Title: Diversified Outlier Exposure for Out-of-Distribution Detection via Informative Extrapolation
Venue: NeurIPS 2023
Accepted: yes
Keywords: out-of-distribution detection

outlier exposure
Abstract: Out-of-distribution (OOD) detection is important for deploying reliable machine learning models on real-world applications. Recent advances in outlier exposure have shown promising results on OOD detection via fine-tuning model with informatively sampled auxiliary outliers. However, previous methods assume that the collected outliers can be sufficiently large and representative to cover the boundary between ID and OOD data, which might be impractical and challenging. In this work, we propose a novel framework, namely, Diversified Outlier Exposure (DivOE), for effective OOD detection via informative extrapolation based on the given auxiliary outliers. Specifically, DivOE introduces a new learning objective, which diversifies the auxiliary distribution by explicitly synthesizing more informative outliers for extrapolation during training. It leverages a multi-step optimization method to generate novel outliers beyond the original ones, which is compatible with many variants of outlier exposure. Extensive experiments and analyses have been conducted to characterize and demonstrate the effectiveness of the proposed DivOE. The code is publicly available at: https://github.com/tmlr-group/DivOE.

Diversified Outlier Exposure for Out-of-Distribution Detection via Informative Extrapolation

Abstract

Out-of-distribution (OOD) detection is important for deploying reliable machine learning models on real-world applications. Recent advances in outlier exposure have shown promising results on OOD detection via fine-tuning model with informatively sampled auxiliary outliers. However, previous methods assume that the collected outliers can be sufficiently large and representative to cover the boundary between ID and OOD data, which might be impractical and challenging. In this work, we propose a novel framework, namely, Diversified Outlier Exposure (DivOE) , for effective OOD detection via informative extrapolation based on the given auxiliary outliers. Specifically, DivOE introduces a new learning objective, which diversifies the auxiliary distribution by explicitly synthesizing more informative outliers for extrapolation during training. It leverages a multi-step optimization method to generate novel outliers beyond the original ones, which is compatible with many variants of outlier exposure. Extensive experiments and analyses have been conducted to characterize and demonstrate the effectiveness of the proposed DivOE. The code is publicly available at: https://github.com/tmlr-group/DivOE .

1 Introduction

Out-of-distribution (OOD) detection [Nguyen et al., 2015, Hendrycks and Gimpel, 2017] gains increasing attention in deploying machine learning models into open-world scenarios, as deep learning systems are expected to conduct reliable predictions on in-distribution (ID) data while identifying OOD inputs [Bommasani et al., 2021, Hendrycks et al., 2022]. It becomes more critical in safety-critical applications like financial or medical intelligence, where the false prediction for samples out of pre-defined label space can sometimes be a disaster. Extensive explorations [Hendrycks et al., 2019, Liu et al., 2020, Tack et al., 2020, Mohseni et al., 2020, Sehwag et al., 2021, Yang et al., 2021, 2022] in recent years has been contributed to improving the model ability for OOD detection.

Compared with post-hoc methods [Hendrycks and Gimpel, 2017, Liang et al., 2018, Liu et al., 2020, Huang et al., 2021, Sun et al., 2022] which designs different score functions for OOD uncertainty estimation, Outlier Exposure (OE) [Hendrycks et al., 2019] is another kind of method owning better performance improvement on OOD detection [Mohseni et al., 2020, Sehwag et al., 2021, Ming et al., 2022, Katz-Samuels et al., 2022, Wang et al., 2023]. The latter engages surrogate OOD data during

𝐷in

𝐷out

𝑠

𝐷out







































training and regularizes the model via fine-tuning those auxiliary outliers. The conceptual idea is to learn the knowledge from auxiliary outliers for effectively identifying OOD inputs. Under such a learning framework, there is an intuitive gap between the surrogate OOD data and the unseen OOD inputs [Fang et al., 2022, Ming et al., 2022] as illustrated in Figure 1. It will be a fundamental problem for boosting the model's discriminative capability on the OOD inputs. Given the finite auxiliary outliers, it naturally motivates the following critical research question: How could we utilize the given outliers for effective OOD detection if the auxiliary outliers are not informative enough ?

Addressing the essential distribution gap between surrogate OOD data and the unseen OOD inputs remains challenging [Hendrycks et al., 2019, Fang et al., 2022, Du et al., 2022, Yang et al., 2021], as it is hard to know the prior knowledge of potential OOD inputs would be encountered at inference stage [Hendrycks et al., 2022], and intentionally collect them. As the unseen OOD inputs in the realworld scenarios are complex [Cimpoi et al., 2014, Yu et al., 2015, Yang et al., 2022], the performance of OE-based methods is heavily affected by the given auxiliary outliers (as empirically presented in Figure 2). Given the finite auxiliary outliers, the surrogate OOD data are expected to have less discrepancy [Hendrycks et al., 2019, Fang et al., 2022] with the unseen OOD inputs, especially for the ones that are close to the decision boundary. Therefore, a potential idea is to expand the given outliers to cover more informative distributions and better generalize to the unseen OOD inputs.

Based on the previous analysis, we propose a new learning framework, i.e., Divsified Outlier Exposure (DivOE), to alleviate the pessimism of limited informative auxiliary outliers. At the high level, we aim to diversify the current distribution represented by the surrogate OOD data (e.g., Figure 2). In detail, we introduce a novel learning objective (i.e., Eq. (4)) that conducts informative extrapolation based on the given auxiliary outliers. Through a multi-step optimization target for generating a fraction of more informative outliers, DivOE can adaptively extrapolate and learn beyond the original OOD distribution. It realizes expanding the overall surrogate distribution of OOD data toward a broader coverage by maximizing the difference between the extrapolated one with its original counterpart.

Weconduct extensive experiments to characterize and present our proposed methods. We have verified its effectiveness with a series of OOD detection benchmarks mainly on two common ID datasets, i.e., CIFAR-10 and CIFAR-100, and also demonstrated its scalability using the ImageNet dataset with the large-scaled auxiliary outliers sampled from ImageNet21K. Under the various evaluations, our DivOE via informative extrapolation, can obtain the better OOD discriminative capability for the models and consistently achieve the lower averaged FPR95 compared with different baselines. Finally, a range of ablation studies from various aspects of the learning framework and further discussions from different perspectives are provided. Our main contributions are summarized as follows,

Conceptually, we study a more general and practical research setting in outlier exposure for OOD detection, considering the auxiliary outliers having limited information that can not well represent the whole decision areas for ID and OOD data. (in Section 3.1)

Technically, we propose a novel learning framework, namely Diversified Outlier Exposure (DivOE), for facilitating fine-tuning with auxiliary outliers, which conducts informative extrapolation to adaptatively diversify outlier exposure. (in Sections 3.2 and 3.3)

Empirically, extensive explorations from different perspectives are conducted to verify the effectiveness of DivOE in improving OOD detection performance, and we perform various ablations or further discussions to provide a thorough understanding. (in Section 4)

2 Background

In this section, we briefly introduce the preliminaries and related work in OOD detection.

2.1 Preliminaries

We consider multi-class classification as the original training task [Nguyen et al., 2015], where X ⊂ R d denotes the input space and Y = { 1 , . . . , C } denotes the label space. A reliable classifier should be able to figure out the OOD input, which can be considered a binary classification problem. Given P , the distribution over X × Y , we consider D in as the marginal distribution of P for X , namely, the distribution of ID data. At test time, the environment can present a distribution D out over X of OOD data. In general, the OOD distribution D out is defined as an irrelevant distribution of which the label set has no intersection with Y and thus should not be predicted by the model f ( · ) . A decision model g ( · ) can be made with the threshold λ :

Building upon the model f ∈ H : X → R c trained on ID data with the logit outputs, the goal of decision is to utilize the scoring function S : X → R to distinguish the inputs of D in from that of D out by S ( x ; f ) . If the score value is larger than the threshold λ , the associated input x is classified as ID and vice versa. We consider several representative scoring functions designed for OOD detection in our exploration, e.g., MSP [Hendrycks and Gimpel, 2017], ODIN [Liang et al., 2018], and Energy [Liu et al., 2020]. More detailed definitions are provided in Appendix A.

To mitigate the issue of over-confident predictions for [Hendrycks and Gimpel, 2017, Liu et al., 2020] some OOD data, another line of research directions [Hendrycks et al., 2019, Tack et al., 2020] utilize the auxiliary unlabeled dataset to regularize the model behavior. Among them, one representative baseline is outlier exposure (OE) [Hendrycks et al., 2019]. OE can further improve the detection performance by making the model f ( · ) finetuned from a surrogate OOD distribution D s out , and its corresponding learning objective is defined as follows,

where λ is the balancing parameter, ℓ CE ( · ) is the Cross-Entropy (CE) loss, and ℓ OE ( · ) is the Kullback-Leibler divergence to the uniform distribution, which can be written as ℓ OE ( h ( x )) = -∑ k softmax k f ( x ) /C , where softmax k ( · ) denotes the k -th element of a softmax output. The OE loss ℓ OE ( · ) is designed for model regularization, encouraging the model to learn knowledge from the surrogate OOD inputs and return low-confident predictions [Hendrycks and Gimpel, 2017].

2.2 Related Work

OODDetection. [Hendrycks and Gimpel, 2017] formally benchmarks the OOD detection problem, proposing to use softmax prediction probability as a conventional baseline method. Subsequent works [Sun et al., 2021] keep focusing on designing post-hoc metrics to distinguish ID samples from OOD samples, among which ODIN [Liang et al., 2018] introduces small perturbations into input images to facilitate the separation of softmax score, Mahalanobis distance-based confidence score [Lee et al., 2018b] exploits the feature space by obtaining conditional Gaussian distributions, energy-based score [Liu et al., 2020] aligns better with the probability density. Except directly designing new score functions, some works [Lin et al., 2021, Sun et al., 2022, Djurisic et al., 2023] pay attention to various aspects to enhance the OOD detection such that LogitNorm [Wei et al., 2022] produces confidence scores by training with a constant vector norm on the logits, DICE [Sun and Li, 2022] reduces the variance of the output distribution by leveraging the model sparsification, and ASH [Djurisic et al., 2023] explores the manipulation of feature representation to enhance OOD detection. In addition, Zhu et al. [2023] improves detection performance by investigating the quality of ID data.

