Title: VRA: Variational Rectified Activation for Out-of-distribution Detection
Venue: NeurIPS 2023
Accepted: yes
Keywords: Out-of-distribution Detection
Abstract: Out-of-distribution (OOD) detection is critical to building reliable machine learning systems in the open world. Researchers have proposed various strategies to reduce model overconfidence on OOD data. Among them, ReAct is a typical and effective technique to deal with model overconfidence, which truncates high activations to increase the gap between in-distribution and OOD. Despite its promising results, is this technique the best choice? To answer this question, we leverage the variational method to find the optimal operation and verify the necessity of suppressing abnormally low and high activations and amplifying intermediate activations in OOD detection, rather than focusing only on high activations like ReAct. This motivates us to propose a novel technique called ``Variational Rectified Activation (VRA)'', which simulates these suppression and amplification operations using piecewise functions. Experimental results on multiple benchmark datasets demonstrate that our method outperforms existing post-hoc strategies. Meanwhile, VRA is compatible with different scoring functions and network architectures. Our code is available at https://github.com/zeroQiaoba/VRA.

VRA: Variational Rectified Activation for Out-of-distribution Detection

Abstract

Out-of-distribution (OOD) detection is critical to building reliable machine learning systems in the open world. Researchers have proposed various strategies to reduce model overconfidence on OOD data. Among them, ReAct is a typical and effective technique to deal with model overconfidence, which truncates high activations to increase the gap between in-distribution and OOD. Despite its promising results, is this technique the best choice? To answer this question, we leverage the variational method to find the optimal operation and verify the necessity of suppressing abnormally low and high activations and amplifying intermediate activations in OOD detection, rather than focusing only on high activations like ReAct. This motivates us to propose a novel technique called 'Variational Rectified Activation (VRA)', which simulates these suppression and amplification operations using piecewise functions. Experimental results on multiple benchmark datasets demonstrate that our method outperforms existing post-hoc strategies. Meanwhile, VRA is compatible with different scoring functions and network architectures. Our code is available at https://github.com/zeroQiaoba/VRA.

1 Introduction

Systems deployed in the real world often encounter out-of-distribution (OOD) data, i.e., samples from an irrelevant distribution whose label set has no interaction with the training data. Most of the existing systems tend to generate overconfident estimations for OOD data, seriously affecting their reliability [1]. Therefore, researchers propose the OOD detection task, which aims to determine whether a sample comes from in-distribution (ID) or OOD. This task allows the model to reject recognition when faced with unfamiliar samples. Considering its importance, OOD detection has attracted increasing attention from researchers and has been applied to many fields with high-safety requirements such as autonomous driving [2] and medical diagnosis [3].

In OOD detection, existing methods can be roughly divided into two categories: methods requiring training and post-hoc strategies. The first category identifies OOD data by training-time regularization [4, 5] or external OOD samples [6, 7]. But they require more computational resources and are inconvenient in practical applications. To this end, researchers propose post-hoc strategies that directly use pretrained models for OOD detection. Due to their ease of implementation, these methods have attracted increasing attention in recent years. Among them, React [8] is a typical post-hoc strategy that truncates abnormally high activations to increase the gap between ID and OOD, thereby improving detection performance. But is this operation the best choice for widening the gap?

To answer this question, we use the variational method to solve for the optimal operation. Based on this operation, we reveal the necessity of suppressing abnormally low and high activations and amplifying intermediate activations in OOD detection. Then, we propose a simple yet effective strategy called 'Variational Rectified Activation (VRA)', which mimics suppression and amplification operations using piecewise functions. To verify its effectiveness, we conduct experiments on multiple benchmark datasets, including CIFAR-10, CIFAR-100, and the more challenging ImageNet. Experimental results demonstrate that our method outperforms existing post-hoc strategies, setting new state-of-the-art records. The main contributions of this paper can be summarized as follows:

( Theory ) From the perspective of the variational method, we find the best operation for maximizing the gap between ID and OOD. This operation verifies the necessity of suppressing abnormally low and high activations and amplifying intermediate activations.

( Method ) We propose a simple yet effective post-hoc strategy called VRA. Our method is compatible with various scoring functions and network architectures.

( Performance ) Experimental results on benchmark datasets demonstrate the effectiveness of our method. VRA is superior to existing post-hoc strategies in OOD detection.

2 Methodology

2.1 Problem Definition

Let X be the input space and Y be the label space with c distinct categories. Consider a supervised classification task on a dataset containing N labeled samples { x , y } , where y ∈ Y is the ground-truth label for the sample x ∈ X . Ideally, all test samples come from the same distribution as the training data. But in practice, the test sample may come from an unknown distribution, such as an irrelevant distribution whose label set has no intersection with Y . In this paper, we use p in to represent the marginal distribution of X and p out to represent the distribution of OOD data. In this paper, we aim to determine whether a sample comes from ID or OOD.

2.2 Motivation

Among all methods, ReAct is a typical and effective post-hoc strategy [8]. Suppose h ( x ) = { z i } i m =1 is the feature vector of the penultimate layer and m denotes the feature dimension. For convenience, we use z as shorthand for z i . ReAct truncates activations above a threshold c for each z :

where c = ∞ is equivalent to the model without truncation. ReAct has demonstrated that this truncation operation can increase the gap between ID and OOD [8]:

Despite its promising results, is this strategy the best option for widening the gap between ID and OOD? In this paper, we attempt to answer this question with the help of the variational method.

