluate various popular (large) language models and computer vision models, and provide detailed analysis.
2
The Omnilnput Framework
We present the details about sampling the output distribution across the input space, and introduce the OMNIINPUT framework to evaluate model performance by calculating precision and recall in its input space.
2.1 Output Distribution and Sampler
Output Distribution. We denote a trained neural network as f > = where E Dt is the training set, Or C NO, and E R is the output value that the model assigns to input. In the example of Natural Language Processing (NLP), is the NLL which is the log of perplexity. Depending other outputs could be used. Each of the D tokens takes one of the +11 values. The output distribution represents the frequency count of each output z given the (entire) input space Ω = NO, or some other space QM specified by a model M. The output distribution represents the occurrence for each output value statistics, we assume that cach input within Ω occurs equally likely. Therefore, similar to the previous evaluations, each input is equally important for analysis and evaluation in our framework. In practice, the statistics of sampling is saved with histogram
the task,
2. Following the principle of equal a priorí probabilities
3

---

Published in Transactions on Machine Learning Research (08/2025)
(2),, which stores the occurrence of each output value 2:
( = Σ
6(z f(x)),
XE
where 8(-) is 1 if 2 f(x is or 5(-) is 0 otherwisc.
The sampled inputs (also called representative inputs) predicted with similar output values near in a small range [z - -2, x A2) are mapped to the same bin. A is small positive constant chosen empirically. The output distribution p(2) is then obtained by normalizing the histogram, that is,
((=)
p(; = E.H(2)
(1)
Discrete Input Sampling and Text Generation. Markov Chain Monte-Carlo (MCMC) for sampling
discrete imputs from ML models are recently proposed /Grathwohl et al. 2021 Zhang et al. 2022). These
samplers sample from an ML model to yield a target distribution
(x x exp(g(x)/T),
(2)
where g()) is the negative "energy" and T is temperature. The sampler initializes sequence of random tokens (or pixels for image inputs). The sampling proceeds by switching some tokens (or pixels) of the sequence to "denoise", and the goal is to acquire the distribution preferred by large g(x). pr(x) is quantity dependent on temperature T. When T is 1, g(-) becomes the log-probability, a common quantity to be modeled in machine lcarning (LeCun et al. in compuler vision (Goshvadi et al.) 2024 for image generation and natural language processing for text 2022).
2006). px(xx in Equ. 2 is also a widely used target distribution
generation (Kumar et al. 2022 Qin et al.
Samplers. Parallel Tempering (PT) (Hukushima & Nemoto 1996 Swendsen & Wang 1986) and Histogram
Reweighting (HR) (Ferrenberg & Swendsen 1989) is an efficient approach to obtain output distribution. They are compatible and can take ad advantage of the development of MCMC samplers that sample from ML models. PT begins with running multiple Metropolis samplers (Metropolis et al.. 1953) at different temperatures simultancously. The samplers exchange configurations at intervals to accelerate mixing and the thermalization /tw.iiiitiiiio/ooiiiinnnnn /denosinn procedure. Samples are collected by the samplers individually to yield their corresponding target distributions (x)).. HR then reweighs the sampled distributions and combines them to yield the model's output. distribution, which is independent. of T and only dependent on the definition of the model itself. Other samplers that sample the output distribution, such as gradient Wang Landau algorithm Liu et al. (2023), can also be used. However, we adopt PTHR because it is more efficient. As we shall see, we extend the commonly used model evaluation metrics, precision and recall, to an input space. Since precision and recall are summed from high confidence values that correspond to high-quality inputs to low confidence values that correspond to low-quality inputs (low precision), it is not necessary to sample the output distribution for all confident values.
2.2 Calculation of Precision-Recall
OMNIINPUT revolves around the output distribution p(2) to formulate the estimation the precision-recall, when combined with additional information from annotated sampled inputs. The samplers described in the previous step provide us with the output distribution, as well as the sampled inputs. For language model, these sampled inputs are lext sequences with N tokens each. We can then proceed to the annotation of these inputs, and use them to caleulate the precision and recall.
Annotation of Inputs. Our motivation is to quantify how much model's prediction agrees or deviates from humans' perception, hence humans serve as a gold standard for comparison. For each "bin" of the output distribution (recall that each "bin" collects the inputs with a small range of output values [2 - - + Az), a subset of the sampled inputs is selected for annotation and scored by a human. This score ranges from when the sample completely deviates from the annotator's judgment for the target class, 1 when the prediction from the model perfectly agrees with the annotator's judgment (input with "good" prediction).
4

---

Published in Transactions on Machine Learning Research (08/2025)
Following the evaluation, the average score for each bin, termed "precision per bin", r(2), is calculated. It is the proportion of the total evaluation score on the inputs (analogous to true positives) relative to the total number of inputs (analogous to true and false positives) within that bin. The number of bins ranges from 150 to 600, depending on the specific experiments in our study. The mixture interval is a hyperparameter. In our experiments, we simply exchange the configurations every 1000 MC moves.
Precision and Recall (PR) In traditional dataset-based model evaluation, precision and recall are widely used to mcasure the similarity between the model's predictions and ground truths labeled by humans. Humans annotate the imputs based on their understanding of the task they want to achieve. Humans then measure which model's predictions are closer to the ground truth annotations. When the predictions perfectly match the human labels, precision and recall will both be optimal. We further extend the precision and recall framework to the input space of large amounts of data where exhaustive annotation is impossible.
For our experiments on language models, we use the NLL as the output 2 for sampling, because it is the loss of the next-token prediction. A low NLL corresponds to a human-understandable sentence. We define a varying threshold of model confidence À such that the inputs predicted with S À by the model are similar to their training data, i.e., they are regarded by the model as human-underssanddbbl sentences. Thus, the precision given À is defined as
precisiony = Eesi (())(()) EESA((2)
(3)
The numerator is the (rue posilives which estimates the number of "good" predictions and the denominator is the total number of inputs predicted as positives - the sum of true positives and false positives. This denominator can be interpreted as the area under curve (AUC) of the output distribution from the -oo to Chreshold A. A higher precision indicates a higher proportion of the inputs agreeing with annotators' judgments for the given output values. To compute the recall, we need the total number of ground truth inputs that are positives over the entire input space Q. This number is constant, albeit unknown. Hence the recall is proportional to Eesx r(z)p(z):
recallx number of positive inputs x Er(s)p(s). =
(4)
A higher recall indicates that the model makes more predictions that agree with the annotators' (ground truth) judgments. As demonstrated above, the output distribution is a valuable quantity for deriving both precision and unnormalized recall. These metrics can be used to understand the model's mapping by varying the threshold A. To simplify the calculation, when p(z) differs significantly for different 2, precisiony is approximated as r(z") where 2x arg max.2xxX p(z) and recally is approximately proportional to max.)xr(2))(2).
For the binary classifiers, both (very) negative and (very) positive logit values correspond to the (high) confidence predictions for different classes, separated by the logit=0 which corresponds to probability 0.5 when Sigmoid activation is used. In this case, we need to designate one class, and the lower and upper limits of the summation in Equ. and Equ. should be set accordingly.
Subsampling of the input space and generative models. While subsampling the input space seems to be an alternative to OMNIINPUT, it takes a long time to explore the input space thoroughly and find confident samples when the input space contains in-and out-of-distribution (OOD) inputs. To improve efficiency, we propose to reverse the evaluation procedure by first asking the model to find what it believes confidently to be low-confident samples, and humans can annotate the samples selected by the model. The model selects and labels samples much faster than humans do. We show that output distribution is key to estimating precision and recall, the common metrics to evaluate models. Morcover, having a generative model to evaluate another model is an alternative, but we still have to estimate how close this model could generate samples as the original training distribution (huge and finite but not enumerable). Therefore, a large-scale evaluation in an input space for this generative model should go first before using it to test any other models. The generative models trained on internet-scale data are not necessarily able to generate internet-scale data.
2 Another commonly used metric, the Receaver Characteristic (ROC) curve, closely connected PR (see
A Appendix A
5

---

Published in Transactions on Machine Learning Research (08/2025)
2.3 Application: Model Comparison
One application of OMNILNPUT is to compare models by PR calculated based on each model's own sampled inputs, that reflect the distribution and composition of represcntative inputs over different output values. Since the precision and recall in OMNIINPUT are computed by the output distributions of the two models and the sampled distributions are represented as histograms, the histograms need to be normalized that they are comparable. In Entire output distribution Normalization we normalize the histograms by dividing the number of sampled imputs (e.g. area under the histogram) so that the area under the curve becomes "1." In this case, it has to sample all possible output values and thus covers the space containing (N + 1) samples. We leverage the fact that the entire input space contains an identical count of (N + 1) samples for all models under comparison Landau et al. (2004).
However, sampling the entire distribution is not necessary, since the precision and recall curve are summed from high confidence (output) values to low confidence values. We propose Cross-models normalization where we need to sample some histograms of high confidence values to normalize two models' sampled histograms. We first designate an input subspace from the original input space, such as the subspace whose inputs have their corresponding outputs predicted by both models within a certain range of Z = [z_, 24]: X = [x[M, E and Mx E Z}. During sampling for MI, we acquire a sampled unnormalized out distribution pM, (z) and the sampled imputs for each 2. Feeding the sampled inputs from M1 both models, we find a subset of inputs Xs, that are from X, meaning that the predicted outputs 21, 22 Z for both model when 21 = MM and 22 M2 We repeat this process for M2 and acquire |x,, as the number of sampled inputs from M2 but these inputs are predicted by both models in Z. We can therefore get the normalized output distributions as
(M) = HM. (2)
PM, (2)
(6) Both Par, and AM₁ are directly comparable, because X is shared by both of the models. In practice, having Z is also preferable because not all output values are interesting to consider. For example, large NLL mostly corresponds to noisy inputs and they generally have very small precision. An intuitive example of applying this normalizaiton is in Appendix B
5
[X,,l
1M
Representative inputs are comparable. The two models are comparable even though they select dif- ferent representative inputs. We reason with a hypothetical example. Suppose we pre-train two models identify human-understandable sentences. After training, we present them with a vast number of sentences from the internet and ask them to select human-mndersanndalle ones with 99% confidence. Since labeling every sentence is impractical, we rely on models to perform an efficient selection of human-understtandalle sentences, which are then annotated by humans. The models examine the sentences extensively (sampling) and then select a few for humans to annotate: one model selects sentences that simply repeat words, while the other selects a mix of human--ndderstandaale sentences and sentences containing noisy words. Both models are confident they have chosen human-understanddble sentences, but we know they make mistakes.
Despite the differences in representative inputs, we can objectively assess which model identifies more human- understandable sentences, because both models were trained with the same objective and tasked with se- lecting human-undesstandable sentences from the same input space. It is important to recognize that the differences in the sentences each model selects directly reflect their distinct abilities, or beliefs, regarding what constitutes a uumaa--nneestanddable sentence. These differences are precisely what OMNIINPUT aims to compare. OMNIINPUT follows a similar approach, but additionally, it requires degroes of uncertainty to compute precision and rocall, which necessitates the estimation of the output distribution.
3 Omnilnput Experiments on Natural Language Processing
Experimental settings. We first apply OMNILNPUT to a Toy example where emumeration of all inputs is affordable to confirm OMNIINPUT's correctness (Sec. 3.1.. In Sec. 3.2 OMNIINPUT is usod in two pre-trained GPT2 models (Radford et al., 2019) and OLMo models (Groeneveld et al. (024) with sequence length 25. We also apply OMNIINPUT to longer sequences of length 100 in GPT-2 models. The sampling target is
6

