Paper: Out-Of-Distribution Detection With Smooth Training (ICLR-2024)

Reviewer comment (Theory):
What are the intuitions/interpretations of $\sqrt{\frac{C}{n}}$ in Equ(4), and the equations of theorem 1 and 2? The connection between the equations and the implications is not clear.

Author response:
We apologize for the confusion. $n$ is the number of training samples and $C$ is a uniform constant. When the number of the training samples is large enough, this term tends to 0 such that the risk of empirical predictor $\mathbf{f}_{\boldsymbol{\theta}_S}$  can approximate to the optimal risk. 
Theorem 1 states that under the right conditions, the model is likely to be overconfident in the ID data. Theorem 2 states that when the model is overconfident in the ID data, it will also be overconfident in the OOD data which have a small distribution discrepancy with ID data. We'll go into more detail in the revised version.

Reviewer comment (Reproducibility):
Can SMOT use the updated model trained on the fly to get the mask for perturbation?

Author response:
Thanks for your kind suggestion, we perform the experiment you described. We still train 300 epochs, in the first 100 epochs we perform the standard training and then we use the model in training to obtain the CAM to perform the SMOT training. The results are as follows:
|                         | Avg FPR95 | Avg AUROC |
|-------------------------|-----------|-----------|
| msp                     | 51.13     | 91.27     |
| SMOT trained on the fly | 25.05     | 95.44     |

It is shown what you described works well! Thanks again for your insightful comments. We will add these results and discussions to our revision.

Reviewer comment (Theory):
The conclusion of Theorem 1 is "given a sufficient amount of training data and a small optimal risk, ..., the issue of over-confidence for ID data is highly probable to arise". However, the equation is only related to "over-confidence" (which is assumed to refer to excessive maximum softmax probability according to Eq. 2) when the loss is exactly cross-entropy loss. If label smoothing is used as the loss (although it is later empirically shown not to work), then there won't be over-confidence by looking at Eq. 4.

Author response:
**A1:** Thanks for your valuable comments.  
Theorem 1 states that networks trained on ERM principle are likely to be overconfident in ID data. We do not discuss the vanilla label smoothing here. We agree that label smoothing can alleviate the problem of overconfidence in neural networks. However, this is more of a conclusion drawn from experimental results. It is hard to follow the your conclusion "*If we use label smoothing as the loss, then there won't be over-confidence by looking at Eq. 4*". In fact, label smoothing is not widely used in OOD detection. Our experimental results also demonstrate that vanilla label smoothing does not improve the model's OOD detection performance. We intuitively believe that this may be due to the fact that label smoothing is applied to raw ID samples, which is contrary to the goal of OOD detection.

Reviewer comment (Theory):
The same argument regarding loss functions could be applied to Theorem 2 as well. Furthermore, it is unclear how exactly the "over-confidence in OOD data" is reflected in Theorem 2. More elaboration and clarification is necessary.

Author response:
**A2:** We apologize for the misunderstanding.  
Theorem 2 states that for any OOD sample $x$, the upper bound of the risk that the well-trained model  
 $\mathbf{f}_{\boldsymbol{\theta}_S}$ misassigns it to the label space of the ID samples is the right-hand term of the inequality in Theorem 2 (I'm sorry, but openreview doesn't seem to be able to compile that equation).

Reviewer comment (Theory):
The concluding paragraph under Theorem 2 is confusing. It is unclear why we want to "access real OOD data to reduce the distribution discrepancy during training". It is also unclear what it means to "reduce the distribution discrepancy" (the \( d(\theta) \) in Theorem 2?) between ID and OOD. Additionally, the sudden appearance of "limited training ID data", "overfitting", and "the failure of ID classification" as issues for OOD detection is not well explained.

Author response:
**A3:** Thanks for your insightful comments.  

In the OE approach, we are allowed to use surrogate OOD data to regularize the model, i.e., to allow the model to have low confidence on this data. However, it is clear that the surrogate OOD data has distributional differences from the real OOD data encountered during testing. Here REDUCE the distribution discrepancy refers to reducing the distribution discrepancy between the surrogate OOD data and the real OOD data.

Reviewer comment (Theory):
In Eq. 9, the use of a temperature-scaled exponential function seems somewhat arbitrary. The intuition behind it is unclear. Questions include: Why use this form? Why (t - 255)? What is the value range of t?

