Original: E NHANCING T HE R ELIABILITY OF O UT - OF - DISTRIBUTION I MAGE D ETECTION IN N EURAL N ETWORKS
Revised: E NHANCING T HE R ELIABILITY OF O UT - OF - DISTRIBUTION I MAGE D ETECTION IN N EURAL N ETWORKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: We consider the problem of detecting out-of-distribution images in neural networks.
Revised: We consider the problem of detecting out-of-distribution images in neural networks.

Original: We propose ODIN , a simple and effective method that does not require any change to a pre-trained neural network.
Revised: We propose ODIN , a simple and effective method that does not require any change to a pre-trained neural network.

Original: Our method is based on the observation that using temperature scaling and adding small perturbations to the input can separate the softmax score distributions between in- and out-of-distribution images, allowing for more effective detection.
Revised: Our method is based on the observation that using temperature scaling and adding small perturbations to the input can separate the softmax score distributions between in- and out-of-distribution images, allowing for more effective detection.

Original: We show in a series of experiments that ODIN is compatible with diverse network architectures and datasets.
Revised: We show in a series of experiments that ODIN is compatible with diverse network architectures and datasets.

Original: It consistently outperforms the baseline approach (Hendrycks & Gimpel, 2017) by a large margin, establishing a new state-of-the-art performance on this task.
Revised: It consistently outperforms the baseline approach (Hendrycks & Gimpel, 2017) by a large margin, establishing a new state-of-the-art performance on this task.

Original: For example, ODIN reduces the false positive rate from the baseline 34.7% to 4.3% on the DenseNet (applied to CIFAR-10) when the true positive rate is 95%.
Revised: For example, ODIN reduces the false positive rate from the baseline 34.7% to 4.3% on the DenseNet (applied to CIFAR-10 and Tiny-ImageNet) when the true positive rate is 95%.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Modern neural networks are known to generalize well when the training and testing data are sampled from the same distribution (Krizhevsky et al., 2012; Simonyan & Zisserman, 2015;
Revised: Modern neural networks are known to generalize well when the training and testing data are sampled from the same distribution (Krizhevsky et al., 2012; Simonyan & Zisserman, 2015;

Original: He et al., 2016; Cho et al., 2014; Zhang et al., 2017).
Revised: He et al., 2016; Cho et al., 2014; Zhang et al., 2017).

Original: However, when deploying neural networks in real-world applications, there is often very little control over the testing data distribution.
Revised: However, when deploying neural networks in real-world applications, there is often very little control over the testing data distribution.

Original: Recent works have shown that neural networks tend to make high conﬁdence predictions even for completely unrecognizable (Nguyen et al., 2015) or irrelevant inputs (Hendrycks & Gimpel, 2017; Szegedy et al., 2014; Moosavi-Dezfooli et al., 2017).
Revised: Recent works have shown that neural networks tend to make high conﬁdence predictions even for completely unrecognizable (Nguyen et al., 2015) or irrelevant inputs (Hendrycks & Gimpel, 2017; Szegedy et al., 2014; Moosavi-Dezfooli et al., 2017).

Original: For example, a neural network trained for classifying handwritten digits can assign high conﬁdence labels to images of animal.

Original: This has raised great concerns in AI Safety (Amodei et al., 2016), in particular how can classiﬁers obtain awareness of uncertainty when shown new kinds of inputs, i.e., out-of-distribution examples.
Revised: In the context of AI safety (Amodei et al., 2016), it has been well documented that it is important for classiﬁers to be aware of uncertainty when shown new kinds of inputs, i.e., out-of-distribution examples.

Original: Therefore, being able to accurately detect out-of-distribution examples can be practically important for visual recognition tasks (Krizhevsky et al., 2012; Farabet et al., 2013; Ji et al., 2013).
Revised: Therefore, being able to accurately detect out-of-distribution examples can be practically important for visual recognition tasks (Krizhevsky et al., 2012; Farabet et al., 2013; Ji et al., 2013).

Original: To make accurate detections, a seemingly straightforward approach  is to enlargeand re-train the neural network on boththe in- and out-of-distribution examples.
Revised: A seemingly straightforward approach of detecting out-of-distribution images is to enlarge the training set of both in- and out-of-distribution examples.

Original: However, the number of outof-distribution examples can be inﬁnitely many, making the re-training approach computationally expensive and intractable.
Revised: However, the number of out-of-distribution examples can be inﬁnitely many, making the re-training approach computationally expensive and intractable.

Original: Moreover, to ensure that a neural network accurately classiﬁes indistribution samples into correct classes while correctly detecting out-of-distribution samples, one might need to employ exceedingly large neural network architectures, which further complicates the training process.
Revised: Moreover, to ensure that a neural network accurately classiﬁes in-distribution samples into correct classes while correctly detecting out-of-distribution samples, one might need to employ exceedingly large neural network architectures, which further complicates the training process.

Original: Hendrycks & Gimpel (2017) proposed a baseline method to detect out-of-distribution examples without further re-training networks, but the performance is limited.
Revised: Hendrycks & Gimpel (2017) proposed a baseline method to detect out-of-distribution examples without further re-training networks.

Original: The method is based on an observation that a well-trained neural network tends to assign higher softmax scores to in-distribution examples than out-of-distribution examples.
Revised: The method is based on an observation that a well-trained neural network tends to assign higher softmax scores to in-distribution examples than out-of-distribution examples.

Original: In this paper, we go further.
Revised: In this paper, we go further.

Original: We observe that after using temperature scaling in the softmax function (Hinton et al., 2015; Pereyra et al., 2017) and adding small controlled perturbations to inputs, the softmax score gap between in - and out-of-distribution examples is further enlarged.
Revised: We observe that after using temperature scaling in the softmax function (Hinton et al., 2015; Pereyra et al., 2017) and adding small controlled perturbations to inputs, the softmax score gap between in - and out-of-distribution examples is further enlarged.

Original: We will show that the combination of these two techniques (temperature scaling and input perturbation) can lead to better detection performance.
Revised: We will show that the combination of these two techniques (temperature scaling and input perturbation) can lead to better detection performance.

Original: For example, provided with a pre-trained DenseNet (Huang et al., 2016) on CIFAR-10 dataset (positive samples), we test against images from TinyImageNet dataset (negative samples).
Revised: For example, provided with a pre-trained DenseNet (Huang et al., 2016) on CIFAR-10 dataset (positive samples), we test against images from TinyImageNet dataset (negative samples).

Original: Our method dramatically reduces the False Positive Rate (FPR), i.e., the fraction of misclassiﬁed out-of-distribution samples, from 34 : 7% to 4 : 3% , when 95% of in-distribution images are correctly classiﬁed.
Revised: Our method dramatically reduces the False Positive Rate (FPR), i.e., the fraction of misclassiﬁed out-of-distribution samples, from 34 : 7% to 4 : 3% , when 95% of in-distribution images are correctly classiﬁed.

Original: We summarize the main contributions of this paper as the following
Revised: We summarize the main contributions of this paper as the following:

Original: (cid:15)
Revised: (cid:15)

Original: We propose a simple and effective method, ODIN, for detecting out-of-distribution examples in neural networks.
Revised: We propose a simple and effective method, ODIN (Out-of-DIstribution detector for Neural networks), for detecting out-of-distribution examples in neural networks.

Original: Our method does not require re-training the neural network and is easily implementable on any modern neural architecture.
Revised: Our method does not require re-training the neural network and is easily implementable on any modern neural architecture.

Original: (cid:15)
Revised: (cid:15)

Original: We test ODIN on state-of-the-art network architectures (e.g., DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016)) under a diverse set of in- and out-distribution dataset pairs.
Revised: We test ODIN on state-of-the-art network architectures (e g., DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016)) under a diverse set of in- and out-distribution dataset pairs.

Original: We show ODIN can signiﬁcantly improve the detection performance, and consistently outperforms the state-of-the-art method (Hendrycks & Gimpel , 2017) by a large margin.
Revised: We show ODIN can signiﬁcantly improve the detection performance, and consistently outperforms the state-of-the-art method (Hendrycks & Gimpel, 2017) by a large margin.

Original: (cid:15)
Revised: (cid:15)

Original: We empirically analyze how parameter settings affect the performance, and further provide theoretical intuitions behind.
Revised: We empirically analyze how parameter settings affect the performance, and further provide simple analysis that provides some intuition behind our method.

Original: The outline of this paper is as follows.
Revised: The outline of this paper is as follows.

Original: In Section 2, we present  necessary deﬁnitions and the problem statement.
Revised: In Section 2, we present the necessary deﬁnitions and the problem statement.

Original: In Section 3, we introduce ODIN and present performance results in Section 4.
Revised: In Section 3, we introduce ODIN and present performance results in Section 4.

Original: We experimentally analyze the proposed method and provide theoretical intuitions in Section 5.
Revised: We experimentally analyze the proposed method and provide some justiﬁcation for our method in Section 5.

Original: We summarize the related works and future directions in Section 6 and conclude the paper in Section 7.
Revised: We summarize the related works and future directions in Section 6 and conclude the paper in Section 7.

Original:  P ROBLEM S TATEMENT
Revised:  P ROBLEM S TATEMENT

Original: In this paper, we consider the problem of distinguishing in- and out-of-distribution images on a pre-trained neural network.
Revised: In this paper, we consider the problem of distinguishing in- and out-of-distribution images on a pre-trained neural network.

Original: Let P X and Q X denote two distinct data distributions deﬁned on the image space X .
Revised: Let P X and Q X denote two distinct data distributions deﬁned on the image space X .

Original: Assume that a neural network f is trained on a dataset drawn from the distribution
Revised: Assume that a neural network f is trained on a dataset drawn from the distribution

Original: P X .
Revised: P X .

