Title: AdaSCALE: Adaptive Scaling for OOD detection
Venue: NeurIPS 2025
Accepted: no
Keywords: OOD Detection
Abstract: The ability of the deep learning model to recognize when a sample falls outside its learned distribution is critical for safe and reliable deployment. Recent state-of-the-art out-of-distribution (OOD) detection methods leverage activation shaping to improve the separation between in-distribution (ID) and OOD inputs. These approaches resort to sample-specific scaling but apply a static percentile threshold across all samples regardless of their nature. In this work, we propose AdaSCALE, an adaptive scaling procedure that dynamically adjusts the percentile threshold based on a sample's estimated OOD likelihood. This estimation leverages our key observation that OOD samples exhibit significantly more pronounced activation shifts at high-magnitude activations under minor perturbation compared to ID samples. AdaSCALE enables stronger scaling for likely ID samples and weaker scaling for likely OOD samples, creating highly separable energy scores. Our approach achieves state-of-the-art OOD detection performance, outperforming the latest rival OptFS by **14.94**% in near-OOD and **21.67**% in far-OOD datasets in average FPR@95 metric in the ImageNet-1k benchmark across eight diverse architectures.

Abstract

The ability of the deep learning model to recognize when a sample falls outside its learned distribution is critical for safe and reliable deployment. Recent state-ofthe-art out-of-distribution (OOD) detection methods leverage activation shaping to improve the separation between in-distribution (ID) and OOD inputs. These approaches resort to sample-specific scaling but apply a static percentile threshold across all samples regardless of their nature, resulting in suboptimal ID-OOD separability. In this work, we propose AdaSCALE , an adaptive scaling procedure that dynamically adjusts the percentile threshold based on a sample's estimated OOD likelihood. This estimation leverages our key observation: OOD samples exhibit significantly more pronounced activation shifts at high-magnitude activations under minor perturbation compared to ID samples. AdaSCALE enables stronger scaling for likely ID samples and weaker scaling for likely OOD samples, yielding highly separable energy scores. Our approach achieves state-of-the-art OOD detection performance, outperforming the latest rival OptFS by 14.94% in near-OOD and 21.67% in far-OOD datasets in average FPR@95 metric on the ImageNet-1k benchmark across eight diverse architectures.

1 Introduction

The reliable deployment of deep learning models hinges on their ability to handle previously unseen 18 inputs, a task commonly known as OOD detection. One critical application is in medical diagnosis, 19 where a model trained on common diseases should be able to flag inputs representing unknown 20 conditions as potential outliers, requiring further review by clinicians. OOD detection primarily 21 involves identifying semantic shifts, with robustness to covariate shifts being a highly desirable 22 characteristic [1, 2]. As modern deep learning models scale in both data and parameter counts, 23 effective OOD detection within large-scale settings is critical. Given the difficulties of iterating on 24 large models, post-hoc approaches that preserve ID accuracy are generally preferred. 25

Avariety of post-hoc approaches have emerged, broadly categorized by where they operate. One class 26 of methods focuses on computing OOD scores directly in the output space [6, 7, 8, 9, 3, 10], while 27 another operates in the activation space [11, 12, 13, 14]. Finally, a more recent line of research also 28 explores a hybrid approach [15, 16], combining information from both spaces. The efficacy of many 29 high-performing methods relies on either accurate computation of ID statistics [17, 18, 19, 20, 21] or 30 retention of training data statistics [12, 14]. However, as retaining full access to training data becomes 31 increasingly impractical in large-scale settings, methods that operate effectively with minimal ID 32 samples without performance degradation are particularly valuable for practical applications. 33

Alleviating the dependence on ID training data/statistics, recent state-of-the-art post-hoc approaches 34

center around the concept of 'fixed scaling." ASH [3] prunes and scales activations on a per-sample 35

basis. SCALE [4], the direct successor of ASH, critiques pruning and focuses purely on scaling, 36

which improves OOD detection without accuracy degradation. LTS [5] extends this concept by 37

directly scaling logits instead, using post-ReLU activations. These methods leverage a key insight: 38

likely ID activation

likely OOD activation

(variable k)

Top-k operation

Top-k operation

Scaling

factor

Fixed scaling

(fixed k = 3)

Top-k operation

Top-k operation

scaling based on the relative strength of a sample's top-k activations (with respect to the entire 39

activations) produces highly separable ID-OOD energy scores. However, although such approaches 40

41

provide sample-specific scaling factors, the scaling mechanism remains uniform across all samples

as the percentile threshold p and thereby k is fixed, as shown in Figure 1. This static approach is 42

inherently limiting for optimal ID-OOD separation while also failing to leverage even minimal ID 43

data, which could be reasonably practical in most deployment scenarios. 44

We hypothesize that designing an adaptive scaling procedure based on each sample's predetermined 45

OOD likelihood offers greater control for enhancing ID-OOD separability. Specifically, this mech46

anism should assign smaller scaling factors for samples with high OOD likelihood to yield lower 47

48

energy scores and larger scaling factors for probable ID samples to yield higher energy scores. To

achieve this, we propose a heuristic for predetermining OOD likelihood based on a key observation in 49

50

activation space: minor perturbations applied to OOD samples induce significantly more pronounced

51

52

53

shifts in their top-k activations compared to ID samples. Consequently, samples exhibiting substantial activation shifts are assigned lower scaling factors, while those with minimal shifts receive higher

scaling factors. This adaptive scaling mechanism can be applied in either logit or activation space.

Our method, AdaSCALE , achieves state-of-the-art performance, delivering significant improvements 54

in OOD detection while requiring only minimal ID samples. 55

We conduct an extensive evaluation across 8 architectures on ImageNet-1k and 2 architectures 56 on CIFAR benchmarks, demonstrating the substantial effectiveness of AdaSCALE. For instance, 57 AdaSCALE surpasses the average performance of the best-generalizing method, OptFS [10], by 58 14.94% / 8.96% for near-OOD detection and 21.48% / 3.39% for far-OOD detection in terms of 59 FPR@95 / AUROC, on the ImageNet-1k benchmark across eight architectures. Furthermore, AdaS60 CALE outperforms the best-performing method, SCALE [4], when evaluated on the ResNet-50 61 architecture, achieving performance gains of 12.95% / 6.44% for near-OOD and 16.79% / 0.79% for 62 far-OOD detection. Additionally, AdaSCALE consistently demonstrates superiority in full-spectrum 63 OOD (FSOOD) detection [1]. Our key contributions are summarized as follows: 64

65

66

67

We reveal that OOD inputs exhibit more pronounced shifts in top-k activations under minor perturbations compared to ID inputs. Leveraging this, we propose a novel post-hoc OOD detection method using adaptive scaling that attains state-of-the-art OOD detection.

68

69

70

71

We demonstrate state-of-the-art generalization of AdaSCALE via extensive evaluations across many setups. AdaSCALE requires tuning just one additional percentile hyperparameter compared to SCALE for a given setup, while the other introduced hyperparameters generalize well across all 10 architectures and 3 datasets.

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

2 Related Works

Post-hoc methods. Early research on OOD detection primarily focused on designing scoring functions based on logit information [6, 7, 8, 9, 22]. While these methods leveraged logit-based scores, alternative approaches have explored gradient-based information, such as GradNorm [23], GradOrth [24], GAIA [25], and Greg-OOD [26]. Given the limited dimensionality of the logit space, which may not encapsulate sufficient information for OOD detection, subsequent studies have investigated activation-space-based methods. These approaches exploit the high-dimensional activations, leading to both parametric techniques such as MDS [11], MDS Ensemble [11], and RMDS [13], as well as non-parametric methods such as KNN-based OOD detection [12, 27]. Recent advancements have proposed hybrid methodologies that integrate parametric and non-parametric techniques to improve robustness. For instance, ComboOOD [14] combines these paradigms to enhance near-OOD detection performance. Similarly, VIM [15] employs a combination of logit-based and distance-based metrics. However, reliance of such approaches on ID statistics [20, 28, 29] can become a constraint, hindering scalability and practical deployment in real-world applications. To mitigate computational challenges for real-world deployment, recent methods, such as FDBD [30] and NCI [31], have focused on enhancing efficiency. Recent advances, such as NECO [32] examines connections to neural collapse phenomena, while WeiPer [33], explore class-direction perturbations. Unlike WeiPer, our work deals with perturbation in the input image similar to ODIN [7].