---

Published in Transactions on Machine Learning Research (08/2025)
the training loss, the hereiivve-oo--ikkhhhooo (NLL), used for next-token predictions. Finally, we also apply OMNIINPUT to sentiment. classifier.
3.1 Toy example validates accuracy of sampling results
Toy is a simple GPT2 model with 4 attention heads and 6 layers. We train it to generate a sequence of 8 tokens, each token is an integer between 0 to 9. That is, x = {ai, 22 T2,,..,ss) where I2 E {0, ...,,....) 9}. We put constraint to require the sum of the 8 tokens to be divisible by 30: (Ei=1 I2) mod 30 = 0. Therefore, the input space has 10a inputs, which is enumcrable. Our trained model can generate all sequences that satisly the division-by-30 constraint. Fig 2 shows the resulting r(z) and p(z) compared to the ground-Iruth enumeration, which confirms that they are very close to each other. Since r(2) and p(z) are close to the ground truth, the precision and recall estimated through sampling will be close to the ground truth. This provides confidence in extending the approach to more complex applications.
3.2 Omnilnput evaluation on real-world (large) language models
We apply OMNITNPUT to pretrained GPT-2 and OLMo models to eval- uate their performance. Specifi- cally, we test two versions of GPT- 2: GPT-2 medium with 25 to- kens, referred to as GPT2-medium- 25, and GPT-2 small with 25 to- kens, referred to as GP72--mall-25. To examine these models' perfor- mance on longer sequences, we also test them on 100 tokens, denoted as GPT2-mediun-100 and GPT2- small-100, respectively. For larger models, we apply OMNIINPUT to four pretrained OLMo models with 25 tokens, OLMo--B, OLMo-1B, OIMo-7B-SFT, and OTMo-7B-Tnssrue.. We use the default. vocabulary sizes 50,304 for OLMo models and 50,257 for GPT-2 models. We emphasize that a test set is not required, as OMNIINPUT does not rely on predefined dataset for evaluation. Unlike the controlled toy experiments, enumeration neither assumed nor feasible in real-world applications.
0.0
1.00
enumeration r(z) sampled r(z)
-2.5
0.75
-5.0
0.50
cnumeration p(z)
-7.5
0.25
sampled piz)
0,00
2
3
4
5
2
4
5
NLL
NLL
Figure 2: Toy example where enumeration is affordable. The line and bar plots show our sampling results match the ground truth for both output distribution p(z) and precision per bin r(z), respectively.
We sample the inputs for different NLL values. A low NLL indicates that the model strongly believes that the sequence is similar to the training distribution (e.g. human- sentences). However, it was found that sequences with NLL below a certain threshold start to contain repeating words and are difficult to be understood by humans (oolzmaan et al.) 2019). Therefore, we empirically choose an NLL output range and only consider their correspouding inputs when calculating precision and recall (PR). We select the lower bound of the NLJ. value when it associated with at least 30 non-duplicate input sequences; the upper bound is constrained by our available human annotation resources. The valid NLL range varies for different models, so we label the inputs with different NLL ranges in different settings. In the GPT2-small-25 and CPT2-medlium225 experiments, we label the inputs with NLL ranging from 2.0 to 4.0. For G0T2-small-100 and GP'T-medium- 100, we annotate the outputs with NLL ranging from 4.0 to 5.0. For OLMo models, the NLL range for OLMo-1B is 3.2 to 4.1; 3.4 to 4.3 for OLMo-7B, 3.7 to 4.6 for OLMo-7B--nstruuc,, and 3.5 to 4.4 for OLMo-7B-SFT Each bin captures ANLL = 0.1.
Rrecilion-Rocall (PR) Curves and Model Performance. Fig. shows that OMNIINPUT can be applied to produce PR curves for different models and sequence lengths. The PR curves for the two GPT2 models with sequence length 25 demonstrate that these settings generally lead to highly understandable sequences, as indicated by the high precision (see Fig. 3 ())). The results suggest that the two models achieve comparable precision and recall for a sequence length of 25.
We also quantitatively compare the area under the PR curve (AUPR) for the (log-scale) recall (x-axis). A larger AUPR mcans that the model's predictions agree better with human perspective. First we find the common minimum and maximum recall of the two PR curves for GPT2-small-25 and medium 25 respectively, and compute the (linear) interpolation of the precision (y-axis) at each recall. We then
7

---

Published in Transactions on Machine Learning Research (08/2025)
10
10
GPT2-small-10
1.0
OLMo-7B
0.5
02-
dPT-mmcdimm-100
0.5
OLMo-7B 7--sttu-l
Precision
0.6
Procision
0.6
Precision
0.6
02-
G5T2-smal1-25
02-
02-
G112-medium-2
-30
-0
-4)
-30
-705
-000
-520
-550
-500
-450
-000
-270
-240
-210
-160
Recall (log scale)
Recall (log scale)
Recall in log seale
(a) GPT2 with seqien 25.
(b) GPT2 with seqlen 100.
(c) OLMo 7B(-Instruct) with seq len 25.
Figure 3: Precision-Recall (PR) Curves for Different Language Models.
accumulate the area starting from the common minimum recall and compare the proportion of the AUPRs for the two PR curves. The AUPR of GPT2-medium--2 is then divided by the AUPR of GPT2-small-25, As an example, the proportion of the cumulative AUPR ending at log-recall around 2 (largest recall) is 1.015, indicating the predictions of GPT2 2012-mme agree slightly better with human annotations.
For sequence lengths of 100, OMNIINPUT indicates that GPT2-modium-11 outperforms GPT2-small-100 within the selected output range & for the language modeling lask. The PR curves of both GPT2 models for sequence length 100 shows that both models generate sequences that are difficult to understand, because of the low precision (sce Fig. b))) The PR curve for CPT2-medium-le curve for GPT2-small-100. GPT2-medium has a larger AUPR and thus performs better than GPT2-small for sequence length 100, though both of them have low precision in general.
is almost always above the PR
For OLMo models, OMNIINPUT indicates that OLMo-7B-Instruet outperforms OL for sequence lengths of 25 for language modeling task. JLMo-7B-Instruue has a higher precision than OLMo-7B's in similar recall range, integrating the PR curve of OTMoo7B--nstruuc results in higher AUPR compared to that of OLMo-7B (see Fig. 3 (c)). Therefore, the sequences from OLMoo7BB-nstruuc are easier to understand. Because the tokenizers are different, we cannot compare across different models.
Insights from Representative Inputs. An in-depth analysis by scrutinizing the inputs raises some concerns about privacy leaking and hallucination. For example, an input we encountered contains some company names with their addresses. An internet search on these names or addresses seems to not match, suggesting a potential privacy leak. Another example is a sequence of magic keywords "Good morning dear friend, I, and Greetings, ladies and gentlemen". 2-52-small-25 keeps generating email addresses before this sequence. This raises concern of privacy leaking of the models.
For SPT2-small-100, we can sample NLL down to around 2.7 where we find repeating words similar to sentences with NLL smaller than 2 in GPT2-small-25. When NLL gets higher, the repeating phrases are generally more meaningful, such as "pickup truck pickup trailer trailer" or "put clean clothes put. things wash clothes." " Overall, sentences with 100 tokens in the selected NL. range have repeated words and are generally not fluent. More experimental details are in Appendix ! Based on our observations, we speculate that the next-token generation ability of these models, driven by sophisticated next-token generation function, may not fully align with the NLL for an entire sentence.
Language classifier. We fine-tune a DistilBERT (Sanh et al. 2019) model using the SS12 dataset (Socher et al. 2013) and achieve 91% accuracy. We choose the logits as our sampling target, and evaluate this model using OMNIINPUT. OMNIINPUT finds that the language classifier performs poorly, as the precision is 0 for all the recall values. Analysis of the sampled inputs for cach positive logit bin reveals that the model tends to classify primarily based on specific keywords, rather than understanding the grammar and structure of the sentences. More details of experiment settings and results are in Appendix D
Because OMNIINPUT focuses on using PR as the performance metric, it is therefore ablc to discover the weakness of the model, i.e., disagreement with human's understanding of a meaningful sentence. When the input space contains dittr---iitribution (OOD) inputs, it is understandable that the language classifier performs poorly bocause is trained to predict the conditional probability p(class(x) given x are from the training distribution. To handle an open-world setting where OOD's are ubiquitous, the models must also learn to distinguish whether the inputs are from the training distribution.
8