Original: Thus, we call P X the in-distribution and Q X the out-distribution , respectively.
Revised: Thus, we call P X the in-distribution and Q X the out-distribution , respectively.

Original: In detection, we draw new images from a mixture distribution P X (cid:2)
Revised: In testing, we draw new images from a mixture distribution P X (cid:2)

Original: Z deﬁned on X (cid:2) f 0 ; 1 g , where the conditional probability distributions P X j Z =

Revised: Z deﬁned on X (cid:2) f 0 ; 1 g , where the conditional probability distributions P X j Z =

Original: =
Revised: =

Original: P X and P X j Z =1 =
Revised: P X and P X j Z =1 =

Original: Q X denote in- and out-distribution respectively.
Revised: Q X denote in- and out-distribution respectively.

Original: Now we focus on the following problem: Given an image X drawn from the mixture distribution P X (cid:2) Z , can we distinguish whether the image is from in-distribution P X or not ?
Revised: Now we focus on the following problem: Given an image X drawn from the mixture distribution P X (cid:2) Z , can we distinguish whether the image is from in-distribution P X or not ?

Original: In this paper, we focus on detecting out-of-distribution images.
Revised: In this paper, we focus on detecting out-of-distribution images.

Original: However, it is equally important to correctly classify an image into the right class if it is an in-distribution image.
Revised: However, it is equally important to correctly classify an image into the right class if it is an in-distribution image.

Original: But this can be easily done: once it has been detected than an image comes from the in-distribution, we can simply use the original image and run it through the neural network to classify it.
Revised: But this can be easily done: once it has been detected that an image is in-distribution, we can simply use the original image and run it through the neural network to classify it.

Original: Thus, we do not change the performance of the neural network for in-distribution images and only focus on improving the detection performance for out-of-distribution images.
Revised: Thus, we do not change the predictions of the neural network for in-distribution images and only focus on improving the detection performance for out-of-distribution images.

Original:  ODIN: O UT - OF - DISTRIBUTION D ETECTOR
Revised:  ODIN: O UT - OF - DISTRIBUTION D ETECTOR

Original: In this section, we present our method, ODIN, for detecting out-of-distribution samples.
Revised: In this section, we present our method, ODIN, for detecting out-of-distribution samples.

Original: The detector is built on two essential techniques: temperature scaling and input preprocessing.
Revised: The detector is built on two essential techniques: temperature scaling and input preprocessing.

Original: We describe the details of both components below.
Revised: We describe the details of both components below.

Original: Temperature Scaling.
Revised: Temperature Scaling.

Original: Assume that the neural network f = ( f 1 ; :::; f N ) is trained to classify
Revised: Assume that the neural network f = ( f 1 ; :::; f N ) is trained to classify

Original: N classes.
Revised: N classes.

Original: For each input x , the neural network assigns a label ^
Revised: For each input x , the neural network assigns a label ^

Original: y ( x ) =
Revised: y ( x ) =

Original: arg max i S
Revised: arg max i S

Original: i ( x ; T ) by computing the softmax output for each class.
Revised: i ( x ; T ) by computing the softmax output for each class.

Original: Speciﬁcally,
Revised: Speciﬁcally,

Original: [Equation]
Revised: [Equation]

Original: where T 2 R + is the temperature scaling parameter and set to 1 during the training.
Revised: where T 2 R + is the temperature scaling parameter and set to 1 during the training.

Original: For a given input x , we call the maximum softmax probability, i.e., S ^ y ( x ; T ) =
Revised: For a given input x , we call the maximum softmax probability, i.e., S ^ y ( x ; T ) =

Original: max i S i ( x ; T ) the softmax score .
Revised: max i S i ( x ; T ) the softmax score .

Original: In this paper, we use notations S ^ y ( x ; T ) and S ( x ; T ) interchangeably.
Revised: In this paper, we use notations S ^ y ( x ; T ) and S ( x ; T ) interchangeably.

Original: Prior works have established to use  temperature scaling to distill the knowledge in neural networks (Hinton et al., 2015) and calibrate the prediction conﬁdence in classiﬁcation tasks (Guo et al., 2017).
Revised: Prior works have established the use of temperature scaling to distill the knowledge in neural networks (Hinton et al., 2015) and calibrate the prediction conﬁdence in classiﬁcation tasks (Guo et al., 2017).

Original: As we shall see later, a good manipulation of temperature T can push the softmax scores of in- and out-of-distribution images further apart from each other, making the out-of-distribution images distinguishable.
Revised: As we shall see later, a good manipulation of temperature T can push the softmax scores of in- and out-of-distribution images further apart from each other, making the out-of-distribution images distinguishable.

Original: Input Preprocessing.
Revised: Input Preprocessing.

Original: Before feeding the image x into the neural network, we preprocess the input by adding small perturbations.
Revised: Before feeding the image x into the neural network, we preprocess the input by adding small perturbations to it.

Original: The preprocessed image is given by
Revised: The preprocessed image is given by

Original: [Equation]
Revised: [Equation]

Original: where the parameter " can be interpreted as the perturbation magnitude.
Revised: where the parameter " can be interpreted as the perturbation magnitude.

Original: The method is inspired by the idea of Goodfellow et al. (2015), where small perturbations are added to decrease the softmax score for the true label and force the neural network to make a wrong prediction.
Revised: The method is inspired by the idea in the reference (Goodfellow et al., 2015), where small perturbations are added to decrease the softmax score for the true label and force the neural network to make a wrong prediction.

Original: Here, our goal and setting is rather different: we aim to increase the softmax score of any given input, without the need for a class label at all.
Revised: Here, our goal and setting are rather different: we aim to increase the softmax score of any given input, without the need for a class label at all.

Original: As we shall see later, the perturbation can have stronger effect on the indistribution images than that on out-of-distribution images, making them more separable.
Revised: As we shall see later, the perturbation can have stronger effect on the in- distribution images than that on out-of-distribution images, making them more separable.

Original: Note that the perturbations can be easily computed by back-propagating the gradient of the cross-entropy loss w.r.t the input.
Revised: Note that the perturbations can be easily computed by back-propagating the gradient of the cross-entropy loss w.r.t the input.

Original: Out-of-distribution Detector.
Revised: Out-of-distribution Detector.

Original: The proposed approach, ODIN, works as follows.
Revised: The proposed approach works as follows.

Original: For each image x , we ﬁrst calculate the preprocessed image ~ x according to the equation (2).
Revised: For each image x , we ﬁrst calculate the preprocessed image ~ x according to the equation (2).

Original: Next, we feed the preprocessed image ~ x into the neural network, calculate its softmax score S (~ x ; T ) and compare the score to the threshold (cid:14) .
Revised: Next, we feed the preprocessed image ~ x into the neural network, calculate its softmax score S (~ x ; T ) and compare the score to the threshold (cid:14) .

Original: We say that the image x is an in-distribution example if the softmax score is above the threshold and that the image x is an out-of-distribution example, otherwise.
Revised: We say that the image x is an in-distribution example if the softmax score is above the threshold and that the image x is an out-of-distribution example, otherwise.

Original: Therefore, the out-of-distribution detector is given by
Revised: Therefore, the out-of-distribution detector is given by

Original: [Equation]
Revised: [Equation]

Original: The detection error P e ( T; ") under temperature T and perturbation magnitude " is deﬁned as [Equation] representing the minimum misclassiﬁcation probability over all thresholds.
Revised: The parameters T; " and (cid:14) are chosen so that the true positive rate (i.e., the fraction of in-distribution images correctly classiﬁed as in-distribution images) under some out-of-distribution image data set is 95% : (The choice of the out-of-distribution images to tune the parameters T; " and (cid:14) appears to be unimportant, as demonstrated in the appendix H.) Having chosen the parameters as above, we evaluate the performance of our algorithm using various metrics in the next section.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: In this section, we demonstrate the effectiveness of ODIN on several computer vision benchmark datasets.
Revised: In this section, we demonstrate the effectiveness of ODIN on several computer vision benchmark datasets.

Original: We run all experiments with PyTorch 1 and we will release the code to reproduce all experimental results 2 .
Revised: We run all experiments with PyTorch 1 and we will release the code to reproduce all experimental results 2 .

Original: 4. T RAINING S ETUP
Revised: 4. T RAINING S ETUP

Original: Architectures and training conﬁgurations.
Revised: Architectures and training conﬁgurations.

Original: We adopt two state-of-the-art neural network architectures, including DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016).
Revised: We adopt two state-of-the-art neural network architectures, including DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016).

Original: For DenseNet, our model follows the same setup as in (Huang et al., 2016), with depth
Revised: For DenseNet, our model follows the same setup as in (Huang et al., 2016), with depth

Original: L = 100 , growth rate k = 

Revised: L = 100 , growth rate k =

Original: (Dense-BC) and dropout rate 0.
Revised: (Dense-BC) and dropout rate 0.

Original: In addition, we evaluate the method on a Wide ResNet, with depth 28 , width 10 (WRN-28-10) and dropout rate 0.
Revised: In addition, we evaluate the method on a Wide ResNet, with depth 28 , width 10 (WRN-28-10) and dropout rate 0.

Original: Furthermore, in
Revised: Furthermore, in

Original: Appendix A.1, we provide additional experimental results on another Wide ResNet with depth 40, width 4 (WRN-40-4), which is as well used by Hendrycks & Gimpel (2017).
Revised: Appendix A.1, we provide additional experimental results on another Wide ResNet with depth 40, width 4 (WRN-40-4).