Author response:
**A5:** Thanks for pointing out this potentially confusing problem. We design the smoothing parameter function based on the following three principles：

- The smoothing parameter should be a monotonically decreasing function of the masking threshold, because the more regions are masked, the smoother its label should be.
- When no region is masked, the smoothing parameter should be (or close to) 0.
- When all regions are masked, the smoothing parameter should be (or close to) 1.

The designed temperature-scaled exponential function satisfies the above rules and can simply adjust the steepness of the function by one parameter $T$. Of course, other more complex functions or learnable functions can be considered, and this is our future work. $t$ is the masking threshold, ranging from 0 to 255, corresponding to the values in the generated heat map. We set $(t-255)$ because when the masking threshold $t$ is 255, the image will not be masked, and we should use hard label, i.e., $\epsilon = 0$.

Reviewer comment (Experiments):
A limitation of the experiments is that all considered OOD datasets are far-OOD, which are easier to detect. There should be more results on near-OOD splits (e.g., CIFAR-100 or Tiny ImageNet for CIFAR-10, SSB or NINCO for ImageNet), as these are more representative of real-world scenarios where OOD images can be extremely similar to ID images.

Author response:
**A6:** Thank you for your suggestion. We supplement experiments under the near-OOD setting, where we compared the OOD detection ability of model trained using SMOT loss with that of a model trained with normal cross-entropy loss, using CIFAR10 as the ID dataset and CIFAR100 and tinyimagenet as the OOD dataset, respectively, with the following results:  
|               | CIFAR100 |       | Tiny-ImageNet |       |
|---------------|----------|-------|---------------|-------|
|               | FPR95    | AUROC | FPR95         | AUROC |
| cross entropy | 62.03    | 87.31 | 59.68         | 87.23 |
| SMOT          | 48.14    | 90.69 | 42.29         | 91.30 |

Apparently SMOT works well under  near-OOD setting as well.

Reviewer comment (Experiments):
The baseline selection seems arbitrary. It is unclear how SMOT compares with recent top-performing methods (e.g., ASH [1] as identified by OpenOOD [2]). A highly relevant baseline is also missing (see "Related Work" for details).

Author response:
**A7:** Following your constructive comments, we compared ASH and SMOT on CIFAR10, and the results show that SMOT can outperform ASH:

|      | Avg FPR95 | Avg AUROC |
|------|-----------|-----------|
| ASH  | 52.17     | 91.04     |
| SMOT | 15.42     | 97.15     |

For the other two works you mentioned, they do inspire us a lot, especially [4]. The use of the classification accuracy of corrupted data on the base model to assign labels to the corrupted data is novel to us. But since the authors don't seem to have published it in conferences or journals, it has very few citations and we haven't noticed this work before. The biggest difference between ours and [4] is that we use masking as perturbation function, and we believe that our approach is more in line with the way humans perceive the world. Also our label assignment function is continuous while theirs is discrete. We are not sure which of these two approaches is better. We will explore this work more closely in a revised version later. We tentatively compared the performance of SMOT with [4] and [5] on CIFAR10, as follows:  
|          | Avg FPR95 | Avg AUROC |
|----------|-----------|-----------|
| [4]      | 18.27     | 96.84     |
| MixOE[5] | 13.55     | 97.59     |
| SMOT     | 15.42     | 97.15     |

As you can see, our method is slightly stronger than [4], but none of them can beat MixOE, which is reasonable because MixOE uses an extra dataset. Thanks again for your careful review!

Reviewer comment (Experiments):
An important missing ablation study is how SMOT compares with random masking/cropping. Including this would better justify SMOT's design of leveraging CAM to determine the masking region.

Author response:
**A9:** Thanks to your suggestion, we have added the experiment, with the randomly generated masks. Please see **A3** to **Reviewer H2kX**.

Reviewer comment (Novelty):
The Related Work section (Sec. 5) is not thorough or informative enough. The general idea of using corrupted/perturbed images associated with soft labels has been explored in at least two works in OOD detection [4, 5], with [4] being particularly relevant. A table comparison shows similarities in design between [4] and this work, making it unclear what advantages SMOT offers over [4] (e.g., less compute, or not requiring a pre-trained model). [4] should be referenced and included as an actual baseline to demonstrate that CAM-based masking and this work’s method for assigning \(\epsilon\) are superior to those in [4].

