B AYESIAN V ARIATIONAL A UTOENCODERS FOR U NSUPERVISED O UT - OF -D ISTRIBUTION D ETECTION
Anonymous authors
Paper under double-blind review
A BSTRACT
Despite their successes, deep neural networks still make unreliable predictions when faced with test data drawn from a distribution different to that of the training data, constituting a major problem for AI safety.
While this motivated a recent surge in interest in developing methods to detect such out-of-distribution (OoD) inputs, a robust solution is still lacking.
We propose a new probabilistic, unsupervised approach to this problem based on a Bayesian variational autoencoder model, which estimates a full posterior distribution over the decoder parameters using stochastic gradient Markov chain Monte Carlo, instead of ﬁtting a point estimate.
We describe how information-theoretic measures based on this posterior can then be used to detect OoD data both in input space as well as in the model’s latent space.
The effectiveness of our approach is empirically demonstrated.
I NTRODUCTION
Outlier detection in input space.
While deep neural networks (DNNs) have successfully tackled complex real-world problems in various domains including vision, speech and language (Schmidhuber, 2015; LeCun et al., 2015; Goodfellow et al., 2016), they still face signiﬁcant limitations that make them unﬁt for safety-critical applications (Amodei et al., 2016).
One well-known shortcoming of DNNs is that when faced with test data points coming from a different distribution than the data the network was exposed to during training, the DNN will not only output wrong predictions, but it will do so with high conﬁdence.
The lack of robustness of DNNs to such out-of-distribution (OoD) inputs (or outliers/anomalies ) was recently addressed by the development of various methods to detect OoD inputs.
Most existing OoD detection approaches are task-speciﬁc in that they consider a certain prediction task (typically classiﬁcation) and use the corresponding output labels for the supervised training of a deep discriminative model to produce the desired target output as well as some conﬁdence score (Hendrycks & Gimpel, 2016;
Hendrycks et al., 2018; Liang et al., 2017).
Alternatively, task-agnostic OoD detection methods solely use the input data for the unsupervised training of a deep generative model (DGM).
One simple and seemingly sensible approach to detect a potential OoD input x ∗ is to train a likelihood-based DGM (e.g. a VAE, auto-regressive DGM, or ﬂow-based DGM) by (approximately) maximizing the likelihood p ( D | θ ) of the model parameters θ under the training data D , and to then estimate the probability p ( x ∗ | θ ) that x ∗ was generated by the model θ (Bishop, 1994): If p ( x ∗ | θ ) is large, then x ∗ must be in-distribution, and OoD otherwise.
However, recent works have shown that this likelihood-based approach does not work in general, as deep generative models sometimes assign higher probability to OoD data than to in-distribution data (Nalisnick et al., 2018; Choi & Jang, 2018).
Motivated by this ﬁnding, recent works have tried to develop more effective scores by correcting the likelihood estimate (Choi & Jang, 2018;
Ren et al., 2019; Nalisnick et al., 2019).
However, while these approaches improve upon the likelihood score, we argue that OoD detection scores which are fundamentally based on the likelihood values are not robust, as the likelihood estimates produced by commonly used DGMs are not reliable for OoD data, similar to how deep discriminative models produce unreliable output predictions on OoD data.
Outlier detection in latent space.
In a distinct line of research, recent works have tackled the challenge of efﬁciently optimizing a complex black-box function f : X → R , f ( x ) =
y deﬁned over high-dimensional, richly structured input domains X (e.g. graphs, images or text).
Given examples D
= { ( x i , y i ) }
Ni =1 , these methods jointly train a VAE on inputs x and a predictive model g : Z → R , g ( z ) =
y mapping from latent codes z to targets y , to then perform the optimization w.r.t.
y in the low-dimensional, continuous latent space Z instead of in input space X (G´omezBombarelli et al., 2018).