Original: The hyper-parameters of neural networks are set identical to the original Wide ResNet (Zagoruyko & Komodakis, 2016) and DenseNet (Huang et al., 2016) implementations.
Revised: The hyper-parameters of neural networks are set identical to the original Wide ResNet (Zagoruyko & Komodakis, 2016) and DenseNet (Huang et al., 2016) implementations.

Original: All neural networks are trained with stochastic gradient descent with Nesterov momentum (Duchi et al., 2011; Kingma & Ba, 2014).
Revised: All neural networks are trained with stochastic gradient descent with Nesterov momentum (Duchi et al., 2011; Kingma & Ba, 2014).

Original: Speciﬁcally, we train Dense-BC for 300 epochs with batch size 64 and momentum 0.9; and Wide ResNet forepochs with batch size 128 and momentum 0.9.
Revised: Speciﬁcally, we train Dense-BC for 300 epochs with batch sizeand momentum 0.9; and Wide ResNet for 200 epochs with batch size 128 and momentum 0.9.

Original: The learning rate starts at 0.1, and is dropped by a factor of 10 at 50% and 75% of the training progress, respectively.
Revised: The learning rate starts at 0.1, and is dropped by a factor of 10 at 50% and 75% of the training progress, respectively.

Original: [Table]
Revised: [Table]

Original: Accuracy.
Revised: Accuracy.

Original: Each neural network architecture is trained on CIFAR-10 (C-10) and CIFAR-100 (C-100) datasets (Krizhevsky & Hinton, 2009), respectively.
Revised: Each neural network architecture is trained on CIFAR-10 (C-10) and CIFAR-100 (C-100) datasets (Krizhevsky & Hinton, 2009), respectively.

Original: CIFAR-10 and CIFAR-100 images are drawn from 10 and 100 classes, respectively.
Revised: CIFAR-10 and CIFAR-100 images are drawn from 10 and 100 classes, respectively.

Original: Both datasets consist of 50, training images and 10,000 test images.
Revised: Both datasets consist of 50, training images and 10,000 test images.

Original: The test error on
Revised: The test error on

Original: CIFAR datasets are summarized in Table 1. 
Revised: CIFAR datasets are summarized in Table 1. [Table]

Original: 4. O UT - OF - DISTRIBUTION D ATASETS
Revised: 4. O UT - OF - DISTRIBUTION D ATASETS

Original: At test time, the test images from CIFAR-10 (CIFAR-100) datasets can be viewed as the indistribution (positive) examples.
Revised: At test time, the test images from CIFAR-10 (CIFAR-100) datasets can be viewed as the indistribution (positive) examples.

Original: For out-of-distribution (negative) examples, we follow the setting[Table] in (Hendrycks & Gimpel, 2017) and test on several different natural image datasets and synthetic noise datasets.
Revised: For out-of-distribution (negative) examples, we follow the setting in (Hendrycks & Gimpel, 2017) and test on several different natural image datasets and synthetic noise datasets.

Original: All the datasets considered are listed below.
Revised: All the datasets considered are listed below.

Original: (1) TinyImageNet.
Revised: (1) TinyImageNet.

Original: The Tiny ImageNet dataset 3 consists of a subset of ImageNet images (Deng et al., 2009).
Revised: The Tiny ImageNet dataset 3 consists of a subset of ImageNet images (Deng et al., 2009).

Original: It contains 10,000 test images from 200 different classes.
Revised: It contains 10,000 test images from 200 different classes.

Original: We construct two datasets, TinyImageNet (crop) and TinyImageNet (resize) , by either randomly cropping image patches of size 32 (cid:2) 32 or downsampling each image to size 32 (cid:2) 32 .
Revised: We construct two datasets, TinyImageNet (crop) and TinyImageNet (resize) , by either randomly cropping image patches of size 32 (cid:2) 32 or downsampling each image to size 32 (cid:2) 32 .

Original: (2) LSUN.
Revised: (2) LSUN.

Original: The Large-scale Scene UNderstanding dataset (LSUN) has a testing set of 10,000 images of 10 different scenes (Yu et al., 2015).
Revised: The Large-scale Scene UNderstanding dataset (LSUN) has a testing set of 10,000 images of 10 different scenes (Yu et al., 2015).

Original: Similar to TinyImageNet, we construct two datasets, LSUN (crop) and LSUN (resize) , by randomly cropping and downsampling the LSUN testing set, respectively.
Revised: Similar to TinyImageNet, we construct two datasets, LSUN (crop) and LSUN (resize) , by randomly cropping and downsampling the LSUN testing set, respectively.

Original: (3) iSUN.
Revised: (3) iSUN.

Original: The iSUN (Xu et al., 2015) consists of a subset of SUN images.
Revised: The iSUN (Xu et al., 2015) consists of a subset of SUN images.

Original: We include the entire collection of 8925 images in iSUN and downsample each image to size 32 by 32 .
Revised: We include the entire collection of 8925 images in iSUN and downsample each image to size 32 by 32 .

Original: (4) Gaussian Noise.
Revised: (4) Gaussian Noise.

Original: The synthetic Gaussian noise dataset consists of 10,000 random 2D Gaussian noise images, where each RGB value of every pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and unit variance.
Revised: The synthetic Gaussian noise dataset consists of 10,000 random 2D Gaussian noise images, where each RGB value of every pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and unit variance.

Original: We further clip each pixel value into the range [0 ; 1] .
Revised: We further clip each pixel value into the range [0 ; 1] .

Original: (5) Uniform Noise.
Revised: (5) Uniform Noise.

Original: The synthetic uniform noise dataset consists of 10,000 images where each RGB value of every pixel is independently and identically sampled from a uniform distribution on [0 ; 1] .
Revised: The synthetic uniform noise dataset consists of 10,000 images where each RGB value of every pixel is independently and identically sampled from a uniform distribution on [0 ; 1] .

Original: 4. E VALUATION METRICS
Revised: 4. E VALUATION METRICS

Original: We adopt the following four different metrics to measure the effectiveness of a neural network in distinguishing in- and out-of-distribution images.
Revised: We adopt the following four different metrics to measure the effectiveness of a neural network in distinguishing in- and out-of-distribution images.

Original:  FPR at 95% TPR can be interpreted as the probability that a negative (out-of-distribution) example is misclassiﬁed as positive (in-distribution) when the true positive rate (TPR) is as high as 95% .
Revised: (1) FPR at 95% TPR can be interpreted as the probability that a negative (out-of-distribution) example is misclassiﬁed as positive (in-distribution) when the true positive rate (TPR) is as high as 95% .

Original: True positive rate can be computed by TPR = TP / (TP+FN), where TP and FN denote true positives and false negatives respectively.
Revised: True positive rate can be computed by TPR = TP / (TP+FN), where TP and FN denote true positives and false negatives respectively.

Original: The false positive rate (FPR) can be computed by FPR =
Revised: The false positive rate (FPR) can be computed by FPR =

Original: FP / (FP+TN), where FP and TN denote false positives and true negatives respectively.
Revised: FP / (FP+TN), where FP and TN denote false positives and true negatives respectively.

Original:  Detection Error i .e. P e measures theminimum misclassiﬁcation probability over all possible score thresholds.
Revised: (2) Detection Error , i.e., P e measures the misclassiﬁcation probability when TPR is 95%.

Original: The deﬁnition of P e is given in equation (3). Here, we set that both positive and negative examples have  equal probability of appearing in the test set.
Revised: The deﬁnition of P e is given by P e = 0 : 5(1 (cid:0) TPR ) + 0 : 5 FPR, where we assume that both positive and negative examples have the equal probability of appearing in the test set.

Original: 3) AUROC is the Area Under the Receiver Operating Characteristic curve, which is also a thresholdindependent metric (Davis & Goadrich, 2006).
Revised: (3) AUROC is the Area Under the Receiver Operating Characteristic curve, which is also a thresholdindependent metric (Davis & Goadrich, 2006).

Original: The ROC curve depicts the relationship between TPR and FPR.
Revised: The ROC curve depicts the relationship between TPR and FPR.

Original: The AUROC can be interpreted as the probability that a positive example is assigned a higher detection score than a negative example (Fawcett, 2006).
Revised: The AUROC can be interpreted as the probability that a positive example is assigned a higher detection score than a negative example (Fawcett, 2006).

Original: A perfect detector corresponds to an AUROC score of 100% .
Revised: A perfect detector corresponds to an AUROC score of 100% .

Original:  AUPR is the Area under the Precision-Recall curve, which is another threshold independent metric (Manning et al., 1999; Saito & Rehmsmeier, 2015).
Revised: (4) AUPR is the Area under the Precision-Recall curve, which is another threshold independent metric (Manning et al., 1999; Saito & Rehmsmeier, 2015).

Original: The PR curve is a graph showing the precision=TP/(TP+FP) and recall=TP/(TP+FN) against each other.
Revised: The PR curve is a graph showing the precision=TP/(TP+FP) and recall=TP/(TP+FN) against each other.

Original: The metric AUPR-In and AUPR-Out in Table 2 denote the area under the precision-recall curve where in-distribution and out-of-distribution images are speciﬁed as positives, respectively.
Revised: The metric AUPR-In and AUPR-Out in Table 2 denote the area under the precision-recall curve where in-distribution and out-of-distribution images are speciﬁed as positives, respectively.

Original: 4. E XPERIMENTALR ESULTS
Revised: 4. E XPERIMENTAL

Original: [Figure]
Revised: [Figure]

Original: Comparison with baseline.
Revised: Comparison with baseline.

Original: In Figure 1, we show the ROC curves when DenseNet-BC-100 is evaluated on CIFAR- (positive) images against TinyImageNet (negative) test examples.
Revised: In Figure 1, we show the ROC curves when DenseNet-BC-100 is evaluated on CIFAR- (positive) images against TinyImageNet (negative) test examples.

