A Unified Survey on Anomaly, Novelty, Open-Set, and Out of-Distribution Detection: Solutions and Future Challenges
Authors: Mohammadreza Salehi
Hossein Mirzaei
Dan Hendrycks
Yixuan Li
Mohammad Hossein Rohban
Mohammad Sabokrou
Venue: Accepted by TMLR ()

Abstract: Machine learning models often encounter samples that are diverged from the training distribution. Failure to recognize an out-of-distribution (OOD) sample, and consequently assign that sample to an in-class label, significantly compromises the reliability of a model. The problem has gained significant attention due to its importance for safety deploying models in open-world settings. Detecting OOD samples is challenging due to the intractability of modeling all possible unknown distributions. To date, several research domains tackle
the problem of detecting unfamiliar samples, including anomaly detection, novelty detection, one-class learning, open set recognition, and out-of-distribution detection. Despite having similar and shared concepts, out-of-distribution, open-set, and anomaly detection
have been investigated independently. Accordingly, these research avenues have not crosspollinated, creating research barriers. While some surveys intend to provide an overview of these approaches, they seem to only focus on a specific domain without examining the
relationship between different domains. This survey aims to provide a cross-domain and comprehensive review of numerous eminent works in respective areas while identifying their commonalities. Researchers can benefit from the overview of research advances in different fields and develop future methodology synergistically. Furthermore, to the best of our knowledge, while there are surveys in anomaly detection or one-class learning, there is no comprehensive or up-to-date survey on out-of-distribution detection, which this survey covers extensively. Finally, having a unified cross-domain perspective, this study discusses and sheds light on future lines of research, intending to bring these fields closer together.

Published in Transactions on Machine Learning Research (11/2022)
A Unified Survey on Anomaly, Novelty, Open-Set, and Out- of-Distribution Detection: Solutions and Future Challenges
Mohammadreza Salehi
s.salchidehnonn@@uoo..l
University of Amsterdam
Hossein Mirzaci
hmmrzaogees&reessarrfffi
Sharif University of Technology
Dan Hendrycks UC Berkeley
hendrycks@@bbrkkeeey.. edu
Yixuan Li University of Madisson
sharonli@cs.wiie wisc. edu
Mohammad Hossein Rohban Sharif University Technology
rohban@sharif..om edu
Mohammad Sabokrou
sabokro @ipm.
Instibute For Research In Fandamental Sciences (IPM)
Reviewed on OpenReview: https: // openreview.
/tterevv/peeeevieu net/ forum? id= aRt VZubpk
Abstract
Machine learning models often encounter samples that are diverged from the training distribution. Failure to recognize an out-of-distribution (OOD) sample, and consequently assign that sample to an in-class label, significantly compromises the reliability of a model. The problem has gained significant attention due to importance for safety deploying models in open-world settings. Delecting OOD samples is challenging due to the intractability of modeling all possible unknown distributions. To date, several research domains tackle the problem of detecting unfamiliar samples, including anomaly detection, novelty detection, one-class learning, open set recognition, and mut-of-distribution detection. Despite having similar and shared concepts, out-of-distributiin,, open-set, and anomaly detection have been investigated independently. Accordingly, these research avenues have not cross- possinoolln,,dd, creating rescarch barriers. While some surveys intend provide an overview of these approaches, they seem only focus specific domain without examining the relationship between different domains. This survey aims to provide cross-domain and comprehensive review of numerous eminent works in respective areas while identifying their commonalities. Researchers can benefit from the overview of research advances in different fields and develop future methodology synergistically. Furthermore, to the best of our knowledge, while there are surveys anomaly detection or one-class learning, there is no comprehensive or up-to- date survey on out-of-distributiin detection, which this survey covers extensively. Finally, having a unified cross-domain perspective, this study discusses and sheds light on future lines of rescarch, intending to bring these ficlds closer together. All the implementations and benchmarks reported in the paper can be found at https://gi thub. com.taslliiisina.
osr-ood-as ber-ood-ad-methan ad-methods

---

Published in Transactions on Machine Learning Research (11/2022)
1 Introduction
Machine learning models commonly make the closed-set assumption, where the test data is drawn i. from the same distribution as the training data. Yet in practice, all types of test input data-even those on which the classifier has not been trained can be encountered. Unfortunately, models can assign misleading This lcads to concerns about the reliability In the literalure, several fields attempt to data in the open-world setting.
confidence values for unseen test samples (162 104 117
183
185)
of classifiers, particularly for safety-critical applications
[8
577
address the issue of identifying the unknowns/ In particular, the problems of anomaly detection (AD), Novelty Detection (ND), One-Class Classification (OCC), Ditt----Ditrrbttionn (OOD) detection, and Open-Set Recognition (OSR) have gained significant attention owing to their fundamental importance and practical relevance. They have been used for similar tasks, although the differences and connections are often overlooked.
httphoowss//ommallessssss /nommaless /awpa/aaass/ooooooooooooeeee cou-oo-distributtee
Specifically, OSR trains a model on K classes a N class training dataset; then, at the test time, the model is faced with N different classes of which N - K are not seen during training. OSR aims to assign correct. labels to seen test-time samples while detecting unseen samples. Novelty detection or one-class classification is an extreme case of open-set recognition, in which K is 1. In the multi-class classification setting, the problem of OOD detection is canonical to OSR: accurately classify in-distribution (ID) samples into the known categorics and detect OOD data that is semantically different and therefore should not be predicted by the model. However, OOD detection encompasses a broader spectrum of learning lasks and solution space, which we comprehensively reviewed in this paper.
While all the aforementioned domains hold the assumption of accessing an entirely normal training datasot, anomaly detection assumes the training datasel is caplured in a fully unsupervised manner without applying any filtration; therefore, it might contain some abnormal samples too. However, as abnormal events barely occur, AD methods have used this fact and proposed filtering during the training process to reach a final semantic space that fully grasps normal features. Despite previous approaches that are mostly used in object detection and image classification domains, this setting is more common in the industrial defect detection tasks, in which abnormal events are rare and normal samples have a shared concept of normality. Fig. [] depicts an overview of the mentioned domains, in which the differences are shown visually. Note that even if there are differences in the formulation of these domains, they have so much in common, and are used interchangeably.
21), focusing on each domain independently or providing a very general notion of anomaly detection to cover all different types of datasots. Instcad, this paper in-depth explanations for methodologics in respective areas. We make cross-domain bridges by which ideas can be easily propagated and inspire future research. For instance, the idea of using some outlier samples from different datasets to improve task-specific features is called Outlier Exposure in (60) or background modeling in (83), and is very similar to semi-supervised anomaly detection in 137). Despite the shared idea, all are considered to be novel ideas in their respective domains.
As an important research area, there have been several surveys in the literature 11 124 138
118
In this survey, we identify the commonalities that address different but related fields. Although some of the mentioned tasks have very close methodological setups, they differ in their testing protocols. Therefore, a
comprehensive review of all the methods can better reveal their limitations in practical applications. As
a key part of this survey, methods are described both mathematically and visually to give better insights to both newcomers and experienced researchers. Our survey also complements existing surveys (BS (80) which focus on higher-level categorizations. Finally, comprehensive future lines of research are provided both practically and fundamentally to not only address the issues of current methods but also shed light on critical applications of these methods in different fields.
In summary, the main contributions are as follows :
Identification of the relationship between different research areas that, despite being highly correlatod with each other, have been examined separately.
2

---

Published in Transactions on Machine Learning Research (11/2022)
2. Comprehensive methodological analysis of recent eminent research, and providing clear thcoretical and visual explanation for methods reviewed.
Performing comprehensive tests on existing baselines order to provide a solid ground for curentt and future lines of research.
4. Providing plausible future lines of research and specifying some fundamental necessities of the methods that will be presented in the future such as fairness, adversarial robustness, privacy, data efficiency, and explainability.
Novdly Dxtretion
164
Open Set Recogration
Cht-OC Distribtionn Detrition
ND
One-dees dassification loss
g
/
Multi-caes clesification loss
OSR
OUBNs
OOD
Multi-clas
classficationn
loss
Figure 1: Problem setup for ND, OSR, and ODD from a unified perspective based on the common routine
followed in the respective fields. (A), (B) and, (C) are sampled from the same training dataset, while (D) is sampled from different datasets. Typically, in ND, all training samples are deemed normal, and share a common semantic (green region), while samples diverged from such distribution Although samples in area (D) can be regarded potential outliers, only areas (B) and (C) are used anomalies for the evaluation phase. In OSR, more supervision is available by accessing the label of normal samples. For example "car", 'dog". 'cat", "airplane" and, "bus" classes i.e, the union of (A) and (B), are considered as normal while (C) is open-sct distribution(soe right Figure). Same as ND, (D) is not usnally considered an open-set distribution in the field, while there no specific constraint on the type of open-set distribution in the definition of OSR domain. In OOD detection, multiple classes are considered as normal, which is quite similar to OSR. For example, (A), (B), and (C) comprise the normal training distributions, and another distribution that shows degree of change with respect to the training distribution and is said to be out-of--issrriuttion, which can be (D) in this case.
considered anomalous.
2 A Unified Categorization
Consider a dataset with training samples (æ1, v1), (I2, 92), from the joint distribution Px,,, where X and Y are random variables on an input space X' = Rd and a label (output) space y respectively. In-class (also called 'scen' or 'normal") domain refers the training data. In AD ND, the label space is a binary set, indicating normal vs. abnormal. During testing, provided with an input sample æ, the model needs estimate P(Y srrmmalssee/in-caaee X x) in the cases of one-class setting. In OOD detection and OSR
3

---

Published in Transactions on Machine Learning Research (11/2022)
Newdly
Ricospaioon
The Taxonomy Of the Explained Methods
A Anomaly D Detection
Cut Di-tttateesss Droictoo Nutboda
Fre trained Peature
Discriminative
Generative
A ddeggtaion
Novelty Detection
Self Supervised Lesening
Classification Based
utteeccoerss
Gonsendive Advennssis Nerwarks
Clne-Clese Classifiattion
Multo Cless Classitration
[5.
[13]
[20]
[3]
[15,
[16-24]
[1.
[11]
[1]
[14] [10. 14]
Out Distribution
Open Recognition
Detection
Figure 2: As discussed section 2 all explained approaches can be unitedly classified in the shown hierarchical structure. The tree on the right points out that although some approaches have been labeled as ND, OSR, or OOD detection the field, however can be classified a more grounded and general form such that their knowledge could be shared synergistically. For instance, self-supervised ND methods can be added multi-class classification approaches without harming their classification assumptions. Unfamiliar sample detection can be done by employing different levels of supervision, which is shown on the left.
for multi-class classification, the label space can contain multiple semantic categories, and the model needs to additionally perform classification on normal samples based on the posterior probability p(Y = y x). It worth mentioning that in AD, input samples could contain some noises (anomalics) combined with normals; thus, the problem is converted into noisy-label one-class classification problem; however, the overall formulation of the detection task still remains the same.
To model the conditional probabilities, the two most common and known perspectives are called generative modeling and discriminative modeling. While discriminative modeling might be easy for OOD detection or OSR settings since there is access to the labels of training samples; nevertheless, the lack of labels makes AD, ND (OCC) challenging. This because one-class classification problems have trivial solution to map each of their inputs regardless of being normal or anomaly to the given label and, consequently, minimize their objective function as much as possible. This issue can be seen in some of the recent approaches such 136), which maps every input to single point regardless of being normal or abnormal when it is trained for large number of training epochs.
however, have made some changes in the formulation of P(Y [X) to solve this problem. They apply a set of affine transformations on the distribution of X such that the normalized distribution does not change. Then the summation Σ! P(T: T((X)) is estimated, calculating the aggregated probability of each transformation T; being applied on the input X given the transformed input T(X), which is equal to PTY X). This is similar to estimating P(Y | X) directly; however, it would not collapse and can be used instead of estimating one-class conditional probability. This simple approach circumvents the problem of collapsing: however, makes the problem dependent on the transformations since transformed inputs must not intersecl with each other much as possible to satisfy the constraint of normalized distribution consistency. Therefore, elaborated later in the survey, OSR methods employ AD approaches with classification models to overcome their issues. A similar situation holds for the OOD domain.
Some approaches 48
In generative modeling, AE (Antoencoder)-basee GAN (Generative Adversarial Network)-basee and explicit density estimation-bass methods such as ruto-rogressive and flow-based models are used model the data distribution. For AEs, there are two important assumptions. If the auto-encoder is trained solely normal training samples:
4

---

Published in Transactions on Machine Learning Research (11/2022)
Table 1: The table summarizes the most notable recent deep learning- works in different fields, specified by the informative methodological keywords and decision score used in each work. For the methods that have common parts, a shared set of keywords are used to place them on a unitary ground as much as possible. The pros and cons of each methodology are described in detail in the method explanation.
Toxonomy
Index
Methods
Publication Venue
Dectsion Score
Keywords
ALOCC
acccataccaa lipet
Earkxasthopeueniin newertateeeed abomatd kunks coakia Autalaanerr, Dolkarent and Ditation
DeepSvill
1001, pmm
deian of
Airhotathe mocele 9V10 meomee boters tepeuplies Anhonadd de
(863)
wll
10cV gros
oosstracaa dei lipes
guaceie mnsuat awsataaaaaaaand Meracy kund Regasetatica open adcmmki tnlaaiee and kktallge sperase
ND
CSI
had
in Lighen the was rppemniite
Uninferuad Studeuto
CVI 0100
cascable risued canevial
kaudiiiee dastlatiee todlevvtades hand traads locking repurtsed bursia Deattpic Conpuctue
CuriPhate
(901)
HIe pertted Lorreng the eedlar todk cnter wich fost romnent slkes cona
iamilay
und witee attenti
9
Opanitac
afar cosperig (padlla pellalilo per datarl
Zonea Vake Tlaoes activdie vate uncoeddec more mobul destiattoo Sitedlecpatio
OSRCI
racthe pubuldiie setor
OSR
rnsontaatioon sadr wasc
partt Bore lound mediive feue Prtrow We Therry betex
12
CROSB
Opaali pellliiit darail
GDFR
dee pranst an porerttdee borkkr mosemmnte cedler prontri
coteeils boring wiive
14
OpenGan
incv (s01)
Ue lnmwr clee ailood
berkiikt rien gromakee stmmen wlindee the welkine mest
MILS
16
MSP
Negatle of coetrans-ttee proveitity
siliic dieeti tantis, when decttaake, mostre cae poddiiitty dooiitotti beed vorkes date Canaiie
17
ODIN
X18(221)
Sepatie eadiaa witaai pecleldity teppetare mallr
oetie Lstache tartie ocha destisato seapesreo wallay slting raill pertat peratatkee calcaday aquaahiir
Mopil
(N0))
deseve do meeiie
19
DC
Uei analery ddtent cless kuste loen, sokee deer ades
Lita
(XS)
tepatio
poobibiity
AlFeepuried
21
G-ODIN
100V 2009
wheee oclp eetogerial slke
be tike nento oihion derd wites lorn tie comprrsir snfiee Thooe poedt Qualdeene
22
Knwngg- hased 0OD
XwitPs
lalll la catted fiis lagh oeread
(601)
24
HeArt
Neatts (a01)
.ile captiing focis level 04I0 atrstie
linaiio toa caacaaiia inde waal comoentiionn dleen mepittlle with vilieca OCO fextier
They would be able to reconstruct unseen normal Lest-time samples as precisely as training-time ones.
They would not be able to reconstruct unseen abnormal test-time samples as precisely as normal inputs.
Nevertheless, recently proposed AE-based methods show that the above-mentioned assumptions are not always true (143 49 189. For instance, even if AE can reconstruct normal samples perfectly, nonetheless with only a one one-pixel shift, reconstruction loss will be high.
Likewise, GANs as another famous model family, are widely used for AD, ND, OCC, OSR, and OOD detection. If a GAN is trained on fully normal training samples, it operates on the following assumptions:
If the input is normal then there is a latent vector that, if generated has a low discrepancy with the input.
If the input is abnormal then there is not a latent vector that, if generated, has a low discrepancy with the input.
5

---

Published in Transactions on Machine Learning Research (11/2022)
Here, the discrepancy can be defined based on the pixel-leve MSE loss of the generated image and test-time input or more complex functions such as layer-wise distance between the discriminator's features when fed a generated image and test-time input. Although GANs have proved their ability to capture semantic abstractions of a given training datasct, they suffer from mode-collapse, unstable training process, and irreproducible result problems 3
Finally, auto-regressive and flow-based models can be used to explicitly approximate the data density and detect abnormal samples based on their assigned likelihood. Intuitively, normal samples must have higher likelihoods compared to abnormal ones; however, will be discussed later, auto-regressive models assign an even higher likelihood to abnormal samples despite them not being seen in the training phase, which results in a weak performance in AD, ND, OSR, and OOD detection. Solutions to this problem will be reviewed in subsequent sections. To address this issue, several remedies have been proposed in the OOD detection domain, which can be used in OSR, AD, and ND; however, considering the fact that OOD detection's 's prevalent testing protocols might be quite different from other domains such as AD or ND, more evaluations on their reliability are needed. As lots of works with similar ideas or intentions have been proposed in each domain, we mainly focus on providing detailed yet concise summary of each and highlighting the similarities in the explanations. In Table | and Fig. 2 summary of the most notable papers reviewed in this work is presented along with specifications on their contributions with respect to the methodological categorization provided in this paper.
3 Anomaly and Novelty Detection
Anomaly Detection (AD) and Novelty Detection (ND) have been used interchangeably in the literature, with few works addressing the differences 122
172 There specific inherent challenges with anomaly detection that contradict the premise that the training data includes entirely normal samples. In physical investigations, for example, measurement noise is unavoidable; as result, algorithms in an unsupervised training process must automatically detect and focus on the normal samples. However, this is not the case for novelty detection problems. There are many applications in which providing a clean dataset with minimum supervision is an easy task. While these domains have been separated over time, their names are still not. appropriately used literature. These are reviewed here a shared section.
Interests in anomaly detection go back to 1969 (22 which defines anomaly /outlier as "samples that appear to deviate markedly from other members of the sample in which it occurs", explicitly assuming the existence of an underlying shared pattern that large fraction of training samples follow. This definition has some ambiguity. For example, one should define a criterion for the concept of deviation or make the term "markedly' more quantitative.
To this end, there has been a great effort both before and after the advent of deep learning methods to make the mentioned concepts more clear. To find a sample that deviates from the trend, adopting an appropriate distance metric is necessary. For instance, deviation could be computed in a raw pixel-level input or in semantic space that is learned through deep neural network. Some samples might have low deviation from others in the raw pixel space but exhibit large deviations in representation space. Therefore, choosing the right distance measure for a hypothetical space is anot challenge. Finally, the last challenge is choosing the threshold to determine whether the deviation from normal samples is significant.
3.1
Non-Deep Learning- Based Approaches
In this section, some of the most notable traditional methods used to tackle the problem of anomaly detection are explained. All other sections are based on the new architectures that are mainly based on deep learning.
3.1.1 Isolation Forests (94):
Like Random Forests, Isolation Forests (IF) are constructed using decision trees. It is also an unsupervised model because there are no predefined labels. Isolation Forests were created with the notion that anomalies are 'few and distinct" data points. An Isolation Forest analyzes randomly sub-sampled data in a tree structure using attributes chosen at random. As further-reaching samples required more cuts to separate, they are less
6

---

Published in Transactions on Machine Learning Research (11/2022)
likely to be outliers. Similarly, samples that end up in shorter branches exhibit anomalies because the tree could distinguish them from other data more easily. Fig. 3 depicts the overall procedure of this work.
0.0
X
.X
(a) Isolating 24
(b) Isolating ae
Figure 3: An overview of the isolation forest method is shown. Anomalies are more susceptible to isolation and hence have short path lengths. A normal point requires twelve random partitions to be isolated compared to an anomaly Zo that requires only four partitions to be isolated. The figure is taken from (4
3.1.2 DBSCAN 440):
Given of points in a space, DBSCAN combines together points that are densely packed together (points with numerous nearby neighbors), identifying outliers those that are isolated in low-density regions. The steps of the DBSCAN algorithm are as follows: (1) Identify the core points with more than the minimum number of neighbors required to produce dense zone. (2) Find related components of core points on the neighbor graph, ignoring all non-core points.(3) If the cluster is neighbor, assign each non-core point to it, otherwise assign to noise. Fig. depicts the overall procedure of this work.
N
O
B
Figure The minimal number of points required to generate dense zone in this figure is four. Since the surrounding these points in radius contains at least four points, Point A and the other red points core points (including the point itself). They constitute single cluster because they all reachable from one another. B and C are not core points, but they may be reached from A (through other core points) and hence are included in the cluster. Point N is a noise point that is neither a core nor reachable directly. The figure is taken from (40).

---

Published in Transactions on Machine Learning Research (11/2022)
3.1.3 LOF: Identifying Density-Basee Based Local Outliers (16):
The local outlier factor based on the concept of a local density, in which locality is determined by the distance between K nearest neighbors. One can detect regions of similar density and points that have a significantly lower density than their neighbors by comparing the local density of an object to the local densitics of its neighbors. These classified as outliers. The typical distance which point can be reachhed" from its neighbors is used to estimate the local density. The LOF notion of "reachability distance' is extra criterion for producing more stable cluster outcomes. The notions of core distance' and 'reachability distance", which are utilized for local density estimation, are shared by LOF and DBSCAN.
3.1.4 OC-SVM 1488):
Primary AD methods would use statistical approaches such as comparing each sample with the mean of the training dataset to detect abnormal inputs, which imposes an ungeneralizable and implicit Gaussian distribution assumption on the training datasct. In order to reduce the number of presumptions or relieve the mentioned deficiencies of traditional statistical methods, OC-SVM (TA was proposed. As the name implies, OC-SVM a one-class SVM maximizing the distance of training samples from the origin using a hyper-plane, including samples on one side and the origin on its other side. Eq. shows the primal form of OC-SVM that attempts find space in which training samples lie on just side, and the more distance of origin to the line, the better the solution to the optimization problem. Fach input data is specified by Zi, Φ is feature extractor, & is the slack variable for cach sample, and p characterize the hyperplane. The parameter v sets an upper bound on the fraction of outliers and also is a lower bound on the number of training examples used as the support vector.
n
min p
|
un Σ E1 -p
(1)
subject to (w (z+)) 3 p- En I....,7
& 0, S.ieLl...... I.....
Finding a hyper-plane appears be a brilliant approach for imposing a shared normal restriction on the training samples. But unfortunately, because half-space is not compact enough to grasp unique shared normal features, it generates large number of false negatives. Therefore, similarly, Support Vector Data Description (SVDDD tries to find the most compact hyper-sphere that includes normal training samples. This is much tighter than hyper-plan, thus finds richer normal features, and is more robust against unwanted noises as Eq. 2 shows. Both of the mentioned methods offer soft and hard margin settings, and in the former, despite the latter, some samples can cross the border and remain outside it even if they are normal. OC-SVM has some implicit assumptions too; for example, it assumes training samples obey a shared concept, which is conceivable due to the ono-class sotting. Also, works pretty well on the AD setting in which the number of outliers is significantly lower than normal ones however fails on high dimensional datasets. The resulting hyper-sphere is characterized by and R the center and radius, respectively. Also, C' controls the trade-off between the sphere compactness and average slack values.
min C R_a 1m1
51 + R >
(2)
subject
[Ø(2,)) all2 R² + 1....,
& > 0,i 1....,n
3.2 Anomaly Detection With Robust Deep eetooeescodes (195):
This work trains an AutoEncoder (AE) on dataset containing both inliers and outliers. The outliers are detected and filtered during training, under the assumption that inliers are significantly more frequent and
8

---

Published in Transactions on Machine Learning Research (11/2022)
have shared normal concept. This way, the AE is trained only normal training samples and consequently poorly reconstructs abnormal test time inputs. The following objective function is used:
min IIL - (P(B((DD))ll ||SS||
(3)
s.t. X- LD - S=
where E and D are encoder and decoder networks, respectively. Ln is the inlier part, S is the outlier part of the training data and À is parameter that tunes the level of sparsity in S. However, the above optimization is not casily solvable since and / need to be optimized jointly. To address this issue, the Alternating Direction Method of Multipliers (ADMM) is used, which divides the objective into two (or more) pieces. At the first step, by fixing S, optimization problem LD = X S, and the objective is I| De (Ea (LD)) Then by setting LD to be the reconstruction of the trained AE, the optimization problem on its norm is solved when S is set to be X - Lp. Since the L1 norm is not differentiable, a proximal operator is employed as an approximation of each of the optimization steps as follows:
the parameters 0 is solved such that
1 À
34 > A
Prox (2i)
+
84 <ー
(4)
0
S 82 5A
Such function is known shrinkage operator and is quite common in L optimization problems. The mentioned objective function with ||||| separates only unstructured noises, for instance, Gaussian noise on training samples, from the normal content in the training dataset. To separate structured noises such as samples that convey completely different meaning compared to the majority of training samples, L2,1 optimization norm can be applied as:
Daj 2)1/2
(5)
j=1 1=1
with a proximal operator that is called block-wise soft- seft-hhresholdig function (O0S) At the test time, the reconstruction error is employed to reject abnormal inputs.
3.3 Adversarially Learned One-Class Classifier for Novelty Detection (ALOCC) (139):
In this work, assumed that a fully normal training sample is given, and the goal is train a novelty detection model using them. At first, (R) as Denoising Auto Encoder (DAE) is trained (I) decrease the reconstruction loss and (2) fool discriminator in GAN-based setting. This helps the DAE to produce high-quality images instead of blurred outputs (84). This happens because, the one hand, the AE model loss explicitly assumes independent Gaussian distributions for cach of the pixels. And on the other hand, true distributions of pixels are usually multi-modal, which forces the means of Gaussians to settle in between different modes. Therefore, they produce blurr images for complex datasets. To address this issue, AEs can trained in GAN-basod framework force the mcan of each of Gaussians capture just one mode of its corresponding true distribution. Moreover, by using the discriminator's output (D) instead of the pixel-level loss, normal samples that not properly reconstructed can be detected normal. This loss reduces the

---

Published in Transactions on Machine Learning Research (11/2022)
False Positive Rate (FPR) of the vanilla DAE significantly. The objective function is as follows:
CR+D min max R
Ex [xxx)_log(((x)))+
B X. (log(1 [[o((--(((X])I]]
(6)
CR. ||X 1 [ CR+D + CR.
where is the input, X' is the roconstructed output of the decoder, and Pt is the distribution of the target class (i.e., normal class). This helps the model not only have the functionality of AEs for anomaly detection but also produces higher quality outputs. Furthermore, detection can be done based on D(R(X)) mentioned above. Fig. depicts the overall architecture of this work.
An extended version of ALOCC, where the R(X) network has been formed Variational AE is presented in (141). Besides, the ALOCC can not process the entire input data (images or video frames) at one step and needs the test samples to divide into several patches. Processing the patches makes the method computationally expensive. To address this problem, AVID (440) was proposed to exploit a fully convolutional work as a discriminator (i.e., D) to score (and hence detect) all abnormal regions the input frame/inage all once.
X
barget cless training sample
x
Target Class Likelihood
Encoder
Decoder
CNN
X
7
X'
[0,1]
R
D
Figure 5: An overview of the ALOCC method is shown. This work trains an autoencoder that fools discriminator in GAN-based setting. This helps the AE to make high-quality images instead of blurred outputs. Besides, by using the discriminator's 's output, a more semantic similarity loss is employed instead of the pixel-level L2 reconstruction loss. The figure is taken from (39
3.4 One-Class Novelty Detection Using GANs With Constrained Latent Representations (OC-GAN) (122):
As one of the challenges, AE trained on entirely normal training samples could reconstruct unseen abnormal inputs with even lower errors. To solve this issue, this work attempts to make the latent distribution of the encoder (EN()) similar to the uniform distribution in adversarial manner:
Hatent
(7)
E. Ex-p, [log(1 D((EN(=+))))),
where n ~ (N, 0.2), x an imput image, Pa is the distribution in-class examples, and D; is the latent discriminator. The discriminator forces the encoder produce uniform distribution on the latent space. Similarly, the decoder (De(-) is forced reconstruct in-class outputs for any latent value sampled from the uniform distribution as follows:
10

