Paper: Image Background Serves as Good Proxy for Out-of-distribution Data (ICLR-2024)

Reviewer comment (Experiments):
SSD [1] also uses a self-supervised algorithm for OOD detection; however, the article does not make any comparisons with SSD.

Author response:
We notice that the original manuscript of SSD only provides AUROC while ignoring the FPR95, which is more important in OOD detection. Nevertheless, we provide the comparison (AUROC) below. The CIFAR-10 is employed as the in-distribution data.
| OOD data | SVHN | LSUN | iSUN | Texture | Places | Average |
| --- | --- | --- | --- | --- | --- | --- |
| SSD | 99.60 | 96.50 | None | 97.60 | 95.20 | 97.225 |
| Ours (SSOD) | 99.44 | 99.11 | 98.16 | 99.59 | 98.42 | **98.944** |

Reviewer comment (Evaluation):
As shown in Tables 2, 4, and 5, SSOD results in a decrease in the model's accuracy for ID classification, which is not permissible for OOD detection. OOD detection requires the model to identify OOD data without affecting the accuracy of ID classification.

Author response:
SSOD only introduces marginal influence to the ID ACC. As a researcher and a practical developer of online applications, we focus on the overall performance of the method instead of entangling in these imperceptible changes. We provide the influence that SSOD introduced on ID ACC below.
| Method | ResNet-50 | SSOD (ResNet-50) | ResNet-101 | SSOD (ResNet-101) | MobileNet V3L | SSOD (MobileNet V3L) | ResNet-18 | SSOD (ResNet-18) |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Dataset | ImageNet-1K | ImageNet-1K | ImageNet-1K | ImageNet-1K | ImageNet-1K | ImageNet-1K | CIFAR-10 | CIFAR-10 |
| ID ACC | 76.13 | 76.09 (-0.04%) | 77.37 | 76.92 (-0.45%) | 74.04 | 73.94 (-0.1%) | 94.21 | 94.17 (-0.04%) |

Reviewer comment (Experiments):
The results reported in Table 1 show that SSOD does not achieve state-of-the-art (SOTA) performance on all OOD datasets, and there are many works with better performance not compared in Table 1: React [2], Dice [3], Ash [4].

Author response:
We evaluate our proposed SSOD on several benchmarks as shown in Table 1 and Table 2. The averaged results suggest that SSOD surpasses other methods by a large margin, i.e., **-6.28%** FPR95 on ImageNet and **-19.01%** FPR95 on CIFAR-10. Moreover, as a researcher in this field and to the best of our knowledge, our team doesn't believe there exists a method that performs absolutely better than all other existing methods on all benchmarks. Besides, we compare over 13 (MSP, MaDist, ODIN, GODIN, KLM, Energy, KNN, MOS, Fort, MCM, CSI, ReAct, ViM, and their variants) methods in our experiments, which is quite sufficient and enough to represent the current research situation. ReAct is shown in `Table 3`. SSOD achieves comparable performance on hard OOD detection as ReAct. More comparisons are demonstrated below. The ImageNet-1K is set as ID data and we compare the FPR95 of ReAct, Dice, and Ash. We will also attach this part to our revised manuscript. Thanks for your suggestion in filling the gap appearing in our experiments. Honestly, based on the results demonstrated in the original manuscript of Ash, it performs better than most current methods, and our SSOD also achieves top-ranked performance among them. **The following results are FPR95, lower is better.**
| Dataset (ID=ImageNet-1K) | iNaturalist | SUN | Places | Texture | Average |
| --- | --- | --- | --- | --- | --- |
| ReAct | 20.38 | 24.20 | 33.85 | 47.30 | 31.43 |
| Dice | 25.63 | 35.15 | 46.49 | 31.72 | 34.75 |
| Ash | 14.21 | 22.08 | 33.45 | 21.17 | 22.73 |
| Ours (SSOD) | 14.80 | 28.52 | 38.92 | 45.32 | 31.89 |
 
   | Dataset (ID=CIFAR-10) | SVHN | LSUN | iSUN | Texture | Places | Average |
   | --- | --- | --- | --- | --- | --- | --- |
   | ReAct | 41.64 | 11.46 | 12.72 | 43.58 | 43.31 | 30.54 |
   | Dice | 25.99 | 3.91 | 4.36 | 41.90 | 48.59 | 24.95 |
   | Ours (SSOD) | 2.12 | 4.42 | 10.06 | 1.91 | 7.44 | 5.19 |

