Original: Semi-supervised novelty detection using ensembles with regularized disagreement
Revised: Semi-supervised novelty detection using ensembles with regularized disagreement

Original: Abstract
Revised: Abstract

Original: Deep neural networks often predict samples with high conﬁdence even when they come from unseen classes and should instead be ﬂagged for expert evaluation.
Revised: Deep neural networks often predict samples with high conﬁdence even when they come from unseen classes and should instead be ﬂagged for expert evaluation.

Original: Current novelty detection algorithms cannot reliably identify such near OOD points unless they have access to labeled data that is similar to these novel samples.
Revised: Current novelty detection algorithms cannot reliably identify such near OOD points unless they have access to labeled data that is similar to these novel samples.

Original: In this paper, we develop a new ensemble-based procedure for semi-supervised novelty detection (SSND) that successfully leverages a mixture of unlabeled ID and novel-class samples to achieve good detection performance.
Revised: In this paper, we develop a new ensemble-based procedure for semi-supervised novelty detection (SSND) that successfully leverages a mixture of unlabeled ID and novel-class samples to achieve good detection performance.

Original: In particular, we show how to achieve disagreement only on OOD data using early stopping regularization.
Revised: In particular, we show how to achieve disagreement only on OOD data using early stopping regularization.

Original: While we prove this fact for a simple data distribution, our extensive experiments suggest that it holds true for more complex scenarios: our approach signiﬁcantly outperforms state-of-the-art SSND methods on standard image data sets (SVHN/CIFAR-10/CIFAR-100) and medical image data sets with only a negligible increase in computation cost.
Revised: While we prove this fact for a simple data distribution, our extensive experiments suggest that it holds true for more complex scenarios: our approach signiﬁcantly outperforms state-of-the-art SSND methods on standard image data sets (SVHN/CIFAR-10/CIFAR-100) and medical image data sets with only a negligible increase in computation cost.

Original:  INTRODUCTION
Revised:  INTRODUCTION

Original: Despite achieving great in-distribution (ID) prediction performance, deep neural networks (DNN) often have trouble dealing with test samples that are out-of-distribution (OOD), i e. test inputs that are unlike the data seen during training.
Revised: Despite achieving great in-distribution (ID) prediction performance, deep neural networks (DNN) often have trouble dealing with test samples that are out-of-distribution (OOD), i e. test inputs that are unlike the data seen during training.

Original: In particular, DNNs often make incorrect predictions with high conﬁdence when new unseen classes emerge over time (e g. undiscovered bacteria [Ren et al., 2019], new diseases [Katsamenis et al., 2020]).
Revised: In particular, DNNs often make incorrect predictions with high conﬁdence when new unseen classes emerge over time (e g. undiscovered bacteria [Ren et al., 2019], new diseases [Katsamenis et al., 2020]).

Original: Instead, we would like to automatically detect such novel samples and bring them to the attention of human experts.
Revised: Instead, we would like to automatically detect such novel samples and bring them to the attention of human experts.

Original: Consider, for instance, a hospital with a severe shortage of qualiﬁed personnel.
Revised: Consider, for instance, a hospital with a severe shortage of qualiﬁed personnel.

Original: To make up for the lack of doctors, the  hospital would like to use an automated system for realtime diagnosis from X-ray images (Task I) and a novelty detection system, which can run at the end of each week, to detect outbreaks of novel disease variants (Task II) (see
Revised: To make up for the lack of doctors, the novel diseases are remarkably similar to known conditions. The unlabeled batch of inference-time data can be used to adapt a semi-supervised novelty detection approach to emerging novel diseases. hospital would like to use an automated system for realtime diagnosis from X-ray images (Task I) and a novelty detection system, which can run at the end of each week, to detect outbreaks of novel disease variants (Task II) (see

Original: Figure 1).
Revised: Figure 1).

Original: In particular, the detection algorithm can be ﬁnetuned weekly with the unlabeled batch of data collected during the respective week.
Revised: In particular, the detection algorithm can be ﬁnetuned weekly with the unlabeled batch of data collected during the respective week.

Original: While the experts are examining the peculiar X-rays over the course of the next week, the novelty detection model helps to collect more instances of the same new condition and can request human review for these patients.
Revised: While the experts are examining the peculiar X-rays over the course of the next week, the novelty detection model helps to collect more instances of the same new condition and can request human review for these patients.

Original: The human experts can then label these images and include them in the labeled training set to update both the diagnostic prediction and the novelty detection systems.
Revised: The human experts can then label these images and include them in the labeled training set to update both the diagnostic prediction and the novelty detection systems.

Original: This process repeats each week and enables both diagnostic and novelty detection models to adjust to new emerging diseases.
Revised: This process repeats each week and enables both diagnostic and novelty detection models to adjust to new emerging diseases.

Original: Note that, in this example, the novelties are a particular kind of out-of-distribution samples with two properties.
Revised: Note that, in this example, the novelties are a particular kind of out-of-distribution samples with two properties.

Original: First, several novel-class samples may appear in the unlabeled batch at the end of a week, e.g. a contagious disease will lead to several people in a small area to be infected.
Revised: First, several novel-class samples may appear in the unlabeled batch at the end of a week, e.g. a contagious disease will lead to several people in a small area to be infected.

Original: This situation is different from cases when outliers are assumed to be singular, e.g. anomaly detection problems.
Revised: This situation is different from cases when outliers are assumed to be singular, e.g. anomaly detection problems.

Original: Second, the novel-class samples share many features in common with the ID data, and only differ from known classes in certain minute details.
Revised: Second, the novel-class samples share many features in common with the ID data, and only differ from known classes in certain minute details.

Original: For instance, both ID and OOD samples are frontal chest X-rays, with the OOD samples showing distinctive signs of a pneumonia caused by a new virus.
Revised: For instance, both ID and OOD samples are frontal chest X-rays, with the OOD samples showing distinctive signs of a pneumonia caused by a new virus.

Original: In what follows, we use the terms novelty detection and OOD samples to refer to data with these characteristics.
Revised: In what follows, we use the terms novelty detection and OOD samples to refer to data with these characteristics.

Original: Automated diagnostic prediction systems (Task I) can already often have satisfactory performance [Calli et al., 2021].
Revised: Automated diagnostic prediction systems (Task I) can already often have satisfactory performance [Calli et al., 2021].

Original: In contrast, novelty detection (Task II) still poses a challenging problem in these scenarios.
Revised: In contrast, novelty detection (Task II) still poses a challenging problem in these scenarios.

Original: Many prior approaches can be used for semi-supervised novelty detection (SSND), when a batch of unlabeled data that may contain OOD samples is available, like in Figure 1. 

Revised: Many prior approaches can be used for semi-supervised novelty detection (SSND), when a batch of unlabeled data that may contain OOD samples is available, like in Figure 1.

Original: However, all of these methods fail to detect novel-class data when used with complex models, like neural networks.
Revised: However, all of these methods fail to detect novel-class data when used with complex models, like neural networks.

Original: Despite showing great success on simple benchmarks like
Revised: Despite showing great success on simple benchmarks like

Original: SVHN vs CIFAR10, SOTA unsupervised OOD detection methods perform poorly on near OOD data [Winkens et al., 2020] where OOD inputs are similar to the training samples.
Revised: SVHN vs CIFAR10, SOTA unsupervised OOD detection methods perform poorly on near OOD data [Winkens et al., 2020] where OOD inputs are similar to the training samples.

Original: Furthermore, even though unlabeled data can beneﬁt novelty detection Scott and Blanchard [2009], existing SSND methods for deep neural networks [Kiryo et al., 2017, Guo et al., 2020, Zhang et al., 2020b, Yu and Aizawa, 2019] cannot improve upon unsupervised methods on near OOD data sets.
Revised: Furthermore, even though unlabeled data can beneﬁt novelty detection Scott and Blanchard [2009], existing SSND methods for deep neural networks [Kiryo et al., 2017, Guo et al., 2020, Zhang et al., 2020, Yu and Aizawa, 2019] cannot improve upon unsupervised methods on near OOD data sets.

Original: Even methods that violate fundamental OOD detection assumptions by using known test OOD data for hyperparameter tuning [Liang et al., 2018, Lee et al., 2018, Yu and
Revised: Even methods that violate fundamental OOD detection assumptions by using known test OOD data for hyperparameter tuning [Liang et al., 2018, Lee et al., 2018, Yu and

Original: Aizawa, 2019] fail to work on challenging novelty detection tasks.
Revised: Aizawa, 2019] fail to work on challenging novelty detection tasks.

Original: Finally, large pretrained models seem to solve near
Revised: Finally, large pretrained models seem to solve near

Original: OOD detection [Fort et al., 2021], but they only work for extremely speciﬁc OOD data sets (see Section 5 for details).
Revised: OOD detection [Fort et al., 2021], but they only work for extremely speciﬁc OOD data sets (see Section 5 for details).

Original: This situation naturally raises the following question:
Revised: This situation naturally raises the following question:

Original: Can we improve semi-supervised novelty detection for neural networks ?
Revised: Can we improve semi-supervised novelty detection for neural networks ?

Original: In this paper, we introduce a new method that successfully leverages unlabeled data to obtain diverse ensembles for novelty detection.
Revised: In this paper, we introduce a new method that successfully leverages unlabeled data to obtain diverse ensembles for novelty detection.

Original: Our contributions are as follows:
Revised: Our contributions are as follows:

Original: • We propose to ﬁnd Ensembles with Regularized Disagreement (ERD), that is, disagreement only on OOD data
Revised: • We propose to ﬁnd Ensembles with Regularized Disagreement (ERD), that is, disagreement only on OOD data.

Original: Our algorithm produces ensembles just diverse enough to be used for novelty detection with a disagreement test statistic (Section 2).
Revised: Our algorithm produces ensembles just diverse enough to be used for novelty detection with a disagreement test statistic (Section 2).

Original: • We prove that training with early stopping leads to regularized disagreement, for data that satisﬁes certain simplifying assumptions (Section 3).
Revised: • We prove that training with early stopping leads to regularized disagreement, for data that satisﬁes certain simplifying assumptions (Section 3).

Original: • We show experimentally that ERD signiﬁcantly outperforms existing methods on novelty detection tasks derived from standard image data sets, as well as on medical image benchmarks (Section 4).
Revised: • We show experimentally that ERD signiﬁcantly outperforms existing methods on novelty detection tasks derived from standard image data sets, as well as on medical image benchmarks (Section 4).

Original:  PROPOSED METHOD
Revised:  PROPOSED METHOD

Original: In this section we ﬁrst introduce our proposed method to obtain Ensembles with Regularized Disagreement (ERD) and describe how they can be used for novelty detection.
Revised: In this section we ﬁrst introduce our proposed method to obtain Ensembles with Regularized Disagreement (ERD) and describe how they can be used for novelty detection.

Original: 2.1 TRAINING ENSEMBLES WITH REGULARIZED DISAGREEMENT (ERD)
Revised: 2.1 TRAINING ENSEMBLES WITH REGULARIZED DISAGREEMENT (ERD)

Original: Recall from Figure 1 that we have access to both a labeled training set S
Revised: Recall from Figure 1 that we have access to both a labeled training set S

Original: = { ( x i , y i ) }
Revised: = { ( x i , y i ) }

Original: ni =1 ∼ P , with covariates x i ∈
Revised: ni =1 ∼ P , with covariates x i ∈

Original: X ID and discrete labels y i ∈ Y , and an unlabeled set U , which contains both ID and unknown OOD samples.
Revised: X ID and discrete labels y i ∈ Y , and an unlabeled set U , which contains both ID and unknown OOD samples.

Original: Moreover, we initialize the models of the ensemble using the weights of a predictor with good in-distribution performance, pretrained on S .
Revised: Moreover, we initialize the models of the ensemble using the weights of a predictor with good in-distribution performance, pretrained on S .

Original: In the scenarios we consider, such a well-performing pretrained classiﬁer is readily available, as it solves Task I in Figure 1.
Revised: In the scenarios we consider, such a well-performing pretrained classiﬁer is readily available, as it solves Task I in Figure 1.

Original: The entire training procedure is described in Algorithm 1.
Revised: The entire training procedure is described in Algorithm 1.

Original: For training a single model in the ensemble, we assign a label c ∈ Y to all the unlabeled points in U , resulting in the c -labeled set that we denote as ( U, c ) :
Revised: For training a single model in the ensemble, we assign a label c ∈ Y to all the unlabeled points in U , resulting in the c -labeled set that we denote as ( U, c ) :

Original: = { ( x, c ) : x ∈ U } .
Revised: = { ( x, c ) : x ∈ U } .

Original: We then ﬁne-tune a classiﬁer f c on the union S ∪ ( U, c ) of the correctly-labeled training set S , and the unlabeled set ( U, c ) .
Revised: We then ﬁne-tune a classiﬁer f c on the union S ∪ ( U, c ) of the correctly-labeled training set S , and the unlabeled set ( U, c ) .