---

Published in Transactions on Machine Learning Research (08/2025)
In summary, our method offers a comprchensive approach to performance assessment. OMNIINPUT is able to capture how well the model's predictions align with human perspective for two reasons: (i) the human annotation process in OMNIINPUT takes place after the sampled inputs are determined. The sampled inputs are dissimilar from the training data and have a better chance to reveal "corner cases" or OOD's. (ii) OMNIINPUT evaluates both the precision and recall of the model, which are not used in the loss function during the training procedure. They therefore provide a completely different perspective from the training loss as performance metrics.
4 Omnilnput Experiments on Computer Vision
We also apply OMNIINPUT to computer vision tasks, demonstrating its versatility across different modalities. In all computer vision experiments, we focus on binary classifiers and energy-based generative models, both of which produce scalar outputs. For classifiers, we consider positive output values (positive logits) logp(y 1|xx, and for energy-based generative models, we consider log log-likelshoods (larger output values).
Experimental settings. We evaluate several backbone models for computer vision: convolution neural network (CNN), multi-layer perceptron network (MLP), and ResNet (He et al. 2015). The details of the model architectures are provided in Appendix E. We extract only the inputs with labels {0. 1) from the MNIST training set to build the classifiers and refer to this reduced training set as MNIST-0/1. We also evaluate generative models for ResNet and MLP. To train these generative modols, we select only the inputs with label=1 as MNIST-1; inputs with labels other than label=1 are considered OOD inputs. We train these models using different training methods: (1) Using the vanilla binary cross-entropy loss, we train classifiers CNN-MNIST-0/1 and MLP-MNIST-0//D which achieve test accuracy of 97.87% and 99.95%, respectively. (2) Using the binary cross-entropy loss and data augmentation by adding uniform noise with varying levels of severity to the input images, we train RES--UGG-MNISSS-0// MLP-AUG- MNIST-0/1, and CNN-AUG-MNIST-O0/ which achieve test accuracy of 99.95%, 99.91%, and 99.33%, respectively. (3) Using energy-based models that learn by generating inputs, we train RES-GEN-MNISS and MLP-GEN-MNIST--P
4.1 Traditional evaluation is not comprehensive
Table 1: Traditional evaluations: AUPR scores on pre-defined test sets with five different types of negative samples (see for details), leading to inconsistent evaluation results for model ranking.
Traditional dataset evaluation depends on the datasets we choose, so it is in- herently not comprehensive. Specif- ically, we use five different test sets for MNIST binary classifiers by fixing the positive test samples the samples in the MNIST test set with label=1, and varying the negative test samples in five different ways: (1) the inputs in the MNIST test set with label=0 (in-dist), and OOD inputs from other datasets: (2) Fashion MNIST (Xiao et al. 2017), (3) Kuzushiji MNIST (Clanuwat et al.] 2018
in-dist
out-of-distribatioo (OOD)
MNIST Fashion Kuzushiji EMNIST QMNIST
Model
label=0 MNIST MNIST
CNN-MNIST-0011
99.81
98.87
93.93
79.42
13.84
RES-GEN-MNIST-1
99.99
100.00
99.99
99.87
16.49
RES-AUG--MNIST44/1
100.00
99.11
93.93
95.10
15.69
MLP-MNIST-0/1
100.00
99.42
92.03
90.68
15.81
(4)
EMNIST [Cohe et al. 2017 with the "byclass" split, and (5) Q-MNIST YYadav & Bottoul 2019
As indicated by the AUPR scores in Table 0 pre-defined test sets like those mentioned above rarely yield consistent model rankings during evaluation. For example,
performs the best on all the
test sets with OOD inputs while only ranked 3 out of 4 on the in-distribution test set. CNN-MNIST-0/1 outperforms MLP- -NIST-O1 on Kuzushiji MNIST, but it typically performs the worst on other test sets. Additional inconsistent results using other evaluation metrics can be found in Appendix F
SRES-MNIST-0L/ is omitted due reported sampling issues in ResNet Liu al. 2023 GENN-GEN-MNISTE cannot learn to generate reasonable images because madel complexity low.
9

---

Published in Transactions on Machine Learning Research (08/2025)
4.2 Omnilnput evaluation
Fig. 4 presents comprehensive precision-recall curve analysis using OMNIINPUT. The results of OMNILNPUT suggest that RES-AUG-MNISTTNN is the best model and MLP-MNIST-0/1 is the second best, both having relatively high recall and precision scores. BES-GEN-MNISTE as generative model, displays a low recall but relatively good procision. Notably, CNN-MNIST-00/1 and CNN-AUG-MNISST-001 cxhibit almost no precision greater than 0, indicating that "hand-written" digits are rare in the represenlative inputs even when the logit value large (see Appendix H..
This suggests that these two models scriously subjected to overconfident prediction problem where the models map the wrong inputs (e.g. noisy inputs) over-confidently as "hand-written" digits. In OMNIINPUT, similar to the AUPR calculated from a dataset, a model with higher pre- cision anticipated to reduce susceptibility to overconfident prodictions. Furthermore, a model with a higher AUPR expected to align more closely with the desired input dis- tribution of the training (testing) set.
RES AUG MINIST 6/1
RES-GEN-MNN
0.8
CNN AUG MNISTOY
CNN-MNIST-OV1
MLP-MNIST-OY1
Preciston
0.6
MLP GEN MNIST
MLP-AUG-MNISS-OO
0.4
We observe the difference in ranking with different datasets in Sec. 4.1. This difference originates from the fact that models understand the training distribution differently. In- stead of taking exams with a small set of images with cor- rect answers, the models in OMNIINPUT are asked select what they believe to be "good" images from large number of images and we humans teachers evaluate their selec- tion. Thus, OMNIINPUT is not directly comparable with the traditional dataset-based evaluations.
0.2
-4000
3000
2000
1100
Unnormalized Recall in log scale
Figure 4: OMNIINPUT evaluation: Precision- Recall curves for various computer vision mod- els. CNN-AUG-MNIST-O// CNN-MNIST- 0/1, and MLP-MNIST-0/ have 0 precision.
Insights from Representative Inputs. An inspection of the representative inputs (Appendix H reveals interesting insights. Firstly, different models exhibit distinct input-output mappings and preferences for specific types of imputs, indicating significant variations in their classification criteria. Specifically,
MLP-MNIST-0/1 and MLP-AUU-MNIST-00/1 likely classify backrround-foregronn inverted digit "0" as "positive" (digit "I").
CNN-MNISTT00 classifies imputs with a black background as positive.
RES-GEN-MNIST- a generative model, demonstrates that it can map digits to large logit values. RES-RES--MMEE AUG-MNIST-0/1, a classifier with data augmentation, demonstrates that adding noise during train- ing help the model better map inputs that look like digit "1" large logit. values.
Moreover, RES-AUG-MNIST-00/ exhibits relatively high recall as the representative inputs generally look like digit "1" with noise in the high logit regime. Conversely, RES-GEN-MNISSS distinct inputs corresponding to the positive class, but with limited diversity in terms of noise variations. These results suggest that generative training methods can improve the alignment between model predictions and human classification criteria, and underscore the need for enhancing recall in generative models. Adding noise to the data during training can also be beneficial.
generates more visually
First, although OMNIINPUT would regard CNN-MNIST-0/1 as "bad" model, the digital "1" still be found in the positive logit range. The low precision indicates the number of these informative digit inputs is so small that the model makes more overconfident predictions where the models map the obviously wrong instances (c.g. noisy images) over-confidently as "hand-written" digits. Having a mixture of poor-quality and high-quality inputs mapped to the same output indicates a flawed model, so further scrutiny the inputs is required due to the uninformative and unreliable nature of the model's predictions. Second, the model does not use reliable features, such as "shapes" of the digits patterns to distinguish inputs. Had this model use shapes to achieve high accuracy, the representative inputs would have more similar patterns instead of unstructured black backgrounds.
Discussion.
10

