FROB: F EW - SHOT ROB UST M ODEL FOR C LASSIFICATION WITH O UT - OF -D ISTRIBUTION D ETECTION
Anonymous authors
Paper under double-blind review
A BSTRACT
Nowadays, classiﬁcation and Out-of-Distribution (OoD) detection in the few-shot setting remain challenging aims mainly due to rarity and the limited samples in the few-shot setting, and because of adversarial attacks.
Accomplishing these aims is important for critical systems in safety, security, and defence.
In parallel, OoD detection is challenging since deep neural network classiﬁers set high conﬁdence to OoD samples away from the training data.
To address such limitations, we propose the Few-shot ROBust (FROB) model for classiﬁcation and few-shot OoD detection.
We devise a methodology for improved robustness and reliable conﬁdence prediction for few-shot OoD detection.
We generate the support boundary of the normal class distribution and combine it with few-shot Outlier Exposure (OE).
We propose a self-supervised learning few-shot conﬁdence boundary methodology based on generative and discriminative models, including classiﬁcation.
The main contribution of FROB is the combination of the generated boundary in a selfsupervised learning manner and the imposition of low conﬁdence at this learned boundary.
FROB implicitly generates strong adversarial samples on the boundary and forces samples from OoD, including our boundary, to be less conﬁdent by the classiﬁer.
FROB achieves generalization to unseen anomalies and adversarial attacks, with applicability to unknown, in the wild, test sets that do not correlate to the training datasets.
To improve robustness, FROB redesigns and streamlines OE to work even for zero-shots.
By including our learned boundary, FROB effectively reduces the threshold linked to the model’s few-shot robustness, and maintains the OoD performance approximately constant and independent of the number of fewshot samples.
The few-shot robustness analysis evaluation of FROB on different image sets and on One-Class
Classiﬁcation (OCC) data shows that FROB achieves competitive state-of-the-art performance and outperforms benchmarks in terms of robustness to the outlier OoD few-shot sample population and variability
I NTRODUCTION
In real-world settings, in the wild, it is essential to robustly perform classiﬁcation and OoD detection with high levels of conﬁdence and reliability.
The problem of detecting whether a sample is in-distribution, from the training distribution, or OoD is important for adversarial attacks.
This is critical nowadays in many applications in safety, security, and defence.
However, deep neural networks produce overconﬁdent predictions and do not distinguish in- and out-of-data-distribution.
Adversarial examples, when small modiﬁcations of the input appear, can change the classiﬁer decision.
It is an important property of a classiﬁer to address such limitations with high level of conﬁdence, and provide robustness guarantees for deep neural networks.
In parallel, OoD detection is a challenging aim since classiﬁers set high conﬁdence to OoD samples away from the training data.
The state-of-art models are highly overconﬁdent in their predictions, and they do not distinguish in- and OoD. The setting that our proposed Few-shot ROBust (FROB) model addresses is robust few-shot Out-of-Distribution (OoD) detection and few-shot Outlier Exposure (OE).
To address the rarity problem and the limited samples in the few-shot setting, our main aim is to reduce the number of the few-shots of the OoD negative samples, while maintaining accurate and robust performance.
Diverse data are available today in large quantities.
Deep learning magniﬁes the difﬁculty of distinguishing OoD from in-distribution.
It is possible to use such data to improve OoD detection by training detectors with auxiliary outlier sets (Hendrycks et al., 2019).
OE enables detectors to gen- eralize to detect unseen OoD samples with improved robustness and performance.
Models trained with different outliers can detect unmodelled data and improve OoD detection by learning cues for whether inputs are unmodelled.
By exposing models to different OoD, the complement of the support of the normal class distribution is modelled and the detection of new types of anomalies is enabled.
OE improves the calibration of deep neural network classiﬁers in the setting where a fraction of the data is OoD, addressing the problem of classiﬁers being overconﬁdent when applied to
OoD (Bitterwolf et al., 2020).
Aiming at solving the few-shot robustness problem with classiﬁcation and OoD detection, the contribution of our FROB methodology is the development of an integrated robust framework for self-supervised few-shot negative data augmentation on the distribution conﬁdence boundary, combined with few-shot OE, for improved OoD detection.
The combination of the generated boundary in a self-supervised learning way and the imposition of low conﬁdence at this learned boundary is the main contribution of FROB, which greatly and decisively improves robustness for few-shot OoD detection.
To address the rarity of relevant outliers during training using
OoD samples, we propose to use even few-shots to improve the OoD detection performance.
FROB achieves signiﬁcantly better robustness and resilience to few-shot OoD detection, while maintaining competitive in-distribution accuracy.
FROB achieves generalization to unseen anomalies, with applicability to new, in the wild, test sets that do not correlate to the training sets.