OOD Detection with Auxiliary Outliers. Another promising direction toward OOD detection involves the auxiliary outliers for model regularization. From the data perspective, some works

𝐷in

𝐷out

𝑠

𝐷out

?

Group1, Group2, Group3, Group4, Group5































75

50

25

0

25

50

75

Dim1

75

50

25

0

25

50

75

Dim2

ID

Original OOD

75

50

25

0

25

50

75

Dim1

75

50

25

0

25

50

75

Dim2

ID

Extrapolated OOD

explore generating virtual outliers such that VOS [Du et al., 2022] and NPOS [Tao et al., 2023] regularize the decision boundary by adaptively sampling virtual outliers from the low-likelihood region. On the other hand, other works exploit information from natural outliers, such that outlier exposure is introduced by [Hendrycks et al., 2019], given that real OOD data are available in enormous quantities. Recently, some works highlight the importance of sampling strategy, such that NTOM [Chen et al., 2021] greedily utilizes informative auxiliary data to tighten the decision boundary for OOD detection, and POEM [Ming et al., 2022] adopts Thompson sampling to contour the decision boundary precisely. The performance of training with outliers is usually superior to that without outliers, as shown in many other works [Fort et al., 2021, Salehi et al., 2021, Sun et al., 2023]. From the optimization perspective, Wang et al. [2023] introduces implicit regularization via model perturbation, and Wang et al. [2022], Yang et al. [2023] present early trials to improve OOD performance in terms of the AUROC with tighter generalization bounds and new evaluation metrics.

3 Method: Diversified Outiler Exposure

In this section, we introduce our new framework, i.e., Diversified Outlier Exposure (DivOE), which conducts informative extrapolation during fine-tuning with auxiliary outliers. First, we present and discuss the critical motivation that inspires our method (Section 3.1). Second, we introduce its newly derived learning objective and explain the underlying implications (Section 3.2). Lastly, we present the algorithmic realization of DivOE and discuss its compatibility with other methods (Section 3.3).

3.1 Motivation

First, collecting OOD samples near the boundary still remains challenging as we can hardly know which kind of samples are truly located in the decision boundary between ID and OOD space. Second, as empirically shown in the left-middle panel of Figure 2, if the auxiliary outliers are not sufficiently informative (e.g., less diversified), the performance of outlier exposure will be limited due to the under-represented OOD distributions, which can be reflected by the higher FPR95 score (indicating a higher error on OOD detection). Thus, it naturally arises the following research question,

How could we utilize the given outliers for effective OOD detection if the auxiliary outliers are not informative enough to represent the unseen OOD distribution?

Especially for those OOD inputs that are close to the decision boundary, the auxiliary outliers may not well characterize such a broad distributional area [Fang et al., 2022, Wang et al., 2023, Zhang et al., 2023]. Therefore, a new mechanism is required to diversify the outlier exposure by exploring more potential OOD distribution for effective OOD detection. As in the right two panels of Figure 2, DivOE realizes this expectation by explicitly extrapolating the OOD data engaged during training.

3.2 DivOE via Informative Extrapolation

As aforementioned, the OE paradigm heavily relies on the auxiliary outliers sampled from the surrogate OOD distribution. Given the auxiliary outliers that are not informative enough to represent the

unseen OOD data, the model is expected to learn beyond the current surrogate OOD distribution. One conceptual idea to achieve this goal is to extrapolate based on the current surrogate distribution. Under such a concurrent learning paradigm, the model can be regularized by the original surrogate OOD distribution and simultaneously generalize beyond the given auxiliary outliers for OOD detection. To this intuition, we consider an adaptively evolved version of the surrogate OOD distribution D s out under the learning framework of OE as follows,

where D e out indicates the extrapolated surrogate distribution during training and ˜ X indicates the newly manipulated samples that are different from those in the original objective (i.e., Eq. (2)) of OE. In the above learning objective, the left part is for the original classification task, and the right part is for the newly proposed informative extrapolation in our DivOE. With the conceptual target for diversifying the current surrogate OOD distribution, we consider reformulating the specific objective as,

where β indicates a balancing factor for controlling the extrapolation ratio and D s +∆ out represents the synthesized distribution with a manipulation ∆ . Intuitively, the overall objective defined in Eq. (4) not only learns from the original surrogate OOD distribution but also generalizes to the different OOD distributions via the maximization part. The underlying insight is to expand the surrogate OOD distribution towards a more diversified one. The informative extrapolation is realized by the maximization part that maximizes the differences between the original surrogate OOD distribution and the generated one. Note that, Eq. (4) corresponds to an expectation formulation based on the whole population for diversifying outlier exposure, which is prohibitively expensive in realization. To achieve that more efficiently, we introduce an instance-level version for practical realization, and its optimization target can be formulated as the following hybrid loss,

where n indicates the sample number of auxiliary outliers and r indicates the extrapolation ratio that corresponds to β in Eq. (4). Except for the original loss on learning with the given outliers, the latter part of Eq. (5) defines a surrogate optimization part for realizing the informative extrapolation.

Here we adopt instance-level maximization for manipulating the expected OOD samples based on the original one, in which the specific δ is obtained by the following optimization objective,

Intuitively, DivOE will generate new outliers closer to the decision boundary to expand the coverage area of auxiliary outliers, and simultaneously be more informative to shape the decision area between ID and OOD data. The specific optimization process of δ is characterized as,

where sign is the function that extracts the sign of the tensor elements and S ( · ; f ) indicates the general OOD score functions. The optimization process also indicates that our extrapolation framework is general and can adopt different score functions to generate targeted outliers. Here we also provide the theoretical implication of our proposed objective based on previous work [Ming et al., 2022].

Theorem 3.1. Given a simple Gaussian mixture model in binary classification with the hypothesis class H = sign ( θ T x ) , θ ∈ R d . There exists constant α , and σ ( ϵ ) that satisfy,

From the perspective of sample complexity, we present the effects of our informative extrapolation. As FPR ( θ ∗ n 1 ,n 2 ) = erf ( µ T θ ∗ n 1 ,n 2 σ || θ ∗ n 1 ,n 2 || ) is monotonically decreasing, the lower bound of µ T θ ∗ n 1 ,n 2 σ || θ ∗ n 1 ,n 2 || will

𝑜𝑟𝑖𝑔𝑖𝑛𝑎𝑙

𝜖 = 0.05

𝜖 = 0.10

𝜖 = 0.1

5

















































































































































increase with the constraint of ( α -τ ( ϵ )) (which corresponds to our DivOE that extrapolates the outlier boundary towards ID data) decrease in our methods, the upper bound of FPR ( θ ∗ n 1 ,n 2 ) will decrease. The above indicates the benefit of DivOE with the informative extrapolation on shaping boundary decision areas. The completed definition and the analysis can be referred to in Appendix B.

3.3 Realization of DivOE

In this part, we introduce the realization of the whole learning framework of DivOE in detail. Here we formally present the learning objective of DivOE via informative extrapolation as follows,

where m and n indicate the sample numbers of ID data and auxiliary outliers respectively, other notations keep the same meaning as the previous equations. Concretely, the maximization part of DivOE adopts the multi-step optimization (e.g., projected gradient decent [Bottou, 2012, Madry et al., 2018]) to realize the targeted outlier synthetics. The specific process is defined as,

where t ∈ N , x ( t ) is the extrapolated OOD data at step t , and Π B [ x (0); ϵ ] ( · ) is the projection function that projects the new OOD data back into the ϵ -ball centered at x (0) if necessary. Different from the conceptual idea of constraining the perturbation (for human-imperceptibility) in the literature on adversarial robustness [Madry et al., 2018, Zhang et al., 2019], the projection operation in DivOE provides a quantification way to study the extrapolated distribution and its diversification. As the generation process starts from the given outliers, the semantical class (belongs to ID or OOD) is hard to change, as empirically shown in the left-most panel of Figure 3 (we adopted a very large ϵ = 0 . 15 ). More exploration about this perspective will leave to Section 4.3 for further discussion.

Here we summarize the whole procedure of the proposed DivOE in Algorithm 1, which consists of multi-round training iterations. To be specific, on each round of fine-tuning, DivOE first samples a mini-batch with a specific ratio r ∈ [0 , 1] from the auxiliary outliers and conduct multi-step optimization following Eq. (10) to generate the new outliers. With the ID training data, the original outliers, and the extrapolated outliers, DivOE then fine-tune the model with the loss defined in Eq. (9).

In practical realization, for the specific extrapolation strength ϵ , DivOE can also generate the extrapolation pool with multiple ϵ candidates within the extrapolated sub-batch. The specific definition of extrapolation pool is as follows,

where the extrapolation strength with its corresponding sample number can be flexibly decided in the extrapolated sub-batch with a total sample number equal to r ∗ n , which may better facilitate the diversification target. As a primary exploration, we visualize the extrapolated data with its distribution quantified by Energy score [Liu et al., 2020] in the left two panels in Figure 3. Intuitively, even with a large extrapolation strength with human-perceptible pixel noise added in the original outliers, it will not change its classification results in OOD detection. It can represent a more different OOD distribution compared with the given outliers as the distribution shifted gradually to the right.

Algorithm 1 Diversified Outlier Exposure (DivOE) via Informative Extrapolation

, training , extrapolate

Comparison and Compatibility. Compared with the conventional OE algorithm [Hendrycks et al., 2019], the critical difference behind DivOE is trying to extrapolate based on the given auxiliary outliers for diversifying outlier exposure. To be specific, it provides a general framework (under the guidance of the learning objective in Eq. (5)) for modeling the informative unknown inputs beyond the original ones. The discriminative feature regularized by our DivOE can be utilized by those advanced post-hoc scoring functions [Sun et al., 2021, Huang et al., 2021, Sun and Li, 2022, Djurisic et al., 2023]. For OE-based methods, the informative extrapolation introduced in DivOE is orthogonal to current tuning objectives [Hendrycks and Gimpel, 2017, Wang et al., 2023] and also compatible to those different data augmentation [Zhang et al., 2018, Yun et al., 2019], synthesizing [Kong and Ramanan, 2021, Lee et al., 2018a], and also sampling strategies [Chen et al., 2021, Ming et al., 2022] adopted based on either ID data [Du et al., 2022, Tao et al., 2023] or auxiliary outliers.

