I GEOOD : An Information Geometry Approach to Out-of-Distribution Detection
Abstract
Reliable out-of-distribution (OOD) detection is a fundamental step towards a safer implementation of modern machine learning (ML) systems under distribution shift.
In this paper, we introduce I GEOOD , an effective method for detecting OOD samples.
I GEOOD applies to any pre-trained neural network, works under different degrees of access to the ML model, does not require OOD samples or assumptions on the OOD data, but can also beneﬁt (if available) from OOD samples.
By building on the geodesic (Fisher-Rao) distance between the underlying data distributions, our discriminator combines conﬁdence scores from the logits outputs and the learned features of a deep neural network.
Empirically, we show that I GEOOD is competitive and often outperforms state-of-the-art methods by a large margin on a variety of networks architectures and datasets.
Introduction
Out-Of-Distribution (OOD) or novelty detection is one of the main objectives in conceiving reliable
ML systems [1].
An application of these methods arises in monitoring ML-based online services for drifting distributions.
Tracking changes in the underlying data distribution is challenging as they contain unusual (irregular or unexpected) events and have large dimensions.
For instance, the detection of such anomalous observations will have to rely on the intrinsic properties of the
ML models, methods and algorithms based on their statistical behavior in the presence of indistribution data.
Classic approaches to OOD detection consist of deriving metrics for detecting those abnormalities from the lens of ML models (e.g., softmax output, latent representations across layers), provided that the data is high dimensional and often only a single test example is available.
1.1 Contributions
In this paper we propose I GEOOD , a new uniﬁed and effective method to perform OOD detection by rigorously exploring the information-geometric properties of the feature space on various depths of a DNN.
I GEOOD provides a ﬂexible framework that applies to any pre-trained softmax neural classiﬁer.
A key ingredient of I GEOOD is the Fisher-Rao distance.
This distance is used as an effective differential geometry tool for clustering in the context of multivariate Gaussian pdfs [30, 37].
In our context, we measure the dissimilarity between probability (in and out) distributions, as the length of the shortest path within the manifold induced by the underlying class of distributions (i.e., the softmax probabilities of the neural classiﬁer or the densities modeling the learned representations across the layers).
By doing so, we can explore statistical invariances of the geometric properties of the learned features [5].
Our method adapts to various scenarios depending on the level of information access of the DNN, uses only in-distribution samples but can also beneﬁt (if available) of OOD samples. Workshop on Systems (
1.2 Related works
OOD detectors are binary classiﬁers that discriminate in- and out-of-distribution samples.
A few works [36, 14, 4, 26, 40, 39, 12] propose retraining the base (or an auxiliary) model with synthetic or ground truth OOD samples to serve as a classiﬁer and as an OOD discriminator.
Disposing of both
OOD and in-distribution samples during training enables the hidden layers to learn representations to facilitate OOD detection.
These methods will not be compared to ours in this work, as they entail retraining or modifying the base neural network by using OOD data to further train parameters.
Moreover, this assumes that OOD samples are stationary, which is an unrealistic assumption in practical scenarios.
The work [27] demonstrates failure modes of OOD detection methods to better understand how to improve them, especially how spurious features like image background can vastly degrade detection performance.
references [35, 17, 6, 38, 42, 33, 45, 25] study OOD detection in the context of generative models.
Open set recognition [3], outlier or anomaly detection [29], concept drift detection [31], and adversarial attacks detection [10, 23] are related topics.
W HITE -B OX scenario.
This class of OOD detectors allows discriminators to have access to all intermediate layer outputs.
Naturally, they have access to more information than B LACK -B OX or
G REY -B OX techniques, which provide detection based only on the network’s outputs, i.g., MSP [13], ODIN [21], and the free-energy [22] based methods to name a few.
reference [34] proposes high order Gram matrices to perform OOD detection, by computing class-conditional pairwise feature correlations across the hidden layers of the network.
The work [20] models the latent features’ outputs of DNN models as a class-conditional Gaussian mixture distribution with tied covariance matrix and class-conditional mean vectors.
They calculate the Mahalanobis distance between an OOD sample as a single estimator of the mean of a class-conditional Gaussian distribution with covariance matrix estimated on the entire training set.
The importance of each feature component and hyperparameters are tuned using validation data.
The work [32] modiﬁes the Mahalanobis distance-based OOD detector [20] to improve near-OOD detection by reducing the importance of features shared by inand out-of-distribution data.
I GEOOD : OOD Detection using the Fisher-Rao Distance
In this section, we introduce I GEOOD , a ﬂexible framework for OOD detection.