While these approaches have achieved state-of-the-art results in important domains including automatic chemical design and automatic machine learning (G´omez-Bombarelli et al., 2018; Luo et al., 2018; Lu et al., 2018), their practical effectiveness is limited by their ability to handle the following trade-off: They need to ﬁnd inputs x that both have a high target value y and are sufﬁciently novel (i.e., not too close to inputs in the training data D ), while at the same time ensuring that the optimization w.r.t.
y does not progress into regions of the latent space Z too far away from the training data, which might yield latent points z that decode to semantically meaningless and/or syntactically invalid inputs x (Kusner et al., 2017; Grifﬁths & Hern´andez-Lobato, 2017; Brookes et al., 2019; Mahmood & Hern´andez-Lobato, 2019;
Alperstein et al., 2019).
We observe that the required ability to quantify the semantic/syntactic distance of latent codes z to the training data directly corresponds to the ability to detect outliers in latent space Z .
Our approach.
In this work, we propose a principled, unsupervised, probabilistic method to simultaneously tackle the challenge of detecting outliers x ∗ in input space X (without directly relying on likelihood estimates) as well as outliers z ∗ in latent space Z .
To this end, we take an informationtheoretic perspective on OoD detection, and propose to use the (expected) informativeness of an input x ∗ / latent z ∗ as a proxy for whether x ∗ / z ∗ is OoD or not.
To quantify this informativeness, we take inspiration from information-theoretic active learning (MacKay, 1992) and leverage probabilistic inference techniques to maintain a posterior distribution over the parameters of a deep generative model, in particular of a variational autoencoder (VAE) (Kingma & Welling, 2013; Rezende et al., 2014).
This results in a Bayesian VAE (BVAE) model, where instead of ﬁtting a point estimate of the decoder parameters via maximum likelihood, we estimate their posterior distribution using samples generated via stochastic gradient Markov chain Monte Carlo (MCMC).
The informativeness of an unobserved input x ∗ / latent z ∗ is then quantiﬁed by measuring the (expected) change in the posterior over model parameters after having observed x ∗ / z ∗ .
In summary, our contributions are as follows: (a) We propose a Bayesian VAE model which uses state-of-the-art Bayesian inference techniques to estimate a posterior distribution over the decoder parameters (Section 3.2).
(b) We describe how this model can be used to detect outliers both in input space (Section 3.3) as well as in the model’s latent space (Section 3.4) using information-theoretic metrics.
(c) We empirically demonstrate that our approach outperforms state-of-the-art outlier detection methods (Section 5).
B ACKGROUND 2. V ARIATIONAL A UTOENCODERS
Consider a latent-variable model p ( x , z | θ ) with marginal likelihood p ( x | θ )
= (cid:82) p ( x , z | θ ) d z , where x are observed variables, z are local latent variables (i.e., individually tied to some x ), and θ are global latent variables (i.e., shared among all x ).
For clarity, we will mostly refer to z simply as latent variables (i.e., without the preﬁx local ), and to θ as model/decoder parameters .
We assume that p ( x , z | θ ) =
p ( x | z , θ ) p ( z ) , i.e., the joint density p ( x , z | θ ) factorizes into a prior distribution p ( z ) on the local latent variables z and a parameterized likelihood p ( x | z , θ ) of the observed variables x given z .
We furthermore assume the z to be continuous, such that computing p ( x | θ ) in generally intractable.
Such a model is called a variational autoencoder (VAE) (Kingma & Welling, 2013;
Rezende et al., 2014) if θ are the parameters of a deep neural network, and the corresponding intractable posterior distribution p ( z | x , θ ) over the latent variables z is approximated using amortized variational inference via another deep neural network q ( z | x , φ ) parameterized by φ (typically called the encoder, inference network or recognition network).
Given some dataset D = { x i } Ni =1 of N input vectors x i ∈ X drawn i.i.d.
from some underlying data distribution p ∗ ( x ) , the parameters θ and φ of a VAE are then learned by maximizing the evidence lower bound (ELBO)
L θ,φ , which is a lower bound to the marginal log-likelihood log p ( x | θ ) , i.e.,
[Equation]
for some input x ∈ D .
By independence, L θ,φ ( D ) =
(cid:80) x ∈ D
L θ,φ ( x ) .
Since maximizing the ELBO approximately maximizes log p ( D | θ ) , this training procedure can be viewed as approximate max- imum likelihood estimation (MLE).
In practice, L θ,φ ( x ) in Eq.