Activation-shaping post-hoc methods. A seminal work in OOD detection, ReAct [17], identified abnormally high activation patterns in OOD samples and proposed clipping extreme activations. This approach has been further generalized by BFAct [18] and VRA [19], which extend activation clipping for enhanced effectiveness. Additionally, BATS [34] refines activation distributions by aligning them with their respective typical sets, while LAPS [35] enhances this strategy by incorporating channelaware typical sets. Inspired by activation clipping, another line of research explores activation 'scaling" as a means to improve OOD detection. ASH [3] introduces a method to compute a scaling factor as a function of the activation itself, pruning and rescaling activations to enhance the separation of energy scores between ID and OOD samples. However, this approach results in a slight degradation in ID classification accuracy. In response, SCALE [4] observes that pruning adversely affects performance and thus eliminates it, leading to improved OOD detection while preserving ID accuracy. SCALE currently represents the state-of-the-art method for ResNet-50-based OOD detection. Despite their efficacy, these activation-based methods exhibit limited generalization across diverse architectures. To address this issue, LTS [5] extends SCALE by computing scaling factors using post-ReLU activations and applying them directly to logits rather than activations. Our work builds on this line of work, introducing the adaptive scaling mechanism. ATS [21] argues that relying solely on final-layer activations may result in the loss of critical information beneficial for OOD detection and proposes to leverage intermediate-layer activations too. However, its efficacy is contingent upon the availability of a large number of training samples, whereas our approach attains state-of-the-art performance while utilizing a minimal number of ID samples. A newly proposed method OptFS [10] introduces a piecewise constant shaping function with the goal of generalization across diverse architectures in large-scale settings, while our work exhibits superior generalization extending to small-scale settings too.

Training methods. The training methods incorporate adjustments during training to enhance the ID-OOD differentiating characteristics. They either make architectural adjustments [36, 37, 38], apply enhanced data augmentations [39, 40, 41], or make simple training modifications [42, 43, 44]. More recent methods have adopted contrastive learning in the context of OOD detection [45, 46, 47, 48]. Moreover, some approaches also either utilize external real outliers [49, 50, 51, 52] or synthesize virtual outliers either in image space [53, 54, 55, 56, 57, 58, 59, 60] or in feature space [61, 62, 63, 64]. However, training methods can be costlier and less effective than post-hoc approaches in some largescale setups [65].

3 Preliminaries

Let X denote the input space and Y = { 1 , 2 , ..., C } denote the label space, where C is the number of classes. We consider a multi-class classification setting where a classifier h is trained on ID data drawn from an underlying joint distribution P ID ( x, y ) , where x ∈ X and y ∈ Y . The ID

training dataset is denoted as D ID = { ( x i , y i ) } N i =1 , where N is the number of training samples and 125 ( x i , y i ) ∼ P ID ( x, y ) . The classifier h is composed of a feature extractor f θ : X → A ∈ R D , and a 126 classifier g W : A → Z ∈ R C . The feature extractor maps an input x to a feature vector a ∈ A , where 127 a = f θ ( x ) and the classifier then maps this feature vector to a logit vector z = g W ( a ) ∈ R C . Werefer 128 to individual dimensions of the feature vector a as activations, denoted by a j for the j -th dimension. 129 The classifier h is trained on D ID to minimize the empirical risk: min θ, W 1 N ∑ N i =1 L ( g W ( f θ ( x i )) , y i ) 130 where L is a loss function, such as cross-entropy loss. During inference, the model may encounter 131 data points drawn from a different distribution, denoted as P OOD ( x ) , which is referred to as OOD 132 data. The OOD detection problem aims to identify whether a given input x is drawn from marginal 133 distribution P ID ( x ) or from P OOD ( x ) . Hence, the goal is to design a scoring function S ( x ) : X → R 134 that assigns a scalar score to each input x , reflecting its likelihood of being an OOD sample. A higher 135 score typically indicates a higher probability of the input being OOD. A threshold τ is used to classify 136 an input as either ID or OOD: OOD ( x ) = { True , if S ( x ) > τ False , if S ( x ) ≤ τ . 137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

4 Method

In this section, we introduce AdaSCALE, a novel post-processing approach that dynamically adapts the scaling mechanism based on each sample's estimated OOD likelihood. We first present our key empirical observations regarding activation behavior under minor perturbations, building upon insights from ReAct [17]. Next, we revisit and analyze the core principle underlying recent state-ofthe-art approaches. Finally, we detail our proposed adaptive scaling mechanism that leverages these observations to achieve superior OOD detection performance.

4.1 Observations in Activation Space

Aseminal work ReAct [17] demonstrated that OOD samples often induce abnormally high activations within neural networks. We extend this finding with an important observation: the positions of such high activations in OOD samples are relatively unstable under minor perturbations compared to ID samples . This instability provides a valuable signal for distinguishing OOD samples from ID samples. Below, we formalize this observation and our methodology.

4.1.1 Perturbation Mechanism

Let x ∈ R C in × H × W be an input image with C in input channels, H height, and W width. We denote channel value at position ( c, h, w ) as x [ c, h, w ] . To identify channel values for perturbation, we employ pixel attribution that quantifies each input element's influence on the model's prediction. An attribution function, AT ( x, c, h, w ) , assigns a score to each channel value, with lower absolute scores indicating less influence. We select o % of channel value indices with lowest absolute attribution scores, forming the set R . We use a gradient-based attribution:

where y pred is the predicted class index. To create a perturbed input, we select a subset R containing o % of channel values to perturb. The perturbed image x ε is obtained as:

where ε is perturbation magnitude. While we employ gradient-based attribution for principled pixel selection for perturbation, as we show later in Appendix C.3, it is important to note that even random selection empirically performs similarly, whereas selecting salient pixels degrades performance.

4.1.2 Activation Shift as OOD Indicator

After obtaining the perturbed input x ε , we compute its activation a ε = f θ ( x ε ) . We define the activation shift as the absolute element-wise difference between the original activation and the perturbed activation:

Figure 2 illustrates the key insight of our 167 approach: activation shift at extreme (high168 magnitude) activations is consistently more pro169 nounced in OOD samples compared to ID sam170 ples. This behavior can be understood intu171 itively: ID samples activate network features in 172 a stable, predictable manner reflecting learned 173 patterns, while OOD samples trigger less sta174 ble, more arbitrary high activations that shift 175 significantly under perturbation. Based on this 176 observation, we propose using activation shift 177 at the topk 1 highest activations as a metric to 178 estimate OOD likelihood of a sample: 179

where argsort ( a , desc = True )[: k 1 ] returns 180 the indices of the k 1 highest values in a . As 181 evidenced by Q OOD /Q ID ratio ( > 1 ) shown in 182 Figure 3, the Q statistic generally assigns higher 183 values to OOD samples than ID ones. However, 184

0.5

argsort (a)

ImageNet-1k (ID)

0.4

OpenImage-O (OOD)

0.3

i

0.2

a

0.1

1.3

a

0.0

0)

250

500

750

1000

1250

00S1

1750

2000

k

the high variance of Q metric (Figure 2) suggests the possibility of overoptimistic estimations. To 185 address this issue, we introduce a correction term C o that exhibits an opposing behavior: it tends to 186 be higher for ID samples than for OOD samples. Figure 8 in Appendix C shows that the perturbed 187 activations of ID samples tend to be higher than those of OOD ones, especially in high-activation 188 regions. We leverage this complementary signal by defining: 189

where k 2 is a hyperparameter denoting the number of considered activations. We refine our OOD quantification by combining both metrics, weighted by a hyperparameter λ :

Indeed, Figure 3 illustrates that Q ′ OOD /Q ′ ID > Q OOD /Q ID, 192 suggesting that the correction term C o helps mitigate over193 confident estimations. If ¯ Q s = { ¯ Q ′ 1 , ¯ Q ′ 2 , ..., ¯ Q ′ n val } be the 194 set of Q ′ values on n val ID validation samples, we could 195 transform any Q ′ into a normalized probability scale by 196 constructing empirical cumulative distribution function 197 (eCDF) derived from ¯ Q s . The eCDF, denoted as F Q ′ ( Q ′ ) , 198 can be defined as: 199

200

1.79

QOOD/QID

QoOD / QiD

1.6

1.61

1.52

1.4

1.2

1.37.

