D EEP A NOMALY D ETECTION WITH O UTLIER E XPOSURE
Anonymous authors
Paper under double-blind review
A BSTRACT
It is important to detect and handle anomalous inputs when deploying machine learning systems.
The use of larger and more complex inputs in deep learning magniﬁes the difﬁculty of distinguishing between anomalous and in-distribution examples.
At the same time, diverse image and text data commonly used by deep learning systems are available in enormous quantities.
We propose leveraging these data to improve deep anomaly detection by training anomaly detectors against an auxiliary dataset of outliers, an approach we call Outlier Exposure (OE).
This approach enables anomaly detectors to generalize and detect unseen anomalies.
In extensive experiments in vision and natural language processing settings, we ﬁnd that Outlier Exposure signiﬁcantly improves the performance of existing anomaly detectors, including detectors based on density estimation, and that OE improves classiﬁer calibration in the presence of anomalous inputs.
We also analyze the ﬂexibility and robustness of Outlier Exposure, and identify characteristics of the auxiliary dataset that improve performance.
I NTRODUCTION
Machine Learning systems in deployment often encounter data that is unlike the model’s training data.
This can occur in discovering novel astronomical phenomena, ﬁnding unknown diseases, or detecting sensor failure.
In these situations, models that can detect anomalies (Gal & Ghahramani, 2016; Liu et al., 2018; Emmott et al., 2013) are capable of correctly ﬂagging unusual examples for human intervention, or carefully proceeding with a more conservative fallback policy.
Behind many machine learning systems are deep learning models (Krizhevsky et al., 2012) which can provide high performance in a variety of applications, so long as the data seen at test time is similar to the training data.
However, when there is a distribution mismatch, deep neural network classiﬁers tend to give high conﬁdence predictions on anomalous test examples (Nguyen et al., 2015).
This can invalidate the use of prediction probabilities as calibrated conﬁdence estimates (Guo et al., 2017), and makes detecting anomalous examples doubly important.
Several previous works seek to address these problems by giving deep neural network classiﬁers a means of assigning anomaly scores to inputs.
These scores can then be used for detecting out-ofdistribution (OOD) examples (Hendrycks & Gimpel, 2017; DeVries & Taylor, 2018;
Liu et al., 2018).
These approaches have been demonstrated to work surprisingly well for complex input spaces, such as images, text, and speech.
Moreover, they do not require modeling the full data distribution, but instead can use heuristics for detecting OOD, unmodeled phenomena.
Several of these methods detect unmodeled phenomena by using representations from only in-distribution data.
In this paper, we investigate a complementary method where we train models to detect unmodeled data by learning cues for whether an input is unmodeled.
While it is difﬁcult to model the full data distribution, we can learn effective heuristics for detecting out-of-distribution inputs by exposing the model to OOD examples, thus learning a more conservative concept of the inliers and enabling the detection of novel forms of anomalies.
We propose leveraging diverse, realistic datasets for this purpose, with a method we call Outlier Exposure (OE).
OE provides a simple and effective way to consistently improve existing methods for OOD detection.
Through numerous experiments, we extensively evaluate the broad applicability of Outlier Exposure.
For multiclass neural networks, we provide thorough results on Computer Vision and Natural
Language Processing tasks which show that Outlier Exposure can help anomaly detectors generalize to and perform well on unseen distributions of outliers.
We also demonstrate that Outlier Exposure provides gains over several existing approaches to out-of-distribution detection.
Our results also show the ﬂexibility of Outlier Exposure, as we can train various models with different sources of outlier distributions.
Additionally, we establish that Outlier Exposure can make density estimates of OOD samples signiﬁcantly more useful for OOD detection.
Finally, we demonstrate that Outlier Exposure improves the calibration of neural network classiﬁers in the realistic setting where a fraction of the data is OOD.
Our code is made publicly available at [anonymized] .
R ELATED W ORK
Out-of-Distribution Detection with Deep Networks.
Hendrycks & Gimpel (2017) demonstrate that a deep, pre-trained classiﬁer has a lower maximum softmax probability on anomalous examples than in-distribution examples, so a classiﬁer can conveniently double as a consistently useful outof-distribution detector.
Building on this work, DeVries & Taylor (2018) attach an auxiliary branch onto a pre-trained classiﬁer and derive a new OOD score from this branch.
Liang et al.
(2018) present a method which can improve performance of OOD detectors that use a softmax distribution.
In particular, they make the maximum softmax probability more discriminative between anomalies and in-distribution examples by pre-processing input data with adversarial perturbations (Goodfellow et al., 2015).
Unlike in our work, their hyperparameters are tailored to each source of anomalies.
Lee et al.
(2018) train a classiﬁer concurrently with a GAN (Radford et al., 2016; Goodfellow et al., 2014), and the classiﬁer is trained to have lower conﬁdence on GAN samples.
For each testing distribution of anomalies, they tune the classiﬁer and GAN using samples from that out-distribution, as discussed in Appendix B of their work.
Unlike Liang et al.
; Lee et al.
(2018), in this work we train our method without tuning parameters to ﬁt speciﬁc types of anomaly test distributions, so our results are not directly comparable with their results.
