Title: The Best of Both Worlds: On the Dilemma of Out-of-distribution Detection
Venue: NeurIPS 2024
Accepted: yes
Keywords: Out-of-Distribution Detection; Uncertainty estimation;
Abstract: Out-of-distribution (OOD) detection is essential for model trustworthiness which aims to sensitively identity semantic OOD samples and robustly generalize for covariate-shifted OOD samples. However, we discover that the superior OOD detection performance of state-of-the-art methods is achieved by secretly sacrificing the OOD generalization ability. The classification accuracy frequently collapses catastrophically when even slight noise is encountered. Such a phenomenon violates the motivation of trustworthiness and significantly limits the model's deployment in the real world. What is the hidden reason behind such a limitation? In this work, we theoretically demystify the "\textit{sensitive-robust}" dilemma that lies in previous OOD detection methods. Consequently, a theory-inspired algorithm is induced to overcome such a dilemma. By decoupling the uncertainty learning objective from a Bayesian perspective, the conflict between OOD detection and OOD generalization is naturally harmonized and a dual-optimized performance could be expected. Empirical studies show that our method achieves superior performance on commonly used benchmarks. To our best knowledge, this work is the first principled OOD detection method that achieves state-of-the-art OOD detection performance without sacrificing OOD generalization ability. Our code is available at https://github.com/QingyangZhang/DUL.

The Best of Both Worlds: On the Dilemma of Out-of-distribution Detection

Abstract

Out-of-distribution (OOD) detection is essential for model trustworthiness which aims to sensitively identify semantic OOD samples and robustly generalize for covariate-shifted OOD samples. However, we discover that the superior OOD detection performance of state-of-the-art methods is achieved by secretly sacrificing the OOD generalization ability. Specifically, the classification accuracy of these models could deteriorate dramatically when they encounter even minor noise. This phenomenon contradicts the goal of model trustworthiness and severely restricts their applicability in real-world scenarios. What is the hidden reason behind such a limitation? In this work, we theoretically demystify the ' sensitive-robust ' dilemma that lies in many existing OOD detection methods. Consequently, a theory-inspired algorithm is induced to overcome such a dilemma. By decoupling the uncertainty learning objective from a Bayesian perspective, the conflict between OODdetection and OOD generalization is naturally harmonized and a dual-optimal performance could be expected. Empirical studies show that our method achieves superior performance on standard benchmarks. To our best knowledge, this work is the first principled OOD detection method that achieves state-of-the-art OOD detection performance without compromising OOD generalization ability. Our code is available at https://github.com/QingyangZhang/DUL.

1 Introduction

Endowing machine learning models with out-of-distribution (OOD) detection and OOD generalization ability are both essential for their deployment in the open world [1, 2, 3]. We borrow an example of autonomous driving from [4] to demonstrate the motivation of these two tasks. Given a machine learning model trained on in-distribution (ID) data (top image in Fig. 1 (a)), OOD detection aims to sensitively perceive uncertainty arising upon outliers that do not belong to any known classes of training data [5] (bottom right image in Fig. 1 (a)). While OOD generalization expects machine learning models to be robust in the presence of unexpected noise or corruption, e.g., rainy or snowy weather (bottom left image in Fig. 1 (a)). In this paper, we reveal that many previous methods pursue OODdetection performance at a secret cost of sacrificing OOD generalization ability. To make things worse, we observe that some SOTA OOD detection methods may result in a catastrophic collapse in classification performance ( ∼ 15% accuracy degradation) when encountering even slight noise. One pioneering work [4] makes a trade-off between OOD detection and OOD generalization, but the relationship between these two tasks is still largely unexplored. The learning objectives of these two tasks are seemingly conflicting at first glance. OOD detection encourages sensitive uncertainty awareness (highly uncertain prediction) on unseen data, while generalization expects the prediction to be confident and robust under unforeseeable distributional shifts. Previous work in OOD detection

56

(Error)

54

Entropy

52

Bayesian

generalization

50

EBM

Trade-off Area

ID

48

XPOEM

OSCONE

46

△WOODS

44

MSP

42

40

20

30

40

50

60

70

80

Covariate-shiftedOOD

Semantic OOD

OOD detection(FPR95)

(OODgeneralization)

(OODdetection)

(a）Three types of data arise in the open world

(b）Dilemma of current SOTA methods

research area [4] characterizes the relationship between OOD detection and OOD generalization as a trade-off and thus striking for a balanced performance. However, this trade-off significantly limits the employment of current state-of-the-art OOD detection methods. Naturally, one might require the model to be aware of the OOD input for ensuring safety, but certainly does not expect to sacrifice the generalization ability, not to mention that the catastrophically collapsed classification performance under noise or corruption.

In this work, we first uncover the potential reason behind this limitation by characterizing the generalization error lower bound of previous OOD detection methods, which is referred to sensitiverobust dilemma . To overcome the dilemma, we devise a novel Decoupled Uncertainty Learning (DUL) framework for dual-optimal performance. The decoupled uncertainties are separately responsible for characterizing semantic OOD (detection) and covariate-shifted OOD (generalization). Thanks to the decoupled uncertainty learning objective, dual-optimal OOD detection and OOD generalization performance could be expected. Our emphasis lies on a particular category of OOD detection methods in the classification task, including max softmax probability (MSP) based model [6], energy-based model (EBM) [8] and Bayesian methods [9]. This selection offers two-fold advantages. First, MSP, EBM and Bayesian detectors encompass major OOD detection advances in classification task [5]. Second, numerous OOD detection works in diverse learning tasks (classification, object detection [12], time-series prediction and image segmentation) are all roughly related to classification [13]. The contributions of this paper are summarized as follows:

This paper reveals that existing SOTA OOD detection methods may suffer from catastrophic degradation in terms of OOD generalization. That is, their superior OOD detection ability is achieved by (secretly) sacrificing OOD generalization ability. We theoretically demystify the sensitive-robust dilemma in learning objectives as the main reason behind such a limitation.

In contrast to previous works that characterize OOD detection and generalization as conflictive learning tasks and thus implying an inevitable trade-off, we propose a novel learning framework termed Decoupled Uncertainty Learning (DUL) to successfully break through the limitation beyond a simple trade-off. Our DUL substantially harmonizes the conflict between OOD detection and OOD generalization, which achieves the best OOD detection performance without sacrificing the OOD generalization ability.

We conduct extensive experiments on standard benchmarks to validate our findings. Our DUL achieves dual-optimal OOD detection and OOD generalization performance. To our best knowledge, DUL is the first method that gains state-of-the-art OOD detection performance without sacrificing OOD generalization ability.

2 Related works

OODdetection aims to indicate whether the input arises from unknown classes that are not present in training data, which is essential for model trustworthiness. In the classification task, the majority of advanced OOD detection methods include MSP detectors which characterize samples with lower max softmax probability as OOD [6, 14, 15, 7, 16]. EBM detectors identify high energy samples as OODand frequently establish better performance than MSP detectors [8, 11, 17, 4], and various other types OOD detection methods such as distance-based detectors [18], non-parametric KNN-based detectors [19] which also show promises. According to the training paradigm, OOD detection methods can be split into auxiliary OOD-free and auxiliary OOD-required methods. Auxiliary OOD-free methods directly use the model pre-trained on ID data only for OOD detection. Another line of methods assumes that some OOD data is accessible during training and incorporates auxiliary outlier datasets (collected from websites or other datasets) for further enhancing OOD detection performance. By exposing the model to some semantic OOD during training, auxiliary OOD-required methods frequently outperform auxiliary OOD-free methods on commonly-used benchmarks [20, 5].

OOD generalization expects the model to be robust under unforeseeable noise or corruption [21, 22, 23, 24, 25]. Basically, OOD generalization expects invariant and confident prediction on OOD data. Examples include classic domain adaption (DA) methods which encourage the model's behavior to be invariant across different distributions [21, 26, 27]. Besides, test-time adaption (TTA) directly encourages confident predictions on OOD data by minimizing predictive entropy [28, 29, 30]. However, as we will show later, confident prediction and invariance are seemingly conflictive to OOD detection purpose and further imply an unavoidable trade-off. The most related work to our paper is SCONE [4], which strikes to keep a balance between OOD detection and generalization performance. We argue that such a trade-off is not necessary and the conflict can be elegantly eliminated.

