Is Fine-tuning Needed? Pre-trained Language Models Are Near Perfect for Out-of-Domain Detection
Year: 2023

Abstract:
Out-of-distribution (OOD) detection is a critical task for reliable predictions over text. Finetuning with pre-trained language models has been a de facto procedure to derive OOD detectors with respect to in-distribution (ID) data. Despite its common use, the understanding of the role of fine-tuning and its necessity for OOD detection is largely unexplored. In this paper, we raise the question: is fine-tuning necessary for OOD detection? We present a study investigating the efficacy of directly leveraging pre-trained language models for OOD detection, without any model fine-tuning on the ID data. We compare the approach with several competitive fine-tuning objectives, and offer new insights under various types of distributional shifts. Extensive evaluations on 8 diverse ID-OOD dataset pairs demonstrate nearperfect OOD detection performance (with 0% FPR95 in many cases), strongly outperforming its fine-tuned counterparts. We show that using distance-based detection methods, pretrained language models are near-perfect OOD detectors when the distribution shift involves a domain change. Furthermore, we study the effect of fine-tuning on OOD detection and identify how to balance ID accuracy with OOD detection performance. Our code is publically available1.

heading: 1 Introduction
text: Despite recent successes, high-performing pretrained language models are still fragile under distribution shifts, making their applications to the real world challenging (Ribeiro et al., 2020). In most real-world settings, the train and test distributions are often not independent and identically distributed. Furthermore, test distributions are often non-stationary and can change over time. The problem of out-of-distribution (OOD) detection addresses the identification of anomalous data, enabling the model to abstain from prediction when it
1https://github.com/Uppaal/lm-ood
is not supposed to. This is especially important for high-risk settings like financial and medical applications, where unreliable predictions could incur great costs (Ulmer et al., 2020; Zhang et al., 2021).
In literature, a de facto procedure is to fine-tune a pre-trained language model on the in-distribution (ID) data2, and then derive the OOD detector based on the adapted model (Zhou et al., 2021; Hendrycks et al., 2020; Xu et al., 2021). The fine-tuned model is hypothesized to produce embeddings that are customized to the ID data. Thus, prior work focuses on the design of fine-tuning and expects the adapted representations to be more useful for OOD detection. Despite its common use, the understanding of the role of fine-tuning and its necessity for OOD detection is largely lacking in the field.
Motivated by this, we revisit the common procedure and raise the unexplored question: is finetuning necessary at all, for OOD detection? To answer this question, we introduce a simple and effective procedure for OOD detection, which does not require any model fine-tuning on the ID data. Specifically, we explore distance-based metrics for detection, which measure the relative distances of samples in the representation space of a pre-trained language model. The operating hypothesis is that embeddings of ID samples are closer to each other than the OOD sample embeddings. To the best of our knowledge, we are the first to explore distancebased OOD detection methods directly on a pretrained language model, rather than the fine-tuned models adopted in previous works.
We show that our method based on a pre-trained language model achieves near-perfect performance in detecting out-of-domain shifts, favorably outperforming its fine-tuned counterparts. For example, for 20NewsGroups (ID) vs. RTE (OOD), OOD detection with the best fine-tuning loss (Khosla et al., 2020) yields an FPR95 of 24.8%, while a pre-
2Note that the ID data is defined w.r.t. the downstream dataset of interest, not the pre-training data.
12813
trained language model can perfectly detect RTE as OOD with 0% FPR95. For comprehensive evaluations, we experiment on 8 diverse ID-OOD dataset pairs spanning semantic and background shifts, and show that the strong performance of using the pretrained model holds consistently. To better understand the strong performance, we further show that pre-trained models display strongly separated domain clusters, both qualitatively and quantitatively. The strong separation of domain clusters leads to the efficacy of distance-based OOD detection.
Even further, we systematically compare different fine-tuning objectives, and interestingly observe that the performance of distance-based OOD detection declines over the course of fine-tuning across all objectives, despite the increase in ID classification accuracy. To this end, we provide new insights that early stopping (Yao et al., 2007) can be a promising solution, if one desires a good tradeoff between OOD detection and ID classification performance.
Our contributions can be summarized as follows:
1. We propose a simple and effective method for zero-shot3 OOD detection, leveraging pretrained language models without fine-tuning on the ID data. Extensive experiments demonstrate its near-perfect performance (with 0% FPR95 in most cases), favorably outperforming its fine-tuned counterparts.
2. We conduct a comprehensive study to understand fine-tuning objectives and their impact on OOD detection. We offer new insights on their efficacy under various types of distribution shifts.
3. We perform qualitative and quantitative analysis on the embedding characteristics, explaining the strong performance of using a pretrained language model for OOD detection.