2.3 VRA Framework

To find the best operation, we should optimize the following objectives:

Maximize the gap between ID and OOD.

Minimize the modification brought by the operation to maximally preserve the input.

The final objective function is calculated as follows:

where λ controls the trade-off between two losses. To solve for Eq. 3, we first make a mild assumption to ensure the function space G is sufficiently complex.

Assumption 1 We assume E in [ | z | ] , E out [ | z | ] , E in [ z 2 ] , and E out [ z 2 ] exist. Let G be a Hilbert space:

This space is sufficiently complex containing most functions, such as identity functions, constant functions, and all bounded continuous functions. Then, we define the inner product of G as follows:

Combining this assumption, the equivalent equation of Eq. 3 is:

Then, we leverage the variational method to solve for the functional extreme value. We mark g ∗ ( · ) as the optimal solution. ∀ f ( · ) ∈ G and ∀ ϵ ∈ R , we then have:

It can be converted to:

Then, we have:

Combining Assumption 1 and the arbitrariness of ϵ , we can get:

Considering Assumption 1 and the arbitrariness of f ( z ) , we have:

Therefore, the optimal activation function is:

To verify its effectiveness, we compare the optimal function g ∗ ( · ) with the unrectified function g ( z ) = z . Since g ∗ ( · ) is the optimal solution, it should get a smaller value in Eq. 3:

The equivalent equation of Eq. 14 is:

It shows that g ∗ ( · ) enlarges the gap between ID and OOD by at least 1 2 λ E in [( g ∗ ( z ) -z ) 2 ] ≥ 0 .

2.4 Practical Implementations

Through theoretical analysis, we have found the optimal operation g ∗ ( · ) that can maximize the gap between ID and OOD. But in practice, this operation depends on the specific expressions of p in and p out. Estimating these expressions is a challenging task given that OOD data comes from unknown distributions [9]. This drives us to look for more practical implementations.

(a)

empirical PDF on iNaturalist

(b)

empirical PDF on SUN

(c)

empirical PDF on Places

(d)

activation functions on iNaturalist

(e)

activation functions on SUN

(f)

activation functions on Places

Pin

Pout

Empirical PDF

Empirical PDF

Empirical PDF

Z

Z

Z

value

value

value

二

(-).6

ReAct

w/otruncation

Z

For this purpose, we treat ImageNet as ID data and select multiple OOD datasets. We first use histograms to approximate the probability density functions of p in and p out. Then, we compute g ∗ ( · ) and compare it with ReAct, whose threshold is set to the 90 th percentile of activations estimated on ID data, consistent with the original paper [8]. Experimental results are shown in Figure 1. Compared with the model without truncation, we observe that ReAct suppresses high activations (see Figure 1(d) ∼ 1(f)). Unlike ReAct, the optimal operation g ∗ ( · ) further demonstrates the necessity of suppressing abnormally low activations in OOD detection. To mimic such operations, we design a piecewise function called VRA:

where α and β are two thresholds for determining low and high activations. Obviously, α = 0 and β = ∞ represent models without activation truncation; α = 0 and β > 0 represent models equivalent to ReAct. Therefore, our method is a more general operation. Since different features have distinct distributions, we propose an adaptively adjusted strategy to determine α and β . Specifically, we predefine η α and η β satisfying η α < η β . Then, we treat the η α -quantile (or η β -quantile) of activations estimated on ID data as α (or β ). Meanwhile, we observe that g ∗ ( · ) amplifies intermediate activations in Figure 1(d) ∼ 1(f). Therefore, we propose another variant of VRA called VRA+, which further introduces a hyper-parameter γ to control the degree of amplification:

3 Experiments

3.1 Experimental Setup

Corpus Description In line with previous works, we consider different OOD datasets for distinct ID datasets [8, 10]. For CIFAR benchmarks [11] as ID data, we use the official train/test splits for ID data and select six datasets as OOD data: Textures [12], SVHN [13], Places365 [14], LSUN-Crop [15], LSUN-Resize [15], and iSUN [16]; for ImageNet [17] as ID data, it is more challenging than

CIFAR benchmarks due to larger label space and higher resolution images. To ensure non-overlapped categories between ID and OOD, we select a subset from four datasets as OOD data, in line with previous works [8, 10]: iNaturalist [18], SUN [19], Places [14], and Textures [12].

Baselines To verify the effectiveness of our method, we implement the following state-of-the-art post-hoc strategies as baselines: 1) MSP [20] is the most basic method that directly leverages the maximum softmax probability to identify OOD data; 2) ODIN [21] uses temperature scaling and input perturbation to increase the gap between ID and OOD; 3) Mahalanobis [22] calculates the distance from the nearest class center as the indicator; 4) Energy [23] replaces the maximum softmax probability with the theoretically guaranteed energy score; 5) ReAct [8] applies activation truncation to remove abnormally high activations; 6) KNN [24] exploits non-parametric nearest-neighbor distance for OOD detection; 7) DICE [10] leverages sparsification to select the most salient weights; 8) SHE [25] uses the energy function defined in the modern Hopfield network [26]. 9) ASH [27] removed a large portion of a sample's activation at a late layer.