I GEOOD is implemented in two ways: at the level of the logits using temperature scaling (Section 2.1), and layer-wise level (Section 2.2).
The key ingredient of I GEOOD is the Fisher-Rao (F-R) distance [2] This distance measures the dissimilarity between two probability models within a class of probability distributions by calculating the geodesic distance between two points on the learned manifold.
2. I GEOOD score using the softmax probability
For the classiﬁcation problem, we can take the temperature T scaled softmax function (Eq.
(1)) as an approximation of a class-conditional probability distribution:
[Equation]
where f : X → R C is a vectorial function with f (cid:44) (cid:0) f 1 , f 2 , . .
, f C (cid:1) and f y ( · ) denotes the y -th logits output value of the DNN classiﬁer.
The F-R distance d FR − Logits between two softmax probability distributions can be shown by[-
-]
[Equation]
Class conditional centroid estimation.
We model the training dataset class-conditional posterior distribution by calculating the centroid of the logits representations of this set.
Precisely, we compute the centroid for the logits of each class y of the in-distribution training dataset D N corresponding to the F-R distance, i.e.,
[Equation]
where N y is the amount of training examples with label y .
We optimize this expression using SGD algorithm, where the parameter to be tuned is µ in the logits space.
OOD detection score.
We propose the F-R distance-based OOD detection score FR 0 ( x ) on the space of the logits to be the sum of the distances between f ( x ) and each individual class conditional centroid µ y calculated by Eq.
We denote it as follows:
[Equation]
We obtained better performance by taking the sum instead of the minimal distance. A likely explanation for this would be that Eq. (4) leverages useful information related to the example’s conﬁdence score for each class y .
2. I GEOOD score leveraging latent features
For each layer, we deﬁne a set of class-conditional Gaussian distributions with diagonal standard deviation matrix σ ( (cid:96) ) and class-conditional mean µ ( (cid:96) )
y , where y ∈ { 1 , . .
, C } and (cid:96) is the index of the latent feature.
We compute the empirical estimates of these parameters according to µ ( (cid:96) ) y = 1 N y (cid:88) ∀ i : y i = y f
( (cid:96) ) ( x i ) , and σ ( (cid:96) ) = diag   (cid:115) N (cid:88)
y ∈Y (cid:88) ∀ i : y i = y (cid:16) f
( (cid:96) )
j [Equation] where j ∈ { 1 , . . .
, k } , k is the size of feature (cid:96) , and f ( (cid:96) ) ( · ) is the output of the network for feature (cid:96) .
The F-R distance ρ FR between two univariate Gaussian pdfs N ( µ 1 , σ 21 ) and N ( µ 2 , σ 22 ) is given by
[Equation]
[Equation]
(6) where ( µ i , σ i ) is a 2-dimensional vector with components
µ i and σ i and | · | is the 2-norm. Similarly, the F-R distance d FR − Gauss between two multivariate Gaussian pdfs with diagonal standard deviation matrix is derived from the univariate case and is given by
[Equation]
where k is the cardinality of the distributions N ( µ , σ 2 ) and N ( µ (cid:48) , σ (cid:48) 2 )
, µ i is the i -th component of the vector µ , and σ i,i is the entry of index i, i of the standard deviation matrix σ .
Experimental support for a diagonal Gaussian mixture model.
We observed that the latent features covariance matrices are often ill-conditioned and are diagonal dominant.
In other words, the condition number of the covariance matrix often diverges, and the magnitude of the diagonal entry in a row is greater than or equal to the sum of all the other entries in that row for most rows.
Fisher-Rao distance-based feature-wise conﬁdence score.
We derive a conﬁdence score by applying the F-R distance between the test sample x and the closest class-conditional diagonal Gaussian distribution.
We can consider two situations: (i) we do not have access to any validation OOD data whatsoever.
In this case, the natural choice is to model the test samples as Gaussian distribution with the same diagonal standard deviation as the learned representation, i.e.,
[Equation]
(8) and (ii) , we dispose of a validation OOD dataset on which the features’ diagonal standard deviation matrices σ (cid:48)
( (cid:96) ) and µ (cid:48) ( (cid:96) ) can be estimated, as well as the quantity
[Equation]
Feature ensemble.
Similarly to [20], we combine the conﬁdence scores of the logits and low-level features through a linear combination to emphasize features that demonstrate a greater capacity for detecting abnormal samples.
The following equation summarizes the I GEOOD score:
[Equation]
Experimental Results
The experimental setup follows the setting established by [13], [21] and [20].
