Original: E NHANCING T HE R ELIABILITY OF O UT - OF - DISTRIBUTION I MAGE D ETECTION IN N EURAL N ETWORKS
Revised: E NHANCING T HE R ELIABILITY OF O UT - OF - DISTRIBUTION I MAGE D ETECTION IN N EURAL N ETWORKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: We consider the problem of detecting out-of-distribution images in neural networks.
Revised: We consider the problem of detecting out-of-distribution images in neural networks.

Original: We propose ODIN , a simple and effective method that does not require any change to a pre-trained neural network.
Revised: We propose ODIN , a simple and effective method that does not require any change to a pre-trained neural network.

Original: Our method is based on the observation that using temperature scaling and adding small perturbations to the input can separate the softmax score distributions between in- and out-of-distribution images, allowing for more effective detection.
Revised: Our method is based on the observation that using temperature scaling and adding small perturbations to the input can separate the softmax score distributions between in- and out-of-distribution images, allowing for more effective detection.

Original: We show in a series of experiments that ODIN is compatible with diverse network architectures and datasets.
Revised: We show in a series of experiments that ODIN is compatible with diverse network architectures and datasets.

Original: It consistently outperforms the baseline approach (Hendrycks & Gimpel, 2017) by a large margin, establishing a new state-of-the-art performance on this task.
Revised: It consistently outperforms the baseline approach (Hendrycks & Gimpel, 2017) by a large margin, establishing a new state-of-the-art performance on this task.

Original: For example, ODIN reduces the false positive rate from the baseline 34.7% to 4.3% on the DenseNet (applied to CIFAR-10) when the true positive rate is 95%.
Revised: For example, ODIN reduces the false positive rate from the baseline 34.7% to 4.3% on the DenseNet (applied to CIFAR-10) when the true positive rate is 95%.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Modern neural networks are known to generalize well when the training and testing data are sampled from the same distribution (Krizhevsky et al., 2012; Simonyan & Zisserman, 2015;
Revised: Modern neural networks are known to generalize well when the training and testing data are sampled from the same distribution (Krizhevsky et al., 2012; Simonyan & Zisserman, 2015;

Original: He et al., 2016; Cho et al., 2014; Zhang et al., 2017).
Revised: He et al., 2016; Cho et al., 2014; Zhang et al., 2017).

Original: However, when deploying neural networks in real-world applications, there is often very little control over the testing data distribution.
Revised: However, when deploying neural networks in real-world applications, there is often very little control over the testing data distribution.

Original: Recent works have shown that neural networks tend to make high conﬁdence predictions even for completely unrecognizable (Nguyen et al., 2015) or irrelevant inputs (Hendrycks & Gimpel, 2017; Szegedy et al., 2014; Moosavi-Dezfooli et al., 2017).
Revised: Recent works have shown that neural networks tend to make high conﬁdence predictions even for completely unrecognizable (Nguyen et al., 2015) or irrelevant inputs (Hendrycks & Gimpel, 2017; Szegedy et al., 2014; Moosavi-Dezfooli et al., 2017).

Original: For example, a neural network trained for classifying handwritten digits can assign high conﬁdence labels to images of animal.
Revised: For example, a neural network trained for classifying handwritten digits can assign high conﬁdence labels to images of animal.

Original: This has raised great concerns in AI Safety (Amodei et al., 2016), in particular how can classiﬁers obtain awareness of uncertainty when shown new kinds of inputs, i.e., out-of-distribution examples.
Revised: This has raised great concerns in AI Safety (Amodei et al., 2016), in particular how can classiﬁers obtain awareness of uncertainty when shown new kinds of inputs, i.e., out-of-distribution examples.

Original: Therefore, being able to accurately detect out-of-distribution examples can be practically important for visual recognition tasks (Krizhevsky et al., 2012; Farabet et al., 2013; Ji et al., 2013).
Revised: Therefore, being able to accurately detect out-of-distribution examples can be practically important for visual recognition tasks (Krizhevsky et al., 2012; Farabet et al., 2013; Ji et al., 2013).

Original: To make accurate detections, a seemingly straightforward approach is to enlarge and re-train the neural network on both the in- and out-of-distribution examples.
Revised: To make accurate detections, a seemingly straightforward approach is to enlarge and re-train the neural network on both the in- and out-of-distribution examples.

Original: However, the number of outof-distribution examples can be inﬁnitely many, making the re-training approach computationally expensive and intractable.
Revised: However, the number of outof-distribution examples can be inﬁnitely many, making the re-training approach computationally expensive and intractable.

Original: Moreover, to ensure that a neural network accurately classiﬁes indistribution samples into correct classes while correctly detecting out-of-distribution samples, one might need to employ exceedingly large neural network architectures, which further complicates the training process.
Revised: Moreover, to ensure that a neural network accurately classiﬁes indistribution samples into correct classes while correctly detecting out-of-distribution samples, one might need to employ exceedingly large neural network architectures, which further complicates the training process.

Original: Hendrycks & Gimpel (2017) proposed a baseline method to detect out-of-distribution examples without further re-training networks, but the performance is limited.
Revised: Hendrycks & Gimpel (2017) proposed a baseline method to detect out-of-distribution examples without further re-training networks, but the performance is limited.

Original: The method is based on an observation that a well-trained neural network tends to assign higher softmax scores to in-distribution examples than out-of-distribution examples.
Revised: The method is based on an observation that a well-trained neural network tends to assign higher softmax scores to in-distribution examples than out-of-distribution examples.

Original: In this paper, we go further.
Revised: In this paper, we go further.

Original: We observe that after using temperature scaling in the softmax function (Hinton et al., 2015; Pereyra et al., 2017) and adding small controlled perturbations to inputs, the softmax score gap between in - and out-of-distribution examples is further enlarged.
Revised: We observe that after using temperature scaling in the softmax function (Hinton et al., 2015; Pereyra et al., 2017) and adding small controlled perturbations to inputs, the softmax score gap between in - and out-of-distribution examples is further enlarged.

Original: We will show that the combination of these two techniques (temperature scaling and input perturbation) can lead to better detection performance.
Revised: We will show that the combination of these two techniques (temperature scaling and input perturbation) can lead to better detection performance.

Original: For example, provided with a pre-trained DenseNet (Huang et al., 2016) on CIFAR-10 dataset (positive samples), we test against images from TinyImageNet dataset (negative samples).
Revised: For example, provided with a pre-trained DenseNet (Huang et al., 2016) on CIFAR-10 dataset (positive samples), we test against images from TinyImageNet dataset (negative samples).

Original: Our method dramatically reduces the False Positive Rate (FPR), i.e., the fraction of misclassiﬁed out-of-distribution samples, from
Revised: Our method dramatically reduces the False Positive Rate (FPR), i.e., the fraction of misclassiﬁed out-of-distribution samples, from

Original: 34 : 7% to 4 : 3% , when 95% of in-distribution images are correctly classiﬁed.
Revised: 34 : 7% to 4 : 3% , when 95% of in-distribution images are correctly classiﬁed.

Original: We summarize the main contributions of this paper as the following
Revised: We summarize the main contributions of this paper as the following

Original: (cid:15)
Revised: (cid:15)

Original: We propose a simple and effective method, ODIN, for detecting out-of-distribution examples in neural networks.
Revised: We propose a simple and effective method, ODIN, for detecting out-of-distribution examples in neural networks.

Original: Our method does not require re-training the neural network and is easily implementable on any modern neural architecture.
Revised: Our method does not require re-training the neural network and is easily implementable on any modern neural architecture.

Original: (cid:15)
Revised: (cid:15)

Original: We test ODIN on state-of-the-art network architectures (e g., DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016)) under a diverse set of in- and out-distribution dataset pairs.
Revised: We test ODIN on state-of-the-art network architectures (e.g., DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016)) under a diverse set of in- and out-distribution dataset pairs.

Original: We show ODIN can signiﬁcantly improve the detection performance, and consistently outperforms the baseline (state-of-the-art method) (Hendrycks & Gimpel, 2017) by a large margin.
Revised: We show ODIN can signiﬁcantly improve the detection performance, and consistently outperforms the state-of-the-art method (Hendrycks & Gimpel, 2017) by a large margin.

Original: (cid:15)
Revised: (cid:15)

Original: We empirically analyze how parameter settings affect the performance, and further provide theoretical intuition behind.
Revised: We empirically analyze how parameter settings affect the performance, and further provide theoretical intuition behind.

Original: The outline of this paper is as follows.
Revised: The outline of this paper is as follows.

Original: In Section 2, we present necessary deﬁnitions and the problem statement.
Revised: In Section 2, we present necessary deﬁnitions and the problem statement.