---

Published in Transactions on Machine Learning Research (08/2025)
We evaluate uninformative samples because ideal model not only maps training distribution samples to high confidence but also maps the non-training distributiin samples to low confidence. Tt. is a common practice in OOD detection to consider a large variety of types of samples, including noisy images and analytical experiments of overconfident OOD prediction on uninformative samples Nguyen et al. (2015) were conducted. The weird failure that the model these noisy samples that reasonable humans do not make indicates an intrinsic difference in how the model classifies differently than humans do.
The representative imputs of MLMM-MMNSSST noise level decreases when the logit increases, indicating how noise affects the model's prediction. OMNIINPUT finds this distribution shift in the representative inputs with regard to model outputs. Importantly, this distribution shift is presented by the model itself through the sampling step in OMNIINPUT, without the need for manual trials and errors to find out the noise distribution (Hendrycks & Dietterich 2019
and MLP-AUG-MNIST--0/ 1 display visual similaritics, but the
Together with the previous PR curve analysis, these findings suggest that different input-output mappings, along with the input distribution, are encoded in the models. This in turn affects the model performance. OMNIINPUT is novel way to gain insights into this, which can inform future research endeavors to focus enhancing both the robustness and visual diversity of the generative models.
Statistics beyond finding OOD inputs. Besides finding the overconfident OOD samples that humans do not recognize as in-distribution inputs, OMNIINPUT can estimate the number of OOD inputs and the number of in-distribution inputs from high (to low) confidence to evaluate models. An optimal model should map a small number of OOD inputs to high-confidence output values. In other words, OMNIINPUT not only finds the individual input as other methods do, such as by adversarial optimization in adversarial attacks but is unique it can find the the number of them for evaluation. This number is crucial as better model can still make mistakes, but the nunber of mistakes is siguificantly fewer than others.
Evaluation Effort, Efficiency, and Hu- man Annotation Ambiguity. We have at least 50 samples per bin for all the models af- ter deleting the duplicates. For a fixed sam- pling cost, the total number of samples is fixed. Hence larger number of bins would result in fewer samples per bin. Evaluating these samples in our OMNINNPUT framework requires less effort than annotating a dataset collected for traditional dalaset-driven evaluation, e.g., 60000 annotations are nceded for the MNIST.
10 samples per bin
0.75
20 samples per bin
30 samples per bin
Precision
40 samples per bin
50 samples per bin
0.25
0.00
1550
-1000
500
(Unnermalized) Recall in log scale
Figure 5: Convergence of OMNIINPUT with respect to the number of annotated samples per bin. We use MLP- MNIST-0/1 as an examplc. There are 40 bins in total; cach bin has at least 50 samples after deleting the duplicates.
In Fig. 5 vary the number of annotated samples per bin in OMNINNPUT from 10 to 50 and plot different precision-recall curves for the MLP-MNNIST-0/1 model. The results indi- cate that the evaluation converges quickly when the number of inputs approaches 40 or 50, empirically demonstrating that OMNIINPUT requires relatively few annotated samples to reach a reliable evaluation.
We observe that models exhibit varying degrees of robustness and visual diversity. To assess the ambiguity in human labeling, we examine the variations in r(z) when three different individuals label the same dataset (Fig. G). Notably, apart from the CNN model, the other models display different levels of labeling ambiguity, i.c., different individuals label the same sample differently. These differences give the confidence intervals in the precision per bin, r(z), and can be understood as the uncertainty of the model predictions.
Human Annotation vs. Model Annotation. In principle, metrics employed in evaluating generative models (Salimans et al. 2016 Heusel et al.) 2017: Nacem et al.) 2020 Sajjadi et al. 2018 Cheema & Urner 2023) could be employed to obtain the r(z) values in our method. However, using a performance--mcertiffee model in the entire input space to get r(2) is inherently unreliable. For example, we examined the Fréchet Inception Distance (FID) (Heusel et al. 2017 commonly used generative model performance metric. We found that the consistency between FID scores and human evaluations varies depending on the models and
11

---

Published in Transactions on Machine Learning Research (08/2025)
1.0
1.0
0.-
0.8
06
0.6
0.4
0.4
0.-
0.2
0.
lagit
logit
legit
(a) REEE-EEENN GEN-MNIST-1
(b) RES-AUGG-MNIST-O/1
(c) CNN-MNISTT-011
(d) MLP-MNIST-00/1
Figure 6: Precision per bin r(z) with confidence intervals for four different models.
datasets. This indicates human supervision is needed when model annotation is used. Experiment details are in Appendix G Currently, model-as-a-juddee Gu et al. 20044) is also widely adopted method in the
community, if errors are tolerable. However, when the errors of model annotation cannot be ignored, human annotation is always the gold standard.
5
Related Works
Performance Characterization has been extensively studied in the literature Haralick 1992
Klette et al.
2000
Thacker et al. 2008 Ramesh et al.) 1997 Bowyer & Phillips 1998 Aghdasi] 1994 Ramesh & Haralick,
1992
1994h. Previous research focused on devising evaluation methods for specific model architectures, such
as simple models (Hammitt & Bartleti 1995) and mathematical morphological operators (Gao et al. 2002;
Kanungo & Haralick, 1990). In our method, models can be a black box where the analytic charactorization
of the input-to-oulput function unknown (Courtney et al.) 1997 Cho et al., 1997), and we place emphasis the output distribution (Greiffenhagen et al.) [001] to derive performance metrics. This approach allows us to evaluate the model's performance without requiring detailed knowledge of its internal workings. There
are recent attempts (Qiu et al. 2020 Lang et al. 2021 Luo et al. 2023 Prabhu et al.] 2023) to evaluate model performance without a pre-defined test set. These works used other generators to generate samples for evaluating the model. On the contrary, we use a sampler to sample from the model to be evaluated. Sampling is transparent with convergence estimates, but other generators are still used as black boxes. Because of the inherently unknown biases in generative models, utilizing these models to evaluate another model carries the risk of yiclding unfair and potentially incorrect conclusions. Our method brings the focus back to the model to be tested, tasking it with generating samples by itself for scrutiny, rather than relying on external agents such as human or other models to come up with testing data. An additional benefit is that this approach offers a novel framework for estimating errors in the predictions when comparing different models.
Samplers MCMC samplers have gained widespread popularity in the machine learning community (Chen ct al. 2014 Welling Tch 2011 Li et al., 2016 Xu et al. 2018). Among these, CSGLD (Deng et al.,
2020 leverages the Wang-Lande algorithm (Wang Landau 2001 to comprehensively explore the energy
landscape. Gibbs- With-Gradients (GWG) (Gratwwhl et al. 2021 extends this approach to discrete domains, while discrete Langevin proposal (DLP) (Zhang et al. 2022) is able to propose global updates. Although these algorithms can in principle be used to sample the output distribution, they either require long time to converge, or are not able to explore the full range of possible output values in our experience. We therefore employ parallel tempering (PT) with histogram reweighting (HR) to recover the full output distribution of the model, while ensuring & manageable time to solution.
Open-world Model Evaluation requires model to perform well for in-distribution test sets (Dosovitskiy
ct al.
2021 Tolstikhin et al.
2021 Steiner et al.) 2021 Chen et al.| 2021 Zhuang ct al. 2022 He ct al. 2015
Simonyan & Zisserman 2014
Szegedy et al. 2015 Huang et al. 2017 Kagoruyko & Komodakis 2016)
OOD
detection Liu et al. [2200] Hendrycks & Gimpel 2016 Hendrycks et al. 2019 Hsu et al.] 2020
Lee et al.
2017
2018
Liang et al. 2018
Mohseni et al. 2020 Ren et al. 2019), generalization (Cao et al.
2022 Sun
& Li
2022
and adversarial attacks (Szegedy et al. 2013: Rozsa et al. 2016 Miyato et al. 2018 Kurakin
et al.
2016
Xie al.] 2019 Madry et al.] (2017). Understanding performance of the model requires the
consideration of an input space that includes all these types of samples.
12

---

Published in Transactions on Machine Learning Research (08/2025)
6 Conclusions and Future Work
We present OMNIINPUT, novel framework for realizing dataset-free, comprehensive evaluations of models using Internet-scale data from the models' own imput spaces. It is based on new way to caleulate the precision and recall by leveraging the output distribution. We show that OMNIINPUT applies to wide range of tasks, ranging from computer vision to natural language processing. Our work demonstrates the importance of sampling from the output distribution by showing how it enables the understanding of the model's input-output mapping. Future work can develop more efficient samplers for output distribution, so we can apply OMNINNPT for evaluating more complex models. Complex models' inference time is longer, so it benefits if more advanced techniques for fast attention calculation are developed. Global updates ZZhang et al. 20222 of inputs will lead to faster sampling convergence. It. is also interesting to explore how to reduce the required amount of human annotation effort in model evaluations, especially when comparing two correlated models. Continuous input sampling is likely doable but some efforts need to be taken. We believe OMNINNPUS opens the gale to many dataset-free evaluations and this is a crucial research direction, especially in this LLM era when the benchmark dataset performance is less reliable for model comparison.
References
Farzin Aghdasi. Digitization and analysis of mammographic images for early detection of breast cancer. PhD thesis, University of British Columbia, 1994.
Kevin Bowyer and P Jonathon Phillips. Empirical evaluation techniques in compuler vision. TEEE Computer Society Press, 1998.
Kaidi Cao, Maria Brbic, and Jure Leskovec. Open-world semi-suprrviee learning. In International Confer- ence on Learning Representations, 2022. URL
Fasil Cheema and Ruth Urner. Precision recall cover: A method for assessing generative models. In Francisco Ruiz, Jennifer Dy, and Jan-Willem van de Meent (eds.), Proceedings of The 26th International Conference on Artificial Intelligence and Statistics, volume 206 of Proceedings of Machine Learning Research, pp. 6571-6594. PMLR, 25-27 Apr 2023. URL htttss://proceeddnng: mlr wwwpppereesee/eaeeepppe che.ma22a.eeeaa2a..mmm html
Tianqi Chen, Emily Fox, and Carlos Guestrin. Stochastic gradient hamiltonian monte carlo. In International conference machine learning, pp. 1683-1691. PML.R, 2014.
Xiangning Chen, Cho-Jui Hsich, and Boqing Gong. When vision transformers outperform resnets without pretraining or strong data augmentations. arXio preprint arXiv:2106.01548 2021.
Kyujin Cho, Peter Meer, and Javier Cabrera. Performance assessment through bootstrap. IEEE Transactions on Pattern Analysis and Machine Intelligence, 19(1):11185 -1988, 1997.
Tarin Clanuwat, Mikel Bober-Trizar, Asanobu Kitamoto, Alex Lamb, Kazuaki Yamamoto, and David Ha. Deep learning for classical japanese literature, 2018
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. 2017 International Joint Conference on Neural Networks (IJCNN) 2017. doi: 10.
Patrick Courtney, Ncil Thacker, and Adrian F Clark. Algorithmic modelling for performance evaluation. Machine Vision and Applications, 9(5):219 228, 1997.
Wei Deng, Guang Lin, and Faming Liang. A contour stochastic gradient langevin dynamics algorithm for simulations of multi-modal distributions. In Advances in Neural Information Processing Systems, 2020.
Alexcy Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. ICLR, 2021.
13