---

Published in Transactions on Machine Learning Research (11/2022)
Ivisual
- (B Dog D. (De(((())))))) E Exwpi [log(1 (x))))),
where D2 is called visual discriminator.
Intuitively, the learning objective distributes normal features in the latent space such that the reconstructed outputs entirely or at least roughly resemble the normal class for both normal and abnormal inputs. Another technique called informative negative sample mining is also employed on the latent space to actively seek regions that produce images of poor quality, To do so, classifier is trained to discriminate between the reconstructed outputs of the decoder and fake images, which are generated from randomly sampled latent vectors. To find informative negative samples, the algorithm (see Fig. G starts with random latent-space sample and uses the classifier to assess the quality of the generated image. After that, the algorithm solves an optimization the latent space make the generated image such that the discriminator detects it as fake. Finally, the negative sample is used to boost the training process.
Input Set of training daiz s, liention size N.
parmmuu A
Output: Models: Ea, De. C. Dr. D.
for deeaaiio to N do
Clasesfer updote: keep Dr Dr. La. De
" A/0, F)
Liunn ((De(ss) (. C(DD(G))
Dack propogatellsrree to change
Diseriminttr update:
bawe 6- Dal,, + Dy(b, 1)
Laad (2(eel)).0) (2.
change
Informutiv-arguii
Keep
faod..
mub-itenation lo
Lauotee C(Dvlle).
Buck prek-pppe fataaie to change la
end
Generator update: heep Dr, D..C
Auee Di6,, 1) Di(f,.0)
(D(ee)))) De(!:))l
As in previous AE-based methods, reconstruction loss is em- ployed in combination with the objective above. Reconstruction error is used as the test time anomaly score.
Rack-prepaggte
feaun 1 Frssed May to changge En. De
end
Figure 6: The training process of OC-GAN method 122)
3.5 Latent
Space Autoregression for Novelty Detection (LSA) (1):
This work proposes a concept called "surprisc" for novelty de- lection, which specifies the uniqueness of input samples the latent space. The more unique sample is, the less likelihood it has in the latent space, and subsequently, the more likely it is to be an abnormal sample. This is beneficial, especially when there are many similar normal training samples in the training dataset. To minimize the MSE error for visually identical training samples, AEs often learn to reconstruct their average as the outputs. This can result in fuzzy results and large reconstruction eтrors for such inputs. Instead, by using the surprise loss in combination with the reconstruction error, the issuc is alleviated. Besides, abnormal samples are usually more surprising, and this increases their novelly score. Surprise score learned using an aulo-regressive model on the latent space, as Fig. 7 shows. The auto-regressive model (h) can be instantiated from different architectures, such as LSTM and RNN networks, to more complex ones. Also, similar other AE-based methods, the reconstruction error is optimized. The overall objective function is as follows:
L = (0 0p) + X (0, 0%)
(9)
= Ex || 2| - X log( (og(h((;00)) (x)]] = == [xx 0x),
where LRee and LLLKK are the reconstruction and surprise terms. The parameters of the encoder, decoder, and probabilistic model are specified by 0g, OD and 0n, respectively. x is the input, f the encoder, and X controls the weight of LL.KK.
3.6 Augmeneed Deep Autoencoder for Unsupervised Anomaly Detection (Mem-An -E)
49
This work challenges the second assumption behind using AEs. It shows that some abnormal samples could be perfectly reconstructed even when there not any of them in the training dataset. Intuitively, AEs
11

---

Published in Transactions on Machine Learning Research (11/2022)
Labert
memoory
Reconstruct error
Inaut sample
Reconstruction
Novelty
score
Localization
map
Likiltooo
latent vector (()
Novelty
Hude Extmatioon network
Van enters
Home
conditionals
Figure An overview of the LSA method shown. A surprise score is defined based on the probability model. Also, reconstruction error is simultaneously optimized normal training samples. The figure is taken from (.
distribution of embeddings. The probability distribution is learned using
may not learn to extract uniquely describing features of normal samples; as result, they may extract some abnormal features from abnormal inputs and reconstruct them perfectly. This motivates the need for learning features that allow only normal samples to be reconstructed accurately. To do so, Mem-AE employs a memory that stores unique and sufficient features of normal training samples. During training, the encoder implicitly plays the role of memory address generator. The encoder produces an embodding, and memory features that are similar to the generated embedding are combined. The combined embedding is then passed to decoder to make the corresponding reconstructed output. Also, Mem-AE uses sparse addressing technique that uses only small number of memory items. Accordingly, the decoder in Mcm-AE is restricted to performing the reconstruction using small number of addressed memory items, rendering the requirement for efficient utilization of the memory items. Furthermore, the reconstruction error forces the memory to record prototypical patterns that are representative of the normal inputs. To summarize the training process, Mem-AE (1) finds address Enc(z)
from the encoder's output; (2) measures the cosine similarity d(z,, m²) of the encoder output with each of the memory elements my (3) computes attention weights w, where each of its elements is computed as follows:
exp(d(z,ma)
(10)
Σ ==1 ex)(d(2,m,))
(4) applics address shrinkage techniques to ensure sparsity:
10 max(w: ww X, O).
(11)
[W; Al +e
T E(w") = Σ
wi log log():;),
(12)
where is the reconstruction error and used as the test time anomaly score. Fig. g shows the overview architecture.
and finally, the loss function defined as 13
1 Σ [R(x +a((")
L(e,, 0a, M)
(13)
where de and 0a denote the parameters of the encoder and decoder. x² denotes training samples and x denote the reconstructed sample corresponding the each train-
12

---

Published in Transactions on Machine Learning Research (11/2022)
Memory module
Memory M
Eneaderr
Decoder
Irput
Memory Ackhessiingg
Rec.
X
fe(1)
Z
Attention addreesing with Hard shrinkage
Sa()
X
Figure 8: An overview of the Mem-AE method is shown. Each sample is passed through the encoder, and latent embedding is extracted. Then using the cosine similarity, some nearest learned normal features are selected from the memory, and the embedding & is made their weighted average. At last, the roconstruction error of the decoded & and input is considered as the novelty score. The figure taken from 49
3.7 Redefining the Adversarially Learned
Classifier Training Paradigm (Old-is-Gola (189):
This work extends the idea of ALOCC (39) As ALOCC is trained GAN-based setting, suffers from stability and convergence issues. On one hand, the over-training of ALOCC confuse the discriminator D because of the realistically generated fake data. On the other hand, under-training detriments the usability of discriminator features. To address this issue, a two-phase training process is proposed. In the first phase, similar training process as ALOCC is followed
C= LR
(14)
As phase one progresses, low-epoch generator model gold for later use in phase two of the training is saved. The sensitivity of the training process to the variations of the selected epoch is discussed in the paper.
During the second phase, samples X = G are considered high-quality reconstructed data. Samples Xlow (X) are considered as low-quality samples. Then, pseudo anomaly samples are created as follows:
gol)(X,) gold (X,) + gold (X;)
X
2
(15)
pseudo ((
After that, the discriminator is trained again to strengthen its features by distinguishing between good quality samples such as {X and low-quality or pseudo anomaly ones such as {loow pseudo } as follows:
aa Ex log((1 - + + (1-a) Ex (log(1 D(8)))
max D
+ (B E fmo [log(1 D(}1ow))]]
(16)
(1 3) Eueend (loge D(A ((Dsoudoo)))
In this way, does not collapse as in ALOCC, and D(g(X)) is used as the time criterion. Fig. shows the overall architecture of this method.
13

---

Published in Transactions on Machine Learning Research (11/2022)
Phaxe one bascling training
Nermal only trining
Test
High quality recoastructed 8
Imagge X
Anomaly
Disriiinstor
Pecudo-anomall
Pecud-asantnlly mesertmened grodd
modale
Old state
quality resonstmeted image X
g
quality Had quality cuanlles poth.
Figure 9: An overview of the Old-Is-Gold method is shown. The architecture is similar to ALOCC; however, it saves the weights of the network G during the training process, which are called Gold, Then, Gold is employed to make some low-quality samples that the discriminator is expected to distinguish as normal. Also, some pseudo abnormal samples are generated by averaging each pair of normal low-quality samples, which the discriminator is supposed distinguish as fake inputs. This makes the discriminator's fcatures rich and stabilizes the training process. The figure taken from (189).
3.8 Adversarial Mirrored Autoencoder (AMA) (159):
The overall ure of AMA similar to ALOCC. However, it challenges the first assumption AEs. It has been shown that 4p norms are not suitable for training AEs in the anomaly detection domain since they cause blurry reconstructions and subsequently increase the error of normal samples. To address this problem, AMA proposes to minimize the Wasserstein distance between joint distributions Px,x and P Px,x. The objective function is as follows:
xxxx
max ExwPx (D(X,X) -X(X, DELip-1
(17)
where X is the reconstructed image.
15 showed that by forcing the linear combination of latent codes of pair of data points look realistic after decoding, the encoder learns better representation of data. Inspired by this, AMA makes use of X Ximer- obtained by decoding the linear combination of some randomly sampled inputs:
min max Ex (D(X,X) D(X, Xinter) G DELip-1
(18)
To further boost discriminative abilities of D, inspired by (27). normal samples are supposed as residing in the typical set (28) while anomalies reside outside of it, a Gaussian regularization equal to L2 norm is imposed on the latent representation. Then using the Gaussian Annulus Theorem (170) stating that in a d-dimensional space, the typical set resides with high probability at a distance of vd from the origin, synthetic negatives (anomalies), are obtained by sampling the latent space outside and closer the typical set boundaries. Therefore, the final objective function is defined follows:
14

---

Published in Transactions on Machine Learning Research (11/2022)
min max DELip-1
fnormal -Aneg Lueg
norral -RNPxx D(X,X) D)
(19)
Ainter (D(X, -XX, 8iter)) )) + Areg [|E(X)]]
Lngg
E3 xnxi D(X, D(X, Xnez)
Fig. shows an overview of the method and the Lest time criterion is the penultimate layer of D.
G(X,G) where f
time
space by Simplex Interpolation Atypical during training
Fit R(Nuaa) scores to gousstan
Nean
module
N (Hrrran
R(Haud)
A(Nowe
D
module
A(kar) is the likebbood R(s.>) under training distribution
RDO
(6) AMA Module
Inference time
Figure 10: An overview AMA method shown. The architecture is similar to ALOCC; however, does not try to minimize reconstruction error between and é. Instead, a discriminator is trained with Wasserstein Loss to minimize the distance between the distribution (z) and (z, 2). In this way, it forces to be similar to without using any norm that causes blurred reconstructed outputs. Moreover, some negalive latent vectors are sampled from low probability areas, which the discriminator is supposed to distinguish as fake ones. This makes the latent space consistent compared to the previous similar approaches. The figure is taken from (159).
3.9 Unsupervised Anomaly Detection with Generative Adversarial Networks to Guide Marker Discovery (AnoGAN) (147):
This work trains a GAN on normal training samples, then at the test time, solves an optimization problem that attempts to find the best latent space by minimizing a discrepancy. The discrepancy found by using a pixel-level loss of the generated image and input in combination with the loss discriminator's features at different layers when the generated and input images are fed. Intuitively, for normal test time samples, a desired latent vector can be found despite abnormal ones. Fig. II shows the structure of the method.
As inferring the desired latent vector through solving optimization problem is time-conssmmng, some extensions of AnoGAN have been proposed. For instance, Efficient-GAN (911 trics to substitute the optimization problem by training an encoder E such that the latent vectors 2' approximate the distribution of z. In this way, E is used to produce the desired latent vector, significantly improving test time speed. Fig. 12 shows the differences. The following optimization problem (20) is solved at the test time to find z. The anomaly score is assigned basod on how well the found latent vector can minimize the objective function.
min (1-
1x x G(z) IGx + Σ D(x) D(G()))
(20)
15

---

Published in Transactions on Machine Learning Research (11/2022)
(b)
Real
z
+
Generated G(z)
normal
Generator
Discriminator
anomalous
Figure 11: An overview AnoGAN method. At first, a generator network G and a discriminator D are trained jointly on normal training samples using the standard training loss, which yields semantic latent representation space. Then at the test time, an optimization problem that seeks to find an optimal latent, embedding that mimics the pixel-level and semantic-level information of the input is solved. Intuitively, for normal samples, good approximation of imputs can be found in the latent space; however, it is not approximated well for abnormal inpuls. The figure is taken from 147
2
G(z)
Z
(zz)
x!
x
D(x, x!)
z'
E(x)
x
D(x, x')
A
B
Figure 12: Figure A shows the architecture of AnoGAN. Figure B shows the architecture of Sfficient-GAN The encoder E mimics the distribution of the latent variable z. The discriminator D learns to distinguish between joint distribution of (x, 2) instead of The figure is taken from (177)
3.10 Deep One-Class Classification (DeepSVDD) (136):
This method can be seen as an extension of SVDD using deep network. assumes the existence of shared features between training samples, and tries to find latent space in which training samples can be comprossod into minimum volume hyper-sphere surrouniing them. Fig. shows the overall architecture. The difference w.r.t traditional methods is the automatic learning of kernel function by optimizing the parameters W. To find the center e of the hyper-sphere, AE is first trained the normal training samples, then the average of normal sample latent embeddings is considered as After that, by discarding the decoder part, the encoder is trained using the following objective function:
n |ols; W)
min W
c113
(21)
n
where W shows the weights of encoder's (th layer. At the test time, anomaly score is computed based on |1];;; W*) cll2 where W denotes trained parameters.
16

---

Published in Transactions on Machine Learning Research (11/2022)
X
@(:W)
F
An overview of the DSVDD method is shown. It finds a minimum volume hyper-sphere that contains all training samples. As the minimum radius is found, more distance to the center expected for abnormal samples compared to normal ones. The figure is taken from (36).
Figure 13:
3.11 Deep Supi-Supervised Anomaly Detection (177):
This is the semi-supervised version DSVDD which assumes a limited number of labeled abnormal samples. The loss function defined to minimize the distance of normal samples from a pre-defined center of a hyper-sphere while maximizing abnormal sample distances. The objective function defined follows:
min [2;;; W) - -cll2+
(22)
n m (1l((f W) cl13)0s A 2
||
where d(0;;; W) is deep feature extractor with parameter W.
Note that, as mentioned above, there access to Mi). (I'm Ffm) X with Y = (-1,++1} where 0 denotes known normal samples and Ò = -1 otherwise. is specified completely similar DSVDD averaging on the latent embeddings of AF trained normal training samples. From somewhat. theoretical point of view, AE's objective loss function helps the encoder maximize ((X; Z) in which X denotes input variables and Z denotes latent variables. Then, it can be shown that (22 minimizes the entropy of normal sample latent embeddings while maximizing it for abnormal ones as follows:
H(Z) = El- = - = logp()) da
(23)
< log((2ne))det(()) log o²
As the method makes normal samples compact, it forces them to have low variance, and consequently, their entropy is minimized, The final theoretical formulation is approximated as follows:
max T(X; + ((H p(=|z)
(24)
Here, I specifies the mutual information and a regularization term obtain statistical properties that is desired for the downstream tasks.
3.12 Deep Anomaly Detection Using Geometric Transformations (GT)
48
GT attempts reformulate the one-class classification problem into a multi-class classification. GT defines set of transformations that do not change the data distribution, then trains classifier to distinguish between
17

---

Published in Transactions on Machine Learning Research (11/2022)
them. Essentially, the classifier is trained in self-supervised manner. Finally, Dirichlet distribution is trained on the confidence layer of the classifier to model non-linear boundaries. Abnormal samples are expected to be in low-density areas since the network can not confidently estimate the correct transformation. At the test time, different transformations are applied to the input, and the sum their corresponding Dirichlet probabilities assigned as the novelty score. An overview of the method is shown in Fig. 14
(To(()))
y y(Ti(x))
fo(x)
yTT2
y yTTx-1x)))
Figure 14: An overview of the GT method is shown. A set of transformations is defined, then classifier must distinguish between them. Having trained the classifier in a self-supervised manner, Dirichlet distribution is trained on the confidence layer to model their boundaries. The figure is taken from 48
3.13 Effective End- End Unsupervised Outlier Detection via Inlier Priority of Discriminative Network 1722
In this work, similar to GT, a self-supervised learning (SSL) task is employed to train an anomaly detector except in the presence of a minority of outlicrs or abnormal samples in the training datasct. Suppose the following training loss is used as the objective function:
Las(x;1 ()
Σ
log log(p (P())))))))))) (v) (0)),
(25)
where (1) is obtained by applying a set of transformations O(. v), and y indicates each transformation. The anomaly detection obtained based on the objective function score. Take for example the rotation prediction task. During training, the classifier learns to predict the amount of rotation for normal samples. During test time, different rotations applied inputs, the objective function scores for normal samples would be lower than abnormal ones.
However, due to the presence of abnormal samples in the training dataset, the objective score for abnormal samples may not always be higher. To address this issue, it is shown that the magnitude and direction of gradient in each stop have a significant tendency toward minimizing inlicr samples' loss function. Thus the
network produces lower scores compared to abnormal ones.
(172) exploits the magnitude of transformed
inliers and outliers' aggregated gradient to update we, i.c. follow this approximation:
|| we
(in)
L|l and ([ut) L]|, which are shown to
E Wc
(in) -1
N
in
(26)
V ta
(out) L
N2
18

---

Published in Transactions on Machine Learning Research (11/2022)
where E() denotes the probability expectation. As Nu Nout normal samples have more effect the training procedure. Also, by projecting and averaging the gradient in the direction of each of the training -VL((a))
sample's gradient (-VoL(x) [==)+/>))] ) the stronger effect of inlier distribution outlier is observed
again. Fig. 15 shows the effect empirically.
Magnitude of Gradient
Magnitude of Gradient
Magnitude of Gradient
40
40
30
Inliers
Inliers
20
Inliers
20
Outliers
20
Ouiliers
Outlies
10:
200
200
200
Iterations
Iterations
Iterations
(a) MNIST ("3")
(b) F-MNIST ("bag") (c) CIFARIO ("horse")
Figure 15: The average magnitude of the gradient for inliers and outliers with respect to the number of iterations. The class used as inliers is in brackets. The figure is taken from (72).
3.14 Classification Based Anomaly Detection for General Data (GOAD) 12):
This work is very similar GT. trains network classify between different transformations (T); however, instead of using cross-entropy loss training a Dirichlet distribution the final confidences, finds a center for each transformation and minimizes the distance of each transformed data with its corresponding center follows:
(=1m)(((mm)))--m Σm [[T(((
P(m' T(x,m))
(27)
where the centers Cm are given by the average feature over the training set for every transformation i.e. Cm Erex f(T(2, m)). For training two options are used. The first one is using simple cross entropy P(m' [T(x, m)) values, and the second one is using the center triplet loss (33 as follows:
Σ max (I m)) - Cy
(28)
mm min [I](T(;,, - Cm 113)
where is margin regularizing the distance between clusters.
The idea can be seen as the combination of DSVDD and GT in which GT's transformations are used, and different compressed hyperspheres are learned to separate them. M different transformations transform each sample at the test time, and the average of correct label probabilities assigned as the anomaly score.
3.15
CSI: Novelty Detection via Contrastive Learning on Distributionally Shifted Instances (165):
This work attempts to formulate the problem of novelty detection into contrastive framework similar to SimCLR (25). The idea of contrastive learning is to train an encoder Sa to extract the necessary information to distinguish similar samples from others. Let æ a query, 24, and x be a set positive and negative samples respectively, 2 be the encoder's output feature or the output of an additional projection layer (f (z)) for each input, and suppose sim(2, z²) is cosine similarity. Then, the primitive form of the contrastive loss is defined follows:
19

---

Published in Transactions on Machine Learning Research (11/2022)
1 ExEr, cdim(((a))((2))>> x+
Teon (t,)
log Ex'Ez-ur_ cdim(3(2),
(29)
Specifically for SimCLR, the contrastive loss above is converted into the formulation below:
(B;T) 2B
Σ Tecon ( , B_z)
(30)
+ Leou (2 ( (11) B_:))
where ( = (f) T2(x:) for the transformations Ti and T2 from set of transformations T, B : {a:) and B_ (2)" 1i (s/"))) 1aft
However, contrastive learming requires defining a set of negative samples. To this end, a collection of transformations that shift the distribution of training samples (S) is specified to make the desired negative set when applied on each input. For instance, rotation or patch permutation completely shifts the original input samples' distribution; and can therefore be used as negative samples. Another set transformations called align transformations (T") is defined as not changing the distribution of training images much as (S). Then the Contrasting shifted instances (CST) loss be defined as follows:
Loon-Si == LSmmCL (USES By;
(31)
where := {s(x)) Here, CST considers each distribbutionally--hiiiedd sample as an OOD with respect to the original sample. The goal is to discriminate an in-distribution sample from other OOD i.e., (s E S) samples.
Further, to facilitate fo to discriminate each shifted instance, a classification loss for classifying shifted instances is defined in combination with Lcon-St- To do so, a linear layer for modeling an auxiliary softmax classifier Sy æ) is added to So as in GT or GOAD:
1 EVE - -lg Pe = [$,),
Lehs.
(32)
2B K SES
where B, is the batch augmented from B.. testing, the cosine similarity to the nearest training sample in {am) multiplied by the norm of representation ||=(=)] used. The contrastive loss increases the norm of in-distribution samples, it is an easy way minimize the cosine similarity of identical samples by increasing the denominator of 229 To further improve the scoring criterion, ensembbling over random augmentations utilizing shifting transformations similar to GOAD can be employed.
3.16 DA-Contrastive: Learning and Evaluating Representations for Deep One-class Classification (158):
This research tries to put the problem of novelty detection into contrastive framework, similar to the other methods mentioned previously in (165) and (88). (165) reports that all of the augmentations that are utilized in the contrastive loss presented at 29 are not necossarily effective for the one-class lcarning. As result, rotated versions of the input are treated as separate distributions in this study, and are accounted as negative samples in contrastive loss. Positive samples are also created by applying augmentations to each distribution, such as color jittcring. Finally, the one-class classifier trained on the positive and negative samples in a contrastive learning manner. After, a KDE or OC-SVM (148) trained on the learned representation of normal training samples, which is used at the test time. An overview of the method can be seen in Fig. 16
20

---

Published in Transactions on Machine Learning Research (11/2022)
push
Inbe Aup
ariforryy.
argreettaioe.
Figure 16: An overview of the DA-Con DA-Contrastive method represented. This work trains a one-class classifier employing a novel variant of contrastive learning with distribution augmentations such that the class collision between examples from the same class is reduced. This implies discriminating different distributions generated by augmentations of different rotations from the original imput (see the right side), which results in less uniformity and more compactness in the feature space (see the left side). The figure is taken from (158)
3.17
Uninformed Students: Teacher Anomaly Detection With Discriminative Latent Embeddings (14):
This work trains a teacher network using metric learning and knowledge distillation techniques to provide semantic and discriminative feature space. The teacher T is obtained by first training network T that embeds patch-sized images p into metric space. Then, fast dense local feature extraction for an entire input image can be achieved by deterministic network transformation from T to T, as described in (8). To train 7, a large number of training patches p are obtained by randomly cropping an image database, for instance, ImageNet. Then using the following knowledge distillation loss, the knowledge of a pre-trained network P is distilled into I as follows:
L =
(33)
where D is used to align the size of output spaces. This helps the use of computationally efficient network f instead of P at the test time while the required knowledge is distilled.
To further enrich the feature space of f, an SSL method employed such that the feature space of patches that are obtained by applying small translations, small changes in the image luminance, and the addition of Gaussian noise to p be similar. This set called pt as opposed to p", which is obtained using random cropping regardless of the neighborhood to the patch p. The SSL loss is defined as follows:
8t =17(0) - f(p))
8 = min [T )1" - 1(x ))}}}
(34)
Lm (f) max 8
where 0 denotes the margin parameter. Finally, reduce the redundancy of feature maps of 7, a compactness loss which minimizes their cross-correlation used follows:
Le(T) = Σ
Ci
(35)
therefore, the final loss is LL(T) + (m) + (T())
Having teacher T trained comprchensively to produce dimensional feature maps for each pixel of an input image, an ensemble of student networks is forced to approximate the feature maps of T for each pixel located at row and column as follows:
21

---

Published in Transactions on Machine Learning Research (11/2022)
I(S.) = wh (1,c)
Σ 11 - -W(rr)) - 1)ddiag()
(36)
where μ and are used for data normalization, note that the receptive field of each student is limited to local image region P(r.c), this helps the students obtain dense predictions for each image pixel with only a single forward pass without having to actually crop the patches P(r.c)- At the test time, as students have only learned to follow their teacher on normal training samples, their average ensemble error can be used to detect abnormal samples. Intuitively, they wouldn't follow their teacher on abnormal samples and produce a high average error.
3.18 Self- Supervised Learning for Anomaly Detection and Localization (CutPaste) (90):
This work designs simple SSL task to capture local, pixel-level regularities instead of global, semantic-level ones. While GT or GOAD utilize transformations such as rotation, translation, or jittering, Catte cuts a patch of its training imput and copies in another location. The network is trained to distinguish between defected samples and intact ones. Extra auxiliary tasks such cutout and Scar can be used in combination with the cut-paste operation. After training, KDE Gaussian density estimator is trained on the confidence scores of normal training samples, which is used at the test time. Due to the simplicity of the method, it may overfit easily on the classification task. However, several experiments in the paper show contrary to this assumption. An overview of the method can be seen in Fig. 17
score
GradCAM
Image- levall Patch-leval
Anomaly score (spatial max pooling)
Heatmap (Upsamplcd)
CNN
GDE
CuiPasle
(a) Learning Self-Supervised Representation
(b) Anomaly Detection and Localization
Figure 17: An overview of CutPaste. network is trained classify artificially made defected samples from the original ones. Despite the simplicity of the method, it does not overfit, MV dataset. The figure is taken from 90
3.19 Multiresolution Knowledge Distillation for Anomaly Detection (Multi-KD) (144):
Generative models are suited for detecting pixel-level anomalies; however, they may fail on complex, semantic- level ones. In contrast, discriminative models are good at capturing semantics. Designing an SSL. task that captures both semantic and syntax is not easy. To address this issue, Multi-KD attempts mimie the intermediate layers of VGG pre-trained network-caller intermediate knowledge- into simpler network using knowledge distillation. This way, multi-resolution modeling of the normal training distribution is obtained and can be used to detect both pixel-level and semantic-level anomalics at the test time. Here, the concept of knowledge is defined to be the length and direction of a pre-trained network on ImageNet (3I). A cloner network has a simple yet similar overall architecture compared to the source, making its knowledge similar the source on normal training samples. At test time, the cloner can follow the source on the normal test time samples; however, fails for the abnormal ones. This results in high discrepancy that can be used at test time. Fig. 18 shows the overall architecture.
22

---

Published in Transactions on Machine Learning Research (11/2022)
Similar methods exist, which model the distribution of different layers of pre-trained network using multivariate Gaussian descriptors such as PaDiM (0) or 134 An overview of the architecture of (134) is
shown in the Fig. 19
Scusce Network
Hestunpp
Ameralio daeanne
Nermal cims Uliatte recios
Text sanplaa dionacce vecions
Anandd Noy
Chiree Nerwok
Incrpecnettlty Algoniten
Chanct Andhieetun
Figure 18: An overview of the Multi-KD method is shown. Tt distills multi-resolution knowledge of a pre-trained source network on the normal training distribution into a simpler cloner one. The structure of source and cloner is similar lo each other. Therefore, the cloner distills the source's knowledge in the corresponding layers. At the test time, their discrepancy would low for normal inputs as opposed to abnormal ones. The figure taken from
Level
3
5
7
8
224 x 224
112 x 112
112 x 112
56 56
28 28
14 x 14
14 14
xx7
7X1
16
40
80
112
192
320
1280
M1
M2
M3
M4
M5
M6
M7
Mg
Mg
M
Figure 19: An overview of (144). It models the different layers' distribution of pre-trained network using Gaussian descriptors. Then, at the test time, the probability of being normal is computed using the training time means and variances. The figure is taken from (134.
4 Open-set Recognition
Open-set recognition (OSR) receives more supervision than AD or ND. In this setting, K normal classes are given at the training time. At testing, N classes with N K unknown and K known classes exist. The objective is to identify unknown classes while classifying the known ones. This has lot of applications in
23