We use two pre-trained deep neural networks architectures for image classiﬁcation tasks: DenseNet-BC-100 [16] and a ResNet-34 [11].
We take as in-distribution data images from CIFAR-10 [18], CIFAR-100 and SVHN [28] datasets.
For out-of-distribution data , we use natural image examples from the datasets: TinyImageNet [19], LSUN [44], Describable Textures Dataset [7], Chars74K [8], Places365 [46], iSUN [43] and a synthetic dataset generated from Gaussian noise.
For models pre-trained on CIFAR-10, data from CIFAR-100 and SVHN are also considered OOD; for models pre-trained on CIFAR-100, data from CIFAR-10 and SVHN are considered OOD, and for models pre-trained on SVHN, the CIFAR-10 and CIFAR-100 datasets are considered OOD.
Even though we ran experiments with image data, I GEOOD could be applied to any neural-based classiﬁcation task.
We consider two tuning scenarios: one with data from adversarially generated [10] (FGSM) samples from the training dataset, and another with data from the OOD test set.
For the former, we tune hyperparameters for each method with generated data (pseudo OOD) and in-distribution data.
While for the latter, we tune hyperparameters with [-1,
-]1,000 OOD data samples and in-distribution data.
We derive two methods: I GEOOD +, which is given by Eq.
(10) and considers that we have an estimate on the diagonal covariance matrix and mean vector from OOD data as additional information; and
I GEOOD , which doesn’t consider any prior on OOD data, i.e., set α (cid:48) (cid:96) = [-
-]0 on Eq.
Comparison with Mahalanobis.
For each DNN model and in-distribution dataset pair, we report the average OOD detection performance for Mahalanobis [20], I GEOOD and I GEOOD +.
Tablevalidates the contributions of our techniques.
We observe substantial performance improvement in all experiments for the left-hand side of the table, where I GEOOD + outperforms Mahalanobis on average for all test cases, recording an improvement up to 23% on TNR at TPR-95%.
To assess the consistency of I GEOOD to the choice of validation data, we measured the detection performance when hyperparameters are tuned only using in-distribution and generated adversarial data as observed in the right-hand side of Table 1.
In this setup, I GEOOD improves by 2.5% the average TNR at TPR-95% across all datasets and models, but is sometimes outperformed by 2-3%.
The abbreviation TNR-95%, C-10 and C-100 stands for TNR at TPR-95%, CIFAR-10 and CIFAR100, respectively.
The extended results can be found in Tables 6 and 7 in the appendix. Tuning on OOD data [Table] Ablation study.
The I GEOOD score has three components, FR 0 , FR (cid:96)
[Table]
and FR (cid:48) (cid:96) , that together compose the ﬁnal metric given by Eq.
The outputs of the network provide limited OOD detection capacity.
Always when available, the intermediate features, i.e., FR (cid:96) , are a valuable resource for OOD detection.
Moreover, when few reliable OOD data are available, calculating FR (cid:48) (cid:96) can further improve the detection performance as shown on the left side column of Table 1.
Also, data from a source other than in-distribution, e.g., adversarial samples, is enough for tuning hyperparameters and combining features, as observed on the right side column of Table 1.
Figure 1 shows the detection performance for each hidden feature of a DenseNet as well as the scores histograms for a particular task for both Mahalanobis
and I
GEOOD scores.
[Figure]
I GEOOD compared to other W HITE -B OX methods.
Even though reference [20] shares the closest setup to ours, recent literature also proposes OOD detection in a W HITE -B OX setting, achieving state-of-the-art in a few benchmarks.
Notably, [34, 15, 47] achieve great performance in a range of benchmarks.
Thus, we report the results from the original references in Table 2.
This setup considers that a few OOD samples are available for tuning.
We refer the reader to the appendix (see Section D) where we provide a table of results with validation on adversarial data.
[Table]
Summary and Concluding Remarks
In this work [Table] we introduced I GEOOD , an effective and ﬂexible method for Out-Of-Distribution (OOD) detection that applies to any pre-trained neural network.
The main feature of I GEOOD relies on the geodesic distance of the probabilistic manifold of the learned latent representations that induces an effective measure for OOD detection.
The Fisher-Rao distance between pdf of the latent feature, corresponding to the test sample, and a reference pdf, corresponding to the conditional-class of pdfs, provides an effective conﬁdence score.
We consider diverse testing environments where prior knowledge of OOD data may or may not be available.