Original: The red curve corresponds to the ROC curve when using baseline method (Hendrycks & Gimpel, 2017), whereas the blue curve corresponds to our method with temperature
Revised: The red curve corresponds to the ROC curve when using baseline method (Hendrycks & Gimpel, 2017), whereas the blue curve corresponds to our method with temperature

Original: T = 1000 and perturbation magnitude " = 0 : 0012 .
Revised: T = 1000 and perturbation magnitude " = 0 : 0012 .

Original: We observe a strikingly large gap between the blue and red ROC curves.
Revised: We observe a strikingly large gap between the blue and red ROC curves.

Original: For example, when TPR = 95% , the FPR can be reduced from 34% to 4 : 2% by using our approach.
Revised: For example, when TPR = 95% , the FPR can be reduced from 34% to 4 : 2% by using our approach.

Original: Choosing parameters.
Revised: Choosing parameters.

Original: For each out-of-distribution dataset, we randomly hold out 1,000 images for tuning the parameters
Revised: For each out-of-distribution dataset, we randomly hold out 1,000 images for tuning the parameters

Original: T and " .
Revised: T and " .

Original: For temperature T , we select among 1, 2, 5, 10, 20, 50, 100, 200, 500, 1000; and for perturbation magnitude " we choose from 21 evenly spaced numbers starting fromand ending at 0.004.
Revised: For temperature T , we select among 1, 2, 5, 10, 20, 50, 100, 200, 500, 1000; and for perturbation magnitude " we choose from 21 evenly spaced numbers starting fromand ending at 0.004.

Original: The optimal parameters are chosen to minimize the detection error on the holdout set.
Revised: The optimal parameters are chosen to minimize the FPR at TPR 95% on the holdout set.

Original: We evaluate the our approach on the remaining test images.
Revised: We evaluate the our approach on the remaining test images.

Original: All parameter settings are reported in the Appendix A. We provide additional details on the effect of parameters in Section 5.
Revised: All parameter settings are reported in the Appendix A. We provide additional details on the effect of parameters in Section 5.

Original: Main results.
Revised: Main results.

Original: The main results are summarized in Table 2.
Revised: The main results are summarized in Table 2.

Original: For each in- and out-of-distribution dataset pair, we report both the performance of the baseline (Hendrycks & Gimpel, 2017) and our approach using temperature scaling and input preprocessing.
Revised: For each in- and out-of-distribution dataset pair, we report both the performance of the baseline (Hendrycks & Gimpel, 2017) and our approach using temperature scaling and input preprocessing.

Original: In Table 2, we observed improved performance across all neural architectures and all dataset pairs.
Revised: In Table 2, we observe improved performance across all neural architectures and all dataset pairs.

Original: Noticeably, our method consistently outperforms the baseline by a large margin when measured by FPR at 95% TPR and detection error.
Revised: Noticeably, our method consistently outperforms the baseline by a large margin when measured by FPR at 95% TPR and detection error.

Original: 4. E XTENSIONS
Revised: 4. E XTENSIONS

Original: In this subsection, we analyze how the statistical distance between in- and out-of-distribution natural image dataset affects the detection performance of the proposed method.
Revised: In this subsection, we analyze how the statistical distance between in- and out-of-distribution natural image dataset affects the detection performance of the proposed method.

Original: Data distribution distance vs. Detection performance.

Original: To measure the statistical distance between in- and out-of-distribution datasets, we adopt a commonly used metric, maximum mean discrepancy (MMD) with Gaussian RBF kernel (Sriperumbudur et al., 2010; Gretton et al., 2012;

Original: Sutherland et al., 2016).

Original: Speciﬁcally, given two image sets, V = f v 1 ; :::; v m g and W =

Original: [Figure]
Revised: [Figure]

Original: F P R a t
Revised: F P R a t

Original: T P R
Revised: T P R% (

Original: [Figure]
Revised: [Figure]

Original: [Figure]

Original: [Figure]
Revised: [Figure]

Original: D e t ec t i o n
Revised: D e t ec t i o n

Original: E rr o r    5 Datasets 0.
Revised: E rr o r    5 Datasets 0.

Original: 0.5 D i s t a n ce 0.
Revised: 0.5 D i s t a n ce 0.

Original: [Figure]
Revised: [Figure]

Original: D i s t a n ce

Original: [Figure]
Revised: [Figure]

Original: F P
Revised: D i s t a n ce

Original: [Figure]
Revised: [Figure]

Original: t
Revised: t

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: e t
Revised: e t

Original: [Figure]
Revised: [Figure]

Original: t i o n
Revised: t i [Figure] n

Original: [Figure]
Revised: [Figure]

Original: rr o
Revised: o

Original: [Figure] [Figure] 
Revised: [Figure] [Figure] [Figure]

Revised: D i s t a n ce 0.

Original: [Figure]
Revised: [Figure]

Original: 0.5 D i s t a n ce0.
Revised: 0.5 D i s t a n ce

Revised: Data distribution distance vs. Detection performance.

Revised: To measure the statistical distance between in- and out-of-distribution datasets, we adopt a commonly used metric, maximum mean discrepancy (MMD) with Gaussian RBF kernel (Sriperumbudur et al., 2010; Gretton et al., 2012;

Revised: Sutherland et al., 2016).

Original: 0.5 D i s t a n ce f w  w m g , the maximum mean discrepancy between V and Q is deﬁned as
Revised: Speciﬁcally, given two image sets, V = f v 1 ; :::; v m g and W = f w 1 ; :::; w m g , the maximum mean discrepancy between V and Q is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: k ( v i ; w j ) ; where k ( (cid:1) ; (cid:1) ) is the Gaussian RBF kernel, i.e., k ( x; x ′ ) =
Revised: where k ( (cid:1) ; (cid:1) ) is the Gaussian RBF kernel, i.e., k ( x; x ′ ) =

Original: exp
Revised: exp

Original: [Equation]
Revised: [Equation]

Original: We use the same way used by Sutherland et al.
Revised: We use the same method used by Sutherland et al.

Original: (2016) to choose (cid:27) , where 2 (cid:27) 2 is set to the median of all Euclidean distances between all images in the aggregate set V [ W .
Revised: (2016) to choose (cid:27) , where 2 (cid:27) 2 is set to the median of all Euclidean distances between all images in the aggregate set V [ W .

Original: In Figure 2 (a)(b), we show how  performance of ODIN vary against the MMD distances between in- and out-of-distribution datasets 4 .
Revised: In Figure 2 (a)(b), we show how the performance of ODIN varies against the MMD distances between in- and out-of-distribution datasets 4 .

Original: The datasets (on x-axis) are ranked in the descending order of MMD distances with CIFAR-100.
Revised: The datasets (on x-axis) are ranked in the descending order of MMD distances with CIFAR-100.

Original: There are two interesting observations can be drawn from.
Revised: There are two interesting observations can be drawn from these ﬁgures.

Original: First, we ﬁnd that the MMD distances between the cropped datasets and CIFAR-100 tend to be larger.
Revised: First, we ﬁnd that the MMD distances between the cropped datasets and CIFARtend to be larger.

Original: This is likely due to the fact that cropped images only contain local image context and are therefore more distinct from CIFAR-100 images, while resized images contain global patterns and are thus similar to images in CIFAR-100.
Revised: This is likely due to the fact that cropped images only contain local image context and are therefore more distinct from CIFAR-100 images, while resized images contain global patterns and are thus similar to images in CIFAR-100.

Original: Second, we observe that the MMD distance tends to be negatively correlated with the detection performance.
Revised: Second, we observe that the MMD distance tends to be negatively correlated with the detection performance.

Original: This suggests that the detection task becomes harder as in and out-of-distribution images are more similar to each other.
Revised: This suggests, not surprisingly, that the detection task becomes harder as in and out-of-distribution images are more similar to each other.

Original: Same-manifold datasets.
Revised: Same-manifold datasets.

Original: Furthermore, we investigate the extreme scenario when in- and out-ofdistribution datasets are on the same manifold.
Revised: Furthermore, we investigate the extreme scenario when in- and out-ofdistribution datasets are on the same manifold.

Original: In experiment, we randomly split CIFAR-100 into two disjoint datasets containing 80 and 20 classes each.
Revised: In experiment, we randomly split CIFAR-100 into two disjoint datasets containing 80 and 20 classes each.

Original: We name them CIFAR-80 and CIFAR20 , respectively.
Revised: We name them CIFAR-80 and CIFAR20 , respectively.

Original: We train both DenseNet and Wide ResNet-28-10 on the CIFAR-80 dataset (indistribution) and evaluate the detection performance on the CIFAR-20 dataset (out-distribution).
Revised: We train both DenseNet and Wide ResNet-28-10 on the CIFAR-80 dataset (indistribution) and evaluate the detection performance on the CIFAR-20 dataset (out-distribution).

Original: All hyperparameters used here are exactly the same as in Section 4.1.
Revised: All hyperparameters used here are exactly the same as in Section 4.1.

Original: The MMD distance between
Revised: The MMD distance between

Original: CIFAR-20 and CIFAR-80 is much smaller than other dataset pairs.
Revised: CIFAR-20 and CIFAR-80 is much smaller than other dataset pairs.

Original: In Figure 2 (c)(d), we observe that both FPR at TPR 95% and detection error become larger on the CIFAR-20 dataset.
Revised: In Figure 2 (c)(d), we observe that both FPR at TPR 95% and detection error become larger on the CIFAR-20 dataset.

Original: This coincides with our expectation that the detection task becomes extremely hard when in- and out-ofdistribution dataset locate on the same manifold.
Revised: This coincides with our expectation that the detection task becomes extremely hard when in- and out-ofdistribution dataset locate on the same manifold.