Uncertainty estimation in Bayesian framework. In the Bayesian framework, predictive uncertainty can be regarded as an indicator of whether the input sample is prone to be OOD. Since OOD samples are unseen during training and thus should be of higher uncertainty than ID. The overall predictive uncertainty of a classification model can be decomposed into three factors according to their source, including data (aleatoric) uncertainty (AU), distributional uncertainty (DU), and model (epistemic) uncertainty (EU) [31, 9]. AU measures the natural complexity of the data (e.g., class overlap, label noise) and EU results from the difficulty of estimating the model parameters with finite training data. DU arises due to the mismatch between the distributions of test and training data. A line of classic measurement can be used to capture various types of uncertainty including entropy, mutual information, and differential entropy [9].

3 Preliminaries

We consider K -class classification task with classifier f : X → R K parameterized by θ , where X is the input space and Y = { 1 , 2 , ..., K } denotes the target space. The model output f θ ( x ) is considered as logits. The k -th element in logits is denoted as f k ( x ) indicates the confidence of predicting x to class k . The predicted distribution F ( x ) is obtained by normalizing f ( x ) with the softmax function. We first formalize all possible distributions that the model might encounter.

In-distribution P ID XY which denotes the distribution of labeled training data.

Covariate-shifted OOD P COV XY which is relevant to OOD generalization. P COV XY is of the same label space with ID. However, its marginal distribution P COV X encounters shifts due to unexpected noise or corruption.

Semantic OOD P SEM XY ′ is the distribution of data that do not belong to any known class. Its label space has no overlap with the known ID label space, i.e., Y ′ ∩ Y = ∅ .

In the following paper, we omit the subscript for simplicity. The goal of OOD detection is to build a detector G : X → [IN , OUT] to decide whether an input x is semantic OOD data or not through a thresholding function G deduced from classifier f

where γ is the threshold. g f is an OOD scoring function deduced from f , which is expected to assign a higher value to OOD than ID. For example, in MSP detectors, g f ( x ) = -max k F ( x ) where F ( x ) is the predicted softmax probability (negative max softmax probability). In EBM detectors, g f is realized by the energy function E ( x ; f ) := -log ∑ K i =1 e f k ( x ) and the semantic input of OOD should be of high energy [8]. Since it is difficult to foresee P SEM one will encounter, a board line of OOD detection works [7, 8, 9, 11, 17, 12, 32, 33] regularize the model on some auxiliary OOD data P SEM train during training (e.g., data from the web or other datasets), and expect the model can learn useful heuristic to handle unknown test-time OOD P SEM test . The learning objective is shown as follows

where L CE is the standard cross entropy loss for the original classification task. L reg is the OOD detection regularization term depending on the detector used, which generally encourages a high uncertainty on P SEM train . For example, L reg is set to cross entropy between F ( x ) and the uniform distribution for MSP detector [7]. In EBM detectors [8], L reg is realized as a margin ranking loss to explicitly encourage a large energy gap between ID and semantic OOD. In this paper, we are interested in this setting for the following reasons:

In contrast to labeled data in supervised learning literature, auxiliary OOD data can be unlabeled and easy-to-collected in practice [11].

Most SOTA methods involve auxiliary outliers [5, 20] for superior performance.

Even under some strict assumptions that P SEM train is unavailable, recent works utilize GAN [15], diffusion model [34] or sampling strategy [12] to generate 'virtual" outliers for training.

Thus we believe this setting is promising and the cost of auxiliary outliers is minor given the importance of ensuring model trustworthiness. At test-time, the model is evaluated in terms of

ID accuracy (ID-Acc ↑ ) which measures the model's performance on P ID ,

OOD accuracy (OOD-Acc ↑ ) measures the OOD generalization ability on P COV ,

False positive rate at 95% true positive rate (FPR95 ↓ ) := E x ∼ P SEM test ( I ( G γ ( x ) = IN)) measures the OOD detection ability, where γ is chosen when true positive rate (TPR) is 95% . I is the indicator function. In OOD detection, ID samples are considered as negative.

It is worth noting that in the standard OOD detection setting [11, 4], the test OOD data should not have any overlapped classes or samples with training-time auxiliary OOD data P SEM train . Let Y SEM test and Y SEM train be the label space of P SEM test and P SEM train respectively, we have Y SEM test ∩ Y SEM train = ∅ . Otherwise, OOD detection would be a trivial problem.

4 Sensitive-robust Dilemma of Out-of-distribution Detection

In this section, we detail the limitation of current OOD detection methods: their OOD detection performance is achieved at the cost of generalization ability. This limitation implies the potential risk of SOTA OOD detection methods and underscores the urgent need for a better solution. Firstly, we re-examine representative OOD detection methods of six different types, including 1) baseline model MSP that is trained without any OOD detection regularization [6], 2) entropy-regularization (Entropy) that encourages high predictive entropy on OOD [7], which is devised for MSP detectors, 3) energy-regularization for EBM detectors that enforces the output with high energy score for OOD input [8], 4) Bayesian uncertainty learning that encourages high overall uncertainty on OOD [9], 5) state-of-the-art OOD detection methods WOODS [10] and POEM [11] 6) the most related SCONE [4] that seeks for a trade-off between OOD detection and generalization performance.

Limitation of current OOD detection methods. In Fig. 1 (b), we investigate current OOD detection methods in terms of OOD classification error and FPR95. The expected classifier should yield both low OOD classification error and FPR95. As it is observed, despite the superior OOD detection performance, all above methods significantly underperform the baseline MSP in terms of OOD generalization. By contrast, our method (DUL) successfully overcomes the limitation.

Theoretical justification. Toward understanding the limitation, we provide theoretical analysis for two types of most popular OOD detection methods, i.e., MSP and EBM detectors. Our analysis

identifies the ' sensitive-robust ' dilemma as the main reason behind such a limitation. The roadmap of our analysis is: (1) inspired by transfer learning theory, we first reveal that OOD detection regularization applied on semantic OOD may also affect the behavior of model on covariate-shifted OOD; (2) then we demonstrate why MSP detectors suffer from poor generalization by characterizing its generalization error bound; (3) we further identify that EBM methods [8] suffer from a similar drawback when incorporating with gradient-based optimization. First of all, we recap the definition of disparity discrepancy in transfer learning theory [35, 27].

Definition 1 (Disparity with Total Variation Distance) . Given two hypotheses f ′ , f ∈ F and distribution P , we define the Disparity with Total Variation Distance between them as

where F f ′ , F f are the class distributions predicted by f ′ , f respectively. TV ( ·||· ) is the total variation distance, i.e., TV ( F f || F f ′ ) = 1 2 ∑ K k =1 || F f,k -F f ′ ,k || .

Definition 2 (Disparity Discrepancy with Total Variation Distance, DD with TVD) . Given a hypothesis space F and two distributions P, Q , the Disparity Discrepancy with Total Variation Distance (DD with TVD) is defined as

Disparity discrepancy (DD) measures the "distance" between two distributions P, Q which considers the hypothesis space. DD is one of the most fundamental conceptions in transfer learning theory which constrains the behavior of hypothesis in F should not be dissimilar substantially on different distributions P and Q . 3 If the DD between semantic OOD and covariate-shifted OOD is limited, one can suppose that OOD detection regularization applied to semantic OOD samples will also influence the model's behavior on covariate-shifted OOD. Thus encouraging high uncertainty on semantic OOD may also result in highly uncertain prediction on covariate-shifted OOD, which is potentially harmful to generalization ability. We first formalize this intuition for MSP detectors.

Theorem 1 (Sensitive-robust dilemma) . Let P COV , P SEM test be the covariate-shifted OOD and semantic OOD distribution. GError P COV ( f ) denotes standard cross entropy loss taking expectation on P COV , i.e., generalization error. Then we have

(5)

where L reg is the OOD detection loss devised for MSP detectors defined in [7], i.e., cross-entropy between predicted distribution F ( x ) and uniform distribution. d F ( P COV , P SEM test ) is DD with TVD that measures the dissimilarity of covariate-shifted OOD and semantic OOD. C and κ are both some constants depending on hypothesis space F , P COV and P SEM test .