Many other works (de Vries et al., 2016;
Bendale & Boult, 2016; Subramanya et al., 2017) also encourage the model to have lower conﬁdence on anomalous examples.
Recently, Liu et al.
(2018) provide theoretical guarantees for detecting outof-distribution examples under the assumption that a suitably powerful anomaly detector is available.
Utilizing Auxiliary Datasets.
Outlier Exposure uses an auxiliary dataset to give the network better representations in order to detect anomalies.
Goodfellow et al.
(2015) train on adversarial examples to increased robustness.
Torralba et al.
(2011) pre-train unsupervised deep models on a database of web images for stronger features.
Radford et al.
(2017) train an unsupervised network on a corpus of Amazon reviews for a month in order to obtain quality sentiment representations.
Zeiler &
Fergus (2014) ﬁnd that pre-training a network on the large ImageNet database (Russakovsky et al., 2015) endows the network with general representations that are useful in many ﬁne-tuning applications.
Chen & Gupta (2015); Mahajan et al.
(2018) show that representations learned from images scraped from the nigh unlimited source of search engines and photo-sharing websites improve object detection performance.
O UTLIER E XPOSURE
We consider the task of deciding whether or not a sample is from a learned distribution called D in .
Samples from D in are called “in-distribution,” and otherwise are said to be “out-of-distribution” (OOD) or samples from D out .
In real applications, it may be difﬁcult to know the distribution of outliers one will encounter in advance.
Thus, we consider the realistic setting where D out is unknown.
Given a parametrized OOD detector and an Outlier Exposure (OE) dataset D OEout , we train the model to discover signals and learn heuristics to detect whether a query is sampled from D in or
D OEout .
We ﬁnd that these heuristics generalize to unseen distributions D out .
Deep parametrized anomaly detectors typically leverage learned representations from an auxiliary task, such as classiﬁcation or density estimation.
Given a representation learner f , we can thus formalize Outlier Exposure as minimizing the objective
[Equation]
over the parameters of f .
In cases where labeled data is not required or available, then y can be ignored.
The primary loss function L is the original representation learning objective, and L OE is a loss incorporating OE.
Outlier Exposure can be applied with many types of data and original tasks.
Hence, the speciﬁc formulation of L OE is a design choice, and depends on the task at hand and the OOD detector used.
For example, when using the maximum softmax probability baseline detector (Hendrycks &
Gimpel, 2017), we set L OE to the cross-entropy between f ( x (cid:48) ) and the uniform distribution.
When the original objective L is density estimation and labels are not available, we set L OE to a margin ranking loss on the log probabilities f ( x (cid:48) ) and f ( x ) .
When performing Outlier Exposure, we ﬁnetune a pre-trained f by sampling equally many examples from D in and D OEout per batch.
The entire
Outlier Exposure process usually requires only a few minutes, even for large datasets.
E XPERIMENTS
We evaluate OOD detectors with and without OE on a wide range of datasets.
Each evaluation consists of an in-distribution dataset D in used to train an initial model, a dataset of anomalous examples
D OEout , and a baseline detector to which we apply OE.
We describe the datasets in Section 4.2.
In these experiments, we ensure that D in , D OEout , and D testout are mutually disjoint.
The OOD detectors and
L OE losses are detailed on a case-by-case basis.
[Figure]
[Figure]
curve with Tiny ImageNet ( D in ) and Textures ( D testout ).
We evaluate out-of-distribution detection methods on their ability to detect OOD points.
For this purpose, we treat the
OOD examples as the positive class, and we evaluate three metrics: area under the receiver operating characteristic curve ( AUROC ), area under the precision-recall curve ( AUPR ), and the false positive rate at N % true positive rate ( FPR N ).
The
AUROC and AUPR are holistic metrics that summarize the performance of a detection method across multiple thresholds.
The AUROC can be thought of as the probability that an anomalous example is given a higher OOD score than a in-distribution example (Davis & Goadrich, 2006).
Thus, a higher AUROC is better, and an uninformative detector has an
AUROC of 50%.
The AUPR is useful when anomalous examples are infrequent (Manning & Sch ¨ utze, 1999), as it takes the base rate of anomalies into account.
During evaluation with these metrics, the base rate of D testout to D testin test examples in all our experiments is 1 : 5 .
Whereas the previous two metrics represent the detection performance across various thresholds, the FPR N metric represents performance at one strict threshold.
By observing performance at a strict threshold, we can make clear comparisons among strong detectors.
The FPR N metric
(Liu et al., 2018; Kumar et al., 2016; Balntas et al., 2016) is the probability that an in-distribution example (negative) raises a false alarm when N % of anomalous examples (positive) are detected, so a lower FPR N is better.
When anomalies require human intervention, capturing nearly all anomalies with few false alarms is of high practical value.
4. D ATASETS 4.2. I N -D ISTRIBUTION D ATASETS
SVHN.
The SVHN dataset (Netzer et al., 2011) contains 32 × 32 color images of house numbers.
There are ten classes comprised of the digits 0 - 9 .
The training set has 604 , 388 images, and the test set has 26 , 032 images.
For preprocessing, we rescale the pixels to be in the interval [0 , 1] .
CIFAR.
