Title: CADet: Fully Self-Supervised Out-Of-Distribution Detection With Contrastive Learning
Venue: NeurIPS 2023
Accepted: yes
Keywords: Contrastive learning

OOD detection

adversarial detection

MMD

ImageNet-O

Anomaly detection

CIFAR-10.1
Abstract: Handling out-of-distribution (OOD) samples has become a major stake in the real-world deployment of machine learning systems. This work explores the use of self-supervised contrastive learning to the simultaneous detection of two types of OOD samples: unseen classes and adversarial perturbations. First, we pair self-supervised contrastive learning with the maximum mean discrepancy (MMD) two-sample test. This approach enables us to robustly test whether two independent sets of samples originate from the same distribution, and we demonstrate its effectiveness by discriminating between CIFAR-10 and CIFAR-10.1 with higher confidence than previous work. Motivated by this success, we introduce CADet (Contrastive Anomaly Detection), a novel method for OOD detection of single samples. CADet draws inspiration from MMD, but leverages the similarity between contrastive transformations of a same sample. CADet outperforms existing adversarial detection methods in identifying adversarially perturbed samples on ImageNet and achieves comparable performance to unseen label detection methods on two challenging benchmarks: ImageNet-O and iNaturalist. Significantly, CADet is fully self-supervised and requires neither labels for in-distribution samples nor access to OOD examples.

CADet: Fully Self-Supervised Anomaly Detection With Contrastive Learning

Abstract

Handling out-of-distribution (OOD) samples has become a major stake in the real-world deployment of machine learning systems. This work explores the use of self-supervised contrastive learning to the simultaneous detection of two types of OOD samples: unseen classes and adversarial perturbations. First, we pair self-supervised contrastive learning with the maximum mean discrepancy (MMD) two-sample test. This approach enables us to robustly test whether two independent sets of samples originate from the same distribution, and we demonstrate its effectiveness by discriminating between CIFAR-10 and CIFAR-10.1 with higher confidence than previous work. Motivated by this success, we introduce CADet (Contrastive Anomaly Detection), a novel method for OOD detection of single samples. CADet draws inspiration from MMD, but leverages the similarity between contrastive transformations of a same sample. CADet outperforms existing adversarial detection methods in identifying adversarially perturbed samples on ImageNet and achieves comparable performance to unseen label detection methods on two challenging benchmarks: ImageNet-O and iNaturalist. Significantly, CADet is fully self-supervised and requires neither labels for in-distribution samples nor access to OOD examples. 1

1 Introduction

While modern machine learning systems have achieved countless successful real-world applications, handling out-of-distribution (OOD) inputs remains a tough challenge of significant importance. The

problem is especially acute for high-dimensional problems like image classification. Models are typically trained in a close-world setting but inevitably faced with novel input classes when deployed in the real world. The impact can range from displeasing customer experience to dire consequences in the case of safety-critical applications such as autonomous driving [31] or medical analysis [55]. Although achieving high accuracy against all meaningful distributional shifts is the most desirable solution, it is particularly challenging. An efficient method to mitigate the consequences of unexpected inputs is to perform anomaly detection, which allows the system to anticipate its inability to process unusual inputs and react adequately.

Anomaly detection methods generally rely on one of three types of statistics: features, logits, and softmax probabilities, with some systems leveraging a mix of these [66]. An anomaly score f ( x ) is computed, and then detection with threshold τ is performed based on whether f ( x ) > τ . The goal of a detection system is to find an anomaly score that efficiently discriminates between in-distribution and out-of-distribution samples. However, the common problem of these systems is that different distributional shifts will unpredictably affect these statistics. Accordingly, detection systems either achieve good performance on specific types of distributions or require tuning on OOD samples. In both cases, their practical use is severely limited. Motivated by these issues, recent work has tackled the challenge of designing detection systems for unseen classes without prior knowledge of the unseen label set or access to OOD samples [68, 63, 66].

We first investigate the use of maximum mean discrepancy two-sample test (MMD) [19] in conjunction with self-supervised contrastive learning to assess whether two sets of samples have been drawn from the same distribution. Motivated by the strong testing power of this method, we then introduce a statistic inspired by MMD and leveraging contrastive transformations. Based on this statistic, we propose CADet (Contrastive Anomaly Detection), which is able to detect OOD samples from single inputs and performs well on both label-based and adversarial detection benchmarks, without requiring access to any OOD samples to train or tune the method.

Only a few works have addressed these tasks simultaneously. These works either focus on particular in-distribution data such as medical imaging for specific diseases [65] or evaluate their performances on datasets with very distant classes such as CIFAR10 [32], SVHN [47], and LSUN [73], resulting in simple benchmarks that do not translate to general real world applications [33, 51].

Contributions Our main contributions are as follows:

We use similarity functions learned by self-supervised contrastive learning with MMD to show that the test sets of CIFAR10 and CIFAR10.1 [52] have different distributions.

We propose a novel improvement to MMD and show it can also be used to confidently detect distributional shifts when given a small number of samples.

We introduce CADet, a fully self-supervised method for OOD detection inspired by MMD, and show it outperforms current methods in adversarial detection tasks while performing well on label-based OOD detection.

The outline is as follows: in Section 2, we discuss relevant previous work. Section 3 describes the self-supervised contrastive method based on SimCLRv2 [5] used in this work. Section 4 explores the application of learned similarity functions in conjunction with MMD to verify whether two independent sets of samples are drawn from the same distribution. Section 5 presents CADet and evaluates its empirical performance. Finally, we discuss results and limitations in Section 6.

2 Related work

We propose a self-supervised contrastive method for anomaly detection (both unknown classes and adversarial attacks) inspired by MMD. Thus, our work intersects with the MMD, label-based OOD detection, adversarial detection, and self-supervised contrastive learning literature.

MMD two-sample test has been extensively studied [19, 67, 18, 62, 8, 29], though it is, to the best of our knowledge, the first time a similarity function trained via contrastive learning is used in conjunction with MMD. Liu et al. [35] uses MMD with a deep kernel trained on a fraction of the samples to argue that CIFAR10 and CIFAR10.1 have different test distributions. We build upon that work by confirming their finding with higher confidence levels, using fewer samples. Dong et al. [11] explored applications of MMD to OOD detection.

Label-based OOD detection methods discriminate samples that differ from those in the training distribution. We focus on unsupervised OOD detection in this work, i.e. , we do not assume access to data labeled as OOD. Unsupervised OOD detection methods include density-based [74, 45, 46, 7, 12, 53, 59, 17, 37, 10], reconstruction-based [56, 75, 9, 50, 49, 7], one-class classifiers [57, 54], self-supervised [15, 25, 2, 63], and supervised approaches [34, 23], though some works do not fall into any of these categories [66, 60]. We refer to Yang et al. [71] for an overview of the many recent works in this field.

Adversarial detection discriminates adversarial samples from the original data. Adversarial samples are generated by minimally perturbing actual samples to produce a change in the model's output, such as a misclassification. Most works rely on the knowledge of some attacks for training [1, 43, 13, 39, 76, 48, 40], with the exception of [27].