The proof is deferred in Appendix A. Theorem 1 demonstrates that for MSP detectors, the OOD detection objective conflicts with OOD generalization. The model's generalization error lower bound is negatively correlated with OOD detection loss that the model tries to minimize. Thus given a limited d F , pursuing low OOD detection loss on P SEM test will also inevitably result in highly uncertain prediction on P COV . It is worth noting that such an interpretative theorem is applicable for all MSP-based OOD detectors no matter whether the model involves P SEM train during training or not. Since the inherent motivation of OOD detection methods lies in minimizing the OOD detection loss in P SEM test , regardless of the training strategies used.

Why a limited d F ( P COV , P SEM test ) is practical? In Theorem 1, d F ( P COV , P SEM test ) measures the dissimilarity between P COV and P SEM test . It seems that this lower bound will be very small and trivial when d F ( P COV , P SEM test ) is large enough. However, since the semantic OOD samples can be any samples that do not belong to ID classes, one can suppose that semantic OOD samples are extremely diverse and some are of high similarity with ID and covariate-shifted OOD [37]. Detecting these 'ID-like' OOD samples is inherently the core challenge of OOD detection [11, 17, 38]. Thus, it is reasonable to assume a limited d F ( P COV , P SEM test ) . Weprovide more discussions in the Appendix D.2.

As presented before, the key limitation of MSP detectors is that they enforce high-entropy prediction on semantic OOD. We proceed to reveal that EBM detectors suffer from similar issues due to the natural property of gradient-based optimization. For EBM detectors, L reg is defined by [8] is

which constrains the energy score E ( x ; f ) := -log ∑ K k =1 e f k ( x ) of ID sample x to be lower than that of OOD sample ˜ x . m IN , m OUT are manually selected margins. Although such regularization does not indicate high entropy prediction at first glance, unfortunately, we demonstrate that EBM detectors also tend to uncertain prediction when equipped with gradient-based optimization. Here we focus on Gradient Descent (GD) as a showcase. In each training epoch t , model f θ is updated with GD as θ t +1 = θ t -η ∇ θ L reg , where η is the learning rate. For any sample ˜ x drawn from P SEM , the gradient ∇ θ L reg can be written as

where m OUT -E (˜ x ) > 0 (otherwise the gradient is zero) and f k (˜ x ) is the predicted logits on the k -th class. For sample ˜ x , when class k has larger predicted logit, it contributes more to the overall gradient ∇ θ L reg and thus could obtain more optimization efforts during backpropagation. Eventually, one can infer that when an EBM detector is about to converge, it tends to high-entropy prediction on P SEM train accordingly. Incorporating this into the established Theorem 1, this is likely to harm the generalization ability of P COV . Empirical evidence can support this supposition (see Table 14 in Appendix C). Therefore both MSP and EBM detectors face the ' sensitive-robust ' dilemma.

5 Decoupled Uncertainty Learning

We demonstrate how to handle the dilemma between OOD detection and generalization by decoupled uncertainty learning in the Bayesian framework. Unlike the most related work [4] which aims to seek a good trade-off, our method successfully gets out of the aforementioned sensitive-robust dilemma.

Uncertainty Estimation in Bayesian Framework. We first revisit the theoretical properties of different types of uncertainty in a Bayesian framework. Non-Bayesian classifiers consider the model's output f ( x ) as logits, which is then normalized with softmax to directly model predictive categoricals p (ˆ y | x ) . While in Bayesian framework [9], f ( x ) is considered as parameters of a Dirichlet distribution p ( µ | x ) firstly, which is used to model the prior of predictive categoricals p (ˆ y | x ) by

where Dir( µ | α ) is Dirichlet distribution and α is the concentration parameters of Dirichlet. The sum of all α k ∈ α (noted as α 0 ) is so called the strength of the Dirichlet distribution, i.e., α k > 0 , α 0 = ∑ k α k . After obtaining prior p ( µ | x, θ ) , the final predicted posterior p (ˆ y | x ) over class labels is given by calculating the mean of the Dirichlet prior

From a Bayesian perspective, given deterministic parameters θ , the overall uncertainty of final prediction p (ˆ y | x ) can be decomposed into two factors, including data (aleatoric) uncertainty (AU) and distributional uncertainty (DU). DU lies in p ( µ | x, θ ) which is defined as uncertainty due to the mismatch between the distributions of test and train data. AU is described by p (ˆ y | µ ) which captures the natural complexity of the data (e.g., class-overlap) [9]. By definition, OOD detection is primarily associated with DU which is only a part of the overall uncertainty. While generalization is related to the overall uncertainty of p (ˆ y | x ) as we mentioned in related works (both AU and DU). One essential property of DU is that it can be high even if the expected categorical p (ˆ y | x, θ ) expresses low overall

uncertainty. Such a property is well suited to achieve OOD detection and generalization jointly since high DU no longer necessarily indicates high overall uncertainty.

Decoupled Uncertainty Learning. While the aforementioned Bayesian framework enjoys theoretical potentiality, its learning object [9] lacks consideration of OOD generalization. Similar to other OOD detection methods, it also directly enforces high overall uncertainty on OOD

where p ( y | x ) , p (ˆ y | x ) are the ground-truth distribution and predicted distribution on ID. The model's prediction on OOD is enforced to be close to a rather flat Dirichlet distribution. It is worth noting that Dir( µ | α = 1 ) means all classes are equiprobable, and the entropy of the final prediction is maximized. As shown in Fig. 1 (b), the vanilla Bayesian method [9] also suffers from degraded OOD generalization performance. To this end, we propose D ecoupled U ncertainty L earning (DUL), a novel OOD detection regularization method that explicitly encourages high DU on OOD samples without affecting the overall uncertainty. Similarly to previous OOD detection methods [8], our DUL is also devised in a finetune manner for effectiveness. Given a classifier f θ 0 well pre-trained on P ID , the goal of DUL lies in enhancing its OOD detection performance without sacrificing any generalization ability. Specifically, we finetune the model by encouraging higher DU but non-increased overall uncertainty on P SEM train . The learning objective of DUL is

where H ( · ) is the entropy. p (ˆ y | ˜ x ) and p 0 (ˆ y | ˜ x ) are the predicted distribution on semantic OOD data ˜ x after and before finetuning. The first term is the original ID classification loss. The second term is OOD detection loss, which encourages high DU on outlier ˜ x . m OUT and τ > 0 are hyperparameters. h 0 , h are DU on ˜ x before and after finetuning. Here we measure DU with the differential entropy ( h [ p ( µ | ˜ x, θ )] = -∫ S K -1 p ( µ | ˜ x )ln( p ( µ | ˜ x )) dµ , S is a K -simplex). We refer interested readers to the Appendix D.1 for mathematical details. The third term constraining on H ( p (ˆ y | ˜ x )) avoids increment of overall uncertainty during finetuning and thus the generalization ability can be retained. Considering the difficulty of constrained optimization, we convert Eq. 11 into an unconstrained form and get our final minimizing objective

where γ is hyperparameter. In contrast to previous Bayesian method [9], DUL only encourages high DU rather than overall uncertainty on OOD and explicitly discourages high entropy in the final prediction. The implementation details are in Appendix D.1.

6 Experiment

We conduct experiments to validate our analysis and the superiority of DUL. The questions to be verified are Q1 Motivation. To what extent does OOD detection conflict with OOD generalization in previous methods? Q2 Effectiveness. Does DUL achieve better OOD detection and generalization performance compared to its counterparts? Q3 Interpretability. Does the proposed method well decouple uncertainty as expected?

6.1 Experimental Setup

Our settings follow the common practice [8, 11, 20, 5] in OOD detection. Here we present a brief description and more details about datasets, metrics, and implementation are in Appendix B.1 and B.2.