The two CIFAR (Krizhevsky & Hinton, 2009) datasets contain 32 × 32 natural color images.
CIFAR-10 has ten classes while CIFAR-100 has 100 .
CIFAR-10 and CIFAR-100 classes are disjoint but have similiarities.
For example, CIFAR-10 has “automobiles” and “trucks” but not
CIFAR-100’s “pickup truck” class.
Both have 50 , 000 training images and 10 , 000 test images.
Pixels are standardized by the average training image’s channel means and standard deviations.
Tiny ImageNet.
The Tiny ImageNet dataset (Johnson et al.) is a 200 -class subset of the ImageNet (Russakovsky et al., 2015) dataset where images are resized and cropped to 64 × 64 resolution.
The dataset’s images were cropped using bounding box information so that cropped images contain the target, unlike Downsampled ImageNet (Chrabaszcz et al., 2017).
The training set has 100 ,images and the test set has 10 , 000 images.
Pixels are standardized by the average training image’s channel means and standard deviations.
20 Newsgroups.
20 Newsgroups is a text classiﬁcation dataset of newsgroup documents withclasses and approximately 20 , 000 examples split evenly among the classes.
We use the standard 60 / 40 train/test split.
TREC.
TREC is a question classiﬁcation dataset with 50 ﬁne-grained classes and 5 , 952 individual questions.
We reserve 500 examples for the test set, and use the rest for training.
SST.
The Stanford Sentiment Treebank dataset (Socher et al., 2013) consists of movie reviews categorized by their positive or negative sentiment.
The dataset has 8 , 544 reviews for training and 2 , 210 for testing.
4.2. O UTLIER E XPOSURE D ATASETS
80 Million Tiny Images.
80 Million Tiny Images (Torralba et al., 2008) is a large-scale, diverse dataset of 32 × 32 natural images scrapped from the web.
We use this dataset as D OEout for experiments with SVHN, CIFAR-10, and CIFAR-100 as D in .
We remove all examples of 80 Million Tiny
Images which appear in the CIFAR datasets.
In the Discussion we note that only a small fraction of this dataset is necessary for successful OE.
ImageNet-22K.
We use the ImageNet dataset with images from approximately 22 thousand classes as D OE for experiments with Tiny ImageNet as D in ; images in ImageNet-1K are removed.
WikiText-2.
WikiText-2 is a corpus of Wikipedia articles typically used for language modeling.
We use WikiText-2 as D OEout for language modeling experiments with Penn Treebank as D in .
For classiﬁcation tasks on 20 Newsgroups, TREC, and SST, we treat each sentence of WikiText-2 as an individual example, and use simple ﬁlters to remove low-quality sentences.
Code for reproducing this dataset from the raw WikiText-2 corpus is provided with the main experiment code.
4. M ULTICLASS C LASSIFICATION
In what follows, we use Outlier Exposure to enhance the performance of existing OOD detection techniques with multiclass classiﬁcation as the original task.
Throughout the following experiments, we let x ∈ X be a classiﬁer’s input and y ∈ Y = { 1 , 2 , . . .
, k } be a class.
We also represent the classiﬁer with the function p :
X → R k , such that for any x , 1 T p ( x ) = 1 and p ( x ) (cid:23)
so that p lies on a probability simplex.
Maximum Softmax Probability.
Consider the maximum softmax probability baseline (Hendrycks & Gimpel, 2017) which gives an input x the OOD score − max c p c ( x ) .
Out-ofdistribution samples are drawn from various unseen distributions (Appendix A).
For each task, we test with approximately twice the number of D testout distributions compared to most other papers, and we also test on NLP tasks.
The quality of the OOD example scores are judged with the metrics described in Section 4.1.
For this multiclass setting, we perform Outlier Exposure by ﬁne-tuning a pre-trained classiﬁer p so that its posterior is more uniform on D OEout samples.
Speciﬁcally, the ﬁnetuning objective is E ( x,y )
∼D in [ − log p y ( x )]
+ λ E x
∼D
OEout [ H ( U ; p ( x ))] , where H is the cross entropy and U is the uniform distribution over k classes.
When there is class imbalance, we could encourage p ( x ) to match ( P ( y = 1) , . .
, P ( y = k )) ; yet for the datasets we consider, matching U works well enough.
Also, note that training from scratch with OE can result in even better performance than ﬁne-tuning (Appendix E).
This approach works on different architectures as well (see Appendix F).
Unlike Liang et al.
; Lee et al.
(2018) and like Hendrycks & Gimpel (2017);
DeVries &
Taylor (2018), we do not tune our hyperparameters for each D testout distribution, so that D testout is kept unknown like with real-world anomalies.
Instead, the λ coefﬁcients were determined early in experimentation with validation D valout distributions described in Appendix A. For vision experiments we use λ = 0 .
5 , and for NLP λ = 1 . 0 .
Like previous OOD detection methods involving network ﬁne-tuning, we chose λ
so that impact on classiﬁcation accuracy is negligible.
[Table] [Table]
For vision experiments
[Table]
we train Wide Residual Networks (Zagoruyko & Komodakis, 2016) and then ﬁne-tune network copies with OE for 10 epochs.