Self-supervised contrastive learning methods [69, 22, 4, 5] are commonly used to pre-train a model from unlabeled data to solve a downstream task such as image classification. Contrastive learning relies on instance discrimination trained with a contrastive loss [21] such as infoNCE [20].

Contrastive learning for OOD detection aims to find good representations for detecting OOD samples in a supervised [36, 30] or unsupervised [68, 44, 58] setting. Perhaps the closest work in the literature is CSI [63], which found SimCLR features to have good discriminative power for unknown classes detection and leveraged similarities between transformed samples in their score. However, this method is not well-suited for adversarial detection. CSI ignores the similarities between different transformations of a same sample, an essential component to perform adversarial detection (see Section 6.2). In addition, CSI scales their score with the norm of input representations. While efficient on samples with unknown classes, it is unreliable on adversarial perturbations, which typically increase representation norms. Finally, we failed to scale CSI to ImageNet.

3 Contrastive model

We build our model on top of SimCLRv2 [5] for its simplicity and efficiency. It is composed of an encoder backbone network f θ as well as a 3 -layer contrastive head h θ ′ . Given an in-distribution sample X , a similarity function sim , and a distribution of training transformations T train , the goal is to simultaneously maximize

and minimize

i.e., we want to learn representations in which random transformations of a same example are close while random transformations of different examples are distant.

To achieve this, given an input batch { x i } i =1 ,...,N , we compute the set { x ( j ) i } j =0 , 1; i =1 ,...,N by applying two transformations independently sampled from T train to each x i . We then compute the embeddings z ( j ) i = h θ ′ ◦ f θ ( x ( j ) i ) and apply the following contrastive loss:

̸

τ is the temperature hyperparameter and sim ( x, y ) = ⟨ x | y ⟩ ∥ x ∥ 2 ∥ y ∥ 2 is the cosine similarity.

Hyperparameters: We follow as closely as possible the setting from SimCLRv2 with a few modifications to adapt to hardware limitations. In particular, we use the LARS optimizer [72] with learning rate 1 . 2 , momentum 0 . 9 , and weight decay 10 -4 . Iteration-wise, we scale up the learning rate for the first 40 epochs linearly, then use an iteration-wise cosine decaying schedule until epoch 800 , with temperature τ = 0 . 1 . We train on 8 V 100 GPUs with an accumulated batch size of 1024 . We compute the contrastive loss on all batch samples by aggregating the embeddings computed by each GPU. We use synchronized BatchNorm and fp32 precision and do not use a memory buffer. We use the same set of transformations, i.e., Gaussian blur and horizontal flip with probability 0 . 5 , color where

jittering with probability 0 . 8 , random crop with scale uniformly sampled in [0 . 08 , 1] , and grayscale with probability 0 . 2 .

For computational simplicity and comparison with previous work, we use a ResNet50 encoder architecture with final features of size 2048 . Following SimCLRv2, we use a three-layer fully connected contrastive head with hidden layers of width 2048 using ReLU activation and batchNorm and set the last layer projection to dimension 128 . For evaluation, we use the features produced by the encoder without the contrastive head. We do not, at any point, use supervised fine-tuning.

4 MMDtwo-sample test

The Maximum Mean Discrepancy (MMD) is a statistic used in the MMD two-sample test to assess whether two sets of samples S P and S Q are drawn from the same distribution. It estimates the expected difference between the intra-set distances and the across-sets distances.

Definition 4.1 (Gretton et al. [19]) . Let k : X × X → R be the kernel of a reproducing Hilbert space H k , with feature maps k ( · , x ) ∈ H k . Let X,X ′ ∼ P and Y, Y ′ ∼ Q . Under mild integrability conditions,

Given two sets of n samples S P = { X i } i ≤ n and S Q = { Y i } i ≤ n , respectively drawn from P and Q , we can compute the following unbiased estimator [35]:

̸

Under the null hypothesis h 0 : P = Q , this estimator follows a normal distribution of mean 0 [19]. Its variance can be directly estimated [18], but it is simpler to perform a permutation test as suggested in Sutherland et al. [62], which directly yields a p -value for h 0 . The idea is to use random splits X,Y of the input sample sets to obtain n perm different (though not independent) samplings of ̂ MMD 2 u ( X,Y ; k ) , which approximate the distribution of ̂ MMD 2 u ( S P , S P ; k ) under the null hypothesis.

Liu et al. [35] trains a deep kernel to maximize the test power of the MMD two-sample test on a training split of the sets of samples to test. We propose instead to use our learned similarity function without any fine-tuning. Note that we return the p -value 1 n perm +1 ( 1 + ∑ n perm i =1 1 ( p i ≥ est ) ) instead of 1 n perm ∑ n perm i =1 1 ( p i ≥ est ) . Indeed, under the null hypothesis P = Q , est and p i are drawn from the same distribution, so for j ∈ { 0 , 1 , . . . , n perm } , the probability for est to be smaller than exactly j elements of { p i } is 1 n perm +1 . Therefore, the probability that j elements or less of { p i } i are larger than est is ∑ j i =0 1 n perm +1 = j +1 n perm +1 . While this change has a small impact for large values of n perm , it is essential to guarantee that we indeed return a correct p -value. Notably, the algorithm of Liu et al. [35] has a probability 1 n perm > 0 to return an output of 0 . 00 even under the null hypothesis.

̸

Additionnally, we propose a novel version of MMD called MMD-CC (MMD with Clean Calibration). Instead of computing p i based on random splits of S P ⋃ S Q , we require as input two disjoint sets of samples drawn from P and compute p i based on random splits of S (1) P ⋃ S (2) P (see Algorithm 1). This change requires to use twice as many samples from P , but reduces the variance induced by the random splits of S P ⋃ S Q , which is significant when the number of samples is small. Note that S (1) P , S (2) P and S Q must always have the same size. Under the null hypothesis, P = Q , S (1) P , S (2) P and S Q are identically distributed, so the p i conserve the same distribution as for MMD (this is not the case when P = Q , hence the difference in testing power). Thus, the validity of MMD-CC follows from the validity of MMD.

1.0

0.8

positiverate

0.6

50 samples

true

0.4

100 samples

200 samples

500 samples

0.2

1000 samples

2000 samples

0.0

random

00

0.2

0.4

0.6

0.8

1.0

false positive rate

Algorithm 1 MMD-CC two-sample test

4.1 Distribution shift between CIFAR-10 and CIFAR-10.1 test sets

After years of evaluation of popular supervised architectures on the test set of CIFAR-10 [32], modern models may overfit it through their hyperparameter tuning and structural choices. CIFAR-10.1 [52] was collected to verify the performances of these models on a truly independent sample from the training distribution. The authors note a consistent drop in accuracy across models and suggest it could be due to a distributional shift, though they could not demonstrate it. Recent work [35] leveraged the two-sample test to provide strong evidence of distributional shifts between the test sets of CIFAR-10 and CIFAR-10.1. We run MMD-CC and MMD two-sample tests for 100 different samplings of S (1) P , S (2) P , S Q , using every time n perm = 500 , and rejecting h 0 when the obtained p -value is below the threshold α = 0 . 05 . We also report results using cosine similarity applied to the features of supervised models as a comparative baseline. We report the results in Table 1 for a range of sample sizes. We compare the results to three competitive methods reported in Liu et al. [35]: Mean embedding (ME) [8, 29], MMD-D [35], and C2ST-L [6]. Finally, we show in Figure 1a the ROC curves of the proposed model for different sample sizes.

