T RAINING C ONFIDENT N EURAL C LASSIFIERS FOR D ETECTING O UT - OF -D ISTRIBUTION
Anonymous authors
Paper under double-blind review
A BSTRACT
The problem of detecting whether a test sample is from in-distribution (i.e., training distribution by a classiﬁer) or out-of-distribution sufﬁciently different from it arises in many real-world machine learning applications.
However, the state-of-art deep neural networks are known to be highly overconﬁdent in their predictions, i.e., do not distinguish in- and out-of-distributions.
Recently, to handle this issue, several threshold-based detectors have been proposed given pre-trained neural classiﬁers.
However, the performance of prior works highly depends on how to train the classiﬁers since they only focus on improving inference procedures.
In this paper, we develop a novel training method for classiﬁers so that such inference algorithms can work better.
In particular, we suggest two additional terms added to the original loss (e.g., cross entropy).
The ﬁrst one forces samples from out-of-distribution less conﬁdent by the classiﬁer and the second one is for (implicitly) generating most effective training samples for the ﬁrst one.
In essence, our method jointly trains both classiﬁcation and generative neural networks for out-of-distribution.
We demonstrate its effectiveness using deep convolutional neural networks on various popular image datasets.
I NTRODUCTION
Deep neural networks (DNNs) have demonstrated state-of-the-art performance on many classiﬁcation tasks, e.g., speech recognition (Hannun et al., 2014), image classiﬁcation (Girshick, 2015), video prediction (Villegas et al., 2017) and medical diagnosis (Caruana et al., 2015).
Even though
DNNs achieve high accuracy, it has been addressed (Lakshminarayanan et al., 2017; Guo et al., 2017) that they are typically overconﬁdent in their predictions.
For example, DNNs trained to classify MNIST images often produce high conﬁdent probability 91% even for random noise (see the work of (Hendrycks & Gimpel, 2016)).
Since evaluating the quality of their predictive uncertainty is hard, deploying them in real-world systems raises serious concerns in AI Safety (Amodei et al., 2016), e.g., one can easily break a secure authentication system that can be unlocked by detecting the gaze and iris of eyes using DNNs (Shrivastava et al., 2017).
The overconﬁdence issue of DNNs is highly related to the problem of detecting out-of-distribution: detect whether a test sample is from in-distribution (i.e., training distribution by a classiﬁer) or outof-distribution sufﬁciently different from it.
Formally, it can be formulated as a binary classiﬁcation problem.
Let an input x ∈ X and a label y ∈ Y = { 1 , . .
, K } be random variables that follow a joint data distribution P in ( x , y )
=
P in ( y | x ) P in ( x ) .
We assume that a classiﬁer P θ ( y | x ) is trained on a dataset drawn from P in ( x , y ) , where θ denotes the model parameter.
We let P out ( x ) denote an out-of-distribution which is ‘far away’ from in-distribution P in ( x ) .
Our problem of interest is determining if input x is from P in or P out , possibly utilizing a well calibrated classiﬁer P θ ( y | x ) .
In other words, we aim to build a detector, g ( x ) :
X → { 0 , 1 } , which assigns label 1 if data is from in-distribution, and label 0 otherwise.
There have been recent efforts toward developing efﬁcient detection methods where they mostly have studied simple threshold-based detectors utilizing a pre-trained classiﬁer (Hendrycks & Gimpel, 2016; Liang et al., 2017).
For each input x , it measures some conﬁdence score q ( x ) based on a pre-trained classiﬁer, and compares the score to some threshold δ > 0 .
Then, the detector assigns label 1 if the conﬁdence score q ( x ) is above δ , and label 0, otherwise.
Speciﬁcally, (Hendrycks & Gimpel, 2016) deﬁned the conﬁdence score as a maximum value of the predictive distribution, and (Liang et al., 2017) further improved the performance by using temperature scaling (Guo et al., 2017) and adding small controlled perturbations to the input data.
Although such inference methods are computationally simple, their performances highly depend on the pre-trained classiﬁer.