heading: 2 Preliminaries
text: OOD Detection For a supervised multi-class classification task, the labeled training dataset Din = {(xi, yi)}Ni=1 consists of samples from the joint distribution PXY , where X is the input space and Y = {1, · · · , C} is the label space. Given a testtime sample x′, OOD detection aims to identify whether x′ is in-distribution (ID) Pin or not, where Pin is the marginal of PXY on X . Formally, we
3We use the term “zero-shot” to refer to a setting where no (ID or OOD) data is used to update the model parameters.
denote the OOD detector as a binary function mapping G(x′) : X → {in, out}.
Types of Distribution Shifts Arora et al. (2021) categorize OOD samples by the type of distribution shift they exhibit in NLP problems. According to Ren et al. (2019), the representations h(x) can be decomposed into two independent and disjoint components—semantic features and background features. Semantic features are discriminative and strongly correlated with labels for prediction, while background features contain population-level statistics and are invariant across labels.
Based on the type of features in OOD samples, the distribution shift is categorized as semantic shift or background shift. An example of the semantic shift is the open-set classification problem that encounters novel classes at test time (Scheirer et al., 2012), where the semantic of x′ is outside the support of Y . Background shift is often seen when the domain or style of texts changes in the input space X while Y remains the same (Pavlick and Tetreault, 2016). We comprehensively consider both types of shifts later in our experiments in Section 4.

heading: 3 Methodology
text: In Section 3.1, we start by introducing OOD detection with pre-trained language models, which does not require any model fine-tuning on the ID dataset. We further consider OOD detection with model fine-tuning in Section 3.2.

heading: 3.1 OOD Detection with Pre-trained Models
text: We consider a pre-trained language model backbone h : X → Rd, which encodes an input x to a d-dimensional text embedding h(x).
The goal of OOD detection is to identify samples that do not belong to Pin. Note that the ID data is defined w.r.t. the downstream dataset Din of interest, instead of the pre-training data. Different from prior works, there is no fine-tuning/training on the ID samples, and the setup is thus labelled as zero-shot OOD detection.
We formulate the zero-shot OOD detector as a binary function mapping:
Gλ(x;h) = { in if S(x;h) ≥ λ out if S(x;h) < λ , (1)
where S(x;h) is the OOD scoring function, and λ is the threshold. By convention, λ is chosen so that
a high fraction of ID data (e.g., 95%) is above the threshold. We describe S(x;h) in details next.
We employ distance-based methods for zeroshot OOD detection, which measure the relative distances of samples in representation space. To the best of our knowledge, we are the first to use distance-based OOD detection directly with a pretrained language model, while previous works use models adapted to the ID data. The operating hypothesis is that the embeddings of ID samples are closer to each other than the OOD sample embeddings. Modeling the learned representation space as a mixture of multivariate Gaussians, Lee et al. (2018) used the Maximum Mahalanobis distance (Mahalanobis, 2018) to all class centroids as the score for OOD detection:
SMaha(x;h) = min c∈Y
(h(x)− µc)⊤
Σ−1 (h(x)− µc) ,
where Σ is the covariance matrix and µc is the mean embedding of class c. Both Σ and µc are estimated on the ID embeddings extracted from the pre-trained language model h(·).
Using Mahalanobis distance for OOD detection requires some distributional assumptions on the representation space. This is circumvented through non-parametric density estimation using nearest neighbors (Sun et al., 2022). The distance between a query point and its k-th nearest neighbor in the ID data is used for OOD detection:
SkNN(x, h) = −∥z− zk∥2,
where z and zk are the L2 normalized embeddings, for the query point x and its k-th nearest neighbor. In Section 5, we evaluate zero-shot OOD detection performance using both parametric (Maha) and non-parametric (KNN) distance functions.