FROB’s evaluation on different sets, CIFAR-10, SVHN, CIFAR-100, and low-frequency noise, using cross-dataset and
One-Class Classiﬁcation (OCC) evaluations, shows that our self-supervised model with few-shot OE on the conﬁdence boundary and few-shot adaptation improves the few-shot OoD detection performance and outperforms benchmarks.
The robustness performance analysis of FROB to the number of few -shots and to outlier variation shows that it is robust to few-shots and outperforms baselines.
O UR P ROPOSED F EW - SHOT ROB USTNESS (FROB) M ETHODOLOGY
We propose FROB for few-shot OoD detection and classiﬁcation using discriminative and generative models.
We devise a methodology for improved robustness and reliable conﬁdence prediction, to force low conﬁdence close and away from the data.
To improve robustness, FROB generates strong adversarial samples on the boundary close to the normal class.
It ﬁnds the boundary of the normal class, and it combines the self-supervised learning few-shot boundary with our robustness loss.
Flowchart of FROB.
Fig.
1 shows the ﬂowchart of FROB which uses a discriminative model for classiﬁcation and OoD detection.
FROB also uses a generator for the OoD samples and the learned boundary.
It generates low-conﬁdence samples and performs active negative training with the generated OoD samples on the boundary.
It performs self-supervised learning negative sampling of conﬁdence boundary samples via the generation of strong and speciﬁcally adversarial OoD. It trains classiﬁers and generators to robustly classify as less conﬁdent samples on and out of the boundary.
Our proposed loss.
We denote the normal class data by x where x i are the labeled data with class labels y i .
Our proposed loss of the discriminative model which is minimized during training is arg min
[Equation]
where f ( . ) is the Convolutional Neural Network (CNN) discriminative model for multi-class classiﬁcation with K classes.
Our loss has 2 terms and a hyper-parameter.
The 2 losses operate on different samples for positive and negative training, respectively.
The ﬁrst loss is the cross-entropy between y i and the predictions, softmax ( f ( x i )) ; the CNN is followed by the normalized exponential to obtain the probability over the classes.
Our robustness loss forces f ( . ) to accurately detect outliers, in addition to classiﬁcation.
It operates on the few-shot OE samples, Z .
It is weighted by the hyper-parameter λ .
k is a class index.
For the in-distribution, N is the batch size and i is the batch data sampling index.
For the OoD, M is the batch size and m is the batch data sampling index.
FROB then trains a generator to generate low-conﬁdence samples on the normal class boundary.
Our algorithm includes these learned low-conﬁdence samples in the training to improve the performance in the few-shot setting.
Instead of using a large OE set, which constitutes an ad hoc choice of outliers to model the complement of the support of the normal class distribution, FROB performs learned negative data augmentation and self-supervised learning, to model the boundary of the support of the normal class distribution.
We train a CNN deep neural network generator and denote it by O ( z ) , where O refers to OoD samples and z are latent space samples from a standard Gaussian distribution.
[Figure]
Our proposed optimization of maximizing dispersion subject to being on the boundary is given by arg min O
[Equation]
where using (2), we penalize the probability that O ( z ) have higher conﬁdence than the normal class.
We hence make O ( z ) have lower probability than x (Jolicoeur-Martineau, 2019; Ren et al., 2021).
FROB includes the learned low-conﬁdence samples in the training by performing (1) with the selfgenerated few-shot boundary, O ( z ) , in addition to Z .
Our self-supervised learning mechanism to calibrate conﬁdence in unforeseen scenarios is (2) followed by (1).
FROB performs boundary data augmentation in a learnable self-supervised learning manner.
It introduces self-generated boundary samples, and sets them as OoD to better perform few-shot OoD detection.
This learned boundary has strong and adversarial anomalies close to the distribution support and near high probability normal class samples.
FROB introduces optimal, relevant, and useful anomalies to more accurately detect few-shots of OoD (Wang et al., 2020a;b).
It detects OoD robustly, by generating strong adversarial
OoD samples and helpful task-speciﬁc anomalies.
A property of our nested optimization, where the inner optimization is O ( z ) in (2) and the outer one is cross-entropy with negative training in (1), is that if an optimum is reached for the inner one, an optimum will also be reached for the outer.
FROB addresses the few-shots problem by performing negative data augmentation in a well-sampled manner on the support boundary of the normal class.
It performs OoD sample description and characterization, not allowing space between the normal class and our self-generated anomalies.
FROB addresses the question of what OoD samples to introduce to our model for negative training, to robustly detect few-shots of data.
FROB introduces self-supervised learning and learned data augmentation using the Deep Tightest-Possible Data Description algorithm of (2) followed by (1), and our self-generated conﬁdence boundary in (2) is robust to mode collapse (Dionelis et al., 2020b;a).
By performing scattering, FROB achieves diversity using the ratio of distances in the latent and data spaces rather than maximum entropy (von K¨ugelgen et al., 2021;
Dieng et al., 2019).