Implementation Details Our method contains three user-specific parameters: the thresholds η α and η β , and the degree of amplification γ . We select η α from { 0 . 5 , 0 . 6 , 0 . 65 , 0 . 7 } , η β from { 0 . 8 , 0 . 85 , 0 . 9 , 0 . 95 , 0 . 99 } , and γ from { 0 . 2 , 0 . 3 , 0 . 4 , 0 . 5 , 0 . 6 , 0 . 7 } . Consistent with previous works [8], we use Gaussian noise images as the validation set for hyperparameter tuning. By default, we use DenseNet-101 [28] for CIFAR and ResNet-50 [29] for ImageNet. All experiments are implemented with PyTorch [30] and carried out with NVIDIA Tesla V100 GPU. To compare the performance of different methods, we exploit two widely used OOD detection metrics: FPR95 and AUROC. Among them, FPR95 measures the false positive rate of OOD data when the true positive rate of ID data is 95%; AUROC measures the area under the receiver operating characteristic curve.

3.2 Experimental Results and Discussion

Main Results To verify the effectiveness of our method, we compare VRA-based methods with competitive post-hoc strategies. Experimental results are shown in Table 1 and Table 2. We observe that our method generally achieves Top3 performance on different datasets and performs the best overall. Different from these baselines, we attempt to maximize the gap between ID and OOD by suppressing abnormally low and high activations and amplifying intermediate activations. These

results demonstrate the effectiveness of such suppression and amplification operations in OOD detection. Meanwhile, we observe that VRA+ generally outperforms VRA, suggesting that the operation closer to the theoretical optimum solution generally can achieve better performance.

We also compare with methods that require training. MOS [4] addresses OOD detection by trainingtime regularization. Experimental results in Table 2 show that our method outperforms MOS with the same backbone. Meanwhile, VOS [5] is a recently advanced strategy that synthesizes virtual outliers to regularize decision boundaries during training. According to their original paper, it achieves 95.33% in AUROC and 22.47% in FPR95 on CIFAR-10. Our method outperforms VOS under the same ID data, OOD data, and network architecture (see Table 1). Therefore, VRA-based methods do not require an expensive training process but can achieve better performance in OOD detection.

Compatibility with Scoring Functions In Table 3, we investigate the compatibility of VRA-based methods with different scoring functions: MSP, Energy, and ODIN. Experimental results demonstrate that our method brings performance improvements for all scoring functions and generally achieves better performance than competitive post-hoc strategies. These results verify the compatibility and effectiveness of our method in OOD detection.

(a) AUROC on CIFAR-10

(b) AUROC on CIFAR-100

(c) AUROC on ImageNet

(d)

FPR95 on CIFAR-10

(e)

FPR95 on CIFAR-100

(f)

FPR95 on ImageNet

96.6

90.0

80

96.4

80

89.5

80

94.5

60

96.2

60

89.0

60

94.0

20

40

96.0

95.8

20

40

S'88

88.0

87.5

20

40

93.0

- 93.5

0

0

95.6

87.0

92.5

0.70

0.70

0.70

0.80

0.65

95.4

0.80

0.65

86.5

0.80

0.65

92.0

0.85

na

0.85

na

0.85

na

0.90

0.60

0.90

09'0

0.90

0.60

nB

0.95

nB

0.95

nB

0.95

0.99

0.50

0.99

0.50

0.99

0.50

20

22.0

23.0

50

60

58.0

60.0

35

30

36.0

38.0

10

15

20.0

19.0

21.0

20

10

OE

40

56.0

54.0

52.0

50.0

10

0

25

20

15

28.0

34.0

32.0

30.0

0.70

18.0

0.70

48.0

0.70

26.0

0.80

0.85

0.90

0.60

0.65

na

17.0

0.80

0.85

0.90

0.60

0.65

na

46.0

0.80

0.85

0.90

0.60

0.65

na

24.0

nB

0.95

nB

0.95

nB

0.95

66°0

0.50

660

0.50

0.99

0.50

Performance Upper Bound Analysis We propose VRA and VRA+ to approximate the optimal operation for OOD detection. But is it necessary to design other functions to get a better approximation? To answer this question, we need to reveal whether g ∗ ( · ) can reach the upper-bound performance. The core of estimating g ∗ ( · ) is to estimate the probability density functions of p in and p out. To this end, we consider two ideal cases: VRA-True and VRA-Fake-True . In the first case, we assume that all ID and OOD data are known in advance; in the second case, we randomly select 1% of ID and OOD data from the entire dataset. Both cases leverage histograms to estimate p in and p out and use Eq. 13 to calculate g ∗ ( · ) . Considering that histograms provide a piecewise form of g ∗ ( · ) , we directly use the piecewise function to represent g ∗ ( · ) . In Table 4, we observe that both ideal cases can achieve near-perfect results. Therefore, g ∗ ( · ) that increases the gap between ID and OOD can generate more discriminative features for OOD detection. In the future, we will explore other functions that can better describe the optimal operation for better performance.

Parameter Sensitivity Analysis VRA uses two hyper-parameters ( η α and η β ) to adaptively adjust thresholds for low and high activations. In this section, we conduct parameter sensitivity analysis and reveal their impact on OOD detection. In Figure 2, we observe that our method does not perform well when η α and η β are inappropriate. A large η α suppresses too many low activations, while a large η β suppresses too few high activations. Therefore, it is necessary to choose proper η α and η β for VRA.