Reviewer comment (Novelty):
The motivation is not convincing enough: I do not agree with the author's critique of the two-stage manner approach. Post-processing algorithms are actually more suitable for adapting to various pre-trained models, regardless of whether the model is trained with supervised learning or self-supervised learning.

Author response:
I think that there exist some misunderstandings. We agree with you that both post-processing and pre-processing methods are great for tackling OOD detection, such as ODIN, GODIN, ReAct, and KNN. However, when concerning practical applications, we find two obstacles that these methods encounter. Firstly, we have no suitable pre-trained weights for some specific tasks such as face recognition. This makes it costly to perform these methods. Besides, the deployment is usually complex as we have to compute and store many intermediate results or features. Secondly, our proposed SSOD can better utilize the image data from the target scenario since it's end-to-end trainable, which is more suitable in some situations than the two-stage manner approach. Again, we are here to emphasize that the two-stage manner methods are quite great for promoting the development of OOD detection. **The motivation of SSOD is to inject more insights into this research direction and provide a more suitable technical proposal in some specific scenarios.** For example, in surveillance video processing, if we have some data from the target scenarios, our SSOD can learn their backgrounds as OOD characters, and therefore, reduce false alarms when nothing appears on the video screen.

Reviewer comment (Experiments):
I recommend the author conduct experiments about ViT architectures.

Author response:
ViT is based on self-attention mechanisms. The methodology of SSOD is to extract pure background information from the input images. These prerequisites tell us that the key to applying SSOD to self-attention based models is to extract local image features. This topic has a lot of content and many details to discuss. Therefore, we will not include this part in this paper. **Our current solution is to sample image tokens before self-attention in ViT and add an OOD token to learn the discriminative characters of ID and OOD data.** The OOD token is similar to the CLS token, and we also add an OOD head to perform ID/OOD classification. Currently obtained results are better than ResNet on ImageNet, and we will explore more sampling methods. The manuscript of this extended version will be made publicly available on Arxiv after completion.

Reviewer comment (Evaluation):
The paper indicates that existing post-hoc methods are influenced by biases from pretrained models. Yet, as Table 3 reveals, the proposed technique doesn't perform optimally on ImageNet-O, which contains adversarial images for ImageNet. Given that the method's training relies on both the original dataset and model's intermediate predictions, is it possible the method still suffers from the bias?

Author response:
Honestly, SSOD is quite effective but not perfect. The methodology of SSOD is to obtain OOD supervision from the CLS head. Therefore, if the CLS head fails to detect the target object of the ID dataset, its generated ID/OOD supervision is likely to be invalid. This tells us that SSOD suffers from the bias when the CLS head fails to identify the input images, i.e., fails to perform classification. We argue that it's hard to design a perfect method that can handle all scenarios. We present SSOD for injecting new thoughts into the sub-field of OOD syntheses.

Reviewer comment (Presentation):
In Tables 4 & 5, the shaded regions seem to obscure the lines, affecting clarity.

Author response:
This bug appears if the PDF is opened using Adobe and disappears if using Google Chrome. We will fix this point.

Reviewer comment (Theory):
The article uses some uncritical and unreasonable assumptions in the derivation of the probabilistic framework, such as setting T as sM+1, ignoring the possible differences between sM+1 and T; treating P(wi|x) as P(wi|x∈SID,x), ignoring the possibility that x may belong to the OOD data.