Datasets. ◦ ID datasets P ID . We train the model on different ID datasets including CIFAR-10, CIFAR-100 and ImageNet-200 (a subset of ImageNet-1K [39] with 200 classes). ◦ Auxiliary OOD datasets P SEM train . In CIFAR experiments, we use ImageNet-RC as P SEM train . ImageNet-RC is a downsampled variant of the original ImageNet-1K which is widely adopted in previous OOD detection

works [8, 11, 17]. We also conduct experiments on the recent TIN-597 [20] as an alternative. When ImageNet-200 is ID, the remaining 800 classes termed ImageNet-800 are considered as P SEM train . ◦ OOD detection test sets P SEM test are a suite of diverse datasets introduced by commonly used benchmark [5]. In CIFAR experiments, we use SVHN [40], Places365 [41], Textures [42], LSUN-R, LSUN-C [43] and iSUN [44] as P SEM test . When P ID is ImageNet-200, P SEM test consists of iNaturlist [45], Open-Image [46], NINCO [47] and SSB-Hard [48]. It is worth noting that in standard OOD detection settings, there should be no overlapped classes between P ID , P SEM train and P SEM test , otherwise OOD detection is a trivial problem. ◦ OOD generalization test sets P COV is the original ID test set corrupted with additive Gaussian noise of N (0 , 5) , following [4]. Besides, we also conduct experiments on CIFAR10-C, CIFAR100-C and ImageNet-C which involve 15 diverse types of different noise or corruption (e.g., snow, rain, frost, fog...) in Appendix C.

Metrics. For OOD detection performance evaluation, we report the average FPR95, AUROC and AUPR to be consistent with [11]. OOD generalization ability is compared in terms of classification accuracy (OOD-Acc). Besides, we also report classification accuracy on ID test sets (ID-Acc).

Compared methods. We compare DUL with a board line of OOD detection methods, including auxiliary OOD required and auxiliary OOD free methods. ◦ Auxiliary OOD-free methods do not require P SEM train during training, including MSP [6], Maxlogits [49], pretrained EBM [8] and Mahalaobis [18]. ◦ Auxiliary OOD-required methods explicitly regularize the model on P SEM train , including entropy-regularization (Entropy) [7], finetuned EBM [8], DPN of Bayesian framework [9], POEM [11] and WOODS [10]. We also compare our DUL to recent advanced SCONE [4] which aims to keep a balance between OOD detection and generalization.

6.2 Experimental Results

Dilemma between OOD detection and generalization (Q1). We validate the dilemma mentioned before in Fig. 1. As shown in Tab. 1, though many advanced methods establish superior OOD detection performance, their OOD generalization degrades a lot. For example, recent SOTA POEM achieves nearly perfect OOD detection performance on CIFAR10 when ImageNet-RC serves as P SEM train with 3 . 32% false positive error rate (FPR95). However, its OOD-Acc drops a lot (about 10% ) compared to baseline MSP. This phenomenon is also observed in other advanced methods. To further detail this phenomenon, we reduce the weight of OOD detection regularization terms in Entropy and finetuned EBM and show the performance on both OOD detection and generalization. As shown in Table 3, when the regularization strength increases, OOD detection performance improves (lower FPR.), while the OOD generalization performance degrades (higher error rate).

OODdetection and generalization ability (Q2). As shown in Tab. 1, DUL establishes strong overall performance in terms of both OOD detection and generalization. We highlight a few essential observations: 1) Compared to auxiliary OOD free methods , DUL establishes substantial improvement due to additional regularization on auxiliary outliers. 2) Compared to auxiliary OOD required methods , our method achieves superior OOD detection performance without sacrificing generalization ability. Meanwhile, previous OOD detection methods commonly exhibit severely degraded classification accuracy, with many cases increasing by more than 10% error rate. 3) Comparison to the most related work SCONE [4]. Despite recent advanced SCONE simultaneously considering both two targets, we observe that it can be hard to find a good trade-off. In contrast, dual-optimal OOD detection and generalization performance is achieved by our DUL. Noted that DUL is the only method that achieves state-of-the-art detection performance (mostly the best or second best) without degraded generalization ability (no red values in the entire row). The sensitive-robust dilemma is no longer observed in our method. These observations justify our expectation of DUL. 4) Combining with existing methods. Besides, to further demonstrate the effectiveness of the proposed DUL, we also add the unchanged overall uncertainty term in Eq.12 to the original Entropy and finetuned EBM. The results in Table 2 show that DUL regularization can also benefit EBM. However, combining Entropy with our regularization can not improve the accuracy substantially. This is not surprising, since the target of Entropy (high entropy prediction) and our DUL (non-increased entropy) directly conflict according to Theorem 1. 5) Comparison to methods with an extra OOD detect branch. Different from aforementioned methods, a line of recent OOD detectors [50, 51, 52, 17] employ extra output branches aside from the classification logits (with a shared backbone for feature extraction). For these OOD detectors, our theoretical analysis is not directly applicable and further analysis from a feature learning perspective may be needed in future work. However, the proposed DUL is devised in a finetune manner. Compared to OOD detectors with extra output branches that requires re-training the classifier from scratch, DUL can be applied to any pre-trained model (e.g., from torchvision, huggingface), with modest computation overhead.

Visualization of estimated uncertainty (Q3). To evaluate the uncertainty estimation, we visualize the distribution of ID (CIFAR-10) and OOD (SVHN) samples in terms of uncertainty. As we can see in Fig. 2 (b), our DUL establishes a distinguishable (distributional) uncertainty gap between test-time ID and OOD data, which indicates a good sensitiveness for OOD detection. By contrast, the baseline method MSP (Fig.2 (a)) can not effectively discriminate ID and OOD. Besides, we visualize the predictive entropy (overall uncertainty) on covariate-shifted OOD (CIFAR-10 with Gaussian noise) in Fig. 2 (c), our DUL yields much lower entropy compared to other methods. Besides, we visualize the data uncertainty on semantic OOD test data (Textures) when CIFAR-10 is ID in Fig. 6.2. The

investigated methods are 1) pretrained model training on ID dataset only, 2) finetuned model with OOD detection regularization (ablating the last term in Eq.12), and 3) finetuned model with the full DUL method described by Eq.12. As shown in Fig. 6.2, to keep the overall uncertainty and enlarge the distributional uncertainty (for OOD detection), the data uncertainty must be reduced. We use Eq.17 from [9] to calculate data uncertainty. The distributional uncertainty is shifted by subtracting that on ID dataset. These results meet our expectation.

SVHN (semantic OOD)

SVHN (semantic OOD)

Predictive Entropy

4.5

MSP

Entropy

EBM

DUL

Density

CIFAR10 (ID)

Density

CIFAR10 (ID)

0

1.2

1.0

Negative Softmax probability

0.80.6

0.4

0.2

0.0

400

Differential entropy

390

380

370

Noise severity

3

4

(a)MSP

(b）DUL

(c）Entropy on covariate-shifted OOD

Data uncertainty

Distributional uncertainty

Total Uncertainty

8

0.6

1.5

Density

Density

1.0-

21

0.2

0.5

0

0.0

0.0

1.2

1.4

1.6

1.8

2.0

2.2

-2

0

2

4

6

8

0

1

2

Pretrain

Finetunew/oDUL

Finetune w.DUL

7 Conclusion

This paper provides both theoretical and empirical analysis towards understanding the dilemma between OOD detection and generalization. We demonstrate that the superior OOD detection performance of current advances are achieved at the cost of generalization ability. The theory-inspired algorithm successfully removes the conflict between previous OOD detection and generalization methods. For SOTA OOD detection performance, our implementation assumes that auxiliary outliers are available during training. This limitation is noteworthy for our DUL as well as the most existing SOTA OOD detection methods. We argue that this added cost is minor and reasonable given the significance of ensuring model trustworthiness in open-environments. Reducing the dependency on auxiliary OOD data can be an interesting research direction for the future exploration.

References

Chunjong Park, Anas Awadalla, Tadayoshi Kohno, and Shwetak Patel. Reliable and trustworthy machine learning for health using dataset shift detection. Advances in Neural Information Processing Systems , 34:3043-3056, 2021.

Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Concrete problems in ai safety. arXiv preprint arXiv:1606.06565 , 2016.

Jiashuo Liu, Zheyan Shen, Yue He, Xingxuan Zhang, Renzhe Xu, Han Yu, and Peng Cui. Towards out-of-distribution generalization: A survey. arXiv preprint arXiv:2108.13624 , 2021.