4 Experiments

In this section, we present the comprehensive verification of the proposed DivOE in the OOD detection scenario. First, we provide the experimental setups in detail (in Section 4.1). Second, we provide the performance comparison of our DivOE with a series of post-hoc scoring functions and the OE-based methods with different strategies on the auxiliary outliers (in Section 4.2). Third, we conduct various ablation studies and further discussions to understand our DivOE (in Section 4.3).

4.1 Setups

Here we present several critical parts of experimental setups and leave more details in Appendix C.

Datasets. Following the common benchmarks used in previous work [Liu et al., 2020, Ming et al., 2022], we adopt CIFAR-10 , CIFAR-100 [Krizhevsky, 2009] as our ID datasets. We use a series of different image datasets as the OOD datasets, namely Textures [Cimpoi et al., 2014], Places365 [Zhou et al., 2017], iSUN [Xu et al., 2015], LSUN_Crop [Yu et al., 2015], and LSUN_Resize [Yu et al., 2015]. For the surrogate OOD data used in OE-based methods [Hendrycks et al., 2019, Chen et al., 2021, Ming et al., 2022, Zhang et al., 2023], we adopt Tiny-ImageNet [Le and Yang, 2015]. We also conduct the experiments on the ImageNet, where we utilize the large-scaled ImageNet21K [Ridnik et al., 2021] as the surrogate OOD set like previous works [Wang et al., 2023] for OE-based methods.

Evaluation metrics. We employ the following three common metrics to evaluate the performance of OOD detection: (i) Area Under the Receiver Operating Characteristic curve (AUROC) [Davis and Goadrich, 2006] can be interpreted as the probability for a positive sample to have a higher discriminating score than a negative sample [Fawcett, 2006]; (ii) Area Under the Precision-Recall curve (AUPR) [Manning and Schütze, 1999] is an ideal metric to adjust the extreme difference

between positive and negative base rates; (iii) False Positive Rate (FPR) at 95% True Positive Rate (TPR) [Liang et al., 2018] indicates the probability for a negative sample to be misclassified as positive when the true positive rate is at 95 %. We also include in-distribution testing accuracy (ID-ACC) to reflect the preservation level of the performance for the original classification task on ID data.

OODdetection baselines. We compare the proposed method with several competitive baselines in the two directions. Specifically, we adopt Maximum Softmax Probability (MSP) [Hendrycks and Gimpel, 2017], ODIN [Liang et al., 2018], Mahalanobis score [Lee et al., 2018b], and Energy score [Liu et al., 2020] as scoring function baselines; We adopt OE [Hendrycks et al., 2019], Energybounded learning [Liu et al., 2020], NTOM[Chen et al., 2021], POEM [Ming et al., 2022] and MixOE [Zhang et al., 2023] as baselines with outliers. For all scoring function methods, we assume the accessibility of well-trained models. For all methods involving outliers, we constrain all major experiments to a fine-tuning scenario, which is more practical in real cases. Different from training a dual-task model at the very beginning, equipping deployed models with OOD detection ability is a much more common circumstance. We leave more definitions and implementations in Appendix A.

4.2 Main Results

In this part, we present the major performance comparison with some representative baseline methods for OOD detection to demonstrate the effectiveness of the proposed DivOE. Specifically, we consider several post-hoc methods of scoring functions as the performance reference based on the pre-trained model and some OE-based methods for specific comparison on fine-tuning with auxiliary outliers. Note that for all the experiments here, we utilize the whole auxiliary outliers (following the general setup of OE [Hendrycks et al., 2019, Liu et al., 2020] and ensuring the same number of outliers engaged in each method) instead of the reduced ones adopted in previous figures for illustrations.

In Table 1, we present the overall results using different methods for OOD detection. Since the OE-based methods engage the auxiliary outliers during training, the model will generally gain better

empirical performance on OOD detection, reflected by the evaluation metrics. For those OE-based methods, we provide a specific comparison on their detailed operation for D aux (e.g., D s out ) in the right of Table 1. Since VOS virtually synthesizes the outliers based on the ID data, it doesn't perform better than those using the real collected outliers. Among the rest, NTOM and POEM adopt different strategies for informative sampling, which obtain different levels of detection performance gains across different ID datasets. MixOE that mixups ID and surrogate OOD data does not perform well on some complexed tasks like CIFAR-100 and ImageNet, since the original algorithm is designed for fine-grained OOD detection. Without sacrificing much classification performance (i.e., ID-ACC) on ID data, our DivOE can consistently achieve better OOD detection performance across the three datasets, which verifies the effectiveness of our methods with the newly proposed informative extrapolation for outlier exposure. We also summarize the fine-grained results on OOD detection to Tables 12 and 13 in Appendix C, which provides a better understanding of the improvement.

In Table 2, we report the results of compatibility experiments, in which we compare those OE-based methods with their variants, incorporating our DivOE for informative extrapolation. Specifically, we consider some of the previous OE-based methods and also add two related methods, e.g., OECC [Papadopoulos et al., 2021] and DOE [Wang et al., 2023], in the comparison. Although those methods can have different level of performance enhancement compared with the conventional OE baseline, We can find that our DivOE can consistently help them gain better OOD detection performance across three evaluation metrics, and keep the ID-ACC comparable with the original pre-trained model. As for DOE, it utilizes the model perturbation on implicit outlier synthesizing, which is also orthogonal and compatible with our DivOE for explicit extropolation. In this table, we can find the plain DivOE can achieve lower FPR95 on CIFAR-100 with DOE, while the performance of DOE is affected by different ID datasets. The above demonstrates the effectiveness and algorithmic robustness of our proposed method. In addition, we also provide further discussion on the differences in Appendix A.1.

4.3 Ablation and Further Discussions

In this part, we conduct further explorations to provide a thorough understanding of our DivOE. For the extra results and discussions (e.g., impact and limitations), we leave more details in Appendix C.

Importance of extrapolation ratio in diversifying the distribution. As a critical aspect of our proposed learning objective of DivOE in Eq. (9), the extrapolation ratio is introduced to control the manipulated portion of the given auxiliary outliers. DivOE aims to extrapolate based on the surrogate OOD distribution without total loss of the original representation. In Figure 4(a), we show the performance by varying the ratio r . It is worth noting that adopting extrapolation on the full batch of data may even degrade the performance, indicating the vital role of the extrapolation ratio in the whole learning framework. It performs diversifying as the maximization part introduced in Eq. (5) instead of an overall augmentation. The results verify the rationality of pursuing diversified outliers instead of only most informative ones. We provide more comparison on the concepts of "diversified" and "informative" in Appendix A.2, and leave more results in Appendix C to further explain it.

Extending the diversified strength in the informative extrapolation. To better characterize the effects of informative extrapolation in DivOE, we consider fine-tuning the given model with

































(a) Extrapolated Ratio































(b) Diversified Strength



































































different ϵ (with a consistent extrapolation ratio, r = 0 . 5 ), which is used to constrain the diversified strength in maximizing the optimization target in Eq. (6). In Figure 4(b), we can observe that an appropriate diversified strength can help OE performs better on OOD detection, while using a large ϵ may empirically return to the original baseline case. One possible reason may be that the extrapolated outliers with a large ϵ may fail to become more informative as previously reflected in Figure 3.

Generality of using different OOD scores. Since DivOE introduces a general learning framework of outlier exposure for model finetuning with auxiliary outliers, the specific realization for informative extrapolation can have multiple choices. For example, different scoring functions can all perform OOD uncertainty estimation, indicating the multiple candidate target for Eq. (6) to optimize. Here we report the performance using different optimization targets (e.g., MSP or Energy score) in Figure 4(c), where they have different performance improvements compared with the original OE baseline.

Comparison with different augmentation-based methods for OE. In Figure 4(d), we perform the comparison of our DivOE with the original OE adopting some representative augmentation methods (e.g., Mixup [Zhang et al., 2018] and CutMix [Yun et al., 2019]) for diversifying the given outliers. The results verify the superiority of DivOE on OOD detection over the direct adaptation of those strategies since they lack a critical diversification guidance. On the other hand, our framework has no strict constraints for the detailed manipulating operations. In other words, DivOE can also utilize those augmentation methods for extrapolation, for which we leave more discussion in Appendix C.

5 Conclusion

In this paper, we propose a novel learning framework, i.e., Diversified Outlier Exposure (DivOE), that promotes diversity in outlier exposure with the given auxiliary outliers. To empower the model with more knowledge about the decision boundary between ID and OOD data, DivOE conducts informative extrapolation guided by a newly designed objective. Through the diversification target, our method adaptively synthesizes meaningful outliers during the training process, which helps the model better shape the decision areas for OOD detection. We have conducted extensive experiments to demonstrate the effectiveness of our proposed DivOE and its compatibility with a range of OE-based methods, and also various ablation studies with further explorations to characterize the framework.

Acknowledgments

JNZ and BH were supported by the NSFC Young Scientists Fund No. 62006202, NSFC General Program No. 62376235, Guangdong Basic and Applied Basic Research Foundation No. 2022A1515011652, RIKEN Collaborative Research Fund, HKBU Faculty Niche Research Areas No. RC-FNRA-IG/22-23/SCI/04, and HKBU CSD Departmental Incentive Scheme. GY and JCY were supported by the National Key R&D Program of China (No. 2022ZD0160703), 111 plan (No. BP0719010) and National Natural Science Foundation of China (No. 62306178). TLL was partially supported by the following Australian Research Council projects: FT220100318, DP220102121, LP220100527, LP220200949, and IC190100031.

References

Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportunities and risks of foundation models. In arXiv , 2021.

Karsten M Borgwardt, Arthur Gretton, Malte J Rasch, Hans-Peter Kriegel, Bernhard Schölkopf, and Alex J Smola. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformatics , 2006.

Léon Bottou. Stochastic gradient descent tricks. Neural Networks: Tricks of the Trade: Second Edition , 2012.

Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying out-ofdistribution detection using outlier mining. In ECML PKDD , 2021.

Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In CVPR , 2014.

Jesse Davis and Mark Goadrich. The relationship between precision-recall and roc curves. In ICML , 2006.

Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection. In ICLR , 2023.

Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. VOS: learning what you don't know by virtual outlier synthesis. In ICLR , 2022.

John Duchi, Elad Hazan, and Yoram Singer. Adaptive subgradient methods for online learning and stochastic optimization. Journal of Machine Learning Research , 2011.

Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is out-of-distribution detection learnable? In NeurIPS , 2022.