Our framework uses data space point-set distances (Dionelis et al., 2020b;a; Jalal et al., 2017; Jordan et al., 2019).
Inference.
The Anomaly Score (AS) of FROB for any queried test sample, ˜ x , during inference is
[Equation]
where if the AS is smaller than a threshold τ , i.e. AS < τ , ˜ x is OoD. Otherwise, ˜ x is in-distribution.
R ELATED W ORK ON C LASSIFICATION WITH O O D D ETECTION
Outlier Exposure.
The OE method trains detectors with outliers to improve the OoD performance to detect unseen anomalies (Hendrycks et al., 2019).
Using auxiliary sets, disjoint from train and test data, models learn better representations for OoD detection.
Conﬁdence Enhancing Data Augmentation (CEDA), Adversarial Conﬁdence Enhancing Training (ACET), and Guaranteed OoD Detection (GOOD) tackle the problem of classiﬁers being overconﬁdent at OoD samples (Bitterwolf et al., 2020;
Hein et al., 2019).
Their aim is to force low conﬁdence in a l ∞ -norm ball around each
OoD sample where the prediction conﬁdence is max k =1 , 2 ,...,K p k ( x ) for the output K -class softmax (Sensoy et al., 2018; Hariharan & Girshick, 2017; Jeong & Kim, 2020).
CEDA employs point-wise robustness (Bastani et al., 2016; Rosenfeld et al., 2020).
GOOD ﬁnds worst-case OoD detection guarantees.
The models are trained on OE sets, using the 80 Million Tiny Images reduced by the normal class.
Disjoint distributions are used for positive and negative training, but the OoD samples for OE are chosen in an ad hoc way.
In contrast, FROB performs learned negative data augmentation on the boundary of the normal class to streamline and redesign few-shot OE (and zero-shot OE).
Human prior.
GOOD deﬁnes the normal class, then ﬁlters it out from the 80 Million Tiny Images.
This ﬁltering-out process of normality from the OE set is human-dependent.
This modiﬁed dataset is set as anomalies.
Next, GOOD learns the normal class and sets low conﬁdence to these OoD. This process is data-dependent, not automatic, and feature-dependent (Dionelis et al., 2021; Sohn et al., 2021).
In contrast, FROB eliminates the need for feature extraction and human intervention which is the aim of Deep Learning, as these do not scale.
This ﬁltering-out process is not practical and cannot be used in real-world scenarios as anomalies are not conﬁned in ﬁnite closed sets (Sensoy et al., 2020).
FROB avoids feature-, application-, and dataset-dependent processes.
Our self-supervised boundary data augmentation obviates memorization, scalability, and data diversity problems arising from memory replay and prioritized experience replay (Zaheer et al., 2020; Pourreza et al., 2021).
Learned OoD samples.
The Conﬁdence-Calibrated Classiﬁer (CCC) uses a GAN to create samples out of, but close to the normal class (Lee et al., 2018a).
FROB substantially differs from CCC, as
CCC ﬁnds a threshold and not the boundary.
CCC uses the OE set, U ( y ) , where the labels follow a
Uniform distribution, to compute this threshold.
This is limiting as the threshold depends on U ( y ) , which is an ad hoc choice of outliers.
In contrast, FROB ﬁnds the conﬁdence boundary and does not use U ( y ) to ﬁnd this boundary.
FROB streamlines OE and few-shot outliers.
Our boundary is not a function of U ( y ) , as U ( y ) is not necessary (Sohn et al., 2021).
For negative training, CCC deﬁnes a closeness metric (KL divergence), and then penalizes this metric (Zaheer et al., 2020; Asokan &
Seelamantula, 2020; Dionelis et al., 2021).
CCC suffers from mode collapse as it does not perform scattering for diversity.
The models in Lee et al.
(2018a);
Vernekar et al.
(2019a;b) and Wang et al.
(2018) perform conﬁdence-aware classiﬁcation.
Self-Supervised outlier Detection (SSD) creates
OoD samples in the Mahalanobis metric (Sehwag et al., 2021).
It is not a classiﬁer, as it performs
OoD detection with OE.
FROB achieves fast inference with (3), in contrast to Tack et al.
(2020) which is slow during inference (Goldberger et al., 2005).
Tack et al.
(2020) does not address issues arising from detecting with nearest neighbors while using a different composite loss for training.
E VALUATION AND R ESULTS
We evaluate FROB trained on different sets, CIFAR-10, SVHN, CIFAR-100, 80 Million Tiny Images, Uniform noise, and low-frequency noise, and we report the Area Under the Receiver Operating
Characteristic Curve (AUROC), the Adversarial AUROC (AAUROC), and the Guaranteed AUROC (GAUROC) which uses l ∞ -norm perturbations for the OoD (Bitterwolf et al., 2020; Croce & Hein, 2020).