Author response:
I have to argue that using $T$ as $s_{M+1}$ is not an assumption, it is just an equivalent substitution. As depicted in `Eq 1`, both $s_i$ and $T$ are trainable parameters of neural networks, and what we do in `Eq 5` is just use $s_{M+1}$ to indicate $T$. Moreover, we argue that treating $P(w_i|x)$ as $P(w_i|x\in S_{ID}, x)$ is not an assumption as well. Based on the bayes' theorem, we have:

     $P(w_i|x)=P(w_i|x\in S_{ID}, x) P( x \in S_{ID}|x) + P(w_i|x\in S_{OOD}, x) P(x\in S_{OOD}|x)$.
     In Section 3.1, we have highlighted that $w_i$ indicates the ID categories, and $S_{ID}$ has no overlap with $S_{OOD}$. Therefore, the term $P(w_i|x\in S_{OOD}, x)$ equals zero.

Reviewer comment (Experiments):
The article uses a fixed and subjective threshold γ in the self-supervised sampling mechanism to determine whether an image block belongs to ID or OOD, which does not consider the possible differences and variations between different datasets, models, and categories.

Author response:
SSOD performs consistently well across whole benchmarks using $\gamma$ as 0.95. We manually try several different values of $\gamma$ on different benchmarks and find this parameter is stable. Due to the limited space, we didn't provide this part in ablation. Please refer to our response to **Reviewer #ajFn**, where we provide detailed ablations on $\gamma$. The more detailed experimental results on these parameters will be attached in our revised Appendix.

Reviewer comment (Writing):
There are some spelling mistakes, grammatical errors, and punctuation errors in the article; some irregular or inappropriate terms are used in the article, such as OOD-data-free model, OOD patch sampler, and so on.

Author response:
We will correct these errors in our revised manuscript.

Reviewer comment (Theory):
The derivation of formula (1) seems to lack a detailed explanation. Can a more complete mathematical derivation of this formula be provided?

Author response:
In Eq 1, $\sigma(\cdot)$ indicates the `Sigmoid` function, and $g_i(x)=-s_i+T$ is a score function. More concretely, $g_i(x)=-s_i(x)+T$, where both $s_i(x)$ and $T$ can be regarded as trainable neural networks. $s_i(x)$ changes with the input $x$. $T$ is the learnable bias term which is a constant. Therefore, we can use $T$ as $s_{M+1}$ since they are both unchanged with the input image $x$. The details about `Sigmoid` function can be found here: https://en.wikipedia.org/wiki/Sigmoid_function.

Reviewer comment (Writing):
There are some grammatical and spelling errors in the text, please fix them.

Author response:
We will correct these errors in our revised manuscript.

Reviewer comment (Evaluation):
There seems to be a subjective bias in the interpretation of the experimental results. Can more objective evidence be provided to support these interpretations?

Author response:
We compare all methods based on valid experiments, besides, for those results from the original copy, we highlight them as well. For example, in `Section 4.2`, we detail the evaluation protocol and the experimental settings. All conclusions are drawn from the experimental results. **We admire all of these investigated methods which have promoted the development of OOD detection and robust classification**. Our team has no subjective judgment during the evaluation procedure. We will refine the description and look forward to your detailed reply.

Reviewer comment (Writing):
In the first paragraph on page 1, the author mentions that "OOD detection empowers the model trained on the closed image set to identify unknown data in the open world". But there is no definition or difference between what is closed image set and open world. Please define and explain these two concepts clearly in the introduction.

Author response:
The closed image set indicates the image dataset with a fixed number of categories. For example, the ImageNet-1K is a closed image dataset with 1000 categories. For those objects not included within this scope, a conventional classification model trained on ImageNet-1K fails to identify them. The open world indicates the real world where any kind of image can appear. These terminologies usually appear in the field of **Open World Recognition**, and we will present a more detailed description. Besides, this survey [1] shows the overall view of OOD detection and robust classification, which may help to mitigate this concern.