Original: In Section 3, we introduce ODIN and present performance results in Section 4.
Revised: In Section 3, we introduce ODIN and present performance results in Section 4.

Original: We experimentally analyze the proposed method and provide theoretical intuitions in Section 5.
Revised: We experimentally analyze the proposed method and provide theoretical intuitions in Section 5.

Original: We summarize the related works and future directions in Section 6 and conclude the paper in Section 7.
Revised: We summarize the related works and future directions in Section 6 and conclude the paper in Section 7.

Original:  P ROBLEM S TATEMENT
Revised:  P ROBLEM S TATEMENT

Original: In this paper, we consider the problem of distinguishing in- and out-of-distribution images on a pre-trained neural network.
Revised: In this paper, we consider the problem of distinguishing in- and out-of-distribution images on a pre-trained neural network.

Original: Let P X and Q X denote two distinct data distributions deﬁned on the image space X .
Revised: Let P X and Q X denote two distinct data distributions deﬁned on the image space X .

Original: Assume that a neural network f is trained on a dataset drawn from the distribution
Revised: Assume that a neural network f is trained on a dataset drawn from the distribution

Original: P X .
Revised: P X .

Original: Thus, we call P X the in-distribution and Q X the out-distribution , respectively.
Revised: Thus, we call P X the in-distribution and Q X the out-distribution , respectively.

Original: In detection, we draw new images from a mixture distribution P X (cid:2)
Revised: In detection, we draw new images from a mixture distribution P X (cid:2)

Original: Z deﬁned on X (cid:2) f 0 ; 1 g , where the conditional probability distributions P X j Z =

Revised: Z deﬁned on X (cid:2) f 0 ; 1 g , where the conditional probability distributions P X j Z =

Original: =
Revised: =

Original: P X and P X j Z =1 =
Revised: P X and P X j Z =1 =

Original: Q X denote in- and out-distribution respectively.
Revised: Q X denote in- and out-distribution respectively.

Original: Now we focus on the following problem: Given an image X drawn from the mixture distribution P X (cid:2) Z , can we distinguish whether the image is from in-distribution P X or not ?
Revised: Now we focus on the following problem: Given an image X drawn from the mixture distribution P X (cid:2) Z , can we distinguish whether the image is from in-distribution P X or not ?

Original: In this paper, we focus on detecting out-of-distribution images.
Revised: In this paper, we focus on detecting out-of-distribution images.

Original: However, it is equally important to correctly classify an image into the right class if it is an in-distribution image.
Revised: However, it is equally important to correctly classify an image into the right class if it is an in-distribution image.

Original: But this can be easily done: once it has been detected than an image comes from the in-distribution, we can simply use the original image and run it through the neural network to classify it.
Revised: But this can be easily done: once it has been detected than an image comes from the in-distribution, we can simply use the original image and run it through the neural network to classify it.

Original: Thus, we do not change the performance of the neural network for in-distribution images and only focus on improving the detection performance for out-of-distribution images.
Revised: Thus, we do not change the performance of the neural network for in-distribution images and only focus on improving the detection performance for out-of-distribution images.

Original:  ODIN: O UT - OF - DISTRIBUTION D ETECTOR
Revised:  ODIN: O UT - OF - DISTRIBUTION D ETECTOR

Original: In this section, we present our method, ODIN, for detecting out-of-distribution samples.
Revised: In this section, we present our method, ODIN, for detecting out-of-distribution samples.

Original: The detector is built on two essential techniques: temperature scaling and input preprocessing.
Revised: The detector is built on two essential techniques: temperature scaling and input preprocessing.

Original: We describe the details of both components below.
Revised: We describe the details of both components below.

Original: Temperature Scaling.
Revised: Temperature Scaling.

Original: Assume that the neural network f = ( f 1 ; :::; f N ) is trained to classify
Revised: Assume that the neural network f = ( f 1 ; :::; f N ) is trained to classify

Original: N classes.
Revised: N classes.

Original: For each input x , the neural network assigns a label ^
Revised: For each input x , the neural network assigns a label ^

Original: y ( x ) =
Revised: y ( x ) =

Original: arg max i S
Revised: arg max i S

Original: i ( x ; T ) by computing the softmax output for each class.
Revised: i ( x ; T ) by computing the softmax output for each class.

Original: Speciﬁcally,
Revised: Speciﬁcally,

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: ) where T 2 R + is the temperature scaling parameter and set to 1 during the training.
Revised: where T 2 R + is the temperature scaling parameter and set to 1 during the training.

Original: For a given input x , we call the maximum softmax probability, i.e., S ^ y ( x ; T ) =
Revised: For a given input x , we call the maximum softmax probability, i.e., S ^ y ( x ; T ) =

Original: max i S i ( x ; T ) the softmax score .
Revised: max i S i ( x ; T ) the softmax score .

Original: In this paper, we use notations S ^ y ( x ; T ) and S ( x ; T ) interchangeably.
Revised: In this paper, we use notations S ^ y ( x ; T ) and S ( x ; T ) interchangeably.

Original: Prior works have established to use temperature scaling to distill the knowledge in neural networks (Hinton et al., 2015) and calibrate the prediction conﬁdence in classiﬁcation tasks (Guo et al., 2017).
Revised: Prior works have established to use temperature scaling to distill the knowledge in neural networks (Hinton et al., 2015) and calibrate the prediction conﬁdence in classiﬁcation tasks (Guo et al., 2017).

Original: As we shall see later, a good manipulation of temperature T can push the softmax scores of in- and out-of-distribution images further apart from each other, making the out-of-distribution images distinguishable.
Revised: As we shall see later, a good manipulation of temperature T can push the softmax scores of in- and out-of-distribution images further apart from each other, making the out-of-distribution images distinguishable.

Original: Input Preprocessing.
Revised: Input Preprocessing.

Original: Before feeding the image x into the neural network, we preprocess the input by adding small perturbations.
Revised: Before feeding the image x into the neural network, we preprocess the input by adding small perturbations.

Original: The preprocessed image is given by
Revised: The preprocessed image is given by

Original: [Equation]
Revised: [Equation]

Original: where the parameter " can be interpreted as the perturbation magnitude.
Revised: where the parameter " can be interpreted as the perturbation magnitude.

Original: The method is inspired by the idea of Goodfellow et al.
Revised: The method is inspired by the idea of Goodfellow et al.

Original: (2015), where small perturbations are added to decrease the softmax score for the true label and force the neural network to make a wrong prediction.
Revised: (2015), where small perturbations are added to decrease the softmax score for the true label and force the neural network to make a wrong prediction.

Original: Here, our goal and setting is rather different: we aim to increase the softmax score of any given input, without the need for a class label at all.
Revised: Here, our goal and setting is rather different: we aim to increase the softmax score of any given input, without the need for a class label at all.

Original: As we shall see later, the perturbation can have stronger effect on the indistribution images than that on out-of-distribution images, making them more separable.
Revised: As we shall see later, the perturbation can have stronger effect on the indistribution images than that on out-of-distribution images, making them more separable.

Original: Note that the perturbations can be easily computed by back-propagating the gradient of the cross-entropy loss w.r.t the input.
Revised: Note that the perturbations can be easily computed by back-propagating the gradient of the cross-entropy loss w.r.t the input.

Original: Out-of-distribution Detector.
Revised: Out-of-distribution Detector.

Original: The proposed approach, ODIN, works as follows.
Revised: The proposed approach, ODIN, works as follows.

Original: For each image x , we ﬁrst calculate the preprocessed image ~ x according to the equation (2).
Revised: For each image x , we ﬁrst calculate the preprocessed image ~ x according to the equation (2).

Original: Next, we feed the preprocessed image ~ x into the neural network, calculate its softmax score S (~ x ; T ) and compare the score to the threshold (cid:14) .
Revised: Next, we feed the preprocessed image ~ x into the neural network, calculate its softmax score S (~ x ; T ) and compare the score to the threshold (cid:14) .

Original: We say that the image x is an in-distribution example if the softmax score is above the threshold and that the image x is an out-of-distribution example, otherwise.
Revised: We say that the image x is an in-distribution example if the softmax score is above the threshold and that the image x is an out-of-distribution example, otherwise.

Original: Therefore, the out-of-distribution detector is given by
Revised: Therefore, the out-of-distribution detector is given by

Original: [Equation]
Revised: [Equation]

Original: The detection error P e ( T; " ) under temperature T and perturbation magnitude " is deﬁned as
Revised: The detection error P e ( T; " ) under temperature T and perturbation magnitude " is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: representing the minimum misclassiﬁcation probability over all thresholds.
Revised: representing the minimum misclassiﬁcation probability over all thresholds.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: In this section, we demonstrate the effectiveness of ODIN on several computer vision benchmark datasets.
Revised: In this section, we demonstrate the effectiveness of ODIN on several computer vision benchmark datasets.