Experimentally, we showed that I GEOOD can signiﬁcantly and consistently improves the accuracy of OOD detection on several DNN models and across various OOD datasets, achieving new state-of-the-art performances on a few benchmarks. Acknowledgments and Disclosure of Funding This work has been supported by the project PSPC AIDA: 2019-PSPC-09 funded by BPI-France.
A Review of Fisher-Rao Distance (FRD)
In this section, we review some results from references [2, 30].
We intend to clarify some basic concepts surrounding the Fisher-Rao distance while motivating the use of this measure in the context of OOD detection.
In few words, the Fisher-Rao’s distance is given by the geodesic distance, i.e., the shortest path between points in a Riemannian space induced by a parametric family.
Consider the family C of probability distributions over the class of discrete concepts or labels: Y = { 1 , . .
, C } , denoted by C (cid:44) (cid:8) q θ ( ·| x ) : x ∈ X ⊆ R C (cid:9) .
We are interested in measuring the distance between probability distributions q θ ( ·| x ) with respect to the testing input x and a population of inputs drawn accordingly to the in-distribution data set.
To this end, we ﬁrst need to characterize the Fisher-Rao distance for two inputs or for two probability distributions q θ , q (cid:48) θ ∈ C .
Assume that the following regularity conditions hold [2]:
(i) ∇ x q θ ( y | x ) exists for all x , y and θ ∈ Θ ; (ii) (cid:80)
y ∈Y ∇ x q θ ( y | x ) = 0 for all x and θ ∈ Θ ; (iii) G ( x ) =
E Y ∼ q θ ( ·| x ) (cid:2) ∇ x log q θ ( Y | x ) ∇ (cid:62) x log q θ ( Y | x ) (cid:3) is positive deﬁnite for any x and θ ∈ Θ .
Notice that if (i) holds, (ii) also holds immediately for discrete distributions over ﬁnite spaces (assuming that (cid:80) y ∈Y and ∇ x are interchangeable operations) as in our case.
When (i)-(iii) are met, the variance of the differential form ∇ (cid:62) x log q θ ( Y | x ) d x can be interpreted as the square of a differential arc length ds 2 in the space C , which yields
[Equation]
Thus, G , which is the Fisher Information Matrix (FIM), can be adopted as a metric tensor.
We now consider a curve γ : [0 , 1] → X connecting a pair of arbitrary points x , x (cid:48) in the input space X , i.e., γ (0) =
x and γ (1) =
x (cid:48) .
Notice that any curve γ induces a curve q θ ( ·| γ ( t )) for t ∈ [0 , 1] in the space C .
The Fisher-Rao distance between the distributions q θ = q θ ( ·| x ) and q (cid:48) θ = q θ ( ·| x (cid:48) ) will be denoted as d R, C ( q θ , q (cid:48) θ ) and is formally deﬁned by the expression:
[Equation]
where the inﬁmum is taken over all piecewise smooth curves.
This means that the FRD is the length of the geodesic between points x and x (cid:48) using the FIM as the metric tensor.
In general, the minimization of the functional in Eq.
(12) is a problem that can be solved using the well-known Euler-Lagrange differential equation.
A.1 Derivation of Fisher-Rao distance for the class of Softmax probability distributions
The direct computation of the FIM of the family C with q θ ( y | x ) in the form of the softmax probability distribution function Eq.
(1) can be shown to be singular, i.e., rank ( G ( x ))
≤ C − 1 , where C − 1 is the number of degrees of freedom of the manifold C .
To overcome this issue, we introduce the probability simplex P deﬁned by
P = (cid:40)
q : Y → [0 , 1] C : (cid:88) y ∈Y q ( y ) =(cid:41)
[Equation]
Next, we consider the following parametrization for any distribution q ∈ P :
[Equation]
From this expression, we consider the statistical manifold D = (cid:8) q ( ·| z ) : (cid:107) z (cid:107) 2 = 4 , z y ≥ 0 , ∀ y ∈ Y (cid:9) .
Note that the parameter vector z belongs to the positive portion of a sphere of radius 2 and centered at the origin in R C .
The computation of the FIM for z on D yields:
[Equation]
where { e y } are the canonical basis vectors in R C and I is the identity matrix.
From expression Eq.
(15) we can conclude that the Fisher-Rao metric in this parametric space is equal to the Euclidean metric.
Also, since the parameter vector lies on a sphere, the FRD between the distributions q = q ( ·| z ) and q (cid:48)
=
q ( ·| z (cid:48) ) can be written as the radius of the sphere times the angle between the vectors z and z (cid:48) .
Which leads to expression:
[Equation] [Equation]
Finally, we can compute the FRD for softmax distributions in C as
[Equation]
[Equation] obtaining the same form of expression Eq.