Haoyue Bai, Gregory Canal, Xuefeng Du, Jeongyeol Kwon, Robert D Nowak, and Yixuan Li. Feed two birds with one scone: Exploiting wild data for both out-of-distribution generalization and detection. In International Conference on Machine Learning , 2023.

Jingyang Zhang, Jingkang Yang, Pengyun Wang, Haoqi Wang, Yueqian Lin, Haoran Zhang, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, Yixuan Li, Ziwei Liu, Yiran Chen, and Hai Li. Openood v1.5: Enhanced benchmark for out-of-distribution detection. arXiv preprint arXiv:2306.09301 , 2023.

Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. International Conference on Learning Representations , 2017.

Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. International Conference on Learning Representations , 2019.

Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. Advances in neural information processing systems , 2020.

Andrey Malinin and Mark Gales. Predictive uncertainty estimation via prior networks. Advances in neural information processing systems , 2018.

Julian Katz-Samuels, Julia B Nakhleh, Robert Nowak, and Yixuan Li. Training ood detectors in their natural habitats. In International Conference on Machine Learning , 2022.

Yifei Ming, Ying Fan, and Yixuan Li. Poem: Out-of-distribution detection with posterior sampling. In International Conference on Machine Learning , 2022.

Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. International Conference on Learning Representations , 2022.

Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110.11334 , 2021.

Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-ofdistribution image detection in neural networks. International Conference on Learning Representations , 2018.

Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting out-of-distribution samples. International Conference on Learning Representations , 2018.

Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances in neural information processing systems , 2019.

Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying out-ofdistribution detection using outlier mining. In Machine Learning and Knowledge Discovery in Databases , 2021.

Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems , 2018.

Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In International Conference on Machine Learning , pages 20827-20840. PMLR, 2022.

Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, Wenxuan Peng, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, et al. Openood: Benchmarking generalized out-ofdistribution detection. Advances in Neural Information Processing Systems , 35:32598-32611, 2022.

Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint arXiv:1907.02893 , 2019.

Zhaolin Hu and L Jeff Hong. Kullback-leibler divergence constrained distributionally robust optimization. Available at Optimization Online , 2013.

Paul Michel, Tatsunori Hashimoto, and Graham Neubig. Modeling the second player in distributionally robust optimization. International Conference on Learning Representations , 2021.

Aman Sinha, Hongseok Namkoong, Riccardo Volpi, and John Duchi. Certifying some distributional robustness with principled adversarial training. International Conference on Learning Representations , 2018.

Zongbo Han, Zhipeng Liang, Fan Yang, Liu Liu, Lanqing Li, Yatao Bian, Peilin Zhao, Bingzhe Wu, Changqing Zhang, and Jianhua Yao. Umix: Improving importance weighting for subpopulation shift via uncertainty-aware mixup. Advances in Neural Information Processing Systems , 2022.

Han Zhao, Remi Tachet Des Combes, Kun Zhang, and Geoffrey Gordon. On learning invariant representations for domain adaptation. In International conference on machine learning , pages 7523-7532. PMLR, 2019.

Yuchen Zhang, Tianle Liu, Mingsheng Long, and Michael Jordan. Bridging theory and algorithm for domain adaptation. In International Conference on Machine Learning , 2019.

Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. International Conference on Learning Representations , 2021.

Marvin Zhang, Sergey Levine, and Chelsea Finn. Memo: Test time robustness via adaptation and augmentation. Advances in neural information processing systems , 35:38629-38642, 2022.

Shuaicheng Niu, Jiaxiang Wu, Yifan Zhang, Zhiquan Wen, Yaofo Chen, Peilin Zhao, and Mingkui Tan. Towards stable test-time adaptation in dynamic wild world. arXiv preprint arXiv:2302.12400 , 2023.

Alex Kendall and Yarin Gal. What uncertainties do we need in bayesian deep learning for computer vision? Advances in neural information processing systems , 2017.

Qizhou Wang, Zhen Fang, Yonggang Zhang, Feng Liu, Yixuan Li, and Bo Han. Learning to augment distributions for out-of-distribution detection. Advances in Neural Information Processing Systems , 36, 2024.

Hyunjun Choi, Hawook Jeong, and Jin Young Choi. Balanced energy regularization loss for out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15691-15700, 2023.

Xuefeng Du, Yiyou Sun, Jerry Zhu, and Yixuan Li. Dream the impossible: Outlier imagination with diffusion models. Advances in Neural Information Processing Systems , 36, 2024.

Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International Conference on Machine Learning , 2015.

Yishay Mansour, Mehryar Mohri, and Afshin Rostamizadeh. Domain adaptation with multiple sources. Advances in neural information processing systems , 21, 2008.

William Yang, Byron Zhang, and Olga Russakovsky. Imagenet-ood: Deciphering modern out-of-distribution detection algorithms. International Conference on Learning Representations , 2024.

Yichen Bai, Zongbo Han, Changqing Zhang, Bing Cao, Xiaoheng Jiang, and Qinghua Hu. Idlike prompt learning for few-shot out-of-distribution detection. arXiv preprint arXiv:2311.15243 , 2023.

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115:211-252, 2015.

Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning . Granada, Spain, 2011.

Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2017.

Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In Proceedings of the IEEE conference on computer vision and pattern recognition , 2014.

Fisher Yu, Yinda Zhang, Shuran Song, Ari Seff, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365 , 2015.

Junting Pan and Xavier Giró-i Nieto. End-to-end convolutional network for saliency prediction. arXiv preprint arXiv:1507.01422 , 2015.

Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE conference on computer vision and pattern recognition , 2018.

Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Kamali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, et al. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. International journal of computer vision , 128(7):1956-1981, 2020.

Julian Bitterwolf, Maximilian Mueller, and Matthias Hein. In or out? fixing imagenet out-ofdistribution detection evaluation. In International Conference on Machine Learning , 2023.

Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. The semantic shift benchmark. In ICML 2022 Shift Happens Workshop , 2022.

Dan Hendrycks, Steven Basart, Mantas Mazeika, Andy Zou, Joe Kwon, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-of-distribution detection for realworld settings. International conference on machine learning , 2022.

Wenjun Miao, Guansong Pang, Xiao Bai, Tianqi Li, and Jin Zheng. Out-of-distribution detection in long-tailed recognition with calibrated outlier class learning. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 38, pages 4216-4224, 2024.

Julian Bitterwolf, Alexander Meinke, Maximilian Augustin, and Matthias Hein. Breaking down out-of-distribution detection: Many methods based on ood training data estimate a combination of the same core quantities. In International Conference on Machine Learning , pages 2041-2074. PMLR, 2022.

Kai Liu, Zhihang Fu, Chao Chen, Sheng Jin, Ze Chen, Mingyuan Tao, Rongxin Jiang, and Jieping Ye. Category-extensible out-of-distribution detection via hierarchical context descriptions. Advances in Neural Information Processing Systems , 36, 2024.

Clément L Canonne. A short note on an inequality between kl and tv. arXiv preprint arXiv:2202.07198 , 2022.

Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual-logit matching. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 4921-4930, 2022.

Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set recognition: A good closed-set classifier is all you need? International Conference on Learning Representations , 2022.

Dan Hendrycks and Thomas G Dietterich. Benchmarking neural network robustness to common corruptions and surface variations. International Conference on Learning Representations , 2019.

Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. British Machine Vision Conference , 2016.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , 2016.

Yarin Gal et al. Uncertainty in deep learning. 2016.

Appendices

where λ is a constant independent of f . U is the K -classes uniform distribution. P COV is the covariate-shifted OOD distribution. P SEM test is the semantic OOD distribution.

Proof. Let f ∗ be the hypothesis which jointly minimizes the total variance distance between the predicted distribution F f with uniform distribution U taking expectation on P COV and P SEM test , which is to say

Set λ = E x ∼ P COV [ TV ( F f ∗ ( x ) || U )] + E x ∼ P SEM test [ TV ( F f ∗ ( x ) || U )] , then by the triangle equality we have

Intuitively speaking, Lemma 1 demonstrates that if the classifier f express high overall uncertainty on P SEM test (i.e., the predicted distribution F f is close to uniform distribution), it will also tend to high uncertain prediction on P COV given a limited d F ( P SEM test , P COV ) .