---

Published in Transactions on Machine Learning Research (08/2025)
Alan M. Ferrenberg and Robert H. Swendsen. Optimized Monte Carlo data analysis. Physsccal Review Letters, 63((2))1195-113) September 1989. doi:
Xiang Gao, Visvanathan Ramesh, and Terry Boult. Statistical characterization of morphological operalor sequences. In European Conference on Computer Vision, pp. 590 605. Springer, 2002.
Katayoon Goshvadi, Haoran Sun, Xingchao Liu, Azade Nova, Ruqi Zhang, Will Grathwohl, Dale Schu- urmans, and Hanjun Dai. Dises: a benchmark for discrete sampling. Advances in Newral Information Processing Systems, 36, 2024.
Will Grathwohl, Kevin Swersky, Milad Hashemi, David Duvenand, and Chris Maddison. Oops i took gradient: Scalable sampling for discrete distributions. In International Conference on Machine Learning, pp. 1931--8411 PMLR, 2021.
Michael Greiffenhagen, Dorin Comaniciu, Heinrich Niemann, and Visvanathan Ramesh. Design, analysis, and engineering of video monitoring systems: An approach and a case study. Proceedings of the IEEE, 89 (10):1498-1111) 1517, 2001.
Dirk Groeneveld, Iz Beltagy, Pete Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, A. Jha, Hamish Tvison, Tan Magmusson; Yizhong Wang, Shane Arora, David Atkinson, Russell Authur, Khyathi Raghavi Chandu, Arman Cohan, Jennifer Dumas, Yanai Elazar, Yuling Gu, Jack Hessel, Tushar Khot, William Merrill, Jacob Daniel Morrison, Niklas Muennighoff, Aakanksha Naik, Crystal Nam, Matthew E. Peters, Valentina Pyatkin, Abhilasha Ravichander, Dustin Schwenk, Saurabh Shah, Will Smith, Emma Strubell, Nishant Subramani, Mitchell Wortsman, Pradeep Dasigi, Nathan Lambert, Kyle Richardson, Luke Zettle- moyer, Jesse Dodge, Kyle Lo, Luca Soldaini, Noah A. Smith, and Hanna Hajishirzi. Olmo: Accelerating the science of language models. arxiv preprinl, 2024. URL htttps://appp http::////pp.smmmtiiicccoooooooo hwwpcccchholaooooooo.ooooo mrg/CorpusID: 267365485
Jiawei Gu, Xuhui Jiang, Zhichao Shi, Hexiang Tan, Xuehao Zhai, Chengjin Xu, Wei Li, Yinghan Shen, Shengjie Ma, Honghao Liu, et al. A survey on llm-as-a-judge. arXiv preprint or arXi::2411115504 2024.
AM Hammitt and EB Bartlett. Determining functional relationships from trained neural networks. Mathe- matical and computer modelling, 22(3):83 103, 1995.
Robert M Haralick. Performance characterization in computer vision. In BMVC92, pp. 1-8. Springer, 1992.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual lcarning for image recognition. 0303855, 2015.
arXiv preprint
Dan Hendryeks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. Proceedings of the International Conference on Learning Representations, 2019.
Dan Hendryeks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv preprint arXiv:1610.001:: 2016.
Dan Hendryeks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In International Conference on Learning Representations, 2019. URL httpp:://ppaareviee.nette/ee id=HyxCxhRcy7
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural infor- mation processing systems, 30, 2017.
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degener- ation. arXiv preprint ar
2019.
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized ODIN: Detecting out-of-distr image without learning from Computer Vision and Pattern Recognition, pp. 10951-10960, 2020.
data. In Proceedings of the IEEE/CVF Conference on
14

---

Published in Transactions on Machine Learning Research (08/2025)
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolu- tional networks. In Proceedings of the TEEE conference on computer vision and pollern recognilion, pp. 2017.
Koji Hukushima and Koji Nemoto. Exchange monte carlo method and application to spin glass simulations. Journal of the Physical Sociely of Japan, 65(6):1604-160 1608, 1996.
Tapas Kamungo and Robert M Haralick. Character recognition using mathematical morphology. In Proc. of the Fourth USPS Conference on Advanced Technology, pp. 973 1886,,,,111 1990.
Reinhard Klette, H Siegfried Stichl, Max A Viergever, and Koen Vincken. Performance characterization in computer vision. Springer, 2000.
Sachin Kumar, Biswajit Paria, and Yulia Tsvetkov. Constrained sampling from language models via langevin dynamics embodding spaces. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2022.
Alexey Kurakin, lan Goodfellow, Samy Bengio, et al. Adversarial examples in the physical world, 2016.
DP Landau, Shan-Ho Tsai, and M Fxler. new approach monte carlo simulations in statistical physics: Wang-landau sampling. American Journal of Physics, 72(10):1294 1302, 2004.
Oran Lang, Yossi Gandelsman, Michal Yarom, Yoav Wald, Gal Elidan, Avinatan Hassidim, William T. Freeman, Phillip Isola, Amir Globerson, Michal Trani, and Inbar Mosseri. Explaining in style: Training gan to explain a classifier in stylespace. arXiv preprint arXiv:2104.1336 2021.
Guillaume Leclere, Hadi Salman, Andrew lyas, Sai Vemprala, Logan Engstrom, Vibhav Vineet, Kai Xiao, Pengchuan Zhang, Shibani Santurkar, Greg Yang, et al. 3db: A framework for debugging computer vision models. Advances in Neural Information Processing Systems, 35:8498 88118, 2022.
Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzato, and Fujie Huang. A tutorial on energy-based learning. Predicting struclured dala, 1(0), 2006.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibratee classifiers for detecting distif-iisttibuttinn samples. arXiv preprint arXie:1711.09333 2017.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting out-of- distribution samples and adversarial atlacks. In Advances in Neural Information Processing Systems, pp. 7167-7177, 2018
Chunyuan Li, Changyou Chen, David Carlson, and Lawrence Carin. Preconditioned stochastic gradient langevin dynamics for deep neural networks. In Thirtieth AAAI Conference on Artificial Intelligence, 2016.
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In 6th International Conference on Learning Representations, ICLR 2018, 2018.
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. Advances in Neural Information Processing Systems, 2020.
Weitang Liu, Yi-Zhuang You, Ying Wai Li, and Jingbo Shang. Gradient-based wang-landau algorithm: A novel sampler for output distribution of neural networks over the input space. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.). Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 223311 PMLR, 23 29 Jul 2023. URL hattps://rrocedinng.. mlr. preas/v202/1iu223 html
15

---

Published in Transactions on Machine Learning Research (08/2025)
Jinqi Luo, Zhaoning Wang, Chen Henry Wu, Dong Huang, and Fernando De La Torre. Zero-shot model diagnosis. In Proceedings of the IEEE/CVP Conference on Compuler Vision and Pollern Recognation (CVPR), 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial atlacks. arXiv preprint arxi 1706. 00000668,, 2017.
Nicholas Metropolis, Arianna W. Rosenbluth, Marshall N. Rosenbluth, Augusta H. Teller, and Edward Teller. Equation of State Calculations by Fast Computing Machines. The Journal of Chemical Physics, (166))1087-1092 June 1953. ISSN 0021-9606. doi:
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: a regular- ization method for supervised and semi-supervised learning. IEEE transactions on pattern analysis and machine intelligence, 41 11(8):1979-1190 1993, 2018.
Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generaliz- able out-of-distribution detection. Proceedings of the AAAI Conference on Artificial Intelligence, 34(04): 5216 5223, April 2020. ISSN 2159-5399. doi: 10.1609 vaai.434i04
Muhammad Ferjad Naeem, Seong Joon Oh, Youngjung Uh, Yunjey Choi, and Jaejun Yoo. Reliable fidelity and diversity metrics for generative models. 2020.
Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 427-436, 2015.
Viraj Prabhu, Sriram Yenamandra, Prithvijit Chatlopadyyay, and Judy Hoffman. Lance: Stress-testing visual models by generating landed counterfactual images. In Neural Information Processing Systems (NeurIPS), 2023.
Lianhui Qin, Sean Welleck, Daniel Khashabi, and Yejin Choi. Cold decoding: Energy-based constrained text generation with langevin dynamics. Advances in Neural Information Processing Systems, 35:9538-9555 9551, 2022.
Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li. Semanticadv: Generating adversarial examples via attributo-conndiionne image editing. In ECCV, 2020.
Alcc Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodci, and Ilya Sutskever. Language models are unsupervised multitask learners. 2019.
V Ramesh and RM Haralick. A methodology for automatic selection of iu algorithm tuning parameters. In ARPA Image Understanding Workshop, 1994.
Visvanathan Ramesh and Robert M Haralick. Random perturbation models and performance characteri- zation in computer vision. In Proceedings 1992 IEEE Computer Society Conference on Computer Vision and Pallern Recognition, pp. 521-522. IEFE Computer Society, 1992.
Visvanathan Ramesh, RM Haralick, AS Bedekar, X Liu, DC Nadadur, KB Thornton, and X Zhang. Com- puter vision performance characterization. RADIUS: Image Understanding for Imagery Intelligence, pp. 241-282, 1997.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distrbbution detection. In Advances in Neural Information Processing Systems, pp. 14680-14691, 2019.
Andras Rozsa, Ethan M Rudd, and Terrance E Boult. Adversarial diversity and hard positive generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 25-32, 2016.
16