Namely, they fail to work if the classiﬁer does not separate the maximum value of predictive distribution well enough with respect to P in and P out .
Ideally, a classiﬁer should be trained to separate all class-dependent in-distributions as well as out-of-distribution in the output space.
As another line of research, Bayesian probabilistic models (Li & Gal, 2017; Louizos & Welling, 2017) and ensembles of classiﬁers (Lakshminarayanan et al., 2017) were also investigated.
However, training or inferring those models are computationally more expensive.
This motivates our approach of developing a new training method for the more plausible simple classiﬁers.
Our direction is orthogonal to the
Bayesian and ensemble approaches, where one can also combine them for even better performance.
Contribution.
In this paper, we develop such a training method for detecting out-of-distribution
P out better without losing its original classiﬁcation accuracy.
First, we consider a new loss function, called conﬁdence loss .
Our key idea on the proposed loss is to additionally minimize the KullbackLeibler (KL) divergence from the predictive distribution on out-of-distribution samples to the uniform one in order to give less conﬁdent predictions on them.
Then, in- and out-of-distributions are expected to be more separable.
However, optimizing the conﬁdence loss requires training samples from out-of-distribution, which are often hard to sample: a priori knowledge on out-of-distribution is not available or its underlying space is too huge to cover.
To handle the issue, we consider a new generative adversarial network (GAN) (Goodfellow et al., 2014) for generating most effective samples from P out .
Unlike the original GAN, the proposed GAN generates ‘boundary’ samples in the low-density area of P in .
Finally, we design a joint training scheme minimizing the classiﬁer’s loss and new GAN loss alternatively, i.e., the conﬁdent classiﬁer improves the GAN, and vice versa, as training proceeds.
Here, we emphasize that the proposed GAN does not need to generate explicit samples under our scheme, and instead it implicitly encourages training a more conﬁdent classiﬁer.
We demonstrate the effectiveness of the proposed method using deep convolutional neural networks such as AlexNet (Krizhevsky, 2014) and VGGNet (Szegedy et al., 2015) for image classiﬁcation tasks on CIFAR (Krizhevsky & Hinton, 2009), SVHN (Netzer et al., 2011), ImageNet (Deng et al., 2009), and LSUN (Yu et al., 2015) datasets.
The classiﬁer trained by our proposed method drastically improves the detection performance of all threshold-based detectors (Hendrycks & Gimpel, 2016; Liang et al., 2017) in all experiments.
In particular, VGGNet with 13 layers trained by our method improves the true negative rate (TNR), i.e., the fraction of detected (LSUN) out-ofdistribution samples, compared to the baseline: 14 . 0% → 37 . 8% and 46 .
3% → 99 . 9% on CIFAR10 and SVHN, respectively, when 95% of in-distribution samples are correctly detected.
We also provide visual understandings on the proposed method using the image datasets.
We believe that our method can be a strong guideline when other researchers will pursue these tasks in the future.
T RAINING CONFIDENT NEURAL CLASSIFIERS 2. C ONFIDENT CLASSIFIER FOR OUT - OF - DISTRIBUTION
We propose a new loss function to train a classiﬁer which can map the samples from in- and outof-distribution into the output space separately.
Without loss of generality, suppose that the cross entropy loss is used for training.
Then, we deﬁne the following, termed conﬁdence loss:
[Equation]
where KL denotes the Kullback-Leibler (KL) divergence and U ( y ) is the uniform distribution.
It is highly intuitive as the new loss forces the predictive distribution on out-of-distribution samples to be closer to the uniform one, i.e., zero conﬁdence, while that for samples from in-distribution still follows the label-dependent probability.
In other words, the proposed loss is designed for assigning higher maximum prediction values to in-distribution samples than out-of-distribution ones.
Here, a caveat is that adding the KL divergence term might degrade the classiﬁcation performance.
However, we found that it is not the case due to the high expressive power of deep neural networks, while inand out-of-distributions become more separable with respect to the maximum prediction value by optimizing the conﬁdence loss (see Section 3.1 for supporting experimental results).