Other methods in the literature do not use external data for pre-training, as we do with ImageNet, which makes a fair comparison difficult. However, it is noteworthy that our learned similarity can very confidently distinguish samples from the two datasets, even in settings with fewer samples available. Furthermore, while we achieve excellent results even with a supervised network, our model trained with contrastive learning outperforms the supervised alternative very significantly. We note however that with such high number of samples available, MMD-CC performs slightly worse than MMD. Finally, we believe the confidence obtained with our method decisively concludes that CIFAR10 and CIFAR10.1 have different distributions, which is likely the primary explanation for the significant drop in performances across models on CIFAR10.1, as conjectured by Recht et al. [52]. The difference in distribution between CIFAR10 and CIFAR10.1 is neither based on label set nor adversarial perturbations, making it an interesting task.

1.0

0.8

true positive rate

0.6

0.4

ImageNet-O

iNaturalist

PGD

0.2

CW

FGSM

0.0

random

0.0

0.2

0.4

0.6

0.8

10

false positive rate

4.2 Detection of distributional shifts from small number of samples

Given a small set of samples with potential unknown classes or adversarial attacks, we can similarly use the two-sample test with our similarity function to verify whether these samples are in-distribution [14]. In particular, we test for samples drawn from ImageNet-O, iNaturalist, and PGD perturbations, with sample sizes ranging from 3 to 20 . For these experiments, we sample S (1) P and S (2) P 5000 times across all of ImageNet's validation set and compare their MMD and MMD-CC estimators to the one obtained from S P and S Q . We report in Table 2 the AUROC of the resulting detection and compare it to the ones obtained with a supervised ResNet50 as the baseline.

Such a setting where we use several samples assumed to be drawn from a same distribution to perform detection is uncommon, and we are not aware of prior baselines in the literature. Despite using very few samples ( 3 ≤ n ≤ 20 ), our method can detect OOD samples with high confidence. We observe particularly outstanding performances on iNaturalist, which is easily explained by the fact that the subset we are using (cf. Section 1) only contains plant species, logically inducing an abnormally high similarity within its samples. Furthermore, we observe that MMD-CC performs significantly better than MMD, especially on detecting samples perturbed by PGD.

Although our method attains excellent detection rates for sufficient numbers of samples, the requirement to have a set of samples all drawn from the same distribution to perform the test makes it unpractical for real-world applications. In the following section, we present CADet, a detection method inspired by MMD but applicable to anomaly detection with single inputs.

5 CADet: Contrastive Anomaly Detection

While the numbers in Section 4 demonstrate the reliability of two-sample test coupled with contrastive learning for identifying distributional shifts, it requires several samples from the same distribution, which is generally unrealistic for practical detection purposes. This section presents CADet, a method to leverage contrastive learning for OOD detection on single samples.

Self-supervised contrastive learning trains a similarity function s to maximize the similarity between augmentations of the same sample, and minimize the similarity between augmentations of different samples. Given an input sample x test , we propose to leverage this property to perform anomaly detection on x test , taking inspiration from MMD two-sample test. More precisely, given a transformation distribution T val , we compute n trs random transformations x test i of x test , as well as n trs random transformations x ( k ) i on each sample x ( k ) of a held-out validation dataset X (1) val . We then compute the

intra-similarity and out-similarity:

̸

We finally define the following statistic to perform detection:

Intuition: note that while CADet is inspired by MMD, it has some significant differences. m in is computed across transformations of a same sample, while m out is computed across transformations and across samples. Therefore, even under the null hypothesis, m in and m out cannot be expected to have the same distribution. Besides, both score can be expected to be smaller on OOD samples. Indeed, OOD samples can be expected to have representations further from clean data in average, thus decreasing m out . Furthermore, since the self-supervised model was trained to maximize the similarity between transformations of a same sample, it is reasonable to expect that the model will perform this task better in-distribution than out-of-distribution, and thus that m in will be higher in-distribution than on OOD data. This intuition justifies adding m in to m out , instead of the subtraction operated by MMD. Finally, note that we do not consider the intra-similarity between validation samples: the validation is fixed, so it is necessarily a constant.

Calibration: since we do not assume knowledge of OOD samples, it is difficult a priori to tune γ , although crucial to balance information between intra-sample similarity and cross-sample similarity. As a workaround, we calibrate γ by equalizing the variance between m in and γm out on a second set of validation samples X (2) val :

It is important to note that the calibration of γ is essential, because m in and m out can have very different means and variances. Since m out measures the out-similarity between transformations of different samples, it can be expected to be low in average, with high variance. On the contrary, m in measures the similarity between transformations of a same sample, and can thus be expected to have higher mean and lower variance, which is confirmed in Table 5. Therefore, simply setting γ = 1 would likely results in one of the score dominating the other.

Rather than evaluating the false positive rate (FPR) for a range of possible thresholds τ , we use the hypothesis testing approach to compute the p-value:

The full pseudo-codes of the calibration and testing steps are given ins Appendix A. Setting a threshold p ∈ [0 , 1] for p v will result in a FPR of mean p , with a variance dependant of | X (2) val | . Section 5.1 further describes our experimental setting.

5.1 Experiments

For all evaluations, we use the same transformations as SimCLRv2 except color jittering, Gaussian blur and grayscaling. We fix the random crop scale to 0 . 75 . We use |{ X (2) val }| = 2000 in-distribution samples, |{ X (1) val }| = 300 separate samples to compute cross-similarities, and 50 transformations per sample. We pre-train a ResNet50 with ImageNet as in-distribution.

Unknown classes detection: we use two challenging benchmarks for the detection of unknown classes. iNaturalist using the subset in [28] made of plants with classes that do not intersect ImageNet. Wang et al. [66] noted that this dataset is particularly challenging due to proximity of its classes. We also evaluate on ImageNet-O [26]; explicitly designed to be challenging for OOD detection with ImageNet as in-distribution. We compare to recent works and report the AUROC scores in Table 3.

For Mahalanobis [33], since tuning on ood samples is not permitted, we use as score the mahalanobis score of the last layer as done in ViM [66]. Furthermore, to isolate the effect of the training scheme from the detection method, we present in Appendix B the performance of previous methods using the same self-supervised backbone as CADet, in conjunction with a trained linear layer.