heading: 3.2 OOD Detection with Fine-tuning
text: In contrast to the zero-shot OOD detection setup, an alternative strategy is to fine-tune the model on the ID dataset Din and then perform OOD detection w.r.t. the fine-tuned model. In what follows, we comprehensively consider three different fine-tuning objectives: (1) cross-entropy loss, (2) task-adaptive pretraining loss, and (3) supervised contrastive loss.
Cross-Entropy (CE) The cross-entropy loss is widely used for training neural networks, making it
an ideal baseline for our study. Given a pre-trained model, we fine-tune with the CE loss:
LCE = 1
N
N∑
i=1
− log e fy(xi;θ)
∑C j=1 e fj(xi;θ)
where fy is the logit output corresponding to the ground truth label y, and θ is the parameterization of the neural network.
Task-adaptive Pretraining (TAPT) Gururangan et al. (2020) show that multi-phase adaptive pretraining boosts downstream task performance of pre-trained language models. They introduce Task Adaptive Pre-Training (TAPT), which involves extending the unsupervised pre-training process (using the masked language modeling objective (Kenton and Toutanova, 2019)) with data for the downstream task, before fine-tuning to the same task using cross-entropy. TAPT improves generalization capabilities by providing a strong initialization for fine-tuning, and to the best of our knowledge, TAPT has not been used in the setting of OOD detection prior to our work.
Supervised Contrastive Learning (SupCon) By leveraging information on labels and increasing the number of positive pairs during contrastive training, SupCon (Khosla et al., 2020) has been shown to consistently outperform cross-entropy on largescale classification tasks (Gunel et al., 2020). The objective encourages embeddings of a class to be highly separated from other classes, boosting the performance of OOD detection on text classification tasks (Zhou et al., 2021). Formally,
LSupCon = − N∑
i=1
1
N |P (i)| ∑
p∈P (i) log exp(z⊤i zp/τ)∑ a∈A(i) exp (z ⊤ i za/τ) ,
where P (i) is the set of anchor instances from the same class as xi, A(i) is the set of all anchor instances, zi is the L2 normalized sentence embedding for xi, and τ is the temperature.
After fine-tuning, OOD detection is performed using a similar procedure as Equation 1, except that the scoring function S(x;h) is calculated using the fine-tuned model. While our primary focus is distance-based detection, we additionally consider two common output-based methods—maximum
softmax probability (MSP) (Hendrycks and Gimpel, 2017) and energy score (Liu et al., 2020). They derive OOD scores from the confidence or logits from the classification head of the model.

heading: 4 Experimental Setup
text: Datasets We adopt the benchmark in Hendrycks et al. (2020) and Zhou et al. (2021), examining 9 diverse ID-OOD dataset pairs. Specifically, we use the IMDB dataset (Maas et al., 2011) and SST-2 (Socher et al., 2013) on sentiment analysis, the 20NewsGroups (20NG) dataset (Lang, 1995) on topic classification, the RTE (Wang et al., 2018) and MNLI (Williams et al., 2018) on natural language inference, the English side of Multi30k (Elliott et al., 2016) on machine translation, the cross-intent dataset CLINC150 (Larson et al., 2019), and the NewsCategory multiclass classification dataset (Misra, 2018). Details of the data preparation are described in Appendix A.
With these datasets, we examine two main settings: out-of-domain (OoD) shift where ID and OOD examples come from different datasets (i.e., domains), and same-domain (SD) shift where ID and OOD examples come from the same domain but have disjoint sets of classes. In the OoD setting, we further categorize the ID-OOD pairs into the semantic shift and background shift. Particularly, IMDB and SST-2 are both sentiment analysis datasets that have the same set of classes but consist of examples from different domains. In the same-domain setting, we split the NewsCategory dataset, where we make disjoint sets of classes as ID and OOD (Appendix A).
Models We use RoBERTa (Liu et al., 2019), which is a commonly used pre-trained language model like BERT (Kenton and Toutanova, 2019). Both models have been used in prior work on OOD detection (Podolskiy et al., 2021; Hendrycks et al., 2020), but we choose RoBERTa as the diverse data it is pre-trained on has been shown to make it stronger for OOD detection (Zhou et al., 2021; Podolskiy et al., 2021; Hendrycks et al., 2020). We use embeddings of the beginning-of-sentence (BOS) token
as the sentence representation, and compare this to alternate approaches in Appendix C. Following Zhou et al. (2021), we fine-tune RoBERTa-base on downstream datasets for 10 epochs. For SupCon, we use a joint objective with Cross Entropy, with weight α = 2 to the SupCon loss. For TAPT, we pre-train the model for 3 epochs on the ID data. For distance-based OOD detection, we use sentence embeddings from the penultimate layer. We fine-tune all layers using Adam, with batch size 4, learning rate 10−5, and weight decay 0.01. Further details of implementation and configurations are in Appendix G.
Evaluation Metrics We report the following standard metrics: (1) the false positive rate (FPR95) of OOD samples when the true positive rate of ID samples is at 95%, (2) the area under the receiver operating characteristic curve (AUROC), (3) the area under the precision-recall curve (AUPR), and (4) ID classification accuracy (ID ACC).

heading: 5 Results and Analysis

heading: 5.1 Out-of-domain detection with pre-trained language models is near perfect
text: Table 2 shows the pre-trained model outperforming all its fine-tuned variants in the out-of-domain shift setting, and achieving near-perfect OOD detection on all ID-OOD pairs considered. In addition to comparisons with three fine-tuning objectives, we also compare with a competitive baseline proposed by Zhou et al. (2021), which fine-tunes a model with a novel contrastive objective. Taking 20NewsGroups (ID) vs. RTE (OOD) as an example, OOD detection with the best fine-tuning strategy (i.e., SupCon) yields an FPR95 of 24.8%. In sharp contrast, zero-shot OOD detection using the pre-trained language model can perfectly detect RTE as OOD with 0% FPR95. We investigate same-domain shift in-depth later in Section 5.3.
Figure 1 sheds some light on the strong performance of pre-trained language models for out-ofdomain detection. In the leftmost figure, we observe that large pre-trained language models create separate domain clusters of sentence embeddings for ID and OOD data, matching the findings of Aharoni and Goldberg (2020). The strong separation of clusters boosts the performance of distance-based OOD detection. In contrast, fine-tuning induces a model to divide a single domain cluster into multiple class clusters. When a fine-tuned model encounters an OOD datapoint, it attempts to classify
it by mapping it to one of the existing ID class clusters. However, due to the distributional difference of the datapoint, the model is unable to perfectly map such a point and OOD points end up in the space between the ID class clusters most similar to it. Fine-tuned representations of the data thus make distance-based OOD detection more challenging.