We remark that minimizing a similar KL loss was studied recently for different purposes (Lee et al., 2017; Pereyra et al., 2017).
Training samples for minimizing the KL loss is explicitly given in
[Figure]
their settings while we might not.
Ideally, one has to sample all (almost inﬁnite) types of outof-distribution to minimize the KL term in (1), or require some prior information on testing out-ofdistribution for efﬁcient sampling.
However, this is often infeasible and fragile.
To address the issue, we suggest to sample out-of-distribution close to in-distribution, which could be more effective in improving the detection performance, without any assumption on testing out-of-distribution.
In order to explain our intuition in details, we consider a binary classiﬁcation task on a simple example, where each class data is drawn from a Gaussian distribution and entire data space is bounded by 2D box [ − 50 , 50] 2 for visualization.
We apply the conﬁdence loss to simple fully-connected neural networks (2 hidden layers and 500 hidden units for each layer) using different types of outof-distribution training samples.
First, as shown in Figure 1(a), we construct an out-of-distribution training dataset of 100 (green) points using rejection sampling on the entire data space [ − 50 , 50] 2 .
Figure 1(b) shows the decision boundary of classiﬁer optimizing the conﬁdence loss on the corresponding dataset.
One can observe that a classiﬁer still shows overconﬁdent predictions (red and blue regions) near the labeled in-distribution region.
On the other hand, if we construct a training out-of-distribution dataset of 100 points from [ − 20 , 20] 2 , i.e., closer to target, in-distribution space (see Figure 1(c)), a classiﬁer produces conﬁdent predictions only on the labeled region and zero conﬁdence on the remaining in the entire data space [ − 50 , 50] 2 as shown in Figure 1(d).
This implies that training out-of-distribution samples nearby the in-distribution region could be more effective in improving the detection performance.
Our underlying intuition is that the effect of boundary of indistribution region might propagate to the entire out-of-distribution space.
Our experimental results in Section 3.1 also support this: realistic images are more useful as training out-of-distribution than synthetic datasets (e.g., Gaussian noise) for improving the detection performance when we consider an image classiﬁcation task.
This motivates us to develop a new generative adversarial network (GAN) for generating such effective out-of-distribution samples.
2. A DVERSARIAL GENERATOR FOR OUT - OF - DISTRIBUTION
The GAN framework proposed by (Goodfellow et al., 2014) consists of two main components: discriminator D and generator G .
The generator maps a latent variable z from a prior distribution
P pri ( z ) to generated outputs G ( z ) , and discriminator D : X → [0 , 1] represents a probability that sample x is from a target distribution.
Suppose that we want to recover the in-distribution
P in ( x ) using the generator G .
Then, one can optimize the following min-max objective for forcing
P G ≈ P in :
[Equation]
However, unlike the original GAN, we want to make the generator recover an effective out-ofdistribution P out instead of P in .
Inspired by our intuition in Section 2.1.
we assume that the density of out-of-distribution is (i) inversely proportional to that of in-distribution in its high-density area, i.e., if P in ( x ) > ε for some ε , and (ii) very marginal, say η ≈ 0 , otherwise.
Then, we ﬁrst derive
KL
[Equation]
P
[Equation]
where H ( · ) denotes the entropy and I is the indicator function.
Using the assumption (i), minimizing the part (a) with respect to the generator G becomes
[Equation]
where θ is the model parameter of a classiﬁer trained on in-distribution and the approximation is inspired by our design of the conﬁdence loss (1)
, i.e., P in ( x ) ≈ exp ( KL ( U ( y ) (cid:107) P θ ( y | x ))) .
We remark that this approximation is also closely related to the inception score (Salimans et al., 2016) which is popularly used as a quantitative measure of visual ﬁdelity of the samples.
Next, using the assumption (ii), minimizing the part (b) with respect to the generator G becomes
[Equation]
since minimizing the probability that the generator produces samples in the low-density area can be approximated by forcing P G ≈ P in , i.e., the original GAN loss.