(1) is maximized by mini-batch stochastic gradient-based optimization using low-variance, unbiased, stochastic Monte Carlo estimators of ∇L θ,φ obtained via the reparametrization trick.
Finally, one can approximate the probability p ( x | θ, φ ) of a data point x under the generative model via importance sampling w.r.t.
the variational posterior q ( z | x , φ ) , i.e.,
[Equation]
Note that the likelihood p ( x | θ, φ ) in Eq.
(2) is conditioned on both θ and φ , to make explicit the dependence on the parameters φ of the proposal distribution q ( z | x , φ ) .
2. B AYESIAN L EARNING IN N EURAL N ETWORKS VIA S TOCHASTIC G RADIENT MCMC
To generate samples θ ∼ p ( θ | D ) of parameters θ of a deep neural network, one can use state-ofthe-art stochastic gradient Markov chain Monte Carlo methods such as stochastic gradient Hamiltonian Monte Carlo (SGHMC).
Hamiltonian Monte Carlo (HMC) (Duane et al., 1987; Betancourt, 2017) is a method for generating samples θ ∼ p
( θ | D ) in a Metropolis-Hastings framework that efﬁciently explores the state space.
In particular, consider the posterior distribution p ( θ | D )
∝ exp( − U ( θ, D )) with potential energy function U ( θ, D ) =
− log p ( D , θ )
= − log( p ( D | θ ) p ( θ ))
=
− (cid:80) x ∈ D log p ( x | θ ) − log p ( θ ) induced by the prior p ( θ ) and marginal log-likelihood log p ( x | θ ) .
HMC generates samples θ ∼ p ( θ | D ) by simulating Hamiltonian dynamics, which involves evaluating the gradient ∇ θ U ( θ ) of U .
However, direct computation of this gradient requires examination of the entire dataset D (due to the summation of the log-likelihood over all x ∈ D ), which might become prohibitively costly for large datasets.
To tackle this issue, Chen et al.
(2014) recently proposed a scalable HMC variant called stochastic gradient Hamiltonian Monte Carlo (SGHMC), which considers a noisy, unbiased estimate of the gradient computed from a minibatch M of points sampled uniformly at random from D (i.e., akin to minibatch-based optimization algorithms such as variants of stochastic gradient descent), i.e.,
[Equation]
B AYESIAN V ARIATIONAL A UTOENCODERS FOR O O D D ETECTION 3. M OTIVATION AND I NTUITION
We take the following information-theoretic perspective on OoD detection.
Consider an active learning scenario, where we have computed an estimate of our model parameters θ based on some observations D , and want to add an unobserved input x ∗ to the training set D to improve our estimate of θ as much as possible.
To this end, in information-theoretic active learning (MacKay, 1992), it is observed that every potential input x ∗ contains a certain amount of information about the values of the model parameters.
In other words, every data point x ∗ helps us to some extent in updating our model parameters to ﬁnd the optimal ones which capture the true underlying data-generating process.
Now, we argue that inputs which are uninformative about the model parameters are likely similar to the data points already in the training set D , i.e., they are likely in-distribution inputs.
In contrast, inputs which are very informative about the model parameters are likely different from everything we have seen so far in the training data D , i.e., they are likely OoD inputs.
We thus propose to use the informativeness of a datum x ∗ as a proxy for whether x ∗ is OoD or not.
To quantify this informativeness, information-theoretic active learning approaches leverage probabilistic inference techniques to maintain a posterior distribution p ( θ | D ) over model parameters θ given data D (i.e., instead of ﬁtting a point estimate of θ via maximum likelihood estimation).
Given this posterior p ( θ | D ) , the informativeness of an unobserved datum x ∗ is then quantiﬁed by measuring the (expected) change in the posterior after having observed x ∗ , i.e., the change required to update p ( θ | D ) to the posterior p ( θ | D ∪ { x ∗ } ) .
We follow this approach and propose to use a Bayesian VAE (BVAE) model, where instead of ﬁtting a point estimate of the parameters via maximum likelihood, we estimate their posterior distribution using samples generated via stochastic gradient MCMC.