Original: We provide additional experimental results in
Revised: We provide additional experimental results in

Original: Appendix A.1 and Appendix G.
Revised: Appendix A.1 and Appendix G.

Original:  D ISCUSSIONS 5. E FFECTS OF P ARAMETERS
Revised:  D ISCUSSIONS 5. E FFECTS OF P ARAMETERS

Original: In this subsection, we empirically show how temperature T and perturbation magnitude " affect
Revised: In this subsection, we empirically show how temperature T and perturbation magnitude " affect

Original: FPR at TPR 95% and AUROC on DenseNet and Wide ResNet-28-10.
Revised: FPR at TPR 95% and AUROC on DenseNet and Wide ResNet-28-10.

Original: Additional results on other metrics and architectures are provided in Appendix B.
Revised: Additional results on other metrics and architectures are provided in Appendix B.

Original: We show the detection performance when using only the temperature scaling method (see Figure 3(a)(b), " = 0 ), or the input preprocessing method (see Figure 3(c)(d), T = 1 ).
Revised: We show the detection performance when using only the temperature scaling method (see Figure 3(a)(b), " = 0 ), or the input preprocessing method (see Figure 3(c)(d), T = 1 ).

Original: In Figure 4, we show the detection performance w.r.t " when 
Revised: In Figure 4, we show the detection performance w.r.t " when [Figure] [Figure]

Original: T is optimal (e.g., T =1000).
Revised: T is optimal (e.g., T =1000).

Original: First, from Figure 3 (a)(b), we observe that increasing the temperature can improve the detection performance, although the effects diminish when T is sufﬁciently large (e.g., T > 100 ).
Revised: First, from Figure 3 (a)(b), we observe that increasing the temperature can improve the detection performance, although the effects diminish when T is sufﬁciently large (e.g., T > 100 ).

Original: Next, from Figure 3(c)(d) and Figure 4, we observe that we can further improve the detection performance by appropriately choosing the perturbation magnitudes.
Revised: Next, from Figure 3(c)(d) and Figure 4, we observe that we can further improve the detection performance by appropriately choosing the perturbation magnitudes.

Original: We can achieve overall better performance by combining both (1) temperature scaling and (2) input preprocessing.[Figure] [Figure]
Revised: We can achieve overall better performance by combining both (1) temperature scaling and (2) input preprocessing.

Original: 5. A NALYSIS ON T EMPERATURE S CALING
Revised: 5. A NALYSIS ON T EMPERATURE S CALING

Original: In this subsection, we analyze the effectiveness of the temperature scaling method.
Revised: In this subsection, we analyze the effectiveness of the temperature scaling method.

Original: As shown in Figure 3 (a) and (b), we observe that a sufﬁciently large temperature yields better detection performance although the effects diminish when T is too large.
Revised: As shown in Figure 3 (a) and (b), we observe that a sufﬁciently large temperature yields better detection performance although the effects diminish when T is too large.

Original: To gain insights, we can refer to the Taylor expansion of  softmax score (details provided in Appendix D).
Revised: To gain insight, we can use the Taylor expansion of the softmax score (details provided in Appendix D).

Original: When T is sufﬁciently large, we have
Revised: When T is sufﬁciently large, we have

Original: [Equation]
Revised: [Equation]

Original: (4) by omitting the third and higher orders.
Revised: (3) by omitting the third and higher orders.

Original: For simplicity of notation, we deﬁne
Revised: For simplicity of notation, we deﬁne

Original: U 1 ( x 
Revised: U 1 ( x ) =

Original: [Equation]

Original: = N (cid:0) [Equation] ∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y ( x ) (cid:0) f
Revised: [ f ^ y ( x ) (cid:0) f

Original: i ( x )] and U 2 ( x ) =
Revised: i ( x )] and U 2 ( x ) =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y ( x ) (cid:0) f
Revised: [ f ^ y ( x ) (cid:0) f

Original: i ( x )] 2 : (5)
Revised: i ( x )] 2 : (4)

Original: Interpretations of U 1 and U 2 .
Revised: Interpretations of U 1 and U 2 .

Original: By deﬁnition, U 1 measures the extent to which the largest unnormalized output of the neural network deviates from the remaining outputs; while U 2 measures the extent to which the remaining smaller outputs deviate from each other.
Revised: By deﬁnition, U 1 measures the extent to which the largest unnormalized output of the neural network deviates from the remaining outputs; while U 2 measures the extent to which the remaining smaller outputs deviate from each other.

Original: We provide formal mathematical derivations in Appendix F.
Revised: We provide formal mathematical derivations in Appendix F.

Original: In Figure 5(a), we show the distribution of U 1 for each out-of-distribution dataset vs. the in-distribution dataset (in red).
Revised: In Figure 5(a), we show the distribution of U 1 for each out-of-distribution dataset vs. the in-distribution dataset (in red).

Original: We observe that the largest outputs of the neural network on in-distribution images deviate more from the remaining outputs.
Revised: We observe that the largest outputs of the neural network on in-distribution images deviate more from the remaining outputs.

Original: This is likely due to the fact that neural networks tend to make more conﬁdent predictions on in-distribution images.
Revised: This is likely due to the fact that neural networks tend to make more conﬁdent predictions on in-distribution images.

Original: Further, we show in Figure 5(b) the expectation of U 2 conditioned on U 1 , i.e., E [ U 2 j U 1 ] , for each dataset.
Revised: Further, we show in Figure 5(b) the expectation of U 2 conditioned on U 1 , i.e., E [ U 2 j U 1 ] , for each dataset.

Original: The red curve (in-distribution images) has overall higher expectation.
Revised: The red curve (in-distribution images) has overall higher expectation.

Original: This indicates that, when two images have similar values on U 1 , the in-distribution image tends to have a much higher value of U 2 than the out-of-distribution image.
Revised: This indicates that, when two images have similar values on U 1 , the in-distribution image tends to have a much higher value of U 2 than the out-of-distribution image.

Original: In other words, for in-distribution images, the remaining outputs (excluding the largest output) tend to be more deviated from each other compared to  out-of-distribution datasets.
Revised: In other words, for in-distribution images, the remaining outputs (excluding the largest output) tend to be more separated from each other compared to [Figure] out-of-distribution datasets.

Original: This may happen when some classes in the in-distribution dataset share common features while others differ signiﬁcantly.
Revised: This may happen when some classes in the in-distribution dataset share common features while others differ signiﬁcantly.

Original: To illustrate this, in Figure 5 (f)(g), we show the outputs of each class using a DenseNet (trained on CIFAR-10) on a dog image from CIFAR-10, and another image from TinyImageNet (crop).
Revised: To illustrate this, in Figure 5 (f)(g), we show the outputs of each class using a DenseNet (trained on CIFAR-10) on a dog image from CIFAR-10, and another image from TinyImageNet (crop).

Original: For the image of dog, we can observe that the largest output for the label dog is close to the output for the label cat but is quite deviated from the outputs for the label car and truck .
Revised: For the image of dog, we can observe that the largest output for the label dog is close to the output for the label cat but is quite separated from the outputs for the label car and truck .

Original: This is likely due to the fact that, in CIFAR-10, images of dog are very[Figure] similar to the images of cat but are quite distinct from images of car and truck.
Revised: This is likely due to the fact that, in CIFAR-10, images of dogs are very similar to the images of cats but are quite distinct from images of car and truck.

Original: For the image from
Revised: For the image from

Original: TinyImageNet (crop), despite having one large output, the remaining outputs are close to each other and thus have a smaller deviation.
Revised: TinyImageNet (crop), despite having one large output, the remaining outputs are close to each other and thus have a smaller deviation.

Original: The effects of T .
Revised: The effects of T .

Original: To see the usefulness of adopting a large T , we can ﬁrst rewrite the softmax score function in Equation (4) as S / ( U 1 (cid:0) U 2 = 2 T )
Revised: To see the usefulness of adopting a large T , we can ﬁrst rewrite the softmax score function in Equation (3) as S / ( U 1 (cid:0) U 2 = 2 T )

Original: =T .
Revised: =T .

Original: Hence the softmax score is largely determined by U 1 and U 2 = 2 T .
Revised: Hence the softmax score is largely determined by U 1 and U 2 = 2 T .

Original: As noted earlier, U 1 makes in-distribution images produce larger softmax scores than out-of-distribution images since S / U 1 , while U 2 has the exact opposite effect since S / (cid:0) U 2 .
Revised: As noted earlier, U 1 makes in-distribution images produce larger softmax scores than out-of-distribution images since S / U 1 , while U 2 has the exact opposite effect since S / (cid:0) U 2 .

Original: Therefore, by choosing a sufﬁciently large temperature, we can compensate the negative impacts of
Revised: Therefore, by choosing a sufﬁciently large temperature, we can compensate the negative impacts of

Original: U 2 = 2 T on the detection performance, making the softmax scores between in- and out-of-distribution images more separable.
Revised: U 2 = 2 T on the detection performance, making the softmax scores between in- and out-of-distribution images more separable.

Original: Eventually, when T is sufﬁciently large, the distribution of softmax score is almost dominated by the distribution of U 1 and thus increasing the temperature further is no longer effective.
Revised: Eventually, when T is sufﬁciently large, the distribution of softmax score is almost dominated by the distribution of U 1 and thus increasing the temperature further is no longer effective.

Original: This explains why we see in Figure 3 (a)(b) that the performance becomes unchanged when T is too large (e.g., T > 100 ).
Revised: This explains why we see in Figure 3 (a)(b) that the performance does not change when T is too large (e.g., T > 100 ).