Original: In particular, we choose an early stopping time at whichvalidation accuracy is high and training error on S ∪ ( U, c )
Revised: In particular, we choose an early stopping time at which

Original: Input: Train set S , ID Validation set V , Unlabeled set U , Model ˜ f pretrained on S ,  size K
Revised: Input: Train set S , ID Validation set V , Unlabeled set U , Model ˜ f pretrained on S , Ensemble size K

Original: Result:
Revised: Result:

Original: ERD ensemble { f y i } Ki =
Revised: ERD ensemble { f y i } Ki =

Original: Sample K different labels { y 1 , ..., y K } from Y for c ← { y 1 , ..., y K } do // fine-tune K models f
Revised: Sample K different labels { y 1 , ..., y K } from Y for c ← { y 1 , ..., y K } do // fine-tune K models f

Original: c ← Initialize ( ˜ f ) ( U, c ) ← { ( x, c ) : x ∈ U } f c ← EarlyStoppedFineTuning ( f c , S ∪ ( U, c ); V ) return { f y i } Ki =
Revised: c ← Initialize ( ˜ f ) ( U, c ) ← { ( x, c ) : x ∈ U } f c ← EarlyStoppedFineTuning ( f c , S ∪ ( U, c ); V ) return { f y i } Ki =

Original: Input: Ensemble { f y i } Ki =1 , Test set T , O = ∅ , Threshold t 0 ,
Revised: Input: Ensemble { f y i } Ki =1 , Test set T , O = ∅ , Threshold t 0 ,

Original: Disagreement metric ρ
Revised: Disagreement metric ρ

Original: Result: O , i.e. the novel-class samples from T for x ∈ T do // run hypothesis test if ( Avg ◦ ρ )( f y 1 , ..., f y K )( x ) > t 0 then
Revised: Result: O , i.e. the novel-class samples from T for x ∈ T do // run hypothesis test if ( Avg ◦ ρ )( f y 1 , ..., f y K )( x ) > t 0 then

Original: O ← O ∪ { x } return O  is low.
Revised: O ← O ∪ { x } return O validation accuracy is high and training error on S ∪ ( U, c ) is low.

Original: We create a diverse ensemble of K classiﬁers f c by choosing a different artiﬁcial label c ∈ Y for every model.
Revised: We create a diverse ensemble of K classiﬁers f c by choosing a different artiﬁcial label c ∈ Y for every model.

Original: Intuitively, encouraging each model in the ensemble to ﬁt different labels to the unlabeled set U promotes disagreement, as shown in Figure 2.
Revised: Intuitively, encouraging each model in the ensemble to ﬁt different labels to the unlabeled set U promotes disagreement, as shown in Figure 2.

Original: In the next sections, we elaborate on how to use diverse ensembles for novelty detection.
Revised: In the next sections, we elaborate on how to use diverse ensembles for novelty detection.

Original: 2.2 ENSEMBLE DISAGREEMENT FOR NOVELTY DETECTION
Revised: 2.2 ENSEMBLE DISAGREEMENT FOR NOVELTY DETECTION

Original: We now discuss how we can use ensembles with disagreement to detect OOD samples and why the right amount of diversity is crucial.
Revised: We now discuss how we can use ensembles with disagreement to detect OOD samples and why the right amount of diversity is crucial.

Original: Note that we can cast the novelty detection problem as a hypothesis test with the null hypothesis
Revised: Note that we can cast the novelty detection problem as a hypothesis test with the null hypothesis

Original: H 0 : x ∈ X ID .
Revised: H 0 : x ∈ X ID .

Original: As usual, we test the null hypothesis by comparing a test statistic with a threshold t 0 :
Revised: As usual, we test the null hypothesis by comparing a test statistic with a threshold t 0 :

Original: The null hypothesis is rejected and we report x as OOD ( positive ) if the test statistic is larger than t 0 (Section 4.3 elaborates on the choice of t 0 ).
Revised: The null hypothesis is rejected and we report x as OOD ( positive ) if the test statistic is larger than t 0 (Section 4.3 elaborates on the choice of t 0 ).

Original: In particular, we use as test statistic the following disagreement score, which computes the average distance between the softmax outputs of the K models in the ensemble:
Revised: In particular, we use as test statistic the following disagreement score, which computes the average distance between the softmax outputs of the K models in the ensemble:

Original: [Equation]
Revised: [Equation]

Original: where ρ is a measure of disagreement between the softmax outputs of two predictors, for example the total variation distance ρ TV ( f i ( x ) , f j ( x ))
Revised: where ρ is a measure of disagreement between the softmax outputs of two predictors, for example the total variation distance ρ TV ( f i ( x ) , f j ( x ))

Original: = 12 (cid:107) f
Revised: = 12 (cid:107) f

Original: i ( x ) − f j ( x ) (cid:107) 1 used in our experiments 2 .
Revised: i ( x ) − f j ( x ) (cid:107) 1 used in our experiments 2 .

Original: We provide a thorough discussion on the soundness of this test statistic for disagreeing models and compare it with previous metrics in Appendix B.
Revised: We provide a thorough discussion on the soundness of this test statistic for disagreeing models and compare it with previous metrics in Appendix B.

Original: Even though previous work like Yu and Aizawa [2019] used a similar disagreement score, their detection performance is notably worse.
Revised: Even though previous work like Yu and Aizawa [2019] used a similar disagreement score, their detection performance is notably worse.

Original: The reason lies in the lack of diversity in their trained ensemble (see Figure 8a in Appendix B).
Revised: The reason lies in the lack of diversity in their trained ensemble (see Figure 3a in Appendix B).

Original: On the other hand Algorithm 1 without early stopping would lead to a too diverse ensemble, that also disagrees on ID points, and hence, has a high false positive rate (see Appendix K).
Revised: On the other hand Algorithm 1 without early stopping would lead to a too diverse ensemble, that also disagrees on ID points, and hence, has a high false positive rate (see Appendix K).

Revised: In 2 We also expect other distance metrics to be similarly effective.

Original: In the next section, we explain why novelty detection with this test statistic crucially relies on the right amount of ensemble diversity and how ensembles may achieve this goal if they are trained to have regularized disagreement.
Revised: the next section, we explain why novelty detection with this test statistic crucially relies on the right amount of ensemble diversity and how ensembles may achieve this goal if they are trained to have regularized disagreement.

Original: 2.3 DESIRED ENSEMBLE DIVERSITY VIA REGULARIZED DISAGREEMENT
Revised: 2.3 DESIRED ENSEMBLE DIVERSITY VIA REGULARIZED DISAGREEMENT

Original: For simplicity of illustration, let us ﬁrst assume a training set with binary labels and a semi-supervised novelty detection setting as depicted in Figure 2 a).
Revised: For simplicity of illustration, let us ﬁrst assume a training set with binary labels and a semi-supervised novelty detection setting as depicted in Figure 2 a).

Original: For an ensemble with two models, like in Figure 2 b), the model predictions agree on the blue and red areas and disagree on the gray area depicted in Figure 2 c).
Revised: For an ensemble with two models, like in Figure 2 b), the model predictions agree on the blue and red areas and disagree on the gray area depicted in Figure 2 c).

Original: Note that the two models in Figure 2 are just diverse enough to obtain both high power (ﬂag true OOD as
Revised: Note that the two models in Figure 2 are just diverse enough to obtain both high power (ﬂag true OOD as

Original: OOD) and low false positive rate (avoid ﬂagging true ID as
Revised: OOD) and low false positive rate (avoid ﬂagging true ID as

Original: OOD) at the same time.
Revised: OOD) at the same time.

Original: Previous methods that try to leverage unlabeled data to obtain more diverse ensembles either do not work with deep neural networks [Bennett et al., 2002, Zhang and Zhou, 2010, Jain et al., 2020] or do not disagree enough on OOD data [Yu and Aizawa, 2019], leading to subpar novelty detection performance (see Figure 8a in Appendix B).
Revised: Previous methods that try to leverage unlabeled data to obtain more diverse ensembles either do not work with deep neural networks [Bennett et al., 2002, Zhang and Zhou, 2010, Jain et al., 2020] or do not disagree enough on OOD data [Yu and Aizawa, 2019], leading to subpar novelty detection performance (see Figure 3a in Appendix B).

Original: To obtain the right amount of diversity, it is crucial to train ensembles with regularized disagreement on the unlabeled set: The models should disagree on the unlabeled OOD samples, but agree on the unlabeled ID points (Figure 3c).
Revised: To obtain the right amount of diversity, it is crucial to train ensembles with regularized disagreement on the unlabeled set: The models should disagree on the unlabeled OOD samples, but agree on the unlabeled ID points (Figure 3c).

Original: Thus, we avoid having too little disagreement as in Figure 3a), which results in low power, or too much diversity, resulting in high false positive rate as in Figure 3b).
Revised: Thus, we avoid having too little disagreement as in Figure 3a), which results in low power, or too much diversity, resulting in high false positive rate as in Figure 3b).

Original: In particular, if models f c predict the correct label on ID points and the label c on OOD data, we can effectively use disagreement to detect novel-class samples.
Revised: In particular, if models f c predict the correct label on ID points and the label c on OOD data, we can effectively use disagreement to detect novel-class samples.

Original: Since classiﬁers with good ID generalization need to be smooth, we expect the model predictions on holdout OOD data from the same distributions to be in line with the predictions on the unlabeled set.
Revised: Since classiﬁers with good ID generalization need to be smooth, we expect the model predictions on holdout OOD data from the same distributions to be in line with the predictions on the unlabeled set.

Original: In Section 3 we argue that the training procedure in Algorithm 1 successfully induces regularized disagreement and prove it in a synthetic setting.
Revised: In Section 3 we argue that the training procedure in Algorithm 1 successfully induces regularized disagreement and prove it in a synthetic setting.

Original: Our experiments in Section 4 further corroborate our theoretical statements.
Revised: Our experiments in Section 4 further corroborate our theoretical statements.

Original: Finally, we note that one could also use other regularization techniques like dropout or weight decay.
Revised: Finally, we note that one could also use other regularization tech- niques like dropout or weight decay.

Original: However, running a grid search to select the right hyperparameters can be more computationally expensive than simply using one run of the training process to select the optimal stopping time.
Revised: However, running a grid search to select the right hyperparameters can be more computationally expensive than simply using one run of the training process to select the optimal stopping time.

Original:  PROVABLE REGULARIZED DISAGREEMENT VIA EARLY STOPPING
Revised:  PROVABLE REGULARIZED DISAGREEMENT VIA EARLY STOPPING

Original: In this section, we show how using early stopping in Algorithm 1 prevents ﬁtting the incorrect artiﬁcial label on the unlabeled ID samples.
Revised: In this section, we show how using early stopping in Algorithm 1 prevents ﬁtting the incorrect artiﬁcial label on the unlabeled ID samples.

Original: Albeit for a simpliﬁed setting, this result provides a rigorous proof of concept and intuition for why ERD ensembles achieve the right amount of diversity necessary for good novelty detection.
Revised: Albeit for a simpliﬁed setting, this result provides a rigorous proof of concept and intuition for why ERD ensembles achieve the right amount of diversity necessary for good novelty detection.

Original: 3.1 PRELIMINARY DEFINITIONS
Revised: 3.1 PRELIMINARY DEFINITIONS

Original: We ﬁrst introduce necessary deﬁnitions to prepare the mathematical statement.
Revised: We ﬁrst introduce necessary deﬁnitions to prepare the mathematical statement.

Original: Recall that in our approach, in addition to the correct labels of the ID training set S , each member of the ensemble tries to ﬁt one label c to the entire unlabeled set U that can be further partitioned into ( U, c ) =
Revised: Recall that in our approach, in addition to the correct labels of the ID training set S , each member of the ensemble tries to ﬁt one label c to the entire unlabeled set U that can be further partitioned into ( U, c ) [Equation] U [Equation]

Original: ( U ID , c ) ∪ ( U OOD , c ) = { ( x, c ) : x ∈ U ID } ∪ { ( x, c ) : x ∈ U OOD } , where U ID :=
Revised: [Equation] [Equation] [Equation] , where U ID :

Original:  U ∩ X ID and U OOD :
Revised: = U ∩ X ID and U OOD :

Original: =
Revised: =

Original: U \ U ID .
Revised: U \ U ID .

Original: Moreover, assuming that the label of an ID input x is deterministically given by y ∗ ( x ) , we can partition the set ( U ID , c ) (see Figure 3b) into a subset of effectively “correctly labeled” samples ( U c ID , c ) and “incorrectly labeled” samples ( U ¬ c ID , c ) : ( U ¬ c ID , c ) :=
Revised: Moreover, assuming that the label of an ID input x is deterministically given by y ∗ ( x ) , we can partition the set ( U ID , c ) (see Figure 3b) into a subset of effectively “correctly labeled” samples ( U c ID , c ) and “incorrectly labeled” samples ( U ¬ c ID , c ) : ( U ¬ c ID , c ) :=

Original: { ( x, c ) : x ∈ U ID with y ∗ ( x ) (cid:54) =
Revised: { ( x, c ) : x ∈ U ID with y ∗ ( x ) (cid:54) =

Original: c } ( U c ID , c ) :=
Revised: c } ( U c ID , c ) :=

Original: { ( x, c ) : x ∈ U ID with y ∗ ( x ) =
Revised: { ( x, c ) : x ∈ U ID with y ∗ ( x ) =

Original: c } .
Revised: c } .

Original: Note that ( U ¬ c ID , c ) can be viewed as the subset of noisy samples from the entire training set S ∪ ( U, c ) .
Revised: Note that ( U ¬ c ID , c ) can be viewed as the subset of noisy samples from the entire training set S ∪ ( U, c ) .

Original: 3.2 MAIN RESULT
Revised: 3.2 MAIN RESULT

Original: We now prove that there exists indeed an optimal stopping time at which a two-layer neural network trained with gradient descent does not ﬁt the incorrectly labeled subset ( U ¬ c ID , c ) , under mild distributional assumptions.
Revised: We now prove that there exists indeed an optimal stopping time at which a two-layer neural network trained with gradient descent does not ﬁt the incorrectly labeled subset ( U ¬ c ID , c ) , under mild distributional assumptions.

Original: For the formal statement, we assume that the artiﬁcially labeled set S ∪ ( U, c ) is clusterable , i.e. the points can be grouped in K clusters of similar sizes.
Revised: For the formal statement, we assume that the artiﬁcially labeled set S ∪ ( U, c ) is clusterable , i.e. the points can be grouped in K clusters of similar sizes.

Original: Each class may comprise several clusters, but every cluster contains only samples from one class.
Revised: Each class may comprise several clusters, but every cluster contains only samples from one class.

Original: Any cluster may include at most a fraction ρ ∈ [0 , 1] of samples with label noise, e.g. ( U ¬ c ID , c ) .
Revised: Any cluster may include at most a fraction η ∈ [0 , 1] of samples with label noise, e.g. ( U ¬ c ID , c ) .