3. T HE B AYESIAN VAE (BVAE)
In contrast to an ordinary VAE, where we ﬁt the generative model parameters θ via (approximate)
MLE, i.e., θ MLE = arg max θ L ( D ) θ,φ , to obtain the likelihood p ( x | z , θ MLE ) , we place a prior p ( θ ) over θ and estimate its full posterior distribution p ( θ | D )
∝ p ( D | θ ) p
( θ ) , to induce the generator likelihood p ( x | z , D ) =
(cid:82) p ( x | z , θ ) p ( θ | D ) dθ =
E p ( θ | D )
[ p ( x | z , θ )] .
This induces the marginal likelihood
[Equation]
which marginalizes over both the local latent variables z and the global latent variables θ .
The generative process deﬁned in Eq.
(4) ﬁrst draws a latent vector z ∼ p ( z ) from its prior and a decoder parameterization θ ∼ p ( θ | D ) from its posterior, and then generates x ∼ p ( x | z , θ ) by passing both through the likelihood.
Training this model now involves performing Bayesian inference over both z and θ , resulting in the posterior p ( z | x , D ) over z and the posterior p ( θ | D ) ∝ p ( D | θ ) p ( θ ) over θ .
Since both posteriors are intractable for the model we consider, we will now discuss how to approximate inference over z and θ , respectively.
3.2. I NFERENCE OVER THE LATENT VARIABLES z
To estimate the posterior p ( z | x , D ) over z , we follow an ordinary VAE and resort to amortized variational inference via a recognition network q ( z | x , φ ) with variational parameters φ , using the
ELBO L θ,φ ( x ) ≤ log p ( x | θ ) in Eq.
We learn the encoder parameters φ via approximate MLE, using a low-variance, unbiased Monte Carlo estimator of the stochastic gradient ∇ φ L θ,φ ( x ) , i.e., ∇ φ L θ,φ ( x ) (cid:39) 1 L (cid:80) Ll =1 ∇ φ log [ p ( x | z l , θ )] − ∇ φ D KL ( q ( z | x , φ ) (cid:107) p ( z )) , z l ∼ q ( z | x , φ ) (5) where the posterior samples z l ∼ q ( z | x , φ ) are generated using the reparametrization trick.
3.2. I NFERENCE OVER THE MODEL PARAMETERS θ
To generate posterior samples θ ∼ p ( θ | D ) of decoder parameters (e.g. as required to approximate the gradient ∇ φ L φ ( x ) in Eq.
(5)), we propose to use SGHMC (cf.
Section 2).
However, the gradient of the energy function ∇ θ U ( θ, M ) in Eq.
(3) used for simulating the Hamiltonian dynamics requires us to evaluate the log-likelihood log p ( x | θ ) , which is intractable in a VAE and thus also in our model.
To alleviate this issue, we approximate the log-likelihood appearing in ∇ θ U ( θ, M ) by the ELBO L θ,φ ( x ) of an ordinary VAE in Eq.
Given a set Θ = { θ m } Mm =1 of posterior samples θ m ∼ p ( θ | D ) , we can more intuitively think of working with a ﬁnite mixture/ensemble of decoders/generative models p ( x | z , D ) =
E p ( θ | D )
[ p ( x | z , θ )] (cid:39) 1 M (cid:80) θ ∈ Θ p ( x | z , θ ) (cf.
Eq.
3.2. I NFERENCE OVER THE VARIATIONAL PARAMETERS φ
Recall that the goal of amortized variational inference is to learn how to do posterior inference, by ﬁnding the optimal parameters φ MLE = arg max φ L ( D ) θ,φ (cf.
Eq.
(1)) of an inference network i : X → Ψ : i φ ( x ) =
ψ mapping inputs x to parameters ψ of the variational posterior q ψ ( z ) =
q ( z | x , φ ) over z .
However, one fundamental shortcoming of ﬁtting an inference network via MLE is that the model q ( z | x , φ MLE ) will not generalize to OoD inputs, but instead produce conﬁdently wrong posterior inferences for OoD inputs.
To alleviate this issue, we refrain from ﬁtting a point estimate φ MLE , and instead consider a Bayesian treatment of the variational parameters φ (i.e., in addition to the Bayesian treatment of the decoder parameters θ discussed earlier).