For the evaluation of FROB, we test different combinations of normal class sets, OE datasets, few-shot outliers (FS-OE), the generated boundary (FS- O ( z ) ), and test sets, in an alternating manner.
We examine the generalization performance of FROB to few-shots of unseen new OoD samples at the dataset level, Out-of-Dataset anomalies.
To examine the robustness to the number of few-shot samples, we decrease the number of few-shots by dividing them by two.
We perform uniform sampling for choosing the few-shots, and we examine the variation of the dependent variable, AUROC, to changes of the independent variable, the provided number of few-shots of OoD (FS-OE).
In this way, we evaluate the robustness of FROB to the number of few-shots.
We also examine the Failure
Point of our proposed FROB algorithm and of benchmarks; we deﬁne this Break Point as the number of few-shots from which the performance in AUROC decreases and then eventually falls to 0 .
Datasets.
For training, we use the normal class sets CIFAR-10 and SVHN.
For OE, we use the datasets 80 Million Tiny Images, SVHN, and CIFAR-100.
In addition, for few-shot outliers, we use samples from CIFAR-10, CIFAR-100, SVHN, and low-frequency noise.
We evaluate our FROB algorithm on CIFAR-100, SVHN, CIFAR-10, low-frequency noise, and Uniform noise.
Benchmarks.
We compare FROB to benchmarks.
Having access to large OE sets is not representative of the few-shot OoD detection setting.
We compare FROB to GOOD, CEDA, ACET, and
OE (Bitterwolf et al., 2020; Hein et al., 2019; Hendrycks et al., 2019).
We also compare FROB to
GEOM, GOAD, DROCC, Hierarchical Transformation-Discriminating Generator (HTD), Support
Vector Data Description (SVDD), and Patch SVDD (PaSVDD) in the few-shot setting using OneClass Classiﬁcation (OCC) (Sheynin et al., 2021).
GOOD and Hendrycks et al.
(2019) use the
Million Tiny Images for OE.
FROB outperforms baselines in the few-shot OoD detection setting.
Ablation Study.
We examine the OoD detection performance of FROB, in AUROC, by introducing few-shot samples for: (i) with OE, and without (w/o) FS-OE and FS- O ( z ) , (ii) with (w/) FS-OE and without FS- O ( z ) , (iii) with FS-OE and FS- O ( z ) , and (iv) with FS-OE, FS- O ( z ) , and OE.
4. FROB P ERFORMANCE A NALYSIS C OMPARED TO B ENCHMARKS
Overview.
We evaluate the benchmarks using OE and compare them to FROB and its OoD performance.
We analyse the performance of baselines, CEDA, OE model, ACET, and GOOD, using
Million Tiny Images for OE, as well as the performance of CCC using OE SVHN or CIFAR-10.
We compare them to FROB, using the 80 Million Tiny Images for OE.
FROB without using our self-supervised generated distribution boundary shows similar behavior to the benchmarks, and outperforms them in all the examined AUC-type metrics in Table 1.
Table 1 shows the results of FROB without few-shot boundary samples, when the normal class is SVHN and CIFAR-10, using the OE set 80 Million Tiny Images, evaluated on different test sets in AUROC.
FROB without O ( z ) outperforms benchmarks.
Taking into account this FROB model behavior, we examine the performance of
FROB without the boundary O ( z ) to a variable number of few-shot outliers in Figs.
1 and 2.
Without the generated O ( z ) , the AUROC performance decreases as the number of few-shots decreases, and is not robust and suitable for few-shot OoD detection, for few-shots less than approximately 800 .
Then, we examine the performance of FROB with the self-learned O ( z ) , in Figs.
4 and 5.
Sec. 4.
shows that O ( z ) is effective and that FROB is robust, even to a very small number of few-shots.
4.1. FROB P ERFORMANCE A NALYSIS U SING OE
First, we examine the performance of benchmarks, CEDA, OE, ACET, and GOOD, when setting (a) SVHN and (b) CIFAR-10 as the normal class, with OE 80 Million Tiny Images, tested on different sets, CIFAR-100, CIFAR-10, SVHN, and Uniform noise, in AUROC, AAUROC, and GAUROC.
We examine the performance of CCC using CIFAR-10 for OE, tested on Uniform noise.
We compare the performance of benchmarks to that of FROB without O ( z ) .
Our algorithm, when setting SVHN as the normal class, on average outperforms the baselines CCC, CEDA, OE, and ACET, in AAUROC and GAUROC, and yields competitive results in AUROC.
FROB shows comparable performance to GOOD in Table 1.
This is also shown in Table 3, in the Appendix.
When setting CIFAR-10 as the normal class, FROB on average outperforms the benchmarks CEDA, OE, ACET, and GOOD in
AUC-type metrics, according to Table 1 and also to Table 4 in the Appendix. Table 1, as well as
Tables 3 and 4 in the Appendix, present the performance of FROB without using our self-generated boundary samples, O ( z ) .