Role of Adaptively Adjusted Strategy In this paper, we adopt an adaptive strategy to automatically determine α and β . To verify its effectiveness, we compare this adaptive strategy with another strategy that uses fixed α and β for different features. To determine these hyper-parameters, we use Gaussian

noise images as the validation set, in line with previous works [8]. Experimental results in Table 5 demonstrate that our adaptive strategy outperforms this fixed strategy. The reason lies in that different features have distinct statistical distributions. Using fixed thresholds for different features will limit the performance of OOD detection.

Compatibility with Backbones In this section, we further verify the compatibility of our method with different backbones. For a fair comparison, all methods are pretrained on ImageNet, and we report the average results on four OOD datasets of ImageNet. Compared with competitive post-hoc strategies, experimental results in Table 6 demonstrate that our method can achieve the best performance under different network architectures. These results validate the effectiveness and compatibility of our method. Meanwhile, we observe some interesting phenomena in Table 6. ReAct [8] points out that mismatched BatchNorm [31] statistics between ID and OOD lead to model overconfidence on OOD data. In Table 6, VGG-16 and VGG-16-BN refer to models without and with BatchNorm, respectively. We observe that no matter with or without BatchNorm, ReAct cannot achieve better performance than Energy, consistent with previous findings [32]. Therefore, BatchNorm may not be the only reason for model overconfidence, and the network architecture also matters. Furthermore, Energy [23] generally outperforms MSP [20] with the exception of EfficientNetV2, which also reveals its limitation in compatibility. In the future, we will conduct an in-depth analysis to reveal the reasons behind these phenomena.

4 Further Analysis

Combining features with logit outputs can achieve better performance in OOD detection [37]. Therefore, we design another variant of VRA called VRA++, whose scoring function is defined as:

where z i , i ∈ [1 , m ] represents the i -th feature and l i , i ∈ [1 , c ] represents the i -th logit output. This scoring function consists of two items: (1) Since we have maximized the gap between ID and OOD E in [ g ( z i )] -E out [ g ( z i )] , we directly use the sum of all rectified features ∑ m i =1 g ( z i ) as the indicator; (2) We also calculate the energy score on logit outputs for OOD detection. These items are combined using a balancing factor λ v . Unlike VRA using piecewise functions, we further test the performance of the quadratic function g ( z ) = -z 2 + α v z . By choosing a proper α v , this quadratic function can

also simulate suppression and amplification operations. Finally, our scoring function is defined as:

Among all methods, ViM [37] is a powerful strategy that combines features and logit outputs. For a fair comparison with ViM, we use the same ID data (ImageNet), OOD data (OpenImage-O [37], Texture [12], iNaturalist [18], and ImageNet-O [38]), and network architecture (BiT [39]). Experimental results in Table 7 demonstrate that VRA++ achieves better performance than ViM, verifying the scalability and high potential of our method. Meanwhile, VRA++ generally achieves the best performance among all variants (see Table 8). These results further demonstrate the necessity of combining features and logit outputs in OOD detection.

5 Related Work

Post-hoc Method Post-hoc strategies are an important branch of OOD detection. Due to their ease of implementation, they have attracted increasing attention from researchers. Among them, MSP [20] was the most basic post-hoc strategy, which directly leveraged the maximum value of the posterior distribution as the indicator. Since then, researchers have proposed various post-hoc approaches. For example, ODIN [21] used temperature scaling and input perturbations to improve the separability of ID and OOD data. Energy [23] replaced the softmax confidence score in MSP [20] with the theoretically guaranteed energy score. Mahalanobis [22] used the minimum distance from the class centers to identify OOD data. KNN [24] was a nonparametric method that explored K-nearest neighbors. More recently, researchers have found that the reason behind model overconfidence in OOD data lies in abnormally high activations of a small number of neurons. To address this, Dice [10] used weight sparsification, while ReAct [8] exploited activation truncation. Different from these works, we further demonstrate that abnormally low activations also affect OOD detection performance. This motivates us to propose VRA to rectify the activation function.

Activation Function Activation functions are an important part of neural networks [40, 41]. Previously, researchers found that neural networks with the ReLU activation function produced abnormally high activations for inputs far from the training data, harming the reliability of deployed systems [42]. To address this problem, ReAct used a truncation operation to rectify activation functions. In this paper, we propose a more powerful rectified activation function for OOD detection. Experimental results on multiple benchmark datasets demonstrate the effectiveness of our method.

Variational Method The variational method is often used to solve for the functional extreme value. Its most famous application in neural networks is the variational autoencoder [43], which solves for the functional extreme value by trading off reconstruction loss and Kullback-Leibler divergence. It

has also been applied to other complex scenarios [44] and multimodal tasks [45]. In this paper, we use the variational method to find the operation that can maximize the gap between ID and OOD.

6 Limitation

Distributions of ID and OOD data impact the performance of VRA. In the future, we will conduct a theoretical analysis to explain the reason behind this phenomenon. Meanwhile, analogous to previous works such as ReAct and ASH, this paper mainly focuses on the pre-trained classifiers with ReLU-based activations. Although we have explored some other architectures in the appendix, future experiments in more structures are also needed.