Original: We denote by c 1 , ..., c K the cluster centers and deﬁne the matrix C :=
Revised: We denote by c 1 , ..., c K the cluster centers and deﬁne the matrix C :=

Original: [ c 1 , ..., c K ] T ∈ R K × d .
Revised: [ c 1 , ..., c K ] T ∈ R K × d .

Original: Further, let λ NNC be a measure of how well a  two-layer neural network can separate the cluster [-centers ( λ NNC = 
-]
Revised: Further, let λ NN C be a measure of how well a randomly-initialized two-layer neural network can separate the cluster [-centers ( λ NNC = 
-]centers.

Original:  if c i =
Revised: We provide the formal deﬁnition of λ NN C in Appendix A. Intuitively, λ NN C is large if the cluster centers are well-separated and it vanishes if c i =

Original: c j for some i, j ≤ K ).
Revised: c j for some i, j ≤ K .

Original: Under these assumptions we have the following:
Revised: Under these assumptions we have the following:

Original: Proposition 3.1.
Revised: Proposition 3.1.

Original: (informal) It holds with high probability over the initialization of the weights that a two-layer neural network trained on S ∪ ( U, c ) perfectly ﬁts S , ( U c ID , c ) and ( U OOD , c ) , but not ( U ¬ c ID , c ) , after T (cid:39) (cid:107) C (cid:107) 2 λ NNC iterations.
Revised: (informal) It holds with high probability over the initialization of the weights that a two-layer neural network trained on S ∪ ( U, c ) perfectly ﬁts S , ( U c ID , c ) and ( U OOD , c ) , but not ( U ¬ c ID , c ) , after T (cid:39) (cid:107) C (cid:107) 2 λ NN C iterations.

Original: The precise assumptions for the proposition can be found in Appendix A. On a high level, the reasoning follows from two simple insights: 1.
Revised: The precise assumptions for the proposition can be found in Appendix A. On a high level, the reasoning follows from two simple insights: 1.

Original: When the artiﬁcial label is not equal to the true label, the ID samples in the unlabeled set can be seen as noisy samples in the set S ∪ ( U, c ) .
Revised: When the artiﬁcial label is not equal to the true label, the ID samples in the unlabeled set can be seen as noisy samples in the set S ∪ ( U, c ) .

Original: It is well known that early stopping prevents models from ﬁtting incorrect labels since noisy samples with incorrect labels are often ﬁt later during training (see e.g. theoretical and empirical evidence here Yilmaz and Heckel [2019], Li et al.
Revised: It is well known that early stopping prevents models from ﬁtting incorrect labels since noisy samples with incorrect labels are often ﬁt later during training (see e.g. theoretical and empirical evidence here Yilmaz and Heckel [2019], Li et al.

Original: Song et al.
Revised: Song et al.

Original: [2020], Liu et al.
Revised: [2020], Liu et al.

Original: In particular, our proof heavily relies on Theorem 2.2 of Li et al.
Revised: In particular, our proof heavily relies on Theorem 2.2 of Li et al.

Original: [2020] which shows that early stopped predictors are robust to label noise.
Revised: [2020] which shows that early stopped predictors are robust to label noise.

Original: Proposition 3.1 gives a ﬂavor of the theoretical guarantees that ERD enjoys.
Revised: Proposition 3.1 gives a ﬂavor of the theoretical guarantees that ERD enjoys.

Original: Albeit simple, the clusterable data model actually includes data with non-linear decision boundaries.
Revised: Albeit simple, the clusterable data model actually includes data with non-linear decision boundaries.

Original: On the other hand, the requirement that the clusters are balanced seems rather restrictive.
Revised: On the other hand, the requirement that the clusters are balanced seems rather restrictive.

Original: In our experiments we show that this condition is in fact more stringent than it should.
Revised: In our experiments we show that this condition is in fact more stringent than it should.

Original: In particular, our method still works when the number of OOD samples | U OOD | is considerably smaller than the number of
Revised: In particular, our method still works when the number of OOD samples | U OOD | is considerably smaller than the number of

Original: ID samples from any given class, as we show in Section 4.5.
Revised: ID samples from any given class, as we show in Section 4.5.

Original: 3.3 CHOOSING THE EARLY STOPPING TIME
Revised: 3.3 CHOOSING THE EARLY STOPPING TIME

Original: In practice, we avoid computing the exact value of T by using instead a heuristic for picking the early stopping itera- tion with the highest validation accuracy (indicated by the vertical line in Figure 4).
Revised: In practice, we avoid computing the exact value of T by using instead a heuristic for picking the early stopping iteration with the highest validation accuracy (indicated by the vertical line in Figure 4).

Original: As shown in the ﬁgure, the model ﬁts the noisy training points, i.e. ( U ¬ c ID , c ) , late during ﬁnetuning, which causes the validation accuracy to decrease, since the model will also predict the incorrect label c on some validation ID samples.
Revised: As shown in the ﬁgure, the model ﬁts the noisy training points, i.e. ( U ¬ c ID , c ) , late during ﬁnetuning, which causes the validation accuracy to decrease, since the model will also predict the incorrect label c on some validation ID samples.

Original: In Appendix J we show that the trend in Figure 4 is consistent across data sets.
Revised: In Appendix J we show that the trend in Figure 4 is consistent across data sets.

Original:  EXPERIMENTAL RESULTS
Revised:  EXPERIMENTAL RESULTS

Original: In this section we evaluate the novelty detection performance of ERD with deep neural networks on several image data sets.
Revised: In this section we evaluate the novelty detection performance of ERD with deep neural networks on several image data sets.

Original: On difﬁcult near OOD data sets, we ﬁnd that our approach outperforms all baselines, including SSND methods, but also methods operating in other, sometimes more favorable settings.
Revised: On difﬁcult near OOD data sets, we ﬁnd that our approach outperforms all baselines, including SSND methods, but also methods operating in other, sometimes more favorable settings.

Original: In addition, we discuss some of the trade-offs that impact ERD’s performance.
Revised: In addition, we discuss some of the trade-offs that impact ERD’s performance.

Original: 4.1 DATA SETS
Revised: 4.1 DATA SETS

Original: Our experiments focus on novel-class detection scenarios where the ID and OOD data share many similar features and only differ in a few characteristics.
Revised: Our experiments focus on novel-class detection scenarios where the ID and OOD data share many similar features and only differ in a few characteristics.

Original: We use standard image data sets (e.g. CIFAR10/CIFAR100) and consider half of the classes as ID, and the other half as novel.
Revised: We use standard image data sets (e.g. CIFAR10/CIFAR100) and consider half of the classes as ID, and the other half as novel.

Original: We also assess ERD’s performance on a medical image benchmark [Cao et al., 2020], where near OOD data consists of novel unseen diseases (e.g. X-rays of the same body part from patients with different conditions; see Appendix E for details).
Revised: We also assess ERD’s performance on a medical image benchmark [Cao et al., 2020], where near OOD data consists of novel unseen diseases (e.g. X-rays of the same body part from patients with different conditions; see Appendix E for details).

Original: Further, we also include far OOD data sets (e.g.
Revised: Further, we also include far OOD data sets (e.g.

Original: CIFAR10/CIFAR100 vs SVHN) for completeness.
Revised: CIFAR10/CIFAR100 vs SVHN) for completeness.

Original: For all scenarios, we used a labeled training set (e.g. 40K samples for CIFAR10), a validation set with ID samples (e.g. 10K samples for CIFAR10) and an unlabeled test set where half of the samples are ID and the other half are OOD (e.g. 5K ID samples and 5K OOD samples for CIFAR10 vs
Revised: For all scenarios, we used a labeled training set (e.g. 40K samples for CIFAR10), a validation set with ID samples (e.g. 10K samples for CIFAR10) and an unlabeled test set where half of the samples are ID and the other half are OOD (e.g. 5K ID samples and 5K OOD samples for CIFAR10 vs

Original: SVHN).
Revised: SVHN).

Original: For evaluation, we use a holdout set containing ID and OOD samples in the same proportions as the unlabeled set.
Revised: For evaluation, we use a holdout set containing ID and OOD samples in the same proportions as the unlabeled set.

Original: Moreover, in Appendix F.5 we present results obtained with a smaller unlabeled set of only 1K samples.
Revised: Moreover, in Appendix F.5 we present results obtained with a smaller unlabeled set of only 1K samples.

Original: 4.2 BASELINES
Revised: 4.2 BASELINES

Original: We compare our method against a wide range of baselines that are applicable in the SSND setting.
Revised: We compare our method against a wide range of baselines that are applicable in the SSND setting.

Original: Semi-supervised novelty detection.
Revised: Semi-supervised novelty detection.

Original: We primarily compare ERD to SSND approaches that are designed to incorporate a small set of unlabeled ID and novel samples.
Revised: We primarily compare ERD to SSND approaches that are designed to incorporate a small set of unlabeled ID and novel samples.

Original: The MCD method [Yu and Aizawa, 2019] trains an ensemble of two classiﬁers such that one model gives high-entropy and the other yields low entropy predictive distributions on the unlabeled samples.
Revised: The MCD method [Yu and Aizawa, 2019] trains an ensemble of two classiﬁers such that one model gives high-entropy and the other yields low entropy predictive distributions on the unlabeled samples.

Original: Furthermore, nnPU [Kiryo et al., 2017] considers a binary classiﬁcation setting, in which the labeled data comes from one class (i.e. ID samples, in our case), while the unlabeled set contains a mixture of samples from both classes.
Revised: Furthermore, nnPU [Kiryo et al., 2017] considers a binary classiﬁcation setting, in which the labeled data comes from one class (i.e. ID samples, in our case), while the unlabeled set contains a mixture of samples from both classes.

Original: Notably, both methods require oracle knowledge that is usually unknown in the regular SSND setting: MCD uses test OOD data for hyperparameter tuning while nnPU requires oracle knowledge of the ratio of OOD samples in the unlabeled set.
Revised: Notably, both methods require oracle knowledge that is usually unknown in the regular SSND setting: MCD uses test OOD data for hyperparameter tuning while nnPU requires oracle knowledge of the ratio of OOD samples in the unlabeled set.

Original: In addition to these baselines, we also propose two natural extensions to the SSND setting of two existing methods.
Revised: In addition to these baselines, we also propose two natural extensions to the SSND setting of two existing methods.

Original: Firstly, we present a version of the Mahalanobis approach ( Mahal-U ) that is calibrated using the unlabeled set, instead of using oracle OOD data.
Revised: Firstly, we present a version of the Mahalanobis approach ( Mahal-U ) that is calibrated using the unlabeled set, instead of using oracle OOD data.

Original: Secondly, since nnPU requires access to the OOD ratio of the unlabeled set, we also consider a less burdensome alternative: a binary classiﬁer trained to separate the training data from the unlabeled set and regularized with early stopping like our method.
Revised: Secondly, since nnPU requires access to the OOD ratio of the unlabeled set, we also consider a less burdensome alternative: a binary classiﬁer trained to separate the training data from the unlabeled set and regularized with early stopping like our method.

Original: Unsupervised novelty detection (UND).
Revised: Unsupervised novelty detection (UND).

Original: Naturally, one may ignore the unlabeled data and use UND approaches.
Revised: Naturally, one may ignore the unlabeled data and use unsupervised approaches.

Original: The current SOTA UND method on the usual benchmarks is the Gram method [Sastry and Oore, 2019].
Revised: The current SOTA UND method on the usual benchmarks is the Gram method [Sastry and Oore, 2019].

Original: Other  UND approaches include vanilla ensembles  [Lakshminarayanan et al., 2017], deep generative models (which tend to give undesirable results for OOD detection [Kirichenko et al., 2020]), or various Bayesian approaches (which are often poorly calibrated on OOD data [Ovadia et al., 2019]).
Revised: Other notable UND approaches include vanilla ensembles [Table] [Lakshminarayanan et al., 2017], deep generative models (which tend to give undesirable results for OOD detection [Kirichenko et al., 2020]), or various Bayesian approaches (which are often poorly calibrated on OOD data [Ovadia et al., 2019]).

Original: Preliminary analyses revealed that generative models and methods trained with a contrastive loss [Winkens et al., 2020] or with one-class classiﬁcation [Sohn et al., 2021] perform poorly on near OOD data sets (see Appendix F. for a comparison; we use numbers reported by the authors for works where we could not replicate their results).
Revised: Preliminary analyses revealed that generative models and methods trained with a contrastive loss [Winkens et al., 2020] or with one-class classiﬁcation [Sohn et al., 2021] perform poorly on near OOD data sets (see Appendix F. for a comparison; we use numbers reported by the authors for works where we could not replicate their results).

Original: Other methods.
Revised: Other methods.

Original: We also compare with Outlier Exposure [Hendrycks et al., 2019] and Deep Prior Networks (DPN) [Malinin and Gales, 2018] which use TinyImages as known outliers during training, irrespective of the OOD set used for evaluation.
Revised: We also compare with Outlier Exposure [Hendrycks et al., 2019] and Deep Prior Networks (DPN) [Malinin and Gales, 2018] which use TinyImages as known outliers during training, irrespective of the OOD set used for evaluation.

Original: On the other hand, the Mahalanobis baseline [Lee et al., 2018] is tuned on samples from the same OOD distribution used for evaluation.
Revised: On the other hand, the Mahalanobis baseline [Lee et al., 2018] is tuned on samples from the same OOD distribution used for evaluation.

Original: Finally, we also consider large transformer models pretrained on ImageNet21k and ﬁne-tuned on the ID training set [Fort et al., 2021].[Table] 73 CIFAR [0:4] CIFAR10[
Revised: Finally, we also consider large transformer models pretrained on ImageNet21k and ﬁne-tuned on the ID training set [Fort et al., 2021].

Original: [Table]

Original: [Table]

Original: [Table]

Original: [Table] [Table] [Table] 4.3 IMPLEMENTATION DETAILS
Revised: 4.3 IMPLEMENTATION DETAILS

Original: Baseline hyperparameters.
Revised: Baseline hyperparameters.