Lemma 2. [Inequality between KL and TV] For any K-class distribution P and Q on { 1 , · · · , K } and κ > 0 , the following inequality holds

Proof. The proof can be found in [53] page 8.

Lemma 3. Denote the OOD detection loss used for MSP detectors as L reg , then we have

where TV ( ·||· ) is total variance distance (TVD). U denotes uniform distribution support on Y = { 1 , 2 · · · K } . L reg is defined in [7] is the cross-entropy between predicted distribution F f ( x ) and uniform distribution U .

Lemma 2 means that minimizing the OOD detection loss will constrains the predicted distribution to be close to uniform distribution, which is a intuitive and straightforward result.

Proof. In K -classes classification task, for any sample ˜ x drawn from P SEM X , we have

Applying Pinsker's Inequality, the following inequality holds

Noted that H ( U ) = log K , we can re-write above inequality as

Then, by taking expectation on P SEM X we can get the result.

Now we are ready to present the proof of Theorem 1.

Proof. By the definition, the generalization error can be written as

where P true is the target distribution given input x (i.e., the true class distribution) and L CE ( · ) denotes the cross-entropy loss.

Applying Lemma 2, for any x we have

By the sub-additivity of TVD, we have

Taking expectation on P COV XY , we have

Applying Lemma 1 and Lemma 2,

Given the fact that P COV XY , P true are both fixed, H ( P true ) and TV ( P true || U ) are constants for each x . Finally, we get

B Experimental Details

B.1 Datasets details

ID datasets P ID . ID datasets are chosen following common practice in OOD detection. We use CIFAR-10, CIFAR-100 and ImageNet-200 as P ID . ImageNet-200 is a subset of the original ImageNet-1K introduced by [20, 5].

Auxiliary OOD datasets P SEM train . For CIFAR experiments, we use ImageNet-RC and TIN-597 as auxiliary datasets. ImageNet-RC is a down-sampled variant of the ImageNet-1K, which consists

of 1000 classes and 1,281,167 images. We also conduct experiments on TIN-597 as an alternative for ImageNet-RC. TIN-597 is introduced by recent work [5]. The resolutions of ID and auxiliary samples are both 64 × 64 . For ImageNet experiments, we use a subset of ImageNet-1K consisting of 200 classes as ID datasets. The remaining images belong to other 800 classes are utilized as auxiliary datasets. The resolutions of ID and auxiliary images are both 224 × 224 .

OOD detection test datasets P SEM test . In CIFAR experiments, following standard practice [8], we use SVHN [40], Textures [42], Places365 [41], iSUN [44], LSUN-C and LSUN-R [43] to evaluate the OOD detection performance. ◦ The SVHN test set comprises 26,032 color images of house numbers. ◦ Textures (Describable Textures Dataset, DTD) consists of 5,640 images depicting natural textures. ◦ Places365 dataset consists scenic images of 365 different categories. Each class consists of 900 images. ◦ The iSUN dataset is a subset of the SUN database with 8,925 images. ◦ The Large-scale Scene Understanding dataset (LSUN) comprises a testing set with 10,000 images of 10 different scenes. LSUN offers two datasets, LSUN-C and LSUN-R. In LSUN-C, the original high-resolution images are randomly cropped into 32 × 32 . Meanwhile, in LSUN-R, the images are resized to 32 × 32 . In ImageNet experiments, we follow the settings of [5], where OpenImage-O [54], SSB-hard [55], Textures [42], iNaturalist [45] and NINCO [47] are selected as OOD detection test datasets. ◦ OpenImage-O contains 17632 manually filtered images and is 7.8 × larger than the ImageNet dataset. ◦ SSB-hard is selected from ImageNet-21K. It consists of 49K images and 980 categories. ◦ Textures (Describable Textures Dataset, DTD) consists of 5,640 images depicting natural textures. ◦ iNaturalist consists of 859000 images from over 5000 different species of plants and animals. ◦ NINCO consists with a total of 5879 samples of 64 classes which are non-overlapped with ImageNet-1K.

OOD generalization test datasets P COV . Following previous work [4], we corrupt the original test data with Gaussian noise of zero mean and variance of 5 in the main paper. In appendix, we conduct additional experiments involving CIFAR10-C, CIFAR100-C and ImageNet-C [56] with 15 diverse types of noise.

B.2 Implementation details

B.2.1 CIFAR experiments.

We use WideResNet-40-10 [57] as the backbone network, which comprises 40 layers. The widen factor is set to 10. We use SGD optimizer to train all methods with dropout strategy. The dropout rate is 0.3. The momentum is set to 0.9 and weight decay is set to 0.0005.

Pretraining details. The pretrained model is obtained by training WideResNet-40-10 for 200 epochs with an initial learning rate of 0.1. We decay the learning rate by a factor of 0.2 at the 60-th, 120-th, and 160-th epochs. Batch size is set to 128.

Finetuning details. ◦ For Entropy and EBM, we finetune the pretrained model for 20 epochs with an initial learning rate of 0.001, utilizing a cosine annealing strategy to adjust the learning rate. Following the official implementation, the weight of OOD detection regularization term is set to 0.5 and 0.1 for Entropy and EBM (finetune) respectively. The hyperparameters m ID and m OOD in EBM regularization learning are set to -25 and -7 respectively. The ID batch size is 128 and the OOD batch size is set to 256. ◦ For SCONE, we finetune the pretrained model for 10 epochs with an initial learning rate of 0.0002, utilizing a cosine annealing strategy to adjust the learning rate. The batch size is 32, the OOD batch size is 64. The margin of the OOD detection boundary is set to 1. To be aligned with most previous works in OOD detection and generalization, we assume P COV X is unavailable during finetuning. ◦ For WOODS, we finetune the pretrained model for 10 epochs with an initial learning rate of 0.0002, utilizing a cosine annealing strategy to adjust the learning rate. The ID batch size is 32, the OOD batch size is 64. Other hyperparameters settings are consistent with SCONE. ◦ For DUL, α 0 is set to 12. While finetuning on CIFAR10, the m ID and m OOD are set to 10 and 30 respectively. The weight λ, γ are set to 0.3 and 2. We train for 20 epochs with an initial learning rate of 0.00005, utilizing a cosine annealing strategy to adjust the learning rate. While finetuning on CIFAR100/TIN-597, the m ID and m OOD are set to 10 and 30 respectively. The weights λ, γ are set to 0.05 and 2 respectively. We finetune for 20 epochs with an initial learning rate of 0.00005, utilizing a cosine annealing strategy to adjust the learning rate. While finetuning on CIFAR100/ImageNet-RC, we set h 0 = 0 . The m ID and m OOD are set to -430 and -370 respectively. We train for 30 epochs with an initial learning rate of 0.0001, utilizing a cosine annealing strategy to adjust the learning rate.

The weights λ, γ are set to 0.1 and 1 respectively. For CIFAR-100/ImageNet-RC, we set τ = 2 and otherwise τ = 1 . ◦ For DUL † , we use Thompson sampling strategy [11] for OOD informativeness mining. The sampling hyperparameters are consistent with that of POEM.

Training from scratch details. ◦ For POEM, we train from scratch for 200 epochs with an initial learning rate of 0.1, and decay the learning rate by a factor of 0.2 at the 60 -th, 120 -th, and 160 -th epochs following [57]. The ID and OOD batch size are set to 128 and 256 respectively. Following the official implementation, the pool of outliers consists of randomly selected 400,000 samples from auxiliary datasets, and only 50,000 samples (same size as the ID training set) are selected for training based on the boundary score. ◦ For DPN, we train for 200 epochs with an initial learning rate of 0.1, and decay the learning rate by a factor of 0.2 at the 60-th, 120-th, and 160-th epochs. The Dirichlet parameters α are calculated by performing ReLU plus one on the model's outputs, i.e., α = ReLU( f ( x )) + 1 . α 0 is set to 15 and 12 respectively when training on CIFAR10 and CIFAR100. The auxiliary datasets are ImageNet and TIN-597. The ID and OOD batch size are set to 128 and 256 respectively. When training on CIFAR100/TIN-597, the OOD regularization weight λ is set to 0.05. In other cases, λ is set to 0.5.

B.2.2 ImageNet experiments.