---

Published in Transactions on Machine Learning Research (11/2022)
which labeling normal datasets is more feasible, gathering cleaned dataset without having any abnormal sample is possible. As there is more supervision, training data can be categorized into four classes:
known known classes (KKC): Training samples that we know they are known. They are alroady given and labeled.
known unknown closses (KUC): Training samples that we know they are not known. This means, they do not belong to the known categories. For example, background images, or any image that we know not categorized into the known classes are this group. They are already given and labeled.
unknown known classes (UKC): Training samples that we do not know they known. For example, known test time samples are in this group. These not given at the training phase.
wnknown wnknown classes (UUC): Training samples that we do not know they are not known. For example, unknown test time samples are in this group. These are not given at the training phase.
The space that is far from known classes, including KKC and KUC, is called open space O 144)
Labeling
any sample in this space has a risk value denoted by Ro. The risk factor is usually represented as Eq. 37 in which So the overall measuring space, and f is the measurable recognition (classification) function 1451. The value of f is if the input belongs KKC otherwise
Ro(f) = So ((x) de Js, f(z) dr
(37)
As discussed in (47), there are some difficulties in defining the practical formulation of openness; therefore, this study uses the definition of (47) as in Eq. 38 where CIa is the set of classes used in training, and Cre is the set of classes used in the testing.
2 |CTRR [CTRl + [CTE
0 0=1-1
(38)
Larger values of O correspond to more open problems, and 0 is assigned to a completely closed one. OSR problem can be defined as finding recognition functions f in such a way that minimizes the risk factor Ro.
4.1 Towards Open Set Deep Networks (OpenMax) 11):
This work addresses the problem of overconfident scores of classification models for unseen test time samples. Due to the normalization in softmax computation, two samples with completely different logit scores may have the same confidence score distribution. Instead of using the confidence score, Open resorts to the logit scores that are shown by Activation Vector (AV). AV of each sample captures the distribution over classes. The mean AV (MAV) is defined be the average of AV values across all samples. As for each input sample, the value AV corresponding the corresponding value of MAV would be high too. Considering the distance of each element in AVs from the corresponding element in MAV random variable, correctly classified inputs would have the highest distances for ground truth elements. This might happen for few classes that are not ground truth but have strong relationship with ground truth. For instance, the class leopard as the ground truth and cheetah as a near class. To model the dist ribution of these highest values, the Extreme Value Theorem (EVT) can be used as follows:
the ground truth is supposed to be high; its distance
EVT: Let (S1, 82, .... sn) be a sequence i.i.d. samples. Lot M, max(s1, ... sn). If sequence of pairs of real numbers (an, bw) exists such that each 0 a, and
24

---

Published in Transactions on Machine Learning Research (11/2022)
Mx - bn <x F())
lim P 12-00
(39)
Op
Then if F is a non-degenerate distribution function, it belongs to one of three extreme value distributions (26). For this work, the Weibull distribution is used. By modeling the distribution of extremes for each class, one can easily compute the probability of each test input being an extreme and discard remaining ones.
In summary, during training, the CDF of extreme values for each class or element. of AVs are approximated using EVT and correctly classified training samples. For each test-time input sample, the top a clements in AV are selected, representing ground truth and near classes; then, their CDFs are assigned to variables (a) Fig. 20 shows. These probabilities represent the chance of each AV's element by (2))) to be the maximum. After that, an arbitrary class is added to the existing ones the representative of unknown unknown samples, assumed as class 0, and all activation values are normalized as follows:
6(x) = v(x) o w(x)
60(x) = Σ - (w;))[-w;x)))
(40)
The normalization performed so that the activation vector of UUC would be high Wa(g) (r)s are small. Finally, softmax is computed based on the normalized activation vector, and unknown or uncertain inputs are rejected. All dyper--arameee such as tuned using validation set including both seen and unseen samples.
Algorithm OpenMax probability estimation with rejection of unknown or uncertain inputs.
uN (x) Require: means nı and libMR models PJ (T,, (1, 1E2) Require: o, the numer of "lop" classes to revise Let a(i) (1))))t(()(<r))) Let wy
Require: Activation vector for v(x) = Un
2: for = 1....,a a do
| *x())
3: (x()()) = 11 aite
Ao(t)
end for
5. Revise activation vector ((x)
v o (x))
Define êo(x) E; [x(((( - (z(2)).
7:
e)(x)
P(y = j|x)
ΣN (x)(
Let y" argmax, P1y=jix 9: Reject input if = 0 or P(y - x01x)
The inference algorithm of open-max. The class 0 is added in addition to other classes and considered as the unknown class; then, its probability is computed for each of the input samples, and the probabilities of top k values are normalized with respect to the unknown class's probability. At last, if the most significant value is for class 0 or the confidence of top & values is less than a specific amount, the sample is discarded. The figure is taken from (TT).
Figure 20:
4.2 Generative OpenMax for Multi-Class Open Set Classification (G-OpenMax) (46):
This work is similar to OpenMax with exceptions of artificially generating UUC samples with GANs and fine-tuning OpenMax. This removes the need to have validation dataset. To generate UUCs, conditional
25

---

Published in Transactions on Machine Learning Research (11/2022)
GAN is trained on the KKCs follows:
min max Rr (og(DD(zrc))
(41)
+ Pe-Ps c- [log(1 Do(GG(2,c),))).
where D is the discriminator with parameter 0, and G is the generator with parameter é.
New samples are generated by interpolating the KKCs latent space. the generated sample is not classified as one of the mixing labels, the image is considered UUC. Finally, another classifier called Net (see Fig. 21 is trained using both UUC and KKC samples such that UUCs can be assigned to the class 0 of the classifier. The inference steps are similar to OpenMax except that the normalization process for the class 0 and other classes is the same.
OpenMax
OpenMax
Known Class
Net
Net
Extrome Valuo Theory pi..k
G-OpenMax
G-OpenMax
Calibrate Score
Known C1...K
Net
Net
Extremn Value Theory (fi..
GAN Unknown
Class CK-1
K+-1
(a) Pre-Network Training
(b) Soore Calibration
Figure 21: The overall architecture of G-OpenMax compared the base OpenMax. As it is shown, everything is completely the same except the unknown unknown sample generation, which is done using GAN. The figure is taken from 46).
4.3 Open Set Learning with Counterfactual Images (OSRCI) 111
This work follows the idea of generating UUC samples as in G-OpenMax. A generated input is made similar to KKC yet not to be assigned to the same class. Such generated inputs are called counter-factual examples. As these samples are near the boundary of UUCs, they can better help approximate the real UUC distribution.
Spocifically, a classifier is trained on & classes. A GAN-based method such as ALOCC is trained. The discriminator trained using a Wasserstein critic with gradient penalty as follows:
LD = D(GG(E(=)) D(2))
ZEX
(42)
LG Σ - xEX
where P(D) is the interpolated gradient penalty term, E encodes the input, D is the discriminator, and G is the generator.
The counter-factual samples are generated by optimizing a latent voctor 2, which has a small distance to the latent vector of an arbitrary training sample æ while decoded image produces low confidence scores for each of the known classes:
K
min E(x)1B + log (1
e (x(C()))
(43)
where Ck the classifier and (G))) the logit of the counterfactual image G(z) for class i. The generated UUCs are used in combination with KKCs train new classifier Cк+1, which used at the test time.
26

---

Published in Transactions on Machine Learning Research (11/2022)
4.4 Reducing Network Agnostophobia (33)
In applications such as object detection, there is usually a class called background. On the internet, a large number of samples can be crawled, which can be used as "background" for a specific task. This work employs background samples an auxiliary KUC distribution to train a classifier. The training facilitates KUC to have small feature magnitudes while KKCs have larger magnitudes with defined margin. Also, the entropy of the confidence layer is maximized for the background samples, which is equivalent to increasing the classifier's 's uncertainly for such inpuls. The training employs simple entropic open-sel loss that maximizes the entropy of confidence scores, along with the objectosphere loss minimizing the L2 norm of final features. Fig. 22 shows the effect of cach loss on the geometric location of cach class's samples at the final layer. At the test time, the thresholding is based on Fc())-1[F(x)], where F(x) is the representation from penultimate layer.
3200
1033
1000
100
60 61 02
01
01
65 06 04 64 10
00 21 62 DE 65 a6 07 L4 as
45 01
as
07 0a da 24
(a) Softmax
(b) Background
(c) Objectosphere
The effect of different loss functions on the last layer of a classifier. The classifier is trained on the MNIST dataset. The background class is considered to be NIST letters (5I). Black dots show samples from Devanagari (T))) UUCs, and the gray lines show the boundarics of different classes. (a) shows the last layer when the network is trained only with softmax loss. (b) shows similar setting to (a); however, background samples are used as a separate class. (c) shows the last layer when the network is trained with the objectosphere loss. The figures in the bottom are histograms of softmax probability values for samples of KKCs with green color and UUCs with the red one. The figure is taken from (3)
Figure 22:
4.5 Class Conditioned Auto-Encoder for Open- Set Recognition (C2AE) (117):
The second premise behind employing AEs is used in this study, which states that abnormal test time samples should not be reconstructed well normal ones. Nevertheless, despite AD and ND, in OSR, training labels are used to increase AE abilities. Here, an AE is used as the meta-recognition function while its encoder plays the role of a classifier for the recognition task. Intuitively, this work wants the encoder to classify each passed sample correctly and provide embeddings by which the reconstruction of the original input is possible. Furthermore, it imposes other constsaints to force encoder embeddings not to be easily converted to each other, c.g., by applying linear transformations, which prevents the AE from utilizing the learned features reconstruct abnormal/ unneen inputs.
To this end, at first, the encoder that is classifier is trained and fixed. Then for given input X, match vector 4,, = ly-- E f- where K is the number of classes is defined such that I is equal to 1 for the y'th element and -1 herwiiee. Similarly, some none-match vectors Lam = Lynm for any random yn" + sampled randomly from labels are considered. After that, two neural networks H, and H3 with parameters O, and O are defined to receive match and nono-match vectors and produce some linear transformations by which the encoder embeddings are transformed. Finally, match transformations must be constructed perfectly; however, none-match ones are forced to have high reconstruction loss follows:
27

---

Published in Transactions on Machine Learning Research (11/2022)
24 F(Xi),
7pp H. (1p
7pp
Hy (1y(1
BOT H (by
Bem Hz(pgr)) m
PO!" O 24 + -
Zihmm = Vugm o 2s + Syg
X
(z
8pmm (=)mmm))
(44)
N
D
||x
N
1=1
N
1
C
|
X 1|2
N
where Eams are sampled randomly based on randomly sampled none-match vectors, and the objective loss is:
min C + (1 - a) Lr
(45)
0g.00
The embedding transformation technique called FiLM (25). This means that a given input would be reconstructed well only when the corresponding match vector used. Therefore, for each test-time input, the roconstruction error under different match vectors is computed, and the rejection decision is made basod on their minimum value. If the minimum value is greater than a threshold 5 it is discarded; else, the encoder's output is assigned. To obtain in principled way, the optimum threshold is found using EVT on the distribution of match and nonc-match reconstruction error values i.e ||X, X1'Il1 and |X; - XxmIIh for each and randomly sampled nonc-match vectors. Assuming the prior probability of observing unknown samples is Pu; the probability of error as a function of threshold 7 shown in Eq. 46 where Gm and Gan are the extreme value distributions of the match and none-match errors.
+" min Pervor(T) (T)
= min[(1 - Pw)) (r 2 T) + Pa Paml-r -T))
(46)
min[(1 pw.) Gm (T) + Pu * Gum(
4.6 Deep Transfer Learning For Multiple Class Novelty Detection (DTL) 1121:
This work also follows the idea of using a background dataset (called reference dataset). Similar to (33), DTL addresses the deficiencies of using softmax loss in OSR. A new loss function called membership loss (Las) is proposed. Specifically, each activation score value ft of the penultimate layer is normalized into [o, 1] using the sigmoid function. The normalized scores can be interpreted as the probability of the input image belonging to each individual class. Tdeally, given the label y, f(x), should be 1 when y = and otherwise. The loss function is defined Eq. 47
(M, = (1- c-1
Σ [o(()))))
(47)
1=1.
is a regularization parameter to control the relative weight given to each risk source, a denotes the Sigmoid function, and is the number of classes.
Another technique for improving the detection performance based on the "globally negative filters.. Filters that provide evidence for a particular class considered as positive filters and vice versa. For pre-trained
28

---

Published in Transactions on Machine Learning Research (11/2022)
neural networks, it has been shown that only small fraction of final feature maps activated positively. Furthermore, some filters are always activated negatively, indicating irrelevance for all known classes. By discarding inputs that activate globally negative filters, a novel sample is less likely to produce high activation scores. To learn such filters for domain-specific tasks, DTL trains two parallel networks with shared weights up to the last layer-the the first one solves a classification lask on the reference dataset, and the second one solves the domain-specific classification tasks in combination with membership loss. If the reference and domain-specific datasets do not share much information, they provide negative filters for each other. Also, since the reference dataset consists of diverse classes, those learned filters be considered globally negative filters. Finally, filters of the parallel network in combination with the confidence scores of the domain-specifie classifier are used for novelty detection. Fig. 47 shows the overall network architecture.
Reference Dataset (R)
(())
Not Novel
Cross-entropy loss
Max
>
Membership loss
Test Image (x)
Cross-entenn entropy
Novel
f(T)
loss
Known Set (T)
(a) Training
(b) Testing
Figure 23: An overview of DTL method. Two parallel networks trained to produce confidence scores and globally negative filters. The network above solves simple classification task on the reference dataset, and the one below solves membership loss in combination with the domain-specific classification task. Test time detection done by putting a threshold on the confidence of maximum class. The figure is taken from 121
4.7
Learning for Open-Set Recognition (CROSR) (183)
This work follows the similar idea C2AF. In particular, CROSR employs encoder network for classification and producing the latent vectors for reconstruction task. Importantly, the latent vector used for the reconstruction task and penultimate layer y used for the classification task are not shared. The reason is that there is an excessive amount of information loss in the penultimate layer, which makes distinguishing between unknown and known samples hard. The overall procedure can be described as follows:
2), = f(x), p(C, x) Softmax, (v),
(48)
==)(=)
Moreover, to preserve information at different levels of abstraction, each layer of the encoder is compressed into latent vector zj. The latent vector is then decoded to minimize the reconstruction error of the corresponding layer as follows:
x1+1 fi(m));
hx(xz),
(49)
& = ( + (x(()))
where fi and 9i are layers of the encoder and decoder, respectively. hy is a reprojection to the original space of rz. The autoencoding structure is based ladder network 130
29

---

Published in Transactions on Machine Learning Research (11/2022)
The final latent vector is the concatenation of each 24. EVT is employed in OpenMax (T However, the distance is not only computed on the penultimate layer but also on the latent vector z. Specifically, EVT is applied on the joint [y, z]. Test-time detection is performed similar to OpenMax. Fig. 24 shows an overview the method.
R2
X1
R1
21
X 21 100 (LO+
(odl
Xg
Ro
DOOG (aidlaa Xn
Supervised net
(b) Autoencoder
LadderNet
(d) Ours: Deep hierurchicul reconstruction net
An overview of the proposed method compared to similar methods in the literature. As it is obvious, an encoder is used for the classification task, and the reconstruction task done in a ladder network. The figure is taken from (183.
Figure 24:
4.8
Generative-Discriinnnn Discriminative Feature Representations For Open-Set Recognition (GDFR) 123
Similar to CROSR, this proposed work trains a discriminative model in combination with generative onc. Discriminative approaches may lose important features that are utilitarian for distinguishing between seen and unseen samples. Generative modeling can provide complementary information. Similar to GT, GDFR employs SSL to improve the features of the discriminator. A shared network performs both the classification and SSL tasks, predicting the geometric transformations applied to the input.
Moreover, generative model such AE is used, producing reconstructed outputs & for given input x. Then the collection of input-reconstruucton pairs (z, f) are passed to the discriminator network for classification and SSL tasks. The disparity between & and æ for unseen samples improves the discriminator network's detection power.
Fig.
25 shows the method.
Casolliaaion
Clavdran tranch
Cheiiiorii branch
Meconstactedd Mkc0i
Clnoficatoo
Cuooliaaton
Casstication
cuperision
(a) Conventional classification network
Randen
Cloood
Clarofficaton beanch
Proposed method Training
Classiication
Recombructed
Casc Braaoon Netvor
Cooood set Classifcatte
(
Clssilation
The Turshbrruaa sinn
Randon Transkeration
(b) Classification network with Self- supervision
Proposed Testing
Figure 25: An overview of GDFR. As it can be seen, a classification network is trained on both SSL and classification tasks to make the learned features richer. Also, to benefit from generative modeling, each input is passed an AE, and further tasks are applicd on the joined reconstructed and input images. The figure is taken from 123
30

---

Published in Transactions on Machine Learning Research (11/2022)
4.9 Conditional Gaussian Distribution Learning for Open Set Recognition (CGDL) (162):
The main idea of this research is very similar to CROSR. However, CGDL uses the probabilistic ladder network based on variational encoding and decoding (660). The overall encoding process for the Ith layer is as follows:
= Conv(n--1)
h4 = Flatten(zi)
(50)
14 Linear(h:)
of Softplus(Linear(h)))
where "Conv" is a convolutional layer, "Flatten" is linear layer to flatten the input data into I-dimensional space, "Lincar" single lincar layer, and "Softplus" operation is log(1 + exp(-)).
The final representation vector z is defined as + a &e where N(O,,), 7), @ the element-wise product, and n, are the outputs of the top layer L. Similarly, for the decoding process we have:
4+1 Unflatten(E4a))
61 1 ConvT(
N Flatten($141)
1 Linear(hu+1)
of Softplus(Linerr((uu))
(51)
9-14 + 0, + MM + to
0, + 01
q-
0, + 0
a = 9-11 + q-o oe.
During training, samples are passed into the encoder to estimate μ and a for each layer. The mean and variance can be used as priors for the corresponding decoding layer. The final embedding = of the encoder's top layer is used for the joint classification task and decoding process. The distribution of the encoder's final layer is forced to be similar different multivariate Gaussian r²(() N(2; (k, T), where k is the index of known classes and μa is obtained by fully-connected layer which maps the one-hot encoding of the input's label to the latent space. Each layer of the decoder is a Gaussian probability distribution in which prior of its mean and variance is added by the corresponding layer of encoder statistics. Putling it together, the training objective function is as follows:
LKL 1 KL ()))
K-1
+
(+(((1))))))
(52)
1=1
C, = || - -6111
(L, + X Le + 8 LKL).
where Lo
is the classification and
(0(8:161+,, N(a 9-14 g-ot) go (8:1(1111) = (âr; Ar, 07)-
(53)
31

---

Published in Transactions on Machine Learning Research (11/2022)
At the test time, both the probability of final latent space with respect to (2) and reconstruction error for each test input are used for detection. If input is preserved, the classification output is considered as the true class. As Fig. 26] shows, the latent vector is considered as a prior in which the distribution of all classes should have low KL distance. This is similar to the role of ((0, I) in the bascline VAE.
ypred
Unknown Ypred
Unknown
Qutector T
KL-divergence
Clasiifier
X3
As
KL-divergence
d2
Q.R2
X2
KL-divergence
Ji
X1
Encoder FF
Decoder 5
Reconstruction
Figure 26:
An overview of CGDL method. Compared to CROSR probabilistic ladder network is used instead of a deterministic one; however, the classification task is similar. The probability distributions of the decoder network contain a prior from the corresponding layer statistics of the encoder network. Unlike, VAE in which there is a prior N(,, 7) on the latent space; here, the prior learned, and each class distribution is conducted have low KL distance with it. The figure taken from (622..
4.10 Hybrid Models for Open Set Recognition (192):
In this work, a classification network is trained in combination with flow-based generative model. Generative models in the pixel-level space may not produce discernible results for unscen and seen samples, and they are not robust against semantically irrelevant noises. To address this issue, flow-based model is applied to the feature representation space instead of pixel-level space (see Fig. 27 The reason for using flow-based models their handy and comprehensive theoretical abilities. The training loss is a simple cross-entropy loss in combination with nogative likeliiel used for the training of the flow-based model. At the test time, the thresholding applied to the likelihood each input, and is preserved, the classifier's out is assigned as the in-class label.
4.11 Learning Open Set Network With Discriminative Reciprocal Points (RPL) (22):
Similar to Mem-AE, the idca of prototype features is used in this work. The goal is to learn set of prototypes or reciprocal points, which can assign labels to each input based on the distance w.r.t each prototype. RPL helps the model better adjust the boundaries of different classes compared to softmax or OpenMax, and decreases the risk factor. Initially, random reciprocal points are chosen. The location of reciprocal points and the weights of a classifier network are adjusted to minimize the classification loss. This forces the network locate features of each class some specific reciprocal points yield the desired class boundary using at.
32

---

Published in Transactions on Machine Learning Research (11/2022)
Enender Flow-based Model
Encoder Flow-hased Model
Liis per dimemsion
Training images
Test
logP(s)
Images
IugP(x)
Known Classes
Known
Unknown
Classfiet
Clusses
Class
Training
cross eatropy
Testing
Classifier
Figure 27: An overview the hybrid models for open set rocognition. As it can be seen, a classification network trained in combination with a generative flow-based model. At the test time, the probability of the latent vector is considered as the criterion of rejection, and the classifier assigns a label if the input not rejected. The figure is taken from 192).
least a sct of points. To decrease the risk factor, samples cach class are forced to have a margin with respoct their reciprocal points, which is learned during the training process. Eq. 54 shows the mathematical formulation:
d( d(fa(n); pk) Σ llf(z)) -
plu k/,,, S0, P)
(54)
Σ End(So(o).P1)
M Σ L, M ((((f(()), - R+
1
where pk is the set of kth class reciprocal points, P is reciprocal point, M is the number of reciprocal points for each class, N is the nunber of classes, R is the margin for each class, and y is tunable hyper-parameler.
4.12 A Loss for Bustance-Baseer Open Set Recognition (CAC) (104):
The idea of this work is similar to RPL and GOAD. For each class, CAC defines anchor vector of dimension N-the number of classes. For each vector, the element corresponding to the class label is 1 and 0 otherwise. For each training sample, the learning process forces its logit scores to be in a compact ball w.r.t true class anchor vector while having large distance from anchors of other classes. CAC can also be seen as a multi-class DSVDD. The training loss function is follows:
d = e= C) (|zz cil12,.... cxll22
Cr(x,y) = loog(1 + Σ edo-da
(55)
1$4
CA(x, v) = dy = [1f(x) C,,
CCAC = Lr y) + X LA(x.v),
where f urature extractor projecting an input image x to vector of class logits = f(x), N the number of known classes, and C is a non-trainable parameter representing a set of class center points (c1,..., one for each of the N known classes.
4.13 Few-Shot Open-Set Set Recognition Using Meta-Learning (PEELER) (93)
In this work, the idea of meta-learning is combined with open set recognition. Meta-learning enable learning general features that can be easily adapted to any unseen task. Meta-learning is also called learning learn.
33

---

Published in Transactions on Machine Learning Research (11/2022)
Due to the ability to work in few-shot settings, meta-learning can be useful in low data regimes. At the meta iteration meta-model h is initialized with the one produced by the previous meta-iteration. Let (8% Th) M be meta-training dataset with N number of training problems, two steps are performed. First, estimate I' of the optimal model for the training set S is produced. Then the test set 7 is used for finding model with a suitable loss function L as the Eq. 56 shows.
h" = arg minA
Σ (AL
Likk h (xx))
(56)
To adopt meta-learning in OSR, a classification loss in combination with open-set loss is used. Moreover, the test set Т is augmented with some unseen samples. The overall loss function is defined as Eq. 57 where L is a simple classification loss, and L, maximizes the entropy of unknown samples on the known classes.
h" = arg minA
Σ
Lelun, h (xx))
(57)
Loth((z))]
+ A-
ETT EN
At the test time, the average features of correctly classified samples obtained as a prototype point and used for the rejection of unseen samples.
4.14 Learning Placeholders for Open-Set Recognition (PROSER) (196):
This work tries to train a classifier (f(x)) that can distinguish between larget class and non-target classes. A dummy classifier is added to the softmax layer of the model with a shared feature extractor. Then forced have the socond maximum value for the correctly classified samples. When the classifier encounters novel inputs, the dummy classifier produces high values since all known classes are non-targets. Dummy classifier be seen the instance-dependent threshold which well fit every known class. The loss function is defined as the Eq. 58 where ((xx// / is meant to make the most probable class zero.
L = Σ 1(f(x).)) + (((((()//, (r,
(58)
Moreover, the mixup technique (169 is added to the loss function to boost unseen samples detection. The mixup representations are introduced to approximate the unseen sample's distribution and should be classified as the dummy class l: + 1. Finally, rejecting each test time sample is done based on the probability of the dummy class.
4.15 Counterfactual Zero-Shor Shot and Open-Set Visual Recognition (187):
This work attempts to make abnormal samples in a counterfactuual faithful way. As the paper mentions, most of the generative approaches such as G-OpenMax do not produce desired fake samples, the distributions of which do not resemble real distribution of unseen samples. To this end, a 8-VAE (66) is used to make sample attribute variable Z and the class attribute variable Y independent. The 3-VAE loss function is similar to simple VAE; however, the KL term is induced by coefficient B. This is shown to be highly effective in lcarning disentangled sample attribute Z (66). For discntangling Y from Z, the proposed approach makes counter-factual samples by changing the variable to have a large distance with the given inpul & in spite of samples that are generated by changing the variable Z. To make couter-factuul samples faithful, a Wasscrstein GAN ( loss used for discriminator D(X, Y), which verifies the correspondence between the generated
image and the assigned label. At last, generated samples can be used boost the performance of any OSR problem.
34