Original: We run all experiments with PyTorch 1 and we will release the code to reproduce all experimental results 2 .
Revised: We run all experiments with PyTorch 1 and we will release the code to reproduce all experimental results 2 .

Original: 4. T RAINING S ETUP
Revised: 4. T RAINING S ETUP

Original: Architectures and training conﬁgurations.
Revised: Architectures and training conﬁgurations.

Original: We adopt two state-of-the-art neural network architectures, including DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016).
Revised: We adopt two state-of-the-art neural network architectures, including DenseNet (Huang et al., 2016) and Wide ResNet (Zagoruyko & Komodakis, 2016).

Original: For DenseNet, our model follows the same setup as in (Huang et al., 2016), with depth
Revised: For DenseNet, our model follows the same setup as in (Huang et al., 2016), with depth

Original: L = 100 , growth rate k = 

Revised: L = 100 , growth rate k =

Original: (Dense-BC) and dropout rate 0.
Revised: (Dense-BC) and dropout rate 0.

Original: In addition, we evaluate the method on a Wide ResNet, with depth 28 , width 10 (WRN-28-10) and dropout rate 0.
Revised: In addition, we evaluate the method on a Wide ResNet, with depth 28 , width 10 (WRN-28-10) and dropout rate 0.

Original: Furthermore, in
Revised: Furthermore, in

Original: Appendix A.1, we provide additional experimental results on another Wide ResNet with depth 40, width 4 (WRN-40-4), which is as well used by Hendrycks & Gimpel (2017).
Revised: Appendix A.1, we provide additional experimental results on another Wide ResNet with depth 40, width 4 (WRN-40-4), which is as well used by Hendrycks & Gimpel (2017).

Original: The hyper-parameters of neural networks are set identical to the original Wide ResNet (Zagoruyko & Komodakis, 2016) and DenseNet (Huang et al., 2016) implementations.
Revised: The hyper-parameters of neural networks are set identical to the original Wide ResNet (Zagoruyko & Komodakis, 2016) and DenseNet (Huang et al., 2016) implementations.

Original: All neural networks are trained with stochastic gradient descent with Nesterov momentum (Duchi et al., 2011; Kingma & Ba, 2014).
Revised: All neural networks are trained with stochastic gradient descent with Nesterov momentum (Duchi et al., 2011; Kingma & Ba, 2014).

Original: Speciﬁcally, we train Dense-BC for 300 epochs with batch size 64 and momentum 0.9; and Wide ResNet forepochs with batch size 128 and momentum 0.9.
Revised: Speciﬁcally, we train Dense-BC for 300 epochs with batch size 64 and momentum 0.9; and Wide ResNet forepochs with batch size 128 and momentum 0.9.

Original: The learning rate starts at 0.1, and is dropped by a factor of 10 at 50% and 75% of the training progress, respectively.
Revised: The learning rate starts at 0.1, and is dropped by a factor of 10 at 50% and 75% of the training progress, respectively.

Original: [Table]
Revised: [Table]

Original: Accuracy.
Revised: Accuracy.

Original: Each neural network architecture is trained on CIFAR-10 (C-10) and CIFAR-100 (C-100) datasets (Krizhevsky & Hinton, 2009), respectively.
Revised: Each neural network architecture is trained on CIFAR-10 (C-10) and CIFAR-100 (C-100) datasets (Krizhevsky & Hinton, 2009), respectively.

Original: CIFAR-10 and CIFAR-100 images are drawn from 10 and 100 classes, respectively.
Revised: CIFAR-10 and CIFAR-100 images are drawn from 10 and 100 classes, respectively.

Original: Both datasets consist of 50, training images and 10,000 test images.
Revised: Both datasets consist of 50, training images and 10,000 test images.

Original: The test error on
Revised: The test error on

Original: CIFAR datasets are summarized in Table 1.
Revised: CIFAR datasets are summarized in Table 1.

Original: [Table]

Original: 4. O UT - OF - DISTRIBUTION D ATASETS
Revised: 4. O UT - OF - DISTRIBUTION D ATASETS

Original: At test time, the test images from CIFAR-10 (CIFAR-100) datasets can be viewed as the indistribution (positive) examples.
Revised: At test time, the test images from CIFAR-10 (CIFAR-100) datasets can be viewed as the indistribution (positive) examples.

Original: For out-of-distribution (negative) examples, we follow the setting  in (Hendrycks & Gimpel, 2017) and test on several different natural image datasets and synthetic noise datasets.
Revised: For out-of-distribution (negative) examples, we follow the setting [Table] in (Hendrycks & Gimpel, 2017) and test on several different natural image datasets and synthetic noise datasets.

Original: All the datasets considered are listed below.
Revised: All the datasets considered are listed below.

Original: (1) TinyImageNet.
Revised: (1) TinyImageNet.

Original: The Tiny ImageNet dataset 3 consists of a subset of ImageNet images (Deng et al., 2009).
Revised: The Tiny ImageNet dataset 3 consists of a subset of ImageNet images (Deng et al., 2009).

Original: It contains 10,000 test images from 200 different classes.
Revised: It contains 10,000 test images from 200 different classes.

Original: We construct two datasets, TinyImageNet (crop) and TinyImageNet (resize) , by either randomly cropping image patches of size 32 (cid:2) 32 or downsampling each image to size 32 (cid:2) 32 .
Revised: We construct two datasets, TinyImageNet (crop) and TinyImageNet (resize) , by either randomly cropping image patches of size 32 (cid:2) 32 or downsampling each image to size 32 (cid:2) 32 .

Original: (2) LSUN.
Revised: (2) LSUN.

Original: The Large-scale Scene UNderstanding dataset (LSUN) has a testing set of 10,000 images of 10 different scenes (Yu et al., 2015).
Revised: The Large-scale Scene UNderstanding dataset (LSUN) has a testing set of 10,000 images of 10 different scenes (Yu et al., 2015).

Original: Similar to TinyImageNet, we construct two datasets, LSUN (crop) and LSUN (resize) , by randomly cropping and downsampling the LSUN testing set, respectively.
Revised: Similar to TinyImageNet, we construct two datasets, LSUN (crop) and LSUN (resize) , by randomly cropping and downsampling the LSUN testing set, respectively.

Original: (3) iSUN.
Revised: (3) iSUN.

Original: The iSUN (Xu et al., 2015) consists of a subset of SUN images.
Revised: The iSUN (Xu et al., 2015) consists of a subset of SUN images.

Original: We include the entire collection of 8925 images in iSUN and downsample each image to size 32 by 32 .
Revised: We include the entire collection of 8925 images in iSUN and downsample each image to size 32 by 32 .

Original: (4) Gaussian Noise.
Revised: (4) Gaussian Noise.

Original: The synthetic Gaussian noise dataset consists of 10,000 random 2D Gaussian noise images, where each RGB value of every pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and unit variance.
Revised: The synthetic Gaussian noise dataset consists of 10,000 random 2D Gaussian noise images, where each RGB value of every pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and unit variance.

Original: We further clip each pixel value into the range [0 ; 1] .
Revised: We further clip each pixel value into the range [0 ; 1] .

Original: (5) Uniform Noise.
Revised: (5) Uniform Noise.

Original: The synthetic uniform noise dataset consists of 10,000 images where each RGB value of every pixel is independently and identically sampled from a uniform distribution on [0 ; 1] .
Revised: The synthetic uniform noise dataset consists of 10,000 images where each RGB value of every pixel is independently and identically sampled from a uniform distribution on [0 ; 1] .

Original: 4. E VALUATION METRICS
Revised: 4. E VALUATION METRICS

Original: We adopt the following four different metrics to measure the effectiveness of a neural network in distinguishing in- and out-of-distribution images.
Revised: We adopt the following four different metrics to measure the effectiveness of a neural network in distinguishing in- and out-of-distribution images.

Original: (1) FPR at 95% TPR can be interpreted as the probability that a negative (out-of-distribution) example is misclassiﬁed as positive (in-distribution) when the true positive rate (TPR) is as high as 95% .
Revised: FPR at 95% TPR can be interpreted as the probability that a negative (out-of-distribution) example is misclassiﬁed as positive (in-distribution) when the true positive rate (TPR) is as high as 95% .

Original: True positive rate can be computed by TPR = TP / (TP+FN), where TP and FN denote true positives and false negatives respectively.
Revised: True positive rate can be computed by TPR = TP / (TP+FN), where TP and FN denote true positives and false negatives respectively.

Original: The false positive rate (FPR) can be computed by FPR =
Revised: The false positive rate (FPR) can be computed by FPR =

Original: FP / (FP+TN), where FP and TN denote false positives and true negatives respectively.
Revised: FP / (FP+TN), where FP and TN denote false positives and true negatives respectively.