Original: In Appendix E, we provide  formal proof showing that the detection error eventually converges to a constant number when T goes to inﬁnity.
Revised: In Appendix E, we provide a formal proof showing that the detection error eventually converges to a constant number when T goes to inﬁnity.

Original: 5. A NALYSIS ON I NPUT P REPROCESSING
Revised: 5. A NALYSIS ON I NPUT P REPROCESSING

Original: As noted previously, using the temperature scaling method by itself can be effective in improving the detection performance.
Revised: As noted previously, using the temperature scaling method by itself can be effective in improving the detection performance.

Original: However, the effectiveness quickly diminishes as T becomes very large.
Revised: However, the effectiveness quickly diminishes as T becomes very large.

Original: In order to make further improvement, the input processing method can be quite complementary.
Revised: In order to make further improvement, we complement temperature scaling with input preprocessing.

Original: This has already been seen in Figure 4, where the detection performance is improved by a large margin on most datasets when T = 1000 , provided with an appropriately chosen perturbation magnitude " .
Revised: This has already been seen in Figure 4, where the detection performance is improved by a large margin on most datasets when T = 1000 , provided with an appropriate perturbation magnitude " is chosen.

Original: In this subsection, we provide insights behind this.
Revised: In this subsection, we provide some intuition behind this.

Original: To explain, we can look into the ﬁrst order Taylor expansion of the log-softmax function for the perturbed image ~ x , which can be derived as
Revised: To explain, we can look into the ﬁrst order Taylor expansion of the log-softmax function for the perturbed image ~ x , which is given by

Original: [Equation]
Revised: [Equation]

Original: where x is the original input.
Revised: where x is the original input.

Original: The effects of gradient.
Revised: The effects of gradient.

Original: In Figure 5 (c), we present the distribution of ∥∇ x log S ( x ; T ) ∥ 1 — the 1norm of gradient of log-softmax with respect to the input x — for all datasets.
Revised: In Figure 5 (c), we present the distribution of ∥∇ x log S ( x ; T ) ∥ 1 — the 1norm of gradient of log-softmax with respect to the input x — for all datasets.

Original: A salient observation is that CIFAR-10 images (in-distribution) tend to have larger values on the norm of gradient than most out-of-distribution images.
Revised: A salient observation is that CIFAR-10 images (in-distribution) tend to have larger values on the norm of gradient than most out-of-distribution images.

Original: To further see the effects of the norm of gradient on the softmax score, we provide in Figures 5 (d) the conditional expectation E [ ∥∇ x log S ( x ; T ) ∥ 1 j S ] .
Revised: To further see the effects of the norm of gradient on the softmax score, we provide in Figures 5 (d) the conditional expectation E [ ∥∇ x log S ( x ; T ) ∥ 1 j S ] .

Original: We can observe that, when an in-distribution image and an out-of-distribution image have the same softmax score, the value of ∥∇ x log S ( x ; T ) ∥ 1 for in-distribution image tends to be larger. 
Revised: We can observe that, when an in-distribution image and an out-of-distribution image have the same softmax score, the value of ∥∇ x log S ( x ; T ) ∥ 1 for in-distribution image tends to be larger. [Figure]  [Figure]

Original: We illustrate the effects of the norm of gradient in Figure 6.
Revised:  [Figure] [Figure] [Figure]

Revised: ˜ x

Revised: [Figure]

Revised: ˜ x

Revised: [Figure]

Original:  Suppose  an in-distribution image x(blue) and an out-of-distribution image x 2 (red) have similar softmax scores, i.e., S ( x 1 ) (cid:25) S ( x 2 ) .
Revised: [Figure] We illustrate the effects of the norm of gradient in Figure 6. Suppose that an in-distribution image x 1 (blue) and an out-ofdistribution image x 2 (red) have similar softmax scores, i.e., S ( x 1 ) (cid:25) S ( x 2 ) .

Original: After input processing, the in-distribution image can have a much larger softmax score than the outof-distribution image x 2 since x 1 results in a much larger value on the norm of softmax gradient than that of x 2 .
Revised: After input processing, the in-distribution image can have a much larger softmax score than the out-of-distribution image x 2 since x 1 results in a much larger value on the norm of softmax gradient than that of x 2 .

Original: Therefore, in- and out-of-distribution images are more separable from each other after input preprocessing 5 .[Figure]
Revised: Therefore, in- and out-of-distribution images are more separable from each other after input preprocessing 5 .

Original: The effect of " .
Revised: The effect of " .

Original: When the magnitude " is sufﬁciently small, adding perturbations does not change the predictions of the neural network, i.e., ^ y (~ x ) =
Revised: When the magnitude " is sufﬁciently small, adding perturbations does not change the predictions of the neural network, i.e., ^ y (~ x ) =

Original: ^ y ( x ) .
Revised: ^ y ( x ) .

Original: However, when " is not negligible, the gap of softmax scores between in- and out-of-distribution images can be affected by ∥∇ x log S ( x ; T ) ∥ 1 .
Revised: However, when " is not negligible, the gap of softmax scores between in- and out-of-distribution images can be affected by ∥∇ x log S ( x ; T ) ∥ 1 .

Original: Our observation is consistent with that in (Szegedy et al., 2014; Goodfellow et al., 2015; MoosaviDezfooli et al., 2017), which show that the softmax scores tend to change signiﬁcantly if small perturbations are added to the indistribution images.
Revised: Our observation is consistent with that in (Szegedy et al., 2014; Goodfellow et al., 2015; Moosavi-Dezfooli et al., 2017), which show that the softmax scores tend to change signiﬁcantly if small perturbations are added to the in-distribution images.

Original: It is also worth noting that using a very large " can lead to performance degradation, as seen in Figure 4.
Revised: It is also worth noting that using a very large " can lead to performance degradation, as seen in Figure 4.

Original: This is likely due to the fact that the second and higher order terms in the Taylor expansion are no longer insigniﬁcant when the perturbation magnitude is too large.
Revised: This is likely due to the fact that the second and higher order terms in the Taylor expansion are no longer insigniﬁcant when the perturbation magnitude is too large.

Original:  R ELATED W ORKS AND F UTURE D IRECTIONS
Revised:  R ELATED W ORKS AND F UTURE D IRECTIONS

Original: The problem of detecting out-of-distribution examples in low-dimensional space has been wellstudied in various contexts (see the survey by Pimentel et al.
Revised: The problem of detecting out-of-distribution examples in low-dimensional space has been wellstudied in various contexts (see the survey by Pimentel et al.

Original: Conventional methods such as density estimation, nearest neighbor and clustering analysis are widely used in detecting lowdimensional out-of-distribution examples (Chow, 1970; Vincent & Bengio, 2003; Ghoting et al., 2008; Devroye et al., 2013), .
Revised: Conventional methods such as density estimation, nearest neighbor and clustering analysis are widely used in detecting lowdimensional out-of-distribution examples (Chow, 1970; Vincent & Bengio, 2003; Ghoting et al., 2008; Devroye et al., 2013), .

Original: The density estimation approach uses probabilistic models to estimate the in-distribution density and declares a test example to be out-of-distribution if it locates in the lowdensity areas.
Revised: The density estimation approach uses probabilistic models to estimate the in-distribution density and declares a test example to be out-of-distribution if it locates in the lowdensity areas.

Original: The clustering method is based on the statistical distance, and declares an example to be out-of-distribution if it locates far from its neighborhood.
Revised: The clustering method is based on the statistical distance, and declares an example to be out-of-distribution if it locates far from its neighborhood.

Original: Despite various applications in lowdimensional spaces, unfortunately, these methods are known to be unreliable in high-dimensional space such as image space (Wasserman, 2006; Theis et al., 2015).
Revised: Despite various applications in lowdimensional spaces, unfortunately, these methods are known to be unreliable in high-dimensional space such as image space (Wasserman, 2006; Theis et al., 2015).

Original: In recent years, out-of-distribution detector based on deep models have been proposed, due to their undoubtable representing power in high-dimensional space.
Revised: In recent years, out-of-distribution detectors based on deep models have been proposed.

Original: Schlegl et al.
Revised: Schlegl et al.

Original: (2017) train a generative adversarial networks to detect outof-distribution examples in clinical scenario.
Revised: (2017) train a generative adversarial networks to detect out-of-distribution examples in clinical scenario.

Original: Sabokrou et al.
Revised: Sabokrou et al.

Original: (2016) train a convolutional network to detect anomaly in scenes.
Revised: (2016) train a convolutional network to detect anomaly in scenes.

Original: Andrews et al.
Revised: Andrews et al.

Original: (2016) adopt transfer representation-learning for anomaly detection.
Revised: (2016) adopt transfer representation-learning for anomaly detection.

Original: All these works require enlarging or modifying the neural networks.
Revised: All these works require enlarging or modifying the neural networks.

Original: In a more recent work, Hendrycks & Gimpel (2017) found that pre-trained neural networks can be overconﬁdent to out-of-distribution example, limiting the effectiveness of detection.
Revised: In a more recent work, Hendrycks & Gimpel (2017) found that pre-trained neural networks can be overconﬁdent to out-of-distribution example, limiting the effectiveness of detection.

Original: Our paper aims to improve the performance of detecting out-of-distribution examples,yet without requiring any change to an existing well-trained model.
Revised: Our paper aims to improve the performance of detecting out-of-distribution examples, without requiring any change to an existing well-trained model.

Original: Our approach leverages the following two interesting observations to help better distinguish between in- and out-of-distribution examples:
Revised: Our approach leverages the following two interesting observations to help better distinguish between in- and out-of-distribution examples:

Original: (1) On in-distribution images, modern neural networks tend to produce outputs with larger variance across class labels, and (2) neural networks have larger norm of gradient  when applied on in-distribution images.
Revised: (1) On in-distribution images, modern neural networks tend to produce outputs with larger variance across class labels, and (2) neural networks have larger norm of gradient of log-softmax scores when applied on in-distribution images.