---

Published in Transactions on Machine Learning Research (11/2022)
4.16 OpenGAN: Open-Set Set Recognition via Open Data Generation (82):
This work argues that using an easily accessible auxiliary outlier dataset can improve the open-set recognition performance as mentioned in (137 and (58). However, the auxiliary dataset might poorly generalize to diverse open-set data that are likely to be faced. Therefore, close to (189) a GAN-based approach is employed to generate fake samples that are supposed to mimic the distribution of the open-set data. Although, as mentioned (I89), GAN-based methods suffer from instability when used in the one-class training setup, the OSR setup, labeled closed-set data is available which can be used find the best stopping point during training. Furthermore, fake samples can be generated according to the feature space of closed-set samples passed through pre-trained K-way classification model, which significantly reduces the dimensionality of the problem and helps stability. This work shows that a well-sclected GAN-discriminator (D) using validation set achieves SOTA on OSR. Fig. shows that at first, a closed-set classifier is trained on the given training dataset and is kept fixed afterward. Then, a GAN-based framework trained on the embeddings of the closed-set and outlier images, which forces the generator (9) to produce semantically fake outputs that are hard to be detected function, where Ào controls the contribution of generated fake samples by G, and Xo adjusts the effect of auxiliary outlier dataset.
fake for the discriminator. Eq. 59 shows the mathematical formulation of the loss
max min E.z Potuxed log(D(x))) + +>o RegnPopon [log(1 -D(+)] Ar EE-N [log(1 D(G(=)) D
(59)
G
K-way softmax
cloeed imagen
elosodenct ImmRgR
closcdlsct images
closed-sct insrges
outlie images
closed vs. fake
closed vs, open
closed vs. open
closed vs, open
fake ferufounsss
images
outlier imaggs
images
(a) GAN
(b) Outlier Exposure
(c) OpenGANPie
(d) Open
Figure 28: An overview of the OpenGAN method. Unlike pure GAN-based methods Outlier Exposure, fake samples are generated in the latent space while discriminator is trained to distinguish between the closed-set samples' embedding and outlier inputs. Closed-sct embeddings are produced using trained K-way closed-set classification model that is kept frozen afterward. In this way, the fake generator G is pushed towards making features, that match outlier images' embeddings. The figure is taken from
4.17 Open-set Recognition: A Good Closed-set Classifier Is All You Need? (167):
This work provides a comprchensive investigation through the correlation of closod-set accuracy and open-set performance of different deep architectures. It shown that not only the closed-set accuracy of a model is highly correlated with its OSR performance, but also this correlation holds across variety of loss objectives and architectures. This is surprising because stronger closed-set classifiers are more likely to overfit to the training classes and perform poorly in OSR. Fig. 29 illustrates the mentioned relationship for different architectures and within the ResNet family architectures. Another contribution of this work is providing a Semantic Shift Benchmark (SSB), which unlike common approaches of utilizing a single test set for the evaluation, makes two 'Easy' and 'Hard' sets based on the semantic similarity the open-sct categorics to the training classes. The ability of a model to detect semantic novelty as opposed to the low-level distributional shift is better captured this manner.
5 Out-of-distribution Detection
OOD detection aims to identify test-times samples that are semantically different from the training data categories, and therefore should not be predicted into the known classes. For instance, one could train the model CIFAR-10 (as in-distribution data), and then evaluate CIFAR-100 (E as out-of-distributiio
35

---

Published in Transactions on Machine Learning Research (11/2022)
AUROC (Open Performance)
0.825
Hard
VTT-B-16
AUROC (Open-sel Perfornance)
0.825
Hard
0.800
Easy
0.800
Easy
ResNet18
0.775
ResNet34
ResNet50
0.750
0.750
ResNet101
0.725
0.725
ResNet152
0.700
0.700
0.675
0.675
0.650
0.650
0.675
0.700
0.725
0,750
0.775
0.800
0.825
0.850
0.70
0.72
0.74
0,76
0.78
Accuracy (Closed Set Performance)
Accuracy (Closed Set Performance)
aa)
Figure 29: (a) The performance of different deep model architectures the ImageNet dalaset. The ImageNet- 21K-P dataset is used to generate 'Easy' and 'Hard' OSR splits. (b) The performance of different ResNet families on the ImageNet. The figure is taken from (167)
dataset, as CIFAR-10 and CIFAR-100 have mutually exclusive classes. In the multi-class setting, the problem of OOD detection canonical to OSR: accurately classifying samples from the known classes while detecting the unknowns. However, OOD detection encompasses broader spectrum of learning tasks (e.g., multi-label classification) and solution space (e-g., densily estimation without classification). Some approaches relax the constraints imposed by OSR and achieve strong performance. The following reviews some of recent OOD detection works and their differences.
5.1 A Baseline for Detecting Misclassified and Out-of- Disttiibbbiiitio Examples in Neural Networks (56):
This work coined "out-of-distribution detoction" and showed how to evaluate deep learning out-of-distribution delectors. As previous anomaly detection works for deep classifiers often had low-quality or proprietary datasets, existing datasets were re-purposed to create diitribbtttiiiiiioonn datasets, enabling easier evaluation. This approach proposes using the maximum softmax probability (MSP) to detect out-of-distributioo samples, namely max; p(y = k z). test sample with a large MSP score detected as an in-distribution (ID) example rather than ont-of-distribution (OOD) example. This showed that simple maximum probability score can be useful for detection in vision, natural language processing, and speech recognition settings, but there is much room for improvement. It also showed p(y a) models can be useful for out-of-distributtin detection and that p(x) models are not necessarily needed. Until now, it still serves as general-purper purposs bascline that is nontrivial to surpass. Concurrent OSR work proposed additional modifications to softmax probabilities for detection (II).
5.2 Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks (ODIN) (92)
In this work, technique called temperature scaling was employed. Although it has been used in other domains such as knowledge distillation (67), the main novelty this work is showing the usefulness this technique in the OOD domain. In temperature scaling, the softmax score computed as in Eq. 60 OOD samples are then detected the test time based on thresholding the maximum class probability. This simple approach, in combination with adding small controlled noise, has shown significant improvement compared to the baseline approach MSP. ODIN further shows that adding step gradient to the inputs in the direction of improving the maximum score has more effect the in-class samples, and pushes them to have larger margin with the OOD samples.
S((x:T) = exp(f((x)/T) IN exp((
(60)
36

---

Published in Transactions on Machine Learning Research (11/2022)
The paper also provided mathematical explanation for the effect of temperature scaling on out-of-distribttion detection. This can be seen in the Taylor approximation of the softmax score (expanded around the largest. logit output fg(2) (z)):
S, exp(Ii(x)/T)
Σn= (xp(f,(=//T)
Σ j=1 expl (5(m))/((1)
(61)
N Ey=1fo())) fz(x) + 2ोFh N -
A sufficiently large temperature T has a strong smoothing effect that transforms the softmax score back to the logit space- which effectively distinguishes TD vs. OOD. In particular, the ID/OOD separability is determined by the U, = Σ -j=1,tylf(()) - [=)] and U2 = Σラ -=ー1ززي (x)==/(((())(fff1)))))) f=))] The former measures the extent to which the largest unnormalized output of the neural network deviates from the remaining outputs; while the latter measures the extent which the remaining smaller outputs deviate from each other. For the in-class samples, Up and ElU² Ui] are higher than OOD ones. Mathematically and empirically, ODIN is not sensitive to T when it is large enough to satisfy the Taylor approximation. For example, the paper shows that simply applying T' = 1000 can yield effective performance boost without hyper-pan prper-parameter tuning. In general, using temperature scaling can improve the separability more significantly than input preprocessing.
Note that ODIN differs from confidence calibration, where a much milder T is employed. While calibration focuses on representing the true correctness likelihood of ID data only, the ODIN score is designed to maximize the gap between ID and OOD data and may no longer be meaningful from predictive confidence standpoint. As seen in Fig. 30 the ODIN scores are closer to 1/N where N is the number of classes.
Temperature scaling only
In-distribution
Out-distribttion
Temperature scaling
Score distribution
& Input preprocessing
Bascline
I/N
Softmax score
Figure 30: An overview of ODIN, a post-hoc method that uses temperature scaling and input perturbation to amplify the ID/OOD separability. The figure is taken from (2
5.3 A Simple Unified Framework for Detecting (89):
Samples and Adversarial Attacks
This work was inspired from the idea of Linear Discriminant Analysis (LDA) in which P(X Y = y) is considered to be multivariate Gaussian distribution. In order for P(Y = X = z) to be similar to softmax form, it is assumed that the feature space of the penultimate layer follows the Gaussian distribution. Therefore, mcan and variance vector is simply estimated from fcatures of cach class, and multivariate Gaussian is fit to them. In order to check validily of the assumptions, it uses the Mahalanobis distance of the test time images to perform the classification instead of the softmax function. Surprisingly, the results are comparable or better than softmax, which supports the assumptions. It performs OOD detection using Mahalanobis distance to the closest flass-onniiiinaal Gaussian distribution. Furthermore, improve the performance, features in different layers ensembled and small controlled noise added test. samples
37

---

Published in Transactions on Machine Learning Research (11/2022)
where (x) is the Mahalanobis distance with mean of the closest class-conditional Gaussian distribution. A similar idea has been discussed earlier in (134).
shown in Eq. 62
= sign ( M()))
(62)
5.4 Predictive Uncertainty Estimation via Prior Networks (DPN) (102):
This work discusses three different sources of uncertainty: (1) data uncertainty, (2) distributional uncertainty, and (3) model uncertainty. The importance of breaking down the final uncortainty into these terms was discussed. For instance, model uncertainty might. happen because of the model's lack of capacity approximate the given distribution well. On the other hand, data. uncertainty might happen because of the intrinsic intersection of similar classes. For instance, classifying between different kinds of dogs has more data uncertainty than solving classification problem with completely separate classes. Distributional uncertainty is related to the problem of AD, ND,, OSR, and OOD detection. The goal of this work was to estimate the distributional uncertainty for each input and compare it with the data and model uncertainties. Data uncertainly P(we 0) can be defined by the posterior distribution over class labels given a set of parameters 8. Model uncertainty P(0) D) defined by the posterior distribution over the parameter given data D. These two types of uncertainties could be combined give rise to the distributional uncertainty, shown in Eq. 63
P(wel x², D) P(we fP (0))))(0 D) do
(63)
As computing the integral is not tractable, the above formula is usually converted into Eq. 64 where g()) is approximation of P(0 D).
M P(wa xx, 0') (())
P(we (),
(64)
M
Each P(wel x*.D) D) can then be seen as a categorical distribution located on a simplex, as shown in Fig.
31
(a) Ensemble
(b) Distribution
Figure 31: The figure shows a distribution over the categorical distributions for modeling uncertainty using both model uncertainty and data uncertainty. The figure is taken from (102).
Now to extract distributional uncertainty from the model uncertainty, Eq. 64 decomposed into the following Eq. 65
P(we xx' (2* = |] P(we 1))(() x² (0)0)P( du
(65)
where P(w. (u) is categorical distribution given realization from Dirichlet distribution, P(u x=, x²,,)) is the Dirichlet distribution given the input and model parameters 0, and P(O D) is the distribution over model parameters given the dataset D. For simplicity, in this work P(O D) is equal to 5(0 - 0) and is produced by the output of a deep network. Therefore P(p 2².0) P(u x 9) Dir(p a), and a f(xx,0) where (.,-) represented by deep neural network.
38

---

Published in Transactions on Machine Learning Research (11/2022)
At the training time, the Dirichlet Prior Network (DPN) is expected to yield flat distribution over the simplex for OOD samples, indicating large uncertainty in the mapping from x to y. Some out-of-distribution data is used to minimize the KL distance of Dir(# | a) and the flat Dirichlet distribution. For the in-class samples, the KL divergence between Dir(H/ | a)) and a sharp, sparse Dirichlet distribution minimized. The objective Dirichlet distributions are obtained by pre-setting their parameters during training process. During test time, different criterion such as max probability, last layer's 's entropy (H),,, and distributional uncertainty as in Eq. 66 are used for OOD detection.
Ily, p | x² D) = H[E m) (P(y [)]
(66)
Dp [P() x)]]
5.5 siniddence-caibbaatee Classifiers for Detecting tuttof-diistrbuttio Samples (88):
This work attempted to maximize the entropy of confidence scores for OOD samples, similar to (3) Similar to (III), it generates OOD samples by jointly training GAN and classifier. As shown in Eq. 67 the first term solves a classification lask on in-class samples, the second term uses KL divergence to make the confidence score distribution of generated OOD samples uniform. The remainder terms train the GAN on the in-class samples. Note that, the GAN is forcod to generate high-quality OOD samples that produce high uncertainty when they are passed the classifier. Therefore, the generated samples are located on the boundaries of in-class and outlier distributions. The paper also shows that leveraging on-boundary in-class samples significantly improves its confidence calibration.
min max min (P log Po(y = |+]]
0
+ (P [[) x))] + Pp D(x)]
(67)
(e) [log(1 Dx)))
Pm denotes the in-class distribution and (o I) is a classifier trained on the datasct drawn from Pin(x,)) y). Test time OOD detection is done based on thresholding of the maximum softmax value.
5.6 Deep Anomaly Detection with Outlier Exposure (OE) (58):
This work introduced Outlier Exposure (OE) and reported extensive experiments on its usefulness for various settings. When applied to classifiers, the Outlier Exposure loss encourages models to output a uniform softmax distribution on outliers, following (88) More generally, the Outlier Exposure objective is
E (( [(((()))) 9) + A EE (for(((")) v)l.
assuming a model f, the original learning objective L; when labeled data is not available, y can be ignored. Models trained with this objective can have their maximum softmax probabilities (66) better separate in- and out-of-distribution examples. To create DOE data unlike the training data will need to be scraped or curated downloaded. Samples from DOE are gathered from already existing and available datasets that might. not be directly related to the task-specific objective function; however, they can significantly improve the performance because they contain many diverse variations. Concurrent work (33) explores a similar intuition for small-scale image classification, while Outlier Exposure shows how to improve OOD detection for density estimation models, natural language processing models, and small- and large-scale image classifiers.
5.7 Using Seff-Supervised Learning Can Improve Model Robustness and Uncertainty (60):
This work investigated the benefits of training supervised lcarning tasks in combination with SSL methods in improving robust of classifiers against simple distributional shifts and OOD detection tasks. To do so, an auxiliary rotation prediction was added to a simple supervised classification. The work measures robustness against simple corruptions such as Gaussian noise, shot noise, blurring, zooming, fogging etc. It has been observed that although auxiliary SSL tasks do not improve the classification accuracy, the model's robustness and detection abilities are significantly improved. Additionally, when the total loss function is trained in
39

---

Published in Transactions on Machine Learning Research (11/2022)
adversarially robust way, the robust accuracy is improved. Finally, the method is tested in the ND setting using rotation prediction, and horizontal and vertical translation prediction similar but simpler than GT or GOAD. They also test in the setting of multiclass classification setting and find that auxiliary self-supervised learning objectives improves the maximum softmax probability detector (56). In addition, similar to (B3) and
[8 they attempled to make distribution the confidence layer for some background or outlier samples
uniform. Outliers are selected from other accessible datasets, as in Outlier Exposure (88)
5.8 Unsupervised Out-of-Distribution Detection by Maximum Classifier Discrepancy (185):
This work relies on a surprising fwct-two classifiers trained with different random initializations can act differently on unseen test time samples at their confidence layers. Motivated by this, the work attempts to increase the discrepancy loss is the difference between the first classifier's last layer entropy and that of the second one. This forces the classifiers to have the same confidence scores for in-class inputs, yet increases their discrepancy for the others. Fig. 32 shows the overall architecture. First, two classifiers are trained on the in-class samples and are encouraged to produce the same confidence scores. Second, an unlabeled dataset containing both OOD and in-class data employed to maximize their discrepancy on outliers while preserving their consistency on inliers.
unseen samples and reduce the discrepancy on seen ones. The discrepancy
Step Supervised training
Entropy
y Xua
GT
Xin
F2
Pa (aan
GT
Step B: Unsupervised training
A
by xc
Discrepancy Loss
Alpi pull.ps(y(aa)))
Xul
E
Xin
Entropy
ph by bc)
2 log(p: (w. (Xa))
The overall architecture of (185. As it can be seen, at the first step, both of the classifiers are trained. Then, at the next step, an auxiliary discrepancy loss is added to the supervised classification to adjust the boundaries of in-class and OOD samples. The figure is taken from 185)
Figure 32:
5.9 Why ReLU Networks Yield High-Confidence Predictions Far Away From the Training Data (54):
This work proved that ReLU networks produce piece-wise affine functions; therefore, they can be written as f(x) V'r + a' on the polytope (x) as follows:
Fi { Rd A')) + of 0)
(68)
Q(x) = N= OE=I.... Pi.s
where (1) is a diagonal matrice defined elementwise as:
( (x) = -{ sign (1)
if fi=jj else.
(69)
0
40

---

Published in Transactions on Machine Learning Research (11/2022)
ny and L are the number of hidden units in the Ith layer and the total number of layers, respectively. The following theorem proves the deficiency of ReLU networks.
Theorem. 1 Let R²d = QI and f(x)= V'x a' be the piecewise affine representation of the output of a ReLU network on Qt- Suppose that V does not contain identical rows for all = 1..., R Then for almost any x E Rd and there exists an a and a class (1..., K} such that for ax holds
efe(z) Σ ef-(2) 21-6
(70)
The equation goes to 1 if a - cc. From this, we can imply that for ReLU networks there exist infinitely many imputs which yield high confidence predictions. Note that arbitrarily high confidence prediction can not obtained due to the bounded domain of inputs. In order to relieve this problem, a technique that is called confidence enhancing data augmentation usod, as the Eq. 71 shows.
Ler( ((x)) + A ElLyow (J,
(71)
efil))
L Pout
log Il,...,K
k=1 efv(z)
where Pout and Pmu in-class and out-of-distribution distributions respectively, which we certain that the set of the intersection of their supports has zero or close to zero probability mass. An example of such an out-distribution pout would be the uniform distribution on [0, 1] or other noise distributions.
The above training objective needs many samples to enforce low confidence on the entire out-distribution, an alternative technique called adversarial confidence enhancing Training (ACET) is used. ACET uses the idea of adversarial robust training to not only minimize the objective function at cach point but also the worst case in neighborhood of the point Eq. 72 shows.
N LCE
ET max Lpons (f. u]]
(72)
N
Iu- l.s
At the test time, thresholded confidence score is used to distinguish between inliers and outliers.
5.10
Do Deep Generative Models Know What They Don't Know? (110):
This work shows that generative models surprisingly assign higher likelihood scores to outliers. This holds for VAEs, rugr-seee models, and different kinds flow-based methods. In the generative modeling, usually, parametric model on the data distribution is assumed as po (z). Then, finds the best 0 that minimizes the KL distance between the true but unknown distribution p² and p, which equal to maximizing the likelihood of po())) the inpul distribution, as the Eq. 73 shows.
1 = / (xe) log ('(x) dr = logpa(X) - H(pp] po(x)
(73)
Also, assuming the existence of a latent space the integrals can be written as Eq. 74 where Z and X are hidden and input variables, respectively. Let be diffeomorphism from the data space latent space, which commonly happens in flow-based modelings, where 88 is known the volume element.
0f
41

---

Published in Transactions on Machine Learning Research (11/2022)
J P=(2)) dz = p-(((())
0f dr
dr Px(x)) dx
(74)
The parameters of p can be decomposed as 0 = (6, with being the diffcomorphism's parameters, i.e. [a;; o), and & being the auxiliary distribution's parameters, L.c. p(2;))) Then the objective function can be written Eq. 75
0" = arg maxg log (X))
05e drn
(75)
arg max
logp: 0), log
An interesting aspect of the objective function above is that it encourages the function f to have high sensitivity to small changes of input samples Zn- It mentioned in the paper that we plot the effect of each term separately, the first term shows the desired behavior for inliers and outliers, but the second term causes the problem. Changing f to constant-volume (CV) transformations (34) can alleviate the problem, but not entirely. Finally, using the second-order expansion of the log-likelihood around an interior point æo, it has been shown that the assigned likelihoods have direct relation to the model curvature and data's second moment. Therefore, the problem of generative models might be fundamental. Eq. 76 shows the details of expansion where Tr means trace operation.
< E,llog 0)] - Ep- [log 0) V sn fogo( 8)² (E [x] - Ep- (x:))
(76)
V2 2o logp(zo, (){E,, - Ep-
2
5.11 Likelihood Ratios for Dustr--Distiibution Detection (132):
This paper employs likelihood ratio to alleviate the problem of OOD detection in generative models. The key idea is to model the background (Xg) and foreground (XF) information separately. Intuilively, background information is assumed to be less harmed than foreground information when semantically irrelevant information are added to the input distribution. Therefore, two autoregressive models are trained on noisy and original input distribution, and their likelihood ratio is defined as Eq. 77
LLR(x) llog (X) -log
Pa X (XFF)
pa, (X) poo [BB BBBa )o, (Xr)
(77)
Po (X() log (Xr) log Poo (Xp)
log
Poo (Xp)
po(.) is the model trained on the in-distribution data, and pa. (.) is the background model trying to estimate the general background statistics.
At the test time, thresholding method is used on the likelihood ratio score.
5.12 Generalized ODIN (68):
As an extension ODIN Q2 this work proposes specialized network to learn temperature scaling and a strategy to choose perturbation magnitude. G-ODIN defines an explicit binary domain variable d {dn dout } representing whether the input is inlier (i.e, Pmn). The posterior distribution be decomposed into
42

---

Published in Transactions on Machine Learning Research (11/2022)
p(dull) Note that in this formulation, the reason for assigning overconfident scores to outliers seems more obvious, since the small values of p(y, dm x) and p(dnn x) produce the high value of ply | dnn Therefore, they are decomposod and estimated using different heads of a shared feature extractor network hx(x) and g(ar) for ply) dn) and p(di x)) respectively. This structure called dividend hainnndddvvvn divissr and the logit fi(z) for class can be written as Aa(a). g(rr) The objective loss function is a simple cross entropy, similar to previous approaches. Note that the loss can be minimized by increasing (4) or decreasing g(x.. For instance, when the data is not in the high-density areas of in-distribution, h₂(x) might be small; therefore, (() is forced to be small to minimize the objective function. In the other case, g(x) are encouraged to have larger values. Therefore, they approximate the role of aforementioned distributions p(y dmn I) and p(dn) 2).
ply 4)) p(yddal)))
At the test time max; (x) or g(x) are used. Fig. 33 shows an overview of the method.
In-distribution data
P(3, di, (z)
ply. din xx)
Neural Networks
count count
p(y) din, 23)
p p(din xz)
plydn
Out-of-distribution data
p(dia
Figure 33: The overall architecture of Generalized ODIN. As evident, different heads are applied on the penultimate layer to model the mentioned distributions. The figure is taken from 68
5.13 Background Data Resampling for Outlier-Aware Classification (91):
As mentioned before, in AD, ND, OSR, and OOD detection, some methods use background or outlier dataset to boost their performances. However, to avoid different kinds of biases, the size of auxiliary datasets becomes important. In this work, a re-sampling technique is proposed to select an optimal number of training samples from the outlier dataset such that on-boundary samples play a more influential role the optimization task. The work first provided an interesting probabilistic interpretation of outlier exposure technique. The loss function can be written Eq. 80 where Lete and Luni are shown in Eq. 78 and Eq. 79 respectively.
Les(f((;;)) log (x;
(78)
Luni (f;;(();;))
Σ k=1
log (2; 0) log K
(79)
K
L(0:p.9) = xp..)) Lota
(80)
+ +aEx Iuui (fx; (X: 0))]
By expanding Eq. as Eq. 81 shows.
80 and taking its gradient w.r.t. classifier (f(x:)) logils, the optimal classifier is obtained
f1( = c(x))rix(( x)) 1 - c(x)
K
(81)
(x(
c(x) =
px px + agx (x))
43

---

Published in Transactions on Machine Learning Research (11/2022)
where c(z) can be seen the relative probability of a sample being in-class distribution p background distribution with the ratio a. Suppose P/ is the re-sampled dataset and Da is the given background one, OOD detection loss after reweighting can be written as:
1
Lout (0; w)
Σ
(f;; 0))
D
(R.y)ED
(82)
1
Wi Mani ( 0))
Pal
1
The optimal parameters 0" are learned as follows:
0* ('ww) = arg m D, D,w) [(0;;
(83)
arg ming [ma D) + aroouu (0; w)
Therefore, iterating optimization is solved between finding 6f and wt at each step by fixing and solving the optimization problem for the other. At last the largest values of weights can be selected with regard to the dataset's ' desired size.
Normalized empirical KDE
CIFRRIO (Tran)
CIFARIO0 (Test)
CIFRROO (Test)
CelebA (Test)
Coastant (Test)
FaceScrub (Test)
Omniglot (Test)
Tiny ImageNet (Test)
MNIST (Test)
TrafficSign (Tes))
FasbioMNIST (Tes)
Noise (Test)
SVHN (Test)
-10
-2
Lm
Figure 34: The assigned likelihood values of a simple generative model to different datasets when trained on CIFAR10. As evident, simpler datasets achieve higher values. The figure taken from (152).
5.14 Input Complexity and Out-of-Distribution Detection With Likelihood-Bann Based Generative Models (152):
This work further investigated the problem of generative models assigning higher likelihood values to OOD samples. In particular, this work finds strong tie between the OOD samples' complexity and likelihood values. Simpler input can lead to higher likelihood value. Fig. 35 shows this phenomenon. Furthermore, another experiment to support the claim is designed that starts from a random noise, on which a mean average pooling is applied at each step. To preserve the dimension, an upscaling done after average poolings. Surprisingly, simpler images on which more average poolings are applied to achieve higher likelihoods. Motivated by this, the work proposed likelihood values. Since it is hard to compute the input complexity, the paper instcad calculates bound using a lossless compression algorithm (23). Given set of inputs x coded with the same bit depth, the normalized size of their compressed versions, L(x) (in bits per dimension), is used as the complexity measurement. Finally, the OOD score is defined as Eq. 84
detect OOD samples by accounting for input complexity in combination with upper
S(x) ( L(x),
(84)
where 1x) is the likeliill of an input given model M.
44

---

Published in Transactions on Machine Learning Research (11/2022)
Frequency
CNN (x;0)
disttiidittrbbution
In-distribution
Energy Function
f(x;))
Nogative Energy
throshold
Figure 35: The energy-based OOD detection framework. The energy function maps the logit outputs to a scalar through convenient logsumexp operator. Test samples with lower energy are considered ID and vice versa. The figure is taken from 95
Intuitively, considering Mo as a universal compressor, then p(a Mo) = --x((x) and Consequently, the OOD score can be defined as follows:
p( Mo)
S(x) = logg p(a M) + loga p(æ Mo) = logz
(85)
p( M)
In the cases where a simple OOD sample is fed into the model, the universal compressor My assigns a high probability it and effectively corrects the high likelihood, wrongly given by the learned model M. Similar interpretation holds for the complex OOD samples too.
5.15 Energy-based Out-of-distribution Detection (95):
This work proposes using the energy score derived from the logit outputs for OOD detection, and demonstrated superiority over softmax score. Energy-based models map each input to single deterministic point that is called energy (86). set of energy values F(x, y) could be turned into a density function p(x) through the Gibbs distribution:
E(x.u)/T E((x9)/
ply x) = E c E(x/TT
(86)
where T the temperature parameter, x is input data, and E(x) called Helmholtz free energy and equal
E(x) -
- .log e E(x,0'/TT
(87)
y
In deep networks, by considering E(x, v) = fx(x), express the free energy function in terms of the denominator of the softmax activation:
K E(x; f) - -T Σ F/x)/TT
(88)
The paper also shows that cross-entropy loss facilitates pushing down the energy for in-distribution data during the training process. Morcover, softmax scores can be analyzed through an energy-basod perspective, as Eq. 89 shows. During the optimization, E(x; f) is forced be small for in-distribution samples while being shifted by (max(xx to satisfy the maximum function. Consequently, this results in biased scoring
45