They, together with Table 6, show that FROB outperforms benchmarks.
4.1. C OMPARISON OF FROB WITH B ENCHMARKS
Analysis of FROB without O ( z ) by reducing the few-shot outliers.
Fig.
2 shows the performance of FROB for normal class CIFAR-10 without O ( z ) , using variable number of OE SVHN few-shots, tested on different sets.
The FROB performance decreases with reducing number of SVHN fewshots.
A small AUROC of 0 .
5 is reached for approximately 800 few-shots for CIFAR-100, as shown in Table 5 in the Appendix.
Fig.
2 shows that the benchmarks in Table 1, as well as in Tables 3 and 4 in the Appendix, do not achieve a robust performance for decreasing few-shots, their performance is reduced with decreasing number of few-shots, yield a steep decline for few-shots less thansamples, and have a Failure Break Point at approximately 800 few-shots for the test set CIFAR-
(AUROC 0 . 51 ).
The performance of FROB, without O ( z ) , decreases fast and relatively sharp below 1830 samples, when testing on low-frequency noise in Fig.
2, where for few-shots less than 1800 , the modeling error of OE covering the full complement of the support of the normal class is high.
Fig.
3 and Table 5 show the performance of FROB in GAUROC for normal CIFAR-10 without O ( z ) , with variable number of few-shot OE SVHN.
The GAUROC performance of FROB shows that when the few-shots originate from the test set, SVHN, a less steep decrease is observed compared to when the few-shots and the test samples are from different sets, low-frequency noise.
The rate of decrease of GAUROC below 1800 samples is small when the OE and the test samples are from the same
[Table]
[Figure] [Figure]
set.
The GAUROC performance of FROB without O ( z ) , for the test set CIFAR-100, is low.
FROB achieves better performance than the benchmarks in the few-shot OoD detection setting (Table 1)
[Figure]
FROB using only few-shot OE, the OoD performance rapidly decreases for FS-OE of 1800 samples, and it tends to a Break Point of approximately 800 few-shots for normal class CIFAR-10.
It shows a more robust behavior at reducing the number of FS-OE when the OE and test sets are the same.
Using reduced number of 80 Million set samples.
Table 6 in the Appendix shows the performance of FROB using the 80 Million Tiny Images for OE with all available data and for reduced number of samples, few-shots of it (FS-OE).
We evaluate FROB without the boundary, FS- O ( z ) , on different test sets, CIFAR-10, CIFAR-100, SVHN, low-frequency noise, uniform noise, and 80 Million Tiny
Images.
We set SVHN and CIFAR-10 as the normal classes.
The performance of FROB slightly decreases, in AUC-type metrics, when 73257 samples from the 80 Million Tiny Images are used as the chosen OE Calibration set, instead of the 50 million total training samples, during training.
Using variable OE sets.
Table 7, in the Appendix, shows the performance of FROB trained on the normal CIFAR-10 using the OE sets -all data- of SVHN, CIFAR-100, and 80 Million Tiny Images 73257 samples, without our conﬁdence boundary, FS- O ( z ) , tested on different sets in AUC-type metrics.
FROB, using SVHN for OE, achieves higher AUROC compared to using the OE sets
Million Tiny Images and CIFAR-100.
FROB achieves higher GAUROC with the OE set SVHN, i.e. average 0 . 69 , and 80 Million Tiny Images, average 0 . 66 , compared to when using CIFAR-100.
[Figure]
[Figure]
[Table]
S HEYNIN ET AL .,
[Table]
4. E FFECTIVENESS OF OUR P ROPOSED C ONFIDENCE B OUNDARY
Efﬁcacy and effectiveness of learned boundary.
We evaluate FROB with the generated boundary,
O ( z ) , and few-shot outliers.
Fig. 4, and Table 8 in the Appendix, show the performance of FROB trained on normal class CIFAR-10 with O ( z ) and few-shots from SVHN in decreasing number.
We evaluate the performance of FROB on the test sets CIFAR-100, SVHN, and low-frequency noise.
Compared to Fig. 2, when we use O ( z ) , the performance increases, showing robustness even for a very small number of few-shots, even for zero-shots.
We have experimentally demonstrated the effectiveness of O ( z ) , in Fig.
We have demonstrated the improvement in AUROC, when O ( z ) is used, compared to when it is not used.
FROB using few-shot OE outperforms benchmarks and improves robustness to the number of few-shots, pushing down the phase transition point (Fig. 4).
FROB robustness to number of few-shots.
With decreasing few-shots, the performance of FROB in AUROC is robust and approximately independent of the FS-OE number of samples, till approximately zero-shots.
FROB achieves robustness using the boundary FS- O ( z ) as the performance is approximately independent of the FS-OE samples for the test sets, CIFAR-100, SVHN, and lowfrequency noise.