Tom Fawcett. An introduction to roc analysis. Pattern Recognition Letters , 2006.

Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In ICLR , 2021.

Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of out-of-distribution detection. In NeurIPS , 2021.

Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In ICLR , 2017.

Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In ICLR , 2019.

Dan Hendrycks, Steven Basart, Mantas Mazeika, Andy Zou, Joseph Kwon, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-of-distribution detection for real-world settings. In ICML , 2022.

Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. In NeurIPS , 2021.

Julian Katz-Samuels, Julia Nakhleh, Robert Nowak, and Yixuan Li. Training ood detectors in their natural habitats. In ICML , 2022.

Kiefer and J. Wolfowitz. Stochastic estimation of the maximum of a regression function. Ann. Math. Statist. , 1952.

Shu Kong and Deva Ramanan. Opengan: Open-set recognition via open data generation. In CVPR , 2021.

Alex Krizhevsky. Learning multiple layers of features from tiny images. In arXiv , 2009.

Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. In CS 231N , 2015.

Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting out-of-distribution samples. In ICLR , 2018a.

Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurIPS , 2018b.

Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In ICLR , 2018.

Ziqian Lin, Sreya Dutta Roy, and Yixuan Li. Mood: Multi-level out-of-distribution detection. In CVPR , 2021.

Weitang Liu, Xiaoyun Wang, John D Owens, and Yixuan Li. Energy-based out-of-distribution detection. In NeurIPS , 2020.

Ilya Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with warm restarts. In ICLR , 2017.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR , 2018.

Christopher D. Manning and Hinrich Schütze. Foundations of Statistical Natural Language Processing . The MIT Press, 1999.

Yifei Ming, Ying Fan, and Yixuan Li. Poem: Out-of-distribution detection with posterior sampling. In ICML , 2022.

Sina Mohseni, Mandar Pitale, J. B. S. Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. In AAAI , 2020.

Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In CVPR , 2015.

Aristotelis-Angelos Papadopoulos, Mohammad Reza Rajati, Nazim Shaikh, and Jiamian Wang. Outlier exposure with confidence control for out-of-distribution detection. Neurocomputing , 2021.

Tal Ridnik, Emanuel Ben-Baruch, Asaf Noy, and Lihi Zelnik-Manor. Imagenet-21k pretraining for the masses. In NeurIPS Datasets and Benchmarks Track , 2021.

Mohammadreza Salehi, Hossein Mirzaei, Dan Hendrycks, Yixuan Li, Mohammad Hossein Rohban, and Mohammad Sabokrou. A unified survey on anomaly, novelty, open-set, and out-of-distribution detection: Solutions and future challenges. In arXiv , 2021.

Vikash Sehwag, Mung Chiang, and Prateek Mittal. SSD: A unified framework for self-supervised outlier detection. In ICLR , 2021.

Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-distribution detection. In ECCV , 2022.

Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. In NeurIPS , 2021.

Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In ICML , 2022.

Yiyou Sun, Zhenmei Shi, Yingyu Liang, and Yixuan Li. When and how does known class help discover unknown ones? provable understandings through spectral analysis. In ICML , 2023.

Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. CSI: Novelty detection via contrastive learning on distributionally shifted instances. In NeurIPS , 2020.

Leitian Tao, Xuefeng Du, Xiaojin Zhu, and Yixuan Li. Non-parametric outlier synthesis. In ICLR , 2023.

William R Thompson. On the likelihood that one unknown probability exceeds another in view of the evidence of two sample. Biometrika , 1933.

Qizhou Wang, Junjie Ye, Feng Liu, Quanyu Dai, Marcus Kalander, Tongliang Liu, Jianye HAO, and Bo Han. Out-of-distribution detection with implicit outlier transformation. In ICLR , 2023.

Zitai Wang, Qianqian Xu, Zhiyong Yang, Yuan He, Xiaochun Cao, and Qingming Huang. Openauc: Towards auc-oriented open-set recognition. In NeurIPS , 2022.

Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In ICML , 2022.

Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. In arXiv , 2015.

Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. In arXiv , 2021.

Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, WENXUAN PENG, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, et al. Openood: Benchmarking generalized out-of-distribution detection. In NeurIPS Datasets and Benchmarks Track , 2022.

Zhiyong Yang, Qianqian Xu, Shilong Bao, Peisong Wen, Yuan He, Xiaochun Cao, and Qingming Huang. Auc-oriented domain adaptation: From theory to algorithm. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023.

Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. In arXiv , 2015.

Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In CVPR , 2019.

Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In BMVC , 2016.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML , 2019.

Hongyi Zhang, Moustapha Cissé, Yann N. Dauphin, and David Lopez-Paz. Mixup: Beyond empirical risk minimization. In ICLR , 2018.

Jingyang Zhang, Nathan Inkawhich, Randolph Linderman, Yiran Chen, and Hai Li. Mixture outlier exposure: Towards out-of-distribution detection in fine-grained environments. In WACV , 2023.

Bolei Zhou, Agata Lapedriza, Antonio Torralba, and Aude Oliva. Places: An image database for deep scene understanding. Journal of Vision , 2017.

Jianing Zhu, Hengzhuang Li, Jiangchao Yao, Tongliang Liu, Jianliang Xu, and Bo Han. Unleashing mask: Explore the intrinsic out-of-distribution detection capability. In ICML , 2023.

Appendix for DivOE

The whole Appendix is organized as follows. In Appendix A, we present the detailed definitions and implementation of those post-hoc score functions and several OE-based methods that are considered in our exploration. In Appendix B, we formally present the theoretical analysis about DivOE. In Appendix C, we provide our extra experimental details and more comprehensive results with further discussion on the underlying implications. Finally, in Appendix D, we discuss the potential broader impact and limitations of our work.

Reproducibility Statement

Below we summarize several important aspects to facilitate reproducible results:

Datasets. The datasets we used are all publicly accessible, which is introduced in Section 4.1. For methods involving auxiliary outliers, we strictly follow previous works [Liu et al., 2020, Sun et al., 2021] to avoid overlap between the auxiliary dataset (Tiny-ImageNet) and any other OOD datasets.

Assumption. We set our experiments to a fine-tuning scenario where a well-trained model on the original classification task is available, and the training samples are also available for subsequent fine-tuning [Hendrycks et al., 2019].

Open source. We open our source code in the repository: DivOE

Environment. All experiments are conducted with multiple runs on NVIDIA GeForce RTX 3090 GPUs with Python 3.7 and PyTorch 1.12.

A Details about Considered Baselines and Metrics

In this section, we provide the details about the baselines for the scoring functions and fine-tuning with auxiliary outliers, as well as the corresponding hyper-parameters and other related metrics that are considered in our work. Additionally, we provide further discussion on the comparison with two related works, e.g., MixOE and DOE, and also present the critical differences between the diversifying with previous concept of informative.

Maximum Softmax Probability (MSP). [Hendrycks and Gimpel, 2017] proposes to use maximum softmax probability to discriminate ID and OOD samples. The score is defined as follows,

where f represents the given well-trained model and c is one of the classes Y = { 1 , . . . , C } . The larger softmax score indicates the larger probability for a sample to be ID data, reflecting the model's confidence on the sample.

ODIN. [Liang et al., 2018] designed the ODIN score, leveraging the temperature scaling and tiny perturbations to widen the gap between the distributions of ID and OOD samples. The ODIN score is defined as follows,

where ˜ x represents the perturbed samples (controled by ϵ ), T represents the temperature. For fair comparison, we adopt the suggested hyperparameters [Liang et al., 2018]: ϵ = 1 . 4 × 10 -3 , T = 1 . 0 × 10 4 .

Mahalanobis. [Lee et al., 2018b] introduces a Mahalanobis distance-based confidence score, exploiting the feature space of the neural networks by inspecting the class conditional Gaussian distributions. The Mahalanobis distance score is defined as follows,

where ˆ µ c represents the estimated mean of multivariate Gaussian distribution of class c , ˆ Σ represents the estimated tied covariance of the C class-conditional Gaussian distributions.

Energy. [Liu et al., 2020] proposes to use the Energy of the predicted logits to distinguish the ID and OOD samples. The Energy score is defined as follows,

where T represents the temperature parameter. As theoretically illustrated in Liu et al. [2020], a lower Energy score indicates a higher probability for a sample to be ID. Following [Liu et al., 2020], we fix the T to 1 . 0 throughout all experiments.

ASH. [Djurisic et al., 2023] designs a extremely simple, post-hoc method called Activation SHaping for OOD detection. It removes a large portion of an input's activation at a late layer and adjusts the rest of the activation values by scaling them up or assigning them a constant value. The simplified representation is then passed throughout the rest of the network. The logit output is used to classify ID samples and calculate scores for OOD detection as usual. We adopt the energy score and apply the ASH-S version with the hyperparameter p = 95 for CIFAR-10 and p = 85 for CIFAR-100, as suggested by [Djurisic et al., 2023].

Outlier Exposure (OE). [Hendrycks et al., 2019] initiates a promising approach towards OOD detections by involving outliers to force apart the distributions of ID and OOD samples. In the experiments, we use the cross-entropy from f ( x out ) to the uniform distribution as the L OE [Lee et al., 2018a],

Energy (w. D aux). In addition to using the Energy as a post-hoc score to distinguish ID and OOD samples, [Liu et al., 2020] proposes an Energy-bounded objective to further separate the two distributions. The OE objective is as follows,

We keep the thresholds same to [Liu et al., 2020]: m in = -23 . 0 for CIFAR-10 and m in = -25 . 0 for CIFAR-100, m out = -5 . 0 for both CIFAR-10 and CIFAR-100.

NTOM. [Chen et al., 2021] greedily exploits informative auxiliary data to tighten the decision boundary between ID and OOD samples. It samples hard outliers with lower OOD scores to regularize the model for OOD detection. For a fair comparison, we adopt the energy score for both outlier sampling and model training and choose the suggested sampling parameter p = 0 [Chen et al., 2021].

POEM. [Ming et al., 2022] explores the Thompson sampling strategy [Thompson, 1933] to make the most use of outliers to learn a tight decision boundary. The details of Thompson sampling can refer to Ming et al. [2022].

MixOE. [Zhang et al., 2023] proposes to mix ID data and auxiliary outliers to cover the broad region where fine-grained OOD samples lie. The model is then trained such that the prediction confidence linearly declines as the input shifts from ID distribution to OOD distribution. Considering [Zhang et al., 2023] chooses different OOD test datasets from our work, we set the hyperparameters α = 1 and β = 0 . 1 which are verified to be optimal by our tuning experiments.