Notice that 0 ≤ d FR − Logits ( q θ , q
[Equation]
θ ) ≤ π for all x , x (cid:48) ∈
X ⊆ R C , being zero when q θ ( ·| x ) =
q θ ( ·| x (cid:48) ) and maximum when the vectors (cid:0) q θ (1 | x ) , . . .
, q θ ( C | x ) (cid:1) and (cid:0) q θ (1 | x (cid:48) ) , . . .
, q θ ( C | x (cid:48) ) (cid:1) are orthogonal.
A.2 Derivation of Fisher-Rao distance for multivariate Gaussian distributions
Consider a broader statistical manifold S (cid:44) { p θ = p
[Equation]
x
[Equation]
θ ) : θ =
[Equation]
[Equation]
) ∈ Θ } of multivariate differential probability density functions.
The Fisher information matrix G ( θ ) =
[ g ij ( θ )] in this parametric space is provided by:
[Equation]
Next, consider a multivariate Gaussian distribution:
[Equation]
where x ∈ R k is the variable vector, µ ∈ R k is the mean vector, Σ ∈ P k ( R ) is the covariance matrix, and
P k
( R ) is the space of k positive deﬁnite symmetric matrices.
We can deﬁne the statistical manifold composed by these distributions as M = { p θ ; θ = ( µ , Σ) ∈
R k × P k
( R ) } .
By substituting Eq.
(19) in expression Eq. (18), we can derive the Fisher information matrix for this parametrization, obtaining:
[Equation]
which induces the following square differential arc length in M :
[Equation]
Here, d µ = ( dµ 1 , . . . , dµ n ) ∈ R k and d Σ = [ dσ ij ] ∈ P k ( R ) .
We observe that this metric is invariant to afﬁne transformations [30], i.e., for any ( c , Q ) ∈ R k ×
GL k
( R ) , with GL k ( R ) the space of non-singular order k matrices, the map ( µ , Σ) (cid:55)→ (cid:0) Q µ + c , Q Σ Q (cid:62) (cid:1) is an isometry in M .
Thus, the Fisher-Rao distance between two multivariate normal distributions with parameters θ 1 = ( µ 1 , Σ 1 ) and θ 2 = ( µ 2 , Σ 2 ) in M satisﬁes:
[Equation]
Unfortunately, a closed-form solution for the Fisher-Rao distance remains unknown.
This is still an open problem for an arbitrary covariance matrix Σ and mean vector µ .
Fortunately, the FRD is known for the univariate case and hence, for the submanifold where Σ is diagonal.
Notice that in this case Eq.
(21) admits an additive form.
From [30], we obtain the analytical expression of the Fisher-Rao in the 2-dimensional submanifold of univariate Gaussian probability distributions M
[Equation]
where |·| is the Euclidian norm in R 2 and σ denotes the standard deviation.
Consequently, the FRD for Gaussian distributions with diagonal covariance matrix Σ = diag (cid:0) σ 21 , σ 22 , . .
, σ 2 k (cid:1) in the 2 k -dimensional statistical submanifold M D = (cid:8) p θ : θ = ( µ , Σ) , Σ = diag (cid:0) σ 21 , σ 22 , . . .
, σ 2 k (cid:1) , σ i > 0 , i = 1 , . .
k (cid:9) is
[Equation] [Equation]
A.3 Fisher-Rao vs. Mahalanobis distance
There is an intricate relationship between the FRD for multivariate Gaussian distributions and the Mahalanobis distance.
We borrow the result from [30], which states that in the k -dimensional submanifold M Σ of M where Σ is constant, i.e., M Σ
= { p θ : θ = ( µ , Σ) , Σ = Σ
0 ∈ P k
( R ) } , the Fisher-Rao distance d R, M Σ between two distributions is given by the Mahalanobis distance [24]:
[Equation]
[Equation]
[Equation]
The Mahalanobis distance is also used for OOD detection [20] and its performance is compared to the FRD through several experiments in Section 3.
B I GEOOD Algorithms
In this section, we provide pseudo-code for calculating the I GEOOD score from the logits (Algorithm 1) and from the latent features (Algorithm 2).
The B LACK -B OX I GEOOD score is obtained with Algorithm 1 by setting ε = 0 , while the G REY -B OX I GEOOD score is obtained with ε > 0 .
We calculated the centroid of the logits for the in-distribution training set by optimizing the objective function given by Eq.
(3) through a gradient descent algorithm for each DNN.
We used a constant learning rate of 0 .