Adversarial detection: for adversarial detection, we generate adversarial attacks on the validation partition of ImageNet against a pre-trained ResNet50 using three popular attacks: PGD [42], CW [3], and FGSM [16]. We follow the tuning suggested by Abusnaina et al. [1], i.e. PGD: norm L ∞ , δ = 0 . 02 , step size 0 . 002 , 50 iterations; CW: norm L 2 , δ = 0 . 10 , learning rate of 0 . 03 , and 50 iterations; FGSM: norm L ∞ , δ = 0 . 05 . We compare our results with ODIN [34], which achieves good performances in Lee et al. [33] despite not being designed for adversarial detection, Feature Squeezing (FS) [70], Local Intrinsinc Dimensionality (LID) [41], Hu et al. [27], and Mahalanobis [33] (using the mahalanobis score of the last layer as for unknwon classes detection). Most existing adversarial detection methods assume access to adversarial samples during training (see Section 2). We additionally propose a modification to Hu et al. [27] to perform auto-calibration based on the mean and variance of the criterions on clean data, similarly to CADet's calibration step. We report the AUROC scores in Table 4 and illustrate them with ROC curves against each anomaly type in Figure 1b.

6 Discussion

6.1 Results

CADet performs particularly well on adversarial detection, surpassing alternatives by a wide margin. We argue that self-supervised contrastive learning is a suitable mechanism for detecting classification attacks due to its inherent label-agnostic nature. Interestingly, Hu et al. [27] also benefits from contrastive pre-training, achieving much higher performances than with a supervised backbone. However, it is very reliant on calibrating on adversarial samples, since we observe a significant drop in performances with auto-calibration.

We explain the impressive performances of CADet on adversarial detection by the fact that adversarial perturbations will negatively affect the capability of the self-supervised model to match different transformations of the image. In comparison, the model has high capability on clean data, having been trained specifically with that objective.

While CADet does not outperform existing methods on label-based OOD detection, it performs comparably, an impressive feat of generality considering adversarially perturbed samples and novel labels have significantly different properties, and that CADet does not require any tuning on OOD samples.

Notably, applying CADet to a supervised network achieves state-of-the-art performances on iNaturalist with ResNet50 architecture, suggesting CADet can be a reasonable standalone detection method on some benchmarks, independently of contrastive learning. In addition, the poor performances of the supervised network on ImageNet-O and adversarial attacks show that contrastive learning is essential to address the trade-off between different type of anomalies.

Overall, our results show CADet achieves an excellent trade-off when considering both adversarial and label-based OOD samples.

6.2 The predictive power of in-similarities and out-similarities

Table 5 reports the mean and variance of m in and m out , and the rescaled mean γm out across all distributions. Interestingly, we see that outsimilarities m out better discriminate label-based OOD samples, while in-similarities m in better discriminate adversarial perturbations. Combining in-similarities and out-similarities is thus an essential component to simultaneously detect adversarial perturbations and unknown classes.

6.3 Limitations

Computational cost: To perform detection with CADet, we need to compute the features for a certain number of transformations of the test sample, incurring significant overhead. Figure 2 shows that reducing the number of transformations to minimize computational cost may not significantly affect performances. While the cal-

97.5

95.0

92.5

ImageNet-O

AUROC

90.0

iNaturalist

PGD

87.5

CW

85.0

FGSM

82.5

80.0

20

40

60

08

100

120

140

number of transformations

ibration step can seem expensive, it only required less than 10 minutes on a single A100 GPU, which is far from prohibitive. Moreover, it only needs to be run once for a given in-distribution. The

.

coefficient γ and scores are all one-dimensional values that can be easily stored, and we purposely use a small number of validation samples |{ X (1) val }| = 300 to make their embedding easy to memorize.

Architecture scale: as self-supervised contrastive learning is computationally expensive, we only evaluated our method on a ResNet50 architecture. In Wang et al. [66], the authors achieve significantly superior performances when using larger, recent architectures. The performances achieved with a ResNet50 are insufficient for real-world usage, and the question of how our method would scale to larger architectures remains open.

Adaptive attacks: we do not evaluate on adaptive attacks, and as such our detection method should be considered vulnerable to them. However, as shown in Tramer et al. [64], modern detection methods are typically weak to adaptive attacks. Since robustness to any adaptive attack is impossible to prove, we contend this is a limitation of detection methods in general, unspecific to CADet.

6.4 Future directions

While spurious correlations with background features are a problem in supervised learning, it is aggravated in self-supervised contrastive learning, where background features are highly relevant to the training task. We conjecture the poor performances of CADet on iNaturalist OOD detection are explained by the background similarities with ImageNet images, obfuscating the differences in relevant features. A natural way to alleviate this issue is to incorporate background transformations to the training pipeline, as was successfully applied in Ma et al. [40]. This process would come at the cost of being unable to detect shifts in background distributions, but such a case is generally less relevant to deployed systems. We leave to future work the exploration of how background transformations could affect the capabilities of CADet.

6.5 Conclusion

We have presented CADet, a method for both OOD and adversarial detection based on self-supervised contrastive learning. CADet achieves an excellent trade-off in detection power across different anomaly types, without requiring tuning on OOD samples. Additionally, we discussed how MMD could be leveraged with contrastive learning to assess distributional discrepancies between two sets of samples, and proved with high confidence that CIFAR10 and CIFAR10.1 have different distributions.

Acknowledgments and Disclosure of Funding

We thank Issam Laradji for his precious help in fixing cluster issues and our NeurIPS 2023 reviewers and AC for their constructive criticism and for taking the time to engage in discussions. We believe their feedback has significantly improved the quality of our submission.

References

A. Abusnaina, Y. Wu, S. Arora, Y. Wang, F. Wang, H. Yang, and D. Mohaisen. Adversarial example detection using latent neighborhood graph. In International Conference on Computer Vision , 2021.

L. Bergman and Y. Hoshen. Classification-based anomaly detection for general data. arXiv preprint arXiv:2005.02359 , 2020.

N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In Symposium on Security and Privacy , 2017.

T. Chen, S. Kornblith, M. Norouzi, and G. Hinton. A simple framework for contrastive learning of visual representations. In International Conference on Machine Learning , 2020.

T. Chen, S. Kornblith, K. Swersky, M. Norouzi, and G. Hinton. Big self-supervised models are strong semi-supervised learners. arXiv preprint arXiv:2006.10029 , 2020.

X. Cheng and A. Cloninger. Classification logit two-sample testing by neural networks. arXiv preprint arXiv:1909.11298 , 2019.

H. Choi, E. Jang, and A. A. Alemi. Waic, but why? generative ensembles for robust anomaly detection. arXiv preprint arXiv:1810.01392 , 2018.

K. Chwialkowski, A. Ramdas, D. Sejdinovic, and A. Gretton. Fast two-sample testing with analytic representations of probability measures. arXiv preprint arXiv:1506.04725 , 2015.