---

Published in Transactions on Machine Learning Research (11/2022)
function that is not suitable for OOD detection.
ex()
e (xx)
max p(y x) = max
D ex:(x)
exi(x)
Σ, e7(00))--mma (mim)))
(89)
= log max plu |x) =
=E(xff) fmax (x).
The energy score hyperparamcter-free casy to compute, and achieves strong performance compared to the softmax score. Beyond post hoc OOD detection, the paper further demonstrated that energy score can be utilized for model regularization. Different from outlier exposure which forces the uniform softmax distribution for outlier training samples, mneryy-baset regularization directly optimizes the energy gap between ID and OOD:
min (xxx))) (-
[- log (x)) A Leeergy
Lenergy = E (xim D [max(() E(xin) - Min)
(90)
Exoon Drratn (0, Mout Exxout)))
where m is the margin hyper-paree pana-parreeter, and F(x) is the softmax output of the classification model. Dirain is the unlabeled auxiliary OOD training data, and Diraiu is the ID training data. The optimization results in a stronger performance than OE. At the test time, OOD samples are detected based on a threshold on Fxx:
5.16 Likelihood Regret: An tut-of-Distribution Detection Score for Variational Autoencoder (178):
Previous works showed that VA can reconstruct OOT) samples perfectly, resulting in the difficulty detecting OOD samples. The average test likelihoods of VAE across different datasets have much smaller range than PixelCNN (TT6) or Glow (S) showing that distinguishing between OOD and inlier samples is much harder in VAE. The reason might be because of the different ways they model the input distribution. Auto-regressive and flow-based methods model their input at pixel level, while the bottleneck structure in VAE forces the model to ignore some information. To address this issue, a criterion called likelihood regred is proposed. It measures the discrepancy between a model trained to maximize the average likelihood of a training dataset, for instance, a simple VAE, and a model maximizing the likelihood of a single input image. The latter is called an ideal model for each sample. Intuitively, the likelihood difference between the trained model and the ideal might not be high; however, this does not hold for OOD inputs. Suppose the following optimization is performed to train simple VAE
1 - (a,00, +)),
(0",0") = arg max 0, -
(91)
where o and 0 are the parameters of encoder and decoder respectively, T(x,, Φ) denotes the sufficient statistics (May o of (2 I)) and L(x,; 0, ((x,, Φ)) expresses the ELBO. For obtaining the ideal model, the decoder can be fixed, and an optimization problem solved on T(x;, Φ) such that its individual ELBO maximized:
arg max, L(x; 0" .T)
(92)
Finally, the likelihood regret is defined as follows:
LR(x) L(x; 0", f()))))))))))))))))(()())))));)) 1(2;0',00 x²)
(93)
The optimization of Eq. 92 could be started from the initial point that the encoder produces for each input, and threshold is used on L.R values at the test time.
46

---

Published in Transactions on Machine Learning Research (11/2022)
5.17
Understanding Anomaly Detection With Deep Invertible Networks Through Hierarchies of Distributions and Features (146):
This work studied the problem of flow-based generative models for OOD detection. It was noted that local feature such as smooth local patches can dominate the likelihood. Consequently, smoother datascts such as SVHN achieve higher likelihoods than a less smooth one like CIFAR-10, irrespective the training dataset. Another exciting experiment shows the better performance of fully connected network than a convolutional Glow network in detecting OOD samples using likelihood value. This again supports the existence of relationship between local statistics like continuity and likelihood values. Fig. 36 shows the similarity of different dataset local statist that are computed based the difference of pixel value to the mean of its
3 x 3 neighboring pixels.
Probability Density
NLL CIFAR10-Glon
15000
CIFRIO
SVHN TINY
10000
5000
Corr: 0.84
-0.10
-0.05
0.10
35000
40000
Pixel Difference to 3x3 Mean
NLL Local Dist
A
B
Figure 36: (A) shows the distribution of local pixel value differences. As it can be seen, distributions are highly overlapped. (B) Likelihoods extracted from the local pixel value differences correlate with CIFARIO-Gles likelihoods. The figure is taken from (466).
Furthermore, let call the summation of the likelihood of pixel value differences computed in local 3 3 neighboring pixels using a histogram with 100 equally distanced bins with Spearman correlation found between the pseudo-likelihods and the exact values of likelihoods, supporting the above assumptions. To address this problem, the following three steps are used:
A strong
Train a generative network on general image distribution like 80 Million Tiny Images
Train another generative network on images drawn from the in-distribution, e.g., CIFAR-10
Use their likelihood ratio for OOD detection
Also, to improve the efficacy, the following outlier loss, which uses OOD samples, can be added the maximum likelihood objective function:
L = - >. log (a log(p,(x)) - log(Pin(x)))
(94)
T
where is sigmoid function, T' is the temperature parameter, Py is the generaldiisributton--ewwd likelihood, and Pin is the specific in-distribution network likelihood.
5.18 Selr-Supervised Learning for Generalizable Out-of-Distribution Detection (107):
In this work, a self-supervised learning method is employed to use the information of an unlabcled outlier dalaset such that the OOD detection utility of an in-distribution classifier is improved. To do so, at first, the classifier is trained on in-class training samples until the desired performance is achieved. Then, additional outputs (a set of & reject classes) are added to the last layer. Each training batch consists of ID data and some outlier samples. The following loss function is used:
min (m |- log( Poly {))))
(95)
+ XE Poweiss.acca |- log Po(y = target xx)]
47

---

Published in Transactions on Machine Learning Research (11/2022)
where À is a learning coefficient for OOD features, and the target is selected based on the following rules:
if arg max(Pa(x)) E l then target f arg max(Pa(()) else
(96)
target random(k)
This is similar to unsupervised deep k-means in (20). If an unlabeled sample in the outlier dataset resembles in-class samples, it is assigned a random reject class each time; otherwise, it is assigned to a specific reject class. This helps unlabeled inliers to be separated from outliers. At the test time, the sum of the softmax output of the OOD classes used as the detection scorc.
5.19
SSD: Unified Framework for Supervidd Outlier Detection (150):
incorporates SSL methods so to alleviate the need for labeling in-class samples. This is different from several aforementioned methods that require solving a classification task. As a result, SSD can be flexibly used in different settings such as ND, OSR, and OOD detection. The main idea is to employ the contrastive learning in (55, and learn semantically meaningful features. After representation learning, k-means clustering is applied to estimate class centers with mean and covariance (Pm, E. Then for each test time sample, the Mahalanobis distance to the closest. class centroid is used as the OOD detection score:
This work has a very similar idea to GDFR (c.f. Section 4.8)
8.r
min(2x (2x (4m) ) E (Ex - pmm)
(97)
where represents the feature for input x. The contrastive learning objective function is simple. Using image transformations it first creates two views of each image, commonly referred to as positives. Next, it optimizes to pull each instance close to its positive instances while pushing away from other images, commonly referred as negatives:
1 2N
" uTuuT
Lbtch
log
(98)
2N
2N Ek=1 I(k # i)e
where = h(f(a,)
TT(f(=>)) is the normalized feature vector, (II, are positive pairs for the ith image from a batch of N images, and h(-) is the projection head. Morcover, when few OOD samples are available, the following scoring function can be used:
8 = (zz - -:m= TT (Zo ( -- Wood(Ee Hood)
mmm)
(99)
(2x Mood)
This framework can be extended to the supervised settings when the labels of in-class distribution are available. SSD employs the supervised contrastive learning objective proposed (79):
2N
2N ===1 [ = v.)e" u/s/T
Lbatc
1
Σ
log
2N.
(100)
2N
E I[k: + i)e"? us/T
1=1
where Ny, is the number of images with label y: in the batch.
5.20 MOS: Towards Scaling Out-of-distribution Detection for Large Semantic Space (69)
MOS first revealed that the performance of OOD detection can degrade significantly when the mumber of in-distribution classes increases. For example, analysis reveals that a common bascline MSP's average false positive rate (at 95% true positive rate) would rise from 17.34% to 76.94% as the number of classes increases from 50 to 1, 000 ImageNet.k. To overcome the challenge, the key idea of MOS is to decompose the large
48

---

Published in Transactions on Machine Learning Research (11/2022)
semantic space into smaller groups with similar concepts, which allows simplifying the decision boundaries between known vs. unknown data. Specifically, MOS divides the total number of C categories into K groups, G1, G2 Gg. Grouping is done based on the taxonomy of the label space if it is known, applying k-means using the features extracted from the last layer of a pre-trained network or random grouping. Then the standard groupwise softmax for each group Gg is defined as follows:
est(2) Edec, efbcaj: Ce Gk
pe (x)
(101)
where (x) and (x) denole output logits and the softmax probability for class e in group Gk, respectively. Fig. 37 shows the overall architecture. The training loss function is defined as below:
K
LGs
ve (z)(
(102)
R= cE
where vf. and pf represent the label and the softmax probability of category in Gg, and N is the total number of training samples.
A key component in MOS to utilize a category others in each group, which measures the probabilistic score for an image be unknown with respect the group. The proposed OOD scoring function, Minimum Others Score (MOS), exploits the information carried by the others category. MOS is higher for OOD inputs they will be mapped to others with high confidence in all groups, and is lower for in-distribution inputs. Finally, test time detection is done based the following score:
Smos(a) = min (etthers (x)) 15kSK K
(103)
Apimnl Group
5000
0.013
0,002
MOS (MAnimmmm Cwiwweddooooo Dovee
8,98
Indistribution
Artlle Carrge
0.012
0012
MOS
Oubbof-dibrbbution
indiiinbutionn
Group
Figure 37: The overall architecture of MOS. As the figure shows, each sample is labeled as "others' for groups to which does not belong, except the correct group. At the test time, detection is done based on the minimum of "others' class scores. The figure taken from (69)
5.21 Can Multi-Label Classification Networks Know What They Don't Know? 171
In this work, the ability of OOD detectors in the multi-label classification setting was investigated. In the multi-label classification setting, each input sample might have one or more corresponding labels, which make the problem harder since the joint distribution across labels can be intractable to model. This work proposes the JointEnergy criterion as simple and effective method, which estimates the OOD indicator scores by aggregating label-wise energy scores from multiple labels. Also, they show that JointEnergy can be mathematically interpreted from joint likelihood perspective. Similar to what has been discussed in
49

---

Published in Transactions on Machine Learning Research (11/2022)
15 P(y: = æ) can be written as e B(eaa)) R(B) then by defining label wise free energy that special case of
K-class free energy with K 2:
F.g. (x) = -log(1 + elvi(e))
(104)
Joinyynergy can be defined as:
Eoiine (I)
Σ Eyg (x)
(105)
Through derivations, the JointEnergy can be decomposed into three terms:
Bjoine (x) = lolllgpaa y1 = -....., μK = 1)
(106)
(K 1) log p(x)
where the first term takes into account joint likehood across labels; and the second term reflects the underlying data density, which is supposed be higher for in-distribution data a. The summation overall results stronger separability between ID and OOD. The architocture overview is provided in Fig.
Destmbation
(1:0)
Piere
Car
Bor
Car
Doer
Dbg
Frot
Horse SPip
Truck
Sum
ccgragazing over many
Ouh-rr Dusiitation
Distribution
Distribbtuinn
Figure 38: An overview of Jointynergy for OOD detection in multi-label classification networks. During inference time, input æ passed through a classifier, and label-wise scores are computed for each label. OOD indicator scores are cither the maximum-valus score (denoted by green outlines) the sum of all scores. Taking the sum results in a larger difference in scores and more separation between in-distribution and OOD inputs (denoted by red lines), resulting in better OOD detection. Plots in the bottom right depict the probability densities of MaxLogit versus JointEnergy. The figure is taken from (77l
5.22 On the Importance Gradients for Detecting Distributional Shifts the Wild (70)
This work proposes a simple post hoc OOD detction method GradNorm, which utilizes the vector norm of gradients with respect to weights, backpropagated from the KT. divergence between the softmax output and a uniform probability distribution. The GradNorm is generally higher for in distribution (ID) data than that for OOD data. Therefore, it can be used for OOD detection. Specifically, the KL divergence is defined follows:
1 C
efele)/T
DKL (e([[[Softmaxx((())) = C
Σ log
D e((())/T) e(ster)
5
(107)
50

---

Published in Transactions on Machine Learning Research (11/2022)
Before Rectification
After Rectification
OOD ID
FPR95: 55.72%
FPR95: 20.38%
Frequency
Unit Activation
Frequency
0
OOD Scores (a)
Unit Indices (b)
OOD Scores (c)
Figure 39: a) The distribution of ID) and OOD uncertainty scores before truncation when ImageNet and iNaturalist are used as in-class and out-of-distribution samples, b) the distribution of per-unit activations in the penultimate layer for ID and OOD data, and c) the distribution of OOD scores after rectification for the ID and OOD data are depicted in the plots above. When ReAct is used, it significantly enhances the separation of the ID and OOD information. The figure taken from (163).
where u the uniform distribution, T the temperature, fc(x) denotes the c-th element of fz) corresponding to the label e, and C is the number of in-distribution classes. Then, the OOD score is defined S(x) ll @DDa lp where W can be (1) block of parameters, (2) all parameters, and (3) last layer parameters. It was mentioned that the third approach is better than others and achieves significant results.
5.23 ReAct: Out-of-distribution Detection With Rectified Activations (163):
The internal activations of neural networks are examined in depth in this study, which as discovered have considerably different signature patterns for OOD distributions and thus enable OOD detection. The distribution of activations in the penultimate layer of ResNet-50, which is trained on the ImageNet, is depicted in Fig. 3D Each point on the horizontal axis represents a single unit of mcasurement. The mean and standard deviation are depicted by the solid line and shaded area, respectively. The mean activation for the ID data (blue) is hellebehaved, with a mean and standard deviation that are both nearly constant. Contrary this, when looking at the activation for OOD data (gray), the mean activations display substantially greater variations across units and are biased towards having sharp positive values. The unintended consequence of having such high unit activation is that it can present itself in the output of the model, resulting in overconfident predictions on the OOD data. Other OOD datasets exhibit a similar distributional property, which is consistent with previous findings. Therefore, a technique called Rectified Activations (also known as ReAct) is presented as a solution to this problem, in which the outsized activation of a few selected hidden units can be attemuated by rectifying the activations an upper limit e 0. It. demonstrated that ReAct can generalize effectively a variety of network designs and that it is compatible with variety of output-based OOD detection methods, including MSP (56). ODIN 192), and energy score 95 among others.
5.24 VOS: LEARNING WHAT YOU DON'T KNOW BY VIRTUAL OUTLIER SYNTHESIS (38)
In this paper, the key idea to synthesize virtual outliers enhance the model's decision boundary. The work differs from prior works (06 189 127) in two aspects. Firstly, it was one of the first works addressing the object-level out-of-distribution, where every input instance is an object instead of an entire image. Object-level OOD detection is useful when a complex scene contains objects of both ID and OOD categories. Secondly, instead of generating samples in the image space, this work proposes generating ing virtual out outliers in the feature space, which shown to be more tractable than synthesizing images in the high-dimensional pixel space.
The method overview is shown in Figure 40 To generate outlier features, VOS first models the feature space of the in-distribution classifier class-condittonal multivariate Gaussian distribution:
51

---

Published in Transactions on Machine Learning Research (11/2022)
Regression Head
Djoc
Backbone Network
ID Samples (xx b) Classification Head
b
Linear Transformation
Lels
Auchor/Proooaa Generator
Uneectainty score
Densilyy
Virtual Outliersv
Nonlinear MLP
Input>> X
Cuncertainty
Necalive Evercy Scote
Generated Virtual Outliers
po(h(x,
UL Σ
Figure 40: Overview of virtual outlier synthesis (VOS) for model regularization and OOD detection. The figure is taken from (8)
po (h((,, bly = -))) = - N
(108)
where μu is the mean of class k E {I, K}, is the tied covariance matrix, and b E Rt4 be the bounding box coordinates associated with object instances in the image, and h(x, b) is the latent representation an object instance (x, b). The covariance (Σ) and mean (fxx) are estimated empirically based on passing the training samples (((;; b,, ())) to the trained network. To be specific:
Σ
(xi, bi)
NE
(109)
Σ Σ
Σ (h(x,, - (ax) (h (x;, ba) pax)
Then, virtual outliers are synthesized based on the estimated class-conditional distribution, with likelihoods smaller than a threshold e:
Vk (2T) m22 1/2 exp (-2 (vx Fxx) T (vV (Wx)) <eJ.
(110)
where vy N (ii, 5) denotes the sampled virtual outliers for class k.
Having virtual outliers generated, the method regularizes the decision boundary via the energy score (95). where ID objects have negative energy values and the synthesized outliers have positive energy:
((E(()))
Luncertainty EE-yl- log
1 + e- (EE Ex-ol- log
(111)
+ ((E(()))))))
where o6-) nonlinear MLP function. OOD detection can be done by replacing image-level energy with object-level energy. For ID object (x, b), the energy is defined as:
E(x, = - -log Σ wi exp ((x.b);))
(112)
52

---

Published in Transactions on Machine Learning Research (11/2022)
Penultimate Layer's Feature without Contrastive Learning
Penultimate Layer's Feature with Contrastive Learning
The k-th Nearest Neighbor Distance Distribution
The k-th Nearest Neighbor Distance Distribution
Demiky
0.4
0.8
Classes CIFAR-13)
(CIFAR-
ILSUN
Figure 41: Overview of the deep KNN approach for leveraging embedding space to detect OOD samples. The figure is taken from (164.
where (x,, b): = WJ.h(xx b) is the logit output for class in the classification branch and Wels E R is the weight of the last fully connected layer. A training objective for object detection combines a standard loss and an uncertainty regularization loss:
min (xbb)) [Cels + Ltoc + 8 Luncertainty
(113)
where is the weight of the uncertainty regularization. Lets and Lioe are losses for classification and bounding box regression, respectively. OOD detection is performed by using the logistic regression uncertainty branch during testing. Specifically, given an imput x", the object detector produces bounding box prediction b" The OOD uncertainty score for the predicted object (x", b*) is given by:
exp "(F(x" bb"))
pa (g x²,b") I I+ exp ((((x
(114)
A thresholding mechanism can be used to differentiate between ID and OOD objects for OOD detection:
{
if po x b 2 po x b < Y
G (xx'
(115)
0
The threshold is typically chosen so that a high fraction of ID data (e.g., 95%) is correctly classified,
5.25
Dustr--dis Detection with Deep Nearest Neighbors (164):
A non-parametric nearest-neighbor distance is explored for detecting OODs in this study. The distance-based methods assume that the test OOD samples are relatively far away from the ID data, and rely on feature embeddings derived from the model. Prior parametric distance methods (e.g. maximum Mahalanobis distance) impose distributional assumptions about the underlying feature space, and this study suggests that these assumptions may not always hold. The method uses threshold- criterion determine whether the input is OOD by computing the k-th nearest neighbor (KNN) distance between the emboddings of the test input and the embeddings of the training set.
Specifically, OOD detection is performed by using the normalized penultimate feature z = 6(x)/1( where ø X + R is a feature encoder. Denote the embedding set of training data as Z,, = (Z), Z2, 2 Zn). In testing, the normalized feature vector z" is obtained for a test input x", and calculate the Euclidean distances ||z, - z" l12 with respect to embedding vectors z; E Z, En is reordered according to the increasing distance ||z, z" 22112- The reordered data sequence represented by Z, (z(1), (())) (()).... Z(n) OOD dctection is based on the following decision function:
(zz²;k) = (-ra (x*) 2 A)
53

---

Published in Transactions on Machine Learning Research (11/2022)
Algorithm OOD Detection with Deep Nearest Neighbors Input: Training dataset Din- pre-trained neural network encoder o test sample x", threshold X
x; in the training data Din. collect feature vectors
Zn = (Z1,22,..,,2,, Zn.)
Testing Stage:
Given a test sample, we calculate feature vector z"
o(x*) ()==)\((((x)1ll
Reorder Zn according to the increasing value of l|zz
z2122 as 2 = (2(1), (2)) ((,))....,(( ((m))
Output: OOD detection decision 1f-l|z" -(z))22 Z
}}
Figure 42: Algorithm 1
describes the KNN-based OOD detection in detail. The figure is taken from 164
where Tk (z*)= = ||| - 211)222 is the distance to the k-th nearest neighbor, and 1 } is the indicator function.
As the distance threshold is only estimated based on ID data, the method is OOD-agnostic since unknown data is not required in the testing procedure. The method also model-agnostic since applies a variety of loss functions (e.g., cross-entropy and supervised contrastive loss), and model architectures (e.g., CNN and ViT). Morcover, the KNN method is easy to use thanks to modern implementations, such Faiss (15),, library that allows running this in milliseconds, even when the database contains billions of images. In contrast, some prior methods cause numerical instability, such as Mahalanobis distance, which requires the inverse computation of the covariance matrix.
6 A Summary of the Shared Core Ideas
As previously mentioned, methods and formulations of out-of-distributtin detection, open-set recognition, anomaly detection, and novelty detection overlap extensively. Here, we present a selection of notions that have been proved to be advantageous across a variety of areas, albeit under different titles. All of these concepts have been discussed in prior sections, which can be referred to for more information.
Making compressed representation for normal samples: The concept is founded mostly the projection of normal samples into feature space so that normal training samples are located in close proximity to one another. In this manner, the feature extractor is compelled to concentrate on the most shared features among all normal inputs, which implies that the normal and abnormal feature spaces will have less in common; as a result, abnormal inputs will be projected far from normal inputs and can be easily identified.
This intuition has been followed in anomaly detection by DSVDD 136 and DSAD 137, by finding the most compact hyper-sphere in the feature space that includes normal training samples. GOAD (2) takes a similar approach, determining the most compact hyper-sphere for each set of linear transformations applied to the normal inputs. In open-set recognition, (33) defines a so called 'objectoshpere" loss that minimizes the l2 norm of normal training samples, which is equal to compressing them in a hyper-sphore centered in (0, 0). CAC ([ол) follows the same strategy as GOAD, but rather than relying on transformations, it takes advantage of the labels that are made available during open-set recognition and makes use of variety of normal samples in order generate some distinct hyper-spheres.
Analyzing normal gradient: In this approach, instead of directly using normal features, their gradients are utilized. (172) demonstrated that self-supervised techniques such as GT (48) can perform effectively in the face of a small number of outliers or anomalous samples in the training dataset. This occurs because normal samples alter the gradients substantially more than abnormal samples; thus, the notwork can still mostly extract normal features. Similarly, in out-of-distribution detection, (70) shows that the vector norm of gradients with respect weights, backpropagated from the KL divergence between the softmax output and a uniform probability distribution is greater for normal samples than abnormal inputs.
54

---

Published in Transactions on Machine Learning Research (11/2022)
Outlier exposure technique: Outlier-cxposuro-based methods usually assume that there are abnormal samples that can be easily used to improve performance. For example, (88) uses online training datasets that are free to use during the training process to make better normal boundaries, which improve the -isto--distribution detection method. Similarly, DSAD (137) uses datasets that are already on the internet to learn the distribution of abnormal training samples. The same idea is continued by 33 which was explained more detail earlier.
Generating outliers:
This idea is mainly based on generating fake outliers by the premature training of generative models on the normal distribution. Then, the out distribution model trained with the combi-
nation of the fake and existing normal training samples. The approach followed by DSAD (37, G2D (27),
and Old-is-Gol (189) anomaly detection domain. In the same way, methods like G-OpenMax (40), OpenGAN (85) take the advantages of this approach improve the performance of open-set recognition and out-of-distriiution detection.
Prototype-based methods: Here, the objective is to determine the least number of protolypes are needed adequately cover the normal feature space. The normality score then calculated by cofeatures of each input to the prototypes learned during training. In anomaly detection and open-set recognition, Mem-AE (4) and RPL 22 implement this concept, respectively.
Generative models do not make abnormal inputs. It is assumed that generative models trained on normal distributions struggle create or reconstruct abnormal inputs as well as normal inputs. As result, measurements such reconstruction error in ALE-based approaches or discriminator output in GAN-based structures can be utilized to differentiate normal from abnormal. In anomaly detection, methods such (139 189 1 122: 159 use this approach. In open-set recognition and out-of-distribution detection, C2AE (17,, CROSR 183 and CGDL (162) follow the same methodology.
Leveraging the knowledge of pre-trained models. Instead of using the training datascts available the internet, why not utilize the models that have been trained on these datasets? Pre-trained features intuitively contain information that can be conveyed to downstream tasks more effectively than the original training samples. Several approaches have been developed in anomaly detection and open-set recognition based on this notion, such as MKD (44), which distills the knowledge of a pre-trained model for normal training samples into another network to improve anomaly detection performance. Similarly, open-set. rocognition, DTL (121) employs the filters of a pre-trained model that are more stimulated when the model is presented with normal inputs as an additional detection criterion to filter open-set samples during the evaluation.
Self-supervised learning-basee based methods: Tt has been shown by (107) that learning better representations has direct correlation with the performance of open-set recognition. Therefore, self-supervised learning methods as well-known unsupervised representation learning technique seems to be a good fit for anomaly detection, novelty detection, open-set recognition, and out-of-distribution detection. Following this approach, several methods such as CST (165), DA-Contrastive (158) Paste (Р)) have been proposed, which show a strong performance in detecting semantic and pixel-level anomaly detection. In out-of-distribution detection, (60) investigates the effect of self-supervised learning on detecting outliers extensively. A similar approach was also followed by (150 107), which was explained in detail in previous sections.
7 Dataset
7.1
Semantic-Level Datasets
Below we summarize datasets that can be used to detect semantic anomalies. Semantic anomalies are those kinds of anomalics that the variation of pixels leads to the change of semantic content. Datascts such as MNIST, Fashion-MNIST, SVHN, and COIL-100 are considered toy datasets. CIFAR-10, CIFAR-100, LSUN, and TinyImageNet are hard datasets with more variations in color, illumination, and background.
55

---

Published in Transactions on Machine Learning Research (11/2022)
Finally, Flowers and Birds are fine-grained semantic datasets, which makes the problem even harder.
MNIST 855 This dataset includes 28 x 28 grayscale handwritten digits from 0-9 and consists of 60k training images and 10k testing ones.
Fashion MNIST (177): This dataset comprises of 28x28 grayscale images of 70k clothing items from calegories. The training set has 60k images and the test set has 10k images.
CIFAR-10 (83): The CIFAR-10 has 60k natural images. It consists of 32x32 RGB images of 10 classes, There are 50k training images and 10k test images.
CIFAR-100 (83) This datasel is very similar to CIFAR-10, but it has 100 classes containing 600 images The 100 classes are grouped into 20 super classes. Each class has 500 training images and 100 testing images.
TinyImageNNet (11: The Tiny ImageNet dataset consists of subset of ImageNet images It contains 10,000 test images from 200 different classes. Also, two more datasets, TinylmageNet (crop) and IinylmageNNet (resize) can be constructed, by either randomly cropping image patches of size 32 x 32 or downsampling cach image to size 32 x 32.
LSUN (184): The Large-scale Scene UNderstanding dataset (LSUN) has a testing set of 10,000 images of 10 different scene categories such as bedroom, kitchen room, living room, etc. Similar to Tinylmaged ImageNe,,,,, two more datasets, LSUN (crop) and LSUN (resize), can be reconstructed by randomly cropping and downsampling the LSUN testing set, respectively.
COIL-100 (112):: COIL-100 is dataset of colorful images of 100 objects. It comprises 7200 128x 128 images. Images are captured from objects placed on a motorized turntable against black background, and there are 72 images of each object in different poses.
SVHN can be seen as similar in flavor to MNIST (e.g., the images are of small cropped digits), but incorporates an order of magnitude more labeled data (over 600,000 digit images) and comes from significantly harder, unsolved, real-world problems (recognizing digits and numbers in natural scene images). SVHN is obtained from house numbers in Google Street View images.
SVHN 113):
Flowers is a 102 category dataset, consisting of 102 flower categories. The flowers chosen to be flowers commonly occurring in the United Kingdom. Each class consists of between 40 and 258 images. The images have large scale, pose and light variations. In addition, there are categories that have large variations within the category and several very similar categories.
Flowers 115)
Birds 175): CUB-200-2011 is bird classification task with 11,788 images across 200 wild bird species. There is roughly equal amounts of train and test data. It is generally considered one of the most challenging datasets since each species has only 30 images for training.
7.2 Lixel-Level Datasets
In these datasets unseen samples, outliers or anomalies do not have semantic difference with inliers. This means an area of the original image defected; however, the original meaning still reachable, yet has been harmed.
This dataset is an industrial dataset, it provides 5354 high-resolution images divided into ten objects and five texture categories and contains 3629 training images. The test set contains 467 normal images and 1258 abnormal images having various kinds of defects.
MVTec AD ((13)
PCB (711): PCB dataset. containing 1386 images with 6 kinds of defects for the use of detection, classification and registration tasks. Images are captured in high-resolution.
LaceAD (179)): LaceAD contains 9,176 images from the top 10 lace fabric manufacturing companies worldwide, where the images are captured in the real production environment by high-resolution DSLR
56