The component of FROB with the highest beneﬁt is O ( z ) .
FROB achieves robustness to the number of few-shot samples, and this is the main contribution of this paper.
As the number of few-shots decreases, the performance of FROB does not decrease.
When the few-shots are from the test set, Fig. 4 (and Table 8 in Appendix) shows that using the learned boundary, O ( z ) , is effective and robust in the few-shot OoD detection setting.
FROB with the self-generated boundary,
O ( z ) , achieves better performance than the benchmarks, in the few-shot OoD detection setting.
Existing methodologies sensitive to number of few-shots.
Current methodologies are not robust to a small number of few-shots as they perform negative training by including OoD samples randomly somewhere in the data space, allowing a lot of unﬁlled space between the OoD and the normal class (Bitterwolf et al., 2020; Hendrycks et al., 2019).
They need 50 million outliers, to model the complement of the support of the normal class distribution.
They use irrelevant conservative OoD samples and do not model the support boundary of the normal class distribution.
Instead, FROB learns OoD samples generated on the boundary, not requiring 50 million outliers.
FROB redesigns and streamlines OE, to work even for zero-shots.
Our negative data augmentation creates the tightest possible OoD samples that are as close as possible to the support of the normal class distribution.
4.2. O O D D ETECTION P ERFORMANCE OF FROB WHEN FS-OE ARE FROM T EST S ET
FROB improves the AUROC and the GAUROC, when the OE few-shots and the OoD test samples originate from the same set.
In addition to improving both the AUROC and the GAUROC when the few-shot outliers originate from the test set, as shown in Figs. 4 and 2, our proposed FROB model also improves the AUROC performance, when the OE few-shots and the OoD test samples originate from different sets.
These results for FROB are also presented in Tables 8 and 5 in the Appendix.
Tables 10 and 11 in the Appendix show that FROB (i) improves both the AUROC and the GAUROC when the OE few-shots and the OoD test samples originate from the same set, and (ii) enhances the
AUROC when the OE few-shots and the OoD test samples originate from different sets, i.e. CIFAR100 and low frequency noise.
When using the learned boundary FS- O ( z ) and FS-OE, as well as the 80 Million Tiny Images, the performance of FROB in GAUROC improves, according to Tables 7in the Appendix for FS- O ( z ) of 1830 , 915 , 100 , and 80 samples, respectively.
When using the same
OE and test set, SVHN, without the 80 Million Tiny Images set, FROB achieves a comparable high value in GAUROC, 0 . 98 in Fig.
4, compared to when using the 80 Million Tiny Images set, 0 . 97 .
FROB outperforming baselines.
FROB with O ( z ) achieves an AUROC of 0 .
92 for normal CIFAR10, OE SVHN 1830 samples, and test set Uniform noise in Table 8 in the Appendix.
It is effective and outperforms benchmarks.
FROB outperforms Lee et al.
(2018a): for normal CIFAR-10, when the OE set is SVHN, CCC yields an AUROC of 0 .
14 for Uniform noise.
CCC does not have few-shot capability, FS-OE functionality.
It does not test on CIFAR-100 (small domain gap to CIFAR-10).
Fig.
4 shows the performance of FROB in GAUROC for normal CIFAR-10 with O ( z ) , using a variable number of FS-OE SVHN, tested on SVHN.
We evaluate FROB with FS- O ( z ) , by reducing the number of few-shot outliers.
The GAUROC performance shows that when the few-shots originate from the test set, SVHN, a less steep decrease is achieved compared to when the few-shots and the test samples are from different sets, i.e. SVHN and low-frequency noise.
The rate of decrease of the
GAUROC of FROB below 1830 samples is smaller when the few-shots are from the test dataset.
Figure 5, together with Table 14 and Figure 7 in the Appendix, show the performance of FROB using
O ( z ) , the normal class SVHN, and variable number of FS-OE CIFAR-10 samples.
In Figures 5 and 7, compared to Figure 4, we show that FROB achieves better performance for normal class SVHN, compared to for normal CIFAR-10 in all AUC-type metrics on the unseen test dataset CIFAR-100.
4. P ERFORMANCE OF FROB ON U SEEN , IN THE W ILD , D ATASETS
We evaluate FROB using OoD test samples from unseen, in the wild, sets.
Importantly, we evaluate
FROB on test samples that are neither from the normal class nor from the few-shot OE data (or from OE).
In Figs.
2 and 4, we show the performance of FROB in the few-shot setting, for the normal CIFAR-10 with few-shot outliers from SVHN, tested on the unknown sets of CIFAR-10 and low-frequency noise.
Fig.
4 shows that the OoD detection performance of FROB in the few-shot setting is robust, tested on the new sets of CIFAR-100 and low frequency noise.