L. Deecke, R. Vandermeulen, L. Ruff, S. Mandt, and M. Kloft. Image anomaly detection with generative adversarial networks. In Joint european conference on machine learning and knowledge discovery in databases , 2018.

L. Dinh, J. Sohl-Dickstein, and S. Bengio. Density estimation using real nvp. arXiv preprint arXiv:1605.08803 , 2016.

X. Dong, J. Guo, A. Li, W.-T. Ting, C. Liu, and H. T. Kung. Neural mean discrepancy for efficient out-of-distribution detection, 2022.

Y. Du and I. Mordatch. Implicit generation and modeling with energy based models. In Advances in Neural Information Processing Systems , 2019.

R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner. Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 , 2017.

R. Gao, F. Liu, J. Zhang, B. H. 0003, T. Liu, G. N. 0001, and M. Sugiyama. Maximum mean discrepancy test is aware of adversarial attacks. In M. Meila and T. Z. 0001, editors, Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event , volume 139 of Proceedings of Machine Learning Research , pages 3564-3575. PMLR, 2021. URL http://proceedings.mlr.press/v139/gao21b.html .

I. Golan and R. El-Yaniv. Deep anomaly detection using geometric transformations. In Advances in Neural Information Processing Systems , 2018.

I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

W. Grathwohl, K.-C. Wang, J.-H. Jacobsen, D. Duvenaud, M. Norouzi, and K. Swersky. Your classifier is secretly an energy based model and you should treat it like one. arXiv preprint arXiv:1912.03263 , 2019.

A. Gretton, K. Fukumizu, Z. Harchaoui, and B. K. Sriperumbudur. A fast, consistent kernel two-sample test. In Y. Bengio, D. Schuurmans, J. Lafferty, C. Williams, and A. Culotta, editors, Advances in Neural Information Processing Systems , 2009.

A. Gretton, K. M. Borgwardt, M. J. Rasch, B. Schölkopf, and A. Smola. A kernel two-sample test. Journal of Machine Learning Research , 13(1):723-773, 2012.

M. Gutmann and A. Hyvärinen. Noise-contrastive estimation: A new estimation principle for unnormalized statistical models. In International Conference on Artificial Intelligence and Statistics , 2010.

R. Hadsell, S. Chopra, and Y. LeCun. Dimensionality reduction by learning an invariant mapping. In Computer Vision and Pattern Recognition , 2006.

K. He, H. Fan, Y. Wu, S. Xie, and R. Girshick. Momentum contrast for unsupervised visual representation learning. In Conference on Computer Vision and Pattern Recognition , 2020.

D. Hendrycks and K. Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv preprint arXiv:1610.02136 , 2016.

D. Hendrycks, S. Basart, M. Mazeika, A. Zou, J. Kwon, M. Mostajabi, J. Steinhardt, and D. Song. Scaling out-of-distribution detection for real-world settings. arXiv preprint arXiv:1911.11132 , 2019.

D. Hendrycks, M. Mazeika, S. Kadavath, and D. Song. Using self-supervised learning can improve model robustness and uncertainty. In Advances in Neural Information Processing Systems , 2019.

D. Hendrycks, K. Zhao, S. Basart, J. Steinhardt, and D. Song. Natural adversarial examples. arXiv preprint arXiv:1907.07174 , 2021.

S. Hu, T. Yu, C. Guo, W.-L. Chao, and K. Q. Weinberger. A new defense against adversarial images: Turning a weakness into a strength. In Advances in Neural Information Processing Systems , 2019.

R. Huang and Y. Li. Mos: Towards scaling out-of-distribution detection for large semantic space. arXiv preprint arXiv:2105.01879 , 2021.

W. Jitkrittum, Z. Szabo, K. Chwialkowski, and A. Gretton. Interpretable distribution features with maximum testing power. arXiv preprint arXiv:1605.06796 , 2016.

U. Khalid, A. Esmaeili, N. Karim, and N. Rahnavard. Rodd: A self-supervised approach for robust out-of-distribution detection. arXiv preprint arXiv:2204.02553 , 2022.

B. Kitt, A. Geiger, and H. Lategahn. Visual odometry based on stereo image sequences with ransac-based outlier rejection scheme. In 2010 IEEE Intelligent Vehicles Symposium , pages 486-492, 2010. doi: 10.1109/IVS.2010.5548123.

A. Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.

K. Lee, K. Lee, H. Lee, and J. Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems , 2018.

S. Liang, Y. Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint arXiv:1706.02690 , 2017.

F. Liu, W. Xu, J. Lu, G. Zhang, A. Gretton, and D. J. Sutherland. Learning deep kernels for non-parametric two-sample tests. In International Conference on Machine Learning , 2020.

H. Liu and P. Abbeel. Hybrid discriminative-generative training via contrastive learning. arXiv preprint arXiv:2007.09070 , 2020.

W. Liu, X. Wang, J. Owens, and Y. Li. Energy-based out-of-distribution detection. In Advances in Neural Information Processing Systems , 2020.

W. Liu, X. Wang, J. D. Owens, and Y. Li. Energy-based out-of-distribution detection. arXiv preprint arXiv:2010.03759 , 2020.

J. Lust and A. P. Condurache. Gran: an efficient gradient-norm based detector for adversarial and misclassified examples. arXiv preprint arXiv:2004.09179 , 2020.

X. Ma, B. Li, Y. Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. arXiv preprint arXiv:1801.02613 , 2018.

X. Ma, B. Li, Y. Wang, S. M. Erfani, S. N. R. Wijewickrema, M. E. Houle, G. Schoenebeck, D. Song, and J. Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. CoRR , abs/1801.02613, 2018. URL http://arxiv.org/abs/1801.02613 .

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017.

J. H. Metzen, T. Genewein, V. Fischer, and B. Bischoff. On detecting adversarial perturbations. arXiv preprint arXiv:1702.04267 , 2017.

S. Mohseni, M. Pitale, J. Yadawa, and Z. Wang. Self-supervised learning for generalizable out-of-distribution detection. In AAAI Conference on Artificial Intelligence , 2020.

E. Nalisnick, A. Matsukawa, Y. W. Teh, D. Gorur, and B. Lakshminarayanan. Do deep generative models know what they don't know? arXiv preprint arXiv:1810.09136 , 2018.

E. T. Nalisnick, A. Matsukawa, Y. W. Teh, and B. Lakshminarayanan. Detecting out-ofdistribution inputs to deep generative models using a test for typicality. arXiv preprint arXiv:1906.02994 , 2019.

Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011 , 2011.

N. Papernot and P. McDaniel. Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning. arXiv preprint arXiv:1803.04765 , 2018.

P. Perera, R. Nallapati, and B. Xiang. Ocgan: One-class novelty detection using gans with constrained latent representations. In Conference on Computer Vision and Pattern Recognition , 2019.

S. Pidhorskyi, R. Almohsen, and G. Doretto. Generative probabilistic novelty detection with adversarial autoencoders. In Advances in neural information processing systems , 2018.