DOE. [Wang et al., 2023] proposes to implicitly synthesize virtual outliers via model perturbation, which enhances the generalization of OE to better optimize the learning target [Foret et al., 2021].

A.1 A Closer Look at Comparison with MixOE and DOE

In this part, we discuss more about the difference of our DOE with previous MixOE and DOE.

Conceptually, DivOE has a different underlying motivation from MixOE and DOE. Our DivOE is proposed for diversifying outlier exposure by extrapolating auxiliary outliers. In comparison, MixOE focuses on enhancing the fine-grained OOD detection by interpolation between ID samples and OOD

samples; DOE focuses on improving the generalization of the original outlier exposure by exploring model-level perturbation.

Technically, DivOE has a different algorithmic design from the others. Specifically, DivOE was proposed as a general framework for outlier extrapolation, which bases on OOD samples. It is different from MixOE which directly mix-up ID and OOD samples; It is also different from DOE that constructs the model perturbation for better optimization. It is worthy noting our DivOE is from a different perspective (data-level) compared with DOE (model-level), and they are orthogonal and combinable. DOE regards regularizing training on the same outliers with different weight perturbations as implicitly synthesized but does not change the outliers. The optimization of DOE is constrained by the original training samples and is also sensitive to tuning the model perturbation.

Empirically, as shown in Table 1, we have directly compared MixOE with our DivOE. The results show its performance is worse than our DivOE or even the original OE. For DOE, since it is from a different perspective and orthogonal, we compare DOE mainly in Table 2 of the original submission, and here we present Table 3 for further discussion. It shows: (1) DOE is sensitive to the ID classification task and even performs worse than the original OE in CIFAR-100/SVHN/ImageNet; (2) DivOE improves both OE and DOE under the corresponding backbones; (3) Even under unfair comparison between DivOE (OE backbone) vs. DOE, DivOE (OE backbone) still achieves the comparable or better performance on ImageNet/SVHN/CIFAR100 datasets.

A.2 Conceptual Comparison of Diversified and Informative

In this part, we provide further discussion on the comparison of diversified and informative.

Conceptually, "diversified" is proposed to characterize one internal property of auxiliary outliers, while the "informative" in [Chen et al., 2021] is a concept for relative comparison. The intuition behind "diversified" is that we hope the outliers can span more informative areas beyond the original ones, unlike sampling the most "informative" outliers (i.e., near-boundary OOD samples that are close to ID data). Intuitively, Group 1 in Figure 2 indicates the auxiliary outliers which span more informative areas among those other groups. In other words, the most diversified Group 1 also covers the areas of other groups. Here we also utilize the Maximum Mean Discrepancy (MMD) [Borgwardt et al., 2006] to show the difference between "diversified" in our submission and "informative" in Table 4. We measure the discrepancy between the sampled/manipulated outliers with the original ones, termed as MMD[new, original], to indicate the "informative"; measure the discrepancy half by half within the sampled/manipulated outliers, termed as MMD[half new, half new], to indicate the "diversified". The results show that DivOE owns lower "informative" due to the partial outlier extrapolation but higher "diversified" on the inner dispersion of the outliers.

Technically, in our DivOE, 'diversified' guides the training to expand the auxiliary outliers to the extrapolated distributions but also consider the original ones. We re-summarized the results

of Figure 4(a) to Table 5 and show that our DivOE with the pursuit of 'diversified' (conduct partial extrapolation) performs better than those totally considered 'informative' (conduct total extrapolation). The results demonstrate the effectiveness and rationality of DivOE considering partial extrapolation for diversification.

B Theoretical Analysis and Discussion

In this section, we formally present the theoretical implications with detailed definitions and assumptions. The complete theoretical analysis is based on the perspectives of sample complexity and OOD distribution gap in the previous works [Ming et al., 2022, Fang et al., 2022]. Different from the existing methods, we focus on the informative extrapolation proposed in our DivOE for diversifying the given auxiliary outliers towards the ID decision area. Intuitively, we provide an illustration of the conceptual comparison in Figure 5 to explain the differences. Different from the previous sampling-based methods which assume that the sampling space of the surrogate OOD distribution can be broad enough to cover the OOD decision area, our DivOE is targeted to conduct informative extrapolation to extend the given outlier exposure towards the ID decision area. In the following parts, we first introduce some preliminary setups and notations for the analyses.

Preliminary setups and notations. Following the prior works [Lee et al., 2018a, Sehwag et al., 2021, Ming et al., 2022], we assume the extracted feature approximately follows a Gaussian mixture model (GMM) with the equal class priors as 1 2 N ( µ, σ 2 I ) + 1 2 N ( -µ, σ 2 I ) . To be specific, D in = N ( µ, σ 2 I ) and D s out = N ( -µ, σ 2 I ) . Considering the hypothesis class as H = sign ( θ T x ) , θ ∈ R d . The classifier outputs 1 if x ∼ D in and outputs -1 if x ∼ D s out .

First, we introduce the assumption about informative extrapolation on D s out . The assumption is empirically supported to be valid by the previous exploration on the informative extrapolation in Figures 2 and 3, where the extrapolated outliers are more informative and close to the decision boundary towards ID samples.

Assumption B.1 (Informative Extrapolation on D s out ) . Considering the extrapolated version D e out of the D s out in our proposed DivOE, we assume that the data points x ∼ D e out satisfy the extended constraint based on the boundary scores -| f outlier ( x ) | defined in POEM Ming et al. [2022]:

𝐷in

𝐷out

𝑠

𝐷out

𝐷in

𝐷out

𝑠

𝐷out

where the f outlier is a function parameterized by some unknown ground truth weights and maps the high-dimensional input x into a scalar. Generally, it represents the discrepancy between the D e out and the true D out, indicated with the constraint α -τ ( ϵ ) results from the informative extrapolation. The τ ( ϵ ) represents the extended diversity, which is positively related to the extrapolated strength ϵ in general.

Given the above assumption, we can derive the following extended lemma based on that adopted in POEM [Ming et al., 2022].

Lemma B.2 (Constraint of Extrapolated D e out ) . Assume the data points x ∼ extrapolated D e out satisfy the following constraint for resulting in the following varied boundary margin: ∑ n i =1 | 2 x T i µ | ≤ nσ 2 ( α -τ ( ϵ )) .

proof of Lemma. B.2. Given the Gaussian mixture model described in the previous setup, we can obtain the following expression by Bayes' rule of P ( outlier | x ) ,

where d outlier ( x )) = ( x + µ ) ⊤ ( x + µ ) , d in ( x ) = ( x -µ ) ⊤ ( x -µ ) , and P ( outlier | x ) = 1 1+ e -f outlier ( x ) according to its definition. Then we have:

Therefore, we can get the constraint as: ∑ n i =1 | 2 x T i µ | ≤ nσ 2 ( α -τ ( ϵ )) .

With the previous assumption and lemma, then we present the analysis as below.

Complexity analysis on D e out . With the above lemma and the assumptions of informative extrapolation, we can derive the results to understand the benefit of our proposed DivOE.

Consider the given classifier defined as θ ∗ n 1 ,n 2 = 1 n 1 + n 2 ( ∑ n 1 i =1 x 1 i -∑ n 2 i =1 x 2 i ) , assume each x 1 i is drawn i.i.d. from D in and each x 2 i is drawn i.i.d from D e out , and assume the signal/noise ratio is || µ || σ = r 0 ≫ 1 , the dimentionality/sample size ratio is d n = r 1 , as well as exist some constant α < 1 . By decomposition, we can rewrite θ ∗ n 1 ,n 2 = µ + n 1 n 1 + n 2 θ 1 + n 2 n 1 + n 2 θ 2 with the following θ 1 and θ 2:

Since θ 1 ∼ N (0 , σ 2 n 1 I ) , we have that || θ 1 || 2 ∼ σ 2 n 1 X 2 d and µ T θ 1 || µ || ∼ N (0 , σ 2 n 1 ) to form the standard concentration bounds as:

The distribution of θ 2 can be treated as a truncated distribution of θ 1 as x 2 i drawn i.i.d. from the extrapolated D e out . Without losing the generality, we replace n 1 with n , and have the following inequality with a finite positive constant a :

According to Lemma B.2, we can have that | µ T θ 2 | ≤ || µ || 2 + σ 2 ( α -τ ( ϵ )) 2 . Now we can have || θ 1 || 2 ≤ σ 2 n ( d + 1 σ ) , || θ 2 || 2 ≤ σ 2 n ( d + 1 σ ) , | µ T θ 1 | || µ || ≤ ( σ || µ || ) 1 2 simultaneously hold and derive the following recall the decomposition,

and

With the above inequality derived in Eq. (25) and Eq. (26), we can have the following bound with the probability at least 1 -(1 + a ) e -r 1 n 8 σ 2 -2 e -n 1 || µ || 2 σ

Since FPR ( θ ∗ n 1 ,n 2 ) = erf ( µ T θ ∗ n 1 ,n 2 σ || θ ∗ n 1 ,n 2 || ) is monotonically decreasing, as the lower bound of µ T θ ∗ n 1 ,n 2 σ || θ ∗ n 1 ,n 2 || will increase as the constraint from the extrapolated D e out changed accordingly in our DivOE, the upper bound of FPR ( θ ∗ n 1 ,n 2 ) will decrease. From the above analysis, we can observe the benefit of DivOE when conducting the informative extrapolation.

Additional Discussion with Extrapolation Condition. The extrapolation of outlier data towards inliers may not always be possible. Similar to the condition analysis in [Fang et al., 2022], the informative extrapolation that targets better characterize the decision boundary between ID and OOD also needs some requirements or realization assumptions. Intuitively, it mainly relies on auxiliary outliers and specific extrapolation techniques. For the former, the original outliers should not be far away from the ID sample; For the latter, the extrapolation techniques should be able to add enough perturbation or semantic changes to the original outlier. It is worthy further exploring the condition in a theoretical way by referring the analysis in Fang et al. [2022].

C Additional Experimental Results and Further Discussion

In this section, we provide more experiment results from different perspectives to characterize our proposed DivOE. First, we introduce the additional experimental setups for the empirical verification in previous figures and our learning framework. Second, we provide more analyses of the manipulated data via informative extrapolation. Finally, comprehensive results with discussions are provided.