heading: 5.2 What’s the best way of fine-tuning for OOD detection?
text: While pre-trained models show strong out-ofdomain detection performance, they lack the classification ability on the ID dataset. This is expected
since the models are not optimized for the downstream classification task. Thus, we raise the next question: How can we fine-tune the model to accurately classify ID data while having reasonable OOD detection performance?
To answer this question, we comprehensively compare three fine-tuning objectives (c.f. Section 3.2), coupled with different OOD detection methods. Figure 2 depicts the effect of fine-tuning for OOD detection, for both semantic shift (top: 20NewsGroups vs. RTE) and background shift (middle: IMDB vs. SST-2). We highlight three key observations: (1) For distance-based methods,
the OOD detection performance worsens as the number of fine-tuning epochs increases, highlighting that early stopping is the key to strong OOD detection performance. For example, on 20NewsGroups (ID) vs. RTE (OOD), the model trained with TAPT for 1 epoch yields an AUROC of 95.5% (with Mahalanobis), which declines to 91.9% after 10 epochs of fine-tuning. To the best of our knowledge, we are the first to show the importance of early stopping on fine-tuning language models for distance-based OOD detection. (2) Irrespective of the fine-tuning objectives, distance-based OOD detection methods consistently outperform outputbased methods, particularly MSP using softmax confidence (Hendrycks and Gimpel, 2017) and energy score using logits (Liu et al., 2020). (3) Under semantic shift, out-of-domain detection using any of the three fine-tuning objectives displays similar performance on most ID-OOD pairs, bearing a large gap w.r.t. the pre-trained language model.
Linear Probing is Suboptimal To perform classification while preserving the OOD detection performance of a pre-trained model, one possible solution is linear probing (Alain and Bengio, 2016), i.e., fine-tuning the classification head to the downstream task, while keeping the weights of the pretrained model backbone unchanged. However, in Figure 6 (Appendix), we show that linear probing does not yield competitive classification performance. In particular, we observe the strongest fine-tuning objective (TAPT) only obtains an ID accuracy of 61% after 100 epochs of fine-tuning, compared to full network fine-tuning where an accuracy of 86% is achieved in 10 epochs.

heading: 5.3 Investigation on same-domain data shifts
text: In this subsection, we further investigate a more challenging type of data shift, where the test samples are from the same domain and thus can be distributionally very close to the ID data. This is in contrast to our evaluations in Sections 5.1 and 5.2, where the OOD samples are from different domains. To simulate same-domain shifts, we split the NewsCategory dataset into two sets with disjoint classes: one for ID, and another for OOD. The domain for both sets of classes is identical, while the semantic label sets are different. The allocation of classes is described in Table 5 (Appendix A).
Figure 2 (bottom) shows the effect of fine-tuning for detection in this challenging setup of samedomain shifts. A salient observation is that finetuning consistently improves OOD detection performance, across all training objectives. To better understand why the pre-trained model underperforms in this case, in Figure 3, we plot feature representations, before and after fine-tuning, respectively. As seen in the left of Figure 3, when both ID and OOD data are sampled from the same domain, their embeddings are highly overlapping. This explains the suboptimal performance of directly employing embeddings from the pre-trained language model. In contrast, fine-tuning creates stronger separability between ID and OOD data. Table 3 quantitatively confirms that fine-tuning leads to stronger ID-OOD separability (c.f. Equation 2).