While this might seem strange conceptually, it allows us to quantify our epistemic uncertainty in the amortized inference of z , intuitively increasing the ﬂexibility of the recognition network.
We thus also place a prior p ( φ ) over φ and infer the posterior p ( φ | D ) ∝ p
( D | φ ) p ( φ ) , yielding the amortized posterior q ( z | x , D ) =
[Equation] [Equation]
[Equation] [Equation]
j ∼ p (
[Equation]
|
[Equation]
We also use SGHMC to generate the posterior samples φ j ∼ p ( φ | D ) , again approximating the loglikelihood log p ( x | φ, D ) in ∇ φ U ( φ, M ) (cf.
Eq.
(3)) by the ELBO L θ,φ ( x ) in Eq.
Given a set Φ = { φ j } Mj =1 of posterior samples φ j ∼ p ( φ | D ) , we can again more intuitively think of Eq.
(6) as deﬁning a ﬁnite mixture/ensemble of inference networks q ( z | x , D ) (cid:39)
Inference over θ revisited.
When doing inference over both φ and θ , we need to slightly adapt the
SGHMC sampling procedure for the decoder parameters θ ∼ p ( θ | D ) described in Section 3.2.2.
In particular, instead of using the ELBO L θ,φ ( x ) of an ordinary VAE in Eq.
(1) (which is based on the recognition network q ( z | x , φ ) and thus depends on both θ and φ ), we now need to use the ELBO
[Equation]
which depends on θ only, as it is based on the encoder mixture q ( z | x , D ) in Eq.
(6) and thus integrates the variational parameters φ over their posterior p ( φ | D ) .
We then obtain an approximation to the stochastic gradient ∇ θ U ( θ, M ) in Eq.
(3) by using a Monte Carlo approximation of the gradient ∇ θ L θ ( x ) of the ELBO in Eq.
(7), i.e.,
[Equation]
The z l ∼ q ( z | x , D ) are sampled from the encoder mixture in Eq.
(6) by ﬁrst sampling the index of the mixture component uniformly at random, i.e., j ∼ U [1 , M ] (due to the mixture weights all being 1 /M ), and then sampling the latent vector z l from the j -th mixture component, i.e., z l ∼ q ( z | x , φ j ) .
3. D ETECTING O UTLIERS IN I NPUT S PACE
Training a BVAE (see Appendix B for pseudocode) yields the sets Φ = { φ j } Mj =1 and Θ = { θ m } Mm =
of posterior samples φ j ∼ p ( φ | D ) and θ m ∼ p ( θ | D ) of encoder and decoder parameters, respectively.
Given these samples, we follow ideas from information-theoretic active learning (MacKay, 1992) (cf.
Section 1) and aim to detect if a certain test input x ∗ is OoD based on its informativeness about the model parameters θ , as measured by the change in the posterior distribution over θ after having observed x ∗ .
In particular, assume that given some data D and prior p ( θ ) , we have inferred the posterior p ( θ | D )
= p ( D | θ ) p ( θ ) (cid:82) p ( D | θ ) p ( θ ) dθ = p
( D | θ ) p ( D )
p
( θ ) over θ .
In a sequential Bayesian setting, the posterior p ( θ | D ) then serves as the new prior, which, given a new observation x ∗ , is updated to the posterior p ( θ | D ∪ { x ∗ } ) =
[Equation]
p
[Equation]
p
[Equation]
|
[Equation]
) , i.e., by multiplying p ( θ | D ) by the normalized likelihood p ( x ∗ | θ ) p ( x ∗ | D ) .
The intuition now is as follows: If x ∗ is very different from the previous observations in D , then the updated posterior p ( θ | D ∪ { x ∗ } ) will likely be different from p ( θ | D ) , to capture the atypicality of x ∗ .
In contrast, if x ∗ is very similar to the observations in D , then the posterior p ( θ | D ∪ { x ∗ } ) will also be similar to the previous one p ( θ | D ) .
Thus, to detect whether x ∗ is OoD or not, we aim to quantify the change from p ( θ | D ) to p ( θ | D ∪ { x ∗ } ) , which is captured by the factor p ( x ∗ | θ ) p ( x ∗ | D ) .