Original: For all the baselines, we use the default hyperparameters suggested by their authors on the respective ID data set (see Appendix D for more details).
Revised: For all the baselines, we use the default hyperparameters suggested by their authors on the respective ID data set (see Appendix D for more details).

Original: For the binary classiﬁer, nnPU, ViT, and vanilla ensembles, we choose the hyperparameters that optimize the loss on an
Revised: For the binary classiﬁer, nnPU, ViT, and vanilla ensembles, we choose the hyperparameters that optimize the loss on an

Original: ID validation set.
Revised: ID validation set.

Original: ERD details.
Revised: ERD details.

Original: 3 We follow the procedure in Algorithmto ﬁne-tune each model in the ERD ensemble starting from weights that are pretrained on the labeled ID set S .
Revised: 3 We follow the procedure in Algorithmto ﬁne-tune each model in the ERD ensemble starting from weights that are pretrained on the labeled ID set S .

Original: Unless otherwise speciﬁed, we train K = 3 ResNet20 models
Revised: Unless otherwise speciﬁed, we train K = 3 ResNet20 networks

Original: [He et al., 2016] using 3 randomly chosen class labels for ( U, c ) and note that even ensembles of two models produce good results (see Appendix F.9).
Revised: [He et al., 2016] using 3 randomly chosen class labels for ( U, c ) and note that even ensembles of two models produce good results (see Appendix F.9).

Original: We stress that whenever applicable, our choices disadvantage ERD for the comparison with the baselines, e.g. vanilla ensembles use K = 5 , and for most of the other approaches we use the larger WideResNet28-10.
Revised: We stress that whenever applicable, our choices disadvantage ERD for the comparison with the baselines, e.g. vanilla ensembles use K = 5 , and for most of the other approaches we use the larger WideResNet28-10.

Original: We select the early stopping time and other standard hyperparameters so as to maximize validation accuracy.
Revised: We select the early stopping time and other standard hyperparameters so as to maximize validation accuracy.

Original: Evaluation.
Revised: Evaluation.

Original: As in standard hypothesis testing, choosing different thresholds for rejecting the null hypothesis leads to different false positive and true positive rates (FPR and
Revised: As in standard hypothesis testing, choosing different thresholds for rejecting the null hypothesis leads to different false positive and true positive rates (FPR and

Original: TPR, respectively).
Revised: TPR, respectively).

Original: The ROC curve follows the FPR and
Revised: The ROC curve follows the FPR and

Original: TPR for all possible threshold values and the area under the curve (AUROC; larger values are better) captures the performance of a statistical test without having to select a speciﬁc threshold.
Revised: TPR for all possible threshold values and the area under the curve (AUROC; larger values are better) captures the performance of a statistical test without having to select a speciﬁc threshold.

Original: In addition, we also report the TNR at a TPR of 95% (TNR@95; larger values are better).
Revised: In addition, we also report the TNR at a TPR of 95% (TNR@95; larger values are better).

Revised: These metrics evaluate the quality of an outlier score without choosing a rejection threshold.

Revised: However, we note that this problem can easily be addressed in practice.

Revised: For instance, one can choose the threshold so as to achieve a desired FPR, which can be estimated using a validation set of ID samples.

Original: Computation cost.
Revised: Computation cost.

Original: We only need to ﬁne-tune two-model ensembles to get good performance with ERD (see Appendix F.9).
Revised: We only need to ﬁne-tune two-model ensembles to get good performance with ERD (see Appendix F.9).

Original: For instance, in applications like the one in
Revised: For instance, in applications like the one in

Original: Figure 1, ERD ﬁne-tuning introduces little overhead and works well even with scarce resources (e.g. it takes around 5 minutes on 2 GPUs for the settings in Table 1).
Revised: Figure 1, ERD ﬁne-tuning introduces little overhead and works well even with scarce resources (e.g. it takes around 5 minutes on 2 GPUs for the settings in Table 1).

Original: In contrast, other ensemble diversiﬁcation methods require training different models for each hyperparameter choice and have training losses that cannot be easily parallelized (e.g. Yu and Aizawa [2019]). 
Revised: In contrast, other ensemble diversiﬁcation methods require training different models for each hyperparameter choice and have training losses that cannot be easily parallelized (e.g. Yu and Aizawa [2019]). Moreover, the only other approach that achieves comparable performance to our method on some [Figure]

Original: Moreover, the only other approach that achieves comparable performance to our method on some near OOD data uses large transformer models pretrainedon a large and conveniently chosen data set[Fort et al., 2021].
Revised: near OOD data uses large transformer models pretrained a large and conveniently chosen data set

Original: 4.4 MAIN RESULTS
Revised: 4.4 MAIN RESULTS

Original: We summarize the main empirical results in Table 1.
Revised: We summarize the main empirical results in Table 1.

Original: While most methods achieve near-perfect detection for far OOD,
Revised: While most methods achieve near-perfect detection for far OOD,

Original: ERD has a clear edge over the baselines for novel-class detection within the same dataset – even compared to methods ( † ) that use oracle OOD information.
Revised: ERD has a clear edge over the baselines for novel-class detection within the same dataset – even compared to methods ( † ) that use oracle OOD information.

Original: For completeness, we present in Appendix F.2 a comparison with more related works.
Revised: For completeness, we present in Appendix F.2 a comparison with more related works.

Original: These methods either show unsatisfactory performance on near OOD tasks, or seem to work well only on certain speciﬁc data sets.
Revised: These methods either show unsatisfactory performance on near OOD tasks, or seem to work well only on certain speciﬁc data sets.

Original: We elaborate on the potential causes of failure for these works in Section 5.
Revised: We elaborate on the potential causes of failure for these works in Section 5.

Original: For the medical novelty detection benchmark we show in
Revised: For the medical novelty detection benchmark we show in

Original: Figure 5a the average AUROC achieved by some representative baselines taken from Cao et al.
Revised: Figure 5a the average AUROC achieved by some representative baselines taken from Cao et al.

Original: Our method improves the average AUROC from 0 .
Revised: Our method improves the average AUROC from 0 .

Original: 85 to 0 .
Revised: 85 to 0 .

Original: 91 , compared to the best baseline.
Revised: 91 , compared to the best baseline.

Original: We refer the reader to Cao et al.
Revised: We refer the reader to Cao et al.

Original: [2020] for precise details on the methods.
Revised: [2020] for precise details on the methods.

Original: Appendix G contains more results, as well as additional baselines.
Revised: Appendix G contains more results, as well as additional baselines.

Original: 4.5 ABLATION STUDIES AND LIMITATIONS
Revised: 4.5 ABLATION STUDIES AND LIMITATIONS

Original: We also perform extensive experiments to understand the importance of speciﬁc design choices and hyperparameters, and refer the reader to the appendix for details.
Revised: We also perform extensive experiments to understand the importance of speciﬁc design choices and hyperparameters, and refer the reader to the appendix for details.

Original: Relaxing assumptions on OOD samples.
Revised: Relaxing assumptions on OOD samples.

Original: In Table 1 we evaluate our approach on a holdout test set that is drawn from the same distribution as the unlabeled set U used for ﬁne-tuning.
Revised: In Table 1 we evaluate our approach on a holdout test set that is drawn from the same distribution as the unlabeled set U used for ﬁne-tuning.

Original: However, we provide experiments in Appendix F.10 that show that novelty detection with ERD continues to perform well even when the test set and U come[Figure] from different distributions (e.g. novel-class data in the test set also suffers from corruptions).
Revised: However, we provide experiments in Appendix F.10 that show that novelty detection with ERD continues to perform well even when the test set and U come from different distributions (e.g. novel-class data in the test set also suffers from corruptions).

Original: Further, even though our main focus is novel-class detection, our experiments (Appendix F.4) indicate that ERD can also successfully identify near OOD samples that are only mildly covariate shifted compared to the ID data (e.g. CIFAR10 vs corrupted CIFAR

Revised: Further, even though our main focus is novel-class detection, our experiments (Appendix F.4) indicate that ERD can also successfully identify near OOD samples that suffer from only mild covariate shift compared to the ID data (e.g. CIFAR10 vs corrupted CIFAR

Original: [Hendrycks and Dietterich, 2019] or CIFAR10v [Recht et al., 2019]).
Revised: [Hendrycks and Dietterich, 2019] or CIFAR10v [Recht et al., 2019]).

Original: Finally, Appendix F.1 shows that ERD ensembles also perform well in a transductive setting [Scott and Blanchard, 2008], where the test set coincides with U .
Revised: Finally, Appendix F.1 shows that ERD ensembles also perform well in a transductive setting [Scott and Blanchard, 2008], where the test set coincides with U .

Original: Relaxing the assumptions of Proposition 3.1.
Revised: Relaxing the assumptions of Proposition 3.1.

Original: Our theoretical results require that the ID classes in the training set and the novel classes in U have similar cardinality.
Revised: Our theoretical results require that the ID classes in the training set and the novel classes in U have similar cardinality.

Original: In fact, this condition is unnecessarily strong as we show in our empirical analysis: In all experimental settings we have signiﬁcantly fewer OOD than ID training points.
Revised: In fact, this condition is unnecessarily strong as we show in our empirical analysis: In all experimental settings we have signiﬁcantly fewer OOD than ID training points.

Original: We further investigate the impact of the size of the unlabeled set and of the ratio of novel samples in it ( | [Equation] and ﬁnd that
Revised: We further investigate the impact of the size of the unlabeled set and of the ratio of novel samples in it ( | U OOD | | U ID | + | U OOD | ) and ﬁnd that

Original: ERD in fact maintains good performance for a broad range of ratios in Figure 5b.
Revised: ERD in fact maintains good performance for a broad range of ratios in Figure 5b.

Original: Sensitivity to hyperparameter choices.
Revised: Sensitivity to hyperparameter choices.

Original: We point out that ERD ensembles are particularly robust to changes in the hyperparameters like batch size or learning rate (Appendix H), or the choice of the arbitrary label assigned to the unlabeled set (Appendix F.9).
Revised: We point out that ERD ensembles are particularly robust to changes in the hyperparameters like batch size or learning rate (Appendix H), or the choice of the arbitrary label assigned to the unlabeled set (Appendix F.9).

Original: Further, we note that ERD ensembles with as few as two models already show remarkable novelty detection performance and refer to Appendix F. for experiments with larger ensemble sizes.
Revised: Further, we note that ERD ensembles with as few as two models already show remarkable novelty detection performance and refer to Appendix F. for experiments with larger ensemble sizes.

Original: Moreover, ERD performance improves with larger neural networks (Appendix F.8), meaning that ERD will beneﬁt from any future advances in architecture design.
Revised: Moreover, ERD performance improves with larger neural networks (Appendix F.8), meaning that ERD will beneﬁt from any future advances in architecture design.

Original: Choice of disagreement score.
Revised: Choice of disagreement score.

Original: We show in Tablein Appendix B, that the training procedure alone (Algorithm 1) does not sufﬁce for good novelty detection.
Revised: We show in Tablein Appendix B, that the training procedure alone (Algorithm 1) does not sufﬁce for good novelty detection.

Original: For optimal results, ERD ensembles need to be combined with a disagreement-based score like the one introduced in Section 2.3 (see Table 3 in Appendix B).
Revised: For optimal results, ERD ensembles need to be combined with a disagreement-based score like the one introduced in Section 2.3.

Original: Finally, we show how the distribution of the disagreement score changes during training for ERD (Appendix K) and explain why regularizing disagreement is more challenging for near OOD data, compared to easier, far OOD settings (Appendix J). 
Revised: Finally, we show how the distribution of the disagreement score changes during training for ERD (Appendix K) and explain why regularizing disagreement is more challenging for near OOD data, compared to easier, far OOD settings (Appendix J). [Table]

Original: Limitations.
Revised: Limitations.

Original: Despite the advantages of ERD, like all prior
Revised: Despite the advantages of ERD, like all prior

Original: SSND methods, our approach is not a good ﬁt for online (real-time) novelty detection tasks.
Revised: SSND methods, our approach is not a good ﬁt for online (real-time) novelty detection tasks.

Original: Moreover, ERD ensembles are not tailored to anomaly detection, where outliers are particularly rare, since the unlabeled set should contain at least a small number of samples from the novel classes (see Figure 5b).
Revised: Moreover, ERD ensembles are not tailored to anomaly detection, where outliers are particularly rare, since the unlabeled set should contain at least a small number of samples from the novel classes (see Figure 5b and Appendix I).

Original: However, ERD ensembles are an ideal candidate for applications that require highly accurate, ofﬂine novelty detection, like the one illustrated in Figure 1.
Revised: However, ERD ensembles are an ideal candidate for applications that require highly accurate, ofﬂine novelty detection, like the one illustrated in Figure 1.

Original:  RELATED WORK
Revised:  RELATED WORK

Original: In this section, we present an overview of different types of related methods that are in principle applicable for solving semi-supervised novelty detection.
Revised: In this section, we present an overview of different types of related methods that are in principle applicable for solving semi-supervised novelty detection.

Original: In particular, we indicate caveats of these methods based on their categorization with respect to 1) data availability and 2) the surrogate objective they try to optimize.
Revised: In particular, we indicate caveats of these methods based on their categorization with respect to 1) data availability and 2) the surrogate objective they try to optimize.

Original: This taxonomy may also be of independent interest to navigate the zoo of ND methods.
Revised: This taxonomy may also be of independent interest to navigate the zoo of ND methods.

Original: We list a few representative approaches in Table 2 and refer the reader to surveys such as Bulusu et al.
Revised: We list a few representative approaches in Table 2 and refer the reader to surveys such as Bulusu et al.

Original: [2020] for a thorough literature overview.
Revised: [2020] for a thorough literature overview.