Reviewer comment (Evaluation):
On page 4, paragraph 5, the author mentioned "Since the ImageNet-O mainly contains adversarial images, leading to the classifier's wrong prediction, SSOD reports higher FPR95 compared to the open world". SSOD reports higher FPR95 compared to the best previous methods", but no reason or mechanism is given as to why the adversarial images cause SSOD's performance to degrade.

Author response:
The failure of SSOD in adversarial images is led by incorrect supervision from the CLS head. Recall that the mechanism of SSOD is joint learning between the CLS head and the OOD head. Adversarial images lead to poor performance of the CLS head, and therefore, the OOD head encounters a performance drop as well. More concretely, in `Eq 9`, the poor CLS head will provide incorrect confidence $\hat{y}_i^{HW}$ for the OOD head.

Reviewer comment (Novelty):
Authors chose to proceed with the name SSOD for their work but the whole field of Semi-Supervised Object detection (SSOD) [1] already exists, creating a bit of a confusion.

Author response:
**Response to nomenclature**: Thanks a lot for your suggestion and the better name. Honestly, we omit this point during the writing of our manuscript. We chose SSOD as the name of our method only because of its suitable meaning, i.e., self-supervised sampling for OOD detection. We want to emphasize the self-supervised manner and the OOD proxy sampling. Your suggested SSOOD is clearer and more suitable since it indicates the sub-field of OOD detection. We will modify the method name in our revised manuscript.

Reviewer comment (Writing):
I recommend using SSOOD to avoid any confusion with an already established sub-field.

Author response:
**Response to nomenclature**: Thanks a lot for your suggestion and the better name. Honestly, we omit this point during the writing of our manuscript. We chose SSOD as the name of our method only because of its suitable meaning, i.e., self-supervised sampling for OOD detection. We want to emphasize the self-supervised manner and the OOD proxy sampling. Your suggested SSOOD is clearer and more suitable since it indicates the sub-field of OOD detection. We will modify the method name in our revised manuscript.

Reviewer comment (Presentation):
Authors claim that their first contribution is to provide a probabilistic interpretation of OOD, using which existing methods can be analyzed, but pushed the analysis section to the supplementary. In my opinion, if authors claim the probabilistic interpretation as an analysis tool, then it shouldn't be delegated to the supplementary.

Author response:
**Response to the presentation of results**: The probabilistic framework of OOD detection is one of our main contributions. We detail this part in `Section 3.1`, however, the interpretation of existing OOD methods from this view is attached in `Appendix A.1`. This is quite unsuitable. We are organizing our manuscript currently, and we plan to move a part of the related work and experimental setup to the Appendix and transfer the interpretation part from the Appendix to the main body. We have to admit that the organization of this manuscript is a little hurried. Thanks again for your suggestions for improving our manuscript.

Reviewer comment (Theory):
Authors show impressive results on several OOD benchmarks but the motivation that image background can serve as a good proxy for OOD data has some flaws.

Author response:
**Response to motivation and intuition 1**: SSOOD explores the image background as the OOD proxies, providing OOD supervision during the training of the binary classification head. Sailing from this fundamental premise, SSOOD encounters failure most in the following two cases. Firstly, the target object of the input image carries similar characters as the background of ImageNet. Secondly, the learned backgrounds in ImageNet can not cover the background of input images, for example, different domains or styles. Obviously, you fully have the core of SSOOD, including its superiority and limitations. An effective way to close this gap is to train the SSOOD with sufficient and diverse images. In our in-house application, we pre-train the SSOOD on ImageNet-1K and continue to train it on several combined datasets collected from our practical scenarios. The data from the target scenario significantly guarantees the performance of outlier detection.