Original: We believe that having a better understanding of these phenomenon can lead to further insights into this problem.
Revised: We believe that having a better understanding of these phenomenon can lead to further insights into this problem.

Original:  C ONCLUSIONS
Revised:  C ONCLUSIONS

Original: In this paper, we propose a simple and effective method to detect out-of-distribution data samples in neural networks.
Revised: In this paper, we propose a simple and effective method to detect out-of-distribution data samples in neural networks.

Original: Our method does not require retraining the neural network and signiﬁcantly improves on the baseline (state-of-the-art) on different neural architectures across various in and out-distribution dataset pairs.
Revised: Our method does not require retraining the neural network and signiﬁcantly improves on the baseline (state-of-the-art) on different neural architectures across various in and out-distribution dataset pairs.

Original: We empirically analyze the method under different parameter settings, and provide theoretical intuitions and insights behind the approach.
Revised: We empirically analyze the method under different parameter settings, and provide some insights behind the approach.

Original: Future work involves exploring our method in other applications such as speech recognition and natural language processing.
Revised: Future work involves exploring our method in other applications such as speech recognition and natural language processing.

Original: A S UPPLEMENTARY R ESULTS IN S ECTION 4. A. E XPERIMENTAL R ESULTS
Revised: A S UPPLEMENTARY R ESULTS IN S ECTION 4. A. E XPERIMENTAL R ESULTS

Original: [Table]
Revised: [Table]

Original: MNIST:
Revised: MNIST:

Original: We used the same MNIST classiﬁer used by Hendrycks & Gimpel (2017), which is a three-layer, 256 neuron-wide, fully connected network trained for 30 epochs with Adam (Kingma & Ba, 2014).
Revised: We used the same MNIST classiﬁer used by Hendrycks & Gimpel (2017), which is a three-layer, 256 neuron-wide, fully connected network trained for 30 epochs with Adam (Kingma & Ba, 2014).

Original: The classiﬁer achieve 99.34% test accuracy on the MNIST test set.
Revised: The classiﬁer achieve 99.34% test accuracy on the MNIST test set.

Original: We compare our method with the baseline (Hendrycks & Gimpel, 2017) on ﬁve different out-of-distribution datasets: (1) Omniglot dataset (Lake et al., 2015) contains images of handwritten characters in stead of the handwritten digits in MNIST; (2) notMNIST (Bulatov, 2011) dataset contains typeface characters;
Revised: We compare our method with the baseline (Hendrycks & Gimpel, 2017) on ﬁve different out-of-distribution datasets: (1) Omniglot dataset (Lake et al., 2015) contains images of handwritten characters in stead of the handwritten digits in MNIST; (2) notMNIST (Bulatov, 2011) dataset contains typeface characters;

Original: (3) CIFAR-10bw contains black and white rescaled CIFAR-10 images; (4)(5) Gaussian and Uniform image set contains the synthetic Gaussian and Uniform noise images used in Section 4.2.
Revised: (3) CIFAR-10bw contains black and white rescaled CIFAR-10 images; (4)(5) Gaussian and Uniform image set contains the synthetic Gaussian and Uniform noise images used in Section 4.2.

Original: Wide ResNet-40-4: We use the same architecture used by Hendrycks & Gimpel (2017) to evaluate the baseline and our method.
Revised: Wide ResNet-40-4: We use the same architecture used by Hendrycks & Gimpel (2017) to evaluate the baseline and our method.

Original: The Wide ResNet-40-4 achieves 95.7% test accuracy on CIFARdataset and achieve 79.27% test accuracy on CIFAR-100.
Revised: The Wide ResNet-40-4 achieves 95.7% test accuracy on CIFARdataset and achieve 79.27% test accuracy on CIFAR-100.

Original: CIFAR-80:
Revised: CIFAR-80:

Original: DenseNet-BC-100 achieves 78.94% test accuracy on CIFAR-80, while Wide ResNet28-10 achieves 81.71% test accuracy and Wide ResNet-40-4 achieves 79.53% test accuracy on
Revised: DenseNet-BC-100 achieves 78.94% test accuracy on CIFAR-80, while Wide ResNet28-10 achieves 81.71% test accuracy and Wide ResNet-40-4 achieves 79.53% test accuracy on

Original: CIFAR-80.
Revised: CIFAR-80.

Original: A. P ARAMETER S ETTINGS
Revised: A. P ARAMETER S ETTINGS

Original: For MNIST, we set T = 1000 and " = 0 .
Revised: For MNIST, we set T = 1000 and " = 0 .

Original: The parameter settings for other structures are shown as follows.
Revised: The parameter settings for other structures are shown as follows.

Original: [Table]
Revised: [Table]

Original: TinyImageNet
Revised: TinyImageNet

Original: [Table]
Revised: [Table]

Original: resize
Revised: resize

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: B S UPPLEMENTARY R ESULTS IN S ECTION 5. 
Revised: B S UPPLEMENTARY R ESULTS IN S ECTION 5.

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure] 
Revised: [Figure] [Figure] [Figure]

Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: C S UPPLEMENTARY R ESULTS IN S ECTION 5.2 AND 5. 
Revised: C S UPPLEMENTARY R ESULTS IN S ECTION 5.2 AND 5.

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: D T AYLOR E XPANSION
Revised: D T AYLOR E XPANSION

Original: In this section [Equation] we present the Taylor expansion of the soft-max score function:
Revised: In this section, we present the Taylor expansion of the soft-max score function:

Original: [Equation]
Revised: [Equation]

Original: E P ROPOSITION
Revised: E P ROPOSITION

Original: The following proposition 1 shows that the detection error P e ( T; 0) (cid:25) c if T is sufﬁciently large.
Revised: The following proposition 1 shows that the detection error P e ( T; 0) (cid:25) c if T is sufﬁciently large.

Original: Thus, increasing the temperature further can only slightly improve the detection performance.
Revised: Thus, increasing the temperature further can only slightly improve the detection performance.

Original: Proposition 1.
Revised: Proposition 1.

Original: There exists a constant c only depending on function U 1 , in-distribution P X
Revised: There exists a constant c only depending on function U 1 , in-distribution P X

Original: and out-of-distribution Q X such that lim T !
Revised: and out-of-distribution Q X such that lim T !

Original: 1 P e ( T; " ) =
Revised: 1 P e ( T; " ) =

Original: c , when " = 

Revised: c , when " =

Original: (i
Revised: (i

Original: [Equation]
Revised: [Equation]

Original: e., no input preprocessing).
Revised: e., no input preprocessing).

Original: Proof.
Revised: Proof.

Original: Since
Revised: Since

Original: [Equation]
Revised: [Equation]

Original: Therefore, for any X , lim
Revised: Therefore, for any X , lim

Original: [Equation]
Revised: [Equation]

Revised: =

Revised: [Equation]

Original: This indicates that the random variable
Revised: This indicates that the random variable

Revised: T

Original: [Equation]
Revised: [Equation]

Original: This means that
Revised: N

Original: [Equation]
Revised: [Equation]

Original: Therefore
Revised: X ) [Equation] s: as T ! 1 . This means that for a speciﬁc (cid:11) > 0 , choosing the threshold (cid:14) T = 1 = ( N (cid:0) (cid:11)=T ) , then the false positive rate

Revised: FPR ( T )

Original: [Equation]
Revised: [Equation]

Revised: Q

Revised: [Equation]

Original: there exists a constant c depending on U 1 ; P X ;  Q X 
Revised: ( S ^ y ( X ; T ) > 1 = ( N (cid:0) (cid:11)=T )) = Q X (

Revised: T (

Revised: N (cid:0)

Revised: S ^ y

Revised: ( X ; T ) )

Revised: > (cid:11) )

Revised: T !1 (cid:0)(cid:0)(cid:0)(cid:0)!

Revised: Q X (( N (cid:0) 1) U 1 ( X ) > (cid:11) ) ; and the true positive rate

Revised: TPR ( T ) =

Revised: P X ( S ^ y

Revised: ( X ; T ) >

Revised: 1 = ( N (cid:0) (cid:11)=T ))

Revised: =

Revised: P X (

Revised: T (

Revised: N (cid:0)

Revised: S ^ y

Revised: ( X ; T ) )

Original: [Equation]
Revised: > (cid:11) ) T !1 (cid:0)(cid:0)(cid:0)(cid:0)! P X (( N (cid:0) 1) U 1 ( X ) > (cid:11) ) : Choosing (cid:11) (cid:3) such that P X (( N (cid:0) 1) U 1 ( X ) > (cid:11) (cid:3) )

Original: such that{+= 0 : 95 , then TPR ( T ) ! 
 : 95 as T ! 
 and at the same time FPR ( T ) ! Q X (( N (cid:0) 1) U 1 ( X ) > (cid:11) (cid:3) ) as T ! 1 .+}
Revised: {+= 0 : 95 , then TPR ( T ) ! 
 : 95 as T ! 
 and at the same time FPR ( T ) ! Q X (( N (cid:0) 1) U 1 ( X ) > (cid:11) (cid:3) ) as T ! 1 .+}

Revised: There exists a constant c depending on U 1 ; P X ; Q X and P Z , such that

Original: [Equation]
Revised: [Equation]

Original: F A NALYSIS ON TEMPERATURE
Revised: F A NALYSIS OF T EMPERATURE

Original: For simplicity of the notations, let ∆ i = f ^ y (cid:0) f i and thus ∆ =
Revised: For simplicity of the notations, let ∆ i = f ^ y (cid:0) f i and thus ∆ =

Original: f ∆ i g i ̸
Revised: f ∆ i g i ̸

Original: =^ y .
Revised: =^ y .