Original: 5.1 TAXONOMY ACCORDING TO DATA AVAILABILITY
Revised: 5.1 TAXONOMY ACCORDING TO DATA AVAILABILITY

Original: In this section we present related novelty detection methods that use varying degrees of labeled OOD data for training.
Revised: In this section we present related novelty detection methods that use varying degrees of labeled OOD data for training.

Original: We call test OOD the novel-class data that we want to detect at test time.
Revised: We call test OOD the novel-class data that we want to detect at test time.

Original: In a scenario like the one in Figure 1, one can apply unsupervised novelty detection (UND) methods that ignore the unlabeled batch and only uses ID data during training [Lakshminarayanan et al., 2017, Sastry and Oore, 2019, Nalisnick et al., 2019].
Revised: In a scenario like the one in Figure 1, one can apply unsupervised novelty detection (UND) methods that ignore the unlabeled batch and only uses ID data during training [Lakshminarayanan et al., 2017, Sastry and Oore, 2019, Nalisnick et al., 2019].

Original: However, these approaches lead to poor novelty detection performance, especially on near OOD data.[Table]
Revised: However, these approaches lead to poor novelty detection performance, especially on near OOD data.

Original: There are methods that suggest to improve UND performance by using additional data.
Revised: There are methods that suggest to improve UND performance by using additional data.

Original: For example, during training one may use synthetically generated outliers (e
Revised: For example, during training one may use synthetically generated outliers (e.g. Tack et al.

Original: [Table] g. Tack et al. [2020], Sohn et al.
Revised: [2020], Sohn et al.

Original: [2021]) or a different OOD data set that may be available (e [Table] g. OE and DPN use TinyImages) with samples known to be outliers .
Revised: [2021]) or a different OOD data set that may be available (e.g. OE and DPN use TinyImages) with samples known to be outliers .

Original: However, in order for these augmented unsupervised ND (A-UND) methods to work, they require that the OOD data used for training is similar to test OOD samples.
Revised: However, in order for these augmented unsupervised ND (A-UND) methods to work, they require that the OOD data used for training is similar to test OOD samples.

Original: When this condition is not satisﬁed, A-UND performance deteriorates drastically (see
Revised: When this condition is not satisﬁed, A-UND performance deteriorates drastically (see

Original: Table 1).
Revised: Table 1).

Original: However, by deﬁnition, novel data is unknown and the only information about the OOD data that is realistically available is in the unlabeled set like in SSND.
Revised: However, by deﬁnition, novel data is unknown and the only information about the OOD data that is realistically available is in the unlabeled set like in SSND.

Original: Therefore, it is unknown what an appropriate choice of the training OOD data is for A-UND methods.
Revised: Therefore, it is unknown what an appropriate choice of the training OOD data is for A-UND methods.

Original: Another line of work uses pretrained models to incorporate additional data that is close to test OOD samples, i.e. pretrained UND (P-UND) .
Revised: Another line of work uses pretrained models to incorporate additional data that is close to test OOD samples, i.e. pretrained UND (P-UND) .

Original: Fort et al.
Revised: Fort et al.

Original: [2021] use large transformer models pretrained on ImageNet21k and achieve good near OOD detection performance when ID and OOD data are similar to ImageNet samples (e.g. CIFAR10/CIFAR100).
Revised: [2021] use large transformer models pretrained on ImageNet21k and achieve good near OOD detection performance when ID and OOD data are similar to ImageNet samples (e.g. CIFAR10/CIFAR100).

Original: However, our experiments in Appendix F.3 reveal that this method performs poorly on all other near OOD data sets, including unseen FashionMNIST or SVHN classes and Xrays of unknown diseases.
Revised: However, our experiments in Appendix F.3 reveal that this method performs poorly on all other near OOD data sets, including unseen FashionMNIST or SVHN classes and Xrays of unknown diseases.

Original: This unsatisfactory performance is apparent when ID and OOD data do not share visual features with the pretraining data (i.e. ImageNet21k).
Revised: This unsatisfactory performance is apparent when ID and OOD data do not share visual features with the pretraining data (i.e. ImageNet21k).

Original: Since collecting such large troves of “similar” data for pre-training is often not possible in practical applications (as medical imaging), the use case of their method is rather limited.
Revised: Since collecting such large troves of “similar” data for pre-training is often not possible in practical applications (as medical imaging), the use case of their method is rather limited.

Original: Furthermore, a few popular methods use test OOD data for calibration or hyperparameter tuning [Yu and Aizawa, 2019,
Revised: Furthermore, a few popular methods use test OOD data for calibration or hyperparameter tuning [Yu and Aizawa, 2019,

Original: Lee et al., 2018, Liang et al., 2018, Ruff et al., 2020], which is not applicable in practice.
Revised: Lee et al., 2018, Liang et al., 2018, Ruff et al., 2020], which is not applicable in practice.

Original: Clearly, knowing the test OOD distribution a priori turns the problem into supervised ND (SND) , and hence, violates the fundamental assumption that
Revised: Clearly, knowing the test OOD distribution a priori turns the problem into supervised ND (SND) , and hence, violates the fundamental assumption that

Original: OOD data is unforeseeable.
Revised: OOD data is unforeseeable.

Original: As we have already seen, current SSND approaches (e.g.
Revised: As we have already seen, current SSND approaches (e.g.

Original: MCD, nnPU) perform poorly for complex models such as neural networks.
Revised: MCD, nnPU) perform poorly for complex models such as neural networks.

Original: We note that SSND is similar to using unlabeled data for learning with augmented classes (U-LAC)
Revised: We note that SSND is similar to using unlabeled data for learning with augmented classes (U-LAC)

Original: [Da et al., 2014, Guo et al., 2020, Zhang et al., 2020b] and is related to transductive novelty detection [Scott and Blanchard, 2008, Guo et al., 2020], where the test set coincides with the unlabeled set used for training.
Revised: [Da et al., 2014, Guo et al., 2020, Zhang et al., 2020] and is related to transductive novelty detection [Scott and Blanchard, 2008, Guo et al., 2020], where the test set coincides with the unlabeled set used for training.

Original: 5.2 TAXONOMY ACCORDING TO PROBABILISTIC PERSPECTIVE
Revised: 5.2 TAXONOMY ACCORDING TO PROBABILISTIC PERSPECTIVE

Original: Apart from data availability, the methods that we can use in a practical SSND scenario implicitly or explicitly use a different principle based on a probabilistic model.
Revised: Apart from data availability, the methods that we can use in a practical SSND scenario implicitly or explicitly use a different principle based on a probabilistic model.

Original: For example, novel-class samples are a subset of the points that are out-of-distribution in the literal sense, i.e. P X ( x ) < α .
Revised: For example, novel-class samples are a subset of the points that are out-of-distribution in the literal sense, i.e. P X ( x ) < α .

Original: One can hence learn P X from unlabeled ID data, which is however notoriously difﬁcult in high dimensions.
Revised: One can hence learn P X from unlabeled ID data, which is however notoriously difﬁcult in high dimensions.

Original: Similarly, from a Bayesian viewpoint, the predictive variance is larger for OOD samples with P X ( x ) < α .
Revised: Similarly, from a Bayesian viewpoint, the predictive variance is larger for OOD samples with P X ( x ) < α .

Original: Hence, one could instead compute the posterior P X ( y | x ) and ﬂag points with large variance (i.e. high predictive uncertainty ).
Revised: Hence, one could instead compute the posterior P X ( y | x ) and ﬂag points with large variance (i.e. high predictive uncertainty ).

Original: This circumvents the problem with estimating P X .
Revised: This circumvents the problem with estimating P X .

Original: However, Bayesian estimates of uncertainty that accompany NN predictions tend to not be accurate on OOD data [Ovadia et al., 2019], resulting in poor novelty detection performance.
Revised: However, Bayesian estimates of uncertainty that accompany NN predictions tend to not be accurate on OOD data [Ovadia et al., 2019], resulting in poor novelty detection performance.

Original: When the labels are available for the training set, we can instead partially learn P X using y .
Revised: When the labels are available for the training set, we can instead partially learn P X using y .

Original: For instance, one could use generative modeling to estimate the set of x for which
Revised: For instance, one could use generative modeling to estimate the set of x for which

Original: P X ( x ) > α via P X ( x | y )
Revised: P X ( x ) > α via P X ( x | y )

Original: Lee et al.
Revised: Lee et al.

Original: [2018], Sastry and Oore [2019].
Revised: [2018], Sastry and Oore [2019].

Original: Alternatively, given a loss and function space, we may use the labels indirectly, like in ERD, and use properties of the approximated population error that imply small or large P X .CONCLUSION In summary, we propose an SSND procedure that exploits unlabeled data effectively to generate an ensemble with regularized disagreement, which achieves remarkable novelty detection performance.
Revised: Alternatively, given a loss and function space, we may use the labels indirectly, like in ERD, and use properties of the approximated population error that imply small or large P X .

Original: Our SSND method does not need hidden labeled/oracle OOD data during training unlike many other related works summarized in Table 2.

Original: We leave as future work a thorough investigation of the impact of the labeling scheme of the unlabeled set on the sample complexity of the method, as well as an analysis of the trade-off governed by the complexity of the model class.

Original: A THEORETICAL STATEMENTS

Original: Deﬁnition A.1 ( ( (cid:15), ρ ) -clusterable data set) .

Original: We say that a data set D = { ( x i , y i ) } ni

Original: =1 is ( (cid:15), ρ )-clusterable for ﬁxed (cid:15) >and ρ ∈ [0 , 1] if there exists a partitioning of it into subsets { C 1 , ..., C K } , which we call clusters , each with their associated unit-norm cluster center c

Original: i , that satisfy the following conditions:

Original: • (cid:83) Ki

Original: =1 C i = D and C i ∩ C j = ∅ , ∀ i, j ∈ [ K ] ; • all the points in a cluster lie in the (cid:15) -neighborhood of their corresponding cluster center,

Original: i.e. || x − c

Original: i || 2 ≤ (cid:15) for all x ∈ C i and all i ∈

Original: [ K ] ; • a fraction of at least 1 − ρ of the points in each cluster C i have the same label, which we call the cluster label and denote y ∗ ( c i ) .

Original: The remaining points suffer from label noise; • if two cluster C i and C j have different labels, then their centers are 2 (cid:15) far from each other,

Original: i

Original: e. || c i − c

Original: j || 2 ≥ 2 (cid:15) ; • the clusters are balanced i

Original: e. for all i ∈ [ K ] , α 1 nK ≤ | C i | ≤ α 2 nK , where α 1 and α 2 are two positive constants.

Original: In our case, for a ﬁxed label c ∈ Y , we assume that the set S ∪ ( U, c ) is ( (cid:15), ρ ) -clusterable into K clusters.

Original: We further assume that each cluster C i only includes a few noisy samples from ( U ¬ c ID , c ) , i.e. | C i ∩ ( U ¬ c ID ,c ) | | C i | ≤ ρ and that for clusters C i whose cluster label is not c , i.e. y ∗ ( c i ) (cid:54)

Original: =

Original: c , it holds that C i ∩ ( U OOD , c )

Original: = ∅ .

Original: We deﬁne the matrices C :=

Original: [ c 1 , ..., c K ] T ∈ R K × d and Σ :

Original: = ( CC T ) (cid:74) E g

Original: [ φ (cid:48)

Original: ( Cg ) φ (cid:48)

Original: ( Cg ) T ] , with g ∼ N (0 , I d ) and where (cid:74) denotes the elementwise product.

Original: We use (cid:107) · (cid:107) and λ min ( · ) to denote the spectral norm and the smallest eigenvalue of a matrix, respectively.

Original: For prediction, we consider a 2-layer neural network model with p hidden units, where p (cid:38) K 2 (cid:107) C (cid:107) 4 λ min (Σ) 4 .

Original: We can write this model as follows:

Original: [Equation]

Original: The ﬁrst layer weights W are initialized with random values drawn from N (0 , 1) , while the last layer weights v have ﬁxed values: half of them are set to 1 /p and the other half is − 1 /p .

Original: We consider activation functions φ with bounded ﬁrst and second order derivatives, i.e. | φ (cid:48)

Original: ( x ) | ≤ Γ and φ (cid:48)(cid:48)

Original: ( x ) ≤ Γ .

Original: [-We use the squared loss for training, i.e. L ( W ) = 12 (cid:80) ni =
-]
Revised: [-We use the squared loss for training, i.e. L ( W ) = 12 (cid:80) ni =
-]

Original: [-( y i − f ( x i ; W )) 2 and take gradient descent steps to ﬁnd the optimum of the loss function, i.e. W τ +
-]
Revised: [-( y i − f ( x i ; W )) 2 and take gradient descent steps to ﬁnd the optimum of the loss function, i.e. W τ +
-]

Original: =

Original: W τ − η ∇L ( W τ ) , where the step size is set to η (cid:39)

Original: [Equation]

Original: We can now state the following proposition:

Original: Proposition A.1.

Original: Assume that ρ ≤ δ/ 8 and (cid:15) ≤ αδλ min (Σ) 2 /K 2 , where δ is a constant such that δ ≤

Original: [Equation]

Original: |Y− 1 |

Original: and α is a constant that depends on Γ .

Original: Then it holds with high probability 1 − 3 /K 100 − Ke − 100 d over the initialization of the weights that the neural network trained on S ∪ (

Original: [Table]

Original: This result shows that there exists an optimal stopping time at which the neural network predicts the correct label on all

Original: ID points and the label c on all the OOD points.

Original: As we will see later in the proof, the proposition is derived from a more general result which shows that the early stopped model predicts these labels not only on the points in U but also in an (cid:15) -neighborhood around cluster centers.

Original: Hence, an ERD ensemble can be used to detect holdout OOD samples similar to the ones in U , after being tuned on U .

Original: This follows the intuition that classiﬁers regularized with early stopping are smooth and generalize well.

Original: The clusterable data model is generic enough to include data sets with non-linear decision boundaries.