heading: 5.4 Deeper look at embedding quality
text: We quantitatively measure the embeddings produced by both pre-trained and fine-tuned language models. We adopt the following three metrics as
in Ming et al. (2023): (1) inter-class dispersion, which is the average cosine similarity among pairwise class centroids, (2) intra-class compactness, which measures the average cosine similarity between each feature embedding and its corresponding class centroid, and (3) ID-OOD separability, which functions as a measure of domain gap be-
Training ID-OOD Separability ↑
tween ID and OOD. Formally,
Disp.(↑) = 1 C
C∑
i=1
1 C − 1 C∑
j=1
µi · µj1{i ̸= j}
Comp.(↓) = 1 C
C∑
j=1
1
N
N∑
i=1
zi · µj1{yi = j}
Sep.(↑) = 1|Dtestout | ∑
x′∈Dtestout
max j∈Y
zx′ · µj
− 1|Dtestin | ∑
x∈Dtestin
max j∈Y
zx · µj , (2)
where µi is the average of embeddings for samples in class i, and z is the L2 normalized embedding.
Table 4 shows us that fine-tuning encourages the model to embed the data into well-separated class clusters with high inter-class dispersion (measured in angular degrees). In contrast, the pre-trained model represents the entire domain as a homogeneous cluster containing data from all classes. Interestingly, the pre-trained model displays the strongest compactness, indicating the closeness among ID data points in the original representation space. Note that the ID accuracy is random for the pre-trained model, which is expected. Dispersion and compactness monotonically improve through fine-tuning, further indicating that finetuning encourages the model to project the data into well-separated and compact class-wise clusters. However, Figure 4 shows us that while finetuning improves ID-OOD separability for the samedomain shift, it has less impact on out-of-domain shifts. (Actual values and results for other objectives can be found in Appendix D.) This trend also echos our previous observations in Section 5.2 and Section 5.3, on OOD detection performance.

heading: 6 Related Work
text: The problem of OOD detection is different from domain adaptation (Ramponi and Plank, 2020), where a model is trained to generalize to a known target domain with the same label space. It is also different from selective prediction where a model abstains only when its confidence is low, irrespective of domain (El-Yaniv et al., 2010; Geifman and El-Yaniv, 2017; Kamath et al., 2020).
OOD Detection Methods A popular baseline is the calibration method Maximum Softmax Probability (MSP) (Hendrycks and Gimpel, 2017), that directly uses maximum class probability produced by the logits of a trained classifier. However, predictive confidence has been shown to be undesirably high for OOD samples, making MSP ineffective (Nguyen et al., 2015; Wei et al., 2022; Shen et al., 2021). Liu et al. (2020) propose using energy score for OOD detection, which better distinguishes in- and out-of-distribution samples than softmax scores. ReAct (Sun et al., 2021) improves the energy score by introducing a rectified activation, which reduces model overconfidence in OOD data. Sun and Li (2022) utilize logit sparsification to enhance the vanilla energy score. More recently, detection methods that utilize distances of samples in representation space, have risen as a promising class of OOD detection methods in both the vision (Mandelbaum and Weinshall, 2017; Lee et al., 2018; Sun et al., 2022; Ming et al., 2023) and multi-modal (Ming et al., 2022) regimes.
OOD Detection in NLP In the realm of NLP, model confidence using sentence embeddings has been shown to be a strong baseline with pre-trained transformers (Hendrycks et al., 2020; Desai and Durrett, 2020). Contrastive learning (Khosla et al., 2020; Gao et al., 2021; Jin et al., 2022) minimizes intra-class variance, leading to stronger OOD detection, especially in low data regimes (Zeng et al., 2021), and with Mahalanobis distance (Zhou et al., 2021; Podolskiy et al., 2021). Detection performance has also been strengthened using data aug-
mentation (Chen and Yu, 2021; Rawat et al., 2021), discriminative training (Zhan et al., 2021), mutual information maximization (Nimah et al., 2021), ensembles (Li et al., 2021) and prototypical networks in the few-shot setup (Tan et al., 2019). While most previous works perform fine-tuning on the ID data, we provide a comprehensive understanding on directly using the pre-trained model for zero-shot OOD detection.
Pre-trained vs Fine-tuned Pre-trained language models have been shown to learn implicit sentence representations, forming unsupervised domain clusters (Aharoni and Goldberg, 2020). Andreassen et al. (2021) and Kumar et al. (2021) showed that fine-tuning distorts pre-trained features, worsening accuracy on OOD generalization. However, to the best of our knowledge, we are the first to explore the effect of directly using pre-trained language models for OOD detection. Related to our work, Ming et al. (2022) show that pre-trained models can be used for zero-shot OOD detection. Different from ours, they perform OOD detection in the multi-modal space and calculate distances between the visual and textual representations.