Author response:
**A7:** Following your constructive comments, we compared ASH and SMOT on CIFAR10, and the results show that SMOT can outperform ASH:

|      | Avg FPR95 | Avg AUROC |
|------|-----------|-----------|
| ASH  | 52.17     | 91.04     |
| SMOT | 15.42     | 97.15     |

For the other two works you mentioned, they do inspire us a lot, especially [4]. The use of the classification accuracy of corrupted data on the base model to assign labels to the corrupted data is novel to us. But since the authors don't seem to have published it in conferences or journals, it has very few citations and we haven't noticed this work before. The biggest difference between ours and [4] is that we use masking as perturbation function, and we believe that our approach is more in line with the way humans perceive the world. Also our label assignment function is continuous while theirs is discrete. We are not sure which of these two approaches is better. We will explore this work more closely in a revised version later. We tentatively compared the performance of SMOT with [4] and [5] on CIFAR10, as follows:  
|          | Avg FPR95 | Avg AUROC |
|----------|-----------|-----------|
| [4]      | 18.27     | 96.84     |
| MixOE[5] | 13.55     | 97.59     |
| SMOT     | 15.42     | 97.15     |

As you can see, our method is slightly stronger than [4], but none of them can beat MixOE, which is reasonable because MixOE uses an extra dataset. Thanks again for your careful review!

Reviewer comment (Presentation):
The references are not in an appropriate format (e.g., "ResNet18 He et al. (2016)") and there are mis-formatting issues, such as "Eq.equation 8" in "Training details".

Author response:
**A10:** Thanks for the heads up, we've corrected the error in the revised version.

Reviewer comment (Experiments):
It is a little bit expensive to use CAM for identifying those label-correlated regions. I would like to see the OOD detection performance with the randomly generated masks. For example, randomly masking 30%-70% of the image for smoothing training.

Author response:
**A1:** Thanks to your kind suggestion. Following your constructive comments, we have added the experiment, with the randomly generated masks. More detailed results and disucssions can be found in **A3** to **Reviewer H2kX**.

Reviewer comment (Novelty):
The SMOT framework is similar to the Outlier Exposure (OE) framework, the author should also compare the proposal with other Outlier exposure (OE) based methods, and discuss the advantages compared with the OE framework.

Author response:
**A3:** We agree with your point. Our approach is indeed similar to OE. Masked samples can be viewed as OOD samples. 

We would like to highlight the differences between ours and OE. Specificaly, we do smoothing between ID samples and OOD samples. The more ID samples are masked, the more it is considered an OOD sample. This makes the transition between ID and OOD smoother. Also, our OOD samples are created by simply masking ID samples without the need for an external dataset. We compared our method with some OE methods with the following results:
|       | FPR95 | AUROC |
|-------|-------|-------|
| OE[3]    | 12.41 | 97.85 |
| MixOE[4] | 13.55 | 97.59 |
| SMOT  | 15.42 | 97.15 |


As can be seen from the experimental results, SMOT is not as good as OE and MixOE. We would like to note that it's not a fair comparison. 

Thanks agin for your constructive comments. We will add the results and discussions to the revised paper.

Reviewer comment (Evaluation):
Although smooth training enhances Out-Of-Distribution (OOD) detection, there's a minor decrease in in-distribution accuracy compared to conventional training. An in-depth exploration of this trade-off could be beneficial.

Author response:
Thanks for your suggestion. 