---

Published in Transactions on Machine Learning Research (08/2025)
Mchdi S. M. Sajjadi, Olivier Bachem, Mario Lučié, Olivier Bousquet, and Sylvain Gelly. Assessing Generative Models via Precision and Recall. In Advances in Neural Information Processing Systems (NewrIPS). 2018.
Tim Salimans, Ian Goodfellow, Wojeiech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. Advances in neural information processing systems, 29, 2016.
V Sanh. Distilbert, distilled version of bert: smaller, faster, cheaper and lighter. ar preprinl arXiv:1910.01108 2019.
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. ArXiv, abs/1910.01108, 2019.
Michelle Shu, Chenxi Liu, Weichao Qiu, and Alan Yuille. Identifying model weakness with adversarial examiner. In Proceedings of the AAAT conference on artificial intelligence, volume 34, pp. 11998-120001 2020.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint Xr:: 10o.:1149...0 1556, 2014.
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference Empérical Methods in Natural Longuage Processing, pp. 1631-1642, Seattle, Washington, USA, October 2013. Association for Computational Linguistics. URL
https://www aclweb. www.wl..rg/wwwaaoo.......a.ooaea
Andreas Steiner, Alexander Kolesnikov, Xiaohua Zhai, Ross Wightman, Jakob Uszkoreit, and Lucas Beyer, How to train your vit? data, augmentation, and regularization in vision transformers. arXiv preprint arXiv:2106.10270 2021.
Yiyou Sun and Yixuan Li. Open-world contrastive learning. arXic preprint arXiv:2208.0276 2022.
Robert H Swendsen and Jian-Sheng Wang. Replica monte carlo simulation of spin-glasses. Physical review letters, (7221)7 1986.
Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.611 6199, 2013.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguclov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 1-9, 2015.
Neil A Thacker, Adrian F Clark, John L Barron, J Ross Beveridge, Patrick Courtney, William Crum, Visvanathan Ramesh, and Christine Clark. Performance characterization in computer vision: A guide to best practices. Computer vision and image understanding, 109(3):305 -34, 2008.
Ilya Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner, Jes- sica Yung, Andreas Steiner, Daniel Keysers, Jakob Uszkoreit, Mario Lucic, and Alexey Dosovitskiy. Mlp- mixer: An all-mlp architecture for vision. arXiv preprint arXiv:2105.0160 016601 2021.
Fugao Wang and David P Landau. Efficient, multiple-range random walk algorithm to calculate the density of states. Physical review letters, 86(10)22050, 2001.
Max Welling and Yee W Teh. Bayesian learning via stochastic gradient langevin dynamics. In Proceedings of the 28th international conference on machine learning (ICML-11), pp. 681-688, 2011.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image datasct for benchmarking machine learning algorithms, 2017.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2730 2730-2739, 2019.
17

---

Published in Transactions on Machine Learning Research (08/2025)
Pan Xu, Jinghui Chen, Difan Zou, and Quanquan Gu. Global convergence of langevin dynamics based algorithms for nonconvex optimization. Advances in Newral Information Processing Systems, 31, 2018.
Chhavi Yadav and Léon Bottou. Cold case: The lost mnist digits. In Advances in Neural Information
Processing Systems 32. Curran Associates, Inc., 2019.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint rrXtc:165.007166 2016.
Ruqi Zhang, Xingchao Liu, and Qiang Liu. A langevin-like sampler for discrete distributions. International Conference Muchine Learning, 2022.
Juntang Zhuang, Boqing Gong, Liangzhe Yuan, Yin Cui, Hartwig Adam, Nicha Dvornek, Sekhar Tatikonda, James Duncan, and Ting Liu. Surrogate gap minimization improves sharpness-aware training. ICLR, 2022.
A Connection between ROC and PR curve in the input space
It is common in the traditional evaluation framework to consider the receiver operating characteristic curve (ROC) and precision-recall (PR) separately. The recall in PR the same as the unnormalized true positive rate ROC, so we do not need to consider the true positive rate separately. The false positive is the number of positively predicted inputs minus the number of the true positives (using the notation of Equ. 3
to0
to0
+00
Ex(=) - Σ (=)= = -x(=) 22A
(1==)(
22A
=2A
The false positive rate is the number of false positives divided by the number of inputs of the negative class. Since the number of inputs of the negative class is constant in the input space, the unnormalized false positive rate is:
False positive rate oc Σ ((2)(1-r(z))
In other words, we compute the truc positive, the false positive rate is simply proportional to the false positive (Eta p(z) true positive) in the input space. Thus, plotting the ROC curve is like plotting r(z) and r(z) scaled by p(=) respectively. Comparing the equation of the (unnormalized) recall, this (unnormalized) false positive rate contains (almost if not all) the same information as the (unnormalized) recall in the input space.
B Cross-models normalization
As an intuitive example of validation of normalization, suppose it is enumerable to have ground truth count in a large input space where model M1 maps 500 inputs to outputs within Z and Model M2 maps 200 inputs within Z. X is the set of inputs that are predicted by both models within 2. X has 100 inputs.
We sample 50 inputs with outputs within E by Mi, and it is expected to have around 10 them from X. because the sampled proportion 10:
50 should be close the ground truth proportion 100 Therefore, Equ. 5
is 50 5. We then sample 50 inputs whose outputs are within by M2, and should have around 25
Tо of them from X. The sampled proportion Equ. 6 is 50 2, close to the ground truth proportion 200 2.
25
Therefore, comparing the sampled proportions 5 versus 2 computed from Equ. 5 and Equ. 0 of is as if we
were comparing the ground truth count of 500 versus 200.
C PR curves for OLMOo models
Fig. shows the PR curves for OLMo-7B, OTMo-7B--nstrrt, OLMo-7B-SFT and OLMo-1B.
18

---

Published in Transactions on Machine Learning Research (08/2025)
D Language Classifier
We fine-tune DistilBERT (Sanh ct al. 2019) model using the SST2 dataset (Socher et al. 2013 and achieve 91% accuracy. We choose the logits as our sampling target, and evaluate this model using OMNI Since the maximum length of SST2 is 66 tokens, one can define the input space for DistilBERT to be sentences with exactly 66 tokens. For shorter sentences, the last few tokens are padded with padding tokens. Because a typical sentence in SST2 contains 10 tokens, we therefore evaluate sentences of tokens length and tokens in length, respectively.
OMNIINPUT finds that the language classifier performs poorly, the precision is 0 for all the recall values. Analysis the sampled inputs for each positive logit bin reveals that the model tends classify primarily based on specific keywords, rather than understanding the grammar and structure of the sentences.
Here are some sampled inputs for different sentence lengths. For sentence length 66, some sampled inputs with logit equals (positive sentiment) in Fig For sentence length 10, some sampled inputs with logit equals (positive sentiment) Fig
E
Details of the Computer Vision Models used in Evaluation
The ResNet used in our experiments is the same the one used in GWG (Grathwohl et al. 2021). For the input pixels, we employ one-hot encoding and transform them into a 3-channel output through 3-by-3 convolutional layer. The resulting output is then processed by the backbone models to generale features. The CNN backbone consists of two 2-layer 3-by-3 convolutional filters with 32 and 128 output channels, respectively. The MLP backbone comprises single hidden layer with flattened images as inputs and pro- duced 128ddimensional features as output. All the features from the backbone models are ultimately passed through fully-connected layer to generate scalar output.
F Traditional Model Evaluation Results
Tab. 2 shows the AUROC of different models based on pre-defined test sets with different negative class(es). The MLP-MNIST-0/1 performs better on Fashion MNIST but worse in the rest than RES-AUG-MNIST. 0/1. RES-GEN-MNIST- usually perform the best. CNN-MNIST-0//1 performs better Kuzushiji MNIST than RUSS-AUG-MNIST-O)) and MLP-MNIST-0/1 but worse on the rest. Tab 3 shows the FPR95 results. CNN-MNIST-0/ performs better Kuzushiji MNIST than RES-AUG-MNIST-UN but worse the rest. These results show the inconsistency between the metrics, dataset and the models.
and MLP-MNIST-0//
BLM--M
08
Peeeiion
Procinten
Precision
(Umoomdieed Reall log scele
(Unrumsdeeel Recall lng solls
(Unsemmizal Rocall in log walk
(Ummemalizd)) Recall in logcoli
(a) PR for OL.
(b) PR for OLMo-7B.
(c) PR for Oo
(d) PR for O..--TB-SFT.
Figure 7: PR for OLMo Language models.
19