1.32

1.14

1.33

1.24

1.19

1.15

1.30

1.14

1:33

1.17.

1.0

0.8

0.6

0.4

0.2

0.0

SSB Hard

NINCO

ImageNet-O iNaturalist

Textures OpenImage-O

Places

201

202

203

204

where ✶ ( · ) is the indicator function. A higher value of F Q ′ ( Q ′ ) indicates a higher likelihood of the sample being OOD. Importantly, our experiments suggest that as few as 10 ID validation samples are sufficient to construct an effective eCDF for this purpose (See Table 6).

Remark: ODIN vs. AdaSCALE in terms of perturbation

ODIN [7] perturbs entire image, inducing stronger confidence in ID inputs than OOD ones. In contrast, we apply trivial perturbations, perturbing only small number of trivial/random pixels to primarily compute shifts in top-k activations.

190

191

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

Original activations

Element-wisescaling

Scaled activations

ReLU

Classifier

Minor

Encoder

OODlikelihood

operation

Top-k

Scaling

Logit

perturbation

factor

Energy

Class

Perturbed activations

Top-k activations

score

prediction

4.2 Revisiting Static Scaling Mechanism

Scaling baselines [3, 4, 5] operate by scaling activations / logits with scaling factor r computed as:

where P p ( a ) denotes the p th percentile of all elements in activation a . While this approach yields sample-specific scaling factors, it imposes a critical constraint: the p th percentile threshold is static and identical across all test samples, regardless of the nature of samples. We argue that this static nature limits the effectiveness of the scaling procedure and prevents optimal ID-OOD separability.

4.3 Proposed Approach: Adaptive Scaling

Building on our observations, we propose AdaSCALE (Adaptive SCALE), a novel approach that introduces dynamic, sample-specific adjustments to the scaling procedure. The key insight is that p th percentile threshold should be a function of each test sample's estimated OOD likelihood rather than a fixed value. The scaling factor r increases as the p th percentile threshold rises (i.e., when more activations are excluded from the denominator in Equation 8). For optimal ID-OOD separation, we must scale ID samples more strongly than OOD samples, requiring a higher p th percentile for ID samples. We define an adaptive percentile threshold as:

where p min and p max are hyperparameters that define the minimum and maximum limits of percentile threshold. It ensures samples with lower OOD likelihood receive higher percentile thresholds, resulting in stronger scaling. (See Algorithm 1). We implement two variants: AdaSCALE-A scales activations as a scaled = a · exp( r ) [3, 4]. AdaSCALE-L scales logits as z scaled = z · r 2 [5]. We use energy score -log ∑ C i =1 e ( z i ) on (directly or indirectly) scaled logits, with higher values indicating higher ID likelihood. This approach enables per-sample dynamic scaling, as outlined in Figure 4.

5 Experiments

We use pre-trained models provided by PyTorch for ImageNet-1k experiments. For CIFAR experiments, we train three models per network using the standard cross-entropy loss and report the mean results across these three independent trials. The evaluation setup is provided in Table 1.

Metrics. We use two commonly used

OOD Detection metrics: Area Under Receiver-Operator Characteristics (AUROC) and False Positive

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

Rate at 95% True Positive Rate (FPR@95), where a higher AUROC and lower FPR@95 indicates better OOD detection performance.

Baselines. We consider the following post-hoc methods: MSP [6], EBO [8], ReAct [17], MLS [9], ASH [3], SCALE [4], BFAct [18], LTS [5], OptFS [10]. Currently, SCALE is the best-performing method (with ResNet-50), while OptFS is the best-generalizing method.

Hyperparameters. The hyperparameters are determined via automatic parameter search [65, 80]. Although AdaSCALE may appear to require many hyperparameters, our findings indicate that setting ( λ, k 1 , k 2 , o, ϵ ) to (10 , 1% , 5% , 5% , 0 . 5) consistently yields near-optimal performance across all setups, only requiring ( p min, p max) to be tuned for any given architecture. (See Appendix D.) The best results are bold , and the second-best results are underlined across all results.

5.1 Empirical Results

ImageNet-1k benchmark: We compare our proposed method, AdaSCALE, with recent state-ofthe-art approaches across eight architectures on the ImageNet-1k benchmark, as presented in Table 2. AdaSCALE demonstrates consistently strong performance across all architectures compared to existing methods. Specifically, it surpasses the best-generalizing method, OptFS, by 14.94% / 8.96% in the FPR@95/AUROC metric for near-OOD detection across all architectures. Additionally, it outperforms the best-performing method , SCALE (on ResNet-50), by 12.96% / 6.44% in the same metric. A closer observation reveals that while OptFS excels in architectures such as EfficientNet, ViT-B-16, and Swin-B, scaling baselines perform comparably or even better in architectures like ResNet-50, ResNet-101, RegNet-Y-16, and DenseNet-201. In contrast, AdaSCALE-A achieves the best performance in near-OOD detection across all architectures, except for Swin-B, where BFAct performs optimally. Furthermore, effectiveness of AdaSCALE extends beyond near-OOD detection to far-OOD detection, demonstrating an average gain of 21.67% over OptFS in the FPR@95 metric.

CIFAR benchmark: We also compare AdaSCALE with post-hoc baselines on CIFAR benchmarks using WRN-28-10 and DenseNet-101 networks, reporting the averaged performance in Table 3. AdaSCALE outperforms all methods in average AUROC metric across CIFAR benchmarks in both near- and far-OOD detection. For far-OOD detection on CIFAR-10 benchmark, AdaSCALE-A achieves the best FPR@95 score of 33.11 , outperforming the MSP baseline by approximately 1.4 points. Similarly, AdaSCALE-A attains the best FPR@95 / AUROC of 43.07 / 90.31 in near-OOD detection, though MSP remains competitive. In near-OOD detection on CIFAR-100 benchmark,

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

AdaSCALE-A achieves the highest AUROC of 81.35 , while in far-OOD detection, AdaSCALE-L reaches the best performance with FPR@95 / AUROC of 52.49 / 82.21 . While activation-shaping methods perform well in ImageNet-1k, they seem to underperform in CIFAR. In contrast, AdaSCALE achieves consistently superior performance across all setups.

FSOODDetection: FSOODdetection extends conventional OOD detection by incorporating model's ability to generalize on covariate-shifted ID inputs. We present FSOOD detection results in Table 4. We can observe that this is a highly challenging task, as covariate-shifted ID datasets cause a significant performance drop for all methods compared to the conventional case. Despite this, AdaSCALE outperforms OptFS by 4.49 and 4.13 points on average in the FPR@95 metric for FSOOD detection across both near- and far-OOD datasets.

Accuracy: Like SCALE and LTS, AdaSCALE applies linear transformations to scale activations or logits, preserving accuracy, unlike post-hoc rectification methods [3, 17].

5.2 Ablation / hyperparameter studies

Predetermined OOD likelihood Q ′ . Adaptive scaling depends on predetermined OOD likelihood to determine the extent of scaling. We study the effect of various predetermined OOD likelihood functions on OOD detection using ResNet50 network (ImageNet-1k) in Table 5. It clearly shows Q component of Q ′ being most critical while ∑ k 2 k =1 a ε argsort ( a ) k as correction term being a relatively superior choice. However, predetermined OOD likelihood alone - without adaptive scaling - does not result in strong performance.

Pmin

70

96

60

70

94

50

Pmax

40

92

30

90

0

20

'5

88

FPR@95

10

65

70

75

80

85

90

95

AUROC

Pmin

Adaptive percentile. Unlike SCALE which uses constant percentile, AdaSCALE uses dynamic percentile lying in [ p min , p max ] range adaptive to each sample. We show the effect of various percentile limit ranges in Figure 5 in the form of a heatmap on the AUROC validation metric on ImageNet-1k benchmark. The extent of darkness in the heatmap conveys a strong performance (corresponding to highest AUROC / lowest FPR@95). The diagonal entries, representing the results of SCALE, are lighter in comparison to the rest of the cells, denoting the results of AdaSCALE. Hence, it can be observed that using adaptive percentile leads to relatively better OOD detection performance in comparison to static percentile.