Original: (2) Detection Error , i.e., P e measures the minimum misclassiﬁcation probability over all possible score thresholds.
Revised: Detection Error i .e. P e measures the minimum misclassiﬁcation probability over all possible score thresholds.

Original: The deﬁnition of P e is given in equation (3).
Revised: The deﬁnition of P e is given in equation (3).

Original: Here, we set that both positive and negative examples have equal probability of appearing in the test set.
Revised: Here, we set that both positive and negative examples have equal probability of appearing in the test set.

Original: (3) AUROC is the Area Under the Receiver Operating Characteristic curve, which is also a thresholdindependent metric (Davis & Goadrich, 2006).
Revised: 3) AUROC is the Area Under the Receiver Operating Characteristic curve, which is also a thresholdindependent metric (Davis & Goadrich, 2006).

Original: The ROC curve depicts the relationship between TPR and FPR.
Revised: The ROC curve depicts the relationship between TPR and FPR.

Original: The AUROC can be interpreted as the probability that a positive example is assigned a higher detection score than a negative example (Fawcett, 2006).
Revised: The AUROC can be interpreted as the probability that a positive example is assigned a higher detection score than a negative example (Fawcett, 2006).

Original: A perfect detector corresponds to an AUROC score of 100% .
Revised: A perfect detector corresponds to an AUROC score of 100% .

Original: (4) AUPR is the Area under the Precision-Recall curve, which is another threshold independent metric (Manning et al., 1999; Saito & Rehmsmeier, 2015).
Revised: AUPR is the Area under the Precision-Recall curve, which is another threshold independent metric (Manning et al., 1999; Saito & Rehmsmeier, 2015).

Original: The PR curve is a graph showing the precision=TP/(TP+FP) and recall=TP/(TP+FN) against each other.
Revised: The PR curve is a graph showing the precision=TP/(TP+FP) and recall=TP/(TP+FN) against each other.

Original: The metric AUPR-In and AUPR-Out in Table 2 denote the area under the precision-recall curve where in-distribution and out-of-distribution images are speciﬁed as positives, respectively.
Revised: The metric AUPR-In and AUPR-Out in Table 2 denote the area under the precision-recall curve where in-distribution and out-of-distribution images are speciﬁed as positives, respectively.

Original: 4. E XPERIMENTAL R ESULTS
Revised: 4. E XPERIMENTAL R ESULTS

Original: [Figure]
Revised: [Figure]

Original: Comparison with baseline.
Revised: Comparison with baseline.

Original: In Figure 1, we show the ROC curves when DenseNet-BC-100 is evaluated on CIFAR- (positive) images against TinyImageNet (negative) test examples.
Revised: In Figure 1, we show the ROC curves when DenseNet-BC-100 is evaluated on CIFAR- (positive) images against TinyImageNet (negative) test examples.

Original: The red curve corresponds to the ROC curve when using baseline method (Hendrycks & Gimpel, 2017), whereas the blue curve corresponds to our method with temperature
Revised: The red curve corresponds to the ROC curve when using baseline method (Hendrycks & Gimpel, 2017), whereas the blue curve corresponds to our method with temperature

Original: T = 1000 and perturbation magnitude " = 0 : 0012 .
Revised: T = 1000 and perturbation magnitude " = 0 : 0012 .

Original: We observe a strikingly large gap between the blue and red ROC curves.
Revised: We observe a strikingly large gap between the blue and red ROC curves.

Original: For example, when TPR = 95% , the FPR can be reduced from 34% to 4 : 2% by using our approach.
Revised: For example, when TPR = 95% , the FPR can be reduced from 34% to 4 : 2% by using our approach.

Original: Choosing parameters.
Revised: Choosing parameters.

Original: For each out-of-distribution dataset, we randomly hold out 1,000 images for tuning the parameters
Revised: For each out-of-distribution dataset, we randomly hold out 1,000 images for tuning the parameters

Original: T and " .
Revised: T and " .

Original: For temperature T , we select among 1, 2, 5, 10, 20, 50, 100, 200, 500, 1000; and for perturbation magnitude " we choose from 21 evenly spaced numbers starting fromand ending at 0.004.
Revised: For temperature T , we select among 1, 2, 5, 10, 20, 50, 100, 200, 500, 1000; and for perturbation magnitude " we choose from 21 evenly spaced numbers starting fromand ending at 0.004.

Original: The optimal parameters are chosen to minimize the detection error on the holdout set.
Revised: The optimal parameters are chosen to minimize the detection error on the holdout set.

Original: We evaluate the our approach on the remaining test images.
Revised: We evaluate the our approach on the remaining test images.

Original: All parameter settings are reported in the Appendix A. We provide additional details on the effect of parameters in Section 5.
Revised: All parameter settings are reported in the Appendix A. We provide additional details on the effect of parameters in Section 5.

Original: Main results.
Revised: Main results.

Original: The main results are summarized in Table 2.
Revised: The main results are summarized in Table 2.

Original: For each in- and out-of-distribution dataset pair, we report both the performance of the baseline (Hendrycks & Gimpel, 2017) and our approach using temperature scaling and input preprocessing.
Revised: For each in- and out-of-distribution dataset pair, we report both the performance of the baseline (Hendrycks & Gimpel, 2017) and our approach using temperature scaling and input preprocessing.

Original: In Table 2, we observed improved performances across all neural architectures and all dataset pairs.
Revised: In Table 2, we observed improved performances across all neural architectures and all dataset pairs.

Original: Noticeably, our method consistently outperforms the baseline by a large margin when measured by FPR at 95% TPR and detection error.
Revised: Noticeably, our method consistently outperforms the baseline by a large margin when measured by FPR at 95% TPR and detection error.

Original: 4. E XTENSIONS
Revised: 4. E XTENSIONS

Original: In this subsection, we analyze how the statistical distance between in- and out-of-distribution natural image dataset affects the detection performance of the proposed method.
Revised: In this subsection, we analyze how the statistical distance between in- and out-of-distribution natural image dataset affects the detection performance of the proposed method.

Revised: Data distribution distance vs. Detection performance.

Revised: To measure the statistical distance between in- and out-of-distribution datasets, we adopt a commonly used metric, maximum mean discrepancy (MMD) with Gaussian RBF kernel (Sriperumbudur et al., 2010; Gretton et al., 2012;

Revised: Sutherland et al., 2016).

Revised: Speciﬁcally, given two image sets, V = f v 1 ; :::; v m g and W =

Original: [Figure]
Revised: [Figure]

Original: F P R a t T PR
Revised: F P R a t T P

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: D e t ec t i o n
Revised: D e t ec t i o n

Original: E rr o r    5 Datasets0.
Revised: E rr o r    5 Datasets

Original: 0.5 D i s t a n ce 0.
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: D i s t a n ce[-
-]
Revised: D i s t a n ce[-
-]

Original: [Figure]
Revised: [Figure]

Original: F P
Revised: [Figure] [Figure] [Figure] i s t a n ce

Original: [Figure]
Revised: [Figure]

Original: t
Revised: t

Original: [Figure]
Revised: [Figure]

Revised: e

Original: [Figure]
Revised: [Figure]

Original: D e t ec t io n E rr o r
Revised: t i

Original: [Figure]
Revised: [Figure]

Original: Datasets
Revised: n

Original: [Figure]
Revised: [Figure]

Original: 0.5 D i s t a n ce 0.

Original: 0.5 D i s t a n ce
Revised: i s t a n ce

Original: Data distribution distance vs. Detection performance. To measure the statistical distance between in- and out-of-distribution datasets, we adopt a commonly used metric, maximum mean discrepancy (MMD) with Gaussian RBF kernel (Sriperumbudur et al., 2010; Gretton et al., 2012;
Revised: [Figure] [Figure]

Original: Sutherland et al., 2016).
Revised: [Figure]

Original: Speciﬁcally, given two image sets, V = f v 1 ; :::; v m g and W = f w1 ; :::; w m g, the maximum mean discrepancy between V and Q is deﬁned as
Revised: D i s t a n ce f w w m g the maximum mean discrepancy between V and Q is deﬁned as

Original: [Equation]
Revised: [Equation]

Original:  where k ( (cid:1) ; (cid:1) ) is the Gaussian RBF kernel, i.e., k ( x; x ′ ) =
Revised: k ( v i ; w j ) ; where k ( (cid:1) ; (cid:1) ) is the Gaussian RBF kernel, i.e., k ( x; x ′ ) =

Original: exp
Revised: exp

Original: [Equation]
Revised: [Equation]

Original: We use the same way used by Sutherland et al.
Revised: We use the same way used by Sutherland et al.