---

Published in Transactions on Machine Learning Research (11/2022)
camera, They are categorized into 17 subsets based their patterns. Each image has the size of 512 x 512 and has been labeled by professional workers.
Retinal-OCT ((77) This consists of 84,495 X-Ray images in categories CNV, DME, DRUSEN, and NORMAL, each of which has subtle differences with respect to others.
CAMELYONI6 (9)): Detocting metastases of lymph nodes an extremely important variable in the diagnosis of breast cancers. Tissue with metastasis may differ from healthy one only in texture, spatial structure, distribution of muclei, and can be easily confused with normal tissue. The training dataset of Camelyon16 consists of 110 whole-slide images (WSIs) of tumors, and 160 non-tumor cases, and testing dataset with 80 regular slides and 50 slides containing metastases.
I29) Chest X-Ray datasets are medical imaging datasets which comprise a large number frontal-view X-ray images of many unique patients (collected from the year of 1992 to 2015). The datasets include cight fourteen common discase labels, mined from the text radiological reports via NLP techniques. Images not registered and captured in different pose and contrast, which makes the detection task challenging.
Chest X-Rays (1733
Species (62) This dataset consists of organisms that fall outside ImageNet-21KK, Consequently, ImageNet- 21K models can treat. these images as anomalous.
ImageNet-O (63)): ImageNet-O) is a dataset of adversarially filtered examples for ImageNet out-of- distribution detectors. To create this dataset, at first, ImageNet-22KK downloaded, and shared examples from TetgeNet-1I are deleted. With the remaining ImageNee-22K examples that do not belong to ImageNet-1K classes, examples that are classified by ResNet-50 kept. Finally, visually clear images are selected. This creates datasel of OOD examples that are hard for ResNet-50. These examples are challenging for other models to detect, including Vision Transformers.
ImageNet-1K class with high confidence
98
4
Rolaids
Figure 43: Sample visualization of MNIST, Fashion-MNIST,, SVHN, COIL-100, Birds, Chest X-Rays, Cifar- 10, TinyImageNet, LSUN, Flowers, MVTeaAD, PCB, Retinal-OCT, CAMELYON16, LaceAD, MNIST-C, ImageNet-CC C, and ImagoNet-P.
7.3 Synthetic Datasets
These datasets are usually made using semantic-level datasots; however, the amount pixcl-variations is under control such that unseen, novel, or abnormal samples are designed to test different. aspects of trained
57

---

Published in Transactions on Machine Learning Research (11/2022)
models while preserving semantic information. For instance, MNIST-c includes MNIST samples augmented with different kinds of noises such as shot noise and impulse noise, which are random corruptions that may occur during the imaging process. These datasets could be used to not only test the robustness of the proposed models, but also for training models in the AD setting instead of novelty detection or open-set recognition. Due to the lack of comprehensive research in the field anomaly delection, these datasets can be very beneficial.
MNIST-C (109): MNIST-C dataset is comprehensive suite of 15 corruptions applied to the MNIST test set for benchmarking out-of-distribution robustness in computer vision. Through several experiments and visualizations, it is shown that the corruptions siguificantly degrade the performance of state-of-the-ar computer vision models while preserving the semantic content of the test images.
This can be scen as the ImageNet version of MNIST-C. For the ImageNNel-C, a set of 75 common visual corruptions are applied on each image, and for the ImageNet-P, set of perturbed or subtly differing ImageNet images are introduced. It is shown that although these perturbations are not chosen by an adversary, currently existing networks exhibit surprising instability common perturbations.
ImageNet-CC, ImageNet-P (55):
An overall visualization of the mentioned datasets can be found in Fig. 43
8
Evaluation Protocols
8.1 AUC-ROC
Receiver Operating Characteristics (ROC) is well-known criterion. Given a test dataset including positive and negative (or seen and unseen ) samples, it characterizes the relation between the false positive rate (FPR) and the true positive rate (TPR) at different detection thresholds. AUC-ROC is the area under the ROC curve, which is a threshold-nndeeendent metric. The highest value of ROC 1, and 0.5 indicates that the model assigns the positive label with random guessing.
In the literature, AD and ND are usually tested in one-vs-all setting that considers one class as normal and the rest of the classes as anomaly, unseen or unknown. For OOD detection, the in-distribution data is considered positive and OOD data is considered negative. For instance,
train model on CIFAR-10 and consider MNIST as outlier at the test time. This means training and testing datasets have a large contrast with each other. Sometimes instead of MNIST, uniform noise or Gaussian noise can be used.
8.2 FPROTPR
Although AUC-ROC is common metric, in practice, models have select a specific threshold perform detection. To address this issue, operating point the ROC which is desired with respect to applications is selected. A commonly-used metric is FPROTPRz, which measures the FPR when the TPR is x 0.95.
8.3 AUPR
AUPR the Area under the Reecilion-Reeall curve, which another threshold independent metric. The TP PR curve depicts the precision=Tp=t TP and recall= TP under different thresholds. some literature, the metrics AUPR-In and AUPR-Out denote the area under the precision-recall curve where in-distribution and distribbiit images
specified positives, respectively. This metric is usually used in OOD detection setting. FP is the number of false positives, TN is the number of true negatives, FN is the number of false negatives, and TP is the number of true positives.
8.4 Accuracy
This metric is usually used in OSR, which is a common choice for evaluating classifiers under the closod-set assumption, as follows:
58

---

Published in Transactions on Machine Learning Research (11/2022)
A= Σ (TP; + TN,) D Li=l (TP, + TN, + FP, + FN;)
(116)
This can be easily extended to open-world assumption in which UUCs must be classified correctly:
( TU Ao E. + TN, + FP. FN,) + (TU + FU)
(117)
where TU specifies the number of correctly predicted UUC samples.
Although accuracy is a common metric; however, it is very sensitive to inbalanced number of samples, which is not the case in metrics such as AUC-ROC. To cope with this issue, a normalized accuracy (NA), which weights the accuracy for KKCs (AKS) and the accuracy for UUCs (AUS) defined as follows:
NA A,KSS + (1 A.)AUS
(118)
where
Ee (TP, +N,)
AKS
Σ (TP, + TN; + FP, + FN,)
(119)
TU
AUS
TU + FU
and 0 S is a regularization constant.
8.5 F-measure
The F-measure F-score is the harmonic mean of precision P and recall R:
Px R F-2x P+R R
(120)
Note that F must be computed in the same way as the multi-class closed set scenario. This is because the correct classifications of UUCs would considered as true positive classifications; however, it makes no sense since there is no UUC sample in the training process. Therefore, the computations of Precision and Recall only for KKCs modified to give relatively reasonable F-measure for OSR. The measures called macro-F F- measure and micro-F-measurr measure respectively as follows:
1
TP:
TP: TP: + FN,
P
Rum
C
TP++FD
(121)
EC TP. (TP, EE FF))
Di=l TP.
P
Rmi
(TP, (TP.+FM FN.)
Note that although the precision and recall only consider the KKCs; however, by computing FN, and FP, false UUCs and false KKCs are taken into account (76)
59

---

Published in Transactions on Machine Learning Research (11/2022)
8.6 Comparing Evaluating Procedures of Each Domain
Each domain assessment process establishes the practical restrictions that must be met before the claimed performance of proposed methods within that domain can be trusted. Furthermore, in some domains, such OSR and OOD detection, highlighting the differences in evaluation protocols utilized in each domain might help to gain a better expectation about the reported performances when applied in practical applications. As a result, given an arbitrary dataset such as CIFAR-10 (83), the following heining//estingg setup is employed at each domain:
AD/ND: (1) Select a random class out of 10 given classes as normal distribution. (2) Train one-class feature extractor according to the discussod approaches. (3) Test the trained fcature extractor on the entire lest-set, which implies the implicit assumption of 10% likelihood for the occurrence of normal events and 90% for the abnormal ones.
OOD Detection : (1) Use the whole training dataset to train multi-class feature extractor. (2) As the out-of-distribution dataset, choose another dataset, such as one of the datasets listed above. (3) Consider the entire test set to be normal and select some random samples from the distribiitti dataset so that the chance of abnormal occurrences lower than normal when all the samples are combined. As can be observed, this assessment methodology makes an implicit assumption about the rarity of anomalies, which OSR does not.
OSR (1) As the normal distribution, pick K random classes. (2) Train multi-class feature extractor
according to the discussed approaches. (3) Test the trained feature extractor on the entire test-set. As previonsly stated, K is decided based on the openness score. This suggests that abnormal events may have a higher probability than normal events, because anomaly means not being a member of the normal sets. For instance, in the self-driving car application, a model might be only responsible for detecting people and cars as two small sets of many definable sets existing in the agent environment. This key distinction between the OOD detection and OSR viewpoints.
9 Core Challenges
Here we examine the core and ongoing challenges in the fields. This allows the community to employ existing knowledge and craft. future solutions effectively.
9.1 Designing Appropriate Self- Supervised Learning Task
As aforementioned, some methods such as AS recently investigated (6) [82) that augmentation techniques used as SSL tasks are not always beneficial for ND, OSR, and, OOD.
1
55
use SSL tasks to identify outliers; however, it has been
182) shows that self-supervision acts as yet-another model hyper-parameter, and should be carefully chosen in light of the types of real abnormalities in the data. In other words, the alignment between the augmentation and underlying anomaly generating process essential for the success of SSL-based anomaly detection approaches. SSL can even worsen detection performance in the absence such aligument. Similarly, L shows that Maximum Softmax Probability (MSP), as the simplest baseline for OSR, applied on Vision Transformers (ViTs) trained with carefully selected augmentations can surprisingly outperform many recent methods. As result, the community needs to research more the SSL tasks particularly designed to fulfill the goal of outlier detection.
9.2 Data Augmentation
One source uncertainty in classifying known or normal training samples could be the lack of generalization performance. For instance, one rotates a bird image, content not harmed and must be distinguished as the bird again. Some of the mentioned works try to embed this ability into models by designing different SSL objective functions. However, there is also another way to do that, using data augmentations. Data
60

---

Published in Transactions on Machine Learning Research (11/2022)
augmentation is common technique to enrich the training dataset. Some approaches 33
194
188
143
improve generalization performance using different data augmentation techniques.
From another point of view, (22 attempts to generate unseen abnormal samples and use them to convert a one-class learning problem into a simple two-class classification task. Similarly, however in the OSR setting, [22 and (35) follow the same idea. All these studies can also be seen as working on a training dataset make richer for the further detection task. From what has been said, is obvious that working on data instead of models could achieve very effective results and must be investigated more in the sense of different trade-offs in the future.
Recently, (166) has shown the effectiveness of generating fake samples by utilizing SDE-based models 161 instead of GANs. The key innovation in this study is new strategy for creating synthetic training outliers using SDE to train OE-based ND algorithms. By optimizing previously trained SOTA models for the task of ND, the paper shows the effectiveness of the obtained samples. Following the conventional OE pipeline, it minimizes the binary cross entropy loss between the normal training data and artificial outliers.
9.3 Small Sample Size and Few-Shot Learning
Learning with a small sample size is always challenging, but desirable. One way of approaching the problem could be to exploit meta-learning algorithms (41 M14,, and to learn generalizable features that can be easily adapted to AD, ND, OSR, or OOD detection using few training samples (TO).. One challenge in meta-learning is handling distribution shift between training and adaptation phase, which might result in producing one-class meta-learning algorithms such as (33). Also, other approaches explored generating a synthetic OOD datasct to improve few-shot classification of in-class samples (74). Although, the combination of meta-learning and AD, ND, OOD detection, and OSR has gained significant atlention recently, some important aspects-suue such as generalizing to detect UUCs using only a few KUC and the convergence of meta-learning algorithms one-class setting-remanh underexplored.
Recently, some efforts have been made to manipulate the knowledge of pre-trained vision-language models to tackle the problem of zero-shot and few-shot AD and OOD. For instance, (99) uses CLIP (28) and textual queries to define the normal class without utilizing any visual inputs. Similarly, yet in the OOD evaluation setting, 42 provides an extensive number of experiments to show the capabilities of vision transformers at detecting near--ont-ofddisttibbttto samples. They also test zero-shot and multi-modal settings using dison-languee based models.
10
Future Challenges
Here we provide plausible future directions, which might be of interest to both practitioners and academic researchers.
10.1
Evaluating Baselines and the Evaluation Protocols of OOD Detection
The evaluation protocols for OOD detection has room for improvement. For instance, 22) trains a mixture of three Gaussians on the CIFAR-10 dataset (as ID), and evaluated against OOD datasets including Tiny Imagenet. (crop), Tinylmagenet (resize), LSUN, (SUN(resize) and iSUN. The model is trained channel-wise at a pixel- level. Tab. 2 shows the detection results on different datasets. The results are comparable with SOTA despite the simplicity. In particular, LSUN performs poorly since the majority of them have uniform color and texture, with little variation and structure. Similar to what has been observed in likelihood- methods, LSUN "sits inside" CIFAR-10 with similar mean but lower variance, and ends up being more likely under the wider distribution.
We also provide a better insight into the performance of OOD detection baselines, evaluated on both near and far out-of-distribution datasets. For a model that trained on CIFAR-10, 10, we have considered the CIFAR-100 as the near OOD dataset. The results are presented in Tables 3 4 and As is shown, none of the methods are good at detecting both near and far OOD samples, except OE approaches that use an extra auxiliary dataset. Using Mahalanobis distance can improve the performance of most of the methods at.
61

---

Published in Transactions on Machine Learning Research (11/2022)
detecting far OOD samples, while degrading the performance of near OOD detection. Moreover, it can also have poor performance at detecting even some of far OOD samples due to inaccurate Gaussian density estimation. Furthermore, its performance varies significantly when OOD dataset is resized or cropped, showing its dependency on low-level statistics. For instance, notice the SVHN column of Table G This is in correspondence with what has been shown recently by 133 on the deficiencies of Mahalanobis distance as well.
One solution to resolve the issue might be applying imput pre-processing techniques such as ODIN to alleviate the effect of first and second-order statistics in assigning OOD scores; however, it increases the execution speed by the sum of an extra forward and backward pass during testing. Additionally, techniques such as ensembling or MC-Dropout (4) might be slightly better than others on some OOD datasets; yet, they need multiple forward passes, increasing the execution time significantly. For example, the reported MC-Dropout is 40 times slower than a simple MSP. In summary, future works are encouraged to evaluate OOD detection on both near and far OOD datascts.
Table 2: The performance of a simple method using only low-level features on different datasets 2
OOD Dataset
Average Precision
Tiny Imageeee
96.8
Tiny wetgemmaageeeeeeeeeeeeeee (resize)
99.0
LSUN LSUN(resize)
58.0
99.7
iSUN
99.2
10.2 AD Needs to Be Explored More
As mentioned earlier, AD and ND are not completely the same, both historically and fundamentally, An essential and practical category of problems in the real-world application are those that can not be cleaned easily, and consequently, contain different kinds of noises such as, label noise or data noise. This is the case in complex and hazardous systems such modern nuclear power plants, military aircraft carriers, air traffic control, and other high-risk systems (64) Recently proposed methods in ND need to be evaluated in AD settings using the proposed synthetic datasets, and new solutions need to be proposed. As the openness score is usually high for AD detectors, having a high recall while providing a low false alarm rate is necessary for their practicality (29).
Furthermore, almost all the AD or ND mothods are evaluated in the onc-vs-all setting. This results having normal class with a few distribution modes, which not good approximation of real-world scenarios. Therefore, evaluating AD or ND methods in multi-class settings similar to OSR domain while having no access to labels could give more clear perspective on the practicality of SOTA methods. Table 7 reports the performance of the most notable works using the standard evaluation protocols explained before. All the results are reported from the main papers.
10.3 OSR Methods for Pixel-Level Datasets
Almost all the methods existing in OSR are evaluated on semantic datasets. As class boundaries in such datasets are usually far from each other, discriminative or generative methods can model their differrnces effectively. However, in many applications such as Chest X-ray datascts, variations are subtle. Existing methods can result in poor performance on such lasks. For instance, a model may be trained on 14 known chest diseases. A new disease, for example, COVID-19, may emerge unknowns. In this case, the proposed model must detect it as new illness instead of classifying it into pre-existing discase categories. Also, in many clinical applications where medical datasets are gathered, usually, disease images are more accessible than healthy ones; thus, OSR problems must be learned on sickness as normal images and detect healthy ones as abnormal inputs.
Table shows the performance of simple MSP bascline on MV dataset when some frequent faults are considered normal classes. Tn such scenarios, the goal is to detect and classify well-known faults
62

---

Published in Transactions on Machine Learning Research (11/2022)
while distinguishing rare ones outliers that need to be treated differently. Although this is a common and practical industrial setting, the baseline does not perform better than random, casting doubt on their generality for sriety-critical applications.
Recently, (26) has shown the effectiveness of using a prior Gaussian distribution on the penultimate layer of classifier networks, similar to what has been done in several before-mentioned works, in tasks in which the distribution of seen classes are very similar to each other, for instance, Flowers or Birds datasets that were introduced in the previous sections. However, more rescarch should be done in this setting since it is more practical and quite harder than the traditional ones. Table g reports the performance of the most notable works using the standard evaluation protocols explained before. All the results are reported from the main papers.
10.4 Adversarial Robustness
Carcfully designed imperceptible perturbations fooling deep learning- models to make incorrect predic- tions are called adversarial allacks (186). Up to this time, it has been shown that classifiers are susceptible to adversarial attacks, such that their performance degrades significantly at test time, As in OOD detection, OSR, AD and ND, being robust against adversarial attacks is crucial. Recent works OSR (b4 135),
ND 143 142), and OOD detection [T03] 24 149 (3) have investigated the effects of adversarial attacks on
models; however, more is needed. For instance, as anomalies in AD or UUCs in OSR are inaccessible at the training time, therefore, achieving robust model on attacked anomalies or UUCs would not be trivial.
The relation of different defense approaches against adversarial attacks with novelty detection can also reveal some important insights about the internal mechanisms of the proposed models. For instance, membership attack (156) attempts to infer whether an input sample has been used during the training process or not, which can be seen as designing novelty detectors without having any generalization to UKC samples. Also, Bri investigates the relation of detecting poisoning attacks and novelty detectors. Poisoning examples that are intentionally added by attackers to achieve backdoor attacks could be treated as one type of "outliers" in the training dataset. It is claimed that differential privacy not only improves outlier detection and novelty detection, but also backdoor attack detection of ND models.
From an entirely different point of view, as it is mentioned in (22), adversarial robust training can be employed to boost learned feature space in a semantic way. This path has been followed ARAE (13) and Puzzle-AE L22 to improve the performance of AEs in detecting unseen test time samples. Similar intention is followed in the one-class learning method (50) that shows robustness is beneficial for detecting novel samples. This path also needs to be explored more, for instance despite standard adversarial attacks in classification tasks ( attacks do not need to be imperceptible anymore in AD or ND and sometimes perceptible ones improve detection performance more.
10.5 Fairness and Biases of Models
Research on fairness has witnessed a significant growth recently (190) 18 B9g: It has been shown that models become biased towards some sensitive variables during their training process. For instance, (174) show that for attribute classification task in the CelebA (97) dataset, attribute presence is correlated with the gender of people in the image, which obviously not desirable. Attributes such as gender in the mentioned example are called protected variables. In OOD detection literature, a recent work (105) systematically investigates how spurious correlation in the training set impacts OOD delection. The results suggest that the OOD detection performance is severely worsened when the correlation between spurious features and labels is increased in the training set. For example, model that exploits the spurious correlation between the water background and label waterbird for prediction. Consequently, a model that relies on spurious features can produce a high-confidence prediction for an OOD input with the same background (i.e., water) but a different semantic label (e.g., boat).
Fairness and AD or ND seem to have fundamental contrast with each other. In fairness, unbiased models are required in which equality constraints between minorities and majorities hold while the goal of AD models
63

---

Published in Transactions on Machine Learning Research (11/2022)
Table 3: OOD example detection for the maximum softmax probability (MSP) baseline detector, maximum logit value, the MSP detector after fine-tuning with Outlier Exposure (OE), the maximum logit value after fine-tuning with Outlier Exposure (OE), ensemble of models, Mahalanobis distance, and Monte Carlo dropout. Inlier distribution is considered CIFAR-I0. All results are based on evaluations and are average percentages of 10 runs. Missing values (-) indicate that we are proposing this setting, and it has no specific reference.
Methed
Refermecs
Oriooiion
Gamesio
Redemncher
Bleb
TinyImagsNinneereg
Tinyfrag:Nee(eeiin
1.SUN(
[SUNN(owiz))
ISUN
SVEN
CIFAR--00
F23195
14.53
70.50
17.06
40.10
12.65
29.21
25.37
MSP
50
AUBOC
$8.30
91.94
H7.17
AUPR
70.50
52:21
74.23
75.00
$8.15
83.18
03.30
62:46
67.10
55.08
FPR55
$2.00
73:27
11:67
9.50
47:67
4.95
27.28
96.42
43.54
56.52
MIN
AUROC
80.10
AUPR
27.07
25-47
83.56
90:31
65.65
96.95
78.18
73.90
72.05
61:47
FPR55
0.71
0.30
0.58
6.61
13.00
1.32
5.16
5.54
4.77
28, 15,59
MSP-OE
AUROC
90.90
09:78
00.84
06.77
07:27
96.70
08
05.87
98.42
03.35
AUPR
FPR95
0.09
0.43
0.49
4.98
10:17
1.11
6.10
4.50
4.05
30.55
MEX-OR
AUROC
99.02
29.7U
99.88
16.06
97.58
90.74
00.
99.02
98.61
01.110
AUPH
M5.35
76.36
FPRUS
0.84
16.71
16.71
15.00
100
12.34
25.01
100.00
10.71
.00
Eneemble
AUROC
97.57
96.91
91:20
93.18
85.69
95.25
90.21
85.00
92.05
83.000
AUPR
82.52
64.52
71.40
56.32
78.07
64. 90
61:00
67.25
53,00
FPRSS
2.01
7.38
85.82
48.38
61
27.
39.02
34.79
Mainlinnaiss
Mall
AUROC
99.57
99.64
98.21
87.78
87.00
57.10
92. 25
90.41
50.86
H6.71
AUPR
96.49
97.95
91..53
46.79
55.33
41.59
05.14
02:17
$0.36
54.00
FPRSS
10.54
28.73
MC Dropont
E51
AUROC
$3.89
63.41
94.73
90.35
68.52
00.09
01. 01.30
69.73
91.07
88,
AUPR
63.52
35.00 40
74.91
71.05
58.10 10
77.20
05.34
61:70
62:41
56.84
99.4
07.50
01388
51,00
51.40
ODIN
AUBOC
300.00
42.50
AUPB
03.52
35.40
74.91
71.65
58.10
77.26
03.34
61.76
62.41
56.84
is to assign higher anomaly scores to rarely happening events. To address this issue, 1b1 193) proposed fairness-aware ADs while using the label of protocted variables as an extra supervision in the training process.
From different point of view (8TT,, introduces a significantly important bias in semi-supervised anomaly detection methods such as DSAD 1371. Suppose DSAD has been implemented in law enforcement agencies to spot suspicions individuals using surveillance cameras. As few number of training samples has been used as abnormal samples during the process, the trained model might have been biased towards detecting specific types of anomalics more than others. For instance, if the auxiliary abnormal training datasct includes more men than women, boundaries of detecting abnormal events as men might be looser than women at the lest time. This could also happen in the classification settings such as OOD detection or OSR. (133) reports the existence of unfair biases toward some unrelated protected variables in detecting chest discases for classifier trained Chest X-Ray datasets. From what has been said, it seems fairness and AD, ND, OSR, and OOD detection are strongly correlated because of some critical applications in which they are used and further research on their correlation is necessary for having practical models.
10.6 Multi-Modal Datasets
In many situation, training dataset consists of multi-modal training samples, for instance in Chest-X-HB X-Ray datasets, labels of images are found automatically by applying NLP methods on the prescribes of radiologists. In these situations, joint training of different modes could help models to learn better semantic features. However, in this way, models need to be robust in different modes too. For example, in visual Question Answering tasks, we expect model not to produce any answer for out-of-distributiin input texts or images. Note that the correlation between different modes must be attended here, and independent training of AD, ND, OOD detection, or OSR models for different modes results in sticking in local minimas. To cope with this issue, (87) has explored the performance of VQA models in detecting unseen test time samples. However, there are many more challenges need to be investigated in this way. For instance, the robustness and fairness of VQA OOD models is significantly more challenging compared to single mode datasets, besides due heavy training process of these models, inventing few-shot methods might be demanding in the fields.
64

---

Published in Transactions on Machine Learning Research (11/2022)
Table 4: OOD example detection for the maximum softmax probability (MSP) baseline detector, maximum logit value, the MSP detector after fine-tuning with Outlier Exposure (OE), the maximum logit value after fine-tuning with Outlier Exposure (OE), ensemble of models, Mahalanobis distance, and Monte Carlo dropout. Inlier distribution is considered as CIFAR-100. All results based average percentages of 10 runs. Missing values (-) indicate that we are proposing this setting, and it has no specific reference.
evaluations and are
Method
Refermmecs
Oriterion
Cansersan
Redemacher
Blob
Tinytragg/ee((erp))
T.UUNeepp))
1.8U7N(rviin))
ISUN
SVHN
CHFAR--10
54.52
30.08
47.32
65.15
AUROC:
64.86
73:27
80.34
74.56
65.56
76.50
71.43
12
AUPR
19.32
30.03
29.951
165.8
338.11
56.49
34.11
33.85
30.44
33.92
FPRIS
01.20
13.00
09:20
30.000
UH
92.00
AUPR
98.70
83.70
94.50
97.70
89.50
08.20
90.90
87.90
86.90
70,00 60
FPR05
71.89
72.55
81.00
22.51
66.17
22.20
61.30
60.86
67.01
41
MLV
44.24
94.72
77.72
50.019
79.54
74.014
77.55
AUPR
19.82
14:20
15.98
79.10
38.00
81.11
39.14
37.27
31.99
$7.30
PPRO5
12.41
18.89
12:04
22.02
13.27
60.89
43.10
62.55
MSP-OE
64
AUROC
AUPR
71:13
56.81
85.91
85.34
39.57
00.00
48.52
45.90
53.27
$2.28
FPRA5
10.71
16.65
5:00
17:34
73.96
08.50
56.02
60.75
32.50
64.91
MIN-OR
AUROC
AUPR
72.81
52.03
88.60
86.35
72
02.00
$1.06
48.21
54.72
50:48
FPRIG
22.72
48.51
48.07
44.08
100000
47.216
100.10
91.44
57.18
57.18
Ensembiee
AUROC
46:45
21.63
44.31
21.558
44.12
28.75
28.66
31.70
02
FPRBS
0.82
0.30
2.70
T3.79
63.40
76.42
37.94
42.07
32.00
70.80
Mahalannkis
HAU
AUROC
99.78
$4.35
98.53
16.11
75.87
PPR35
56.45
41.41
46.64
47.32
055
55,38
60.53
65.03
75,08
63.33
MC- Dropont
H
AUROC
62:55
76.51
80.50
85.23
75.66
52.24
74.03
74.70
68.89
76.65
18.74
27.34
54.12
32.57
49.08
33.04
28.63
10.7 Explainablity Challenge
Explainable AI (XAI) has found scriously important role in the recently proposed deep network architectures, especially when they are used in safety-critical applications (5). In AD, OSR, ND and OOD delection due to some of their critical applications, we should be able to explain the reason of decisions our models make For instance, if a person is distinguished as suspicions in the surveillance cameras, there must be
[33 57 good reasons for that by which the model has made its decision.
The challenges of explainability can be defined into two different approaches. First, we should explain why a sample is normal, known in-distribution. Secondly, we should explain why sample is abnormal, unknown ont-of-distributton. There are a lot of different techniques to explain the decisions of models in the literature such as Grad-cam (151), Smoothfgrad (157), which have been used in Multi-KD) (144), CutPaste (90) and 168.. However, they only have been used to explain normal, seen or in-distribution samples and their results are not as accurate as enough for unseen or abnormal imputs. To cope with the issue, (96) proposed a VAE based method which can provide the reasons of abnormality of input samples while performing accurately on explaining normal samples as well. However, docs not work well on complex training datasots such as CIFAR-10, which shows the need of conducting more research toward mitigating the problem.
Another important challenge of explainability can be seen in one-class classification or ND approaches, in which there is only access to one-label at the training time. Therefore, Gradcam or Smoothgrad which use the availability of fine-grain labels can not be used anymore. To address this issue, (98) proposed a fully convolutional architecture with a heatmap upsampling algorithm that is called receptive field upsampling, which starts from sample latent vector and reverse the effect of applied convolution operators to find important regions in the given input sample. However, explainable OCC models are still largely unexplored and more investigations in this direction are still necessary.
65