We use ResNet18 [58] as the backbone network. We use SGD optimizer to train all the models. The momentum is set to 0.9.

Pretraining details. The pretrained model is obtained by training ResNet18 for 100 epochs with an initial learning rate of 0.1, utilizing a cosine annealing strategy to adjust the learning rate. The weight decay is set to 0.0001. Batch size is set to 64.

Finetuning details. ◦ For Energy regularized learning, we finetune the pretrained model for 10 epochs with an initial learning rate of 0.001, utilizing a cosine annealing strategy to adjust the learning rate. The weight decay is set to 0.0001. Following the official implementation, the weights of OOD detection regularization term are set to 0.1. Specifically, the m ID and m OOD in energy regularization method are set to -25 and -7 respectively. The ID batch size is 64 and the OOD batch size is set to 128. ◦ For Entropy, we finetune the pretrained model for 10 epochs with an initial learning rate of 0.001, utilizing a cosine annealing strategy to adjust the learning rate. The weight decay is set to 0.0001. The ID and OOD batch size are set to 64 and 128 respectively. Following the official implementation, the weights of OOD detection regularization term are set to 0.5. ◦ For SCONE, we finetune the pretrained model for 10 epochs with an initial learning rate of 0.0002, utilizing a cosine annealing strategy to adjust the learning rate. The weight decay is set to 0.0005. The batch size is 32, the OOD batch size is 64. The margin of the OOD detection boundary is set to 1. To be aligned with most previous works in OOD detection and generalization, we assume P COV X is unavailable during finetuning. ◦ For WOODS, we finetune the pretrained model for 10 epochs with an initial learning rate of 0.0002, utilizing a cosine annealing strategy to adjust the learning rate. The batch size is 32, the OOD batch size is 64. Other hyperparameters of WOODS are consistent with SCONE. ◦ For our DUL, the Dirichlet parameters α are calculated by performing ReLU and exp operation on the model's outputs, i.e., α = exp(ReLU( f ( x ))) . For numerical stability on large scale benchmark, we measure the distributional uncertainty by the strength of Dirichlet distribution. λ, γ are set to 0.1 and 4 respectively. We set τ = 1 in large-scale ImageNet experiments.

Training from scratch details. ◦ For DPN, we train ResNet18 for 100 epochs with an initial learning rate of 0.1, utilizing a cosine annealing strategy to adjust the learning rate. The weight decay is set to 0.0001. Batch size is set to 64. The Dirichlet parameters α are calculated by performing ReLU plus one on the model's outputs, i.e., α = ReLU( f ( x )) + 1 . The ID classification loss is set to KL-divergence between predicted class distribution under Dirichlet prior and target distribution because of the inconvenience of directly setting α 0 . The target distribution is obtained by label smoothing strategy with parameter of 0.01 [9]. The weight of regularization term applied on OOD auxiliary samples is 1.

C Additional Results

C.1 Uncertainty estimation.

We add Gaussian noise with zero mean and varying variance ϵ on CIFAR-10 and investigate the estimated distributional uncertainty and overall uncertainty. Distributional uncertainty is measured by differential entropy. It clear that with DUL regularization, the prediction yields a low overall uncertainty and high distributional uncertainty on covariate-shifted data. We conduct experiments on CIFAR-10/ImageNet-RC and CIFAR-10/TIN-597, tabular results are shown in Tab. 4.

C.2 Time-consuming comparison.

We compare the time-cost of proposed DUL to other training-required OOD detection methods in Tab. 5. We run all the experiments on one single NVIDIA GeForce RTX-3090 GPU. Compared with other OOD detection methods in a finetune manner, DUL does not introduce noticeably extra cost of computation.

C.3 Full results with standard deviation.

Full results with standard deviation are presented this section. In CIFAR experiments, we report the mean and standard deviation in 5 random runs. In ImageNet experiments, we report the mean and

standard deviation in 3 random runs to be consist with [5]. CIFAR experimental results are shown in Tab. 6. Large-scale ImageNet results are shown in Tab. 7.

C.4 Results of different types of corruption.

We conduct additional experiments on CIFAR10-C, CIFAR100-C and ImageNet-C with 15 different types of corruption. The results validate that the proposed method can improve the overall performance under different types of corruption.

C.5 OODdetection results on individual datasets.

We provide OOD detection results of DUL on each individual OOD detection test dataset in Tab. 8 and Tab. 9, based on the checkpoint with random seed 1.

C.6 Empirical evidence

Here we provide empirical supports to our intuition about energy-based OOD detection regularization. We calculate the entropy of predicted distribution before and after finetuning with Energy regularization [8]. The results show can support our claim in Section 4.

D Discussions

D.1 Math derivation

Differential entropy. The proposed DUL calculates differential entropy as OOD detection measurement. Here we detail how to calculate the differential entropy of a Dirichlet distribution. The following derivation of differential entropy is taken from [9]. The differential entropy of a Dirichlet parameterized by α is calculated by

where α 0 is the strength of Dirichlet, i.e., α 0 = ∑ K α k . α k denotes the k -th element in α . Γ is the Gamma function and ψ is the digamma function. Here we provide a PyTorch implementation on how to calculate distribution uncertainty measured by differential entropy.

We refer interested readers to [9] and Gal's PhD Thesis [59] for more detailed math derivations.

D.2 Discussion about Disparity Discrepancy

In section 4, we claim that a limited disparity discrepancy between test-time semantic OOD and covariate-shifted OOD is practical. Here we provide some empirical evidence and discussion to support such a claim.

The key challenge of OOD detection lies in identifying ID-like semantic OOD. As mentioned in recent works [38], effectively distinguishing between the most challenging OOD samples that are much like in-distribution (ID) data is the core challenge of OOD detection. Recent works regularize models on ID-like OOD to enhance the OOD detection performance. Since the ID-like semantic OOD samples are more difficult to be detected and more informative. For example, NTOM [17] and

POEM [11] utilizes greedy and Thompson sampling strategies to find semantic OOD samples which are more closely to ID. [38] proposes to explicitly discover outliers near ID by prompt learning.

Semantic OOD and covariate OOD can be very similar in practice. As shown in Fig. 4. There exists many similar samples from semantic OOD and covariate OOD in large-scale commonly used benchmarks. We borrow some examples from recent works [47] to show case.

cat-faced

Galap. Fur

spagh.

chicken

glass of milk

donut

marbled newt

spider

seal

bolognese

quesadilla

kangaroo

a)