In this paper, we treat max g E in [ g ( z )] -E out [ g ( z )] as the core objective function derived from ReAct and min g E in [( g ( z ) -z ) 2 ] as the regularization term. However, there may be better regularization terms that can not only guarantee the existence of the optimal solution but also ensure that the expression of the optimal solution is easy to implement and has good interpretability. Therefore, we will explore other regularization terms for OOD detection. Meanwhile, this paper uses simple piecewise functions to approximate the complex optimal operation. In the future, we will explore other functional forms that can better describe the optimal operation.

7 Conclusion

This paper proposes a post-hoc OOD detection strategy called VRA. From the perspective of the variational method, we find the theoretically optimal operation for maximizing the gap between ID and OOD. This operation reveals the necessity of suppressing abnormally low and high activations and amplifying intermediate activations in OOD detection. Therefore, we propose VRA to mimic these suppression and amplification operations. Experimental results show that our method outperforms existing post-hoc strategies and is compatible with different scoring functions and network architectures. In the ideal case of knowing a small fraction of OOD samples, we can achieve nearperfect performance, demonstrating the strong potential of our method. Meanwhile, we verify the effectiveness of our adaptively adjusted strategy and reveal the impact of different hyper-parameters.

References

Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, Dan Hendrycks, Yixuan Li, and Ziwei Liu. Openood: Benchmarking generalized out-of-distribution detection. In Proceedings of the Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track , pages 1-14, 2022.

Alexander Amini, Ava Soleimany, Sertac Karaman, and Daniela Rus. Spatial uncertainty sampling for end-to-end control. arXiv preprint arXiv:1805.04829 , 2018.

Tanya Nair, Doina Precup, Douglas L Arnold, and Tal Arbel. Exploring uncertainty measures in deep networks for multiple sclerosis lesion detection and segmentation. In Proceedings of the Medical Image Computing and Computer Assisted Intervention, MICCAI , pages 655-663, 2018.

Rui Huang and Yixuan Li. Mos: Towards scaling out-of-distribution detection for large semantic space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 8710-8719, 2021.

Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. In Proceedings of the International Conference on Learning Representations , pages 1-21, 2022.

Qing Yu and Kiyoharu Aizawa. Unsupervised out-of-distribution detection by maximum classifier discrepancy. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 9518-9526, 2019.

Jingkang Yang, Haoqi Wang, Litong Feng, Xiaopeng Yan, Huabin Zheng, Wayne Zhang, and Ziwei Liu. Semantically coherent out-of-distribution detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 8301-8309, 2021.

Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. In Proceedings of the Advances in Neural Information Processing Systems , pages 144-157, 2021.

Christopher M Bishop. Pattern recognition and machine learning . Springer, 2006.

Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-distribution detection. In Proceedings of the European Conference on Computer Vision , pages 691-708, 2022.

Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.

Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 3606-3613, 2014.

Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning , pages 1-9, 2011.

Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence , 40(6):1452-1464, 2017.

Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365 , 2015.

Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint arXiv:1504.06755 , 2015.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 248-255, 2009.

Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 8769-8778, 2018.

Jianxiong Xiao, James Hays, Krista A Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3485-3492, 2010.

Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In Proceedings of the International Conference on Learning Representations , pages 1-12, 2017.

Shiyu Liang, Yixuan Li, and R Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In Proceedings of the 6th International Conference on Learning Representations , pages 1-27, 2018.

Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Proceedings of the Advances in Neural Information Processing Systems , pages 7167-7177, 2018.

Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. In Proceedings of the Advances in Neural Information Processing Systems , pages 21464-21475, 2020.

Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In Proceedings of the International Conference on Machine Learning , pages 20827-20840, 2022.

Jinsong Zhang, Qiang Fu, Xu Chen, Lun Du, Zelin Li, Gang Wang, Shi Han, and Dongmei Zhang. Out-of-distribution detection based on in-distribution data patterns memorization with modern hopfield energy. In Proceedings of the Eleventh International Conference on Learning Representations , pages 1-19, 2023.

Hubert Ramsauer, Bernhard Schäfl, Johannes Lehner, Philipp Seidl, Michael Widrich, Lukas Gruber, Markus Holzleitner, Thomas Adler, David Kreil, Michael K Kopp, Günter Klambauer, Johannes Brandstetter, and Sepp Hochreiter. Hopfield networks is all you need. In Proceedings of the International Conference on Learning Representations , pages 1-95, 2021.

Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection. In The Eleventh International Conference on Learning Representations , 2022.

Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4700-4708, 2017.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 770-778, 2016.

Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: an imperative style, high-performance deep learning library. In Proceedings of the 33rd International Conference on Neural Information Processing Systems , pages 8026-8037, 2019.

Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In Proceedings of the International Conference on Machine Learning , pages 448-456, 2015.

Yeonguk Yu, Sungho Shin, Seongju Lee, Changhyun Jun, and Kyoobin Lee. Block selection method for using feature norm in out-of-distribution detection. arXiv preprint arXiv:2212.02295 , 2022.

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 , 2014.

Mingxing Tan and Quoc Le. Efficientnetv2: Smaller models and faster training. In Proceedings of the International Conference on Machine Learning , pages 10096-10106, 2021.

Ilija Radosavovic, Raj Prateek Kosaraju, Ross Girshick, Kaiming He, and Piotr Dollár. Designing network design spaces. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 10428-10436, 2020.

Andrew Howard, Mark Sandler, Grace Chu, Liang-Chieh Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, et al. Searching for mobilenetv3. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 1314-1324, 2019.

Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual-logit matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4921-4930, 2022.

Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15262-15271, 2021.

Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Joan Puigcerver, Jessica Yung, Sylvain Gelly, and Neil Houlsby. Big transfer (bit): General visual representation learning. In Proceedings of the European Conference on Computer Vision , pages 491-507, 2020.

Vinod Nair and Geoffrey E Hinton. Rectified linear units improve restricted boltzmann machines. In Proceedings of the International Conference on Machine Learning , pages 807-814, 2010.

Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415 , 2016.

Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 41-50, 2019.

Diederik P Kingma and Max Welling. Auto-encoding variational bayes. In Proceedings of the International Conference on Learning Representations , pages 1-14, 2014.

Bing Yu et al. The deep ritz method: a deep learning-based numerical algorithm for solving variational problems. Communications in Mathematics and Statistics , 6(1):1-12, 2018.

Gaurav Pandey and Ambedkar Dukkipati. Variational methods for conditional multimodal deep learning. In Proceedings of the International Joint Conference on Neural Networks (IJCNN) , pages 308-315, 2017.

Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. Cider: Exploiting hyperspherical embeddings for out-of-distribution detection. arXiv preprint arXiv:2203.04450 , 2022.

Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. In International Conference on Learning Representations , 2020.

Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. Advances in neural information processing systems , 33:11839-11852, 2020.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations , 2020.

Yao Zhu, YueFeng Chen, Chuanlong Xie, Xiaodan Li, Rong Zhang, Hui Xue, Xiang Tian, Yaowu Chen, et al. Boosting out-of-distribution detection with typical features. Advances in Neural Information Processing Systems , 35:20758-20769, 2022.

Yue Song, Nicu Sebe, and Wei Wang. Rankfeat: Rank-1 feature removal for out-of-distribution detection. Advances in Neural Information Processing Systems , 35:17885-17898, 2022.

A Contrastive Learning Trained Backbones

Many post-hoc methods are conducted on classification-based backbones [8, 27]. In this section, we further perform experiments on backbones trained on contrastive learning. We use the pre-trained model from CIDER[46] and apply VRA to the normalized features, followed by KNN[24] for OOD detection. In Table 9, we observe that for the contrastive-learning-based backbone, modifying the feature values and suppressing larger and smaller activation values are also beneficial to OOD detection.

B Compatibility with VIT[49]

Previous works [8, 10, 27] usually only consider the condition where the activation values are nonnegative. To further illustrate the potential of VRA, we conduct experiments on VIT [49] with a large number of negative activation values.

For positive values, ReAct tries to increase E in [ g ( z )] -E out [ g ( z )] . It uses an operation to make OOD data suppress more than ID data. Therefore, for negative values, we should also make OOD data suppress more than ID data. This process results in an increase of E in [ -g ( z )] -E out [ -g ( z )] . To unify the positive and negative cases, we should maximize sgn ( z )( E in [ g ( z )] -E out [ g ( z )]) , where sgn ( · ) is the sign function. Similar to Eq. 3 ∼ 13, we can get the optimal activation:

0.8

pin

0.7

pout

0.6

品

P

0.5

Empirical

0.4

0.3

0.2

0.1

0.0

2.0

1.5

1.0

0.5

0.0

0.5

1.0

1.5

2.0

Z

(a)

2.0

g*(-)

1.5

w/otruncation

1.0

0.5

lue

va

0.0

0.5

M

1.0

1.5

-2.0

2.0

1.5

1.0

0.5

0.0

0.5

1.0

1.5

2.0

Z

empirical PDF on ImageNet (VIT)

(b)

activation functions on ImageNet (VIT)

We visualize the optimal function g ∗ ( · ) on different ID and OOD data in Figure 3. We observe a different g ∗ ( · ) in VIT compared to ReLU-based backbones. Specifically, we should amplify activations with low absolute features and suppress activations with high absolute features. To mimic this operation, we design a new piecewise function called VRA-VIT:

where α > 0 controls the threshold for determining low and high activations, and β > 0 controls the gradient. Results in Table 10 show the effectiveness of VRA, where we set α = 1 and β = 1 . 5 .

C More variance of VRA

The theoretical derivation of VRA and analysis of ID and OOD activations allow us to design other variants of VRA. In this section, we denote these new variants as VRA-B ( binary ) and VRA-G (change the gradient of the medium):

where α and β are thresholds and k controls the scaling factor. For VRA-G, we treat the η α -quantile (or η β -quantile) of activations estimated on ID data as α (or β ), in line with VRA. In Table 11, we investigate the performance of different VRA-based variants. For a fair comparison, we use the same ID data, OOD data, and backbone. Experimental results demonstrate that VRA++ outperforms other variants in OOD detection.

D Discussion with BATS[50] and RankFeat[51]

BATS[50] is an OOD detection method that relies on BatchNorm. The main difference between BATS and our VRA lies in the following aspects. (1) BATS exploits the phenomenon that the features of the

training data more frequently fall in the interval [ µ -λσ, µ + λσ ] . Differently, VRA does not depend on BatchNorm. It tries to find the theoretically optimal operation to maximize the gap between ID and OOD. (2) BATS relies on BatchNorm and uses the mean and standard deviation in BatchNorm to determine thresholds for low and high activations. Differently, VRA does not rely on BatchNorm and determines thresholds for low and high activations using quantiles η α and η β . Experimental results in Table 6 show that VRA can achieve good performance no matter with or without BatchNorm (see VGG-16 and VGG-16-BN). Therefore, our VRA has better compatibility with different backbones compared with BATS. (3) BATS only suppresses high and low activations, but VRA+ and VRA++ further amplify intermediate activations. According to Table 12, this amplification process further improves the OOD detection performance.