---

Published in Transactions on Machine Learning Research (11/2022)
Table 5: OOD example detection for the maximum softmax probability (MSP) baseline detector. Inlier distribution is a set of faults in MVTecAD datasct, and outliers are rare faults. All results are average percentages of 10 runs.
Class Name
Normal Sets
AUC
FPR
AUPR
Cable
good,commined, missing cable, poke insulation
51.70
1
24.20
Capsule
good, poke, faulty imprint, crack
56.40
1
15.80
Wood
good, color, scratch, liquid
53.30
1
86.40
Carpet
good, motal, contamination, hole
50.20
1
14.70
10.8 Reliability of ODD Detection Methods
While OOD detection research has advanced considerably, SOTA performance has become saturated under the existing testing frameworks. Naturally, this raises the question of whether SOTA OOD detection methods are similarly effective in practice. Novel OOD detection research directions have recently emerged that expose weaknesses in existing SOTA methods that prevent their use in the real world. (78) introduces a novel evaluation framework for OOD detection. They introduced new test datasets with semantically preserved and realistic distribution shifts, as well as a novel metric to evaluate method generalization of OOD detection methods to real-world scenarios. Due to semantic consistency, SOTA OOD detection methods are expected realistic distribution shifts. Under rcalistic distribution shifts, SOTA methods
to have high performance are shown to have significant performance drops, demonstrating serious concern when it comes to OOD detection in the real world. Similarly, (59) aims to make multi-class OOD detection in real-world settings more fcasible by introducing new benchmark datasets consisting of high-rosolution images over thousands of classos. As result of their research, the authors demonstrate the need for new benchmarks to redirect research toward real-world applications. Additionally, ( examines the adversarial safety of OOD detection methods and proposes a method that improves robustness. Defenses against adversarial attacks are also paramount for safely deploying OOD detection into the real world. The saturation of OOD detection performance does not signal the end of this research. Continuing to advance this field requires new standardized evaluation frameworks that more accurately quantify a method's practical effectiveness.
10.9 Multi-Label OOD Detection and Scale Datasets
While OOD detection for multi-class classification has been extensively studied, the problem for multi-label networks remain underexplored (I7I). This means each input has more than one true label by which it must be recognized. This is more challenging since multi-label classification tasks have more complex class boundarics, and unseon behaviors could happen in a subset of input sample labols. Another challenge of multi-label datasets can be explored in anomalous segmentation tasks. Different from classification which one can report an entire image as an abnormal input, the specific anomalous part must be specified here.
Current methods have been primarily evaluated on small data sets such CIFAR. It's been shown that approaches developed on the CIFAR benchunark might not translate effectively into ImageNet benchmark with large semantic space, highlighting the need to evaluate OOD detection in a large-scale real-world setting. Therefore, future research is encouraged to evaluate on ImageNet-based OOD detection benchmark (9) and test the limits of the method developed.
10.10 Open-World Recognition
Although detecting novel, unknown or out-of-distribution samples is enough in controlled lab environments, novel categories must be continuously detected and then added to the recognition function in roal-world operational systems. This becomes even more challenging when considering the fact that such systems require minimal downtime, even to learn (10). While there has been much research on incremental (II and life-long learning (120) for addressing the problem of adding new knowledge to pre-existing one, open-world
66

---

Published in Transactions on Machine Learning Research (11/2022)
Table 6: OOD example detection for the maximum softmax probability (MSP) baseline detector, maximum logit value (MLV), the MSP detector after ane-tuning with Outlier Exposure (QE), the maximum logit value after fine-tuning with Outlier Exposure (OE), ensemble of 3 models, Mahalanobis distance, and Monte Carlo dropout. Inlier distribution is considered as TinymmageNet. All results are based average percentages of 10 runs. Missing values (-) indicate that we are proposing this setting, and it has no specific reference.
evaluations and are
Method
References
Criterion
Gauseian
Rademacher
Blob
(SUN(crop)
(SUS(zesize)
ISUN
SVHN
FPR96
72.34
47.00
90.31
29.33
44.37
45.68
44.76
MSP
56
AUROC
33.36
70.52
22.79
90.66
86.16
85.94
89.05
AUPR
12:27
22.76
10.55
77.91
50.79
51.16
67:21
FPR95
43.70
59.40
74.60
14.80
38.90
38.90
23.70
ODIN
AUROC
96.80
87.10
AUPR
56.60
45.10
43.10
96.60
83.10
87.60
92.80
FPROG
67.38
21.56
97.58
10.96
28.53
27.80
27.51
MLV
AUROC
45.34
90.24
15.96
97.75
91.71
91.98
94.09
AUPR
14:15
19.31
9.77
91.22
61.00
66.12
79.28
FPR95
45.32
49.53
0.05
0.53
0.12
0.12
0.39
MSP-OB
AUROC
76
99.97
99.97
AUPR
28.32
19.97
99.93
98.37
99.82
99.79
98.11
FPR93
11.21
16.46
0.05
0.52
0.11
0.12
0.38
MIV-OE
AUROC
95.45
68.30
99.00
99.81
90.97
99:97
99.83
AUPR
99.93
98.48
99.81
99.79
98.16
FPR95
71.09
45.96
78.16
46.55
57.62
38.94
5/1.600
Ensemble
AUROC
35.75
51.80 8G
83.72
76.54
75.70
77.09
AUPR
12.61
25.61
15.70
50.66
34.67
33.48
34.89
FPR9G
06.87
48.15
22. 23
98.46
72.04
79.93
96188
Mahalanohis
LM
AUROC
48.74
70.28
92.41
13.33
71.11
68.65
27.50
AUPR
9.48
28.17
25.19
10.81
FPR95
76.09
56.14
91.36
30:11
13.25
47.22
17.67
MC-Dropout
45
AUROC
30.38
58.92
21.31
93.13
85.66
84.45
87.44
AUPR
11.82
17.54
10.39
76.53
48.49
46.56
62.24
recognition needs a few more steps. This means novel classes must be found continuously, and the system must be updated to include these new classes in multi-class open-set recognition algorithm.
The mentioned process poses many different challenges, from the scalability of current open-set recognition algorithms to designing new learning algorithms to avoid problems such as catastrophic forgetting (131) of OSR classifiers. Furthermore, all the previously mentioned future works can be reformulated in open-world recognition problems again, which means by considering a few existing works in these subjects, it needs to be explored more.
10.11 Vision Transformers in OOD Detection and OSR
Vision Transformers (ViTss 80 have recently been proposed to replace CNNs and have shown great performance in different applications such object detection (19), medical image segmentation (166) and visual tracking (22). Similarly, some methods have recently reported the benefits of ViT's in OOD detection
ST and have shown their capabilities at detecting near OOD samples. For instance,
(22) has reported
the significant. superiority of ViTs compared to previous works when they are trained on CIFAR-10 and tested on CIFAR-100 as inlier and outlier datasots, respectively. However, as ViTs usually get pre-trained on extra-large datasets such ImageNet-22KK that has a large intersection with training and testing datasets, the integrity of the train-test mismatch does not hold anymore, and the problem would be converted to "how much does it remember from pretraining". This means ViTs should be evaluated on datascts that have no intersection with the pre-trained knowledge.
To address this issue, we have evaluated VIT-B16 on SVHN and MNIST when six randomly selected classes are considered as normal and the remaining ones as outliers or unscons. MSP is considered to detect unknown samples. As Table g shows, VYT-B16 that is pre-trained on ImageNet- 22K is not comparatively good other baselines that are trained from scratch. As all the experiments are evaluated in near
67

---

Published in Transactions on Machine Learning Research (11/2022)
Table 7: AUROC results of the most notable works for anomaly soraalyy/ovvllli noveltyy detection. The performance is averaged for each dataset in the one-vs-all setting. All the results in the tables are reported from the reference papers.
Dataset
Method
References
2
3
4
8
9
Mean
OC-GAN
94.20
96.30
97.50
98
98.10
93.90
98.10
97.50
LSA
99.30
99.90
95.90
96.60
95.60
96.40
99.40
98.00
95.30
98.10
97.50
AnoGan
96.60
99.20
85.00
88.70
89.40
88.3
94.70
93.50
84.90
92.40
91.30
MNIST
OC-SVM
99.50
99.90
92.60
93.60
96.70
95.50
98.70
96.60
90.30
96.20
96.00
DeDDSVDD
98.00
99.70
91.70
91.90
94.90
88.50
98.30
94.60
93.90
96.50
94.80
U-std
99.90
99.90
99.00
99.30
99.20
99.30
99.70
99.50
98.60
99.10
99.35
Multiresolution
99.82
99.82
97.79
98.75
98.43
98.16
99.43
98.38
98.41
98.10
98.71
(b)
Dataset
Method
References
Plane
Car
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Mean
OC-GAN
75.70
33.10
64.00
62.00
72.30
62.0
72.30
57.50
82.00
55.40
65.66
LSA
73.50
58.00
69.00
54.20
76.10
54.60
75.10
53.50
71.70
54.80
64.10
AnoGan
96.60
99.20
85.00
88.70
89.40
88.3
94.70
93.50
84.90
92.40
91.30
OC-SVM
63.00
44.00
64.90
48.70
73.50
50.00
72.50
53.30
64.90
50.80
58.56
CIFAR-10
DerpSVDD
98.00
99.70
91.70
91.90
94.90
88.50
98.30
94.60
96.50
GT
25
76.20
84.80
77.10
73.20
82.80
84.80
82.00
88.70
89.50
83.40
82.30
CST
89.90
99.10
93.10
86.40
93.90
93.20
95.10
98.70
97.90
95.50
94.30
U-std
IE1
78.90
84.90
73.40
74.80
85.10
79.30
89.20
83.00
86.20
84.80
81.96
Multiresolution
144
90.53
90.35
79.66
77.02
86.71
91.40
88.98
86.78
91.45
88.91
87.18
(c)
Beferenoes
Bottie
Caponde
Cuppet
Baacinut
Loathee
Metallant
Tootabrush
Tranittr
Wood
Zippet
Moun
36 00)
80.00
67
70/00
85.00
75:00
70.00
51.00
50.00
50.00
75.00
85.00
75:00
02.00
MVTTscDD
DVeD
86.00
70,00
72.00
CT
74 19
33.22
50.37
80.51
03.16
48:44
13.90
$3.95
11
$4.70
79
91.00
11.58
87.04
67.05
Unetel
I8J
95. 10
81.80
90.80
87 90
65.20
90.50
94.50
91.30
96.10
94.30
90
03:90
06.60
91.10
95.10
91.00
Multireccationn
IEL1
99
08:37
4B
70.08
10:00
ML.7U
94.29
70.25
91.57
75.01
85.50
ML.T
83-11
03.24
87.74
68

---

Published in Transactions on Machine Learning Research (11/2022)
Table AUROC results of the most notable works for OSR. The performance is averaged across each dataset using the explained evaluation procodures for 10 random (iils.(MLS stands for (167)
Mothod
Referenccs
MNIST
SVHN
CIFAR-10
CIFAR 10
CIFAR 50
TinyTmag:Not
OpenMax
M
98.10
89.10
81.10
81.70
79.60
81.10
G- G-OpenMax
36
98.40
89.60
67.60
82.70
81,90
58.00
OSRCI
98.80
91.00
69.90
53.80
82.70
58.60
C2AE
98.90
92.20
89.50
96.00
93.70
74.80
CROSR
[8]
09.20
80.00
68.30
58.90
GDFR
93.50
80.70
92.80
92:60
60.80
RPL
99.660
97.60)
96.80
80.90
OpenCan
00.90
98.80
97.30
90.70
MLS
167 09.30
97.10
93.60
97.90
96.50
83.00
Table 9: OSR AUROC results of baselines such as the maximum softmax probability (MSP), Openmax, and CROSR compared ViT-B16. Known distribution is considered random selection of 6 classes of the respective datasets and unknown ones are the rest. All results are percentages and the average of 5 runs.
Method
SVHN
MNIST
Softmax
88.60
97.80
Openmax
89.40
98.10
CROSR
89.90
99.10
ViT-B16
82.18
94.89
OOD detection setting, they support the refore-mentioneel deficiency ViTs. From what has been said, a future line of research could be evaluating ViTs a more controlled situation such that their real benefits would be more precise. Indeed, the recent Species dataset collects examples that do not fall under any of the ImageNet-22K classes and is first step to rectify this problem 62
10.12 Identifiablity Problems
Providing a method whereby unfamiliar samples are detected is not always trivial. (b5) investigates the theoretical foundations of the problem, demonstrating that determining the accuracy is just difficult identifying the ideal predictor, and so the success of any method is dependent on the implicit assumptions about the nature of the shift, which is characterized by mismatches between the source (training) and target (test) distributions. It demonstrated that no approach of measuring accuracy will work in gencral without assumptions on the source classifier or the nature the shift. Average Thresholded Confidence (ATC) is a simple approach for predicting model performance using softmax probability. learns threshold for model confidence on the validation source data and predicts the target domain accuracy as the proportion of unlabeled target points with score greater than the threshold. This work advances the positive answer to the question of feasible technique for selecting threshold that enables prediction accuracy with the thresholded model confidence.
11 Conclusion
In many applications, it is not feasible to model all kinds of classes occurring during testing; thus, scenarios existing in domains such as OOD detection, OSR, ND (one-class learning), and AD become ubiquitous. Up to this time, these domains, despite having the same intention and a large intersection, have been followed independently by researchers.
To address the need this paper gives a comprehensive review on existing techniques, datasets, evaluation criteria, and future challenges. More importantly, limitations of the mentioned approaches are discussed, and
69

---

Published in Transactions on Machine Learning Research (11/2022)
certain promising rescarch directions pointed out. We hope this helps the research community build broader and cross-domain perspective.
Acknowledgements
We would like to thank Yuki M. Asano for the extremely useful discussions and for reviewing the paper prior to submission.
70

---

Published in Transactions on Machine Learning Research (11/2022)
References
[1] Davide Abati, Angelo Porrello, Simone Calderara, and Rita Cucchiara. Latent space autoregression for novelty detection. In CVPR, pp. 481-490, 2019.
[2] Faruk Ahmed and Aaron Courville. Detecting semantic anomalics. In AAAI, volume 34, pp. 3154-3162, 2020.
3 Martin Arjovsky and Léon Bottou. Towards principled methods for training generative adversarial networks. ICLR, 2017.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In ICML, pp. 214-223, 223, 2017.
55 Alejandro Barredo Arricta, Natalia Díaz-Rodríguez, Javier Del Ser, Adrien Bennetot, Siham Tabik, Alberto Barbado, Salvador García, Sergio Gil-López, Daniel Molina, Richard Benjamins, et al. Explain- able artificial intelligence (xai): Concepts, taxonomies, opportunities and challenges toward responsible ai. Information Fusion, 58:82 115, 2020.
66 Mohammad Azizmalayeri and Mohammad Hossein Rohban. Ood augmentation may be at odds with open-set rocognition. NewrIPS, 2022.
[7] Mohammad Azizmalayeri, Arshia Soltani Moakhar, Arman Zarei, Reihaneh Zohrabi, Mohammad Taghi Manzuri, and Mohammad Hossein Rohban. Your custof-distr detection method is not robust! NewrIPS, 2022.
[8] Christian Bailer, Tewodros Habtegebrial, Didier Stricker, et al. Fast feature extraction with cons with pooling layers. BMVC, 2017.
(9) Babak Ehteshami Bejnordi, Mitko Veta, Paul Johannes Van Diest, Bram Van Ginneken, Nico Karsse- meijer, Geert Litjens, Jeroen AWM Van Der Laak, Meyke Hermsen, Quirine F Manson, Maschenka Balkenhol, et al. Diagnostic assessment of deep learning algorithms for detection of lymph node melastases women with breast cancer. Jama, 318(22):2199 2210, 2017.
[10] Abhijit Bendale and Terrance Boult. Towards open world recognition. In CVPR, pp. 1893- 1908-190, 2015.
[11] Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In CVPR, pp. 1563-1572, 2016.
[12] Liron Bergman and Yedid Hoshen. Classification-baseed anomaly detection for general data. ICLR, 2020.
[13] Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger. Mvtec ad comprchensive real-world dataset for unsupervised anomaly detection. In CVPR, pp. 9592 9600, 2019.
[14] Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger. Uninformed students: Student- teacher anomaly detection with discriminative latent embeddings. In CVPR, pp. 4183-4192, 2020.
[15] David Berthelot, Colin Raffll, Aurko Roy, and Ian Goodfellow. Understanding and improving interpo- lation in autoencoders via adversarial regularizer. ICLR, 2018.
[16] Markus M Breunig, Hans-Peted Kriegel, Raymond Ng, and Jörg Sander. Lof: identifying density-based local outliers. In ACM SIGMOD international conference on Management of data, pp. 93 10-404, 2000.
[17] Saikiran Bulusu, Bhavya Kailkhura, Bo Li, P Varshney, and Dawn Song. Anomalous instance detection in deep learning: A survey. Technical report, Lawrence Livermore National (LLNLL,,) Livermore, CA (United States), 2020.
[18] Jenna Burrell. How the machine 'thikk': Understanding opacity in machine learning algorithms. Big Data & Society, 3(1) 3():203391771562222 2016.
71

---

Published in Transactions on Machine Learning Research (11/2022)
[19] Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In ECCV, pp. 213-229. Springer, 2020.
[20] Mathilde Caron, Piotr Bojanowski, Armand Joulin, and Matthijs Douze. Deep clustering for unsuper- vised learning of visual features. In ECCV, pp. 132-149, 2018.
[21] Raghavendra Chalapathy and Sanjay Chawla. Deep learning for anomaly detection: A survey. arXiv preprint Xr::::1901.03. 03407, 2019.
[22] Guangyao Chen, Limeng Qiao, Yemin Shi, Peixi Peng, Jia Li, Tiejun Huang, Shiliang Pu, and Yonghong Tian. Learning open set network with discriminative reciprocal points. ECCV, 2020.
[23] Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying detection using outlier mining. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 430 445. Springer, 2021.
[24] Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Tha. Atom: Robustifying out-of-distribbation detection using outlier mining, ECML PKDD, 2021.
[25] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In ICML, pp. 1597- 2020.
[26] Jiacheng Cheng and Nuno Vasconcelos. Learning deep classifiers consistent with fine-grained novelty detection. In CVPR, pp. 1664-1673, 2021.
[27] Hyunsun Choi and Fric Jang. Generative ensembles for robust anomaly detection. 2018.
[28] Thomas M. Cover and Joy A. Thomas. Elements of Information Theory (Wiley Series in Telecomma- nications and Signal Processing). Wiley-Interscience,, USA, 2006. ISBN 0471241954.
[29] Maria Cvach. Monitor alarm fatigue: an integrative review. Biomedicnl instrumentation & technology. 46(4):268-22) 277, 2012.
[30] Thomas Defard, Aleksandr Setkov, Angelique Loesch, and Romaric Audigier. Padim: a patch distribution modeling framework for anomaly detection and localization. ICPR Workshop, 2020.
[31] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Foi. Imagenet: A large-scale hierarchical image database. In CVPR, pp. 248 255. Teee, 2009.
[32] Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv: 708. 04552, 2017.
[33] Akshay Raj Dhamija, Manuel Günther, and Terrance E Boult. Reducing network agnostophobia. NeurIPS, 2018.
[34] Laurent Dinh, David Krueger, and Yoshua Bengio. Niee: Non-lincar independent components estimation. arXiv preprint arXiv:1410.85.. 2014.
[35] Luke Ditria, Benjamin J Meyer, and Tom Drummond. Opengan: Open set generative adversarial networks. In ACCV, 2020.
[36] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa. Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. ICLR, 2020.
[37] Min Du, Ruoxi Jia, and Dawn Song. Robust anomaly detection and backdoor attack detection via differential privacy. ICLR, 2019.
[38] Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't 't know by virtual outlier synthesis. ICI.R, 2022.
72

---

Published in Transactions on Machine Learning Research (11/2022)
[39] Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. Fairness through awareness. In Inmovations in theoretionl computer science conference, pp. 214-226, 2012.
[40] Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et al. A density-based algorithm for discovering clusters in large spatial databases with noise. In KDD, volume 96, pp. 226 231, 1996.
[41] Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In ICML, pp. 1126-1135, 2017.
[42] Stanislav Fort, Jie Ren, and Balaji Lalshminarayanan. Exploring the limits of out-of-distribution detection. NewrIPS, 2021.
[43] Ahmed Frikha, Denis KrompaB, Hans-Georg Köpken, and Volker Tresp. Few-shot one-class classífication via meta-learning. AAAI, 2020.
[44] Yarin Gal and Zoubin Ghahramani. Dropout bayesian approximation: Representing model uncertainty in deep learning. In ICML, pp. 1050-1059, 2016.
[45] Saurabh Garg, Sivaraman Balakrishnan, Zachary Chase Lipton, Behnam Neyshabur, and Hanie Sedghi. Leveraging unlabeled data to predict out-of-distribution performance. In NeurIPS Workshop on Distribution Shifts: Connecting Methods and Applications, 2021.
[46] Zong Yuan Ge, Sergey Demyanov, Zetao Chen, and Rahil Garnavi. Generative openmax for multi-class open set classification. BMVC, 2017.
[47] Chuanxing Geng, Sheng-jun Huang, and Songean Chen. Recent advances in open set recognition: A survey. T-PAMI, 2020.
[48] Izhak Golan and Ran El- Yaniv. Deep anomaly detection using geometric transformations, NewrIPS, 2018.
[49] Dong Gong, Lingqiao Liu, Vuong Le, Budhaditya Saha, Moussa Reda Mansour, Svetha Venkatesh, and Anton van den Hengel. Memorizing normality to detect anomaly: Memory-auginented deep autoencoder for unsupervised anomaly detection. In ICCV, pp. 1705-1714, 2019.
[50] Sachin Goyal, Aditi Raghunathan, Moksh Jain, Harsha Vardhan Simhadri, and Prateek Jain. Droce: Deep robust onc-class classification. In ICML, pp. 3711-3721, 2020.
[51] Patrick Grother and Kayee Hanaoka. Nist special database 19 handprinted forms and characters 2nd edition. National Institute of Slandards and Technology, Tech. Rep, 2016.
[52] Frank E Grubbs. Procedures for detecting outlying observations in samples. Technomelrics, 11(1):1 21, 1969.
[53] Xinwei He, Yang Zhou, Zhichao Zhou, Song Bai, and Xiang Bai. Triplet-center loss for multi-view 3d object retrieval. In CVPR, pp. 1945-1954, 2018
[54] Matthias Hcin, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In CVPR, pp. 41 50, 2019.
[55] Dan Hendrycks and Thomas Dietterich. Benchmarking neural worw robustness to common corruptions and perturbations. ICLR, 2019.
[56] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distributioo examples in neural networks. ICLR, 2016.
[57] Dan Hendrycks and Mantas Mazeika. X-risk analysis for ai research. arviv preprint 0rX1:2200.00562, 2022.
73

---

Published in Transactions on Machine Learning Research (11/2022)
[58] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. ICI.R, 2018.
[59] Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-of-distribution detection for real-world settings. ICML, 2019.
[60] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self- relf-supervised learning can improve model robustness and uncortainty. NeurIPS, 2019.
[61]
Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Takshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. ICLR, 2019.
[62] Dan Hendrycks, Steven Basart, Mantas Mazcika, Andy Zou, Joseph Kown, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Xiaodong Song. Scaling out-of-distribulion detection for real-world settings. ICML, 2020.
[63] Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt. Unsolved problems in ml safety. ArXiv, abs/2109.13916, 2021.
[64] Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt. Unsolved problems in ml safety. Xiv preprint arXic:210913391 2021.
[65] Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In CVPR, pp. 15262 15271, 2021.
[66] Irina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick, Shakir Mohamed, and Alexander Lerchner. beta-vae: Learning basic visual concepts with constrained variational framework. ICLR, 2016.
[67] Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in neural network. NewrIPS Deep Learning Workshop, 2015.
[68] Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting dusto-idisti image without learning from out-of-distribution data. In CVPR, pp. 10951 10951-10960, 2020.
[69] Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space.
In CVPR, pp. 7719, 2021.
[70] Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. NewrIPS, 2021.
[71] Weibo Huang and Peng Wei. A peb dataset for defects detection and classification. aixi preprint ar XrX1v:191..08944, 2019.
72 Andrew 1lyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. NewrIPS, 2019.
[73] Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-Ilcus, Chris Chute, Henrik Marklund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, al. Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison. In AAAT, volume 33, pp. 590 597, 2019.
[74] Taewon Jeong and Heeyoung Kim. Ood-maml: Meta-learning for few-shot out-of-distribution detection and classification. NeurIPS, 33, 2020.
75 Jeff Johnson, Matthijs Douze, and Hervé Jégou. Billion-scale similarity search with gpus. IEEE Transactions on Big Data, 7(3):535-547, 2019.
[76] Pedro R Mendes Júnior, Roberto M De Souza, Rafacl de O Werneck, Bernardo V Stein, Daniel V Pazinato, Waldir R de Almeida, Otávio AB Penatti, Ricardo da Torres, and Anderson Rocha. Nearest neighbors distance ratio open-set classifier. Machine Learning, 106(3):359 386, 2017.
74

---

Published in Transactions on Machine Learning Research (11/2022)
[77] Daniel S Kermany, Michael Goldbaum, Wenjia Cai, Carolina CS Valentim, Huiying Liang, Sally L Baxter, Alex McKeown, Ge Yang, Xiaokang Wu, Fangbing Yan, et al. Identifying medical diagnoses and treatable diseases by image-based deep learning. Cell, 172(5):1122 1131, 2018.
(78] Vahid Reza Khazaie, Anthony Wong, and Mohammad Sabokrou. Are out-of-distributioo detection methods reliable? arXiv preprint ar arXio:2211.10992 2022.
[79] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. Supervised contrastive learning. NeurIPS, 2020.
[80] Diederik P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. NeurIPS, 2018.
[81] Rajat Koner, Poulami Sinhamahapatra, Karsten Roscher, Stephan Günnemann, and Volker Tresp. Oodformer: Out-of-llistrbutioo detection transformer. BMVC, 2021.
[82] Shu Kong and Deva Ramanan. Opengan: Open-set recognition via open data generation. ICCV, 2021.
[83] Alex Krizhevsky et al. Learning multiple layers of features from tiny images. 2009.
[84]] Anders Boesen Lindbo Larsen, Spren Kaac Sanderby, Hugo Larocholle, and Ole Winther. Autocncoding beyond pixels using learned similarity metric. In ICML, pp. 1558 1566. PMLR, 2016.
[85] Yann LeCun and Corinna Cortes. MNIST handwritten digit database. 2010. URL http://yaan..eecm lecun com/ exdb/mnist/
[86] Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzalo, and F Huang. A tutorial on energy-based learning. Predicting structured data, 1(0), 2006.
[87] Doyup Lee, Yeongiae Cheon, and Wook-Shin Han. Regularizing attention networks for anomaly detection in visual question answering. AAAI, 2020.
[88] Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrateed classifiers for detecting out-of-distribution samples. ICLR, 2018
[89] Kimin Lee, Kibok Lee, Honglak Lec, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. NewrIPS, 2018.
[90] Chun-Liang Li, Kihyuk Sohn, Jinsung Yoon, and Tomas Pfister. Cutpaste: Self-supervised learning for anomaly detection and localization. In CVPR, pp. 9664-9674, 2021.
[91] Yi Li and Nuno Vasconcelos. Background data resampling for outlier-aware classification. In CVPR, pp. 13218 13227,, 2020.
[92] Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distri image detection in neural networks. ICLR, 2017.
[93] Bo Liu, Hao Kang, Haoxiang Li, Gang Hua, and Nuno Vasconcelos. Few-shot open-set recognition using meta-learning. In CVPR, pp. 8798-8807, 2020.
[94] Fei Tony Lin, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In ICDM, pp. 413-422. TEEE, 2008.
[95] Weitang Liu, Xiaoyun Wang, John D Owens, and Yixuan Li. Energy-based out-of-distributie detection. NewrIPS, 2020.
[96] Wenqian Liu, Runze Li, Meng Zheng, Srikrishna Karanam, Ziyan Wu, Bir Bhanu, Richard J Radke, and Octavia Camps. Towards visually explaining variational autoencoders. In CVPR, pp. 8642 8651, 2020.
[97] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV, December 2015.
75