Since in our case, the posterior p ( θ | D ) is represented by the ﬁnite set of samples Θ , we ﬁnd ourselves in a sequential Monte Carlo (or particle ﬁltering) setting, such that for a given parameter/particle θ and input x ∗ , the normalized likelihood p ( x ∗ | θ ) p ( x ∗ | D ) can be written as p
[Equation]
x
[Equation]
where w θ ∈ [0 , 1] and (cid:80) θ ∈ Θ w θ = 1 .
The scalar w θ deﬁned in Eq.
(9) can be interpreted as the probability that x ∗ was generated from the particle θ , thus measuring how well x ∗ is explained by the model θ (and thus how useful θ is for describing the updated posterior p ( θ | D ∪{ x ∗ } ) ), relative to the other particles.
More formally, the values [ w θ ] θ ∈ Θ correspond to the importance weights of the samples/particles θ ∈ Θ drawn from the proposal distribution p
( θ | D ) (i.e., the previous posterior) for an importance sampling-based Monte Carlo approximation of an expectation w.r.t.
the target distribution p ( θ | D ∪ { x ∗ } ) (i.e., the updated posterior after having observed x ∗ ), i.e.,
[Equation]
(10) for some function f : Θ → R .
To measure the change in distribution from p ( θ | D ) to p ( θ | D ∪{ x ∗ } ) , we can then use the weights [ w θ ] θ ∈ Θ to compute the effective sample size (ESS)
[Equation]
such that ESS Θ ( x ∗ ) ∈
[1 , M ] .
[Equation]
The ESS ( x ∗ ) is a widely used measure for the efﬁciency of the estimator in Eq.
(10), and measures how many i.i.d.
samples drawn from the target posterior p ( θ | D ∪{ x ∗ } ) are equivalent to the M samples θ ∈ Θ drawn from the proposal posterior p ( θ | D ) and weighted according to w θ .
It intuitively quantiﬁes the degree of agreement between the particles θ ∈ Θ as to how probable the input x ∗ is, inducing the following decision rule: If ESS ( x ∗ ) is large, then [ w θ ] θ ∈ Θ is close to the uniform distribution [ 1 M ] θ ∈ Θ (for which ESS ( x ∗ ) = M ), meaning that all particles θ ∈ Θ explain x ∗ equally well and are in agreement as to how probable x ∗ is.
Thus, x ∗ likely is an in-distribution input.
Conversely, if ESS ( x ∗ ) is small, then [ w θ ] θ ∈ Θ contains a few large weights (i.e., corresponding to particles that by chance happen to explain the datum well), with all other weights being very small, where in the extreme case, [ w θ ] θ ∈ Θ = [0 , . . .
. , 0] (for which ESS ( x ∗ ) = 1 ).
This means that the particles do not agree as to how probable x ∗ is, so that x ∗ likely is an OoD input.
Finally, we discuss how to compute the likelihood p ( x | θ ) of the BVAE given an input x required to compute the weight w θ in Eq.
We consider two approaches based on importance sampling, with different proposal distributions for sampling the latent codes z k depending on the assumed relationship between the samples Θ of decoder parameters and the samples Φ of encoder parameters: 1.
Firstly, one may treat the samples in Θ and Φ as being coupled as ( θ m , φ m ) ∈ { ( θ m , φ m ) }
Mm =1 , where each pair ( θ m , φ m ) effectively deﬁnes a separate VAE.
This is motivated by the fact that in practice, we for simplicity do indeed take samples of full VAEs, by simultaneously sampling from p ( θ | D ) and p ( φ | D ) , as outlined in Algorithm 1 in Appendix B. Since such a coupled sample ( θ m , φ m ) deﬁnes a VAE, the likelihood can then simply be computed as in a regular VAE, i.e., p ( x | θ m ) =
p ( x | θ m , φ m ) as deﬁned in Eq.
(2), using the proposal distribution q ( z | x , φ m ) .
Secondly, one may decouple the samples in Θ and Φ and treat them as being independent of each other.
In particular, for a given decoder sample θ m , instead of using the corresponding sample φ m as the encoder, we may view the encoder as the mixture q ( z | x , D ) (cid:39) 1 M (cid:80) φ ∈ Φ q ( z k | x , φ ) in
Eq.