RankFeat [51] finds that the feature maps of OOD samples often have large singular values, and removing these values are beneficial to OOD detection. We compare VRA with RankFeat, and the experimental results are shown in Table 13. We observe that our method has a significant improvement compared to RankFeat, especially on the OOD datasets iNaturalist and Texture.

E Upper Bound Analysis

Similar to RankFeat, we provide theoretical analysis from the perspective of boundary analysis. Consider output logits f ( z ) = Wz + b , where z is the feature vector of the penultimate layer. We denote the i th element in f ( z ) as f i , and c is the number of categories. We compute the energy score of the output logits f ( z ) as the OOD score, consistent with RankFeat:

For any norm ∥·∥ p ( p > 0) , there exist k 1 > 0 and k 2 > 0 satisfying:

According to the triangle inequality ∥ Wz + b ∥ p ≤ ∥ Wz ∥ p + ∥ b ∥ p and consistence of matrix norms ∥ Wz ∥ p ≤ ∥ W ∥ p ∥ z ∥ p , we can get:

Then, we get:

According to the above inequality, maximizing E in [ z ] -E out [ z ] is equivalent to maximizing the upper bound gap between ID and OOD. Therefore, the basic idea of VRA is similar to RankFeat. Specifically, RankFeat removes the rank-1 matrix from the high-level feature and increases the upper bound gap between ID and OOD; VRA maximizes E in [ z ] -E out [ z ] to maximize the upper bound gap between ID and OOD. Therefore, we can prove VRA from the similar perspective of RankFeat.

F Visualization on CIFAR

Similar to Figure 1, we plot the activation distribution of ID and OOD data for the DenseNet-101 trained on CIFAR. As shown in Figure 4, we observe a similar distribution pattern to the ResNet-50 trained on ImageNet. Our designed modification function also exhibits the property of suppressing both ends and amplifying in the middle.

(a) empirical PDF on CIFAR-10

(b) empirical PDF on CIFAR-100

(c) activation functions on CIFAR-10

(d) activation functions on CIFAR-100

8

pin

16

Pin

pout

pout

14

Empirical PDF

Empirical PDF

12

5

10

4

3

6

2

4

1

2

0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.1

0.2

0.3

0.4

0.5

Z

Z

0.8

0.8

g*(-)

0.7

0.7

w/otruncation

0.6

0.6

0.5

0.5

value

value

0.4

0.4

0.3

0.3

0.2

0.2

g*(-)

0.1

0.1

w/otruncation

0.0

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.1

0.2

0.3

0.4

0.5

Z

Z

G Distribution of Energy Score

We plot the distribution of energy scores before and after VRA modification in Figure 5. After using VRA modification, the overlap between the energy scores of ID and OOD data becomes less. This phenomenon indicates that VRA makes it easier to distinguish ID and OOD data.

(a) before rectification (overlap: 20.25%)

(b) after rectification (overlap: 12.52%)