For NLP experiments, we train 2-layer GRUs (Cho et al., 2014) for 5 epochs, then ﬁne-tune network copies with OE for 2 epochs.
During each epoch of OE, we use the full training set, and equally many outliers sampled from D OEout .
This way
OE requires only a few minutes on a single GPU.
Networks trained on CIFAR-10 or CIFARare exposed to outliers from 80 Million Tiny Images, and the Tiny ImageNet classiﬁer is exposed to ImageNet-22K. NLP classiﬁers are exposed to outliers from WikiText-2.
Further architectural and training details are in Appendix B. For all tasks, OE improves average performance by a large margin.
Averaged results are shown in Tables 1 and 2.
Sample ROC curves are shown in Figuresand 4.
Detailed results on individual D testout datasets are in Table 7 and Table 8 in Appendix A. Notice that the SVHN classiﬁer with OE can be used to detect new anomalies such as emojis and street view alphabet letters, even though D testOE is a dataset of natural images.
Thus, Outlier Exposure helps models to generalize to unseen D testout distributions far better than the baseline.
Conﬁdence Branch.
A recently proposed OOD detection technique (DeVries & Taylor, 2018) involves appending an OOD scoring branch b : X → [0 , 1] onto a deep network.
Trained with samples from only D in , this branch estimates the network’s conﬁdence on any input.
The creators of this technique made their code publicly available, so we use their code to train new 40-4 Wide
Residual Network classiﬁers.
We ﬁne-tune the conﬁdence branch with Outlier Exposure by adding 0 .
5 E x ∼D OEout [log b ( x )] to the network’s original optimization objective.
In Table 3, the baseline values are derived from the maximum softmax probabilities produced by the classiﬁer trained with DeVries & Taylor (2018)’s publicly available training code.
The conﬁdence branch improves over this MSP detector, and after OE, the conﬁdence branch detects anomalies more effectively.
FPR95 ↓
AUROC ↑
AUPR ↑
D in
MSP
Branch +OE
MSP
Branch +OE
MSP
Branch +OE
CIFAR49.
CIFAR55.
[Table]
Synthetic Outliers.
Outlier Exposure leverages the simplicity of downloading real datasets [Table] but it is possible to generate synthetic outliers.
Note that we made an attempt to distort images with noise and use these as outliers for OE, but the classiﬁer quickly memorized this statistical pattern and did not detect new OOD examples any better than before (Hafner et al., 2018).
A method with better success is from Lee et al.
They carefully train a GAN to generate synthetic examples near the classiﬁer’s decision boundary.
The classiﬁer is encouraged to have a low maximum softmax probability on these synthetic examples.
For CIFAR classiﬁers, they mention that a GAN can be a better source of anomalies than datasets such as SVHN.
In contrast, we ﬁnd that the simpler approach of drawing anomalies from a diverse dataset is sufﬁcient for marked improvements in
OOD detection.
We train a 40-4 Wide Residual Network using Lee et al.
(2018)’s publicly available code, and use the network’s maximum softmax probabilities as our baseline.
Another classiﬁer trains concurrently with a GAN so that the classiﬁer assigns GAN-generated examples a high OOD score.
We want each
D testout to be novel.
Consequently we use their code’s default hyperparameters, and exactly one model encounters all tested D testout distributions.
This is unlike their work since, for each D testout distribution, they train and tune a new network.
We do not evaluate on Tiny ImageNet, since DCGANs cannot stably generate images of that scale and diversity.
Lastly, we take the network trained in tandem with a GAN and ﬁne-tune it with OE.
Table 4 shows the large gains from using OE with a real and diverse dataset over using synthetic samples from a GAN.
[Table]
All results are percentages and averaged across all D testout datasets.
4. D ENSITY E STIMATION
Density estimators learn a probability density function over the data distribution D in .
Anomalous examples should have low probability density, as they are scarce in D in by deﬁnition.
Consequently, density estimates are another means by which to score anomalies (Zong et al., 2018).
We show the ability of OE to improve density estimates on low-probability, outlying data.
In-Distribution +OE 3.
A n o m a l y S c
o r e ( B PP ) 3.06 3.
Out-of-Distribution +OE 3.
A n o m a l y S c
o r e ( B PP ) 2.
PixelCNN++.
Autoregressive neural density estimators provide a way to parametrize the probability density of image data.
Although sampling from these architectures is slow, they allow for evaluating the probability density with a single forward pass through a CNN, making them promising candidates for OOD detection.
We use PixelCNN++ (Salimans et al., 2017) as a baseline OOD detector, and we train it on CIFAR-10.
The OOD score of example x is the bits per pixel (BPP), deﬁned as nll ( x ) / num_pixels , where nll is the negative log-likelihood.
With this loss we ﬁne-tune for 1 epoch using OE, which we ﬁnd is sufﬁcient for the training loss to converge.
Here OE is implemented with a margin loss over the log-likelihood difference between in-distribution and anomalous examples, so that the loss for a sample x in from D in and point x out from D OEout is [Equation] out ) } .
Results are shown in Table 5.
Notice that PixelCNN++ without OE unexpectedly assigns lower BPP from SVHN images than CIFAR10 images.
For all D testout datasets, OE signiﬁcantly improves results.
Language Modeling.