Original: (2016) to choose (cid:27) , where 2 (cid:27) 2 is set to the median of all Euclidean distances between all images in the aggregate set V [ W .
Revised: (2016) to choose (cid:27) , where 2 (cid:27) 2 is set to the median of all Euclidean distances between all images in the aggregate set V [ W .

Original: In Figure 2 (a)(b), we show how performances of ODIN vary against the MMD distances between in- and out-of-distribution datasets 4 .
Revised: In Figure 2 (a)(b), we show how performances of ODIN vary against the MMD distances between in- and out-of-distribution datasets 4 .

Original: The datasets (on x-axis) are ranked in the descending order of
Revised: The datasets (on x-axis) are ranked in the descending order of

Original: MMD distances with CIFAR datasets.
Revised: MMD distances with CIFAR datasets.

Original: There are two interesting observations can be drawn from.
Revised: There are two interesting observations can be drawn from.

Original: First, we ﬁnd that the MMD distances between the cropped datasets and CIFAR-100 tend to be larger.
Revised: First, we ﬁnd that the MMD distances between the cropped datasets and CIFAR-100 tend to be larger.

Original: This is likely due to the fact that cropped images only contain local image context and are thus distinct from images in CIFAR-100, while resized images contain global patterns and are thus similar to images in CIFAR-100.
Revised: This is likely due to the fact that cropped images only contain local image context and are thus distinct from images in CIFAR-100, while resized images contain global patterns and are thus similar to images in CIFAR-100.

Original: Second, we observe that the MMD distance tends to be negatively correlated with the detection performance.
Revised: Second, we observe that the MMD distance tends to be negatively correlated with the detection performance.

Original: This suggests that the detection task becomes harder as in and out-of-distribution images are more similar to each other.
Revised: This suggests that the detection task becomes harder as in and out-of-distribution images are more similar to each other.

Original: Same-manifold datasets.
Revised: Same-manifold datasets.

Original: Furthermore, we investigate the extreme scenario when in- and out-ofdistribution datasets are on the same manifold.
Revised: Furthermore, we investigate the extreme scenario when in- and out-ofdistribution datasets are on the same manifold.

Original: In experiment, we randomly split CIFAR-100 into two disjoint datasets containing 80 and 20 classes each.
Revised: In experiment, we randomly split CIFAR-100 into two disjoint datasets containing 80 and 20 classes each.

Original: We name them CIFAR-80 and CIFAR20 , respectively.
Revised: We name them CIFAR-80 and CIFAR20 , respectively.

Original: We train both DenseNet and Wide ResNet-28-10 on the CIFAR-80 dataset (indistribution) and evaluate the detection performances on the CIFAR-20 dataset (out-distribution).
Revised: We train both DenseNet and Wide ResNet-28-10 on the CIFAR-80 dataset (indistribution) and evaluate the detection performances on the CIFAR-20 dataset (out-distribution).

Original: All hyperparameters used here are exactly the same as in Section 4.1.
Revised: All hyperparameters used here are exactly the same as in Section 4.1.

Original: The MMD distance between CIFAR-20 and CIFAR-80 is much smaller than other dataset pairs.
Revised: The MMD distance between CIFAR-20 and CIFAR-80 is much smaller than other dataset pairs.

Original: In Figure 2 (c)(d), we observe that both FPR at TPR 95% and detection error become larger on the CIFAR-20 dataset.
Revised: In Figure 2 (c)(d), we observe that both FPR at TPR 95% and detection error become larger on the CIFAR-20 dataset.

Original: This coincides with our expectation that the detection task becomes extremely hard when in- and out-of-distribution dataset locate on the same manifold.
Revised: This coincides with our expectation that the detection task becomes extremely hard when in- and out-of-distribution dataset locate on the same manifold.

Original: We provide additional experimental results in Appendix A.1 and Appendix G.
Revised: We provide additional experimental results in Appendix A.1 and Appendix G.

Original:  D ISCUSSIONS 5. E FFECTS OF P ARAMETERS
Revised:  D ISCUSSIONS 5. E FFECTS OF P ARAMETERS

Original: In this subsection, we empirically show how temperature T and perturbation magnitude " affect
Revised: In this subsection, we empirically show how temperature T and perturbation magnitude " affect

Original: FPR at TPR 95% and AUROC on DenseNet and Wide ResNet-28-10.
Revised: FPR at TPR 95% and AUROC on DenseNet and Wide ResNet-28-10.

Original: Additional results on other metrics and architectures are provided in Appendix B.
Revised: Additional results on other metrics and architectures are provided in Appendix B.

Original: We show the detection performances when using only the temperature scaling method (see Figure 3(a)(b), " = 0 ), or the input preprocessing method (see Figure 3(c)(d), T = 1 ).
Revised: We show the detection performances when using only the temperature scaling method (see Figure 3(a)(b), " = 0 ), or the input preprocessing method (see Figure 3(c)(d), T = 1 ).

Original: In Figure 4, we show the detection performance w.r.t " when
Revised: In Figure 4, we show the detection performance w.r.t " when

Original: T is optimal (e.g., T =1000).
Revised: T is optimal (e.g., T =1000).

Original: First, from Figure 3 (a)(b), we observe that increasing the temperature[Figure] [Figure] can improve the detection performances, although the effects diminish when T is sufﬁciently large (e.g., T > 100 ).
Revised: First, from Figure 3 (a)(b), we observe that increasing the temperature can improve the detection performances, although the effects diminish when T is sufﬁciently large (e.g., T > 100 ).

Original: Next, from Figure 3(c)(d) and Figure 4, we observe that we can further improve the detection performances by appropriately choosing the perturbation magnitudes.
Revised: Next, from Figure 3(c)(d) and Figure 4, we observe that we can further improve the detection performances by appropriately choosing the perturbation magnitudes.

Original: We can achieve overall better performance by combining both (1) temperature scaling and (2) input preprocessing. 
Revised: We can achieve overall better performance by combining both (1) temperature scaling and (2) input preprocessing. [Figure] [Figure]

Original: 5. A NALYSIS ON T EMPERATURE S CALING
Revised: 5. A NALYSIS ON T EMPERATURE S CALING

Original: In this subsection, we analyze the effectiveness of the temperature scaling method.
Revised: In this subsection, we analyze the effectiveness of the temperature scaling method.

Original: As shown in
Revised: As shown in

Original: Figure 3 (a) and (b), we observe that a sufﬁciently large temperature yields better detection performance although the effects diminish when T is too large.
Revised: Figure 3 (a) and (b), we observe that a sufﬁciently large temperature yields better detection performance although the effects diminish when T is too large.

Original: To gain insights, we can refer to the Taylor expansion of softmax score (details provided in Appendix D).
Revised: To gain insights, we can refer to the Taylor expansion of softmax score (details provided in Appendix D).

Original: When T is sufﬁciently large, we have
Revised: When T is sufﬁciently large, we have

Original: [Equation]
Revised: [Equation]

Original:  by omitting the third and higher orders.
Revised: (4) by omitting the third and higher orders.

Original: For simplicity of notation, we deﬁne
Revised: For simplicity of notation, we deﬁne

Revised: U 1 ( x

Revised: [Equation]

Revised: =

Revised: N (cid:0)

Original: [Equation]
Revised: [Equation]

Original: ∑ i ̸
Revised: ∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y ( x ) (cid:0) f
Revised: [ f ^ y ( x ) (cid:0) f

Original: i ( x )] and U 2 ( x ) =
Revised: i ( x )] and U 2 ( x ) =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y ( x ) (cid:0) f
Revised: [ f ^ y ( x ) (cid:0) f

Original: i ( x )] 2 : (5)
Revised: i ( x )] 2 : (5)

Original: Interpretations of U 1 and U 2 .
Revised: Interpretations of U 1 and U 2 .

Original: By deﬁnition, U 1 measures the extent to which the largest unnormalized output of the neural network deviates from the remaining outputs; while U 2 measures the extent to which the remaining smaller outputs deviate from each other.
Revised: By deﬁnition, U 1 measures the extent to which the largest unnormalized output of the neural network deviates from the remaining outputs; while U 2 measures the extent to which the remaining smaller outputs deviate from each other.

Original: We provide formal mathematical derivations in Appendix F.
Revised: We provide formal mathematical derivations in Appendix F.

Original: In Figure 5(a), we show the distribution of U 1 for each out-of-distribution dataset vs. the in-distribution dataset (in red).
Revised: In Figure 5(a), we show the distribution of U 1 for each out-of-distribution dataset vs. the in-distribution dataset (in red).

Original: We observe that the largest outputs of the neural network on in-distribution images deviate more from the remaining outputs.
Revised: We observe that the largest outputs of the neural network on in-distribution images deviate more from the remaining outputs.