C.1 Additional Experimental Setups

Figure 1. In the right-panel of Figure 1, we conduct experiments to evaluate the OOD detection performance of different OE-based methods with the gradually reduced number of auxiliary outliers. We first sample a particular number of the least informative auxiliary outliers to simulate the different cases in collecting those surrogate OOD data. With the highest OOD scores, we sample the selected auxiliary outliers from the whole auxiliary dataset. Specifically, we choose the negative boundary

score generated by POEM [Ming et al., 2022] as the OOD score. For the fair comparison, we adjust the size of the mini-batch for OOD samples so that all methods actually train on 90% of the least informative auxiliary dataset by random sampling, or their custom sampling strategies during every epoch while keeping the number of ID training data unchanged.

Figure 2. In the left-middle panel of Figure 2, we evaluate the OOD detection performance of Energy-OE [Liu et al., 2020] with auxiliary outliers with different level of diversity. To simulate the collected auxiliary outliers from different levels of diversity, we first sample the 40000 least informative outliers from Tiny-ImageNet [Le and Yang, 2015] according to the boundary score generated by POEM [Ming et al., 2022]. Then we choose 10000 informative outliers in different but not-overlapped boundary score intervals, namely [0 , 10000] , [10000 , 20000] , [30000 , 40000] , [40000 , 50000] , [50000 , 60000] , and combine them with the 40000 least informative outliers to form 5 groups of auxiliary outliers with different levels of diversity. In the two right panels of Figure 2, we present TSNE visualization of feature embedding (taken at the penultimate layer of the network) on ID, the original outliers, and extrapolated outliers after the first training epoch in DivOE, with extrapolated ratio r = 0 . 5 , extrapolate epsilon ϵ = 0 . 05 and optimization step number k = 5 .

Figure 3. In the two left panel of Figure 3, we keep the extrapolated ratio r fixed to 0.5 and optimization step number k fixed to 5. In the right-middle panel, we compare ID/OOD distributions based on Energy score after training with DivOE, with hyperparameters r = 0 . 5 , ϵ = 0 . 05 , and k = 5 .

Figure 4. In Figure 4(a), the extrapolated epsilon ϵ is set to 0.5 and optimization step number k is set to 5. In Figure 4(b), we fix the extrapolated ratio r to 0.5 and optimization step number k to 5.

Training details. We conduct all major experiments on pre-trained WideResNet [Zagoruyko and Komodakis, 2016]with 40 depth and 2 widen factor and fix the number of fine-tuning epochs to 10, following the previous research work [Hendrycks et al., 2019, Liu et al., 2020]. The models are trained using stochastic gradient descent [Kiefer and Wolfowitz, 1952] with Nesterov momentum [Duchi et al., 2011]. We adopt Cosine Annealing [Loshchilov and Hutter, 2017] to schedule the learning rate, which begins at 0 . 001 . We set the momentum and weight decay to be 0 . 9 and 10 -4 respectively for all experiments. The size of the mini-batch is 128 for both ID samples and OOD samples when training and 200 for both when testing.

Hyper-parameter of DivOE. Throughout the paper, all the experiments with DivOE are conducted with extrapolated ratio r = 0 . 5 , extrapolate epsilon ϵ = 0 . 05 , and optimization step number k = 5 , unless stated otherwise.

C.2 Analyses on the Extrapolated Data

In this part, we further compare the extrapolated outliers with the given auxiliary outliers during the fine-tuning process of OE. In Figure 6, we adopt the TSNE visualization to check the feature representation of the extrapolated outliers during training. Through the comparison with the given outliers (represented by the blue circles), the extrapolated outliers (represented by the orange cricles) manipulated by our introduced target (e.g., Eq. (6)) can better cover the decision area between ID and OOD data. Note that the extrapolated OOD samples are optimized to be closer to the ID samples (represented by the green circles), which indicates this extrapolated portion can perform better on more accurately shaping the decision boundary of the binary classification task for ID and OOD.

In Figure 8, we present the energy score of the extrapolated outliers compared with the original ones. It can be found that the newly synthesized outliers can generally easier to be recognized as ID samples than the original auxiliary outliers. In Figure 9 and Table 28, we report the loss differences corresponding to the maximization part that verifies our operation indeed achieves the conceptual idea of diversified outlier exposure. Intuitively, we visualize the extrapolated outliers in Figure 10. The extrapolated samples still keep the semantic information that belongs to the OOD class space.

In addition, we also conduct another quantitative investigation on the extrapolated outliers with the original ones. In Table 6, we adopt the Maximum Mean Discrepancy (MMD) [Borgwardt et al., 2006] to check the distance between the distributions of the given auxiliary outliers with the extrapolated ones. By varying the specific ϵ that is adopted in the multi-step optimization (e.g., Eq. (9)), we can

(a) Epoch 1

(e) Epoch 5

23

Z3

-50

ID

ID

-50

ID

Original OOD

Originaloo

Original OoD

-75

Extrapolated OOD

54-

Extrapolated OOD

-75

Extrapolated OOD

-100

75

50

25

Dim1

0

25

50

75

-100

75

50

25

Dim1

0

25

50

-100

75

=50

25

Dim1

0

25

50

75

ID

50

ID

OriginalOOD

Original OOD

Extrapolated OOD

S-

Extrapolated OOD

-100

75

50

25

Dim1

25

50

-100

75

50

Dim1

25

50

observe that the manipulated outliers with large ϵ perform large discrepancy with the original outliers. It is intuitive and reasonable with more changes on semantic levels as shown in the left panel of Figure 3. However, as previously illustrated in the left-middle panel of Figure 3, we also find the larger ϵ may not always indicates more informative outliers as the semantic information may be lost when the pixel perturbations are arbitrarily large. It is worth to be further explored in the future.

C.3 Discussion on Using PGD-based Attack

Note that, PGD is a replaceable choice in the framework of DivOE. To better understand the effect of these attack-based noise, we compare it with other inner-attack methods and show that PGD with the uniform distribution loss is generally the better way to achieve higher performance.

We would like to explain that DivOE was proposed as a general framework for diversifying outlier exposure with partially conduct informative extrapolation, which allows any appropriate noise or augmentation techniques to be incorporated. To show the effectiveness of PGD, we conduct the following experiments. On the one hand, we compare the random noise, re-adversarial perturbation, and adversarial perturbation to justify its rationality. The results are summarized in the Table 7 and show the adversarial perturbation achieve better performance than other types of perturbations. On the other hand, we compare with other adversarial attacks and data augmentation methods for inner-maximization part in Table 8 and show that PGD with the uniform distribution loss is generally a better way to achieve higher performance due to the optimization originality.

How would α play an effect in DivOE As for α , it is a step size adopted in the informative extrapolation. To better understand its effect, we conducted the experiments by changing the step size in the PGD attack in Table 9. Since the step size is only related to the optimization of the constrained

maximization, the effects on the final performance of DivOE are not significant. By enlarging the step size, we may save more extra time on the inner maximization to reduce the time cost relatively, which is beneficial for algorithm deployment.

Visual illustration of Extrapolation Process. From the algorithmic perspective, the adversarial perturbation with uniform distribution loss is a non-target perturbation. The intuition is to perturb the OOD sample to be more like ID regarded by the model. Maximizing uniform distribution loss has no requirement for each OOD sample to be perturbed into some specific ID classes. Thus, it is actually automatically decided by the gradient for the specific perturbation directions. To better

𝜖 = 0.005

𝜖 = 0.01

𝜖 = 0.1

𝜖 = 0.5

original

1.0

1.0

1.0

1.0

1.0

softmax probability

0.8

softmax probability

0.8

0.8

8'0

0.8

0.6

0.6

0.6

0.6

0.6

0.4

0.4

softmax

0.4

softmax

0.4

0.4

0.2

0.2

0.2

0.2

0.2

0.0

0

1

23

Class

45

6

8

0.0

0

1

2

3

45

Class

6

7

8

0.0

12345

Class

7

8

0.0

0

12345

Class

6

7

8

0.0

0

123456

Class

8

understand the perturbation effect, we conduct the case study on the specific example in Figure 7 for their specific prediction results during the adversarial perturbation process. It can be find that after the adversarial perturbation, the prediction result of the second example will be concentrate on one specific class with high confidence. By enlarging the perturbation strength , the example will be perturbed to be confidently predicted on different classes.

C.4 Rationality of Partially Extrapolation

Considering the initial motivation to diversify outliers, we explore to extrapolate more potential OOD distribution beyond the original auxiliary ones. For the unperturbed OOD samples used in training, we hope the training can still learn the knowledge from the original auxiliary outliers, for the perturbed OOD samples, we hope the training can find different but informative outliers beyond the original ones to improve the generalization of outlier exposure.

Formally, Eq. (5) is an instance-level realization of Eq. (4) that actually contains the perturbed part and the unperturbed part. The deduction from Eq. (4) to Eq. (5) requires to merge the same terms in Eq. (4) first, and then specifically set with a subsequent rescaling. Finally, we have the formulation that a portion of data to conduct maximization part for diversifying the existing data distribution and the remaining other portion of data corresponds to learning on the original outliers.

To better understand the specific effects of different samples, it can be referred to the left panel of Figure 4, in which we show the OOD detection performance of DivOE under different portions of perturbed data during training. Generally, using a small part of perturbed samples can achieve the extrapolation target and improve the performance. However, if we totally perturb all the data, it is even worse than the original OE.

Intuitively, we hope the extrapolation can realize the diversification target and cover more potential OOD distributions beyond the original auxiliary ones. Under such high-level guidance, generally, the extrapolation ratio is expected to be not too large to totally change the whole original auxiliary distribution, which is empirically demonstrated to be negative for OE. As for diversified strength, we kindly refer to the left middle panel of Figure 3, which serves as a search space for synthesizing different outliers using different. In practical hyper-parameter tuning, we may generally suggest starting with the original OE baseline (i.e., extrapolation ratio equals 0 and diversified strength equals 0) and enlarging the extrapolation ratio or diversified strength step by step, finding a stage where the OODdetection performance on the validation set will not be further enhanced. For the coarse-grained augmentations and specific OOD scores, it may be further decided by other.