We next explore using OE on language models.
We use QRNN (Merity et al., 2018a;b) language models as baseline OOD detectors.
For the OOD score, we use bits per character (BPC) or bits per word (BPW), deﬁned as nll ( x ) / sequence_length , where nll ( x ) is the negative log-likelihood of the sequence x .
Outlier Exposure is implemented by adding the cross entropy to the uniform distribution on tokens from sequences in D OEout as an additional loss term.
For D in , we convert the language-modeling version of Penn Treebank, split into sequences of length 70 for backpropagation for word-level models, and 150 for character-level models.
We do not train or evaluate with preserved hidden states as in BPTT.
This is because retaining hidden states would
[Table]
greatly simplify the task of OOD detection.
Accordingly, the OOD detection task is to provide a score for 70- or 150-token sequences in the unseen D test out datasets.
We train word-level models for 300 epochs, and character-level models for 50 epochs.
We then ﬁne-tune using OE on WikiText-2 for 5 epochs.
For the character-level language model, we create a character-level version of WikiText-2 by converting words to lowercase and leaving out characters which do not appear in PTB.
OOD detection results for the word-level and character-level language models are shown in Table 6; expanded results and D testout descriptions are in Appendix H.
In all cases,
OE improves over the baseline, and the improvement is especially large for the word-level model.
[Table]
D ISCUSSION
Extensions to Multilabel Classiﬁers and the Reject Option.
Outlier Exposure can work in more classiﬁcation regimes than just those considered above.
For example, a multi label classiﬁer trained on CIFAR-10 obtains an 88.8% mean AUROC when using the maximum prediction probability as the OOD score.
By training with OE to decrease the classiﬁer’s output probabilities on OOD samples, the mean AUROC increases to 97.1%.
This is slightly less than the AUROC for a multiclass model tuned with OE.
An alternative OOD detection formulation is to give classiﬁers a “reject class” (Bartlett & Wegkamp, 2008).
Outlier Exposure is also ﬂexible enough to improve performance in this setting, but we ﬁnd that even with OE, classiﬁers with the reject option or multilabel outputs are not as competitive as OOD detectors with multiclass outputs.
Flexibility in Choosing D OEout .
Early in experimentation, we found that the choice of D OEout is important for generalization to unseen D testout distributions.
For example, adding Gaussian noise to samples from D in to create D OEout does not teach the network to generalize to unseen anomaly distributions for complex D in .
Similarly, we found in Section 4.3 that synthetic anomalies do not work as well as real data for D OEout .
In contrast, our experiments demonstrate that the large datasets of realistic anomalies described in Section 4.2.2 do generalize to unseen D testout distributions.
In addition to size and realism, we found diversity of D OEout to be an important factor.
Concretely, a
CIFAR-100 classiﬁer with CIFAR-10 as D OEout hardly improves over the baseline.
A CIFAR-10 classiﬁer exposed to ten CIFAR-100 outlier classes corresponds to an average AUPR of 78.5%.
Exposed to 30 such classes, the classiﬁer’s average AUPR becomes 85.1%.
Next, 50 classes corresponds to 85.3%, and from thereon additional CIFAR-100 classes barely improve performance.
This suggests that dataset diversity is important, not just size.
In fact, experiments in this paper often used around
1% of the images in the 80 Million Tiny Images dataset since we only brieﬂy ﬁne-tuned the models.
We also found that using only 50,000 examples from this dataset led to a negligible degradation in detection performance.
Additionally, D OEout datasets with signiﬁcantly different statistics can perform similarly.
For instance, using the Project Gutenberg dataset in lieu of WikiText-2 for D OEout in the
SST experiments gives an average AUROC of 90.1% instead of 89.3%.
Closeness of D testout , D OEout , and D testin .
Our experiments show several interesting effects of the closeness of the datasets involved.
Firstly, we ﬁnd that D testout and D OEout need not be close for training with
OE to improve performance on D testout .
In Appendix A, we observe that an OOD detector for SVHN has its performance improve with Outlier Exposure even though (
) D
OEout samples are images of natural scenes rather than digits, and (2) D testout includes unnatural examples such as emojis.
We observed the same in our preliminary experiments with MNIST; using 80 Million Tiny Images as D OEout , OE increased the AUPR from 94.2% to 97.0%.
Secondly, we ﬁnd that the closeness of D OEout to D testin can be an important factor in the success of
OE.
In the NLP experiments, preprocessing D OEout to be closer to D in improves OOD detection performance signiﬁcantly.
Without preprocessing, the network may discover easy-to-learn cues which reveal whether the input is in- or out-of-distribution, so the OE training objective can be optimized in unintended ways.
That results in weaker detectors.
In a separate experiment, we use Online Hard
Example Mining so that difﬁcult outliers have more weight in Outlier Exposure.
Although this improves performance on the hardest anomalies, anomalies without plausible local statistics like noise are detected slightly less effectively than before.
Thus hard or close-to-distribution examples do not necessarily teach the detector all valuable heuristics for detecting various forms of anomalies.
Real-world applications of OE could use the method of Sun et al.
(2018) to reﬁne a scraped D OEout auxiliary dataset to be appropriately close to D testin .
[Figure]
OE
Improves
Calibration.