---

Published in Transactions on Machine Learning Research (11/2022)
[98] Philipp Liznerski, Lukas Ruff, Robert A Vandermeulen, Billy Joe Franks, Marius Kloft, and Klaus- Robert Müller. Explainable deep one-class classification. TCLR, 2020.
[99] Philipp Liznerski, Lukas Ruff, Robert A Vandermeulen, Billy Joe Franks, Klaus-Robert Müller, and Marius Kloft. Exposing outlier exposure: What can be learned from few, one, and zero outlier images. TMLR, 2022.
[100] Yiwci Lu, Frank Yu, Mahosh Kumar Krishna Reddy, and Yang Wang. Few-shot sceno-adaptive anomaly detection. In ECCV, pp. 125 141. Springer, 2020.
[101]
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
1022 Andrey Malinin and Mark Gales. Predictive uncertainty estimation via prior networks. NearIPS, 2018.
[103] Alexander Meinke, Julian Bitterwolf, and Matthias Hein. Provably robust detection of out-of-ddistribution data (almost) for free. arXiv preprint arXiv:2106. 04260, 2021.
[104] Dimity Miller, Niko Sunderhauf, Michael Milford, and Feras Dayoub. Class anchor clustering: A loss for distance-based open set recognition. In CVPR, pp. 3570-3577 2021.
[105] Yifei Ming, Hang Yin, and Yixuan Li. On the impact of spurious correlation for out-of-distributtio detection. AAAI, 2022.
[106] Hossein Mirzaei, Mohammadreza Salehi, Sajjad Shahabi, Efstratios Gavves, Cees GM Snoek, Mohammad Sabokrou, and Mohammad Hossein Rohban. Fake it till you make it: Near-distribution novelty detection by bcsee-based generative models. arXiv preprint arxiv:2005. 14297, 2022.
[107] Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 5216 5223, 2020.
[108] Sofia Mosci, Lorenzo Rosasco, Matteo Santoro, Alessandro Verri, and Silvia Villa. Solving structured sparsity regularization with proximal methods. In Joinl European conference on machine learninng and knowledge discovery in databases, pp. 418-433. Springer, 2010.
[109] Norman Mu and Justin Gilmer. Mnist-c: A robustness benchmark for computer vision. arXiv preprint ar Xiw:1906.02339 2019.
[110] Fric Nalisnick, Akihiro Matsukawa, Yee whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? ICLR, 2018.
[111] Lawrence Neal, Matthew Olson, Xiaoli Fern, Weng-Keet Wong, and Fuxin Li. Open set learning with counterfactual images. In ECCV, pp. 613-628, 2018.
[112] Sameer A. Nene, Shree K. Nayar, and Hiroshi Murase. object image library (coil-100. Technical report, 1996.
[113] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
[114] Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-learning algorithms. arXiv preprint Xrxi 10:3::883.0020 02999, 2018
[115] Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In Indian Conference on Computer Vision, Graphics & Image Processing, pp. 722-729. IEEE, 2008.
[116] Aaron van den Oord, Nal Kalchbrenner, Oriol Vinyals, Lasse Espeholt, Alex Graves, and Koray Kavukcuoglu. Conditional image generation with pixelenn decoders. NeurIPS, 2016.
76

---

Published in Transactions on Machine Learning Research (11/2022)
[117] Poojan Oza and Vishal M Patel. C2ac: Class conditioned auto-encoder for open-set recognition. In CVPR, pp. 2307-2316, 2019.
[118] Guansong Pang, Chunhua Shen, Longbing Cao, and Anton van den Hengel. Deep learning for anomaly detection: A review. ACM Computing Surveys, 2020.
[119] Ashok Kumar Pant, Sanjeeb Prasad Panday, and Shashidhar Ram Joshi. Off-line nepali handwritten character recognition using multilayer perceptron and radial basis function neural networks. Asian Himalayas International Conference on Internel, pp. 1 5. IEEE, 2012.
[120] German I Parisi, Ronald Kemker, Jose L Part, Christopher Kanan, and Stefan Wermter, Continual lifelong learning with neural networks: A review. Neural Networks, 113:54-71, 2019.
[12]] Pramuditha Perera and Vishal M Patel. Deep transfer learning for multiple class novelty detection. In CVPR, pp. 11544 11552, 2019.
[122]
Pramuditha Perera, Ramesh Nallapati, and Bing Xiang. Ocgan: One-class novelty detection using gans with constrained latent representations. In CVPR, pp. 2898-2906, 2019.
[223]
Pramuditha Perera, Vlad I Morariu, Rajiv Jain, Varun Manjunatha, Curtis Wigington, Vicente Ordonez, and Vishal M Patel. Generative-discrinnnatae feature representations for open-set recognition. In CVPR, pp. 11814-1182, 2020.
[124] Pramuditha Perera, Poojan Oza, and Vishal M Patel. One-class classification: A survey. arxiv preprinl arXiv:2101.0306, 2021.
[125] Ethan Perez, Florian Strub, Harm De Vries, Vincent Dumoulin, and Aaron Courville. Film: Visual reasoning with general conditioning layer. In AAAT, volume 32, 2018.
[126] James Pickands III et al. Statistical inference using extreme order statistics. Annals of statistics, 3(1): 119 131, 1975.
[127] Masoud Pourreza, Bahram Mohammadi, Mostafa Khaki, Samir Bouindour, Hichem Snoussi, and Mohammad Sabokrou. G2d: Generate to detect anomaly. WACV, pp. 2003 2012, 2021.
[128] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In ICML, pp. 8748 8763, 2021.
[129]
Pranav Rajpurkar, Jeremy Trvin, Kaylie Zhu, Brandon Yang, Hershel Mehta, Tony Duan, Daisy Ding, Aarti Bagul, Curtis Langlotz, Katie Shpanskaya, et al. Chexnet: Radiologist-level pneumonia detection on chest x-rays with deep learning. arXiv preprint arXiv:1711.05225 2017.
[130] Antti Rasmus, Harri Valpola, Mikko Honkala, Mathias Berglund, and Tapani Raiko. Semi-supervised learning with ladder networks. NewrIPS, 2015.
[131] Sylvestre Rebuffi, Alexander Kolesnikov, Georg Sperl, and Christoph H Lampert. icarl: Incre- mental classifier and representation learning. In CVPR, pp. 2001-2010 2017.
[132] Jie Ren, Peter Tiu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A DePristo, Joshua V Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. NewrlPS, 2019.
[133 Jie Ren, Stanislav Fort, Jeremiah Liu, Abhijit Guha Roy, Shreyas Padhy, and Balaji Lakshminaraaaana.
A simple fix mahalanobis distance for improving near-ood detoction. ICML, 2021.
[134] Oliver Rippel, Patrick Mertens, and Dorit Merhof. Modeling the distribution of normal data in pre-trained deep features for anomaly detection. In ICPR, pp. 6726-6733. IEEE, 2021.
[135] Andras Rozsa, Manuel Günther, and Terrance E Boult. Adversarial robustness: Softmax versus openmax. BMVC, 2017.
77

---

Published in Transactions on Machine Learning Research (11/2022)
[136] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In TCML, pp. 4393 44002. PMLR, 2018.
[137] Lukas Ruff, Robert A Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Müller, and Marius Kloft. Deep semi-supervised anomaly detection. ICLR, 2019.
[138] Lukas Ruff, Jacob R Kauffmann, Robert A Vandermculen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dielterich, and Robur- Müller. A unilying review of deep and shallow anomaly detection. Proceedings of the IEEE, 2021.
[199] Mohammad Sabokrou, Mohammad Khalooei, Mahmood Fathy, and Ehsan Adeli. Adversarially learned one-class classifier for novelty detection. In CVPR, pp. 3379 3388, 2018
[140] Mohammad Sabokrou, Masoud Pourreza, Mohsen Fayyaz, Rahim Entezari, Mahmood Fathy, Jürgen Gall, and Ehsan Adeli. Avid: Adversarial visual irregularity detection. In ACCV, pp. 488 505. Springer, 2018.
[141] Mohammad Sabokrou, Mahmood Fathy, Guoying Zhao, and Ehsan Adeli. Deep end-to-end one-class classifier. JEEE transactions on neural networks and learning systems, 32(2):675- 684, 2020.
1122] Mohammadreza Salehi, Ainaz Eftekhar, Niousha Sadjadi, Mohammad Hossein Rohban, and Hamid R Rabiee. Puzzle-ae: Novelty detection in images through solving puzzles. orXiv preprind arXiv:2008.1290 12955, 2020.
[143] Mohammadreza Salehi, Atrin Arya, Barbod Pajoum, Mohammad Otoofi, Amireza Shaciri, Moham- mad Hossein Rohban, and Hamid R Rabiee. Arae: Adversarially robust training of autoencoders improves novelty detection. Neural Networks, 2021.
[144] Mohammadreza Salchi, Niousha Sadjadi, Soroosh Basclizadeh, Mohammad H Rohban, and Hamid R Rabiee. Multiresolution knowledge distillation for anomaly detection. In CVPR, pp. 14902 14912, 2021.
[145] Walter J Scheirer, Anderson de Rezende Rocha, Archana Sapkota, and Terrance E Boult. Toward open set recognition. TT,AMT, 35(7):1157-1172) 2012.
[146] Robin Tibor Schirrmeister, Yuxuan Zhou, Tonio Ball, and Dan Zhang. Understanding anomaly detection with deep invertible networks through hierarchies of distributions and features. arXiv preprint arXiv:2006.10844 2020.
[147] Thomas Schlegl, Philipp Socböck, Scbastian M Waldstein, Ursula Schmidt-Erfurth, and Georg Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In International conference on information processing in medical imaging, pp. 146-157. Springer, 2017.
[148] Bernhard Schölkopf, Robert C Williamson, Alexander J Smola, John Shawe-Taylor John C Platt, et al. Support vector method for novelty detection. In NewrIPS, volume 12, pp. 582 588. Citeseer, 1999.
[149] Vikash Sehwag, Arjun Nitin Bhagoji, Liwei Song, Chawin Sitawarin, Daniel Cullina, Mung Chiang, and Prateek Mittal. Analyzing the robustness of open-world machine learning. In ACM Workshop Artificial Intelligence and Securily, pp. 105-116 116, 2019.
[150] Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. ICLR, 2021.
[151] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, pp. 618 626, 2017.
[152] Joan Serrå, David Álvarez, Vicenç Gómez, Olga Slizovskaia, José F Núñezz and Jordi Luque. Input complexity and out-of-distribution detection with likelihood-based generative models. TCLR, 2019.
78

---

Published in Transactions on Machine Learning Research (11/2022)
[153] Lalch Seyyed-Kalantari, Guanxiong Liu, Matthew McDermott, Irene Y Chen, and Marzych Ghassemi. Chexclusion: Fairness gaps in deep chest x-ray classifiers. In BIOCOMPUTING 2021: Proceedings of the Pacific Symposium, pp. 232 243. World Scientific, 2020.
[154] Rui Shao, Pramuditha Perera, Pong C Yuen, and Vishal M Patel. Open-set adversarial defense. Tn ECCV, pp. 682 698, 2020.
[155] Shubhranshu Shekhar, Neil Shah, and Leman Akoglu. Fairod: Fairness-aware outlier detection. ATES, 2020.
[156] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In SP, pp. 18, 2017.
[157] Danicl Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg. Smoothgrad: removing noise by adding noise. ICML, Workshop on Visualizalion for Deep Learning, 2017.
[158] Kihyuk Sohn, Chun-Liang Li, Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluating representations ions for deep one-class classification. JCLR, 2021.
[159] Gowthami Somepalli, Yexin Wu, Yogesh Balaji, Bhamukiran Vinzamuri, and Soheil Feizi. Unsupervisod anomaly detection with adversarial mirrored autoencoders. Uncertainly in Artificial Intelligence, 2020.
[160] Casper Kaae Sønderby, Tapani Raiko, Lars Maalee, Spren Kaae Sønderby, and Ole Winther. How to train deep variational autoencoders and probabilistic ladder networks. ICLR, 3, 2016.
[161] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. ICLR, 2020.
[162] Xin Sun, Zhenning Yang, Chi Zhang, Voon Ling, and Guohao Peng. Conditional gaussian distribution learning for open set recognition. In CVPR, pp. 13480-13489, 2020.
[163] Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. NewrIPS, 34, 2021.
[164] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. ICML, 2022.
[165] Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. NewrIPS, 2020.
[166] Jeya Maria Jose Valanarasu, Poojan Oza, Ilker Hacihaliloglu, and Vishal M Patel. Medical transformer: Gated axial-attention for medical image segmentation. MICCAI, 2021.
[167] Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set recognition: A good closed-set. classifier is all you need. ICLR, 2022.
1168] Shashanka Venkataramanan, Kuan-Chuan Peng, Rajal Vikram Singh, and Abhijit Mahalanobis. Attention guided anomaly localization in images. In ECCV, pp. 485-503, 2020.
[169] Vikas Verma, Alex Lamb, Christopher Beckham, Amir Najafi, Toannis Mitliagkas, David Lopez-Paz, and Yoshua Bengio. Manifold mixup: Better representations by interpolating hidden states. In ICML, pp. 6438 6447, 2019.
[170] Roman Vershynin. High-ddmenssionl probability: An introduction with applications in data science, volume 47. Cambridge university press, 2018.
[171] Haoran Wang, Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't. know? NewrIPS, 2021.
[72] Siqi Wang, Yijie Zeng, Xinwang Liu, En Zhu, Jianping Yin, Chuanfu Xu, and Marius Kloft. Effective end-to-end unsupervised outlier detection via inlier priority of discriminative network. NewrTPS, 2019.
79

---

Published in Transactions on Machine Learning Research (11/2022)
[173] Xiaosong Wang, Yifan Peng, Le Lu, Zhiyong Lu, Mohammadhadi Bagheri, and Ronald M Summers. Chestx-ray8: Hospital-scale chest x-ray database and benchmarks on weakly-supervised classification and localization of common thorax diseases. In CVPR, pp. 2097 2106, 2017.
[74] Zeyu Wang, Klint Qinami, loannis Christos Karakozis, Kyle Genova, Prem Nair, Kenji Hata, and Olga Russakovsky. Towards fairness in visual recognition: Effective strategies for bias mitigation. In CVPR, pp. 8919-8928, 2020.
[175] Peter Welinder, Steve Branson, Takeshi Mita, Catherine Wah, Florian Schroff, Serge Belongie, and Pietro Perona. Caltech-ucsd birds 200. 2010.
[176] Yan Xia, Xudong Cao, Fang Wen, Gang Hua, and Jian Sun. Learning discriminative reconstructions for unsupervised outlier removal. In ICCV, pp. 1511-1519, 2015.
[177] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv: 770.00777 2017.
[178] Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: An out-of-distribution detection score for variational auto-encoder. NewrIPS, 2020.
[179] Xudong Yan, Huaidong Zhang, Xuemiao Xu, Xiaowei Hu, and Pheng-Am Heng. Learning semantic context from normal samples for unsupervised anomaly detection. In A AAAI, volume 35, pp. 3110-3118, 2021.
[180] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110. 11334, 2021.
[181] Ziyu Ye, Yuxin Chen, and Haitao Zheng. Understanding the effect of bias in deep anomaly detection. IJCAI, 2021.
[182] Jaemin Yoo, Tiancheng Zhao, and Leman Akoglu. Role of data augmentation in unsupervised anomaly detection. aiv preprint ar arXiv:2208.0P 220.2208.07734, 2022.
[183] Ryota Yoshihashi, Wen Shao, Rei Kawakami, Shaodi You, Makoto lida, and Takeshi Naemura. classffcation-rconsstutttti learning for open-set recognition. In CVPR, pp. 4016-4025, 2019.
[184] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03338 03365, 2015.
[185] Qing Yu and Kiyoharu Aizawa. Unsupervised out-of-distribution detection by maximum classifier discrepancy. In ICCV, pp. 9518 9526, 2019.
[186] Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and leorning systems, 30(9):2805-255) 2824, 2019.
[187] Zhongqi Yue, Tan Wang, Qianru Sun, Xian-Sheng Hua, and Hanwang Zhang, Counterfactual zero-shot and open-set visual recognition. In CVPR, pp. 15404-15414, 2021.
[188] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In ICCV, pp. 6023 6032, 2019.
[189] Muhammad Zaigham Zaheer, Jin-ha Lee, Marcella Astrid, and Seung-Ik Lee. Old is gold: Redefining the adversarially learned one-class classifier training paradigm. In CVPR, pp. 14183-14199 2020.
[190] Rich Zemel, Yu Wu, Kevin Swersky, Toni Pitassi, and Cynthia Dwork. Learning fair reprosentations. In ICML, pp. 325 333. PMLR, 2013.
[191] Houssam Zenati, Chuan Sheng Foo, Bruno Lecouat, Gaurav Manek, and Vijay Ramascshan Chan- drasekhar. Efficient gan-based anomaly detection. ICLR Workshop, 2018.
80

---

Published in Transactions on Machine Learning Research (11/2022)
[192] Hongjie Zhang, Ang Li, Jie Guo, and Yanwen Guo. Hybrid models for open set recognition. In ECCV, pp. 102-117. Springer, 2020.
[193] Hongjing Zhang and lan Davidson. Towards fair deep anomaly detection. In ACM Conference on Fairness, Accountability, and Transparency, pp. 138 143,, 2021.
[994] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. ICLR, 2017.
[195] Chong Zhou and Randy C Paffenroth. Anomaly detection with robust deep autoencoders. In interna- tional conference on knowledge discovery and data mining, 665 674, 2017.
[196] Da- Wei Zhou, Han-Jia Ye, and De-Chuan Zhan. Learning placeholders for open-set recognition. In CVPR, pp. 4401-4410, 2021.
A Appendix
You may include other additional sections here.
81


Reviews:
[{"review_id": "TaXMdhqwDk", "reviewer": "Reviewer_pimz", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "This paper provides a very exhaustive review of three major domains in open-world machine learning. Each of these domains has its own reviews published previously, so the challenge of writing a joint review is indeed paramount. The paper meets the bar in discussing a wide range of papers from each domain. \n\nHowever, it still lacks a borad categorization of the paper discussed (even within each domain). I discuss some of the key limitations and suggested changes below.\n\n*Disentangling core challenges and future works*: Authors provide an extensive list of future challenges for the community. I recommend splitting this list into two parts. 1) Establish the core challenges that the community has already extensively been working on. E.g. self-supervised outlier detection (similar setting in anomaly detection), and few-shot detection are some of the techniques that have been recently explored. 2) Identify the challenges that the community is still missing as a recommendation or future work (e.g., use of transformers or explainability of detection models)\n\n*Extensive quantitative benchmarking missing for AD/ND tasks*: While the paper compared most works in OOD detection quantitatively (Table 3,4,5,6) it lacks a similar rigorous benchmarking for AD and ND tasks (table 7, 8). I suggest incorporating something similar to cifar-10 per-class anomaly detection benchmark ([1] and follow-up works)\n\n*Missing categorization of works* The current version of the paper also lacks a concrete categorization of existing works. The existing categorization is done (table 1) based on the domain (OOD detection, AD, OSR). This is just the global categorization, and I believe that each work should be categorized in a more fine-grained manner. For example, they can be categorized into.\n* Use of labels: supervised, unsupervised, or semi-supervised \n* Paradigm: deep-learning vs non-deep learning\n* Use of Pretraining only (feature-space detection) vs training from scratch\n \nWhile some of these details are available in the detailed description provided for each method, it is necessary to elevate them to broad categorization (e.g., in a table). In existing table-1, I suggest authors add the publication venue details of each method, as it might highlight if the research in three communities (OOD, OSR, AD) are clustered across venues.\n\n*Fig.1*: The left-half of the figure (concentric circles) makes it hard to parse the definition of each domain, and in fact can lead to the wrong conclusion. For example, if I follow the color combination of detectors on the right, e.g., yellow for OOD detection, then it gives the impression that the yellow color band on the left is actually the region of OOD images. But that is not the case, as indicated by the definition (a U b) vs (c U d). One way to avoid this confusion would be to highlight these definitions (at least increase their font size). Overall I encourage the authors to improve the presentation of this figure.\n\nRelated work (section 9.5) Sehwag et al. (2019) initiated the work on the robustness of OOD detection under adversarial conditions and effective defenses, which is followed up by Meinke et al. (2021) and Chen et al.(2021). I suggest adding this related work. \n\nAttribution: In each figure caption, I recommend citing the paper from which the figure is borrowed. \n\nA very minor issue in fig.1 is that while the caption highlight four classes (car, dog, cat, and airplane), one of the image is a bus (red London bus). This gives a wrong depiction of the task. Though easy fix.\n \n* Tack, Jihoon, et al. \"Csi: Novelty detection via contrastive learning on distributionally shifted instances.\" Advances in neural information processing systems 33 (2020): 11839-11852.\n* Sehwag, Vikash, et al. \"Analyzing the robustness of open-world machine learning.\" Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security. 2019.\n* Meinke, Alexander, Julian Bitterwolf, and Matthias Hein. \"Provably Robust Detection of Out-of-distribution Data (almost) for free.\" arXiv preprint arXiv:2106.04260 (2021).\n* Chen, Jiefeng, et al. \"Atom: Robustifying out-of-distribution detection using outlier mining.\" Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, Cham, 2021.\n ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper provides a unified review of anomaly detection, open-set recognition, and out-of-distribution detection. While each of these directions has been studied extensively, a compressive review was most certainly needed. This paper effectively fills this gap. It provides an exhaustive summary of a wide range of works in each direction and discussed future challenges for all three domains. ", "claims_and_evidence_yn": "", "claims_explanation": "", "audience_yn": "", "audience_explanation": "", "requested_changes": "Already discussed with suggestions in the section above.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "JeQN2BhleT", "reviewer": "Reviewer_GscL", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n+  The idea of providing a unified survey including AD, ND, OOD, and OSR can be of interest and useful to a broad audience in the machine learning community. \n+ The authors included an extensive set of techniques across the different problems. \n+ The paper includes an empirical evaluation comparing the methods explained in the survey. \n\nWeaknesses: \n- The paper does not really deliver the unified view of the different learning tasks considered, as stated in the introduction. The paper mostly focuses on the brief description of an extensive number of methods in the related work. \n- Some of the descriptions of the algorithms included in the survey are very brief and includes equations that are not really explained (e.g. equations (1) and (2)). It gives the impression that the paper prioritizes quantity (of the methods included in the survey) than quality, which really limits the usefulness of the paper. \n- The different subsections in Section 9 looks rather disconnected and the storyline is not clear. \n- The writing quality of the paper can be significantly improved (typos, grammar, etc.). \n- The paper includes many figures that are not original from the authors, but taken from other papers without making the reference explicit. This can create problems related to copyright infringement and plagiarism. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper provides a review the related work in Anomaly Detection (AD), Novelty Detection (ND), out of distribution detection (OOD) and Open Set Recognition (OSR), aiming to provide a unified view of these problems in machine learning. The paper provides an extensive review of different state-of-the-art methods in these areas as well as an empirical evaluation on different synthetic and real datasets. ", "claims_and_evidence_yn": "", "claims_explanation": "", "audience_yn": "", "audience_explanation": "", "requested_changes": "I have read the comments and requested changes in the previous version of the paper and briefly checked the changes in the paper with respect to the previous version. I fully agree with the changes suggested by the action editors and I think that the authors have not really addressed them for this revised version of the manuscript. \nIn this sense, my main concern is that the paper mostly focuses on the short description (in some cases insufficient) of a large number of papers rather than providing that unified view promised in the introduction. For instance, the authors mention differences between novelty and anomaly detection tasks (depending on the degree of supervision). But then, in Section 3 both anomaly and novelty detection methods are treated a bit arbitrarily. For example, OC-SVM is defined as a novelty detection method, but the authors include it in a section for anomaly detection methods. \nThe authors have done a good job on gathering a very good number of relevant methods for the different tasks, but the survey needs a significant amount of work in relating them to provide that unified view, which is the objective of the survey. \nThe description of some of the methods needs to be revised and improved: in some cases, these are too brief and includes equations or algorithms that are not really explained. \nSection 9 seems too disconnected. Some of the ideas can be of use, but the discussions sometimes are shallow and the different aspects considered in the different subsections are not well connected. \nAs mentioned by other reviewers and the action editors in the previous version of the manuscript, the writing quality of the paper can be significantly improved and the paper should be proofread carefully before submission. In this sense, I don’t see significant improvements with respect to the previous version. \nThere is no relevant final discussion or conclusion in the paper. Section 10 is too short. I think this can also be significantly improved. \n", "broader_impact_concerns": "Many figures and algorithms have been taken from the original papers, but the authors in this paper do not include any explicit reference to the original source. I don’t think that the authors have done this maliciously, but this can be a source of problems in terms of copyright infringement and plagiarism.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "n8srKtJZjv", "reviewer": "Reviewer_8zi1", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\n- Survey paper is clearly written and easy to follow. The exposition is clear and situated nicely and is improved from its last version. Methods are described both mathematically and visually. This survey paper can help newcomers reduce their barriers to entry.\n\n- Table 1 and Figure 2 are illustrative and nice additions to the latest version. I have some minor comments, please read below. \n\n- Explanation for each method covered in the paper is clear. To the best of my knowledge, the survey does a good job of covering relevant papers with diverse ideas in each field.\n\n- Authors have also made some efforts to include relatively old approaches. \n\n**Weaknesses** \n\n- Figure 2 can be improved a bit (see comments below). \n- While authors have included Section 2 to discuss the taxonomy, relation between different approaches is still left a bit unclear\n- Section 3 looks a bit out of the place. \n- Typos. Section 3.4 title. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper aims to comprehensively review relevant works in out-of-distribution, open-set, and anomaly detection. The paper highlights an essential concern with other survey papers in the field, i.e., the existing survey papers only focus on a specific domain without examining the relationship between different domains. This paper provides a cross-domain and comprehensive review of the literature across these areas and at the same time identifies common ideas.", "claims_and_evidence_yn": "", "claims_explanation": "", "audience_yn": "", "audience_explanation": "", "requested_changes": "- (Critical to securing your recommendation for acceptance) The paper discusses different methods in different subsections for each of the survey topics. While Section 2 is added for taxonomy, currently, it seems that the discussion of each method is fairly disjoint without a clear connection between different methods. I encourage authors to provide summary unifying ideas across similar methods and more broadly across different areas.\n\n-  (Critical to securing your recommendation for acceptance) Several things in Figure 2 are unclear. The phrase 'Unfamiliar Data Detection Approaches' looks unfamiliar to me, so it is a bit hard to parse the remaining hierarchy. It is also clear why 'Pre-trained Feature\nAdaptation ' is branched separately from the discriminative branch.   \n", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)