01 and a batch size of 128 for 100 epochs.
Finally, the W HITE -B OX I GEOOD score is obtained by combining the outputs of Algorithms 1 and 2 through ﬁtting the multiplicative weights α through a logistic function classiﬁer on a labeled mixture dataset composed from in- and out-of-distribution data according to a validation dataset, which leads to expression Eq.
D
[Equation]
Offline computation
Calculate the logits centroids from the training data:
[Equation]
Online computation
Add small perturbation to x :
[Equation]
(cid:12) sign [Equation] (cid:80)
[Equation]
arccos
[Equation]
y
[Equation]
(cid:17)(cid:105) return FR 0 ( (cid:101) x ) ← (cid:80) y 2 arccos (cid:16)(cid:80) y (cid:48) ∈Y (cid:113) q θ ( y (cid:48) | f ( (cid:101) x ))
q θ ( y (cid:48) | µ y ) (cid:17)
Algorithm 2: Input : Test sample x and training set D N = { ( x i , y i ) } N i =1 .
Output : FR (cid:96) feature-wise I GEOOD scores.
for each feature (cid:96) ∈ { 1 , . . .
, L } do //
Offline computation
Calculate the means: µ ( (cid:96) )
y ← 1 N y (cid:80) i : y i =
y f
( (cid:96) )
( x i )
Calculate the diagonal standard deviation matrix: σ ( (cid:96) )
jj ← (cid:114) 1 N (cid:80) y ∈Y (cid:80) ∀ i : y i =
y (cid:16) f
( (cid:96) )
j ( x i ) − µ ( (cid:96) )
y,j (cid:17)// Online computation
Compute the OOD score for (cid:96) :
FR (cid:96) ( x ) ← min y (cid:114) (cid:80) k j =1 ρ FR (cid:16)(cid:16) µ ( (cid:96) ) y,j , σ ( (cid:96) ) jj (cid:17) , (cid:16) f
( (cid:96) ) j ( x ) , σ ( (cid:96) ) jj (cid:17)(cid:17)end return (cid:0) FR 1 ( x ) , . . . , FR L ( x ) (cid:1)
Input : Test sample x training set and M OOD samples
O M
Output for each feature (cid:96) ∈ { 1 , . . .
, L } do // Offline computation [Table] Calculate the
[Table]
[Table]
[Equation]
[Table]
[Equation]
[Table]
Calculate
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
Online computation
Compute the OOD scores for (cid:96) :
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
Note that the calculation of the training logits centroids µ y , as well as the latent representations mean vectors µ ( (cid:96) )
y and standard covariance matrices σ ( (cid:96) ) is performed beforehand, prior to inference.
In this way, we retrieve the objects from memory at inference time.
Also, we deﬁne k as the cardinality of feature (cid:96) , or | f ( (cid:96) ) | and ρ FR as the Fisher-Rao distance between univariate Gaussian distribution given by expression Eq.
B.1 Logits centroids estimation details
In order to obtain the logits centroids given the Fisher-Rao distance in the space of softmax probability distributions, we designed a simple optimization problem.
This problem aims to minimize the average distance between the class conditional training samples and the centroids as given by Eq.
We initialized the C centroids, where C is the number of classes of a given model, with the identity matrix of size C × C .
Note that the initial centroid for class i is given by the matrix’s line number i .
We minimized the expression in Eq.
(3) with a gradient descent optimizer for 100 epochs with a ﬁxed learning rate equal to 0.01 for every DNN model and in-distribution dataset.
B.2 Feature importance regression details
For both Mahalanobis and I GEOOD methods, we ﬁtted a logistic regression model with cross-validation using 1,000 OOD and 1,000 in-distribution data samples.
Each regression parameter multiplies the layer scores outputs with the objective function of maximizing the TNR at TPR-95%.
We set the maximum number of iterations to be 100.
B.3 Covariance matrix estimation details
We model the latent output probability distributions as Gaussian distributions with diagonal covariance matrix calculated with expression Eq.
We chose this model motivated by a closed form for the FRD and by observing that the standard covariance matrix for the latent features is often ill-conditioned.
The condition number of a matrix correlates to its numerical stability, i.e., a small rounding error in its estimation may cause a large difference in its values.
So, a matrix with a low condition number is said to be well-conditioned, while a matrix with a high condition number is said to be ill-conditioned.
We calculate the condition number of the covariance matrices with the formula κ (Σ) =
(cid:13)(cid:13)
Σ − 1 (cid:13)(cid:13) ∞ (cid:107) Σ (cid:107) ∞ , where (cid:107) · (cid:107) ∞ is the inﬁnity norm.