Reviewer comment (Experiments):
Using the penguin image example from Fig. 2 teaches the network to consider the background (in this case "water") as a signal for OOD. This will be ineffective in datasets constructed from comics or cartoons, which is not one of the domains that authors evaluate their method on. This also explains why the scores are lower on OOD datasets constructed from SUN and Places because Imagenet is predominantly biased towards "organisms" and "food" with lower signals from indoor scenes and places. This raises the question: "Does this method work because of the choice of the OOD datasets used?" This is partly explained by the results on "Textures" (where the authors agree there is overlap with patterns in the ID classes and the results are low, but the reviewer believes this is just part of the story).

Author response:
**Response 1**: Thanks for your clarification, and we are very clear that we have fully got your point. **Your concern is that the model may learn a shortcut to identify all images as OOD if they have similar backgrounds in ImageNet.** For example, SSOOD performs better on iNaturalist, and this phenomenon is potentially caused by the similarity between the backgrounds of ImageNet and iNaturalist. Besides, you suggest that SSOOD should identify whether an image is ID or OOD mainly based on the foreground objects instead of focusing more on the backgrounds. This topic is quite vital and needs far more investigation and verification. Currently, we will perform an experiment that employs a subset (for example, we only use the categories of vegetables, clothing, and vehicles) of ImageNet as ID data to train the model from scratch. With this trained model, we evaluate it on iNaturalist where the image backgrounds are different. We naturally expect that the FPR95 of SSOOD is lower than MSP under this setting. However, it may be higher than the model trained on the whole ImageNet-1K. Your suggestion inspires us that there still exists a lot of work to fill, for example, how to guide the model to focus on the foreground objects solely instead of learning shortcuts from the backgrounds. On the other hand, we also emphasize the necessity of image backgrounds, since they play the role of OOD supervision. **An important topic is to balance the dependence degree on foreground objects and backgrounds during the ID/OOD identification.**

Reviewer comment (Experiments):
Some additional analysis is required on the iNaturalist dataset (or maybe another toy setup on a subset of Imagenet) to explain why the method works. If the OOD head is learning to detect any background patch as OOD, then what is the role of this in iNaturalist, where the background is usually water/trees/nature, etc.? From Imagenet, the network might have learned to flag backgrounds containing these regions as OOD, so does it ignore the ID category entirely and just focus on background? But that cannot be true since the ID performance is also higher. The interplay between the CLS head and OOD head is very important to completely understand why image background is a good proxy, and this is missing from the paper.

Author response:
**Response to motivation and intuition 2**: This is quite an amazing problem. I am trying to figure out your concern from my limited understanding. Firstly, the training of robust classification consists of OOD detection (binary classification) and conventional multi-category classification as shown in `Eq 11`, and therefore, the classification accuracy gets marginal influence. Besides, within the loss of the OOD head, we collect both ID patches (`objects in ImageNet, labeled as 1`) and OOD patches (`backgrounds in ImageNet, labeled as 0`) to supervise the training, thus the model will not ignore the ID category. In ImageNet vs. iNaturalist, the backgrounds of ImageNet usually appear like some lakes, trees, or nature, and the OOD head treats this information as OOD characters. During the inference, the trained OOD head will assign lower confidence (`note: lower confidence from the OOD head indicates a higher probability that the input is OOD data`) to iNaturalist since it is similar to the background of ImageNet. I doubt that I only get a part of your problem, and I am looking forward to your reply and continuing this discussion. Again, quite admire your insights.

Reviewer comment (Writing):
In the abstract, authors mention they leverage "local property of convolution" for OOD, but it has not been mentioned anywhere else. Can you elaborate what they mean by this?

Author response:
**Response to question 1**: The local property of convolution indicates the limited perceptive field of conventional neural networks. For example, using the ResNet-50 to extract the feature of an input image in the shape of 224x224x3, the yielded feature is in the shape of 2048x7x7, i.e., 7x7 patch features whose dimension is 2048. The local property indicates that the top-left (the first) feature patch only consists of local information from the top-left part of the image instead of global information. And that is the critical factor that SSOOD works. Still, we are extending SSOOD to self-attention-based models, and the key problem is how to extract pure background information since the self-attention mechanism fuses all image patches such as ViT and SwinTransformer.