ID statistics. With the rise of large models, where training data is often undisclosed or inaccessible, relying on full training ID datasets for OOD detection has become increasingly impractical. We rigorously assess AdaSCALE's effectiveness with limited data by conducting experiments on ImageNet-1k with ResNet-50 using n val ID samples to compute ID statistics, where n val ∈ { 10 , 100 , 1000 , 5000 } . Table 6 confirms that even with substantially restricted access to ID data, AdaSCALE-A achieves state-of-the-art performance.

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

Image perturbation study. A sufficiently small perturbation, as discussed in Section 4.3, is used for deriving scaling factor. We now systematically investigate the impact of the extent and nature of perturbation on pre-determining OOD likelihood which is in-turn responsible for OOD detection. We present the results in Table 7. It is clearly evident that perturbing trivial pixels (with o = 5% ) leads to better OOD detection. Another key takeaway is that perturbing even random pixels achieves comparable performance more efficiently, whereas targeting salient pixels results in worse performance.

60

95.65

95.60

C

R

95.55

D

40

A

95.50

uo

lati

95.45

d

20

a

95.40

10

40

80

120

160

200

75

65

$6@

FPR(

551

Near-OOD

Far-OOD

25

15

0

0.1

1

10

100

入

Sensitivity of k 1 , k 2 , and λ . As discussed in Section 4.1.2, ID and OOD distinctions are more pronounced in high activations but diminish as more activations are included. We analyze the impact of k 1 (used in activation shift) and k 2 (used in perturbed activation) using a heatmap of validation AUROC with ResNet-50 (Figure 6). The darker region indicates higher AUROC, suggesting optimal values of k 1 ≈ 1% (20) and k 2 ≈ 5% (100) for ResNet-50 model. Furthermore, the heatmap suggests that k 1 is far more critical hyperparameter than k 2 . The hyperparameter λ controls the weighting of Q in computing Q ′ , the predetermined OOD likelihood. The sensitivity analysis is presented in Figure 7 which shows near-OOD and far-OOD detection using FPR@95. It suggests optimal FPR@95 is achieved at λ ≈ 10 . Please refer to Appendix C.2 for sensitivity study of ε and Appendix C.4 for compatibility study with ISH [4] regularization.

Latency. AdaSCALE incurs extra forward pass to compute perturbed activation a ϵ . Also, top-k operations (time complexity: O ( D log D ) ) are applied to Q and C o to estimate OOD likelihood. Comparing variable vs.

fixed percentiles for scaling in Table 8 over 10,000 trials, we observe that variable percentiles induce higher latency, though the latency ratio decreases with higher-dimensional activation spaces.

6 Conclusion

We propose AdaSCALE , a novel post-hoc OOD detection method that dynamically adjusts the scaling process based on a sample's estimated OOD likelihood. Leveraging the observation that OOD samples exhibit larger activation shifts under minor perturbations, AdaSCALE assigns stronger scaling to likely ID samples and weaker scaling to likely OOD samples, enhancing ID-OOD separability. AdaSCALE achieves state-of-the-art performance as well as generalization across architectures requiring negligibly few ID samples, making it highly practical for real-world deployment.

7 Broader Impacts

This work has positive impact in trustworthy deep learning by enabling detection of OOD samples.

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

References

Jingkang Yang, Kaiyang Zhou, and Ziwei Liu. Full-spectrum out-of-distribution detection. International Journal of Computer Vision (IJCV) , 2023.

Eunsu Baek, Keondo Park, Jiyoon Kim, and Hyung-Sin Kim. Unexplored faces of robustness and out-of-distribution: Covariate shifts in environment and sensor domains. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 22294-22303, 2024.

Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection. In The Eleventh International Conference on Learning Representations (ICLR) , 2023.

Kai Xu, Rongyu Chen, Gianni Franchi, and Angela Yao. Scaling for training time and post-hoc out-of-distribution detection enhancement. In The Twelfth International Conference on Learning Representations (ICLR) , 2024.

Andrija Djurisic, Rosanne Liu, and Mladen Nikolic. Logit scaling for out-of-distribution detection. arXiv preprint arXiv:2409.01175 , 2024.

Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In International Conference on Learning Representations (ICLR) , 2017.

Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-ofdistribution image detection in neural networks. In International Conference on Learning Representations (ICLR) , 2018.

Weitang Liu, Xiaoyun Wang, John D. Owens, and Yixuan Li. Energy-based out-of-distribution detection. In Proceedings of the 34th Conference on Neural Information Processing Systems (NeurIPS) , 2020.

Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, Jacob Steinhardt, and Dawn Song. Scaling out-of-distribution detection for real-world settings. In International Conference on Machine Learning (ICML) , 2022.

Qinyu Zhao, Ming Xu, Kartik Gupta, Akshay Asthana, Liang Zheng, and Stephen Gould. Towards optimal feature-shaping methods for out-of-distribution detection. In The Twelfth International Conference on Learning Representations (ICLR) , 2024.

Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems (NeurIPS) , 2018.

Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. Proceedings of the 39th International Conference on Machine Learning (ICML) , 2022.

Jie Ren, Stanislav Fort, Jeremiah Liu, Abhijit Guha Roy, Shreyas Padhy, and Balaji Lakshminarayanan. A simple fix to mahalanobis distance for improving near-ood detection. arXiv preprint arXiv:2106.09022 , 2021.

Magesh Rajasekaran, Md Saiful Islam Sajol, Frej Berglind, Supratik Mukhopadhyay, and Kamalika Das. Combood: A semiparametric approach for detecting out-of-distribution data for image classification. In Proceedings of the 2024 SIAM International Conference on Data Mining (SDM) , pages 643-651. SIAM, 2024.

Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual-logit matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2022.

Jang-Hyun Kim, Sangdoo Yun, and Hyun Oh Song. Neural relation graph: a unified framework for identifying label noise and outlier data. Advances in Neural Information Processing Systems (NeurIPS) , 36, 2024.

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. Advances in Neural Information Processing Systems (NeurIPS) , 34, 2021.

Haojia Kong and Haoan Li. Bfact: Out-of-distribution detection with butterworth filter rectified activations. In International Conference on Cognitive Systems and Signal Processing (ICCSIP) , pages 115-129. Springer, 2022.

Mingyu Xu, Zheng Lian, Bin Liu, and Jianhua Tao. Vra: Variational rectifed activation for out-of-distribution detection. Advances in Neural Information Processing Systems (NeurIPS) , 2023.

Yiyou Sun and Yixuan Li. Dice: Leveraging sparsification for out-of-distribution detection. In European Conference on Computer Vision (ECCV) , pages 691-708. Springer, 2022.

Gerhard Krumpl, Henning Avenhaus, Horst Possegger, and Horst Bischof. Ats: Adaptive temperature scaling for enhancing out-of-distribution detection methods. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , pages 3864-3873, January 2024.

Xixi Liu, Yaroslava Lochman, and Christopher Zach. Gen: Pushing the limits of softmax-based out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023.

Rui Huang, Andrew Geng, and Yixuan Li. On the importance of gradients for detecting distributional shifts in the wild. Advances in Neural Information Processing Systems (NeurIPS) , 34, 2021.

Sima Behpour, Thang Doan, Xin Li, Wenbin He, Liang Gou, and Liu Ren. Gradorth: A simple yet efficient out-of-distribution detection with orthogonal projection of gradients. In Thirty-seventh Conference on Neural Information Processing Systems (NeurIPS) , 2023.

Jinggang Chen, Junjie Li, Xiaoyang Qu, Jianzong Wang, Jiguang Wan, and Jing Xiao. GAIA: Delving into gradient-based attribution abnormality for out-of-distribution detection. In Thirtyseventh Conference on Neural Information Processing Systems (NeurIPS) , 2023.

Sina Sharifi, Taha Entesari, Bardia Safaei, Vishal M. Patel, and Mahyar Fazlyab. Gradientregularized out-of-distribution detection. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors, European Conference on Computer Vision (ECCV) , pages 691-708, Cham, 2025. Springer.

Jaewoo Park, Yoon Gyo Jung, and Andrew Beng Jin Teoh. Nearest neighbor guidance for out-of-distribution detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023.