Finally, by combining all above approximations, we propose the following new GAN loss for minimizing KL ( P G (cid:107) P out ) :
[Equation]
which encourages the generator to produce the samples which are on the low-density boundary of the in-distribution space.
We also provide its experimental evidences in Section 3.2.
However, maximizing the entropy H ( P G ( x )) in the objective (3) is technically challenging since a GAN does not model the generator distribution explicitly.
To handle the issue, we leverage the pull-away term (PT)
(Zhao et al., 2017):
[Equation]
where z i , z j ∼ P pri ( z ) and M is the number of samples.
One can note that it corresponds to the squared cosine similarity of generated samples.
By minimizing the squared cosine similarity, one can increase the entropy.
We also remark that (Dai et al., 2017) consider a similar GAN generating samples from out-of-distribution for the purpose of semi-supervised learning.
The authors assume the existence of a pre-trained density estimation model such as PixelCNN++ (Salimans et al., 2017) for in-distribution, but such a model might not exist and be expensive to train in general.
Instead, we use much simpler conﬁdent classiﬁers for approximating the density.
Hence, under our fullysupervised setting, our GAN is much easier to train and more suitable.
2. J OINT TRAINING METHOD OF CONFIDENT CLASSIFIER AND ADVERSARIAL GENERATOR
In the previous section, we suggest training the proposed GAN using a pre-trained conﬁdent classiﬁer.
We remind that the converse is also possible, i.e., the motivation of having such a GAN is for training the classiﬁer.
Under this relation between two models, we propose a joint training scheme where the conﬁdent classiﬁer improves the proposed GAN, and vice versa, as training proceeds.
Speciﬁcally, we suggest the following joint objective function:
[Equation]
[Equation]
The classiﬁer’s conﬁdence loss corresponds to (c) + (d), and the proposed GAN loss corresponds to (d) + (e), i.e., they share the KL term (d) under joint training.
To optimize the above objective efﬁciently, we propose an alternating algorithm, which optimizes model parameters { θ } of classiﬁer and GAN models { G, D } alternatively as shown in Algorithm 1.
Since the algorithm monotonically decreases the objective function, it is guaranteed to converge.
repeat
[Equation]
proposed GAN ∗
[Equation]
Sample { z 1 , . . .
, z M } and { x 1 , . . .
, x M } from prior P pri ( z ) and and in-distribution P in ( x ) , respectively, and update the discriminator D by ascending its stochastic gradient of
[Equation]
Sample { z 1 , . . .
, z M } from prior P pri ( z ) , and update the generator G by descending its stochastic gradient of
[Equation]
i )))
(cid:105) .
/ ∗ Update conﬁdent classiﬁer ∗ /
Sample { z 1 , . . .
, z M } and { ( x 1 , y 1 ) , . . .
, ( x M , y M ) } from prior P pri ( z ) and in-distribution
P in ( x , y ) , respectively, and update the classiﬁer θ by descending its stochastic gradient of
M
[Equation]
i
[Equation]
until convergence
E XPERIMENTAL R ESULTS
We demonstrate the effectiveness of our proposed method using various datasets: CIFAR (Krizhevsky & Hinton, 2009), SVHN (Netzer et al., 2011), ImageNet (Deng et al., 2009), LSUN (Yu et al., 2015) and synthetic (Gaussian) noise distribution.
We train convolutional neural networks (CNNs) including VGGNet (Szegedy et al., 2015) and AlexNet (Krizhevsky, 2014) for classifying CIFAR-10 and SVHN datasets.
The corresponding test dataset is used as the in-distribution (positive) samples to measure the performance.
We use realistic images and synthetic noises as the out-of-distribution (negative) samples.
For evaluation, we measure the following metrics using threshold-based detectors (Hendrycks & Gimpel, 2016; Liang et al., 2017): the true negative rate (TNR) at 95% true positive rate (TPR), the area under the receiver operating characteristic curve (AUROC), the area under the precision-recall curve (AUPR), and the detection accuracy, where larger values of all metrics indicate better detection performances.