Original: This is likely due to the fact that neural networks tend to make more conﬁdent predictions on in-distribution images.
Revised: This is likely due to the fact that neural networks tend to make more conﬁdent predictions on in-distribution images.

Original: Further, we show in Figure 5(b) the expectation of U 2 conditioned on U 1 , i.e., E [ U 2 j U 1 ] , for each dataset.
Revised: Further, we show in Figure 5(b) the expectation of U 2 conditioned on U 1 , i.e., E [ U 2 j U 1 ] , for each dataset.

Original: The red curve (in-distribution images) has overall higher expectation.
Revised: The red curve (in-distribution images) has overall higher expectation.

Original: This indicates that, when two images have similar values on U 1 , the in-distribution image tends to have a much higher value of U 2 than the out-of-distribution image.
Revised: This indicates that, when two images have similar values on U 1 , the in-distribution image tends to have a much higher value of U 2 than the out-of-distribution image.

Original: In other words, for in-distribution images, the remaining outputs (excluding the largest output) tend to be more deviated from each other compared to out-of-distribution datasets.
Revised: In other words, for in-distribution images, the remaining outputs (excluding the largest output) tend to be more deviated from each other compared to out-of-distribution datasets.

Original: This may happen when some classes in the in-distribution dataset[Figure] share common features while others differ signiﬁcantly.
Revised: This may happen when some classes in the in-distribution dataset share common features while others differ signiﬁcantly.

Original: To illustrate this, in Figure 5 (f)(g), we show the outputs of each class using a DenseNet (trained on CIFAR-10) on a dog image from CIFAR-10, and another image from TinyImageNet (crop).
Revised: To illustrate this, in Figure 5 (f)(g), we show the outputs of each class using a DenseNet (trained on CIFAR-10) on a dog image from CIFAR-10, and another image from TinyImageNet (crop).

Original: For the image of dog, we can observe that the largest output for the label dog is close to the output for the label cat but is quite deviated from the outputs for the label car and truck .
Revised: For the image of dog, we can observe that the largest output for the label dog is close to the output for the label cat but is quite deviated from the outputs for the label car and truck .

Original: This is likely due to the fact that, in CIFAR-10, images of dog are very  similar to the images of cat but are quite distinct from images of car and truck.
Revised: This is likely due to the fact that, in CIFAR-10, images of dog are very [Figure] similar to the images of cat but are quite distinct from images of car and truck.

Original: For the image from
Revised: For the image from

Original: TinyImageNet (crop), despite having one large output, the remaining outputs are close to each other and thus have a smaller deviation.
Revised: TinyImageNet (crop), despite having one large output, the remaining outputs are close to each other and thus have a smaller deviation.

Original: The effects of T .
Revised: The effects of T .

Original: To see the usefulness of adopting a large T , we can ﬁrst rewrite the softmax score function in Equation (4) as S / ( U 1 (cid:0) U 2 = 2 T )
Revised: To see the usefulness of adopting a large T , we can ﬁrst rewrite the softmax score function in Equation (4) as S / ( U 1 (cid:0) U 2 = 2 T )

Original: =T .
Revised: =T .

Original: Hence the softmax score is largely determined by U 1 and U 2 = 2 T .
Revised: Hence the softmax score is largely determined by U 1 and U 2 = 2 T .

Original: As noted earlier, U 1 makes in-distribution images produce larger softmax scores than out-of-distribution images since S / U 1 , while U 2 has the exact opposite effect since S / (cid:0) U 2 .
Revised: As noted earlier, U 1 makes in-distribution images produce larger softmax scores than out-of-distribution images since S / U 1 , while U 2 has the exact opposite effect since S / (cid:0) U 2 .

Original: Therefore, by choosing a sufﬁciently large temperature, we can compensate the negative impacts of
Revised: Therefore, by choosing a sufﬁciently large temperature, we can compensate the negative impacts of

Original: U 2 = 2 T on the detection performance, making the softmax scores between in- and out-of-distribution images more separable.
Revised: U 2 = 2 T on the detection performance, making the softmax scores between in- and out-of-distribution images more separable.

Original: Eventually, when T is sufﬁciently large, the distribution of softmax score is almost dominated by the distribution of U 1 and thus increasing the temperature further is no longer effective.
Revised: Eventually, when T is sufﬁciently large, the distribution of softmax score is almost dominated by the distribution of U 1 and thus increasing the temperature further is no longer effective.

Original: This explains why we see in Figure 3 (a)(b) that the performance becomes unchanged when T is too large (e.g., T > 100 ).
Revised: This explains why we see in Figure 3 (a)(b) that the performance becomes unchanged when T is too large (e.g., T > 100 ).

Original: In Appendix E, we provide formal proof showing that the detection error eventually converges to a constant number when T goes to inﬁnity.
Revised: In Appendix E, we provide formal proof showing that the detection error eventually converges to a constant number when T goes to inﬁnity.

Original: 5. A NALYSIS ON I NPUT P REPROCESSING
Revised: 5. A NALYSIS ON I NPUT P REPROCESSING

Original: As noted previously, using the temperature scaling method by itself can be effective in improving the detection performance.
Revised: As noted previously, using the temperature scaling method by itself can be effective in improving the detection performance.

Original: However, the effectiveness quickly diminishes as T becomes very large.
Revised: However, the effectiveness quickly diminishes as T becomes very large.

Original: In order to make further improvement, the input processing method can be quite complementary.
Revised: In order to make further improvement, the input processing method can be quite complementary.

Original: This has already been seen in Figure 4, where the detection performance is improved by a large margin on most datasets when T = 1000 , provided with an appropriately chosen perturbation magnitude " .
Revised: This has already been seen in Figure 4, where the detection performance is improved by a large margin on most datasets when T = 1000 , provided with an appropriately chosen perturbation magnitude " .

Original: In this subsection, we provide insights behind this.
Revised: In this subsection, we provide insights behind this.

Original: To explain, we can look into the ﬁrst order Taylor expansion of the log-softmax function for the perturbed image ~ x , which can be derived as
Revised: To explain, we can look into the ﬁrst order Taylor expansion of the log-softmax function for the perturbed image ~ x , which can be derived as

Original: [Equation]
Revised: [Equation]

Original: where x is the original input.
Revised: where x is the original input.

Original: The effects of gradient.
Revised: The effects of gradient.

Original: In Figure 5 (c), we present the distribution of ∥∇ x log S ( x ; T ) ∥ 1 — the 1norm of gradient of log-softmax with respect to the input x — for all datasets.
Revised: In Figure 5 (c), we present the distribution of ∥∇ x log S ( x ; T ) ∥ 1 — the 1norm of gradient of log-softmax with respect to the input x — for all datasets.

Original: A salient observation is that CIFAR-10 images (in-distribution) tend to have larger values on the norm of gradient than most out-of-distribution images.
Revised: A salient observation is that CIFAR-10 images (in-distribution) tend to have larger values on the norm of gradient than most out-of-distribution images.

Original: To further see the effects of the norm of gradient on the softmax score, we provide in Figures 5 (d) the conditional expectation E [ ∥∇ x log S ( x ; T ) ∥ 1 j S ] .
Revised: To further see the effects of the norm of gradient on the softmax score, we provide in Figures 5 (d) the conditional expectation E [ ∥∇ x log S ( x ; T ) ∥ 1 j S ] .

Original: We can observe that, when an in-distribution image and an out-of-distribution image have the same softmax [Figure]
Revised: We can observe that, when an in-distribution image and an out-of-distribution image have the same softmax score, the value of ∥∇ x log S ( x ; T ) ∥ 1 for in-distribution image tends to be larger.

Original: We illustrate the effects of the norm of gradient in Figure 6.
Revised: We illustrate the effects of the norm of gradient in Figure 6.

Original: Suppose an in-distribution image x 1 (blue) and an out-of-distribution image x 2 (red) have similar softmax scores, i.e., S ( x 1 ) (cid:25) S ( x 2 ) .
Revised: Suppose an in-distribution image x(blue) and an out-of-distribution image x 2 (red) have similar softmax scores, i.e., S ( x 1 ) (cid:25) S ( x 2 ) .

Original: After input processing, the in-distribution image can have a much larger softmax score than the out-of-distribution image x 2 since xresults in a much larger value on the norm of softmax gradient than that of x 2 .
Revised: After input processing, the in-distribution image can have a much larger softmax score than the outof-distribution image x 2 since x 1 results in a much larger value on the norm of softmax gradient than that of x 2 .

Original: Therefore, in- and out-of-distribution images are more separable from each other after input preprocessing 5 . 
Revised: Therefore, in- and out-of-distribution images are more separable from each other after input preprocessing 5 . [Figure]

Original: The effect of " .
Revised: The effect of " .