[28]

Bartłomiej Olber, Krystian Radlak, Adam Popowicz, Michal Szczepankiewicz, and Krystian

Chachuła. Detection of out-of-distribution samples using binary neuron activation patterns. In

Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

2023.

Jinsong Zhang, Qiang Fu, Xu Chen, Lun Du, Zelin Li, Gang Wang, xiaoguang Liu, Shi Han, and Dongmei Zhang. Out-of-distribution detection based on in-distribution data patterns memorization with modern hopfield energy. In The Eleventh International Conference on Learning Representations (ICLR) , 2023.

Litian Liu and Yao Qin. Fast decision boundary based out-of-distribution detector. In International Conference on Machine Learning (ICML) , 2024.

Litian Liu and Yao Qin. Detecting out-of-distribution through the lens of neural collapse. arXiv preprint arXiv:2311.01479 , 2023.

[32]

Mouïn Ben Ammar, Nacim Belkhir, Sebastian Popescu, Antoine Manzanera, and Gianni Franchi.

NECO: NEural collapse based out-of-distribution detection.

Conference on Learning Representations (ICLR)

, 2024.

In

The Twelfth International

,

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

Maximilian Granz, Manuel Heurich, and Tim Landgraf. Weiper: OOD detection using weight perturbations of class projections. In The Thirty-eighth Annual Conference on Neural Information Processing Systems (NeurIPS) , 2024.

Yao Zhu, YueFeng Chen, Chuanlong Xie, Xiaodan Li, Rong Zhang, Hui Xue, Xiang Tian, Yaowu Chen, et al. Boosting out-of-distribution detection with typical features. Advances in Neural Information Processing Systems (NeurIPS) , 35:20758-20769, 2022.

Rundong He, Yue Yuan, Zhongyi Han, Fan Wang, Wan Su, Yilong Yin, Tongliang Liu, and Yongshun Gong. Exploring channel-aware typical features for out-of-distribution detection. In Proceedings of the AAAI conference on artificial intelligence (AAAI) , volume 38, pages 12402-12410, 2024.

Terrance DeVries and Graham W Taylor. Learning confidence for out-of-distribution detection in neural networks. arXiv preprint arXiv:1802.04865 , 2018.

Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In Proceedings of the 33rd Conference on Neural Information Processing Systems (NeurIPS) , 2019.

Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting outof-distribution image without learning from out-of-distribution data. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2020.

Haipeng Xiong, Kai Xu, and Angela Yao. Fixing data augmentations for out-of-distribution detection, 2024.

Dan Hendrycks*, Norman Mu*, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple method to improve robustness and uncertainty under data shift. In International Conference on Learning Representations (ICLR) , 2020.

Dan Hendrycks, Andy Zou, Mantas Mazeika, Leonard Tang, Bo Li, Dawn Song, and Jacob Steinhardt. Pixmix: Dreamlike pictures comprehensively improve safety measures. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 16783-16792, June 2022.

Hongxin Wei, Renchunzi Xie, Hao Cheng, Lei Feng, Bo An, and Yixuan Li. Mitigating neural network overconfidence with logit normalization. In International Conference on Machine Learning (ICML) . PMLR, 2022.

Sudarshan Regmi, Bibek Panthi, Sakar Dotel, Prashnna K Gyawali, Danail Stoyanov, and Binod Bhattarai. T2fnorm: Train-time feature normalization for ood detection in image classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops , 2024.

Yonggang Zhang, Jie Lu, Bo Peng, Zhen Fang, and Yiu ming Cheung. Learning to shape in-distribution feature space for out-of-distribution detection. In The Thirty-eighth Annual Conference on Neural Information Processing Systems (NeurIPS) , 2024.

Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embeddings for out-of-distribution detection? In The Eleventh International Conference on Learning Representations (ICLR) , 2023.

Sudarshan Regmi, Bibek Panthi, Yifei Ming, Prashnna K Gyawali, Danail Stoyanov, and Binod Bhattarai. Reweightood: Loss reweighting for distance-based ood detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops , 2024.

Haodong Lu, Dong Gong, Shuo Wang, Jason Xue, Lina Yao, and Kristen Moore. Learning with mixture of prototypes for out-of-distribution detection. In The Twelfth International Conference on Learning Representations (ICLR) , 2024.

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

Zhipeng Zou, Sheng Wan, Guangyu Li, Bo Han, Tongliang Liu, Lin Zhao, and Chen Gong. Provable discriminative hyperspherical embedding for out-of-distribution detection. In The AAAI Conference on Artificial Intelligence (AAAI) , 2025.

Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. In International Conference on Learning Representations (ICLR) , 2019.

Jingyang Zhang, Nathan Inkawhich, Randolph Linderman, Yiran Chen, and Hai Li. Mixture outlier exposure: Towards out-of-distribution detection in fine-grained environments. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , 2023.

Xuefeng Du, Zhen Fang, Ilias Diakonikolas, and Yixuan Li. How does unlabeled data provably help out-of-distribution detection? In The Twelfth International Conference on Learning Representations (ICLR) , 2024.

Jianing Zhu, Yu Geng, Jiangchao Yao, Tongliang Liu, Gang Niu, Masashi Sugiyama, and Bo Han. Diversified outlier exposure for out-of-distribution detection via informative extrapolation. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems (NeurIPS) , volume 36, pages 22702-22734, 2023.

Xuefeng Du, Yiyou Sun, Jerry Zhu, and Yixuan Li. Dream the impossible: Outlier imagination with diffusion models. Advances in Neural Information Processing Systems (NeurIPS) , 36:60878-60901, 2023.

Sudarshan Regmi. Going beyond conventional ood detection, 2024.

Hualiang Wang, Yi Li, Huifeng Yao, and Xiaomeng Li. Clipn for zero-shot ood detection: Teaching clip to say no. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages 1802-1812, October 2023.

Ruiyuan Gao, Chenchen Zhao, Lanqing Hong, and Qiang Xu. Diffguard: Semantic mismatchguided out-of-distribution detection using pre-trained diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages 1579-1589, October 2023.

Yabin Zhang, Wenjie Zhu, Chenhang He, and Lei Zhang. Lapt: Label-driven automated prompt tuning for ood detection with vision-language models. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors, European Conference on Computer Vision (ECCV) , pages 271-288, Cham, 2025. Springer.

Tianqi Li, Guansong Pang, Xiao Bai, Wenjun Miao, and Jin Zheng. Learning tra nsferable negative prompts for out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 17584-17594, June 2024.

Yichen Bai, Zongbo Han, Bing Cao, Xiaoheng Jiang, Qinghua Hu, and Changqing Zhang. Idlike prompt learning for few-shot out-of-distribution detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 17480-17489, June 2024.

Jun Nie, Yadan Luo, Shanshan Ye, Yonggang Zhang, Xinmei Tian, and Zhen Fang. Out-ofdistribution detection with virtual outlier smoothing. International Journal of Computer Vision (IJCV) , 2024.

Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. In Proceedings of the International Conference on Learning Representations (ICLR) , 2022.

Leitian Tao, Xuefeng Du, Jerry Zhu, and Yixuan Li. Non-parametric outlier synthesis. In The Eleventh International Conference on Learning Representations (ICLR) , 2023.

Heng Gao, Zhuolin He, Shoumeng Qiu, and Jian Pu. Oal: Enhancing ood detection using latent diffusion, 2024.

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

Hengzhuang Li and Teng Zhang. Outlier synthesis via hamiltonian monte carlo for out-ofdistribution detection. In The Thirteenth International Conference on Learning Representations (ICLR) , 2025.

Jingkang Yang, Pengyun Wang, Dejian Zou, Zitang Zhou, Kunyuan Ding, WenXuan Peng, Haoqi Wang, Guangyao Chen, Bo Li, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, Dan Hendrycks, Yixuan Li, and Ziwei Liu. OpenOOD: Benchmarking generalized out-ofdistribution detection. In Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , 2022.

Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 and cifar-100 datasets. URl: https://www. cs. toronto. edu/kriz/cifar. html , 6(1):1, 2009.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine , 2012.

Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.

Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N , 7(7):3, 2015.

Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 3606-3613, 2014.

Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2017.