When using classiﬁers for prediction, it is important that conﬁdence estimates given for the predictions do not misrepresent empirical performance.
A calibrated classiﬁer gives conﬁdence probabilities that match the empirical frequency of correctness.
That is, if a calibrated model predicts an event with 30% probability, then 30% of the time the event transpires.
Existing conﬁdence calibration approaches consider the standard setting where data at test-time is always drawn from D in .
We extend this setting to include examples from D testout at test-time since systems should provide calibrated probabilities on both in- and out-of-distribution samples.
The classiﬁer should have low-conﬁdence predictions on these OOD examples, since they do not have a class.
Building on the temperature tuning method of Guo et al.
(2017), we demonstrate that
OE can improve calibration performance in this realistic setting.
Summary results are shown in
Figure 3.
Detailed results and a description of the metrics are in Appendix C
C ONCLUSION
In this paper, we proposed Outlier Exposure, a simple technique that enhances many current OOD detectors across various settings.
It uses out-of-distribution samples to teach a network heuristics to detect new, unmodeled, out-of-distribution examples.
We showed that this method is broadly applicable in vision and natural language settings and can improve model calibration and various anomaly detection techniques such as conﬁdence branches, density estimation, and more.
Moreover, the high performance of OE on standard datasets suggests the need to move to more challenging datasets in future works.
Finally, Outlier Exposure is computationally efﬁcient, and can be applied with low overhead to existing systems.
In summary, Outlier Exposure is an effective and complementary approach for enhancing out-of-distribution detection systems.
A E XPANDED M ULTICLASS R ESULTS
Expanded mutliclass out-of-distribution detection results are in Table 7 and Table 8.
These strong results suggest that future work should focus on new and harder datasets
[Table]
Anomalous Data.
For each in-distribution dataset D in , we comprehensively evaluate OOD detectors on artiﬁcial and real anomalous distributions D testout following Hendrycks & Gimpel (2017).
For each learned distribution D in , the number of test distributions that we compare against is approximately double that of most previous works.
Gaussian anomalies have each dimension i.i.d.
sampled from an isotropic Gaussian distribution.
Rademacher anomalies are images where each dimension is − 1 or 1 with equal probability, so each dimension is sampled from a symmetric Rademacher distribution.
Bernoulli images have each pixel sampled from a Bernoulli distribution if the input range is [0 , 1] .
Blobs data consist in algorithmi-
[Table]
cally generated amorphous shapes with deﬁnite edges.
Icons-50 is a dataset of icons and emojis (Hendrycks & Dietterich, 2018); icons from the “Number” class are removed.
Textures is a dataset of describable textural images (Cimpoi et al., 2014).
Places365 consists in images for scene recognition rather than object recognition (Zhou et al., 2017).
LSUN is another scene understanding dataset with fewer classes than Places365 (Yu et al., 2015).
ImageNet anomalous examples are taken from the 800 ImageNet-1K classes disjoint from Tiny ImageNet’s 200 classes, and when possible each image is cropped with bounding box information as in Tiny ImageNet.
With CIFAR-10 as D in , we use also CIFAR-100 as D testout and vice versa; recall that the CIFAR-10 and CIFAR-100 classes do not overlap.
Chars74K is a dataset of photographed characters in various styles; letters such as “O” and “l” were removed since they can look like numbers.
SNLI is a dataset of predicates and hypotheses for natural language inference.
We use the hypotheses for D OEout .
IMDB is a sentiment classiﬁcation dataset of movie reviews, with similar statistics to those of SST.
Multi30K is a dataset of English-German image descriptions, of which we use the
English descriptions.
WMT16 is the English portion of the test set from WMT16.
Yelp is a dataset of restaurant reviews.
English Web Treebank (EWT) consists of ﬁve individual datasets: Answers ( (E) (N
Reviews (
Weblog ( examples the domain.
Validation Data.
For each experiment, we create a set of validation distributions D valout .
The ﬁrst anomalies are uniform noise anomalies where each pixel is sampled from U [0 , 1] or U [ − 1 , 1] depending on the input space of the task.
The remaining D valout validation sources are generated by corrupting in-distribution data, so that the data becomes out-of-distribution.
One such source of anomalies is created by taking the pixelwise arithmetic mean of a random pair of in-distribution images.
Other anomalies are created by taking the geometric mean of a random pair of in-distribution images.
Jigsaw anomalies are created by taking an in-distribution example, partitioning the image into 16 equally sized patches, and permuting those patches.
Speckle Noised anomalies are created by applying speckle noise to in-distribution images.
RGB Ghosted anomalies involves shifting and reordering the color channels of in-distribution images.
Inverted images are anomalies which have some or all of their color channels inverted.
B A RCHITECTURES AND T RAINING D ETAILS
For CIFAR-10, CIFAR-100, and Tiny ImageNet classiﬁcation experiments, we use a 40-2 Wide
Residual Network (Zagoruyko & Komodakis, 2016).
The network trains for 100 epochs with a dropout rate of 0.3.
The initial learning rate of 0.1 decays following a cosine learning rate schedule (Loshchilov & Hutter, 2017).
During ﬁne-tuning of the entire network, we again use a cosine learning rate schedule but with an initial learning rate of 0.001.