Original: When the magnitude " is sufﬁciently small, adding perturbations does not change the predictions of the neural network, i.e., ^ y (~ x ) =
Revised: When the magnitude " is sufﬁciently small, adding perturbations does not change the predictions of the neural network, i.e., ^ y (~ x ) =

Original: ^ y ( x ) .
Revised: ^ y ( x ) .

Original: However, when " is not negligible, the gap of softmax scores between in- and out-of-distribution images can be affected by ∥∇ x log S ( x ; T ) ∥ 1 .
Revised: However, when " is not negligible, the gap of softmax scores between in- and out-of-distribution images can be affected by ∥∇ x log S ( x ; T ) ∥ 1 .

Original: Our observation is consistent with that in (Szegedy et al., 2014; Goodfellow et al., 2015; MoosaviDezfooli et al., 2017), which show that the softmax scores tend to change signiﬁcantly if small perturbations are added to the in-distribution images.
Revised: Our observation is consistent with that in (Szegedy et al., 2014; Goodfellow et al., 2015; MoosaviDezfooli et al., 2017), which show that the softmax scores tend to change signiﬁcantly if small perturbations are added to the indistribution images.

Original: It is also worth noting that using a very large " can lead to performance degradation, as seen in Figure 4.
Revised: It is also worth noting that using a very large " can lead to performance degradation, as seen in Figure 4.

Original: This is likely due to the fact that the second and higher order terms in the Taylor expansion are no longer insigniﬁcant when the perturbation magnitude is too large.
Revised: This is likely due to the fact that the second and higher order terms in the Taylor expansion are no longer insigniﬁcant when the perturbation magnitude is too large.

Original:  R ELATED W ORKS AND F UTURE D IRECTIONS
Revised:  R ELATED W ORKS AND F UTURE D IRECTIONS

Original: The problem of detecting out-of-distribution examples in low-dimensional space has been wellstudied in various contexts (see the survey by Pimentel et al.
Revised: The problem of detecting out-of-distribution examples in lowdimensional space has been well-studied in various contexts (see the survey by Pimentel et al.

Original: Conventional methods such as density estimation, nearest neighbor and clustering analysis are widely used in detecting lowdimensional out-of-distribution examples (Chow, 1970; Vincent & Bengio, 2003; Ghoting et al., 2008; Devroye et al., 2013), .
Revised: Conventional methods such as density estimation, nearest neighbor and clustering analysis are widely used in detecting low-dimensional out-of-distribution examples (Chow, 1970; Vincent & Bengio, 2003; Ghoting et al., 2008; Devroye et al., 2013), .

Original: The density estimation approach uses probabilistic models to estimate the in-distribution density and declares a test example to be out-of-distribution if it locates in the lowdensity areas.
Revised: The density estimation approach uses probabilistic models to estimate the in-distribution density and declares a test example to be out-ofdistribution if it locates in the low-density areas.

Original: The clustering method is based on the statistical distance, and declares an example to be out-of-distribution if it locates far from its neighborhood.
Revised: The clustering method is based on the statistical distance, and declares an example to be out-of-distribution if it locates far from its neighborhood.

Original: Despite various applications in lowdimensional spaces, unfortunately, these methods are known to be unreliable in high-dimensional space such as image space (Wasserman, 2006; Theis et al., 2015).
Revised: Despite various applications in low-dimensional spaces, unfortunately, these methods are known to be unreliable in high-dimensional space such as image space (Wasserman, 2006; Theis et al., 2015).

Original: In recent years, out-of-distribution detector based on deep models have been proposed, due to their undoubtable representing power in high-dimensional space.
Revised: In recent years, out-of-distribution detector based on deep models have been proposed, due to their undoubtable representing power in high-dimensional space.

Original: Schlegl et al.
Revised: Schlegl et al.

Original: (2017) train a generative adversarial networks to detect outof-distribution examples in clinical scenario.
Revised: (2017) train a generative adversarial networks to detect out-of-distribution examples in clinical scenario.

Original: Sabokrou et al.
Revised: Sabokrou et al.

Original: (2016) train a convolutional network to detect anomaly in scenes.
Revised: (2016) train a convolutional network to detect anomaly in scenes.

Original: Andrews et al.
Revised: Andrews et al.

Original: (2016) adopt transfer representation-learning for anomaly detection.
Revised: (2016) adopt transfer representation-learning for anomaly detection.

Original: All these works require enlarging or modifying the neural networks.
Revised: All these works require enlarging or modifying the neural networks.

Original: In a more recent work, Hendrycks & Gimpel (2017) found that pre-trained neural networks can be overconﬁdent to out-of-distribution example, limiting the effectiveness of detection.
Revised: In a more recent work, Hendrycks & Gimpel (2017) found that pre-trained neural networks can be overconﬁdent to out-of-distribution example, limiting the effectiveness of detection.

Original: Our paper aims to improve the performance of detecting out-of-distribution examples, yet without requiring any change to an existing well-trained model.
Revised: Our paper aims to improve the performance of detecting out-of-distribution examples, yet without requiring any change to an existing well-trained model.

Original: Our approach leverages the following two interesting observations to help better distinguish between in- and out-of-distribution examples:
Revised: Our approach leverages the following two interesting observations to help better distinguish between in- and out-of-distribution examples:

Original: (1) On in-distribution images, modern neural networks tend to produce outputs with larger variance across class labels, and (2) neural networks have larger norm of gradient when applied on in-distribution images.
Revised: (1) On in-distribution images, modern neural networks tend to produce outputs with larger variance across class labels, and (2) neural networks have larger norm of gradient when applied on in-distribution images.

Original: We believe that having a better understanding of these phenomenon can lead to further insights into this problem.
Revised: We believe that having a better understanding of these phenomenon can lead to further insights into this problem.

Original:  C ONCLUSIONS
Revised:  C ONCLUSIONS

Original: In this paper, we propose a simple and effective method to detect out-of-distribution data samples in neural networks.
Revised: In this paper, we propose a simple and effective method to detect out-of-distribution data samples in neural networks.

Original: Our method does not require retraining the neural network and signiﬁcantly improves on the baseline (state-of-the-art) on different neural architectures across various in and out-distribution dataset pairs.
Revised: Our method does not require retraining the neural network and signiﬁcantly improves on the baseline (state-of-the-art) on different neural architectures across various in and out-distribution dataset pairs.

Original: We empirically analyze the method under different parameter settings, and provide theoretical intuition and insights behind the approach.
Revised: We empirically analyze the method under different parameter settings, and provide theoretical intuition and insights behind the approach.

Original: Future work involves exploring our method in other applications such as speech recognition and natural language processing.
Revised: Future work involves exploring our method in other applications such as speech recognition and natural language processing.

Original: A S UPPLEMENTARY R ESULTS IN S ECTION 4. A. E XPERIMENTAL R ESULTS
Revised: A S UPPLEMENTARY R ESULTS IN S ECTION 4. A. E XPERIMENTAL R ESULTS

Original: [Table]
Revised: [Table]

Original: MNIST:
Revised: MNIST:

Original: We used the same MNIST classiﬁer used by Hendrycks & Gimpel (2017), which is a three-layer, 256 neuron-wide, fully connected network trained for 30 epochs with Adam (Kingma & Ba, 2014).
Revised: We used the same MNIST classiﬁer used by Hendrycks & Gimpel (2017), which is a three-layer, 256 neuron-wide, fully connected network trained for 30 epochs with Adam (Kingma & Ba, 2014).

Original: The classiﬁer achieve 99.34% test accuracy on the MNIST test set.
Revised: The classiﬁer achieve 99.34% test accuracy on the MNIST test set.

Original: We compare our method with the baseline (Hendrycks & Gimpel, 2017) on ﬁve different out-of-distribution datasets: (1) Omniglot dataset (Lake et al., 2015) contains images of handwritten characters in stead of the handwritten digits in MNIST; (2) notMNIST (Bulatov, 2011) dataset contains typeface characters;
Revised: We compare our method with the baseline (Hendrycks & Gimpel, 2017) on ﬁve different out-of-distribution datasets: (1) Omniglot dataset (Lake et al., 2015) contains images of handwritten characters in stead of the handwritten digits in MNIST; (2) notMNIST (Bulatov, 2011) dataset contains typeface characters;

Original: (3) CIFAR-10bw contains black and white rescaled CIFAR-10 images; (4)(5) Gaussian and Uniform image set contains the synthetic Gaussian and Uniform noise images used in Section 4.2.
Revised: (3) CIFAR-10bw contains black and white rescaled CIFAR-10 images; (4)(5) Gaussian and Uniform image set contains the synthetic Gaussian and Uniform noise images used in Section 4.2.