Due to the space limitation, more explanations about datasets, metrics and network architectures are given in Appendix A.
3. E FFECTS OF CONFIDENCE LOSS
We ﬁrst verify the effect of conﬁdence loss (1) trained by some explicit, say seen, out-of-distribution datasets.
First, we compare the quality of conﬁdence level by applying various training losses.
Speciﬁcally, the softmax classiﬁer is used and simple CNNs (two convolutional layers followed by three fully-connected layers) is trained by minimizing the standard cross entropy loss on SVHN dataset.
We also apply the conﬁdence loss to the model by additionally optimizing the KL divergence term using CIFAR-10 dataset (as training out-of-distribution).
In Figure 2(a) and 2(b), we report distributions of the maximum prediction value in softmax scores to evaluate the separation quality between in-distribution (i.e., SVHN) and out-of-distributions.
It is clear that there exists a
[Figure]
loss.
For all experiments in (a), (b) and (c), we commonly use the SVHN dataset for in-distribution.
[Table]
For each in-distribution, we minimize the KL divergence term in (1) using training samples from an out-of-distribution dataset denoted by “seen”, where other “unseen” out-of-distributions were also used for testing.
better separation between the SVHN test set (red bar) and other ones when the model is trained by the conﬁdence loss.
Here, we emphasize that the maximum prediction value is also low on even untrained (unseen) out-of-distributions, e.g., TinyImageNet, LSUN and synthetic datasets.
Therefore, it is expected that one can distinguish in- and out-of-distributions more easily when a classiﬁer is trained by optimizing the conﬁdence loss.
To verify that, we obtain the ROC curve using the baseline detector (Hendrycks & Gimpel, 2016) that computes the maximum value of predictive distribution on a test sample and classiﬁes it as positive (i.e., in-distribution) if the conﬁdence score is above some threshold.
Figure 2(c) shows the ROC curves when we optimize the KL divergence term on various datasets.
One can observe that realistic images such as TinyImageNet (aqua line) and LSUN (green line) are more useful than synthetic datasets (orange line) for improving the detection performance.
This supports our intuition that out-of-distribution samples close to in-distribution could be more effective in improving the detection performance as we discussed in Section 2.1.
We indeed evaluate the performance of the baseline detector for out-of-distribution using largescale CNNs, i.e., VGGNets with 13 layers, under various training scenarios, where more results on
AlexNet and ODIN detector (Liang et al., 2017) can be found in Appendix B (the overall trends of results are similar).
For optimizing the conﬁdence loss (1), SVHN and CIFAR-10 training datasets are used for optimizing the KL divergence term for the cases when the in-distribution is CIFAR-10 and
SVHN, respectively.
Table 1 shows the detection performance for each in- and out-of-distribution pair.
When the in-distribution is SVHN, the classiﬁer trained by our method drastically improves the detection performance across all out-of-distributions without hurting its original classiﬁcation performance.
However, when the in-distribution is CIFAR-10, the conﬁdence loss does not help the detection performance in overall, where we expect that this is because the trained/seen SVHN out-
[Figure] [Figure]
of-distribution does not effectively cover all tested out-of-distributions.
Our joint conﬁdence loss (4), which was designed under the intuition, resolves the issue of the CIFAR-10 (in-distribution) classiﬁcation case in Table 1 (see Figure 4(b)).
3. E FFECTS OF ADVERSARIAL GENERATOR AND JOINT CONFIDENCE LOSS
In this section, we verify the effect of the proposed GAN in Section 2.2 and evaluate the detection performance of the joint conﬁdence loss (4).
To verify that the proposed GAN can produce the samples nearby the low-density boundary of the in-distribution space, we ﬁrst compare the generated samples by original GAN and proposed GAN on a simple example where the target distribution is a mixture of two Gaussian distributions.
For both the generator and discriminator, we use fullyconnected neural networks with 2 hidden layers.