For four extrapolation factors, we re-summarize the previous results and discuss the general guidance for tuning. First, MSP score and PGD are empirically demonstrated to be the appropriate choice for extrapolation, which can be fixed (refer to the results in Figure 4(c)). Second, extrapolation ratio and strength (i.e., ϵ ) have general trends either individually or jointly considering them in Table 10. The performance of the extrapolation ratio is monotonous regarding different ϵ . The large values would degrade performance due to the loss of diversity on the auxiliary outliers. Then, the extrapolation strength could be tuned after the other factors are set to appropriate choices. Our empirical results

show that very small or large ϵ should be avoided, and epsilons from 0.05 to 0.1 can generally achieve satisfactory results by referring previous experimental results.

C.5 Extra Experimental Results and Discussions

In this part, we present the extra experimental results in the following perspectives to characterize the learning framework of DivOE for the OOD detection task.

Experiments on Add-on Modules. For adding other methods to Table 2, we conduct experiments accordingly and summarize the results in Table 11. The results show that DivOE can consistently improve them on the original basis compared with other counterparts across different setups.

Experiments on Fine-grained OOD Test Sets. In order to further understand the effectiveness of our DivOE on different OOD datasets, we report the fine-grained results of our experiments on CIFAR-10/CIFAR-100 with 5 OOD datasets (Textures, Places365, iSUN, LSUN-r, LSUN-c). The results on the 5 OOD datasets demonstrate the general effectiveness of our DivOE.

In Tables 12 and 13, we summarize the fine-grained detection performance. The results reflect the performance improvement of each method compared with those representative baselines. Our DivOE can significantly reduce the FPR95 score on some OOD testing sets in which those previous baselines do not perform well (e.g., Textures and Places365), and achieve comparable performance on the rest ones. Note that it is general to have some tradeoffs [Hendrycks et al., 2019, Chen et al., 2021, Ming et al., 2022, Fang et al., 2022] on the performance change when using different methods under the OE framework. DivOE shows a good balance in gaining significant improvement without sacrificing the other performance too much via the informative extrapolation. On the other hand, the significant

performance improvement of DivOE on the Textures and Places365 (that OOD test sets that the original OE does not perform well) exactly verifies that the informatively extrapolated outliers better represent the unseen OOD inputs that are close to the ID decision area.

Experiments on Sample Comparison It may be hard to align the sample number as different methods have different synthesis motivations and but we can actually present the number of generated samples. To facilitate the comparison, we summarize the specific outlier numbers that were manipulated in the adopted algorithm with its performance in OOD detection in Table 14. The results show that, compared with previous methods, either need go through all the outliers for sampling or change the training on all the auxiliary outliers, our DivOE can conduct extrapolation on a small portion of original outliers but achieve generally better performance across different ID classification tasks.

Experiments on Smaller Number of Auxiliary Samples. Here, we added the experiments under different numbers of auxiliary outliers used for all OE-based methods. The experimental results are summarized in Table 15, which indicates that the performance of OOD detection can be generally better if we use more outliers. Under smaller number of samples, i.e., from 50000 to 1000 (relatively smaller than 50000 ID data), DivOE can consistently perform better than OE.

Experiments on Comprehensive Explorations of the Extrapolated Data In Tables 20 and 21, we present a more comprehensive comparison of the extrapolated outliers under the learning framework of our DivOE. To be more specific, we control the specific extrapolation ratio r and the extrapolated strength ϵ to characterize the algorithm. From one perspective, we gradually increase the extrapolated strength ϵ with the fixed extrapolation ratio r = 1 , which means we conduct the full-batch manipulation on the original surrogate OOD distribution. The results demonstrate the failure of such a overall distribution perturbation with the significant performance drop on several OOD test sets (e.g., LSUN-r and LSUN-c). Intuitively, the overall distribution manipulation for the auxiliary outliers can not perform well towards the diversification target, as it is also inconsistent with the conceptual idea of our DivOE. From the other perspective, we decrease the extrapolation ratio r with the enlarged strength on informative extrapolation. Fortunately, with the diversified guidance introduced by our proposed objective in DivOE, we can find that even using ϵ = 0 . 125 can also enhance the performance of outlier exposure with different OOD test sets, resulting in a better performance in average.

Experiments on Using Different Synthetic Mechanism Here, we consider some advanced techniques using Generative Adversarial Network (GAN) to synthesizing new outliers for outlier exposure. Those methods [Lee et al., 2018a, Kong and Ramanan, 2021] additionally train generative models for generating extra outliers for data augmentation, which depends on the sample quality and actually are orthogonal to our extrapolation. We conduct experiments comparing and incorporating the method [Lee et al., 2018a] for informative extrapolation in Table 12 in attached PDF. We find that the

GAN-synthesized method is hard to train under our setups. When we incorporate DivOE into the generated sample, the performance can better enhanced than the original one of GAN-based method.

Experiments on Computational Cost To better understand the computational budget, we conduct additional experiments and summarize the time and memory results in Table 18, which shows that DivOE can achieve better performance with comparable time and memory costs with other OE-based methods. In addition, since the extra time requirement compared with the original OE is mainly from the inner-maximization of the informative extrapolation, we also explore the effect of perturbation noise on the OOD detection performance in Table 19. The results show that we can further save extra time by reducing the outlier manipulation times with maintaining the improvement.

Experiments on Compatibility with other OE-based Methods In Tables 20 and 21, we provide the fine-grained performance on OOD detection of those OE-based methods [Chen et al., 2021, Ming et al., 2022, Wang et al., 2023] with our DivOE. The overall results again confirm the effectiveness of the previously proposed OE-based methods incorporating the informative extrapolation introduced by our DivOE. Especially, DivOE via the informative extrapolation helps these methods better represent the unseen OOD inputs close to the ID decision area. The overall averaged results can refer to Table 2.

Experiments with Limited Informative Auxiliary Outliers In Table 22, we present the detailed performance results of the experiments with limited informative auxiliary outliers in CIFAR-10. The experiments are designed to demonstrate the consistent effectiveness of our proposed DivOE with informative extrapolation. Different from the previous sampling-based methods (e.g., NTOM [Chen et al., 2021] and POEM [Ming et al., 2022]), which assume that the potential surrogate OOD space can be arbitrarily large and cover the boundary decision area for ID and OOD inputs, our DivOE introduces the diversification target which is more general and robust given different auxiliary outliers. With such a general learning target, DivOE can perform learning and extrapolation given the surrogate OOD distribution iteratively under a single learning framework during the fine-tuning process. Empirically, it results in better performance improvement across the different setups on the auxiliary outliers in Table 20. Since the NTOM and POEM both adopt the sampling strategy to sample part of outliers (90%), we keep the same number in OE and our DivOE for the fair comparisons.

Experiments on Extrapolation via Data Augmentation In Tables 24, 25, 26 and 27, we replace the detailed realization of the inner-maximization of the informative extrapolation with the conventional data augmentation method, i.e., Mixup [Zhang et al., 2018], and also explore the effectiveness of combining the CutMix [Yun et al., 2019] in the learning framework. The results also confirm that the high-level idea of our DivOE is general to adopt different data manipulation or synthetic strategies to achieve the diversification target. The averaged and fine-grained performance results demonstrate the effectiveness of the proposed DivOE, which diversifies the given outlier for effective OOD detection. In addition, we also conduct experiments and combine them with the inner-maximization function. Compared with the pixel level manipulation, more coarse-grained data augmentation can also boost the performance if it can be conducted in an optimization way. If the original outliers are far away from the ID samples, data augmentation can serve as the basis for inner-maximization.

D Broader Impact

OOD detection is an important aspect of deploying reliable deep learning systems in the real world [Nguyen et al., 2015, Hendrycks et al., 2022]. It is especially important for those safety-critical applications [Bommasani et al., 2021] like financial or medical intelligence, in which a reliable

model should have the capability to distinguish those samples having different label spaces (e.g. animals) instead of giving a prediction based on existing classes (e.g., finance products or disease). Our research work studies a general and practical research problem in outlier exposure for effective OOD detection, considering the limited informative auxiliary outliers that can not well represent the boundary outliers for the pre-trained model on the classification tasks with ID samples. It is important for effective OOD detection to gain better empirical performance through learning from the auxiliary outliers, and also conceptually figure out the critical problem in this general learning framework.

Although we take a step forward in fine-tuning with auxiliary outliers for effective OOD detection, it is not the end of this direction since there are still many practical problems to be addressed. For example, although learning with the surrogate OOD data can boost the performance of the given model in identifying the OOD inputs, fine-tuning requires extra training time and computational cost, which may bring extra resources for adjusting. Same to other OE-based methods, how to reduce the extra training cost for the model regularization is also a future direction that is worth exploring.

































































































































































































   





