Sagar Vaze, Kai Han, Andrea Vedaldi, and Andrew Zisserman. Open-set recognition: A good closed-set classifier is all you need. In Proceedings of the International Conference on Learning Representations (ICLR) , 2022.

Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie. The inaturalist species classification and detection dataset. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 8769-8778, 2018.

Julian Bitterwolf, Maximilian Müller, and Matthias Hein. In or out? fixing imagenet out-ofdistribution detection evaluation. arXiv preprint arXiv:2306.00826 , 2023.

Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 15262-15271, June 2021.

Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. Proceedings of the International Conference on Learning Representations , 2019.

Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: A critical analysis of out-of-distribution generalization. ICCV , 2021.

Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International conference on machine learning , pages 5389-5400. PMLR, 2019.

Jingyang Zhang, Jingkang Yang, Pengyun Wang, Haoqi Wang, Yueqian Lin, Haoran Zhang, Yiyou Sun, Xuefeng Du, Kaiyang Zhou, Wayne Zhang, et al. Openood v1. 5: Enhanced benchmark for out-of-distribution detection. arXiv preprint arXiv:2306.09301 , 2023.

Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and 565 Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv 566 preprint arXiv:1504.06755 , 2015. 567

568

569

A Notations

Table 9 lists all the notations used in this paper. 570

Appendix

B Algorithm 571

The algorithm for computing adaptive scaling factor r is provided in Algorithm 1.

Algorithm 1 Computing the Adaptive Scaling Factor

Input: Input sample x , perturbation magnitude ε , model f θ , hyperparameters λ , k 1 , k 2 , p min , p max , ε , o , precomputed empirical CDF F Q ′

Output:

Scaling factor r

1: // Extract features and compute activation shifts

2: a ← f θ ( x ) {Original activation} 3: ∇ x z c ← ∂g W ( f θ ( x )) c ∂x {Gradient for predicted class c } 4: R ← o % of channel values with lowest |∇ x z c | 5: x ε ← x + ε · sign ( ∇ x z c ) · ✶ R {Perturb selected regions} 6: a ε ← f θ ( x ε ) {Perturbed activation} 7: a shift ←| a ε -a | {Compute activation shift} 8: // Compute OOD likelihood estimate 9: i 1 ← argsort ( a , desc = True )[: k 1 ] 10: Q ← ∑ i ∈ i 1 a shift i {Shift in top activations} 11: i 2 ← argsort ( a , desc = True )[: k 2 ] 12: C o ← ∑ i ∈ i 2 ReLU ( a ε i ) {Correction term} 13: Q ′ ← λ · Q + C o {OOD likelihood estimate} 14: // Compute adaptive percentile 15: p r ← (1 -F Q ′ ( Q ′ )) {raw ID likelihood from eCDF} 16: p ← p min + p r · ( p max -p min ) {Adjusted percentile} 17: // Compute scaling factor 18: P p ( a ) ← the p -th percentile value of all elements in a 19: r ← ∑ j a j / ∑ a j >P p ( a ) a j {Final scaling factor} 20: return r

C Additional studies

572

573

C.1 Additional observation in activation space. 574

Figure 8 shows perturbed activations a ε are, on average, higher for ID samples than for OOD samples. 575

C.2 Sensitivity study of ε 576

The sensitivity study of ε presented at Table 10 suggests the optimal value of ε to be around 0.5. 577

C.3 Image Perturbation. 578

We present the complete results of image perturbation study (FPR@95 ↓ / AUROC ↑ ) in Table 7.

C.4 ISH regularization:

Apart from enhancing the prior postprocessor ASH [3], SCALE [81] introduces a training regularization to emphasize samples with more distinct ID characteristics. We assess the performance (FPR@95 ↓ / AUROC ↑ ) of each method in ResNet-50 and ResNet-101 model following this regularization in Table 12. The results indicate that AdaSCALE maintains a substantial advantage, surpassing the second-best method, SCALE, by 12.56% / 5.82% and 20.46% / 1.21% in FPR@95 / AUROC for near- and far-OOD detection in ResNet-50, respectively. Moreover, AdaSCALE demonstrates superior performance beyond conventional OOD detection, with corresponding improvements of 4.10% / 5.87% and 9.70% / 1.12% in full-spectrum setting. Furthermore, ISH regularization further amplifies the performance gap between AdaSCALE-A and OptFS, enhancing the near-OOD detection improvement from 12.96% / 6.44% to 15.18% / 14.83% . These findings also generalize to ResNet-101 network.

579

580

581

582

583

584

585

586

587

588

589

590

592

D Hyperparameters

All hyperparameters are determined with respect to the AUROC metric using automatic parameter 593 search of OpenOOD [65, 80]. Although AdaSCALE may appear to require many hyperparameters, 594 our findings indicate that setting ( λ, k 1 , k 2 , o, ϵ ) to (10 , 1% , 5% , 5% , 0 . 5) consistently yields near595 optimal performance across all setups. Consequently, it can be inferred that only the hyperparameters 596 p min and p max need to be appropriately tuned for any new architecture for near-optimal performance. 597 We present final hyperparameter values of AdaSCALE-A and AdaSCALE-L in Table 13 and Table 14. 598

599

E CIFAR-results 600

E.1 WRN-28-10 601

E.2 DenseNet-101 602

F ImageNet-1k results 603

F.1 near-OOD detection 604

F.2 far-OOD detection 605

bold

, and the second-best results are underlined.

bold

, and the second-best results are underlined.

are bold

, and the second-best results are underlined.

F.3 Full-Spectrum near-OOD detection 606

and the second-best results are underlined.

F.4 Full-Spectrum far-OOD detection 607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The limitations is discussed in "Latency" heading in Section 5.2.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [No]

Justification: This paper does not include theoretical results.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: All experimental settings are provided to reproduce the results.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

739

740

741

742

743

744

745

746

747

748

749

750

751

752

753

754

755

756

757

758

759

760

761

762

763

764

765

Answer: [Yes]

Justification: The code (algorithm) is included in the supplementary materials.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: All details are discussed in the paper.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: The error bars are confirmed to be negligible. The mean performance across 3 trials is reported for CIFAR results. Following convention used in prior works, only official checkpoint provided PyTorch is used for each ImageNet result.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

812

813

814

815

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [No]

Justification: The experiments in this paper does not require any special compute resources.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: This research conforms with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: The paper discusses the positive societal impact in Section 7, but there are no clear negative societal impacts.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: This paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The original owners are properly credited along with terms of use.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: New assets introduced in the paper have been well documented and provided. Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [No]