heading: 7 Conclusion
text: In this paper, we explore the simple and effective setting of zero-shot OOD detection with pre-trained langage models. Our work departs from prior literature that typically requires fine-tuning on the ID data. Extensive evaluations demonstrate that pre-trained models are near-perfect for OOD detection when the test data comes from a different domain. We additionally investigate the effect of fine-tuning on OOD detection, and identify strategies to achieve both strong OOD detection performance and ID accuracy. We perform both qualitative and quantitative analysis on the embedding characteristics, explaining the strong performance of our method. We hope our work will inspire future work to the strong promise of using pre-trained models for OOD detection.
Ethical Considerations
Our project aims to improve the reliability and safety of large language models, which can be fragile under distribution shift (Ribeiro et al., 2020) and incur great costs (Ulmer et al., 2020; Zhang et al., 2021). By properly flagging anomalous data, our method can lead to direct benefits and societal impacts, particularly for safety-critical applications.
From a user’s perspective, our method can help improve trust in the language models. Our study does not involve any human subjects or violation of legal compliance. We do not anticipate any potentially harmful consequences to our work. As detailed in Appendix A, all of our experiments are conducted using publicly available datasets. Our code has been released for reproducibility. Through our study and releasing our code, we hope to raise stronger research and societal awareness toward the problem of out-of-distribution detection in natural language processing.
Limitations
We provide a comprehensive study on the efficacy of leveraging pre-trained language models for zeroshot OOD detection. Our method is thus limited to the setting of abstaining from prediction on all OOD data. This is more conservative than selective prediction, where the model must make predictions over as many ID & OOD points as possible while maintaining high accuracy. Despite this, OOD detection has lower risks to high-risk and safety-critical applications, where rare and anomalous data is more reasonably flagged to the expert. We believe our work provides new values and insights to the research community, especially on safe handling of distributional shifts when deploying pre-trained language models.
As discussed in our Ethical Considerations, the OOD detection problem is of significant use in high-risk settings, and should be incorporated into production-level pipelines. However, for the same reason, the OOD detection models must be also reliable to avoid any risk to the downstream applications.

heading: Acknowledgements
text: Li is supported in part by the AFOSR Young Investigator Award under No. FA9550-23-1-0184; UL Research Institutes through the Center for Advancing Safety of Machine Intelligence; Philanthropic Fund from SFF; and faculty research awards from Google, Meta, and Amazon. Hu is supported in part by a gift fund from ProtagoLabs. Any opinions, findings, conclusions, or recommendations expressed in this material are those of the authors and do not necessarily reflect the views, policies, or endorsements either expressed or implied, of the sponsors. We would like to thank Yifei Ming and the anonymous reviewers for helpful comments.

heading: A Preparation of Evaluation Benchmarks
text: For ID data, we use the train splits of the IMDB dataset on sentiment analysis (Maas et al., 2011), and the 20NewsGroups dataset on topic classification (Lang, 1995). For OOD data, we use the test splits of IMDB and 20NewsGroups, as well as the test splits from the sentiment classification dataset SST-2 (Socher et al., 2013), Natural Language Inference datasets RTE (Wang et al., 2018) and MNLI (Williams et al., 2018), the English source side of machine translation dataset Multi30k (Elliott et al., 2016), and the cross intent dataset CLINC150 (Larson et al., 2019). For MNLI, we use both the matched and mismatched test sets. For Multi30k, we combine the flickr 2016 English test set, mscoco 2017 English test set, and filckr 2018 English test. For CLINC150, we use the ‘out of scope’ class as the test set.
Inspired by Arora et al. (2021), we evaluate the detection performance under same-domain shift using the NewsCategory (Misra, 2018) dataset. We create two disjoint sets of classes, used as ID and OOD respectively. The domain for both sets of classes is identical, while the label sets differ. Notably, the NewsCategory dataset contains classes with similar semantics, for example ‘Arts’ and ‘Arts & Culture’. To ensure the semantic distinction between the ID and OOD classes, we categorize semantically similar classes to be entirely in either ID or OOD sets. The allocation of classes is summarized in Table 5. The dataset also has a strong class imbalance, so we sample data points according to a multinomial distribution, following Lample and Conneau (2019). Figure 5 shows the class frequencies before and after sampling.
More statistics about each dataset is available in Table 6. The listed datasets are intended for research purposes only. We do not make any commercial use of them.

heading: B Ablation on the Effect of Layers
text: The RoBERTa architecture consists of a backbone of multiple transformer layers, followed by a taskspecific head on top. For the classification task, this task-specific head consists of a dense layer followed by a classification projection layer. Zhou et al. (2021) use the features from after the dense layer for OOD detection. Instead, we use the features from before this layer. Table 7 shows the OOD detection performance using the representa-
tions from after the dense layer. Table 7 displays a worse performance than our main results in Table 2, where the representations from before the dense layer are used. Using the representations from before the task-specific head also makes zero-shot OOD detection possible, where the task-specific head is randomly initialized, but weights from the backbone of the pre-trained model are used.

heading: C Generation of Sequence Embeddings
text: Our experiments in the main paper use sentence embeddings obtained from the beginning-of-sentence (BOS) token. This practice is standard for most BERT-like models, including RoBERTa, which we use for our experiments. Prior work has also shown that using the average of all token embeddings can lead to the formation of similar domain-based clusters (Aharoni and Goldberg, 2020).
In this section, we compare this approach with the alternate approach of obtaining sequence embeddings as the average of all token embeddings in the sequence. Table 8 shows that both approaches yield almost identical performance on the OOD detection task.