We use standard ﬂipping and data cropping augmentation, Nesterov momentum, and (cid:96) 2 weight decay with a coefﬁcient of 5 × 10 − 4 .
SVHN architectures are 16-4 Wide ResNets trained for 20 epochs with an initial learning rate of 0.
and no data augmentation.
Outlier Exposure ﬁne-tuning occurs for 10 epochs with each epoch being the length of in-distribution epoch, so that Outlier Exposure completes quickly and does involve reading the entire D OEout dataset.
C C ONFIDENCE C ALIBRATION
Models integrated into a decision making process should indicate when they are trustworthy, and such models should not have inordinate conﬁdence in their predictions.
In an effort to combat a false sense of certainty from overconﬁdent models, we aim to calibrate model conﬁdence.
A model is calibrated if its predicted probabilities match empirical frequencies.
Thus if a calibrated model predicts an event with 30% probability, then 30% of the time the event transpires.
Prior research (Guo et al., 2017; Nguyen & O’Connor, 2015; Kuleshov & Liang, 2015) considers calibrating systems where test-time queries are samples from D in , but systems also encounter samples from
D testout and should also ascribe low conﬁdence to these samples.
Hence, we use OE to control the conﬁdence on these samples.
C. M ETRICS
In order to evaluate a multiclass classiﬁer’s calibration, we present three metrics.
First we establish context.
For input example X ∈ X , let Y ∈ Y
= { 1 , 2 , . .
, k } be the ground truth class.
Let (cid:98) Y be the model’s class prediction, and let C be the corresponding model conﬁdence or prediction probability.
Denote the set of prediction-label pairs made by the model with
S = { ( (cid:98) y 1 , c 1 ) , ( (cid:98) y 2 , c 2 ) , . . .
, ( (cid:98) y n , c n ) } .
RMS and MAD Calibration Error.
The Root Mean Square Calibration Error measures the square root of the expected squared difference between conﬁdence and accuracy at a conﬁdence level.
It has the formula (cid:113) E C
[( P ( Y = (cid:98) Y | C = c ) − c ) 2 ] .
A similar formulation which less severely penalizes large conﬁdence-accuracy deviations is the Mean Absolute Value Calibration error, written
E C [ | P ( Y = (cid:98) Y | C = c ) − c | ] .
The MAD Calibration Error is a lower bound of the RMS Calibration
Error.
To empirically estimate these miscalibration measures, we partition the n samples of S into b bins { B 1 , B 2 , . . .
, B b } with approximately 100 samples in each bin.
Unlike Guo et al.
(2017), bins are not equally spaced since the distribution of conﬁdence values is not uniform but dynamic.
Concretely, the RMS Calibration Error is estimated with the numerically stable formula
[Equation]
Along similar lines, the MAD Calibration Error—which is an improper scoring rule due to its use of absolute differences rather than squared differences—is estimated with
[Equation]
Soft F1 Score.
If a classiﬁer makes only a few mistakes, then most examples should have high conﬁdence.
But if the classiﬁer gives all predictions high conﬁdence, including its mistakes, then the previous metrics will indicate that the model is calibrated on the vast majority of instances, despite having systematic miscalibration.
The Soft F1 score (Pastor-Pellicer et al., 2013; Hendrycks &
Gimpel, 2017) is suited for measuring the calibration of a system where there is an acute imbalance between mistaken and correct decisions.
Since we treat mistakes a positive examples, we can write the model’s conﬁdence that the examples are anomalous with c a = (1 − c 1 , 1 − c 2 , . .
, 1 − c n ) .
To indicate that an example is positive (mistaken), we use the vector m ∈ { 0 , 1 } n such that
m i =( y
i (cid:54) = (cid:98) y i ) for 1 ≤ i ≤ n .
Then the Soft F1 score is c T a m 1 T ( c a + m ) / 2 . RMS Calib. [Table] ↓
[Table] D in Temperature + [Table]
CIFAR
[Table]
C. S ETUP AND R ESULTS
There are many ways to estimate a classiﬁer’s conﬁdence.
One way is to bind a logistic regression branch onto the network, so that conﬁdence values are in [0 , 1] .
Other conﬁdence estimates use the model’s logits l ∈ R k , such as the estimate σ (max i l i ) ∈
[0 , 1] , where σ is the logistic sigmoid.
Another common conﬁdence estimate is max i (cid:2) exp ( l i ) / (cid:80) kj =1 exp ( l j ) (cid:3) .
A modiﬁcation of this estimate is our baseline.
Softmax Temperature Tuning.
Guo et al.
(2017) show that good calibration can be obtained by including a tuned temperature parameter into the softmax: (cid:98) p ( y
= i | x ) = exp( l i /T ) /
(cid:80) kj =1 exp( l j /T ) .
We tune T to maximize log likelihood on a validation set after the network has been trained on the training set.
Results.
In this calibration experiment, the baseline is conﬁdence estimation with softmax temperature tuning.
Therefore, we train SVHN, CIFAR-10, CIFAR-100, and Tiny ImageNet classiﬁers with 5000 , 5000 , 5000 , and 10000 training examples held out, respectively.