Original: Moreover, notice that the condition in Proposition A.1 is satisﬁed when S ∪ ( U ID , c ) is ( (cid:15), ρ ) -clusterable

Original: and ( U OOD , c ) is (cid:15) -clusterable

Original: and if the cluster centers of ( U OOD , c ) are at distance at least 2 (cid:15) from the cluster centers of S ∪ ( U ID , c ) .

Original: A situation in which these requirements are met is, for instance, when the OOD data comes from novel classes, when all classes (including the unseen ones that are not in the training set) are well separated, with cluster centers at least 2 (cid:15) away in Euclidean distance.

Original: In addition, in order to limit the amount of label noise in each cluster, it is necessary that the number of incorrectly labeled samples in ( U ¬ c ID , c ) is small, relative to the size of S .

Original: In practice, we only need that the decision boundary separating ( U OOD , c ) from S is easier to learn than the classiﬁer required to interpolate the incorrectly labeled ( U ¬ c ID , c ) , which is often the case, provided that ( U OOD , c ) is large enough and the OOD samples come from novel classes.

Original: We now provide the proof for Proposition A.1:

Original: Proof.

Original: We begin by restating a result from Li et al.

Original: Theorem A.1 ([Li et al., 2020]) .

Original: Let D := { ( x i , y i )

Original: } ∈ R d × Y be an ( (cid:15), ρ ) -clusterable training set, with (cid:15) ≤ c 1 δλ min (Σ) 2 /K 2 and ρ ≤ δ/ 8 , where δ is a constant that satisﬁes δ ≤ 2 |Y|− 1 .

Original: Consider a two-layer neural network as described above, and train it with gradient descent starting from initial weights sampled i.i.d.

Original: from N (0 , 1) .

Original: Assume further that the step size is η = c 2 K n (cid:107) C (cid:107) 2 and that the number of hidden units p is at least c 3 K 2 (cid:107) C (cid:107) 4 λ min (Σ) 4 .

Original: Under these conditions, it holds with probability at least 1 − 3 /K 100 − Ke − 100 d over the random draws of the initial weights, that after

Original: T =

Original: c 4 (cid:107) C (cid:107) 2 λ min (Σ) gradient descent steps, the neural network x (cid:55)→ f ( x ; W T ) predicts the correct cluster label for all points in the (cid:15) -neighborhood of the cluster center, namely:

Original: [Equation]

Original: where ω : Y → { 0 , 1 } |Y| yields one-hot embeddings of the labels.

Original: The constants c 1 , c 2 , c 3 , c 4 depend only on Γ .

Original: Notice that, under the assumptions introduced above, the set S ∪ ( U, c ) is ( (cid:15), ρ ) -clusterable, since the incorrectly labeled ID points in ( U ¬ c ID , c ) constitute at most a fraction ρ of the clusters they belong to.

Original: As a consequence, Proposition A.1 follows directly from Theorem A.1.

Original: B DISAGREEMENT SCORE FOR NOVELTY DETECTION

Original: As we argue in Section 3, Algorithm 1 produces an ensemble that disagrees on OOD data, and hence, we want to devise a scalar score that reﬂects this model diversity.

Original: Previous works [Lakshminarayanan et al., 2017, Ovadia et al., 2019]

Original: ﬁrst average the softmax predictions of the models in the ensemble and then use the entropy as a metric,

Original: i.e.

Original: ( H ◦ Avg )( f 1 ( x ) , ..., f K ( x )) :

Original: [-= − (cid:80) |Y| i =
-]
Revised: [-= − (cid:80) |Y| i =
-]

Original: ( f ( x ))

Original: i log( f ( x ))

Original: i where f ( x ) :

Original: = 1 K (cid:80) K i =

Original: 1 f i ( x ) and ( f ( x ))

Original: i is the i th element of f ( x ) ∈ [0 , 1] |Y| 6 .

Original: We argue later that averaging discards information about the diversity of the models.

Original: Recall that our average pairwise disagreement between the outputs of K models in an ensemble reads:

Original: [Equation]

Original: where ρ is a measure of disagreement between the softmax outputs of two predictors, for example the total variation distance ρ TV ( f i ( x ) , f j ( x ))

Original: = 12 (cid:107) f

Original: i ( x ) − f

Original: [Equation]

Original: 1 used in our experiments.

Original: We brieﬂy highlight the reason why averaging softmax outputs ﬁrst like in previous works relinquishes all the beneﬁts of having a more diverse ensemble, as opposed to the proposed pairwise score in Equation 3.

Original: Recall that varying thresholds yield different true negative and true positive rates (TNR and TPR, respectively) for a given statistic.

Original: In the sketch in Figurewe show that the score we propose, ( Avg ◦ ρ ) , achieves a higher TNR compared to ( H ◦ Avg ) , for a ﬁxed TPR, which is a common way of evaluating statistical tests.

Original: Notice that the detection region for ( H ◦ Avg ) is always limited to a band around the average model for any threshold value t 0 .

Original: In order for the ( H ◦ Avg ) to have large TPR, this band needs to be wide, leading to many false positives.

Original: Instead, our disagreement score exploits the diversity of the models to more accurately detect OOD data.

Original: We now provide further quantitative evidence to support the intuition presented in Figure 6.

Original: The aggregation metric is tailored to exploit ensemble diversity, which makes it particularly beneﬁcial for ERD.

Original: On the other hand, Vanilla Ensembles only rely on the stochasticity of the training process and the random initializations of the weights to produce diverse models, which often leads to classiﬁers that are strikingly similar as we show in Figure 7 for a few 2D data sets.

Original: As a consequence, using our disagreement score ( Avg ◦ ρ ) for Vanilla Ensembles can sometimes hurt novelty detection performance.

Original: To see this, consider the extreme situation in which the models in the ensemble are identical, i.e. f 1 = f 2 .

Original: Then it follows that ( Avg ◦ ρ )( f 1 ( x ) , f 2 ( x ))

Original: = 0 , for all test points x and for any function ρ that satisﬁes the distance axioms.

Original: We note that the disagreement score that we propose takes a form that is similar to previous diversity scores, e.g. Zhang and Zhou [2010], Yu and Aizawa [2019].

Original: In the context of regression, one can measure uncertainty using the variance of the outputs metric previously employed in works such as Gal and Ghahramani [2016].

Original: However, we point out that using the output variance requires that the ensemble is the result of sampling from a random process (e.g. sampling different training data for the models, or sampling different parameters from a posterior).

Original: In our framework, we obtain the ensemble by solving a different optimization problem for each of the models by assigning a different label to the unlabeled data.

Original: Therefore, despite their similarities, our disagreement score and the output variance are, on a conceptual level, fundamentally different metrics.

Original: Table 3 shows that ( Avg ◦ ρ ) leads to worse novelty detection performance for Vanilla Ensembles, compared to using the entropy of the average softmax score, ( H ◦ Avg ) , which was proposed in prior work.

Original: However, if the ensembles are indeed diverse, as we argue is the case for our method ERD (see Section 3), then there is a clear advantage to using a score that, unlike ( H ◦ Avg ) , takes diversity into account, as shown in Table 3 for 5-model ERD ensembles.

Original: We highlight once again that other methods that attempt to obtain diverse ensembles, such as MCD, fail to train models with

Original: [Table]

Original: sufﬁcient disagreement, even when they use oracle OOD for hyperparameter tuning (Figure 8a)

Original: [Table]

Original: [Figure]

Original: C TAXONOMY OF OOD DETECTION METHODS ACCORDING TO OVERALL OBJECTIVE

Original: We now provide more details regarding the categorization of OOD detection approaches based on the different surrogate objectives that they use in order to detect OOD samples.

Original: Learning the ID marginal P X .

Original: We loosely deﬁne OOD samples as all x for which P X ( x ) <

Original: α , for a small constant α > 0 .

Original: Therefore, if we had access to the marginal training distribution P X , we would have perfect OOD detection.

Original: Realistically, however, P X is unknown, and we need to resort to estimating it.

Original: Explicit density estimation with generative models [Akçay et al., 2018, Nalisnick et al., 2019] is inherently difﬁcult in high dimensions.

Original: Alternatively, one-class classiﬁcation [M˜unoz-Marí et al., 2010, Ruff et al., 2020, Sohn et al., 2021] and PU learning approaches [du Plessis et al., 2014, Kiryo et al., 2017] try to directly learn a discriminator between ID and OOD data in the presence of known (e.g.

Original: A-UND) or unknown (e.g. SSND)

Original: OOD data.

Original: However, these methods tend to produce indistinguishable representations for inliers and outliers when the ID distribution consists of many diverse classes.

Original: Learning P X using label information (ours).

Original: Since in a prediction problem, the ID training set has class labels, one can take advantage of that additional information to distinguish points in the support of P X from OOD data.

Original: For instance,

Original: Lee et al.

Original: [2018], Sastry and Oore [2019] propose to use the intermediate representations of neural networks trained for prediction to detect OOD data.

Original: Often, the task is to also simultaneously predict well on ID data, a problem known as open-set recognition

Original: [Geng et al., 2021] and tackled by approaches like OpenHybrid [Zhang et al., 2020a].

Original: Learning uncertainty estimates for P Y | X .

Original: In the prediction setting, calibrated uncertainty estimates error could naturally be used to detect OOD samples.

Original: Many uncertainty quantiﬁcation methods are based on a Bayesian framework [Gal and

Original: Ghahramani, 2016, Malinin and Gales, 2018] or calibration improvement [Liang et al., 2018, Hafner et al., 2019].

Original: However, neither of them perform as well as other OOD methods mentioned above [Ovadia et al., 2019].

Original: D EXPERIMENT DETAILS D.1 BASELINES

Original: In this section we describe in detail the baselines with which we compare our method and describe how we choose their hyperparameters.

Original: For all baselines we use the hyperparameters suggested by the authors for the respective data sets (e.g. different hyperparameters for CIFAR10 or ImageNet).

Original: For all methods, we use pretrained models provided by the authors.

Original: However, we note that for the novel-class settings, pretraining on the entire training set means that the model is exposed to the OOD classes as well, which is undesirable.

Original: Therefore, for these settings we pretrain only on the split of the training set that contains the ID classes.

Original: Since the classiﬁcation problem is similar to the original one of training on the entire training set, we use the same hyperparameters that the authors report in the original papers.

Original: Moreover, we point out that even though different methods use different model architectures, that is not inherently unreasonable when the goal is novelty detection, since it is not clear if a complex model is more desirable than a smaller model.

Original: For this reason, we use the model architecture recommended by the authors of the baselines and which was used to produce the good results reported in their published works.

Original: For Vanilla Ensembles and for ERD we show results for different architectures in Appendix F.8.

Original: • Vanilla Ensembles

Original: [Lakshminarayanan et al., 2017]: We train an ensemble on the training set according to the true labels.

Original: For a test sample, we average the outputs of the softmax probabilities predicted by the models, and use the entropy of the resulting distribution as the score for the hypothesis test described in Section 2.3.

Original: We use ensembles of 5 models, with the same architecture and hyperparameters as the ones used for ERD.

Original: Hyperparameters are tuned to achieve good validation accuracy.

Original: • Gram method [Sastry and Oore, 2019]: The Gram baseline is similar to the Mahalanobis method in that both use the intermediate feature representations obtained with a deep neural network to determine whether a test point is an outlier.

Original: However, what sets the Gram method apart is the fact that it does not need any OOD data for training or calibration.

Original: We use the pretrained models provided by the authors, or train our own, using the same methodology as described for the Mahalanobis baseline.

Original: For OOD detection, we use the code published by the authors.

Original: We note that for

Original: MLP

Original: models,

Original: the

Original: Gram method is difﬁcult to tune and

Original:  we could not ﬁnd a conﬁguration that
Revised:  CONCLUSION

Original: works well, despite our best efforts and following the suggestions proposed during our communication with the authors

Original: • Deep Prior Networks (DPN)

Original: [Malinin and Gales, 2018]: DPN is a Bayesian Method that trains a neural network (Prior Network) to parametrize a Dirichlet distribution over the class probabilities.

Original: We train a WideResNet WRN-28for 100 epochs using SGD with momentum 0 .

Original: [-9 , with an initial learning rate of 0 . 01 , which is decayed by 0 . 
-]
Revised: [-9 , with an initial learning rate of 0 . 01 , which is decayed by 0 . 
-]

Original: at epochs 50 , 70 , and 90 .

Original: For MNIST, we use EMINST/Letters as OOD for tuning.

Original: For all other settings, we use TinyImages as OOD for tuning.

Original: • Outlier Exposure

Original: [Hendrycks et al., 2019]: This approach makes a model’s softmax predictions close to the uniform distribution on the known outliers, while maintaining a good classiﬁcation performance on the training distribution.

Original: We use the WideResNet architecture (WRN).

Original: For ﬁne-tuning, we use the settings recommended by the authors, namely we train for 10 epochs with learning rate 0 .

Original: For training from scratch, we train for 100 epochs with an initial learning rate of 0 . 1 .

Original: When the training data set is either CIFAR10/CIFAR100 or ImageNet, we use the default WRN parameters of the author’s code, namely 40 layers, 2 widen-factor, droprate 0 .

Original: When the training dataset is SVHN, we use the author’s recommended parameters of 16 layers, 4 widen-factor and droprate 0 . 4 .

Original: All settings use the cosine annealing learning rate scheduler provided with the author’s code, without any modiﬁcations.

Original: For all settings, we use TinyImages as known OOD data during training.

Original: In Section F.6 we show results for known OOD data that is similar to the OOD data used for testing.

Original: • Mahalanobis [Lee et al., 2018]:

Original: The method pretrains models on the labeled training data.

Original: For a test data point, it uses the intermediate representations of each layer as “extracted features”.

Original: It then performs binary classiﬁcation using logistic regression using these extracted features.

Original: In the original setting, the classiﬁcation is done on “training” ID vs “training”

Original: OOD samples (which are from the same distribution as the test OOD samples).

Original: Furthermore, hyperparameter tuning for the optimal amount of noise is performed on validation ID and OOD data.