0.25

ID

ID

0.6

OOD

OOD

0.20

0.5

PDF

PDF

Empirical

0.15

Empirical

0.4

0.3

0.10

0.2

0.05

0.1

0.00

0.0

5

10

15

20

25

OE

35

8

10

12

14

16

18

Scores

Scores

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper conducts a fine-grained analysis of ReAct, a simple but effective OOD method by rectifying high activation. The authors perform a variational method to analyze the optimal activation function by clipping and amplifying features. Strong empirical results are presented to support the effectiveness of the proposed methods.\n\nSTRENGTHS:\n1. The proposed method is well-motivated both intuitively and theoretically. ReAct presented a promising solution to distinguish OOD samples by clipping activation. So it is natural to perform a fine-grained analysis of how to better clip activations. Actually, ASH [1] has a similar idea but this paper takes a step further to find the optimal solution of clipping from a theoretical point of view. The variational method seems valid and the assumption of Hilbert space is mostly valid for activations of deep neural networks. The theoretical analysis well motivates the methodology and shaping.\n\n2. The authors propose two different variants of the method: one by simply clipping as React, and the other with middle activation amplification. This allows more possibilities to perform OOD detection.\n\n3. The empirical results are very strong. In the ImageNet benchmark, it even outperforms MOS which is a training-needed approach.\n\n\n>[1] Extremely Simple Activation Shaping for Out-of-Distribution Detection. ICLR 23.\n\nWEAKNESSES:\n1. My main concern is that the methodology seems to need to calculate $\\rho_{out}$ in advance. However, the statistics of OOD data are usually unknown to the model. So having access to the density might reveal some information about OOD data, which might be unfair to the baselines. This might limit the real-world usage of the method.\n\n2. There are some very relevant OOD papers missing in the reference [1,2,3,4]. As stated before, ASH[1] actually has done the similar fine-grained analysis of ReAct. Furthermore, the concept of shaping in ASH covers more operations such as pruning, binary, and scale. RankFeat [2] is also motivated by ReAct and removes the dominant single value of the last feature map. Moreover, it analyzes the lower bound of their method and ReAct. The bound analysis seems to apply to the method of this paper. The comparison and discussion with [1,2] are thus needed in the paper.\n\n3. Some more operations such as binary and scaling can be explored. Currently, only amplification and pruning are supported. \n\n>[1] Extremely Simple Activation Shaping for Out-of-Distribution Detection. ICLR 23. \n>\n>[2] RankFeat: Rank-1 Feature Removal for Out-of-distribution Detection\n\nQUESTIONS:\nPlease see weakness and limitations.\n\nLIMITATIONS:\nMy primary concern is the availability of OOD statistics required by this method. I suggest the authors at least explicitly mention it in the limitation section.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-17"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a technique called \"Variational Rectified Activation (VRA)\", which simulates these suppression and amplification operations using piecewise functions. Theoretical analysis is provided to illustrated VRA. Extensive experiments demonstrate the effectiveness and generalization for the proposed method.\n\nSTRENGTHS:\n1. It is technically sound to use variational methods to find the optimal function that maximizes the gap between ID and OOD.\n2. The whole method is simple and effective, and performs well in different datasets and models. The proposal is also compatible with different scoring functions.\n3. The paper is well written, well-structured and easy to understand.\n\nWEAKNESSES:\n1. The proposed method of simultaneously truncating high and low activations is very similar to the existing method in [1], which also corrects features by suppressing high and low activations, thus limiting the novelty of this proposal.\n2. The formula in Eq.3 confuses me a bit. Why maximizing Ein(z) - Eout(z) maximizes the gap between ID and OOD. Why not maximize the squared difference? What happens if you maximize Eout(z) - Ein(z)?\n3. The VRA piecewise function is designed based on the feature histograms in one model and one ID dataset, which may not hold for other datasets and model architectures. For example，for a Transformer-based model, the features in the penultimate layer contains many negative values，how the piecewise function should be in Transformer-based function. \n\n&nbsp;\n\n[1] Boosting Out-of-distribution Detection with Typical Features. NeurIPS 2022.\n\nQUESTIONS:\n1. Please compare the VRA framework with [1] and discuss the similarities and differences between the two.\n2. In Fig.1, I'm curious about how the optimal function is look like if you use ViT as the classification model, and CIFAR as ID dataset. Could you provide more visualizations in the appendix.\n\n&nbsp;\n\n[1] Boosting Out-of-distribution Detection with Typical Features. NeurIPS 2022.\n\nLIMITATIONS:\nPlease see the comments above.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

comments: SUMMARY:
This work leverages the variational method to find optimal operation and proposes a new technique variational rectified activation (VRA) for out-of-distribution (OOD) detection. This paper finds the best operation for OOD detection and verifies the necessity of suppressing abnormally low and high activations and amplifying intermediate activations. The proposed VRA method is compatible with different network architectures and scoring functions. Extensive experiments on a number of benchmark datasets show the effectiveness of the proposed method.

STRENGTHS:
1. This work tackles out-of-distribution (OOD) detection tasks, which is important for building reliable machine learning models in the real world.
2. The key idea of variational rectified activation that mimics suppression and amplification operations using piecewise functions is simple and flexible to compatible with different scoring functions and network architectures. This work also provides a theoretical understanding of the VRA method for OOD detection from the perspective of the variational method.
3. This paper conducts extensive experiments on several benchmark datasets to validate the effectiveness of the proposed VRA method.

WEAKNESSES:
1. Can the authors report the mean and std for the main results in the experiment section?
2. It would be interesting if the authors can compare the visualization of the distribution of ID and OOD uncertainty scores before and after variational rectification.

QUESTIONS:
Refer to the detailed comments on weaknesses.

LIMITATIONS:
This work does not present any potential negative societal impact.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06

comments: SUMMARY:
In this paper, the authors explore the out-of-distribution detection ability. They propose Variational Rectified Activation based on ReAct. Specifically, they suppress both the high and low values of the penultimate layer rather than only focusing on high values. Their performance on several benchmark dataset surpasses existing post-hoc strategies.

STRENGTHS:
1. They give a theoretical analysis to the proposed method.
2. They compare VRA-based methods with competitive post-hoc strategies, and performs the best.

WEAKNESSES:
1. The theory part should be more clear about the relationship between the objective you minimize and the final score.
2. Please add more baselines to demonstrate the effectiveness of VRA, comparing your method with contrastive learning trained backbones (SSD+[1], CSI[2], CIDER[3]), and other state-of-the-art post-hoc methods (maxlogit[4] and HEAT[5]). 



[1] https://openreview.net/forum?id=v5gjXpmR8J

[2] https://openreview.net/forum?id=o5RKoLQlK4olF

[3] https://openreview.net/forum?id=aEFaE0W5pAd

[4] https://arxiv.org/abs/1911.11132

[5] https://openreview.net/forum?id=tpCynHFviX

QUESTIONS:
1. In equation 3, why it is needed to maximally preserve the input? And with this term, why the optimal operation maximize the gap between ID and OOD?

2. In figure 1, your optimal g function does not seem to agree with VRA function. Have you ever try to adjust the gradient when z is between alpha and beta?

LIMITATIONS:
It seems that the paper did not include a limitation section or paragraph explicitly.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-10