For our method, we use a pre-trained classiﬁer which minimizes the cross entropy on target distribution samples and the KL divergence on out-ofdistribution samples generated by rejection sampling on a bounded 2D box.
As shown in Figure 3(a), the samples of original GAN cover the high-density area of the target distribution while those of proposed GAN does its boundary one (see Figure 3(b)).
We also compare the generated samples of original and proposed GANs on MNIST dataset (LeCun et al., 1998), which consists of handwritten digits.
For this experiment, we use deep convolutional GANs (DCGANs)
(Radford et al.,
[Figure]
In this case, we use a pre-trained classiﬁer which minimizes the cross entropy on MNIST training samples and the KL divergence on synthetic Gaussian noises.
As shown in Figure 3(c) and 3(d), samples of original GAN looks more like digits than those of proposed GAN.
Somewhat interestingly, the proposed GAN still generates some new digit-like images.
We indeed evaluate the performance of our joint conﬁdence loss utilizing the proposed GAN.
To this end, we use VGGNets (as classiﬁers) and DCGANs (as GANs).
We also test a variant of conﬁdence loss which optimizes the KL divergence term on samples from a pre-trained original GAN (implicitly) modeling the in-distribution.
One can expect that samples from the original GAN can be also useful for improving the detection performance since it may have bad generalization properties (Arora et al., 2017) and also generate a few samples on the low-density boundary as like the proposed
GAN.
Figure 4 shows the performance of the baseline detector for each in- and out-of-distribution pair.
First, observe that the joint conﬁdence loss (blue bar) outperforms the conﬁdence loss with some explicit out-of-distribution datasets (green bar).
This is quite remarkable since the former is trained only using in-distribution datasets, while the latter utilizes additional out-of-distribution datasets.
We also remark that our methods signiﬁcantly outperform the baseline cross entropy loss (red bar) in all cases without harming its original classiﬁcation performances (see Table 6 in Appendix B).
Interestingly, the conﬁdence loss with the original GAN (orange bar) is often (but not always) useful for improving the detection performance, whereas that with the proposed GAN (blue bar) still outperforms it in all cases.
Finally, we also provide visual interpretations of models using the guided gradient maps (Springenberg et al., 2014).
Here, the gradient can be interpreted as an importance value of each pixel which inﬂuences on the classiﬁcation decision.
As shown in Figure 5, the model trained by the cross entropy loss shows sharp gradient maps for both samples from in- and out-of-distributions, whereas models trained by the conﬁdence losses do only on samples from in-distribution.
For the case of SVHN in-distribution, all conﬁdence losses gave almost zero gradients, which matches to the results in Figure 4(a): their detection performances are almost perfect.
For the case of CIFAR10 distribution, one can now observe that there exists some connection between gradient maps and detection performances.
This is intuitive because for detecting samples from out-of-distributions better, the classiﬁer should look at more pixels as similar importance and the KL divergence term forces it.
We think that our visualization results might give some ideas in future works for developing better inference methods for detecting out-of-distribution under our models.
C ONCLUSION
In this paper, we aim to develop a training method for neural classiﬁcation networks for detecting out-of-distribution better without losing its original classiﬁcation accuracy.
In essence, our method jointly trains two models for detecting and generating out-of-distribution by minimizing their losses alternatively.
Although we primarily focus on image classiﬁcation in our experiments, our method can be used for any classiﬁcation tasks using deep neural networks.
It is also interesting future directions applying our methods for other related tasks: network calibration (Guo et al., 2017), ensemble method (Lakshminarayanan et al., 2017) and semi-supervised learning (Dai et al., 2017).
A E XPERIMENTAL SETUPS IN S ECTION
Datasets.
We train deep models such as VGGNet (Szegedy et al., 2015) and AlexNet (Krizhevsky, 2014) for classifying CIFAR-10 and SVHN datasets: the former consists of 50,000 training and 10,000 test images with 10 image classes, and the latter consists of 73,257 training and 26,032 test images with 10 digits.