Smooth training does lead to a minor decrease (from 95.12% to 94.54%) in classification accuracy of ID samples. Following your suggestion, we further explore the trade-off between OOD detection performance and ID classification performance on CIFAR-10. We do this by varying the values of the hyperparameters $\lambda$. The experimental results are as follows:
|               | Texture |       | SVHN  |       | iSUN  |       | Places |       | LSUN  |       | Average |       |        |
|---------------|---------|-------|-------|-------|-------|-------|--------|-------|-------|-------|---------|-------|--------|
|               | FPR95   | AUROC | FPR95 | AUROC | FPR95 | AUROC | FPR95  | AUROC | FPR95 | AUROC | FPR95   | AUROC | ID ACC |
| w/o smot      | 58.59   | 88.59 | 55.71 | 91.92 | 50.80 | 91.80 | 57.85  | 88.70 | 32.71 | 95.33 | 51.13   | 91.27 | 95.12  |
| $\lambda = 0.01$ | 35.93   | 94.25 | 18.92 | 96.82 | 25.74 | 96.01 | 46.27  | 91.26 | 12.38 | 97.96 | 27.78   | 95.26 | 94.72  |
| $\lambda = 0.05$ | 27.44   | 95.15 | 12.15 | 97.57 | 14.27 | 97.38 | 31.79  | 93.73 | 2.01  | 99.35 | 17.53   | 96.63 | 94.56  |
| $\lambda = 0.1$  | 23.01   | 96.24 | 8.27  | 98.21 | 12.27 | 97.89 | 31.52  | 93.88 | 2.04  | 99.56 | 15.42   | 97.15 | 94.54  |
| $\lambda = 0.3$  | 37.92   | 93.91 | 26.92 | 95.81 | 28.84 | 95.67 | 45.06  | 91.79 | 21.16 | 96.81 | 31.98   | 94.79 | 94.22  |
| $\lambda = 0.5$  | 26.24   | 95.65 | 21.05 | 96.32 | 19.68 | 96.89 | 43.83  | 91.96 | 14.09 | 97.67 | 25.97   | 95.70 | 94.50  |
| $\lambda = 1$    | 31.96   | 94.46 | 27.23 | 95.72 | 17.25 | 97.07 | 42.03  | 91.85 | 8.53  | 98.15 | 25.5    | 95.45 | 94.02  |

The experimental results show that the ID ACC of models trained with SMOT is lower than that of models trained with normal cross-entropy loss, and that larger $\lambda$ usually leads to lower ID ACC, but not necessarily to higher AUROC. In practice, we need to choose an appropriate $\lambda$ so that the model maintains both high ID classification ability and good OOD detection ability.

Reviewer comment (Experiments):
Further analysis could be devoted to how the results are sensitive to variations in hyperparameter settings. For instance, how essential is the use of a CAM heatmap to guide masking? What's the optimal way to establish the relationship between mask size and label smoothing hyperparameter?

Author response:
We apologize that we missed the important experiment of comparing with random masking. 

As suggested by you and other reviewers, we add this experiment on CIFAR10. Since the images in CIFAR10 is of 32\*32, we divide the image into 64 small 4\*4 squares, and in each loop, we sample a probability $p$ from the distribution of $Beat(\alpha, \beta)$, let each small square be masked with probability $p$, and then smooth the label. The  smoothing parameter is designed as $\epsilon(p) = (exp(p/T) - 1)/(exp(1/T)-1)$. We conducted experiments with different $\alpha, \beta$ and T. Results are as follows(The numbers in the table are the average AUROC/the average FPR95.):
| $(\alpha, \beta)$    | $T=10$        | $T=1$         | $T=0.3$       | $T=0.1$       |
|-----------|-------------|-------------|-------------|-------------|
| (1,1)     | 92.91/39.02 | 93.76/35.14 | 93.62/36.78 | 92.08/44.14 |
| (2,2)     | 91.50/37.48 | 91.27/42.00 | 90.30/41.09 | 91.47/45.07 |
| (2/3,2/3) | 89.38/44.34 | 90.97/41.33 | 89.31/46.17 | 92.24/41.27 |
| (5,2)     |91.79/43.34 | 90.95/44.55 | 91.59/46.87 | 91.79/43.34 |
| (2,5)     | 90.17/37.44 | 89.00/42.54 | 90.12/40.23 | 92.28/42.02 |
| 50,20)    | 91.23/45.54 | 93.28/36.55 | 85.33/54.66 | 91.83/42.89 |
| (20.50)   | 89.64/35.99 | 87.47/49.29 | 86.64/45.58 | 92.56/39.57 |

As can be seen from the experimental results, when CAM is not used to guide masking, it does not work well and in many cases has lower performance than using simple cross-entropy loss. This is because masking randomly does not necessarily result in a change in the label of the image. It doesn't make sense to soften the label when we mask the background

As for how to establish a relationship between the masking size and label smoothing hyperparameter, this is really a major drawback of SMOT at the moment. In our paper, we simply use a temperature-scaled exponential function with a adjustable temperature. A better approach might be to get the relation between masking size and smoothing hyperparameter from priori knowledge or to learn one such relation. This is our future research direction.

Reviewer comment (Experiments):
The paper would greatly benefit from additional experimental analysis regarding the hyper-parameter $\lambda$. There is a discernible balance to be struck between in-distribution (ID) accuracy and OOD performance, which varies with $\lambda$. The sensitivity of this trade-off to different datasets is not sufficiently addressed. I encourage the authors to explore this aspect further to enhance the utility of their approach.