FROB has a robust performance in AUROC with reduced number of SVHN few-shots, till approximately zero-shots.
According to Table 8 in the Appendix, the GAUROC performance of FROB depends on the unknown test set and obtains low values for SVHN 80 few-shots, approximately 0 .
07 on CIFAR-100, 0 .
25 on low frequency noise, and 0 .
02 on Uniform noise.
We use an effective OE set, 80 Million
Tiny Images, to improve the GAUROC of FROB in the few-shot setting to obtain Table 9: for SVHN 80 few-shots, 0 .
43 on CIFAR-100, 0 .
95 on low frequency noise, and 0 .
79 on Uniform noise.
Effect of domain, normal class.
The performance of FROB with the boundary in AUROC depends on the normal class.
In Table 14 and Fig.
5, the performance of FROB with O ( z ) is higher for normal
SVHN than for CIFAR-10, as presented in Fig.
4 and Table 8.
For zero-shots, using the CIFARtest set, the AUROC is 0 .
87 when the normal class is CIFAR-10 compared to 0 .
95 when the normal class is SVHN.
Figs.
5 and 7 show that FROB is robust and effective for normal SVHN, for OE
CIFAR-10, on seen and unseen sets.
FROB with O ( z ) is not sensitive to the number of few-shots in
Figs.
4-7 in the few-shot OoD detection setting when we have OoD sample complexity constraints.
[Figure] [Figure]
4.3. FROB P ERFORMANCE WITH O ( Z ) IN GAUROC U SING 80 M ILLION T INY I MAGES
To improve the performance of FROB with the learned boundary in GAUROC
[Figure]
we use the 80 Million
Tiny Images for OE.
Fig.
6 and Table 9 both show that the performance of FROB, in GAUROC, improves for normal CIFAR-10 with O ( z ) and variable number of OE SVHN, tested on the unseen sets CIFAR-100 and low frequency noise.
In the few-shot OoD detection setting, for decreasing few-shots till approximately 80 , FROB achieves a mean value of approximately 0 . 88 in GAUROC, tested on low frequency noise.
FROB with the OE 80 Million Tiny Images set and the learned O ( z ) reduces the threshold linked to the model’s few-shot robustness.
Tables 10-13 in the Appendix show the performance of FROB with O ( z ) , in GAUROC (and AUROC), when the OE 80 Million Tiny
Images in reduced number ( 73257 ) is used and few-shots from 1830 to 80 are used.
The performance of FROB in GAUROC increases with OE 80 Million Tiny Images, compared to without this set.
4. E VALUATION OF FROB U SING OCC C OMPARED TO B ENCHMARKS
We evaluate FROB using OCC for each CIFAR-10 class.
We report the mean performance of FROB and compare FROB to benchmarks, HTD, GEOM, GOAD, DROCC, SVDD, and PaSVDD, in the few-shot OE setting of 80 samples (Sheynin et al., 2021).
FROB outperforms benchmarks in Table 2, and in Table 15 in the Appendix.
Tables 2 and 15 show the performance of FROB in the OCC setting, when normality is a CIFAR-10 class.
FROB using the self-learned boundary outperforms baselines in the few-shot OoD detection task, when we have budget constraints and OoD sampling complexity limitations.
The improvement of our proposed FROB model, using OE SVHN, in mean AUROC is 2 .
3% , when compared to without using OE SVHN, in Table 2, and in Table 15 in the Appendix.
C ONCLUSION
We have proposed FROB which uses the generated support boundary of the normal data distribution for few-shot OoD detection.
FROB tackles the few-shot problem using classiﬁcation with OoD detection.
The contribution of FROB is the combination of the generated boundary in a self-supervised learning manner and the imposition of low conﬁdence at this learned boundary.
To improve robustness, FROB generates strong adversarial samples on the boundary, and forces samples from OoD and on the boundary to be less conﬁdent.
By including the self-produced boundary, FROB reduces the threshold linked to the model’s few-shot robustness.
FROB redesigns, restructures, and streamlines OE to work even for zero-shots.
It robustly performs classiﬁcation and few-shot OoD detection with a high level of reliability in real-world applications, in the wild.
FROB maintains the OoD performance approximately constant, independent of the few-shot number.
The performance of FROB with the self-supervised learning boundary is robust and effective, as the performance is approximately stable as the few-shot outliers decrease in number, while the performance of FROB without O ( z ) decreases as the few-shots decrease.
The evaluation of FROB, on many sets, shows that it is effective, achieves competitive state-of-the-art performance, and outperforms benchmarks in the few-shot OoD detection setting in AUC-type metrics.
In the future, in addition to conﬁdence and the class, FROB will also output important regions and bounding boxes around abnormal objects.
A PPENDIX E VALUATION T ABLES
The main Tables used for the evaluation of our proposed FROB model are:
[Table]
[Table] [Table] W / O
SVHN: SVHN 0. C FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:73257 LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
C 0.