For each of the four dense blocks outputs of a DenseNet trained on CIFAR-10, we obtained the condition numbers κ Σ = { 2 .
8e10 , 3 . 5e6 , 3 . 1e5 , 3 .
5e21 } .
While for the diagonal covariance matrix, we obtained smaller values of condition numbers: κ Σ D = { 1 . 0e3 , 3 . 0e1 , 1 . 4e1 , 7 . 6e20 } .
We associate the high value for the last feature due to the last feature being high dimensional and coarse, i.e., most of the values in the diagonal are close to zero.
C Detailed Experimental Setup C.1 DNN models and training details
We describe the DNN models used in the experiments:
• DenseNet.
Densely Connected Convolutional Networks [16], or DenseNet for short, are compositions of dense blocks, which are composed of multiple layers directly connected to every other layer in a feed-forward fashion.
In this work, we use the DenseNet-BC-100 architecture.
The BC stands for a model with 1x1 convolutional bottleneck (B) layers and channel number compression (C) of 0.5.
The models have depth L = 100 and growth rate k = 12 .
We consider the outputs of each dense block after the transition layer (3 in total) and the ﬁrst convolutional layer output as the latent features.
After an averaging pooling, the latent features have dimensions F 1 = { 24 , 108 , 150 , 342 } .
• ResNet.
Residual Networks [11], or ResNet, are deep neural networks composed of residual blocks.
Each residual block is composed of layers connected in a feed-forward manner plus a skip connection.
We use the ResNet with 34 layers pre-trained on CIFAR-10, CIFAR- and SVHN datasets.
We take the output of every residual block (4 in total) and the ﬁrst convolutional layer for calculating the
score on the W HITE -B OX setting.
After an averaging pooling, the latent features have dimensions F 2 = { 64 , 64 , 128 , 256 , 512 } .
We train each model by minimizing the cross-entropy loss using SGD with Nesterov momentum equal to 0.9, weight decay equal to 0.0001, and a multi-step learning rate schedule starting at 0.1 for 300 epochs.
The pre-trained models is available at 3 .
We report their test set accuracy in Table 3 with the softmax function and by replacing it with the Fisher-Rao distance between the training class-conditional centroids and the test sample outputs.
Also, it is worth noting that one high-end GPU is sufﬁcient for running every experiment presented in this work. [Table]
C.2 Evaluation metrics
We introduce below standard binary classiﬁcation performance metrics used to evaluate the OOD discriminators.
• True Negative Rate at 95% True Positive Rate (TNR at TPR-95% (%)).
This metric measures the true negative rate (TNR) at a speciﬁc true positive rate (TPR). The operating point is chosen such that the TPR of the in-distribution test set is ﬁxed to some value, 95% in this case. Mathematically, let TP, TN, FP, and FN denote true positive, true negative, false positive and false negative, respectively. We measure TNR = TN / ( FP + TN ) , when TPR = TP / ( TP + FN ) is 95%.
• Area Under the Receiver Operating Characteristic curve (AUROC (%)).
The ROC curve is constructed by plotting the true positive rate (TPR) against the false positive rate =
FP / ( FP + TN ) at various threshold values.
The area under this curve tells how much the OOD discriminator can distinguish in-distribution and OOD data in a threshold-independent manner.
• Area Under the Precision-Recall curve (AUPR (%)).
The PR curve plots the precision =
TP / ( TP + FP ) against the recall =
TP / ( TP + FN ) by varying a threshold.
For the experiments, in-distribution data are speciﬁed as positives while OOD data as negative.
Note that the TNR at TPR-95% is especially important because we want to identify OOD data and preserve a sufﬁciently good performance on identifying in-distribution data, which is not the case for the other metrics.
C.3 Datasets
In our experiments, we use natural image examples from the following image classiﬁcation and synthetic datasets.
We normalize the test samples with the in-distribution dataset statistics
• CIFAR-10.
The CIFAR-10 [18] dataset is composed of 32 × 32 natural images of 10 different classes, e g., airplane, ship, bird, etc.
The training set is composed of 50,000 images, and the test set is composed of 10,000 images.
The classes are approximately equally distributed (5,000 examples each label).
The CIFAR-10 dataset is under the MIT license. • CIFAR-100.
The CIFAR-100 [18] dataset contains similar natural images to the CIFAR-10 dataset, but with 90 additional categories.
Its set repartition is also 50,000 for training and 10,000 for the test set.
We expect around 500 samples for each class of the training set.
It is also under the MIT license. • SVHN.