A copy of this classiﬁer is ﬁne-tuned with Outlier Exposure.
Then we determine the optimal temperatures of the original and OE-ﬁne-tuned classiﬁers on the held-out examples.
To measure calibration, we take equally many examples from a given in-distribution dataset D testin and OOD dataset D testout .
Out-of-distribution points are understood to be incorrectly classiﬁed since their label is not in the model’s output space, so calibrated models should assign these out-of-distribution points low conﬁdence.
Results are in Table 9.
Outlier Exposure noticeably improves model calibration.
C. P OSTERIOR R ESCALING
While temperature tuning improves calibration, the conﬁdence estimate (cid:98) p ( y = i | x ) cannot be less than 1 /k , k
the number of classes.
For an out-of-distribution example like Gaussian Noise, a good model should have no conﬁdence in its prediction over k classes.
One possibility is to add a reject option, or a ( k +1) st class, which we cover in Section 5.
A simpler option we found is to perform an afﬁne transformation of (cid:98) p ( y = i | x ) ∈
[1 /k, 1] with the formula ( (cid:98) p ( y = i | x ) − 1 /k ) /
(1 − 1 /k ) ∈
This simple transformation makes it possible for a network to express no conﬁdence on an out-of-distribution input and improves calibration performance.
As Table 10 shows, this simple 0posterior rescaling technique consistently improves calibration, and the model ﬁne-tuned with OE using temperature tuning and posterior rescaling achieved large calibration improvements.
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] , the same baseline after adding Posterior Rescaling, and temperature tuning + Posterior Rescaling + OE
[Figure]
D A DDITIONAL ROC AND PR C URVES
[Figure]
In Figure
[Figure]
we show additional PR and ROC Curves using the Tiny ImageNet dataset and various anomalous distributions
[Figure]
E T RAINING FROM S CRATCH WITH O UTLIER E XPOSURE U SUALLY I MPROVES D ETECTION P ERFORMANCE
Elsewhere we show results for pre-trained networks that are ﬁne-tuned with OE.
However, a network trained from scratch which simultaneously trains with OE tends to give superior results.
For example, a CIFAR-10 Wide ResNet trained normally obtains a classiﬁcation error rate of 5.16% and an FPR95 of 34.94%.
Fine-tuned, this network has an error rate of 5.27% and an FPR95 of 9.50%.
Yet if we instead train the network from scratch and expose it to outliers as it trains, then the error rate is 4.26% and the FPR95 is 6.15%.
This architecture corresponds to a 9.50% RMS calibration error with OE ﬁne-tuning, but by training with OE from scratch the RMS calibration error is 6.15%.
Compared to ﬁne-tuning, training a network in tandem with OE tends to produce a network with a better error rate, calibration, and OOD detection performance.
The reason why we use OE for ﬁne-tuning is because training from scratch requires more time and sometimes more GPU memory than ﬁne-tuning.
F OE W ORKS ON O THER V ISION A RCHITECTURES
Outlier Exposure also improves vision OOD detection performance for more than just Wide
ResNets.
Table 11 shows that Outlier Exposure also improves vision OOD detection performance for “All Convolutional Networks.”
[Table]
G O UTLIER E XPOSURE WITH H ( U ; p ) S CORES D OES B ETTER T HAN WITH MSP S CORES
While − max c p c ( x ) tends to be a discriminative OOD score for example x , models with OE can do better by using − H ( U ; p ( x )) instead.
This alternative accounts for classes with small probability mass rather than just the class with most mass.
Additionally, the model with OE is trained to give anomalous examples a uniform posterior not just a lower MSP.
This simple change roundly aids performance as shown in Table 12.
This general performance improvement is most pronounced on datasets with many classes.
For instance, when D testout =
Tiny ImageNet and D testout =
Gaussian, swapping the MSP score with the H ( U ; p ( x )) score increases the AUROC 76.5% to 97.1%.
[Table]
For example, CIFAR-10 results are averaged over “Gaussian,” “Rademacher,” . . .
, or “CIFAR-100” measurements
H E XPANDED L ANGUAGE M ODELING R ESULTS
Detailed OOD detection results with language modeling datasets are shown in Table 13.
The D testout datasets come from the English Web Treebank (Bies et al., 2012), which contains text from ﬁve different domains: Yahoo!
Answers, emails, newsgroups, product reviews, and weblogs.
Other
NLP D testout datasets we consider do not satisfy the language modeling
FPR90 ↓
AUROC ↑
AUPR ↑
D in
D testout
BPC +OE BPC +OE BPC +OE PTB Char
Answers 96.
Email 99. Newsgroup 99. Reviews 99. Weblog 100.
Mean 99.
PTB Word
Answers 41.
Email 64.
Newsgroup 54.
Reviews 30.
Weblog 50.
Mean 48.
I U SING O UTLIER E XPOSURE WITH ODIN
The out-of-distribution detection approach of
Liang et al.
(2018) can also perform better with Outlier Exposure.
As in the original paper, we tune the temperature value over { 1 , 10 , 100 , 1000 } and the adversarial perturbation size over {
[Table]
As shown in Table
[Table]
ODIN outperforms the baseline, and ODIN applied to a model tuned with OE performs even better
[Table]