1 The corresponding test dataset are used as the in-distribution (positive) samples to measure the performance.
We use realistic images and synthetic noises as the out-ofdistribution (negative) samples: the TinyImageNet consists of 10,000 test images with 200 image classes from a subset of ImageNet images.
The LSUN consists of 10,000 test images of 10 different scenes.
We downsample each image of TinyImageNet and LSUN to size 32 × 32 .
The Gaussian noise is independently and identically sampled from a Gaussian distribution with mean 0 .
5 and variance 1 .
We clip each pixel value into the range [0 , 1] .
Detailed CNN structure and training.
The simple CNN that we use for evaluation shown in Figure 2 consists of two convolutional layers followed by three fully-connected layers.
Convolutional layers have 128 and 256 ﬁlters, respectively.
Each convolutional layer has a 5 × 5 receptive ﬁeld applied with a stride of 1 pixel each followed by max pooling layer which pools 2 × 2 regions at strides of 2 pixels.
AlexNet (Krizhevsky, 2014) consists of ﬁve convolutitonal layers followed by three fullyconnected layers.
Convolutional layers have 64, 192, 384, 256 and 256 ﬁlters, respectively.
First and second convolutional layers have a 5 × 5 receptive ﬁeld applied with a stride of 1 pixel each followed by max pooling layer which pools 3 × 3 regions at strides of 2 pixels.
Other convolutional layers have a 3 × 3 receptive ﬁeld applied with a stride of 1 pixel followed by max pooling layer which pools 2 × 2 regions at strides of 2 pixels.
Fully-connected layers have 2048, 1024 and 10 hidden units, respectively.
Dropout (Hinton et al., 2012) was applied to only fully-connected layers of the network with the probability of retaining the unit being 0.5.
All hidden units are ReLUs.
Figure 6 shows the detailed structure of VGGNet (Szegedy et al., 2015) with three fully-connected layers and 10 convolutional layers.
Each ConvReLU box in the ﬁgure indicates a 3 × 3 convolutional layer followed by ReLU activation.
Also, all max pooling layers have 2 × 2 receptive ﬁelds with stride 2.
Dropout was applied to only fully-connected layers of the network with the probability of retaining the unit being 0.5.
For all experiments, the softmax classiﬁer is used, and each model is trained by optimizing the objective function using Adam learning rule (Kingma & Ba, 2014) with a mini-batch size of 128.
The learning rate is chosen from { 0 . 001 , 0 . 0005 , 0 . 0002 } and the threshold is chosen from ε ∈ { 0 , 0 .
We drop the learning rate by 0.2 at 60, 120 and 160 epochs and models are trained for total 200 epochs.
The best test result is reported for each method.
Performance metrics.
We measure the following metrics using threshold-based detectors:
• True negative rate (TNR) at 95% true positive rate (TPR).
Let TP, TN, FP, and FN denote true positive, true negative, false positive and false negative, respectively.
We measure TNR = TN / (FP+TN), when TPR = TP / (TP+FN) is 95%.
• Area under the receiver operating characteristic curve (AUROC).
The ROC curve is a graph plotting TPR against the false positive rate =
FP / (FP+TN) by varying a threshold.
• Area under the precision-recall curve (AUPR).
The PR curve is a graph plotting the precision =
TP / (TP+FP) against recall =
TP / (TP+FN) by varying a threshold.
AUPR-IN (or -OUT) is AUPR where in- (or out-of-) distribution samples are speciﬁed as positive.
• Detection accuracy.
This metric corresponds to the maximum classiﬁcation probability over all possible thresholds δ : 1 − min δ (cid:8) P in ( q ( x ) ≤ δ ) P ( x is from P in ) + P out ( q ( x ) > δ ) P ( x is from P out ) (cid:9) , where q ( x ) is a conﬁdent score such as a maximum value of softmax.
We assume that both positive and negative examples have equal probability of appearing in the test set,
i
e., P ( x is from P in ) =
P ( x is from P out )
= 0 .
Note that AUROC, AUPR and detection accuracy are threshold-independent evaluation metrics.
Generating samples on a simple example.