heading: D Detailed Performance of Fine-tuning for OOD Detection
text: Table 9 summarizes the epoch-wise performance when fine-tuning on ID data, for the setting of OoD semantic shift. Table 10 shows the same for OoD background shift, while Table 11 shows this for same-domain (SD) shift.

heading: E Effect of Temperature in SupCon
text: Contrastive loss is shown to be a hardness-aware loss function, penalizing hard negative samples by
reducing tolerance to them (Wang and Liu, 2021). The temperature τ has been shown to control the tolerance to negative samples. As seen in Figure 7, low temperature leads to a uniform distribution with high separability in the learnt embedding space, but this can reduce tolerance to semantically similar samples, breaking underlying semantic structure. The temperature must be set optimally to balance the ‘uniformity-tolerance’ trade-off, having some tolerance to semantically similar examples. When IMDB is ID, we find OOD detection to be optimal at τ = 0.7, since the two classes of the
dataset share semantic similarities. However, with the 20NewsGroups topic classification task, we find a lower value of τ = 0.1 to be optimal. This is because a larger number of ID classes requires a stronger uniformity in the learnt distribution, and the weaker semantic similarities between classes assures that this uniformity does not hurt performance.
Tables 14, 16 and 15 show the effects of varying the temperature parameter τ in the SupCon loss, on OOD detection, in the settings of OoD semantic shift, OoD background shift and same-domain shift. All models are fine-tuned for 10 epochs.

heading: F Effect of k
text: Figure 8 shows us that k = 1 is consistently the optimal k for kNN, across fine-tuning objectives and distribution shifts. The detection per-
formance remains strong until k reaches the ID class size, which is between 400 and 600 for 20NewsGroups. After this point, the nearest neighbour for an ID and OOD point will both be outside the nearest ID class cluster, making both distances more comparable and harder to distinguish. With pre-trained models, the performance remains strong as there is no concept of class clusters and a single domain cluster is instead present.

heading: G Details on Implementation
text: We use RoBERTa from the HuggingFace library4, and use PyTorch to train our models. Hyperparameter search is performed through a grid search. Apart from the default parameters in the trainer module from HuggingFace, our selected hyperparameters are listed in Table 13.
4https://github.com/huggingface/ transformers
Computations The RoBERTa base model has approximately 125 million parameters, including those of the classification head. On a single NVIDIA GeForce RTX 2080 Ti GPU, training the model for 10 epochs takes approximately 8- 12 hours, and OOD detection for a single dataset
takes approximately 15 minutes. Over the scale of our experiments, we have used about 200 hours of GPU training time.
Multiple Runs Following the protocol in Arora et al. (2021), we report results over a single run.
τ ID Acc. MSP Energy KNN Mahalanobis AUROC↑ FPR95↓ AUROC↑ FPR95↓ AUROC↑ FPR95 AUROC↑ FPR95↓ 0.1 0.851 0.830 0.662 0.868 0.413 0.913 0.413 0.930 0.349 0.2 0.850 0.826 0.635 0.851 0.422 0.910 0.426 0.932 0.316 0.3 0.855 0.839 0.650 0.864 0.447 0.913 0.448 0.933 0.342 0.4 0.853 0.817 0.671 0.836 0.486 0.905 0.470 0.925 0.373 0.5 0.853 0.822 0.645 0.844 0.441 0.904 0.434 0.921 0.347 0.6 0.852 0.816 0.649 0.836 0.475 0.901 0.453 0.918 0.364 0.7 0.853 0.805 0.683 0.822 0.518 0.887 0.495 0.903 0.417 0.8 0.854 0.805 0.673 0.827 0.506 0.903 0.468 0.920 0.394 0.9 0.854 0.818 0.668 0.840 0.483 0.902 0.483 0.920 0.399 1 0.853 0.799 0.706 0.814 0.509 0.894 0.489 0.912 0.400
Table 14: Effect of the temperature τ in SupCon finetuning, on OOD detection, for OoD semantic shift (20NewsGroups→RTE).
However, in Table 12 we show results of a subset of experiments averaged over 3 runs. There is no significant difference between the results in Table 12 and Table 2, indicating that our experiments are stable across runs. Therefore, for the sake of computational resources and time, we stick to the single-run practice in our experiments.
τ ID Acc. MSP Energy KNN Mahalanobis AUROC↑ FPR95↓ AUROC↑ FPR95↓ AUROC↑ FPR95 AUROC↑ FPR95↓ 0.1 0.939 0.788 0.833 0.728 0.836 0.842 0.750 0.866 0.750 0.2 0.940 0.682 0.850 0.642 0.852 0.819 0.812 0.844 0.796 0.3 0.941 0.725 0.835 0.732 0.834 0.832 0.814 0.856 0.792 0.4 0.939 0.751 0.859 0.721 0.861 0.822 0.835 0.845 0.812 0.5 0.940 0.784 0.842 0.758 0.837 0.826 0.825 0.849 0.796 0.6 0.939 0.768 0.818 0.719 0.820 0.829 0.797 0.855 0.776 0.7 0.938 0.720 0.851 0.736 0.851 0.833 0.833 0.859 0.834 0.8 0.940 0.775 0.828 0.651 0.826 0.823 0.820 0.841 0.806 0.9 0.939 0.757 0.891 0.652 0.889 0.861 0.829 0.876 0.811 1 0.939 0.738 0.857 0.748 0.857 0.809 0.835 0.840 0.822
Table 15: Effect of the temperature τ in SupCon finetuning, on OOD detection, for OoD background shift (IMDB→SST-2).
τ ID Acc. MSP Energy KNN Mahalanobis AUROC↑ FPR95↓ AUROC↑ FPR95↓ AUROC↑ FPR95 AUROC↑ FPR95↓ 0.1 0.888 0.817 0.700 0.842 0.570 0.927 0.470 0.877 0.478 0.2 0.885 0.825 0.681 0.835 0.592 0.922 0.509 0.878 0.510 0.3 0.879 0.802 0.733 0.817 0.600 0.922 0.502 0.866 0.525 0.4 0.889 0.815 0.670 0.809 0.594 0.922 0.522 0.874 0.524 0.5 0.822 0.706 0.818 0.749 0.747 0.913 0.576 0.821 0.662 0.6 0.890 0.794 0.713 0.796 0.641 0.919 0.561 0.871 0.563 0.7 0.891 0.811 0.694 0.804 0.609 0.921 0.534 0.876 0.538 0.8 0.892 0.814 0.697 0.812 0.602 0.922 0.534 0.879 0.525 0.9 0.847 0.730 0.798 0.747 0.714 0.909 0.606 0.818 0.677 1 0.888 0.817 0.706 0.819 0.611 0.920 0.534 0.875 0.541
Table 16: Effect of the temperature τ in SupCon finetuning, on OOD detection, for same-domain shift with the NewsCategory dataset.
ACL 2023 Responsible NLP Checklist