---

Published in Transactions on Machine Learning Research (08/2025)
['[CLS], "positive', "dazzling', 'textual', 'quilt', 'shale", 'funk', 'austro', 'advanced', 'tending', 'animals', grasping' 'mann', "scott', 'lower, "knives', 'avant', 'luckily', "##gui', 'nations', '##48', 'lions', 'nixon', 'steer', instituted'' 'mont', '##tuo,, 'hang', 'muir", 'dublin', 'armchair', 'lips', '##tin', 'pianist', 'introduce', 'ggn'', 'rosenberg', 'sarawak', 'eddy', ##tmanshipp, 'deluxe', 'highway', '##gaard', 'entertain', 'chronic', '#jjing', "objects,, 'sw', "##flies', '#Httri, 'root', "#Hphone', 'franciscan', 'longitudinal,, 'dealing', 'emilio', 'godfrey', "audiences', 'comparison', 'shards', 'frienshhpp, 'emphasized', '#ttssel', '#llssen,, '[SEP]']
[[CLS]', 'positive', 'dazzling', 'textual', 'quilt', 'skill', 'animal', 'fein', 'jocelyn', 'compelling', 'bounce', ##irson,, 'mograw', 'dynasty', 'buy', '#ffight', '#F5,, 'republics', 'fictional', '##umble'', 'spaniards', 'ronnie', 'wise', 'baha', 'chefs', 'flipping', 'pa', 'symphonies', '##tyn', 'seaman', '##bler', '#tlia, '##3', '##tius', 'nests', :. 'growingg, 'phosphorus', 'stakes', '##wski', 'penalty', 'killers', 'manages', '#thue', "#itions', '#tirval', 'modify', ##roong, 'bikes', 'frankenstein', 'hayden', 'shirt', 'satisfaction', 'taylor', 'modes', 'audiences', impact', '#lskka,, "shirley', 'albaanann'', 'playboy', "extensions', 'mongolian', 'saturn', '1692', [[EP]]]
[[[CS]', 'positive', 'dazzling', 'textual', 'coloring', 'lays', 'bsc', 'fold', 'michael', 'metre', '332', 'herself, 'von', 'illhouette', 'protestant', 'sonata', 'emblem', 'rag', 'fictional", 'lb', 'yours', 'generator', 'chorale', 'kits', "marine', ###haya', '##rdes', 'aegean', '350', 'jailed', 'sucks', 'magical', 'graveyard', 'fragile', '#ooco', "hostage', 'honestly', 'retirement', 'wiley', 'interpreted', " "#Hooping', '#lsat', 'devices', 'domesday', 'animmttion,, 'nokia', 'doctoral', 'erich', 'prefix', 'nectar', 'telling,, wrapping', '#tiight,, 'herrera', 'fiona', 'stella', 'various', 'since', 'L'', 'arcade', "passengers' 'terrace', 'newcastle', 'impact', "[SEP]']
[[CLS],, 'positive', 'dazzling', 'textual', 'coloring', 'izzy', 'fisher', 'housing', 'knock', 'supplier', 'park', 'cigar', 'costume', 'essay', 'maple', 'cemetery', 'walton', 'herman', 'like', 'ethernet', 'strikeouts', ' "reconstruction', 'distal', '##rrie',, 'asking', 'choral', 'adventures', 'w', 'nucleus', 'accounts', '102', 'illinois', is',, 'luna', 'hostage', 'dlan', 'shit', 'seventeen', '##"", 'canterbury', 'smiconductu,, 'childbirth', 'cock' WHiza', 'themed', 'elmer', 'jin', 'st, "#tuta,, 'cordoba', 'palatine', 'moose', 'dir', 'passenger', 'teller', craters', '1710', 'yearbook', 'n', "jude', 'decades', '##tcard'', 'santana', '#tumee, "[SEP]]]
['[CLS], 'genuinely', 'dazzling', 'textual', 'streaks', '#ttquist', 'founders', 'generals', 'khan', 'Hlist', 'mahogany', '#tevich', 'rwanda', 'penguin', 'bobbed', 'detroit', 'anwar', 'oppression', '#thak', '#tssches', 'salmon', '#rrien,, 'deportation', 'flirt', 'mongolian', '#lbrush', 'second', 'adventures', 'liquids', 'birth', 'traditional', 'turned', 'induced', 'philharmonic', 'swept', 'stallion', 'geometridae', 'mohan', 'thoughts', ##tonga', 'bullock', 'mourning', 'wei', 'teen', 'knighted', 'bavaria', 'atkins', 'peterson', 'ud', 'corona', 'gripped', 'strands', '#Hieel, 'barclay', 'arranged', 'pune', 'wraps', 'at', 'clues', 'ether', 'strait', czechoslovakia" '##rith', 'son', '#tglia', '[SEP]']
Figure 8: Sampled inputs of SST2 with sentence length 66.
['[CLS]', "brave', 'searing', 'vvid' 'nbl', 'restoring', 'uploaded', 'sleeps', 'loyalists', [[SEP]']
[[[CLS]', 'appreciated", 'shattrrngg,,, 'nile', "barack', 'branch', 'lifelong', 'flavor', 'cow', '[SEP]'] [[[LLS],, 'incredibly', 'refreshing', 'B#'', 'transport', "aanspport'tedddy,,, 'lledgling, 'u', ##ppee, [[SEP]]]
[[[LSS', 'lexington', 'band', 'difficult', 'prophets', 'humanitarian', 'bianca', 'detectives', 'beautifully', '[SEP]]
[[[LS]', 'made', '##onzo', 'folklore', 'extraordinarr', 'islands', 'gameplay'' ''aboouutlly', 'summons', '[SEP]]]
[[[CLS], ggenerous,, accceleratio',, "precision', '1792', 'freiburg', 'signature', 'treasure', 'parkinson', [[SEP]]
[[[LS]], 'ibbrant' 'keen', 'aboriginall, 'psychiatrist', 'scott', 'monumental', '##tical', '1920', '[SEP]']
[[[LS]], 'contraction', 'businessman', 'sunderland', '##taway', 'jewelry', 'harmony', 'inspiring', 'realistic',
[[SE]]]]
Figure 9: Sampled inputs of SST2 with sentence length 10.
Test Set
class=0 (in-dist) Fushion MNIST (OOD) Kuzushiji MNIST (OOD) EMNIST (OOD) QMNIST (OOD)
WUN-MMIST-O// 0/11
99.76
99.88
99.31
99.56
92.46
RES DEN-MNIST-II
99.99
100.00
100.00
100.00
94.85
HES-AUG-MNISTTA
100.00
99.10
99.15
99.93
94.32
MIP-MMNIST-0/1
100.00
98.62
99.83
94.17
Class==0 OOD for GEN model.
Table AUROC. The higher the better.
20

---

Published in Transactions on Machine Learning Research (08/2025)
Table 4: Comparing human evaluations and FID scores metrics of model performance. Although FID scores similar for the two models, human labels differ significantly from the FID scores. OMNIINPUT
evaluates the input space and thus the the evaluation is more consistent.
RES-AUG-MNIST--02
CNN-MNIST-0//1
logits humanst
FTD
logits humansf
FTD
43
0.9
360.23
12
346.42
42
0.88
362.82
11
0
358.37
41
0.85
368.75
10
363 23
40
0.83
375.58
9
365.01
Test Set
class=0 (in-dist) Fashion MNIST (OOD) Kuzushiji MNIST (OOD) EMNIST (OOD) QMNIST (OOD)
ENN-MNIST-0/1
0.54
0.51
2.78
1.98
21.08
MES-CEN-MNIST-L
0.00
0.00
0.00
0.00
10.55
BUS-AAU--MNSSTA))
0.00
0.34
4.60
0.31
14.17
ATP-MNIST-0//1
0.00
0.27
6.68
0.64
13.24
iClass-D is OOD for GEN model.
Table 3: FPR95. The lower the better.
G Human-model annotation inconsistency
Feature extractors generate features from both the ground truth test set images and the images produced by the generative model, and then compares the distributional differences between these features. In our experiment, the ground truth inputs are test set digits from label=1.
The consistency of FID scores with human evaluations varies depending on the models and datasets. For example, in the case of RES-AUG-MNIST--00 (Table 4 a decrease the FID score (indicating better performance) corresponds to an increase in the human score (also indicating better performance) the logit value rises. This result suggests that certain metrics, like FID, may serve substitutes for human annotations when evaluating generative models. However, for CNN-MNIST-0/L the FID score be entirely mislcading. While human evaluators perceive the representative inputs of CNN-MNIST-001 for the logits in the table as unmeaningful (having score of 0), the FID scores are similar to those of RES-AUG- MNIST-0/1, which contains meaningful digits. This is not the only inconsistent case between humans and metrics. For instance, in table of MLP-MNIST-0011, the FID scores indicate the samples are bad when humans think they are good. The FID scores indicate the even better performance (lower scores) in the logit ranges when humans label incorrect in general.
When the logits are large, humans label the representative inputs as "1." When the logits are small, repre- sentative imputs look like "0." However, the FID scores are better for these "0" inputs, indicating the feature extractors believe these "0" inputs look more like digits "1." The key contradiction that the feature extrac- tors these metrics, when trained on certain datasets, are not verified to be applicable to all OOD settings, but surely they will applied in OOD settings to generate features of inputs from models for evaluation. It is difficult to ensure they will perform reliably.
H Representative inputs for MNIST images
Representative inputs for different models are Fig. 10
Example sampled inputs of (Large) Language models
We include a few example samples for GPT2 and OlMo in Tab.
21

---

Published in Transactions on Machine Learning Research (08/2025)
X
.7
RES- GESS-GN--MNITA
RES AUG-AAUGMMII-AAA
(c) CNN-MNIST MII-MNNIT-O//
(d) CNN- AUG-AUGUT--/OOO/
1
1
1
1
1
1
*
1
1
36
1
36.
1
1
1
(e) MLP-MNIST-0//
(f) ALP-GENN-MNIT-I
(g) MMPP-AUG-MIIST-DD//
Figure 10: Representative inputs of different models.
22

---

Published in Transactions on Machine Learning Research (08/2025)
logits humanst
FID|
17
0.73
434.32
16
0.66
436.60
15
0158
432.89
14
0..8
430.79
-19
0.18
422.01
-20
0.2
419.94
-21
0.2
412.96
-22
0.216
405.20
Table 5: For MLP-MNIST-0/1 the FID scores indicate the samples are bad when humans think they are good. The FID scores indicate the even better performance (lower scores) in the logit ranges when humans label as incorrect in general.
23

---

Published in Transactions on Machine Learning Research (08/2025)
Model
NLL
Samples
GPT2-smal1-25
1.5
stores, grocery stores, restaurants, grocery stores, grocery stores, grocery stores, grocery shopping centers, supermarkets, restaurants, grocery
GPT2-small-25
2.0
science, science fiction and fefence-fictio films, Final Fantasy VII, and The Lord of the Rings, among other titlss.
GPT2-smal1-25
2.5
Dean was really nice and kind. He was sort of a cuddly. T love him, he's such a good
GPT2-small-25
3.0
ethnic tendencies. Students continue to taught that their current situation is their own fault and they should be taken to task for it
GPT2-small-25
3.2
The band responded that they do not refor to themsclves as "old school," but rather modern-era
GPI2-small-25
3.5
lure Daphne, Harry. Now our world knows Hermione Granger wasn't the only person in the school who was kidnapped.
GPT2-smal1-25
4.0
Flags and weight fluctuations in the water with power plants and dissipatiin energy put a lot of strain on the water control system because
GPT2-modiun-25
1.7 houses, government buildings, schools, hospitals, and other buildings used for public purposes, such as airports, military bascs, and
GPT2-medium-25
2.0
sadness, but it's good feeling, and there's that's
that we're better because of it. And
GPT2-medium-25
2.5
Communists were trying to re-create the experiences of the American Civil War where black soldiers fought alongside white soldiers and played crucial
GPT2-medlum-22 25
3.0
drastically altered. In the early monastic period the belief in eternal life and free will had been transformed into a religions belief in
GPT2-medium-25
3.2
acknowledging the wickedness of man due to him, in venting his indignation against, him and finally cursing him, he says
GPT2-medium-25 25
3.5
consequence that Chinese law enforcement is very unclear. In fact, given the lack of clear territorial boundaries and with respect to whom the
GPT2-meduum22
4.0
disqualifications from Supreme Court proceedings, defence from prosecution, compel- ment of guardians, obligation to pay retainer of one half
OLMo-1B
3.0
abouts demeasure on what is to be thereupon upon upon upon upon upon also also also also also also also too too
OLMo-IB
3.5
analys anding several changes and adaptations in human brains and their evolution throughout. the world history. Brain evolution study discusses how the brain
OLMo-1B
3.8
farmers traditional ways of life/culture is not acceptable. It comes out from talking which points out the issue of racism, sex
OLMo-1B
4.5
cis chooses to establish her identity with the Autotaschusansa society," in which typically feminine aspects are a fundamental part
OLMo-7B
3.0
vpub pvphy-p c-a v pvpbv-cpv c-vpy
OLMo--7B
3.5
wei's C2H probe demonstrated the excellent Ln sensitivity and the low detection limit of Ln. A variety of L
OLMo-7B
3.8
Whatever happens outcome his ego and character endures it his name will forever there- after be live in history as it's it's the
O..so-tB
4.0
Devil and Parker Brothers, for poorly made games which often were inacoessible for children, partly due to the strict licensing rules. As
OTMoo-7B-Instrut
4.5
requisite kms which is all about home address details, favourite foods and what sounds psychical, You will be found that you
OLMS-7B-SFT
3.5
memory models more often tend towards simple models that treat memory capacity as uniform across all types of memory content. RY: I
OT---T--FFT
4.0
Something people including me can do.! Creative and idea generating workshops can help you when you need something new for project
Table 6: Example Samples
24