C
FROB
W / O
SVHN:
SVHN 0.
C
FROB
W / O
SVHN:
LFN 0.
C
FROB
W / O
SVHN:
UN 0.
[Table]
W / O
[Table]
W
[Table]
O
[Table]
UN
[Table]
FROB
W
[Table] [Table]
FROB
W
[Table]
SVHN
[Table]
FROB
W / O
SVHN SVHN
[Table]
FROB
W / O
SVHN
LFN
[Table]
FROB
W /
[Table]
SVHN
[Table]
FROB
[Table] [Table]
C
FROB
W /
SVHN:
LFN 0.
C
FROB
W /
SVHN:
UN 0.
C
FROB
W /
SVHN:
C 0.
C
FROB
W /
SVHN:
SVHN 0.
C
FROB
W /
SVHN:
LFN 0.
C
FROB
W /
SVHN:
UN 0.
C
FROB
W /
SVHN:
C 0.
C
FROB
W /
SVHN:
SVHN 0.
C
FROB
W /
SVHN:
LFN 0.
C
FROB
W /
SVHN:
UN 0.
C
FROB
W /
SVHN:
C 0.
C
FROB
W /
SVHN:
SVHN 0.
C
FROB
W /
SVHN:
LFN 0.
C
FROB
W /
SVHN:
UN 0.
C
FROB
W /
SVHN:
C 0.
C
FROB
W /
SVHN:
SVHN 0.
C
FROB
W /
SVHN:
LFN 0.
C
FROB
W /
SVHN:
UN 0.
[Table]
C
FROB
W / 80M: 73257, SVHN:
SVHN 0.
C
FROB
W / 80M: 73257, SVHN:
LFN 0.
C
FROB
W / 80M: 73257, SVHN:
UN 0.
C
FROB
W / 80M: 73257, SVHN:
C 0.
C
FROB
W / 80M: 73257, SVHN:
SVHN 0.
C
FROB
W / 80M: 73257, SVHN:
LFN 0.
C
FROB
W / 80M: 73257, SVHN:
UN 0.
C
FROB
W / 80M: 73257, SVHN:
C 0.
C
FROB
W / 80M: 73257, SVHN:
SVHN 0.
C
FROB
W / 80M: 73257, SVHN:
LFN 0. C FROB
W / 80M: 73257, SVHN:
UN 0.
C
FROB
W / 80M: 73257, SVHN:
C 0.
C
FROB
W / 80M: 73257, SVHN:
SVHN 0.
C
FROB
W / 80M: 73257, SVHN:
LFN 0.
C
FROB
W / 80M: 73257, SVHN:
UN 0.
C
FROB
W / 80M: 73257, SVHN:
C 0.
C
FROB
W / 80M: 73257, SVHN:
SVHN 0.
C
FROB
W / 80M: 73257, SVHN:
LFN 0.
C
FROB
W / 80M: 73257, SVHN:
UN 0.
[Table] [Table]
80M
SVHN:
SVHN 0.
C
W / 80M
SVHN:
LFN 0.
C
W / 80M
SVHN:
UN 0.
C
W / O 80M
SVHN:
C 0.
C
W / O 80M
SVHN:
SVHN 0.
C
W / O 80M
SVHN:
LFN 0.
C
W / O 80M
SVHN:
UN 0.
[Table]
FROB
[Table] [Table]
W /
[Table]
FROB
W /
[Table]
FROB
W /
[Table] [Table]
FROB
W / 80M:
[Table] [Table]
[Table]
FROB
W /
[Table] [Table]
[Table]
FROB
W / 80M
[Table] [Table]
UN
[Table]
FROB
W / 80M:
[Table]
FROB
W / 80M:
[Table]
FROB
W / 80M
[Table]
FROB
W / 80M:
UN
[Table] [Table]
FROB
W /
C100 & SVHN:
C 0.
C
FROB
W /
C100 & SVHN:
SVHN 0.
C
FROB
W /
C100 & SVHN:
LFN 0.
C
FROB
W /
C100 & SVHN:
UN 0.
[Table]
C
FROB
W /
SVHN:
C 0.
C
FROB
W /
SVHN:
SVHN 0.
C
FROB
W /
SVHN:
LFN 0.
C
FROB
W /
SVHN:
UN 0.
C
FROB
W / 80M:73257,
SVHN:
C 0.
C
FROB
W / 80M:73257,
SVHN:
SVHN 0.
C
FROB
W / 80M:73257,
SVHN:
LFN 0.
C
FROB
W / 80M:73257,
SVHN:
UN 0.
C
FROB
W / 80M:
C 0.
C
FROB
W / 80M:
SVHN 0.
C
FROB
W / 80M:
LFN 0.
C
FROB
W / 80M:
UN 0.
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table]
[Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table]
[Table]
[Table] [Table]