Original: Besides, let (cid:22)∆ denote the mean of the set ∆ .
Revised: Besides, let (cid:22)∆ denote the mean of the set ∆ .

Original: Therefore, (cid:22)∆ =
Revised: Therefore, (cid:22)∆ =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y ∆ i =
Revised: =^ y ∆ i =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y (cid:0) f i ]
Revised: [ f ^ y (cid:0) f i ]

Original: =
Revised: =

Original: U 1 :
Revised: U 1 :

Original: Equivalently,
Revised: Equivalently,

Original: U 1 = Mean (∆) :
Revised: U 1 = Mean (∆) :

Original: Next, we will show
Revised: Next, we will show

Original: U 2 =
Revised: U 2 =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y (cid:0) f i ] 2 =
Revised: [ f ^ y (cid:0) f i ] 2 =

Original: Variance 2 ( ∆ ) z }| {
Revised: Variance 2 ( ∆ ) z }| {

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y [∆ i (cid:0) (cid:22) ∆] 2 +
Revised: =^ y [∆ i (cid:0) (cid:22) ∆] 2 +

Original: Mean 2 (∆) z}|{ (cid:22)∆:
Revised: Mean 2 (∆) z}|{ (cid:22)∆:

Original: Since
Revised: Since

Original: U 2 =
Revised: U 2 =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y ∆ 2 i by ∆ i =
Revised: =^ y ∆ 2 i by ∆ i =

Original: f ^ y (cid:0) f
Revised: f ^ y (cid:0) f

Original: i =
Revised: i =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y (∆ i (cid:0) (cid:22)∆ + (cid:22)∆)=
Revised: =^ y (∆ i (cid:0) (cid:22)∆ + (cid:22)∆)=

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [(∆ i (cid:0) (cid:22)∆) 2 (cid:0) 2(∆ i (cid:0) (cid:22)∆) (cid:22)∆ + (cid:22)∆ 2 ] =
Revised: [(∆ i (cid:0) (cid:22)∆) 2 (cid:0) 2(∆ i (cid:0) (cid:22)∆) (cid:22)∆ + (cid:22)∆ 2 ] =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y [∆ i (cid:0) (cid:22)∆]| {z }
Revised: =^ y [∆ i (cid:0) (cid:22)∆]| {z }

Original: Variance 2 (∆) (cid:0) 2 (cid:22)∆
Revised: Variance 2 (∆) (cid:0) 2 (cid:22)∆

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y (∆i (cid:0)
Revised: =^ y (∆

Original: [Equation]
Revised: [Equation]

Original: then
Revised: then

Original: [Equation]
Revised: [Equation]

Original: G A DDITIONAL R ESULTS IN S ECTION 4. 
Revised: G A DDITIONAL R ESULTS IN S ECTION 4.

Original: Apart from the Maximum Mean Discrepancy
Revised: Apart from the Maximum Mean Discrepancy

Original: [Equation]
Revised: [Equation]

Original: we as well use the Energy distanceto measure the statistical distance between two datasets.
Revised: we as well calculate the Energy distance between inand out-of-distribution datasets.

Original: Lettwo different distributions P and Q .
Revised: Let P and Q denote two different distributions.

Original: Then the energy distance between distributions P and Q is deﬁned as
Revised: Then the energy distance between distributions P and Q is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: Therefore, the energy distance between two datasets V = f V 1 ; :::; V m g iid (cid:24) P and W = f W 1 ; :::; W m g iid (cid:24) Q is deﬁned as
Revised: Therefore, the energy distance between two datasets V = f V 1 ; :::; V m g iid (cid:24) P and W = f W 1 ; :::; W m g iid (cid:24) Q is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: In the experiment
Revised: In the experiment

Original: [Equation]
Revised: [Equation]

Original: we use the 2-norm ∥ (cid:1) ∥ 2 . 
Revised: we use the 2-norm ∥ (cid:1) ∥ 2 . [Table] [Figure] [Figure]

Revised: H A DDITIONAL D ISCUSSIONS

Original: [Table]
Revised: In this section, we present additional discussion on the proposed method. We ﬁrst empirically show how the threshold (cid:14) affects the detection performance. We next show how the proposed method performs when the parameters are tuned on a certain out-of-distribution dataset and are evaluated on other out-of-distribution datasets. Finally, we show how the size of dataset for choosing parameters affects the detection performance.

Revised: Effects of the threshold.

Revised: We analyze how the threshold affects the following metrics: (1) FPR, i.e., the fraction of out-of-distribution images misclassiﬁed as in-distribution images; (2) TPR, i.e, the fraction of in-distribution images correctly classiﬁed as in-distribution images.

Revised: In Figure 13, we show how the thresholds affect FPR and TPR when the temperature and perturbation magnitude are chosen optimally (i.e., T = 1 ; 000 , " = 0 : 0014 ).

Revised: From the ﬁgure, we can observe that the threshold corresponding to 95% TPR can produce small FPRs on all out-of-distribution datasets.

Revised: Performance across datasets.

Revised: To investigate how the parameters generalize across datasets, we tune the parameters using one out-of-distribution dataset and then evaluate on a different one.

Revised: Given an out-of-distribution dataset, we ﬁrst split the dataset into two disjoint subsets: tuning set and test set .

Revised: The tuning set contains 1,000 images and the test set contains 9,000 images.

Revised: We tune the parameters on the tuning set and evaluate the detection performance on the test set.

Revised: We ﬁrst choose the temperature T and the perturbation magnitude " such that the FPR at TPR 95% is minimized on the tuning set of one out-of-distribution dataset.

Revised: Next, we set (cid:14) to the threshold corresponding to 95% TPR and calculate the false positive rates on the test sets of other out-of-distribution datasets.

Revised: In Figure 14, we show the detection performance on three out-of-distribution datasets when the parameters are tuned on six different datasets.

Revised: From Figure 14, we can observe that the parameters tuned on different tuning sets can have quite similar detection FPRs on all of three out-of-distribution image sets.

Revised: This may be due to the fact, shown in Figure 13, that the threshold corresponding to 95% TPR can produce small FPRs on all datasets.

Revised: [Figure]

Revised: Performance vs. tuning set size.

Revised: To show the effects of the tuning set size on the detection performance, we devise the following experiment.

Revised: For each out-of-distribution dataset, we choose the tuning set size from 200 ; 400 ; 600 ; 800 ; 1000 ; 1200 ; 1400 ; 1600 ; 1800 ; 2000 .

Revised: For each set size, we tune the temperature T and perturbation magnitude " to minimize the FPR at TPR 95% and calculate the FPR.

Revised: In Figure 15, we show the detection performance of ODIN under different tuning set size.

Revised: From Figure 15, we can observe that the FPR at TPR 95% tends to stabilize when the set size grows above 1,000.

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Figure]

Revised: [Figure]

Revised: I A DDITIONAL A NALYSIS

Revised: Difﬁcult-to-classify images and difﬁcult-to-detect images.

Revised: We analyze the correlation between the images that tend to be out-of-distribution and images on which the neural network tend to make incorrect predictions.

Revised: To understand the correlation, we devise the following experiment.

Revised: For the ﬁxed temperature T and perturbation magnitude " , we ﬁrst set (cid:14) to the softmax score threshold corresponding to a certain true positive rate.

Revised: Next, we calculate the test accuracy on the images with softmax scores above (cid:14) and the test accuracy on the images with softmax score below (cid:14) , respectively.

Revised: We report the results in Figure 16(a) and (b).

Revised: From these two ﬁgures, we can observe that the images that are difﬁcult to detect are more likely to be the images that are difﬁcult to classify.

Revised: For example, the DenseNet can achieve up to 98.5% test accuracy on the images having softmax scores above the threshold corresponding to 80% TPR, but can only achieve around 82% test accuracy on the images having softmax scores below the threshold corresponding to 80% TPR.

Revised: Same manifold datasets.

Revised: We provide additional empirical results showing how the term E

Revised: [ U 2 j U 1 ] affects the detection performance when in- and out-of-distribution datasets locate on the same manifold.

Revised: In Figure 17, we show the outputs of DenseNet on thirty classes for an image of apple from

Revised: CIFAR-80 (in-distribution) and an image of red pepper of CIFAR-20 (out-distribution).

Revised: We can observe that the outputs of DenseNet for both images are quite similar to each other.

Revised: In addition, we can observe that for both images, the second and third largest output are quite close to the largest output.

Revised: This may be due the fact the image of red pepper shares some common features with the images in CIFAR-80.

Revised: Furthermore, the similarity between the outputs for the images from CIFAR-80 and

Revised: [Table]

Revised: CIFAR-20 can help explain that the detection task becomes harder when in- and out-of-distribution datasets locate on the same manifold.

Revised: Reciprocal results between datasets.

Revised: In Table 12, we show the reciprocal results between datasets.

Revised: First, we train the DenseNet on the CIFAR-10 dataset (in-distribution) and evaluate the detection performance on the CIFAR-100 dataset (out-distribution).

Revised: Next, we train the DenseNet on the CIFAR100 dataset (in-distribution) and evaluate the detection performance on the CIFAR-10 dataset (outdistribution).

Revised: From Table 12, we can observe that the performance of the DenseNet trained on

Revised: CIFAR-10 is better than the performance of the DenseNet trained on CIFAR-100.

Revised: This may be due to the fact that the DenseNet has a higher test accuracy on CIFAR-10 (around 95%) compared to the test accuracy on CIFAR-100 (around 77%).