Original: We use the WRN-28-10 architecture, pretrained for 200 epochs.

Original: The initial learning rate is 0 . 1 , which is decayed at epochs 60 , 120 , and 160 by 0 .

Original: We use

Original: SGD with momentum 0 . 9 , and the standard weight decay of 5 · 10 − 4 .

Original: The code published for the Mahalanobis method performs a hyperparameter search automatically for each of the data sets.

Original: The following baselines attempt to leverage the unlabeled data that is available in applications such as the one depicted in

Original: • Non-negative PU learning (nnPU) [Kiryo et al., 2017]: The method trains a binary predictor to distinguish between a set of known positives (in our case the ID data) and a set that contains a mixture of positives and negatives (in our case the unlabeled set).

Original: To prevent the interpolation of all the unlabeled samples, Kiryo et al.

Original: [2017] proposes a regularized objective.

Original: It is important to note that most training objectives in the PU learning literature require that the ratio between the positives and negatives in the unlabeled set is known or easy to estimate.

Original: For our experiments we always use the exact OOD ratio to train the nnPU baseline.

Original: Therefore, we obtain an upper bound on the AUROC/TNR@95.

Original: If the ratio is estimated from ﬁnite samples, then estimation errors may lead to slightly worse OOD detection performance.

Original: We perform a grid search over the learning rate and the threshold that appears in the nnPU regularizer and pick the option with the best validation accuracy measured on a holdout set with only positive samples (in our case, ID data).

Original: • Maximum Classiﬁer Discrepancy (MCD)

Original: [Yu and Aizawa, 2019]: The MCD method trains two classiﬁers at the same time, and makes them disagree on the unlabeled data, while maintaining good classiﬁcation performance.

Original: We use the WRN-28-10 architecture as suggested in the paper.

Original: We did not change the default parameters which came with the author’s code, so weight decay is 10 − 4 , and the optimizer is SGD with momentum 0 .

Original: When available (for CIFAR and CIFAR100), we use the pretrained models provided by the authors.

Original: For the other training datasets, we use their methodology to generate pretrained models: We train a WRN-28-10 for 200 epochs.

Original: The learning rate starts at 0.1 and drops by a factor of 10 at 50% and 75% of the training progress.

Original: • Mahalanobis-U

Original: This is a slightly different version of the Mahalanobis baseline, for which we use early-stopped logistic regression to distinguish between the training set and an unlabeled set with ID and OOD samples (instead of discriminating a known OOD set from the inliers).

Original: The early stopping iteration is chosen to minimize the classiﬁcation errors on a validation set that contains only ID data (recall that we do not assume to know which are the OOD samples).

Original: In addition to these approaches that have been introduced in prior work, we also propose a strong novel baseline that that bares some similarity to PU learning and to ERD.

Original: • Binary classiﬁer

Original: The approach consists in discriminating between the labeled ID training set and the mixed unlabeled set, that contains both ID and OOD data.

Original: We use regularization to prevent the trivial solution for which the entire unlabeled set is predicted as OOD.

Original: Unlike PU learning, the binary classiﬁer does not require that the OOD ratio in the test distribution is known.

Original: The approach is similar to a method described in [Scott and Blanchard, 2008] which also requires that the OOD ratio of the unlabeled set is known.

Original: We tune the learning rate and the weight of the unlabeled samples in the training loss by performing a grid search and selecting the conﬁguration with the best validation accuracy, computed on a holdout set containing only ID samples.

Original: We note that the binary classiﬁer that appears in Section G in the medical benchmark, is not the same as this baseline.

Original: For more details on the binary classiﬁer that appears in the medical data experiments we refer the reader to Cao et al.

Original: D.2 TRAINING CONFIGURATION FOR ERD

Original: For ERD we always use hyperparameters that give the best validation accuracy when training a model on the ID training set.

Original: In other words, we pick hyperparameter values that lead to good ID generalization and do not perform further hyperparameter tuning for the different OOD data sets on which we evaluate our approach.

Original: We point out that, if the ID labeled set is known to suffer from class imbalance, subpopulation imbalance or label noise, any training method that addresses these issues can be used instead of standard empirical risk minimization to train our ensemble (e.g. see Li et al.

Original: For MNIST and FashionMNIST, we train ensembles of 3-layer MLP models with ReLU activations.

Original: Each intermediate layer has 100 neurons.

Original: The models are optimized using Adam, with a learning rate of 0 .

Original: 001 , for 10 epochs.

Original: For SVHN, CIFAR10/CIFAR100 and ImageNet, we train ensembles of ResNet20 [He et al., 2016].

Original: The models are initialized with weights pretrained for 100 epochs on the labeled training set.

Original: We ﬁne-tune each model for 10 epochs using SGD with momentum 0 .

Original: 9 , and a learning rate of 0 .

Original: The weights are trained with an (cid:96) 2 regularization coefﬁcient of 5 e − 4 .

Original: We use a batch size of 128 for all scenarios, unless explicitly stated otherwise.

Original: We used the same hyperparameters for all settings.

Original: For pretraining, we perform SGD for 100 epochs and use the same architecture and hyperparameters as described above, with the exception of the learning rate that starts at 0 . 1 , and is multiplied by 0 .

Original: 2 at epochs 50 , 70 and 90 .

Original: Apart from ERD, which ﬁne-tunes the ensemble models starting from pretrained weights, we also present in the Appendix results for ERD++.

Original: This variant of our method trains the models from random initializations, and hence needs more iterations to converge, making it more computationally expensive than ERD.

Original: We train all models in the ERD++ ensembles forepochs with a learning rate that starts at 0 .

Original: 1 , and is multiplied by 0 .

Original: 2 at epochs 50 , 70 and 90 .

Original: All other hyperparameters are the same as for ERD ensembles.

Original: For the medical data sets, we train a Densenet-121 as the authors do in the original paper [Cao et al., 2020].

Original: For ERD++, we do not use random weight initializations, but instead we start with the ImageNet weights provided with Tensorﬂow.

Original: The training conﬁguration is exactly the same as for ResNet20, except that we use a batch size of 32 due to GPU memory restrictions, and for ﬁne tuning we use a constant learning rate of 10 − 5 .

Original: D.3 COMPUTATIONAL CONSIDERATIONS FOR ERD

Original: We note that ERD models reach the optimal stopping time within the ﬁrst 10 epochs on all the data sets that we consider, which amounts to around 6 minutes of training time if the models in the ensemble are ﬁne-tuned in parallel on NVIDIA 1080 Ti GPUs.

Original: This is substantially better than the cost of ﬁne-tuning a large ViT transformer model (which takes abouthour for 2500 iterations on the same hardware).

Original: Moreover, since the loss we use to train the ensemble decouples over the models, it allows for easy parallelization, unlike objectives like MCD where the ensemble models are intertwined.

Original: E ID AND OOD DATA SETS E.1 DATA SETS

Original: For evaluation, we use the following image data sets: MNIST [Lecun et al., 1998], Fashion MNIST [Xiao et al., 2017],

Original: SVHN [Netzer et al., 2011], CIFAR10 and CIFAR100 [Krizhevsky, 2009].

Original: For the experiments using MNIST and FashionMNIST the training set size is 50K, the validation size is 10K, and the test ID and test OOD sizes are both 10K. For SVHN, CIFAR10 and CIFAR100, the training set size is 40K, the validation size is 10K, and the unlabeled set contains 10K samples: 5K are ID and 5K are OOD.

Original: For evaluation, we use a holdout set of examples (half ID, half OOD).

Original: settings that use half classes as ID and the other half divided

Original: E.2 SAMPLES FOR THE SETTINGS WITH NOVEL CLASSES

Original: [Figure]

Original: F MORE EXPERIMENTS

Original: We now present more experimental results that provide additional insights about the proposed approach.

Original: We note that, unless otherwise speciﬁed, we use 5-model ERD ensembles in this section.

Original: F.1 EVALUATION ON THE UNLABELED SET

Original: In the main text we describe how one can leverage the unlabeled set U to obtain an novelty detection algorithm that accurately identiﬁes outliers at test time that similar to the ones in U .

Original: It is, however, possible to also use our method ERD to ﬂag the OOD samples contained in the same set U used for ﬁne-tuning the ensemble.

Original: In Table 4 we show that the novelty detection performance of ERD is similar regardless of whether we use U for evaluation

Original: [Table]

Original: or a holdout test set T drawn from the same distribution as U .

Original: [Table]

Original: F.2 COMPARISON WITH OTHER RELATED WORKS

Original: We compare 5-model ERD ensembles to more OOD detection approaches.

Original: For various reasons we did not run these methods ourselves on the data sets for which we evaluate our method in Section 4 (e.g. code not available, unable to replicate published results, poor performance reported by the authors etc).

Original: We collected the AUROC numbers presented in Tablefrom the papers that introduce each method.

Original: We note that our approach shows an excellent overall performance, being consistently better than or on par with the related works that we consider.

Original: While the method of Fort et al.

Original: [2021] performs signiﬁcantly better than all other baselines on CIFAR10/CIFAR100 tasks, we argue in Appendix F.3 that this is primarily due to the convenient choice of the data set used for pretraining the transformer models (i.e. Imagenet21k) which is strikingly similar to the ID and OOD data.

Original: OpenHybrid [Zhang et al., 2020a] is an open set recognition approach which reports great near OOD detection performance.

Original: We note that, despite our best efforts, we did not manage to match in our own experiments the results reported in the paper, even after communicating with the authors and using the code that they have provided.

Original: Moreover, we point out that the performance of OpenHybrid seems to deteriorate signiﬁcantly when the ID data consists of numerous classes, as is the case for CIFAR100.

Original: Furthermore, we note that generative models [Nalisnick et al., 2019, Akçay et al., 2018] and one-class classiﬁcation approaches [Ruff et al., 2020, Tack et al., 2020, Sohn et al., 2021] showed generally bad performance, in particular on near

Original: OOD data.

Original: When the ID training set is made up of several diverse classes, it is difﬁcult to represent accurately all the ID data, and only the ID data.

Original: F.3 SHORTCOMINGS OF PRETRAINED VIT MODELS FOR NOVELTY DETECTION

Original: In this section we provide further experimental results pointing to the fact that large pretrained transformer models [Fort et al., 2021] can only detect near OOD samples from certain speciﬁc data sets, and do not generalize well more broadly.

Original: Implementation details.

Original: We ﬁne-tune visual transformer (ViT) models pretrained on Imagenet21k according the methodology described in Fort et al.

Original: We report results using the ViT-S-16 architecture ( 22 million trainable parameters) which we ﬁne-tune for 2500 iterations on labeled ID data.

Original: We use the hyperparameters suggested by the authors and always ensure that the prediction accuracy of the ﬁne-tuned model on ID data is in the expected range.

Original: The code published by the authors uses three different test statistics to detect OOD data: the maximum softmax probability [Hendrycks and Gimpel, 2017], the vanilla Mahalanobis distance [Lee et al., 2018] and a recently proposed variant of the Mahalanobis approach

Original: [Table]

Original: [Table]

Original: [Ren et al., 2021].

Original: In Table 6 we present only the metrics obtained with the best-performing test statistic for ViT.

Original: We stress that this favors the ViT method signiﬁcantly, as different test statistics seem to perform better on different data sets.

Original: Since test OOD data is unknown, it is not possible to select which test statistic to use a priori, and hence, we use oracle knowledge to give ViT models an unfair advantage

Original: [Table]

Original: Experimental results.

Original: In Table 6 we compare pretrained visual transformers with 5-model ERD and ERD++ ensembles.

Original: Notably, the data sets can be partitioned in two clusters, based on ViT novelty detection performance.

Original: On the one hand, if the

Original: ID or OOD data comes from CIFAR10 or CIFAR100, ViT models can detect novel-class samples well.

Original: Perhaps surprisingly,

Original: ViT fails short of detecting OOD data perfectly (i.e. AUROC and TNR@95 of 1) on easy tasks such as CIFAR10 vs SVHN or CIFAR100 vs SVHN, unlike ERD and a number of other baseline approaches.

Original: On the other hand, ViT shows remarkably poor performance on all other data sets, when neither the ID nor the OOD data come from CIFAR10/CIFAR100.

Original: This includes some of the novel disease use cases from the medical OOD detection benchmark (see Appendix G for more details about the data sets).

Original: This unsatisfactory performance persists even for larger

Original: ViT models (we have tried ViT-S-16 and ViT-B-16 architectures), when ﬁne-tuning for more iterations (we have tried both 2500 and 10000 iterations), or when varying hyperparameters such as the learning rate.

Original: Intuition for why ViT fails.

Original: We conjecture that the novelty detection performance with pretrained ViT models relies heavily on the choice of the pretraining data set.

Original: In particular, we hypothesize that, since CIFAR10/CIFAR100 classes are included in the Imagenet21k data set used for pretraining, the models learn features that are useful for distinguishing ID and OOD classes when the ID and/or OOD data comes from CIFAR10/CIFAR100.

Original: Hence, this would explain the good performance of pretrained models on the data sets at the top of Table 6.

Original: On the other hand, when ID and OOD data is strikingly different from the pretraining data, both ID and OOD samples are projected to the same concentrated region of the representation space, which makes it difﬁcult to detect novel-class points.

Original: Moreover, the process of ﬁne-tuning as it is described in Fort et al.

Original: [2021] seems to not help to alleviate this problem.

Original: This leads to the poor performance observed on the near OOD data sets at the bottom of Table 6.

Original: In conclusion, having a large pretraining data set seems to be beneﬁcial when the OOD data shares many visual and semantic features in common with the pretraining data.

Original: However, in real-world applications it is often difﬁcult to collect such large data sets, which makes the applicability of pretrained ViT models limited to only certain speciﬁc scenarios

Original: [Table]

Original: [Table]

Original: [Table]

Original: F.4 OOD DETECTION FOR DATA WITH COVARIATE SHIFT

Original: In this section we evaluate the baselines and the method that we propose on settings in which the OOD data suffers from covariate shift.