As shown in Figure 3(a) and Figure 3(b), we compare the generated samples by original GAN and proposed GAN on a simple example where the target distribution is a mixture of two Gaussian distributions.
For both the generator and discriminator, we use fully-connected neural networks with 2 hidden layers and 500 hidden units for each layer.
For
F C ( 512 )
C o n v R e L
U (f .
m a p s )
m
a x p oo l
C o n v R e L
U (f .
m a p s )
C o n v R e L
U ( f .
m a p s )
C o n v R e L
U ( f .
m a p s )
m
a x p oo l
C o n v R e L
U ( f .
m a p s )
m
a x p oo l
C o n v R e L
U ( f .
m a p s )
C o n v R e L
U ( f .
m a p s )
C o n v R e L
U ( f .
m a p s )
m
a x p oo l
C o n v R e L
U ( f .
m a p s )
C o n v R e L
U ( f .
m a p s ) a v g p oo l
F C ( 10 )
F C ( 512 ) all layers, we use ReLU activation function.
We use a 100-dimensional Gaussian prior for the latent variable z .
For our method, we pre-train the simple fully-connected neural networks (2 hidden layers and 500 ReLU units for each layer) by minimizing the cross entropy on target distribution samples and the KL divergence on out-of-distribution samples generated by rejection sampling on bounded 2D box [ − 10 , 10] 2 .
The threshold ε is set to 0.1.
We use ADAM learning rule (Kingma & Ba, 2014) with a mini-batch size of 400.
The initial learning rate is set to 0.002, and we train for totalepochs.
Generating samples on MNIST.
As shown in Figure 3(c) and Figure 3(d), we compare the generated samples of original and proposed GANs on MNIST dataset, which consists of greyscale images, each containing a digit 0 to 9 with 60,000 training and 10,000 test images.
We expand each image to size 3 × 32 × 32 .
For both the generator and discriminator, we use deep convolutional GANs (DCGANs)
(Radford et al., 2015).
The discriminator and generator consist of four convolutional and deconvolutional layers, respectively.
Convolutional layers have 128, 256, 512 and 1 ﬁlters, respectively.
Each convolutional layer has a 4 × 4 receptive ﬁeld applied with a stride of 2 pixel.
The second and third convolutional layers are followed by batch normalization (Ioffe & Szegedy, 2015).
For all layers, we use LeakyReLU activation function.
Deconvolutional layers have 512, 256,and 1 ﬁlters, respectively.
Each deconvolutional layer has a 4 × 4 receptive ﬁeld applied with a stride of 2 pixel followed by batch normalization (Ioffe & Szegedy, 2015) and ReLU activation.
For our method, we use a pre-trained simple CNNs (two convolutional layers followed by three fully-connected layers) by minimizing the cross entropy on MNIST training samples and the KL divergence on synthetic Gaussian noise.
Convolutional layers have 128 and 256 ﬁlters, respectively.
Each convolutional layer has a 5 × 5 receptive ﬁeld applied with a stride of 1 pixel each followed by max pooling layer which pools 2 × 2 regions at strides of 2 pixels.
The threshold is set to 0.
We use
ADAM learning rule (Kingma & Ba, 2014) with a mini-batch size of 128.
The initial learning rate is set to 0.0002, and we train for total 50 epochs.
B M ORE EXPERIMENTAL RESULTS
In this section
[Table]
we provide more experimental results using AlexNet (Krizhevsky, 2014)
(see Table 2) and ODIN detector (Liang et al., 2017) (see Table 3).
We remark that they show similar trends.
For the ODIN detector, the temperature is set to 1000 and perturbation magnitude is set to 0.0012.
Also
[Table]
we report the detection performances of the baseline and ODIN detectors when we optimize the KL divergence term using Gaussian noises and explicit out-of-distribution samples in Tableand 5.
Finally
[Table]
Table 6 reports the classiﬁcation accuracy of VGGNets on CIFAR-10 and SVHN datasets under various training losses shown in Figure
[Table]
[Table] [Table]
[Table] [Table]