Reviewer comment (Theory):
In eq. 9 the $y_i^{\text{OOD}}$ is the label for detecting OOD patches, right? In which case, patches with confidence lower than 5% ($1-\gamma$) should have a label 1 and not 0, right?

Author response:
**Response to question 2**: We design the OOD head as a binary classification head. Higher confidence outputted by the OOD head indicates a higher probability the input is ID data, i.e., **the ID data is labeled as 1 while the OOD data is labeled as 0 by the OOD head.** We term this head as OOD head may incur some misunderstanding. **Shortly, the output confidence of the OOD head reflects the probability that the input belongs to ID.** For example, if the output confidence is 0, then the input is OOD data; and if the output confidence is 1, then the input is quite likely ID data.

Reviewer comment (Writing):
In the 2nd sentence below Eq. 11, is it "During inference" or "During training/inference"? The second loss term in Eq. 11 is applied on a spatial map from what I understood, so why do we have to compute $P(x\in \mathcal{S}_{\mathbb{ID}}|x)$ explicitly during training? We just need that during inference, correct?

Author response:
**Response to question 3**: Right. This term (OOD factor) is only needed during the inference phase.

Reviewer comment (Presentation):
It appears that the principal interpretation derived from the probabilistic framework (Appendix A.1) might be more aptly positioned between Sections 3.1 and 3.2. Currently, the main motivation behind SSOD doesn't seem to be adequately emphasized.

Author response:
We will move a part of the content from Appendix A.1 to the main body of the manuscript, better illustrating our motivation.

Reviewer comment (Reproducibility):
Could you specify the number of patches used in the SSOD model? More specifically, what are the dimensions (height H and width W) in the last feature map?

Author response:
The dimensions of the feature map depend on the employed backbone and the input images. For example, using a 224x224x3 image and ResNet-50 backbone, the yielded feature map is in the shape of 2048x7x7, i.e., the feature channel is 2048 and the number of patches is 49. The number of employed patches is adaptive as demonstrated in Figure 2 and Eq 9. For instance, in Figure 2 (d), the patches in red/green are used as OOD/ID. The number of employed patches is about 45% of the overall image.

Reviewer comment (Experiments):
Does the performance of SSOD show sensitivity to the classification confidence parameter gamma?

Author response:
SSOD is stable. In our experiments, we set the $\gamma$ from 0.8 to 0.99 with a step of 0.05. Using the ImageNet vs. iNaturalist as the benchmark, and the ResNet-50 as the backbone. The detailed results are demonstrated below. Since the threshold may be different with the changing backbones, we don't detail this part for its marginal significance.
| $\gamma$ | 0.8 | 0.85 | 0.9 | 0.95 | 0.99 |
| --- | --- | --- | --- | --- | --- |
| FPR95 | 18.64 | 17.52 | 15.88 | 14.80 | 15.62 |

Reviewer comment (Evaluation):
While SSOD generally surpasses other baselines in performance, as seen in the tables, there are instances where other baselines demonstrate notably strong results (e.g., MOS in iNaturalist and KNN in Texture). What could be the main reason for these exceptional cases?

Author response:
The performance of different methods depends on both the distribution of the dataset and the parameter space of the model itself. To provide a convincing result, we test comparable methods on several benchmarks and compute the averaged performance. For example, in Table 1, the overall FPR95 and AUROC of SSOD are 1.89% and 91.26%, surpassing the following method with -6.28% FPR95 and +0.77% AUROC. SSOD reports competitive performance (however, poorer than KNN) on Texture, that is because Texture overlaps with ImageNet, we have demonstrated this part in Appendix A.5 (Failure Case Analyses). We suggest that KNN is a clustering-based method. Maybe in the Texture dataset, its yielded manifold and classification boundary are more compact than our discriminative SSOD, therefore, achieving the best FPR95 compared to current approaches.