heading: A For every submission:
text: 3 A1. Did you describe the limitations of your work?
Limitations section in end of main paper.
3 A2. Did you discuss any potential risks of your work? Ethical Considerations and Limitations sections in end of main paper.
3 A3. Do the abstract and introduction summarize the paper’s main claims? Section 1 contains all our main claims.
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? Section 4
3 B1. Did you cite the creators of artifacts you used? Section 4 and Appendix A
3 B2. Did you discuss the license or terms for use and / or distribution of any artifacts? Appendix A
3 B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? Appendix A
7 B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? We do not make use of any sensitive data, so there is no requirement to anonymize it.
3 B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? Appendix A
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. Appendix A
C 3 Did you run computational experiments? Section 5
3 C1. Did you report the number of parameters in the models used, the total computational budget (e.g., GPU hours), and computing infrastructure used? Appendix G
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.
3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found hyperparameter values? Section 4 and Appendix G
3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Appendix G
3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? Appendix G
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants? Left blank.
D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? No response.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? No response.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? No response.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? No response.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? No response.

heading: Future Work
text: We hope our work will inspire future work to the strong promise of using pre-trained models for OOD detection. Ethical Considerations
Our project aims to improve the reliability and safety of large language models, which can be fragile under distribution shift (Ribeiro et al. , 2020) and incur great costs (Ulmer et al. , 2020; Zhang et al. , 2021). By properly flagging anomalous data, our method can lead to direct benefits and societal impacts, particularly for safety-critical applications. From a user’s perspective, our method can help improve trust in the language models. Our study does not involve any human subjects or violation of legal compliance. We do not anticipate any potentially harmful consequences to our work. As detailed in Appendix A, all of our experiments are conducted using publicly available datasets. Our code has been released for reproducibility. Through our study and releasing our code, we hope to raise stronger research and societal awareness toward the problem of out-of-distribution detection in natural language processing. Limitations
We provide a comprehensive study on the efficacy of leveraging pre-trained language models for zeroshot OOD detection. Our method is thus limited to the setting of abstaining from prediction on all OOD data. This is more conservative than selective prediction, where the model must make predictions over as many ID & OOD points as possible while maintaining high accuracy. Despite this, OOD detection has lower risks to high-risk and safety-critical applications, where rare and anomalous data is more reasonably flagged to the expert. We believe our work provides new values and insights to the research community, especially on safe handling of distributional shifts when deploying pre-trained language models. As discussed in our Ethical Considerations, the OOD detection problem is of significant use in high-risk settings, and should be incorporated into production-level pipelines. However, for the same reason, the OOD detection models must be also reliable to avoid any risk to the downstream applications