J. Raghuram, V. Chandrasekaran, S. Jha, and S. Banerjee. A general framework for detecting anomalous inputs to dnn classifiers. In M. Meila and T. Zhang, editors, Proceedings of the 38th International Conference on Machine Learning , volume 139 of Proceedings of Machine Learning Research , pages 8764-8775. PMLR, 18-24 Jul 2021. URL https://proceedings. mlr.press/v139/raghuram21a.html .

B. Recht, R. Roelofs, L. Schmidt, and V. Shankar. Do imagenet classifiers generalize to imagenet? arXiv preprint arXiv:1902.10811 , 2019.

J. Ren, P. J. Liu, E. Fertig, J. Snoek, R. Poplin, M. Depristo, J. Dillon, and B. Lakshminarayanan. Likelihood ratios for out-of-distribution detection. In Advances in Neural Information Processing Systems , 2019.

L. Ruff, R. Vandermeulen, N. Goernitz, L. Deecke, S. A. Siddiqui, A. Binder, E. Müller, and M. Kloft. Deep one-class classification. In International Conference on Machine Learning , 2018.

T. Schlegl, P. Seeböck, S. M. Waldstein, U. Schmidt-Erfurth, and G. Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. arXiv preprint arXiv:1703.05921 , 2017.

T. Schlegl, P. Seeböck, S. M. Waldstein, U. Schmidt-Erfurth, and G. Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In International conference on information processing in medical imaging , 2017.

B. Schölkopf, R. C. Williamson, A. Smola, J. Shawe-Taylor, and J. Platt. Support vector method for novelty detection. In Advances in neural information processing systems , 1999.

V. Sehwag, M. Chiang, and P. Mittal. Ssd: A unified framework for self-supervised outlier detection. In International Conference on Learning Representations , 2021. URL https: //openreview.net/forum?id=v5gjXpmR8J .

J. Serrà, D. Álvarez, V. Gómez, O. Slizovskaia, J. F. Núñez, and J. Luque. Input complexity and out-of-distribution detection with likelihood-based generative models. arXiv preprint arXiv:1909.11480 , 2019.

K. Sohn, C.-L. Li, J. Yoon, M. Jin, and T. Pfister. Learning and evaluating representations for deep one-class classification, 2021.

Y. Sun, C. Guo, and Y. Li. React: Out-of-distribution detection with rectified activations. arXiv preprint arXiv:2111.12797 , 2021.

D. J. Sutherland, H.-Y. Tung, H. Strathmann, S. De, A. Ramdas, A. Smola, and A. Gretton. Generative models and model criticism via optimized maximum mean discrepancy. arXiv preprint arXiv:1611.04488 , 2016.

J. Tack, S. Mo, J. Jeong, and J. Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. In Advances in Neural Information Processing Systems , 2020.

F. Tramer, N. Carlini, W. Brendel, and A. Madry. On adaptive attacks to adversarial example defenses, 2020.

A. Uwimana1 and R. Senanayake. Out of distribution detection and adversarial attacks on deep neural networks for robust medical image analysis. arXiv preprint arXiv:2107.04882 , 2021.

H. Wang, Z. Li, L. Feng, and W. Zhang. Vim: Out-of-distribution with virtual-logit matching. In Conference on Computer Vision and Pattern Recognition , 2022.

L. Wenliang, D. Sutherland, H. Strathmann, and A. Gretton. Learning deep kernels for exponential family densities. In International Conference on Machine Learning , 2019.

J. Winkens, R. Bunel, A. G. Roy, R. Stanforth, V. Natarajan, J. R. Ledsam, P. MacWilliams, P. Kohli, A. Karthikesalingam, S. Kohl, et al. Contrastive training for improved out-ofdistribution detection. arXiv preprint arXiv:2007.05566 , 2020.

Z. Wu, Y. Xiong, S. X. Yu, and D. Lin. Unsupervised feature learning via non-parametric instance discrimination. In Conference on Computer Vision and Pattern Recognition , 2018.

W. Xu, D. Evans, and Y. Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. CoRR , abs/1704.01155, 2017. URL http://arxiv.org/abs/1704.01155 .

J. Yang, K. Zhou, Y. Li, and Z. Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110.11334 , 2021.

Y. You, I. Gitman, and B. Ginsburg. Large batch training of convolutional networks. arXiv preprint arXiv:1708.03888 , 2017.

F. Yu, A. Seff, Y . Zhang, S. Song, T. Funkhouser, and J. Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365 , 2015.

S. Zhai, Y. Cheng, W. Lu, and Z. Zhang. Deep structured energy based models for anomaly detection. In International Conference on Machine Learning , 2016.

B. Zong, Q. Song, M. R. Min, W. Cheng, C. Lumezanu, D. Cho, and H. Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International Conference on Learning Representations , 2018.

F. Zuo and Q. Zeng. Exploiting the sensitivity of l2 adversarial examples to erase-and-restore. In Asia Conference on Computer and Communications Security , 2021.

A Algorithms pseudo-code

We give the full pseudo codes for CADet's calibration step and inference step in Algorithm 2 and 3.

Algorithm 2 CADet calibration step

Input: X (1) val , X (2) val , T eval , learned similarity function s , various hyperparameters used below;

3:

Sample

t

from

5: end for

6: end for

10:

Sample

t

from

̸

T

eval

16: end for

25:

end for

Output: coefficient: γ , scores: score k , transformed samples: x (1) i

T

eval

Input: transformed samples: x i , scores: scores , test sample: x test , coefficient: γ , trasnformation set: T ;

̸

B Ablation on backbone

We present in table 6 the AUROC of previous methods on iNaturalist and ImageNet-O using a self-supervised contrastive ResNet50 backbone, as an ablation to table 3. Since most methods require class logits, we train a linear layer on top of the self-supervised features using all training labels. Thus, these methods still possess an unfair advantage over CADet by exploiting label information.

C Tuning of baselines

For previous works, when not specified otherwise we use the same tuning strategies described in the original papers.