Original: Wide ResNet-40-4: We use the same architecture used by Hendrycks & Gimpel (2017) to evaluate the baseline and our method.
Revised: Wide ResNet-40-4: We use the same architecture used by Hendrycks & Gimpel (2017) to evaluate the baseline and our method.

Original: The Wide ResNet-40-4 achieves 95.7% test accuracy on CIFARdataset and achieve 79.27% test accuracy on CIFAR-100.
Revised: The Wide ResNet-40-4 achieves 95.7% test accuracy on CIFARdataset and achieve 79.27% test accuracy on CIFAR-100.

Original: CIFAR-80:
Revised: CIFAR-80:

Original: DenseNet-BC-100 achieves 78.94% test accuracy on CIFAR-80, while Wide ResNet28-10 achieves 81.71% test accuracy and Wide ResNet-40-4 achieves 79.53% test accuracy on
Revised: DenseNet-BC-100 achieves 78.94% test accuracy on CIFAR-80, while Wide ResNet28-10 achieves 81.71% test accuracy and Wide ResNet-40-4 achieves 79.53% test accuracy on

Original: CIFAR-80.
Revised: CIFAR-80.

Original: A. P ARAMETER S ETTINGS
Revised: A. P ARAMETER S ETTINGS

Original: For MNIST, we set T = 1000 and " = 0 .
Revised: For MNIST, we set T = 1000 and " = 0 .

Original: The parameter settings for other structures are shown as follows.
Revised: The parameter settings for other structures are shown as follows.

Original: [Table]
Revised: [Table]

Original: TinyImageNet
Revised: TinyImageNet

Original: [Table]
Revised: [Table]

Original: resize
Revised: resize

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: B S UPPLEMENTARY R ESULTS IN S ECTION 5. 
Revised: B S UPPLEMENTARY R ESULTS IN S ECTION 5.

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: C S UPPLEMENTARY R ESULTS IN S ECTION 5.2 AND 5. 
Revised: C S UPPLEMENTARY R ESULTS IN S ECTION 5.2 AND 5.

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: D T AYLOR E XPANSION
Revised: D T AYLOR E XPANSION

Original: In this section
Revised: In this section

Original: [Equation]
Revised: [Equation]

Original: we present the Taylor expansion of the soft-max score function:
Revised: we present the Taylor expansion of the soft-max score function:

Original: [Equation]
Revised: [Equation]

Original: E P ROPOSITION
Revised: E P ROPOSITION

Original: The following proposition 1 shows that the detection error P e ( T; 0) (cid:25) c if T is sufﬁciently large.
Revised: The following proposition 1 shows that the detection error P e ( T; 0) (cid:25) c if T is sufﬁciently large.

Original: Thus, increasing the temperature further can only slightly improve the detection performance.
Revised: Thus, increasing the temperature further can only slightly improve the detection performance.

Original: Proposition 1.
Revised: Proposition 1.

Original: There exists a constant c only depending on function U 1 , in-distribution P X
Revised: There exists a constant c only depending on function U 1 , in-distribution P X

Original: and out-of-distribution Q X such that lim T !
Revised: and out-of-distribution Q X such that lim T !

Original: 1 P e ( T; " ) =
Revised: 1 P e ( T; " ) =

Original: c , when " = 

Revised: c , when " =

Original: (i
Revised: (i

Original: [Equation]
Revised: [Equation]

Original: e., no input preprocessing).
Revised: e., no input preprocessing).

Original: Proof.
Revised: Proof.

Original: Since
Revised: Since

Original: [Equation]
Revised: [Equation]

Original: Therefore, for any X , lim
Revised: Therefore, for any X , lim

Original: [Equation]
Revised: [Equation]

Original: This indicates that the random variable
Revised: This indicates that the random variable

Original: [Equation]
Revised: [Equation]

Original: This means that
Revised: This means that

Original: [Equation]
Revised: [Equation]

Original: Therefore
Revised: Therefore

Original: [Equation]
Revised: [Equation]

Original: there exists a constant c depending on U 1 ; P X ; Q X
Revised: there exists a constant c depending on U 1 ; P X ; Q X

Original: [Equation]
Revised: [Equation]

Original: such that
Revised: such that

Original: [Equation]
Revised: [Equation]

Original: F A NALYSIS ON TEMPERATURE
Revised: F A NALYSIS ON TEMPERATURE

Original: For simplicity of the notations, let ∆ i = f ^ y (cid:0) f i and thus ∆ =
Revised: For simplicity of the notations, let ∆ i = f ^ y (cid:0) f i and thus ∆ =

Original: f ∆ i g i ̸
Revised: f ∆ i g i ̸

Original: =^ y .
Revised: =^ y .

Original: Besides, let (cid:22)∆ denote the mean of the set ∆ .
Revised: Besides, let (cid:22)∆ denote the mean of the set ∆ .

Original: Therefore, (cid:22)∆ =
Revised: Therefore, (cid:22)∆ =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y ∆ i =
Revised: =^ y ∆ i =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y (cid:0) f i ]
Revised: [ f ^ y (cid:0) f i ]

Original: =
Revised: =

Original: U 1 :
Revised: U 1 :

Original: Equivalently,
Revised: Equivalently,

Original: U 1 = Mean (∆) :
Revised: U 1 = Mean (∆) :

Original: Next, we will show
Revised: Next, we will show

Original: U 2 =
Revised: U 2 =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [ f ^ y (cid:0) f i ] 2 =
Revised: [ f ^ y (cid:0) f i ] 2 =

Original: Variance 2 ( ∆ ) z }| {
Revised: Variance 2 ( ∆ ) z }| {

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y [∆ i (cid:0) (cid:22) ∆] 2 +
Revised: =^ y [∆ i (cid:0) (cid:22) ∆] 2 +

Original: Mean 2 (∆) z}|{ (cid:22)∆:
Revised: Mean 2 (∆) z}|{ (cid:22)∆:

Original: Since
Revised: Since

Original: U 2 =
Revised: U 2 =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y ∆ 2 i by ∆ i =
Revised: =^ y ∆ 2 i by ∆ i =

Original: f ^ y (cid:0) f
Revised: f ^ y (cid:0) f

Original: i =
Revised: i =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y (∆ i (cid:0) (cid:22)∆ + (cid:22)∆)=
Revised: =^ y (∆ i (cid:0) (cid:22)∆ + (cid:22)∆)=

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y
Revised: =^ y

Original: [(∆ i (cid:0) (cid:22)∆) 2 (cid:0) 2(∆ i (cid:0) (cid:22)∆) (cid:22)∆ + (cid:22)∆ 2 ] =
Revised: [(∆ i (cid:0) (cid:22)∆) 2 (cid:0) 2(∆ i (cid:0) (cid:22)∆) (cid:22)∆ + (cid:22)∆ 2 ] =

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y [∆ i (cid:0) (cid:22)∆]| {z }
Revised: =^ y [∆ i (cid:0) (cid:22)∆]| {z }

Original: Variance 2 (∆) (cid:0) 2 (cid:22)∆
Revised: Variance 2 (∆) (cid:0) 2 (cid:22)∆

Original: N (cid:0)∑ i ̸
Revised: N (cid:0)∑ i ̸

Original: =^ y (∆ i (cid:0)
Revised: =^ y (∆ i (cid:0)

Original: [Equation]
Revised: [Equation]

Original: then
Revised: then

Original: [Equation]
Revised: [Equation]

Original: G A DDITIONAL R ESULTS IN S ECTION 4. 
Revised: G A DDITIONAL R ESULTS IN S ECTION 4.

Original: Apart from the Maximum Mean Discrepancy
Revised: Apart from the Maximum Mean Discrepancy

Original: [Equation]
Revised: [Equation]

Original: we as well use the Energy distance to measure the statistical distance between two datasets.
Revised: we as well use the Energy distance to measure the statistical distance between two datasets.

Original: Let two different distributions P and Q .
Revised: Let two different distributions P and Q .

Original: Then the energy distance between distributions P and Q is deﬁned as
Revised: Then the energy distance between distributions P and Q is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: Therefore, the energy distance between two datasets V = f V 1 ; :::; V m g iid (cid:24) P and W = f W 1 ; :::; W m g iid (cid:24) Q is deﬁned as
Revised: Therefore, the energy distance between two datasets V = f V 1 ; :::; V m g iid (cid:24) P and W = f W 1 ; :::; W m g iid (cid:24) Q is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: In the experiment
Revised: In the experiment

Original: [Equation]
Revised: [Equation]

Original: we use the 2-norm ∥ (cid:1) ∥ 2 .
Revised: we use the 2-norm ∥ (cid:1) ∥ 2 .

Original: [Table]
Revised: [Table]