Justification: LLM usage is not important component of the core methods in this research.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\n## TLDR:\n\nThe paper proposes a method for computing a score used for out-of-distribution (OOD) detection.\nThe authors use the well known energy score $E(x) = − log \\sum_{i=1}^{C} e(z_i(x))$, where $z_i$ is the logit of the i-th class.\nHowever, before computing $E(x)$, the authors rescale the activations (i.e., the feature vector), thus producing different logits than the baseline predictor would.\n\nThe authors report state-of-the-art (SotA) results on the OOD detection benchmark OpenOOD.\n\n## Method summary:\n\nFor the sake of the review, I will briefly introduce the key concepts from the paper. \n\nA classifier $h: \\mathcal{X} \\rightarrow \\mathcal{Y}$ can be decomposed into a feature extractor $f_\\theta: \\mathcal{X} \\rightarrow \\mathbb{R}^D$ and the prediction head $g_{\\mathcal{W}}: \\mathbb{R}^D \\rightarrow \\mathbb{R}^C$, where $D$ is the dimension of the feature vector (activations), $C$ is the number of classes, $\\theta$ parametrize the feature extractor and $\\mathcal{W}$ parametrize the head. Activations for a sample $x$ are $a=f_\\theta(x)$ and the logits are $z=g_\\mathcal{W}(f_\\theta(x)) = g_\\mathcal{W}(a)$. \n\nAdaSCALE computes the OOD score for a sample $x$ as $E(x) = − log \\sum_{i=1}^{C} e(z_i(x))$. \nBefore computing $E(x)$, AdaSCALE recomputes the activations (and therefore also the logits) as either $a_{\\text{scaled}} = a \\cdot e^r$ or $z_{\\text{scaled}} = z \\cdot r^2$, where $r\\in\\mathbb{R}$ is a scaling factor computed as $r=\\frac{ \\sum_{j} a_j}{\\sum_{j: a_j > P_p(a)} a_j}$ and $P_p(a)$ denotes the a-th percentile of elements of $a$. \n\nAdaSCALE does NOT use a fixed percentile $p$, but computes it as $p(x)=p_{\\text{min}} - (1-F_{Q'}(Q'(x))) (p_{\\text{max}} - p_{\\text{min}})$, where $p_{\\text{min}}, p_{\\text{max}} \\in [0, 1]$ are hyperparameters, $Q'(x)$ is a score computed as $Q'(x)=\\lambda Q(x) + C_o(x)$, $\\lambda\\in\\mathbb{R}$. Components of the score $Q'(x)$ are $Q(x)=\\sum_{j: j \\text{ are indices of }k_1 \\text{ highest values of }a} |a_j^\\epsilon(x^\\epsilon) - a_j(x)|$, where $x^\\epsilon$ is a perturbation of the observation $x$; The authors consider gradient based perturbations or random ones; The other component of $Q'$ is $C_o(x)=\\sum_{j: j \\text{ are indices of }k_2 \\text{ highest values of }a} ReLU(a_j^\\epsilon)$.\n\nSTRENGTHS AND WEAKNESSES:\nThe method is introduced in a structured manner, however, I believe that the structure could be improved. The authors first introduce observation perturbations, then they introduce the scores $Q$ and $C_o$ and the scaling factor $r$. Then they introduce the per sample percentile $p$. Only after this do they specify how they compute the energy score $E$. I would advise that the authors take the opposite route - first introduce the energy score $E$ and comment on how it is affected by the scaling $r$ of the activations. Then propose the changes to the scaling factor compared to previous works and show why the changes are sensible.\n\nThe authors report SotA results on the OpenOOD benchmark. AdaSCALE builds on top of previous methods which notice that clipping or scaling the model activations (feature vector) results in the energy score $E$ being more separable for ID and OOD data.\nThe novelty of AdaSCALE comes from the specific process of scaling the activations.\n\n## Notes:\n- lines 18-19: \"... ability to handle previously unseen inputs, a task commonly known as OOD detection ...\"\n   - I would recommend reformulating this. We want predictive models to handle unseen inputs from ID = generalization. The sentence does not properly describe OOD detection\n- line 42: the percentile threshold $p$ is not introduced by this point in the paper\n- line 46: \"... We hypothesize that designing an adaptive scaling procedure based on each sample’s **predetermined OOD likelihood** offers greater control for enhancing ID-OOD separability ...\" \n   - The authors use the term **OOD likelihood** in the paper many times and refer to the score $Q(x)$ as such (line 179). OOD likelihood is $p_\\text{OOD}(x)$. If the likelihood is predetermined then the authors are assuming some fixed distribution as their OOD distribution. This however does not seem to be the case in the remainder of the paper. The use of the term seems inconsistent to me and I do not understand it. Please note that OOD likelihood is $p_{\\text{OOD}(x)} = p(x|\\text{OOD})$, but likelihood of $x$ being an OOD sample is $p(\\text{OOD}|x)$\n- lines 125-130: By \"classifier\" the authors refer to both $h$ and $g_\\mathcal{W}$. Consider e.g., using *classifier head* for $g_\\mathcal{W}$\n- lines 183-184: High $Q(x) \\implies \\sim \\text{OOD}$; lines 187-189: High $C_o(x) \\implies \\sim \\text{ID}$. Why is the combined score $Q'$ then the sum of these two terms with positive coefficients? (The authors use $\\lambda > 0$). Is there a typo here? Should $C_o$ be subtracted instead? \n- lines 208-210 and lines 212-215: Can you provide the reasoning behind this? I understand what you propose, but I do not see the motivation for this. It appears that the authors propose a modification of the SCALE method, where they use a dynamic, but heuristic scaling.\n- figure 5: How do we read the graph for AUROC? E.g. for the upper right corner we get $p_{\\text{min}}=90$, $p_{\\text{max}}=65$. Are the annotations for AUROC swapped? (min should be max and vice versa) Or are the axes reversed? (increasing from left to right, and from top to bottom?)\n- line 295: The term **trivial pixels** is not defined. Are these the pixels selected by gradient attribution?\n\n## Strengths:\n- Strong empirical results; Reported SotA results on OpenOOD benchmark\n- Good literature review with proper citations of methods that inspired AdaSCALE\n- Extensive result tables\n- Presence of ablation studies\n\n## Weaknesses:\n- Heuristic modification of previous work\n   - While the paper achieves strong empirical results, the proposed method, AdaSCALE, appears to be a complex combination of heuristics stacked upon existing techniques. The novelty lies in a sample-adaptive scaling factor, but the derivation of this factor lacks clear justification. The calculation of the percentile $p(x)$ depends on a score $Q'(x)$, which itself is a weighted sum of two other scores, $Q(x)$ and $C_o(x)$. Each of these components, including the use of perturbations and the selection of top-k activations, is introduced without a strong motivation. The approach seems like an engineering solution that was found to work well. Further, based on Tables 5 and 7, and the Figures 5,6,7, it seems that the authors tried many different options for the score $Q'$ and the hyperparameters. Though this is praiseworthy as an ablation study, it raises the question whether it does not lead to \"searching for the best results on the test set\".\n- Contradiction in the formulation of the method\n   - lines 183-184: High $Q(x) \\implies \\sim \\text{OOD}$; lines 187-189: High $C_o(x) \\implies \\sim \\text{ID}$. Why is the combined score $Q'$ then the sum of these two terms with positive coefficients? (The authors use $\\lambda > 0$). Is there a typo here? Should $C_o$ be subtracted instead? \n- Some formulations are not clear\n   - line 46: \"... We hypothesize that designing an adaptive scaling procedure based on each sample’s **predetermined OOD likelihood** offers greater control for enhancing ID-OOD separability ...\" \n      - The authors use the term **OOD likelihood** in the paper many times and refer to the score $Q(x)$ as such (line 179). OOD likelihood is $p_\\text{OOD}(x)$. If the likelihood is predetermined then the authors are assuming some fixed distribution as their OOD distribution. This however does not seem to be the case in the remainder of the paper. The use of the term seems inconsistent to me and I do not understand it. Please note that OOD likelihood is $p_{\\text{OOD}(x)} = p(x|\\text{OOD})$, but likelihood of $x$ being an OOD sample is $p(\\text{OOD}|x)$\n   - figure 5: How do we read the graph for AUROC? E.g. for the upper right corner we get $p_{\\text{min}}=90$, $p_{\\text{max}}=65$. Are the annotations for AUROC swapped? (min should be max and vice versa) Or are the axes reversed? (increasing from left to right, and from top to bottom?)\n   - line 295: The term **trivial pixels** is not defined. Are these the pixels selected by gradient attribution?\n\nQUESTIONS:\n## Core Method and its Motivation\n1) Contradictory Formulation of the $Q'$ Score:\n   - The paper states that a high $Q(x)$ value indicates a sample is likely OOD (lines 183-184), while a high $C_o(x)$ value indicates a sample is likely ID (lines 187-189). However, the score $Q'$ is formulated as $Q'(x) = \\lambda Q(x) + C_o(x)$.\n   - Could you please clarify the reasoning behind **adding** these two seemingly opposing scores?\n   - Is this a typographical error in the manuscript?\n\n2) Motivation Behind the Heuristic Design:\n   - The AdaSCALE method is a complex composition of several steps. While the empirical results are very strong, the paper lacks a clear motivation for why this specific combination of heuristics is the right approach.\n   - Could you provide a more detailed intuition or theoretical justification for the design? Have you tried some other approaches that did not work?\n   - The ablation studies show an extensive search over different components and hyperparameters. Can you provide assurance that the final method generalizes well, rather than being a configuration that has been over-tuned to the OpenOOD benchmark? From the Appendix D I see that the hyperparameters differ mostly in $p_{\\text{min}}$ and $p_{\\text{max}}$, but for some architectures $k_2$ is also substantially different.\n\n## Clarification on Terminology and Figures\n3)  Use of \"OOD Likelihood\":\n    - The paper repeatedly uses the term \"OOD likelihood\". Is the use consistent with the interpretation $p_{\\text{OOD}}(x)$?