Reviews:
[{"review_id": "D0ELPo8tfo", "reviewer": "Reviewer_StkD", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "# Pros\n- The approach to sample from the output distribution and to calculate precision/recall is sensible and sufficiently described in the paper. \n- The approach / the direction shows significant value, as model evaluation solely based on small validation/test sets is often not representative for actual use of LLMs or vision models.\n- The conducted empirical evaluation comprises both language- as well as vision models, showing sufficient breadth in applications.\n- The results show that the metric can be used to discover interesting corner cases\n\n# Cons\n- While the approach is sensible, it is unclear to me if the used sampling method is better than referenced work. It should be better shown that there is a real need for it. It is listed as core contribution, so it should be made clear\n- The (Liu et al. 2023) reference is missing in the related work in the sample section. It is, again, unclear if this approach could have been reused for sampling or not.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes a framework for deep learning model evaluation which should cover the complete input space using internet data, where data points are sampled and manually annotated based on the output distribution of the resp. model. Precision and recall can then be calculated at different output values. The main added argument for such a method is that various deep learning models are not only used for their initial training input distribution, but beyond. The authors propose to use parallel tempering and histogram reweighing for estimating the output distribution. \n\nThe approach is evaluated for LLMs (GTP-2, OlMo 7B/-instruct) and vision classifiers (MLP, CNN, ResNet) by pairwise comparison of models wrt the precision call curves or negative log likelihood. The results show that the approach can be used to compare models. It is argued for that this is due to the difference of used data sources, the manual annotations are done after sampling and precision/recall are not used as loss during training. \nAdditionally, the authors show that in a toy setting (where enumeration is computationally feasible) the sampled distribution is sufficiently equal to the actual distribution.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Why does one need an improved sampler compared to (Liu et al. 2023)? Please make this clear in the manuscript.\n\nCan the mentioned approach be used to discover out-of-distribution samples? If so, would it perform better than the SOTA? Please make this clear in the manuscript if this is an important use case.\n\nExtending here, while the evaluation is quite exhaustive for the method at hand, it would be interesting to compare it to more methods listed in the related work section. Could you please argue why the evaluation as is, is sufficient or at further experiments?", "broader_impact_concerns": "There are no serious concerns. It might be interesting to think about the licenses of internet data when applying such an approach, but I am sure one can find good data which are open licensed. Otherwise this should be discussed more.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "skdnGuEsPZ", "reviewer": "Reviewer_9Fin", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n1. OmniInput introduces a new paradigm for model evaluation that does not rely on predefined datasets, addressing the limitations of traditional benchmark-based evaluation\n2. Sampling from the entire input space allows for evaluation of real-world performance and model generalization\n3. The framework minimizes the need for extensive human annotation by sampling representative inputs, increasing evaluation efficiency.\n4. The PR curves produced by OmniInput demonstrate its ability to evaluate model performance effectively. GPT2-medium outperforms GPT2-small for longer sequences, and OLMo-7B-Instruct shows improved precision over OLMo-7B\n\nWeaknesses:\n1. Sampling from large input spaces, especially for complex generative models, can be computationally expensive despite using efficient methods. \n2. OmniInput focuses on discrete inputs, making it less applicable to models with continuous input spaces. \n3. Although reduced, human annotation is still required, which could be further minimized through automation or self-supervised learning.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper presents OmniInput, a novel dataset-free evaluation framework for deep learning models. Unlike traditional dataset-driven approaches, which are limited to fixed datasets, OmniInput evaluates models across the entire input space by sampling internet-scale data. The key contributions of the paper are:\n- OmniInput evaluates models across the entire input space, addressing the limitations of benchmark datasets.\n- Supports broader model coverage, tested on large language models (e.g., GPT-2, OLMo) and computer vision models (e.g., CNN, ResNet), demonstrating scalability. \n- Precision-Recall curves and AUPR enable meaningful comparison beyond accuracy, considering alignment with human judgements.\n.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- The sampling process is computationally expensive for large-scale models. Introducing more efficient sampling methods or approximations would enhance scalability and reduce resource requirements.\n\n- Providing additional details on how the sampling strategy can be adapted to different model architectures and input types would make the framework easier to apply in practice.", "broader_impact_concerns": "The paper mentions that some sampled inputs contained sensitive information (e.g., company names and addresses). This raises concerns about potential privacy violations and unintended data leakage from the training process. Safeguards should be introduced to prevent such privacy risks.\n\nIdentifying model weaknesses through OmniInput could lead to adversarial misuse, where attackers exploit discovered vulnerabilities to manipulate model outputs. Strategies to protect models from such attacks should be considered.\n\nSampling from large input spaces and estimating output distributions for complex models could require significant computational resources, contributing to increased carbon emissions and environmental strain.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "3rFYUWO9A0", "reviewer": "Reviewer_Yg7Z", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n(S1) Scalable methods for explaining and evaluating models will be of interest to the ML researcher and practitioner communities, and to the TMLR audience in particular.\n\n(S2) Using output distribution sampling to avoid dependence on model internals or a labeled holdout set is a novel proposal.\n\n\nWeaknesses\n\n(W1) Consider a particular classification model, ModelX. Suppose ImageA and ImageB have the same predicted logits from ModelX. Will OmniInput sample ImageA and ImageB with the same weight, without regard to whether ImageA or ImageB is more realistic (and thus more likely to be fed as input to the model)? If so -- and it appears to me to be so -- this is a major drawback of the proposed method, which limits its usefulness in scenarios where data lives along a restricted manifold of the entire input space. (This is true of the vast majority of common ML scenarios, including in text and computer vision.)\n\n(W2) The paper claims that the vastness of internet data makes it harder to evaluate models, but this seems wrong. The vastness of the internet gives us access to cheap data that we can use to evaluate models (either a selected subset of, or samples from a generative model trained on internet-scale data, for scalability reasons). It's not clear why one would like to use OmniInput's synthetically generated samples in such a scenario. Does OmniInput discover input features that are likely to be adversarial examples for the given model? Does it tend to produce samples on which the model is over-confident, or on which it is under-confident? The paper does not really explain why OmniInput will (allegedly) produce inputs with qualities that make them meaningful or useful for evaluation. \n\n(W3) The empirical results are not very encouraging in this regard. For example, the generated MNIST examples (Figure 10) are mostly noise, or a combination of noise + a particular digit. They're not even diverse with respect to the underlying digit, or following the manifold structure of MNIST inputs. The paper calls these generated samples \"representative inputs\", but these \nsamples don't appear to be representative of the MNIST training data. So OmniInput seems to not produce particularly interesting or important examples for evaluating a model. Why should we then care about the AUPR curve evaluated on such uninformative samples?\n\n(W4) The method proposed in \"Section 2.3 Application: Model Comparison\" either does not make sense, or it is not motivated / explained well, or I am missing something obvious. What exactly is the connection between model comparison (the title of the section) and normalization (which is the focus of the section itself)? How is normalizing an unnormalized distribution sufficient to compare two different models? What is the relationship between \"entire output distribution normalization\" and \"cross-models normalization\" -- is the latter an approximation of the former? And does it even make sense to try to compare the AUPR of the two different models when they are being evaluated on each of their own selected \"representative inputs\"? What if M1 is poorly calibrated compared to M2, so OmniInput generates easy-to-predict inputs on it, inflating its AUPR compared to M2?\n\nAdditional comments\n\n(M1) [EDIT: satisfactorily addressed by authors]  ~Re: \"A larger AUPR means that the model’s predictions agree better with human perspective.\" This does not seem true to me. Can you justify this claim?~\n\n(M2) This is perhaps a bit nitpicky, but \"We first apply OmniInput to a Toy example where enumeration of all inputs is affordable to confirm OmniInput’s correctness.\" is not correct. This experiment confirmed that the sampling procedure does in fact correctly generate from the output distribution, but not the correctness of OmniInput (ie the proposal to use the output distribution). \n\n(M3) Maybe I missed this, but I don't see a precise description of the sampling method used. For example, I don't see more details about \"The samplers exchange configurations at intervals to accelerate mixing and the thermalization/denoising procedure\" -- what are the intervals used? Did these hyperparameters require tuning for the different experiments?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "OmniInput is a data-free method for evaluating deep learning classification models. The paper proposes using output sampling (ie sampling stratified by predicted class probabilities) to generate input features, then using those generated inputs to evaluate the model. In particular, the paper proposes to create precision-recall curves from the generated inputs. The proposed approach is applied to the language modeling (ie next-token classification) and image classification settings.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "Please see comments above (W1-4) and (M1-3).", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)