Author response:
Thanks for your suggestion. 

Smooth training does lead to a minor decrease (from 95.12% to 94.54%) in classification accuracy of ID samples. Following your suggestion, we further explore the trade-off between OOD detection performance and ID classification performance on CIFAR-10. We do this by varying the values of the hyperparameters $\lambda$. The experimental results are as follows:
|               | Texture |       | SVHN  |       | iSUN  |       | Places |       | LSUN  |       | Average |       |        |
|---------------|---------|-------|-------|-------|-------|-------|--------|-------|-------|-------|---------|-------|--------|
|               | FPR95   | AUROC | FPR95 | AUROC | FPR95 | AUROC | FPR95  | AUROC | FPR95 | AUROC | FPR95   | AUROC | ID ACC |
| w/o smot      | 58.59   | 88.59 | 55.71 | 91.92 | 50.80 | 91.80 | 57.85  | 88.70 | 32.71 | 95.33 | 51.13   | 91.27 | 95.12  |
| $\lambda = 0.01$ | 35.93   | 94.25 | 18.92 | 96.82 | 25.74 | 96.01 | 46.27  | 91.26 | 12.38 | 97.96 | 27.78   | 95.26 | 94.72  |
| $\lambda = 0.05$ | 27.44   | 95.15 | 12.15 | 97.57 | 14.27 | 97.38 | 31.79  | 93.73 | 2.01  | 99.35 | 17.53   | 96.63 | 94.56  |
| $\lambda = 0.1$  | 23.01   | 96.24 | 8.27  | 98.21 | 12.27 | 97.89 | 31.52  | 93.88 | 2.04  | 99.56 | 15.42   | 97.15 | 94.54  |
| $\lambda = 0.3$  | 37.92   | 93.91 | 26.92 | 95.81 | 28.84 | 95.67 | 45.06  | 91.79 | 21.16 | 96.81 | 31.98   | 94.79 | 94.22  |
| $\lambda = 0.5$  | 26.24   | 95.65 | 21.05 | 96.32 | 19.68 | 96.89 | 43.83  | 91.96 | 14.09 | 97.67 | 25.97   | 95.70 | 94.50  |
| $\lambda = 1$    | 31.96   | 94.46 | 27.23 | 95.72 | 17.25 | 97.07 | 42.03  | 91.85 | 8.53  | 98.15 | 25.5    | 95.45 | 94.02  |

The experimental results show that the ID ACC of models trained with SMOT is lower than that of models trained with normal cross-entropy loss, and that larger $\lambda$ usually leads to lower ID ACC, but not necessarily to higher AUROC. In practice, we need to choose an appropriate $\lambda$ so that the model maintains both high ID classification ability and good OOD detection ability.

Reviewer comment (Experiments):
The SMOT technique appears to depend on a pre-trained model to generate the masking (noting that the use of random noise results in subpar OOD performance), a process which adds computational complexity. The paper does not elaborate on alternative methods for 'dirtying' clean images beyond masking or the application of random noise. Exploring and discussing potential alternative techniques would provide a more comprehensive understanding of the method's applicability and limitations.

Author response:
Thank you for your kind suggestion. 

In addition to using masking as perturbation function, we also use adding gaussian noise to inputs as perturbation function, which does not require additional pre-trained models. We report the experimental results in Table 9 in the Appendix:
|             | Texture |       | SVHN  |       | iSUN  |       | Places |       | LSUN  |       | Average |       |
|-------------|---------|-------|-------|-------|-------|-------|--------|-------|-------|-------|---------|-------|
| Method      | FPR95   | AUROC | FPR95 | AUROC | FPR95 | AUROC | FPR95  | AUROC | FPR95 | AUROC | FPR95   | AUROC |
| MSP         | 58.59   | 88.59 | 55.71 | 91.92 | 50.80 | 91.80 | 57.85  | 88.70 | 32.71 | 95.33 | 51.13   | 91.27 |
| SMOT(mask)  | 23.01   | 96.24 | 8.27  | 98.21 | 12.27 | 97.89 | 31.52  | 93.88 | 2.04  | 99.56 | 15.42   | 97.15 |
| SMOT(noise) | 41.40   | 93.05 | 36.78 | 94.64 | 27.91 | 95.87 | 44.64  | 91.40 | 23.40 | 96.77 | 34.68   | 94.35 |

It is shown that adding noise can also improve the OOD detection performance of the model.