Original: The goal is to identify all samples that come from the shifted distribution, regardless of how strong the shift is.

Original: Notice that mild shifts may be easier to tackle by domain adaptation algorithms, but when the goal is OOD detection they pose a much more difﬁcult challenge.

Original: We want to stress that in practice one may not be interested in identifying all samples with distribution shift as OOD, since a classiﬁer may still produce correct predictions on some of them.

Original: In contrast, when data suffers from covariate shift we can try to learn predictors that perform well on both the training and the test distribution, and we may use a measure of predictive uncertainty to identify only those test samples on which the classiﬁer cannot make conﬁdent predictions.

Original: Nevertheless, we use these covariate shift settings as a challenging OOD detection benchmark and show in Table 8 that our method ERD does indeed outperform prior baselines on these difﬁcult settings.

Original: We use as outliers corrupted variants of CIFAR10 and CIFAR100 [Hendrycks and Dietterich, 2019], as well as a scenario where ImageNet [Deng et al., 2009] is used as ID data and ObjectNet [Barbu et al., 2019] as OOD, both resized to 32x32.

Original: Figure 10 shows samples from these data sets.

Original: The Gram and nnPU baselines do not give satisfactory results on the difﬁcult

Original: CIFAR10/CIFAR100 settings in Table 1 and thus we do not consider them for the covariate shift cases.

Original: For the SSND methods (e.g. MCD, Mahal-U and ERD/ERD++) we evaluate on the same unlabeled set that is used for training (see the discussion in Section F.1).

Original: Furthermore, we present results on distinguishing between CIFAR10 [Krizhevsky, 2009] and CIFAR10v2 [Recht et al., 2019], a data set meant to be drawn from the same distribution as CIFAR10 (generated from the Tiny Images collection).

Original: In

Original: Recht et al.

Original: [2019], the authors argue that CIFAR10 and CIFAR10v2 come from very similar distributions.

Original: They provide supporting evidence by training a binary classiﬁer to distinguish between them, and observing that the accuracy that is obtained of 52.9% is very close to random.

Original: Our experiments show that the two data sets are actually distinguishable, contrary to what previous work has argued.

Original: First, our own binary classiﬁer trained on CIFAR10 vs CIFAR10v2 obtains a test accuracy of 67%, without any hyperparameter tuning.

Original: The model we use is a ResNet20 trained for 200 epochs using SGD with momentum 0.9.

Original: The learning rate is decayed by 0.2 at epochs 90, 140, 160 and 180.

Original: We use 1600 examples from each data set for training, and we validate usingexamples from each data set.

Original: [Table]

Original: Our OOD detection experiments (presented in Table 7) show that most baselines are able to distinguish between the two data sets, with ERD achieving the highest performance.

Original: The methods which require OOD data for tuning (Outlier Exposure and DPN) use CIFAR

Original: [Table]

Original: [Table]

Original: F.5 RESULTS WITH A SMALLER UNLABELED SET

Original: We now show that our method performs well even when the unlabeled set is signiﬁcantly smaller.

Original: In particular, we show in the table below that ERD maintains a high AUROC and TNR@95 even when only 1,000 unlabeled samples are used for ﬁne-tuning (500 ID and 500 OOD)

Original: [Table]

Original: [Table]

Original: F.6 MORE RESULTS FOR OUTLIER EXPOSURE

Original: The Outlier Exposure method needs access to a set of OOD samples during training.

Original: The numbers we report in the rest of paper for Outlier Exposure are obtained by using the TinyImages data set as the OOD samples that are seen during training.

Original: In this section we explore the use of an OOD train data set that is more similar to the OOD data observed at test time.

Original: This is a much easier setting for the Outlier Exposure method: the closer OOD train is to OOD test , the easier it will be for the model tuned on OOD train to detect the test OOD samples.

Original: In the table below we focus only on the settings with corruptions.

Original: For each corruption type, we use the lower severity corruption as OOD train and evaluate on the higher severity data and vice versa.

Original: We report for each metric the average taken over all corruptions (A), and the value for the worst-case setting (W)

Original: [Table]

Original: F.7 RESULTS ON MNIST AND FASHIONMNIST

Original: [Table]

Original: For FashionMNIST we chose this particular split (i.e. classes 0,2,3,7,8 vs classes 1,4,5,6,9) because the two partitions are more similar to each other.

Original: This makes novelty detection more difﬁcult than the 0-4 vs 5-9 split.

Original: F.8 VANILLA AND ERD ENSEMBLES WITH DIFFERENT ARCHITECTURES

Original: In this section we present OOD detection results for 5-model Vanilla and ERD ensembles with different architecture choices, and note that the better performance of our method is maintained across model classes.

Original: Moreover, we observe that ERD beneﬁts from employing more complex models, like the WideResNet

Original: [Table]

Original: [Table]

Original: [Figure]

Original: F.9 IMPACT OF THE ENSEMBLE SIZE AND OF THE CHOICE OF ARBITRARY LABEL

Original: In this section we show novelty detection results with our method using a smaller number of models for the ensembles.

Original: We notice that the performance is not affected substantially, indicating that the computation cost of our approach could be further reduced by ﬁne-tuning smaller ensembles.

Original: [Table]

Original: Impact of the choice of arbitrary labels. Furthermore, we note that in the table we report averages over 3 runs of our method, where for each run we use a different subset of Y to assign arbitrary labels to the unlabeled data. We do this in order to assess the stability of ERD ensembles to the choice of the arbitrary labels and notice that the novelty detection performance metrics do not vary signiﬁcantly. Concretely, the standard deviations are consistently below 0 .
Revised: In summary, we propose an SSND procedure that exploits unlabeled data effectively to generate an ensemble with regularized disagreement, which achieves remarkable novelty detection performance.

Original: 01 for all data sets for the AUROC metric, and below 0 .

Original: 07 for the TNR@95 metric.

Original: F.10 DETECTION PERFORMANCE ON DIFFERENT OOD DATA

Original: In this section we investigate whether the proposed method maintains its good novelty detection performance when the test-time OOD data comes from a different data set compared to the OOD data that is present in the unlabeled set used for ﬁne-tuning.

Original: In particular, we are interested if our approach can still identify outliers in situations when they suffer from various corruptions.

Original: This scenario can sometimes occur in practice, when machine failure or uncurated data can lead to mild distribution shift.

Original: Concretely, we focus on the difﬁcult near OOD scenarios and take as ID half of the CIFAR10 or CIFAR100 classes, while the other half is OOD.

Original: For this experiment, we ﬁne-tune the ERD ensembles using clean OOD data from the other half of

Original: CIFAR10 and CIFAR100, respectively.

Original: For evaluation, we use clean ID data and corrupted OOD samples from CIFAR10-C and CIFAR100-C, respectively.

Original: We give more details on these corrupted data sets in Appendix F.4.

Original: We consider corruptions of severity 2 and 5 from all corruptions types.

Original: In Table 14 we show the average AUROC and the worst AUROC over all corruption types for vanilla and ERD ensembles.

Original: Note that our approach maintains a similar performance compared to the numbers presented in Table 1 for same test-time OOD data. It is also noteworthy that all the average AUROC values are consistently larger than the baselines in Table 1. [Table]
Revised: Our SSND method does not need labeled OOD data during training unlike many other related works summarized in Table 2.

Original: G MEDICAL OOD DETECTION BENCHMARK

Original: The medical OOD detection benchmark is organized as follows.

Original: There are four training (ID) data sets, from three different domains: two data sets with chest X-rays, one with fundus imaging and one with histology images.

Original: For each ID data set, the authors consider three different OOD scenarios:

Original: Use case 1: The OOD data set contains images from a completely different domain, similar to our category of easy OOD detection settings.

Original: Use case 2: The OOD data set contains images with various corruptions, similar to the hard covariate shift settings that we consider in Section F.4.

Original: Use case 3: The OOD data set contains images that come from novel classes, not seen during training.

Original: The authors evaluate a number of methods on all these scenarios.

Original: The methods can be roughly categorized as follows:

Original: Data-only methods: Fully non-parametric approaches like kNN.

Original: Classiﬁer-only methods: Methods that use a classiﬁer trained on the training set, e.g. ODIN [Liang et al., 2018], Mahalanobis [Lee et al., 2018].

Original: ERD falls into this category as well.

Original: Methods with Auxiliary Models: Methods that use an autoencoder or a generative model, like a Variational Autoencoder or a Generative Adversarial Network.

Original: Some of these approaches can be expensive to train and difﬁcult to optimize and tune.

Original: We stress the fact that for most of these methods the authors use (known) OOD data during training.

Original: Oftentimes the OOD samples observed during training come from a data set that is very similar to the OOD data used for evaluation.

Original: For exact details regarding the data sets and the methods used for the benchmark, we refer the reader to Cao et al.

Original: In addition, in Figure 13 we present the average taken over only the novel-class settings in the medical benchmark.

Original: We observe that the performance of all methods is drastically affected, all of them performing much worse than the average presented in Figure 12.

Original: This stark decrease in AUROC and TNR@95 indicates that novelty detection is indeed a challenging task for OOD detection methods even in realistic settings.

Original: Nevertheless, 2-model ERD ensembles maintain a better performance than the baselines.

Original: In Figures 14, 15, 16 we present AUROC and AUPR (Area under the Precision Recall curve) for ERD for each of the training data sets, and each of the use cases.

Original: Figure 12 presents averages over all settings that we considered, for all the baseline methods in the benchmark.

Original: Notably, ERD performs well consistently across data sets.

Original: The baselines are ordered by their average performance on all the settings (see Figure 12).

Original: For all medical benchmarks, the unlabeled set is balanced, with an equal number of ID and OOD samples (subsampling the bigger data set, if necessary).

Original: We use the unlabeled set for evaluation.

Original: H EFFECT OF LEARNING RATE AND BATCH SIZE

Original: We show now that ERD ensembles are not too sensitive to the choice of hyperparameters.

Original: We illustrate this by varying the learning rate and the batch size, the hyperparameters that we identify as most impactful. As Figure 17 shows, many different conﬁgurations lead to similar novelty detection performance. I ADDITIONAL FIGURE SHOWING THE DEPENDENCE ON THE UNLABELED SET CONFIGURATION The conﬁguration of the unlabeled set (i.e. the size of the unlabeled set, the ratio ofOOD samples in the unlabeled set) inﬂuences the performance of our method, as illustrated in Figure 5b.
Revised: We leave as future work a thorough investigation of the impact of the labeling scheme of the unlabeled set on the sample complexity of the method, as well as an analysis of the trade-off governed by the complexity of the model class

Original: Below, we show that the same trend persists for different data sets too, e.g. when we consider CIFAR10 as ID data and SVHN as OOD data.

Original: J LEARNING CURVES FOR OTHER DATA SETS

Original: In addition to Figure 4, we present in this section learning curves for other data sets as well.

Original: The trend that persists throughout all ﬁgures is that the arbitrary label is learned ﬁrst on the unlabeled OOD data.

Original: Choosing a stopping time before the validation accuracy starts to deteriorate prevents the model from ﬁtting the arbitrary label on unlabeled ID data.

Original: Impact of near OOD data on training ERD ensembles.

Original: The learning curves illustrated in Figure 19 provide insight into what happens when the OOD data is similar to the ID training samples and the impact that has on training the proposed method.

Original: In particular, notice that for CIFAR10[0-4] vs CIFAR10[5-9] in Figure 19d, the models require more training epochs before reaching an accuracy on unlabeled OOD samples of 100%.

Original: The learning of the arbitrary label on the OOD samples is delayed by the fact that the ID and OOD data are similar, and hence, the bias of the correctly labeled training set has a strong effect on the predictions of the models on the OOD inputs.

Original: Since we early stop when the validation accuracy starts deteriorating (e.g. at around epoch 8 in Figure 19d), we end up using models that do not interpolate the arbitrary label on the OOD samples.

Original: Therefore, the ensemble does not disagree on the entirety of the OOD data in the unlabeled set, which leads to lower novelty detection performance.

Original: Importantly, however, our empirical evaluation reveals that the drop in performance for ERD ensembles is substantially smaller than what we observe for other OOD detection methods, even on near OOD data sets.

Original: [Figure]

Original: K EVOLUTION OF DISAGREEMENT SCORE DURING FINE-TUNING

Original: In this section we illustrate how the distribution of the disagreement score changes during ﬁne-tuning for ID and OOD data, for a 5-model ERD ensemble.

Original: Thus, we can further understand why the performance of the ERD ensembles is impacted by near OOD data.

Original: Figure 20 reveals that for far OOD data (the left column) the disagreement scores computed on OOD samples are well separated from the disagreement scores on ID data (note that disagreement on OOD data is so concentrated around the maximum value of 2 that the boxes are essentially reduced to a line segment).

Original: On the other hand, for near OOD data (the right column) there is sometimes signiﬁcant overlap between the disagreement scores on ID and OOD data, which leads to the slightly lower AUROC values that we report in Table 1.

Original: The ﬁgures also illustrate how the disagreement on the ID data tends to increase as we ﬁne-tune the ensemble for longer, as a consequence of the models ﬁtting the arbitrary labels on the unlabeled ID samples.

Original: Conversely, in most instances one epoch sufﬁces for ﬁtting the arbitrary label on the OOD data.

Original: [Figure]

Original: We need to make one important remark: While in the ﬁgure we present disagreement scores for the ensemble obtained after each epoch of ﬁne-tuning, we stress that the ﬁnal ERD ensemble need not be selected among these.

Original: In particular, since each model for ERD is early stopped separately, potentially at a different iteration, it is likely that the ERD ensemble contains models ﬁne-tuned for a different number of iterations.

Original: Since we select the ERD ensembles from a strictly larger set, the ﬁnal ensemble selected by the our proposed approach will be at least as good at distinguishing ID and OOD data as the best ensemble depicted in Figure 20.