\n4)  Interpretation of Figure 5:\n    - I found the AUROC plot in Figure 5 difficult to interpret.\n    - Could you please clarify how to read this graph? Are the axes inverted, or are the labels swapped?\n5)  Undefined Terms:\n    - Could you please provide a definition for the term **\"trivial pixels\"**?\n\n\nThe empirical results appear very strong and I am open to raising my rating if these questions are addressed, especially questions 1 and 2.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-16"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper reveals that OOD inputs exhibit more pronounced activation shifts under minor perturbations compared to ID inputs. Leveraging this observation, it proposes a novel post-hoc OOD detection method based on adaptive scaling, where a lower scaling factor is applied to inputs with larger activation shifts, and a higher factor is used for more stable activations. Extensive experimental results across various architectures and datasets are provided to demonstrate the effectiveness of the proposed method.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n1. The idea appears novel and conceptually sound. \n\n2. The proposed method has been experimentally validated on various benchmarks and is supported by a comprehensive ablation study.\n\n**Weaknesses:**\n\n1. Although the proposed method achieves state-of-the-art performance in most cases through its novel adaptive scaling strategy, it relies on a scale factor computation procedure that involves dataset-specific and architecture-specific hyperparameter tuning. This requirement somewhat diminishes the overall contribution. To better assess the practicality of the method, please provide a comparison of the computational cost (e.g., memory usage and total inference time) between the proposed approach and existing baselines.\n\n2. Could you please provide further insight into the claim that \"OOD inputs exhibit more pronounced activation shifts under minor perturbations compared to ID inputs\"? For instance, under the proposed gradient-based perturbation mechanism described in Section 4.1.1, do OOD examples yield larger or smaller gradient values compared to ID examples? Additionally, could you offer experimental evidence or theoretical justification to explain why OOD inputs are more sensitive to minor perturbations, resulting in larger activation shifts? Clarifying this point would help substantiate the core intuition behind the method.\n\n3. The proposed method perturbs only a small number of trivial or randomly selected pixels to compute activation shifts. While the authors include an ablation study on the perturbation ratio of o%, Table 7 only reports results for o\\%=5%, 50%, and 100%. It remains unclear where the optimal boundary lies for the perturbation ratio. Interestingly, the results for 5% outperform those for 50% and 100%. Does this suggest that the top 5% of gradient values in OOD examples are more distant from those of ID samples, thus yielding stronger discriminative signals? A deeper explanation or additional experiments varying o% more finely would help clarify this behavior.\n\n4. Higher energy values indicate a higher likelihood of being OOD?  Please clarify it as stated in Lines 223–224.\n\nQUESTIONS:\nSee Weaknesses.\n\nLIMITATIONS:\nAlthough the proposed method achieves state-of-the-art performance in most cases through its novel adaptive scaling strategy, it relies on dataset-specific and architecture-specific hyperparameter tuning. This requirement somewhat diminishes the overall contribution. Moreover, the underlying reason why the proposed method works is not clear and lacks theoretical justification.\n\nIf the authors can adequately address the concerns raised above, I would be willing to consider raising my score.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes AdaSCALE, a dynamic and sample-specific OOD detection methods. The key innovation is replacing the static percentile threshold used in existing scaling methods (ASH, SCALE) with an adaptive mechanism that leverages activation shifts under minor perturbations to estimate OOD likelihood.\n\nSTRENGTHS AND WEAKNESSES:\n# Pros\n1. The paper identifies a genuine limitation in existing scaling methods - the use of static percentile thresholds across all samples regardless of their nature. The proposed adaptive mechanism is well-motivated.\n2. The key observation that OOD samples exhibit more pronounced activation shifts under minor perturbations is interesting and provides a principled way to estimate OOD likelihood without requiring extensive ID statistics.\n3. The experiments span 8 architectures on ImageNet-1k and 2 architectures on 3 benchmarks, demonstrating broad applicability.\n\n# Cons\nSee Questions\n\nQUESTIONS:\n1. Although the empirical observations on activation shifts are convincing, the paper lacks theoretical analysis of why this phenomenon occurs or under what conditions it holds. In particular, the method has many hyperparameters, and theoretical analysis similar to that in ODIN could provide theoretical guidance for the selection of hyperparameters.\n\n2. Too many hyperparameters. There are 8 hyperparameters in the method ($\\lambda$, k1, k2, o, $\\epsilon$, $p_{min}$, $p_{max}$, $n_{val}$), and although most hyperparameters are claimed to have good generalizability, the discussion is not comprehensive enough. For example: \n- There is no discussion of the joint impact of multiple parameters on performance, only the strongly correlated combination of (k1, k2), ($p_{min}, p_{max}$) is discussed, and there are 8 hyperparameters that need to be adjusted. It is difficult to determine the optimal result when you need to adjust these 8 parameters at the same time, rather than discussing the impact of each parameter on the final result separately; \n- Figure 7 also shows the sensitivity of performance to lambda on near-ood; \n- According to the content in the appendix, different architectures on different datasets choose different ($p_{min}, p_{max}$), which leads to the method When applied to a new architecture, it is necessary to retest to obtain the optimal parameters, which greatly weakens the applicability of the method.\n\n3. The proposed AdaSCALE requires input perturbations to dynamically calculate the scale factor. If in real-world scenarios, the input image may suffer from some image corruption, such as Gaussian blur and JPEG compression, will these influence the performance of AdaSCALE?\n\n4. Selection of baseline methods: lack of comparison with some simple and efficient methods, such as CombOOD, NNGuide.\n\n5. Is there a problem with the coordinates in Figure 5? From the current one, all AUROCs are obtained under the condition that pmin is greater than pmax. Can you provide accurate values ​​in Figure 5 to facilitate clear observation of hyperparameter sensitivity?\n\n6. Are the values ​​in Table 6 from multiple tests? Does the quality of the data affect the performance? It stands to reason that the larger n is, the better the performance will be, but the FPR95 on far-ood is better when n=100. Is this caused by random sampling of data?\n\n7. What are the specific settings of the pixel type in Table 7?\n\n8. The test environment in Table 8 is not explained. Why not compare with other methods?\n\nMinor question: The notation of the formula is confusing, such as $F_{Q′} (Q′)$, which can be optimized\n\nLIMITATIONS:\nNO\n\nThe authors should discuss the limitations of the proposed AdaSCALE, such as the choice of hyperparameters in practical applications.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nA post-hoc method to improve OOD detection is presented. The method improves on the activation-scaling approaches introduced in ASH and SCALE. In particular, ASH and SCALE use a fixed percentile threshold to determine which activations to scale. In the proposed method, this threshold is made adaptive on a per-sample basis. Experiments are performed on a variety of datasets and model architectures demonstrating the improvement over SCALE.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The paper is well-motivated and well written, with concepts and ideas clearly explained. \n2. Experimental validation is fairly comprehensive covering several baselines and various types of backbones from CNN-based type to transformer-based. And the proposed method appears to perform well when compared to the tested baselines.\n3. I appreciate the various ablations and hyperparameter studies in Section 5, particularly the results in Table 5 showing the importance of various components.\n\nImprovements/Questions:\n1. No distance based OOD detection methods are included (Mahalanobis and its variations, VLM, etc.) in experimental section. It would be nice to see how the proposed method compares against these. One advantage of distance-based methods is that they can operate on intermediate features enabling early exit in some use-cases.\n\n2. The proposed method is premised on the highest activations being sensitive to perturbations for OOD data. The type of perturbation added here is similar to the fast-gradient sign-method (FGSM) type of adversarial perturbation. These type of perturbations have been used to generate samples for adversarial training of deep neural network models, which results in those models being far more robust to adversarial attacks. My questions, therefore, are: \n\n    a. Is it the case that adversarially trained networks do not exhibit the same level sensitivity to perturbations to OOD data? This would be worth investigating.\n\n    b. would the proposed method work well for adversarially trained networks?\n\nQUESTIONS:\nPlease comment on the two questions raised in the review: inclusion of distance-based methods and analysis on adversarially trained models.\n\nLIMITATIONS:\nNo negative societal impact.\nAuthors address limitation of increased computational complexity and latency.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}