The SVHN [28] dataset collects street house numbers for digit classiﬁcation.
It contains 73,257 training and 26,032 test RGB images of size 32 × 32 of printed digits (from 0 to 9).
We take only the ﬁrst 10,000 examples of the test set for evaluating the methods to have a balanced dataset of in-distribution and out-of-distribution data.
This dataset is subject to a non-commercial license. • Tiny-ImageNet.
The Tiny-ImageNet [19] dataset is a subset of the large-scale natural image dataset ImageNet [9].
It contains 200 different classes and 10,000 test examples.
We downsize the images from their original resolution to images of dimension 32 × 32 × 3 . • LSUN.
The LSUN [44] dataset, which has equally 10,000 test examples, is used for the large-scale scene classiﬁcation of different scene categories (e.g., bedroom, bridge, kitchen, etc.).
Similarly, we resize the images following the same procedure for the Tiny-ImageNet dataset.
LSUN is under the Apache 2.0 license. • iSUN.
The iSUN [43] dataset consists of selected natural scene images from the SUN [41] dataset.
The test set has 8925 images, which we downsample to 32 × 32 × 3 .
We use this dataset as a source of OOD for validation purposes as an independent dataset from the test OOD data. • Textures.
The Describable Textures Dataset (DTD) [7] is a collection of textural pattern images observed in nature.
It contains 47 categories totaling 5640 images of various sizes, which are resized and center cropped to ﬁt into the input size of 32 × 32 .
• Chars74K.
The Chars74K dataset [8] contains 74,000 samples of 62 classes of characters found in natural images, handwritten text, and synthesized from computer fonts.
We used as OOD data only the EnglishImg dataset split, which contains 7705 characters from natural scenes.
We resized and center-cropped the images.
• Places365.
The Places365 dataset [46] contains images of 365 natural scenes categories.
We used the small images validation split as OOD data in our experiments.
It contains 36,500 RGB images which were downsampled from 256 × 256 to 32 × 32 .
• Gaussian.
For the Gaussian dataset, we generated 10,000 synthetic RGB images from 2D Gaussian noise, where each RGB pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and variance 1.0.
The pixel values are clipped to [0 , 1] interval.
This synthetic data was introduced in previous work as an easy benchmark [13].
C.4 Adversarial data generation
We generate adversarial samples from the in-distribution dataset using the fast gradient sign method (FGSM).
This method works by exploiting the gradients of the neural network to create a non-targeted adversarial attack.
For an input image x i , the method computes the sign of the gradients of the loss function J with respect to the input image to create a new image x
adv i that maximizes the loss as given by expression Eq.
This fabricated image is called an adversarial image, which we use for tuning the hyperparameters of the OOD detection methods in the W HITE -B OX case.
Mathematically,
[Equation]
where ε adv > 0 is the additive noise magnitude parameter.
Table 4 shows the resulting L ∞ mean perturbation and classiﬁcation accuracy on adversarial samples.
The Mahalanobis-based method in [20] ﬁts the DNN training data features as class-conditional Gaussian distributions. These use the outputs of every DNN latent block to leverage useful information for discrimination.
[Table]
For a test sample x , the conﬁdence score from the -th feature is calculated based on the Mahalanobis distance between f ( (cid:96) ) ( x ) and the closest class-conditional distribution:
[Table]
[Table]
where f ( (cid:96) ) ( x ) is the (cid:96) -th latent feature output, and (cid:98) µ ( (cid:96) ) y and (cid:98) Σ (cid:96) are, respectively, the empirical class mean and covariance matrix estimates. The covariance matrix is often not full rank, so the pseudo-inverse is calculated instead of the inverse.
In addition, input pre-processing and feature ensemble are also used to boost performance.
A logistic regression model learns the multiplicative weights α (cid:96) for each layer score, which predicts 1 for in-distribution and 0 for OOD examples from a mixture validation dataset. Finally, the Mahalanobis-based discriminator is given by thresholding expression (cid:80) (cid:96) α (cid:96) M (cid:96) ( x ) .
D Additional Out-Of-Distribution detection results
Table 5 shows compares I GEOOD to the current literetaure in the setup where no OOD data is available for tuning.
We show in Tables 6 and 7 additional results referring to the right-hand column and left-hand column of
Table 1, respectively.
[Table]
E Histograms
Figures 3 and 2 display histograms for the OOD detection score for I GEOOD and [20] in the W HITE -B OX with adversarial validation and W HITE -B OX with OOD data validation, respectively.
[Table] [Table] [Table] [Figure]
[Figure]