original

=0.025

=0.05

=0.075

=0.1

=0.15

=0.2

=0.5

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors of this paper present an innovative methodology for out-of-distribution (OOD) detection. While existing methodologies typically involve the direct use of given OOD samples, this paper introduces a new approach that applies perturbations to OOD samples, allowing the model to experience a more diverse set of OOD samples during training.\n\nThe authors define these perturbations using an adversarial loss based on the uniform distribution loss commonly applied to OOD samples. This creates directional guidance for each instance, determining the direction of the gradient and thus defining the perturbations applied to OOD samples.\n\nThe results demonstrate that using perturbed OOD samples improves the performance of OOD detection across several key metrics, including False Positive Rate at 95% Recall (FPR95), Area Under the Receiver Operating Characteristic Curve (AUROC), and Area Under the Precision-Recall Curve (AUPR), when compared to existing methodologies.\n\nSTRENGTHS:\nThis paper's novel approach of applying perturbations to a given data instance in order to utilize a broader array of samples and those tightly located at the decision boundary is indeed a reasonable and intriguing choice. The authors' concept of adversariality against the uniform loss, which implies a concentration of prediction towards a particular class, exhibits an interesting property worth exploring further.\n\nExperimentally, the authors provide a substantial ablation study on the hyperparameters used in loss composition, which adds to the comprehensiveness of their methodology. Notably, the use of t-SNE based plotting allows for a clear visualization of how the OOD samples are perturbed to be situated very closely to in-class samples. It also arise the question of \"how would ood behave for the different perturbation types?\".\n\nWEAKNESSES:\nThe authors have presented an interesting methodology that applies adversarial perturbations based on a particular loss function to enhance the performance of out-of-distribution detection. However, it would be important for the authors to provide empirical evidence that demonstrates the superiority of this adversarial perturbation over other types of perturbations. This would require a systematic and rigorous experimentation design and would ideally be conducted across various datasets and under different conditions to ensure the results are robust and generalizable.\n\nIn the final implementation of the authors' methodology, it's noted that both the perturbed and unperturbed out-of-distribution (OOD) samples are simultaneously considered in the loss function. However, the manuscript doesn't sufficiently explain the rationale behind this particular choice. It would be particularly interesting to see a comparison of results when using only perturbed samples, only unperturbed samples, or both, in the loss function. \n\na crucial aspect that needs further clarification and discussion is the ratio of in-distribution to OOD samples used in the training process. The choice of this ratio can significantly affect the performance and robustness of the model. For instance, a too high proportion of OOD samples could make the model overly sensitive to outliers, while a too low proportion might not adequately expose the model to OOD scenarios.\n\nWhile the paper shows promising results in the specific contexts tested, it would be beneficial for the authors to provide a more extensive analysis covering a range of different OOD datasets. If the authors can provide empirical evidence demonstrating the consistent performance of their method across diverse OOD datasets, it would significantly strengthen their claims. \n\nit's unclear from the manuscript how each OOD sample is directed towards a specific class during this adversarial perturbation process. Specifically, they should explain how the gradient direction, which determines the perturbations applied to the OOD samples, correlates with the movement of these samples towards specific classes.\n\nI am more than eager to increase my score if the questions above are adequately answered.\n\nQUESTIONS:\nPlease see the section weaknesses.\n\nLIMITATIONS:\nPlease see the section weaknesses.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe manuscript studies image-wide OOD detection in presence of auxiliary negative data. The negative data is often limited and therefore cannot fully encompass the distribution of inliers. Consequently, contemporary learning procedures fail to deliver classifiers resilient to outliers. To overcome this issue, the manuscript presents a method for extrapolating the negative data towards all modes of the inlier distribution. The proposed method first calculates the gradient of arbitrary OOD score over the input. Then, the sign of the gradient is used to direct the negative input samples towards the inlier distribution. The final learning algorithm uses both initial and extrapolated auxiliary negatives to train the classifier resilient to outliers. The proposed method outperforms relevant related works on small image benchmarks.\n\nSTRENGTHS:\nS1. The manuscript deals with an important issue.\n\nS2. Extrapolation of auxiliary negative data towards modes of inlier distribution intuitively makes sense.\n\nS3. The developed method achieves competitive results on considered benchmarks.\n\nS4. The developed method can be combined with existing OOD detectors (e.g. Energy, MSP, ... )\n\nWEAKNESSES:\nW1.  The manuscript does not discuss the effectiveness of the method when there is only a small auxiliary dataset available. It seems that the developed method still requires a broad OE dataset (Tiny-ImageNet as stated in L236).\n\nW2. The manuscript does not consider relevant related works which use synthetic negatives created by generative models [a,b,c]. Synthetic negatives are an effective way for augmenting the auxiliary dataset and the proposed method should outperform methods trained on a mixture of real and synthetic negative data.\n\nW4. The manuscript does not reflect on the additional computational budget (time and memory) required by the method over the OE baseline.\n\n[a] Shu Kong, Deva Ramanan: OpenGAN: Open-Set Recognition via Open Data Generation. ICCV 2021\n\n[b] Matej Grcic, Petra Bevandic, Sinisa Segvic: Dense Open-set Recognition with Synthetic Outliers Generated by Real NVP. VISAPP 2021.\n\n[c] Kimin Lee, Honglak Lee, Kibok Lee, Jinwoo Shin: Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samples. ICLR 2018.\n\nQUESTIONS:\nC1. Can the proposed method work on large-scale experiments [d]\n\nC2. Is the extrapolation of outlier data towards inliers always possible or there are some requirements that should be met?\nAnalysis similar to [e] could improve the manuscript.\n\n[d] Haoqi Wang, Zhizhong Li, Litong Feng, Wayne Zhang:\nViM: Out-Of-Distribution with Virtual-logit Matching. CVPR 2022.\n\n[e] Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, Feng Liu:\nIs Out-of-Distribution Detection Learnable? NeurIPS 2022\n\nLIMITATIONS:\nAlthough promised in Appendix D (L435), the limitations are not clearly stated. One possible limitation might be W1.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper tries to solve the problem that sampled auxiliary informative outliers may not be sufficient and diverse enough to recover the data boundary in the OOD detection setting. To achieve this, the authors propose a new learning objective with information extrapolation, where second term expands the surrogate OOD distributions towards a more diversified one. The authors have provided theoretical analysis to show that for Gaussian mixture model and binary classification problem, DivOE can extrapolate the\noutlier boundary towards ID data. In the experiments, the authors adopt image ID datasets such as CIFAR10, CIFAR100, and results show that DivOE achieves better performances over several evaluation metrics.\n\nSTRENGTHS:\nS1. The paper targets an important research problem within the OOD detection research community, and proposes a new auxiliary outlier generation and learning objective to target the research problem that surrogate auxiliary outliers are not sufficient and diverse enough.\n\nS2. The learning objective is simple but adaptable to different post-hoc scoring functions, augmentation techniques and sampling techniques to auxiliary outliers.\n\nS3. The paper has provided a solid theoretical analysis that shows the effectiveness of DivOE within a simplified binary classification setting. The result of Theorem 3.1 is consistent with the authors' explanations and observations in the previous sections.\n\nS4. The paper provides good experiment comparison to exciting methods. They have used several evaluation metrics to demonstrate the effectiveness of the approach.\n\nS5. The writing is very clear and presentation is easy to understand.\n\nWEAKNESSES:\nW1. In Theorem 3.1, The hypothesis class of the binary classification problem is overly simplified to only linear decision boundary. It would be nicer if the authors can provide theoretical results that generalize to more complex hypothesis class.\n\nW2. As Figure 4 shows, the extrapolation ratio and diversified strength are two variables that affect the OOD detection results. If extrapolation ratio is between 0.9~1.0, the performance may degrade and become worse than OE. However, the authors have not mentioned any general guidance to tune those two variables, especially for unseen OOD detection problems.\n\nW3. The authors should consider to include a table comparing the number of outliers generated by DivOE and other benchmark methods in order to achieve similar detection performance scores during experiments.\n\nW4. The authors should also include bold numbers for the best performing algorithms for Table 11, Table 12 and Table 13.\n\nQUESTIONS:\nQ1. The experiments are only performed on two simple image classification tasks with CIFAR10 and CIFAR100. The reviewer is wondering whether the authors have used other image datasets or tabular datasets for evaluation. \n\nQ2. Is there a general guideline in how to choose the extrapolation ratio, augmentation techniques, diversified strength, OOD scores when using DivOE on unseen OOD detection task? It seems that the four factors play an important role in detection performance.\n\nQ3. How would $\\eta$ and $\\alpha$ play an effect in the training steps of DivOE? \n\nQ4. Could different data augmentation techniques be used in combination with the inner-maximization function? Would the augmentation function boost up the performance?\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations and potential negative societal impact of their work, as listed in the NeurIPS checklist. The reviewer would appreciate if the authors can address the question and weakness section.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper improves the methods of utilizing auxiliary outlier data for fine-tuning. Specifically, it synthesizes informative outlier samples close to in-distribution at the decision boundary by adding noise to existing auxiliary data and utilizes them in learning. As a result, it shows improved results by applying the proposed method to various outlier exposure methodologies.\n\nSTRENGTHS:\n1. This paper's method is simple and clearly explained. This paper's approach is novel in explicitly adding noise to outlier data to synthesize and utilize outlier data. \n2. Theoretically, the proposed method looks a reasonable way to select samples closer to in-distribution data at the decision boundary than existing methods. \n3. The experiments are generally fair and show performance improvements when this method is applied as an add-on to a variety of methods. In particular, this paper suggests a method of synthesizing and utilizing outlier data, which presents the possibility of improving the performance of fine-tuning using outlier data. \n4. Additionally, this paper shows that this method is an effective way to improve the performance of fine-tuning using outlier data by applying it to a variety of outlier exposure methodologies and showing improved results.\n\nWEAKNESSES:\n1. The novelty and superiority in outlier synthesis against DOE [Wang et al., 2023] are not clear against DOE [Wang et al., 2023]. \n2. The term \"diversified\" is not well-defined, and it is not clear how it differs from the term \"informative\" used in ATOM [Chen et al., 2021]. \n3. The experiments also lack comparison and discussion with the most similar papers MixOE [Zhang et al., 2023] and DOE [Wang et al., 2023] that use outlier synthesis. For example, there is no comparison between the proposed method and DOE [Wang et al., 2023] when it is applied as an add-on to a variety of existing methods. \n4. The rationale for using PGD (Projected Gradient Descent) based noise is not well-explained. It is not clear if it has superiority over other attack-based noise. \n5. It is not clear how the proposed method of explicitly synthesizing outlier samples differs from implicitly synthesizing them in terms of new effects or novelty.\n\nQUESTIONS:\n1. What is the difference from the most important outlier synthesis methodologies (e.g., MixOE [Zhang et al., 2023] and DOE [Wang et al., 2023]).\n2. The fact that the outlier close to the boundary in the left figure of Figure 2 is a diversified outlier is not clearly explained. It is necessary to explain how the informative and diversified are different.\n3.\tThe process of moving from Equation 4 to Equation 5 is not clear. Additional detailed explanations are needed.\n4. Equation 4 synthesizes all outlier data and leverages only loss, while Equation 5 synthesizes and calculates loss for a portion of outlier data. It seems that the two equations are different methods. Please explain how the two equations are connected.\n5. It is necessary to discuss direct comparison and difference with DOE in TABLE1.\n6. Please add the comparison results of each when combined with DOE and MixOE in TABLE2.\n7.\tPlease add experiments on the ImageNet benchmark [A], as discussed in DOE.\n8.\tPlease add experiments on the application of DivOE to OECC [B] in TABLE2.\n\n[A] Tal Ridnik, Emanuel Ben Baruch, Asaf Noy, and Lihi Zelnik. Imagenet-21k pretraining for the masses. In NeurIPS Datasets and Benchmarks, 2021.\n\n[B] Papadopoulos, Aristotelis-Angelos, et al. Outlier exposure with confidence control for out-of-distribution detection. Neurocomputing, 2021, 441: 138-150.\n\nLIMITATIONS:\nYes. The author adequately addressed the limitations", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}