Semantic OOD classes from NINCO

barn spider

sea lion

eggnog

commonnewt

burrito

indri

(b) ID classes from ImageNet

D.3 Social Impact

AI safety and trustworthiness are closely related to our work. This paper presents work to harmonize the conflicts between out-of-distribution detection methods and model generalization. The proposed method puts effort to enhance machine learning models for their safely deployment on out-ofdistribution data, avoiding both undesirable behavior and degraded performance in challenging high-stake tasks. However, due to the bias from data used by current OOD detection benchmark, e.g., large-scale ImageNet, the ones using the proposed method need to carefully consider the selection of auxiliary outliers for safety-critical applications.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The abstract and introduction accurately reflect the paper's contributions and scope.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: In conclusion and Appendix.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The paper provide the full set of assumptions and a complete (and correct) proof in Appendix.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: Section 6 and Appendix.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: See Appendix and supplemental material.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: The paper provides above details in Section 6 and Appendix.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The authors have carefully reviewed the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: In Appendix.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The license and terms of use explicitly mentioned and properly respected.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel method for finetuning a classifier for both OOD generalization and OOD detection. The paper presents a novel objective function for OOD generalization and detection based on the Bayesian framework and OOD generalization theory. Extensive experimental results suggest that the proposed method is effective.\n\nSTRENGTHS:\n* The paper addresses an important problem of achieving OOD generalization and OOD detection simultaneously. This task has high significance regarding the safety of ML systems.\n* Overall, the exposition of the paper is clear and easy to follow.\n* The paper presents a sound theoretical analysis on why some existing OOD detection approaches have failed in OOD generalization.\n* The experiments are conducted in a reasonable setting, and the results are promising.\n\nWEAKNESSES:\n* It is possible that I missed it, but the paper does not provide a direct theoretical argument supporting the main objective function (Eq. (11)). The most important term in Eq. (11) is the constraint that the entropy of p(y|x) should not change before and after the fine-tuning. This term maintains OOD generalization, but the justification is weak. \n* Related to the above point, the statement in Lines 244-245 (\"While generalization is related to 245 the overall uncertainty of p(yˆ|x) as we mentioned in related works (both AU and DU).\") argues that this entropy (i.e., \"overall uncertainty\") is connected to the generalization performance. Still, I could not find the supporting information in the related work section.\n\nQUESTIONS:\n* Is there a reason why we should enforce the \"non-increased overall uncertainty\" constraint (the constraint in Eq. (11)) only on semantic OOD data? For example, what if we enforce this on the in-distribution dataset? Is there a theoretical justification for this choice, or is it more empirical?\n\nLIMITATIONS:\n* The paper addresses its limitation in the conclusion section. The limitation of the paper does not raise a concern.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-08"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper theoretically characterizes the underlying dilemma in SOTA OOD detection method.  The authors find that OOD detection performance of state-of-the-art methods is achieved with tradeoff between OOD detection and classification. Accordingly, the authors provide an uncertainty-based strategy which decouples these two tasks and thus addresses the dilemma. Plenty of experiments are conducted which well support the theory and validate the effectiveness of the proposed model.\n\nSTRENGTHS:\n1. The findings of this paper are very interesting. This work studies the dilemma between OOD detection and classification generalization. For the first time, the authors provide a theoretical perspective which well reveals the underlying tradeoff. This theoretical result provides strict and intuitive explanations for this phenomenon, which is important and enlightening.\n2. The proposed uncertainty-decoupled strategy is reasonable for the dilemma, and the paper is technically solid. The proposed method is developed according to the induced theory which validates the potential of the theory in inspiring other models. \n3. The organization and writing of this paper are clear, making the contributions easy to catch. The experiments sufficiently validate both the theory and the proposed method.\n\nWEAKNESSES:\nI am not sure are there any existing works implicitly considering decoupling these two tasks, i.e., OOD detection and generalization. Please provide more clarifications. \n\nThe theory is very promising. So it will be better if the authors could provide more discussion on other potential strategies that could also addressing the dilemma. I think it will be very useful for readers.\n\nQUESTIONS:\n1. Figure 1 is very helpful and intuitive, while it seems not clear - which dataset the results are reported in the right figure.\n2. The authors should explain more about the “tradeoff area”. Although it seems ok, but I think more detailed description is necessary. \n3. “Reducing the dependency on auxiliary OOD data can be an interesting research direction for the future exploration.” I think it is interesting to reduce the dependency on auxiliary OOD data. However, could the authors provide some potential directions?\n\nLIMITATIONS:\nSee Weaknesses", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-11"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper reveals the trade-off dilemma of OOD detection and OOD generalization for current SOTA OOD detectors from both theoretical and empirical perspectives. The authors employ a transfer learning framework to analyze the generalization error bound for MSP-based OOD detectors and identify the optimization conflicts between the training objectives of OOD detection and OOD generalization. They find similar patterns for Energy-based detectors. From the theoretical analysis, this paper derives a decoupled uncertainty learning technique for the dual-optimal performance for OOD detection and generalization. Experiments on CIFAR10/100 and ImageNet-200 validate its effectiveness.\n\nSTRENGTHS:\n1. The research problem is valuable and well-presented.\n2. The theoretical analysis for the objective conflicts for MSP- and Energy-based OOD detectors is sound.\n3. The experiments show promising performance for the proposed DUL technique, which successfully maintains the OOD generalization capability while achieving competitive OOD detection results.\n\nWEAKNESSES:\n1. This paper only discusses the MSP- and Energy-based OOD detectors, which adopt exactly the same outputs (i.e., logits) from a neural network to perform ID classification (and OOD generalization) and OOD detection, where the optimization conflict is intuitive. However, other superior OOD detectors employ extra output branches aside from the classification logits (even if they share the same backbone for feature extraction) for OOD detection, such as [1][2][3], which shows promising robustness for covariate shifts[2]. Is the theoretical analysis and DUL technique still applicable to those types of OOD detectors?\n2. As the authors claim,  DUL can lead to a dual-optimal performance for both OOD detection and OOD generalization. However, according to Table 1, DUL does not always win first place across different experimental settings. For instance, DUL and $\\dagger$ DUL are surpassed by POEM on OOD detection performance by a non-negligible margin in the CIFAR10/100+ImageNet-RC setting. It seems DUL just achieves a better trade-off rather than the dual-optimal results. A proper explanation should be given.\n3. DUL seems to basically add a normalization/regularization on the model's output logits with knowledge (measured by Bayesian framework) distilled from a pre-trained ID classifier. It limits the application and novelty of this paper. What happens if the model is trained from scratch?\n4. Besides, adding Gaussian noise is a too trivial setting to evaluate the robustness of covariate shifts. How about evaluating OOD detectors in standard domain adaptation settings?\n\n[1] J Bitterwolf et al. “Breaking Down Out-of-Distribution Detection: Many Methods Based on OOD Training Data Estimate a Combination of the Same Core Quantities”. ICML 2022.\n\n[2] L Kai et al. \"Category-Extensible Out-of-Distribution Detection via Hierarchical Context Descriptions\". NeurIPS 2023.\n\n[3] W Miao et al. \"Out-of-Distribution Detection in Long-Tailed Recognition with Calibrated Outlier Class Learning\". AAAI 2024.\n\nQUESTIONS:\nAlthough OOD detection and OOD generalization are both frequently discussed in the literature, it is still weird when they come up together. It is basically because the D(istribution) for OOD detection and OOD generalization has different meanings. For OOD detection, it means the collection of label y. For OOD generalization, it means the data distribution for sample x. A proper clarification or modification can be taken into consideration\n\nLIMITATIONS:\nPlease see weakness.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses out-of-distribution (OOD) detection and generalization problems. The authors show the sensitive-robust dilemma in learning objectives of OOD detection and generalization and propose a decoupled uncertainty learning (DUL) method to harmonize the above conflict. The proposed method only encourages high distribution uncertainty on OOD data and explicitly discourages high entropy in the final prediction. Experiments on some datasets show the DUL method achieves better performance compared to several baselines.\n\nSTRENGTHS:\n1. Provide a detailed analysis of the sensitive-robust dilemma between OOD detection and generalization by leveraging transfer learning theory.\n\n2. Develop a decoupled uncertainty learning algorithm that explicitly discourages high entropy in the final prediction to keep the OOD generalization ability of the model. \n\n3. Experiments on benchmarks demonstrate the decoupled uncertainty learning objective achieves better performance compared to baselines.\n\nWEAKNESSES:\n1. While analyzing the sensitive-robust dilemma via transfer learning theory is novel, the phenomenon that existing SOTA OOD detection methods may suffer from catastrophic degradation in terms of OOD generalization has been reported in [4]. \n\n2. The decoupled uncertainty learning objective introduces an additional regularization term named unchanged overall uncertainty. It is difficult to understand why DUL even performs better than Entropy [7] and EBM (finetune) [8] on OOD detection tasks.\n\n3. Only simple Gaussian noise is used to reflect the OOD generalization ability, while there are many types of out-of-distributions like corruptions. Therefore, the results in Table 1 can not represent the performance of evaluated methods because different kinds of OOD data often behave differently under the same model [A]. \n\n[A] OoD-Bench: Quantifying and Understanding Two Dimensions of Out-of-Distribution Generalization, CVPR 2022.\n\nQUESTIONS:\n1. According to Eq.9, if keep the overall uncertainty and enlarge the distributional uncertainty (for OOD detection), the data uncertainty must be reduced. Could the authors provide the visualization of data uncertainty?\n\n2. The reviewer suggests two more baselines. (1) In the original Entropy [7] or EBM (finetune) [8], reduce the weight of outlier regularization terms and show the performance on both OOD detection and generalization. (2) Add the unchanged overall uncertainty term in Eq.12 to the original Entropy [7] or EBM (finetune) [8], and report the performance. Those two baselines would help to demonstrate the effectiveness of the bayesian framework in decoupled uncertainty learning.\n\nLIMITATIONS:\nThe authors adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}