For Mahalanobis [33] we employ the score of the last layer only as done in ViM [66]. For LID [41], we try for k in [10 , 20 , ..., 100] (and find k = 20 to perform best on all benchmarks) and σ in the range [0 , 10] . For ODIN, for OOD detection, we use the default values described in Liang et al. [34] (since we assume no access to ood samples), and tune them for adversarial detection. For FS [70], we use the best joint detection of multiple squeezers, which was tuned on ImageNet, ie. Bit Depth 5-bit, Median Smoothing 2x2, and Non-Local Mean 11-3-4.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper consists of two mostly unrelated parts.  In the first part, the authors aim to detect whether two sets of samples are drawn from the same distribution.  To do this, they apply the unbiased estimate of the MMD, in the manner suggested by Sutherland et al., to produce a conformal p-value.  Then they propose a small variation on Sutherland's approach, which they call MMD-CC, that requires twice as many samples but supposedly reduces some variance (although no further explanation or analysis is given).  They apply these techniques to detecting distribution shift between CIFAR-10 and CIFAR-10.1 using a feature-generating network trained on an external dataset (ImageNet), similar to \"outlier exposure\" methods.\n\nIn the second part of the paper, they aim to detect whether a single sample is drawn from same distribution as a set of inliers or not.  For this, they propose the CADet method, which has no discernable relationship to MMD (3) or the unbiased MMD estimate in (4).  Rather, CADet is closer to the CSI approach from Tack et al. and the ICLR'21 approach of Sohn et al., in that it relies on contrastive learning and distributional shifts.  Because key parts of CADet are never explained by the authors, it's difficult to summarize further.  The authors test CADet on experiments where ImageNet is the inliers and other datsets are the outliers, but they never compare to the state-of-the-art CSI approach even though they write \"the closest work in the literature is CSI\" on line 86.\n\nSTRENGTHS:\nThe combination of Sutherland's MMD with SimCLRv2 gives good empirical performance in detecting distributional shift between CIFAR-10 and CIFAR-10.1.\n\nWEAKNESSES:\n1. Claims about the existing literature are overblown and key citations are missing.  \na. On line 46, the authors claim that \"only a few works detect OOD samples from single inputs ... without requiring access to OOD samples to train or tune the method.\"  But there are dozens, if not hundreds, of papers proposing such methods.  \nb. Although the authors acknowledge that the CSI paper by Tack et al. is very close in spirit to CADet, they do not cite an even closer method in the ICLR'21 paper by Sohn et al.  \nc. Although the authors frequently compute conformal p-values, they don't cite any relevant literature.\nd. The authors do not cite previous work that uses MMD for OOD, such as Dong et al.'s \"Neural Mean Discrepancy for Efficient Out-of-Distribution Detection\".\n\n2. Throughout the paper, the p-values are invalid.  In the best case, the conformal p-values computed by the authors hold only only marginally, i.e., in expectation over the validation data.  They do NOT hold for a fixed validation set.  For a detailed explanation, see Bates et al. \"Testing for Outliers with Conformal p-values\" or Magesh et al. \"Multiple testing framework for out-of-distribution detection\" or Angelopoulos et al. \"Conformal Prediction: A Gentle Introduction\".\n\n3. In some cases, the p-values are invalid for more fundamental reasons.  In MMD-CC Algorithm 1, for example, the conformal p-values are computed as if n_perm was the size of an i.i.d. validation dataset.  But n_perm permutations are not independent and so the p-values computed in this way are invalid.  For example, there is nothing preventing the user from specifing a value of n_perm that is higher than the total number of possible permutations.  In fact, the MMD-CC method is entirely heuristic and comes with no analysis, which is a serious problem. \n\n4. The MMD-CC method is underwhelming at a practical level as well.  First, it requires twice as many samples as Sutherland's MMD.  Despite that limitation, it performs worse in Table 1.\n\n5. For the CIFAR-10-vs-CIFAR-10.1 experiment, the proposed feature generators were trained using ImageNet (see line 160).  This is problematic for several reasons.  First, using an external datset for OOD detection is a form of outlier exposure that violates the main claim of the paper stated on line 45.  Second, the other methods under test do NOT use an external datset, making the comparison unfair.  Third, the use of an external dataset goes against the instructions on line 94, which explicitly state that SimCLRv2 is to be trained on \"in-distribution samples.\" Fourth, alhough the authors wrote that \"a fair comparison is difficult,\" that's not true; they could have easily trained their feature generator on the CIFAR-10 inlier dataset and it would have avoided all these problems.\n\n6. The authors claim a weakness of CSI is that it can't detect adversarial perturbations, but in doing so the authors are conflating two entirely different versions of the OOD problem.  The first version is where one is given a trained supervised classification network and asked to detect samples different from those used to train it.  In this problem, we start with a network and so adversarial perturbations are well defined.  The second version (solved by CSI) is where one is given an inlier distribution and are asked to detect samples different from it.  Here, there is no network, and thus no adversarial perturbations, and so it is unfair/illogical to claim that CSI is \"not well suited for adversarial detection.\" CSI solves an entirely different problem.\n\n7. The section \"detection of distribution shifts from a small number of samples\" hides the fact that a huge number of samples are required to train the feature generating network.  In fact, by training on an external dataset, the authors are implementing a form of \"outlier exposure\" that goes against the main requirement stated on line 45.\n\n8. Critical information about the CADet method (the main contribution according to the title/abstract) is missing, making it impossible to fully evaluate the paper.  In particular, the similarity function \"s\" in (5) is never specified.  On line 195 it says \"self-supervised contrastive learning trains a similarity function,\" but that is incorrect: SSCL trains a feature generating network that maps an input \"x\" to a set of features \"z,\" as specified on line 99.  SSCL does NOT train a similarity function that maps two inputs \"x1\" and \"x2\" to a scalar.\n\n9. The choice to linearly combine the m^in and m^out scores in (6) is heuristic, and probably highly suboptimal.  The framework of multiple hypothesis testing gives principled ways to combine scores.  For more on multiple hypothesis testing, see Candes' STATS 300C lecture notes.\n\n10. The CSI method by Tack et al. is \"the closest work in the literature\" according to line 86. Yet the authors curiously omit it from all the numerical experiments, choosing much easier competitors.\n\nQUESTIONS:\n1. Regarding the perturbations in Table 2, they are never clearly defined.  Are these perturbations of the Supervised ImageNet-trained classifier used in the bottom two rows?\n\n2. There seems to be a mistake in the contrastive loss equation (1), since the \"j\" in the numerator is undefined.  Should the numerator be \"u_{i,i}\"?\"\n\n3. There seems to be a mistake in the CADet definition (5).  The denominator of m^out contains the number of terms in the numerator sum, but the denominator of m^in does not.  Should the latter be \"ntr(ntr-1)\"?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-12"}

comments: SUMMARY:
This paper studies the OOD detection of new classes and adversarial attacks with learned similarities via self-supervised contrastive learning in conjunction with MMD two-sample test. To enable MMD applicable for OOD detection on single samples, they improve the idea by using augmentations to create a set. Experimental results on new classes and adversarial examples detections show that their method can perform favorably against previous arts.

STRENGTHS:
1. The paper is well-written and well-organized.

2. The paper does a good job summarizing preliminary ideas and providing detailed settings reproducing the overall algorithm.

3. The paper provides helpful discussions regarding the efficiency of the method.

WEAKNESSES:
1. According to Table 3. it seems that the proposed method does not show superior performance against previous arts when using supervised training. Discussions regarding this matter could be included to better justify the method.

2. I'm not an expert on OOD detection. I'm wondering why there are no error bars in the reported results, given that different hyper-parameters could easily improve (or decrease) the performance, and the differences between the compared arts are not that significant reported in Table 3. 

3. Some hyper-parameters are empirically selected without proper justifications, especially those regarding augmentation.

QUESTIONS:
See weakness

LIMITATIONS:
Limitations have been discussed in the manuscript.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-06-26

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose to handle the OOD detection problem, exploring self-supervised contrastive learning to detect samples from previously unseen classes and adversarially perturbed samples. They use self-supervised contrastive learning with the maximum mean discrepancy (MMD) to test if two sets of samples originate from the same distribution. They propose CADet which takes advantage of the similarity of the contrastive representation/transformation of the same sample. The proposed approach is thoroughly tested in two scenarios: the scenario with previously unseen classes and the scenario with adversarially perturbed samples.\n\nSTRENGTHS:\n+ The problem of OOD detection is very important in a lot of aspects of machine learning, and it's a worthwhile problem to study and research.\n+ The proposed approach, CADet, achieves good performance on the benchmarks.\n+ The combination of MMD and self-supervised contrastive learning seems to be effective.\n\nWEAKNESSES:\n- The work is motivated by the claim that OOD samples will be encountered in the wild when the machine learning models are deployed in the wild, but this work is not tested in the wild, in a smart computing or cyber-physical system setting. This is a minor complaint as it is tested on (solely) datasets, but it is advised that the authors revise the paper to not include such claims.\n\n- The work fails to be evaluated on \"fake\" OOD samples, or samples that might originate from a different distribution than the training samples but belong in the same classes. For example, the Webcam domain in the Office-31 dataset and the Amazon domain in the same dataset, have the same classes, but distribution-wise, the samples are different. Will CADet consider Webcam's samples of class A to be OOD from Amazon's samples of class A? \n\n- The Related Works section is too high-level: it's evident that the authors are aware of the recent advance in the field of OOD detection, but a more detailed explanation (one sentence or two) for (most of) the mentioned works would be desirable.\n\nQUESTIONS:\n+ What is the intuition behind the fact that self-supervised contrastive learning works well with MMD?\n\nLIMITATIONS:\n+ The paper proposes an effective approach (self-supervised CL + MMD), but there are other mainstream alternatives to MMD such as the KL divergence and Mahalanobis distance. Why do you pick MMD in particular, instead of KL-divergence and Mahalanobis distance (both of which can be adapted to perform on both instance-level and distribution-level)? Is there any comparison on why KL-divergence based and Mahalanobis distance based approaches aren't as effective?", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes Maximum Mean Discrepancy with Clean Calibration (MMD-CC), as an improvement of MMD when the number of samples is small. Moreover, it introduces CADet, a novel anomaly detector for both OOD and adversarial detection inspired by MMD.\n\nSTRENGTHS:\nIn line with recent works, unsupervised anomaly detection in deep learning is a relevant research objective. The paper is well-written and proposes a novel approach for anomaly detection, improving existing works on Maximum Mean Discrepancy. Moreover, I appreciated the idea of improving MMD to overcome its limitation of requiring sets of test samples.\n\nWEAKNESSES:\n- Experimental setting. I did not understand why for benchmarking adversarial detection you kept ODIN [1] and discarded the Mahalanobis detector. To the best of my knowledge, ODIN is mainly designed for OOD detection, furthermore in [2] the Mahalanobis detector achieves better performance than both LID [3] and ODIN for adversarial detection. Moreover, no adaptive attack was tested [4].\n- Strength of the results. In Table 3, CADet has a high variance of the results depending on the training strategy  (iNaturalist vs ImageNet-O) and is not the overall best performing. Moreover, only the AUROC was reported, while other commonly employed metrics are missing (FPR, AUPR). Regarding MMD-CC, it should be better clarified its significance given that it is significantly better only on Table 2, with PGD and small n_samples.\n- Missing related works. Recently, other unsupervised anomaly detection (for both OOD and adversarial) algorithms have been proposed, such as [5]. A comparison with such method should be performed.\n- Reproducibility. No code was released. Some hyperparameters are missing (e.g., number of neighbours for LID [3], perturbation size for Mahalanobis [2] and ODIN [1]). Given how challenging it is to evaluate and compare OOD detectors, this is an important weakness.\n- Architecture scale. Given the existence of other unsupervised methods for anomaly detection ([5]) and the lack of convincing performance improvements over related methods, the computational limitations of CADet are a significant weakness.\n\n[1] Liang, S., Li, Y., & Srikant, R. (2018). Enhancing the reliability of out-of-distribution image detection in neural networks. ICLR 2018.\n\n[2] Lee, K., Lee, K., Lee, H., & Shin, J. (2018). A simple unified framework for detecting out-of-distribution samples and adversarial attacks. NeurIPS 2018.\n\n[3] Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S. N. R., Schoenebeck, G., Song, D., Houle, M. E., & Bailey, J. (2018). Characterizing adversarial subspaces using local intrinsic dimensionality. ICLR 2018.\n\n[4] Tramer, Florian, et al. \"On adaptive attacks to adversarial example defenses.\" Advances in neural information processing systems 33 (2020): 1633-1645.\n\n[5] Raghuram, J., Chandrasekaran, V., Jha, S., & Banerjee, S. (2021). A General Framework For Detecting Anomalous Inputs to DNN Classifiers. Proceedings of the 38th International Conference on Machine Learning, 8764–8775.\n\nQUESTIONS:\n### Suggestions:\nGiven the amount of OOD and adversarial detectors now available, I would expect a strong validation of a method to prove its effectiveness. I think that the most important concern that should be addressed is how CADet, given its resource limitations, can be a significant improvement over existing unsupervised OOD/adversarial detectors such as [1].\n\n### Typos:\n- Line 140, \"Additionnally\".\n\n[1] Raghuram, J., Chandrasekaran, V., Jha, S., & Banerjee, S. (2021). A General Framework For Detecting Anomalous Inputs to DNN Classifiers. Proceedings of the 38th International Conference on Machine Learning, 8764–8775.\n\nLIMITATIONS:\nThe authors addressed the main limitations of their method.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-02"}

comments: SUMMARY:
The paper presents a novel method for Out-of-Distribution (OOD) detection called CADet (Contrastive Anomaly Detection). The authors leverage self-supervised contrastive learning and the maximum mean discrepancy two-sample test(MMD) to assess whether two sets of samples have been drawn from the same distribution. The method is designed to detect OOD samples from single inputs and performs well on both label-based and adversarial detection benchmarks, without requiring access to any OOD samples nor previous classes to train or tune the method.

STRENGTHS:
1. The authors propose a novel method for OOD detection that does not require access to neither in distribution samples nor OOD samples to train or tune the method.
2. They use similarity functions learned by self-supervised contrastive learning with MMD to assess the distribution even with few shot images.
3. Paper shows the method outperforms current methods in adversarial detection tasks while performing well on label-based OOD detection.

WEAKNESSES:
I do not see major weaknesses for this paper as of now. I will be updating this section if need be later.

QUESTIONS:
1. I understand ResNet50 is a popular architectures that has been used for OOD and adversarial benchmarks. But there has been significant developments in those areas too, did you have a chance to see how would the method perform on other architectures beyond ResNet50?

LIMITATIONS:
Authors have done a good job presenting the limitations of their paper.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-27