(6) deﬁned by all samples in Φ .
The likelihood is then estimated as p ( x | θ ) =
p ( x | θ, D ) with p
[Equation]
[Equation]
where the proposal distribution now is the mixture q ( z | x , D ) instead of q ( z | x , φ ) .
Since q ( z | x , D ) marginalizes over encoder parameters φ , the likelihood in Eq.
(12) only depends on θ .
3. D ETECTING O UTLIERS IN L ATENT S PACE
Detecting outliers in latent space involves identifying latent vectors z ∗ which are very different from the latent vectors corresponding to the training inputs D , and which will thus yield unpredictable results when passed through the decoder to produce p ( x | z ∗ , θ ) .
To discriminate if a given latent vector z ∗ is an outlier or not, we follow the same approach as in Section 3.3 and quantify the informativeness of z ∗ on the model parameters θ by measuring the change in the posterior p ( θ | D ) .
However, quantifying this change in posterior by e.g. computing the ESS metric in Eq.
(11) requires evaluating the likelihood p ( x ∗ | θ ) of the input x ∗ corresponding to the latent code z ∗ , which is not available to us.
We thus alternatively quantify the expected change in the posterior p ( θ | D ) by computing the expected ESS, by averaging over the likelihood mixture p ( x | z ∗ , D ) (cf.
Section 3.2), thus effectively taking into account all possible inputs x ∗ corresponding to z ∗ , i.e.,
[Equation]
where the inputs x n are sampled from the decoder mixture p ( x | z ∗ , D ) by ﬁrst sampling the index of the mixture component uniformly at random, i.e., m ∼ U [1 , M ] (due to the mixture weights all being 1 /M ), and then sampling x n from the m -th mixture component, i.e., x n ∼ p ( x | z ∗ , θ m ) .
In contrast to computing the ESS in Eq.
(11) for outlier detection in input space, where we had to estimate the likelihoods via importance sampling using the (mixture of) inference network(s), computing the likelihoods p ( x n | z ∗ , θ ) in Eq.
(13) simply involves passing the given latent code z ∗ through the decoders parameterized by θ ∈ Θ .
In fact, the encoding part of the model is not required for outlier detection in latent space.
If we are only interested in outlier detection in latent space, we thus do not face any of the issues arising from the recognition network making wrong inferences for
OoD inputs, and as a result do not require a Bayesian treatment of the encoder parameters φ .
R ELATED W ORK
Supervised/Discriminative outlier detection methods Most existing OoD detection approaches are task-speciﬁc and designed for the context of a certain prediction task.
As described in Section 1, these approaches train a deep discriminative model in a supervised fashion using the given labels.
To detect outliers w.r.t.
the target task, many approaches then rely on a conﬁdence score to decide on the reliability of the prediction, which is either produced by modifying the model and/or training procedure, or computed/extracted post-hoc from the model and/or predictions (DeVries & Taylor, 2018;
An & Cho, 2015; S¨olch et al., 2016; Ahmed & Courville, 2019; Sricharan & Srivastava, 2018; Hendrycks & Gimpel, 2016; Hendrycks et al., 2018; Liang et al., 2017; Shafaei et al., 2018).
Alternatively, one can use predictive uncertainty estimates for OoD detection (Malinin & Gales, 2018; Gal & Ghahramani, 2016; Lakshminarayanan et al., 2017; Osawa et al., 2019; Ovadia et al., 2019).
One drawback of such task-speciﬁc approaches is that discriminatively trained models by design discard all input features which are not informative about the speciﬁc prediction task, such that information which is relevant for OoD detection might be lost.
Unsupervised/Generative outlier detection methods In contrast, task-agnostic OoD detection methods solely use the input data for the unsupervised training of a deep generative model, which makes them more general, as they do not require the availability of labels for some prediction task.
Moreover, these approaches capture the entire input data distribution via the generative model, which might be beneﬁcial for OoD detection (it was shown that despite not exploiting label information, unsupervised approaches often work better in practice (Ren et al., 2019)).
Perhaps closest to our approach is the recent work by Choi & Jang (2018), which use an ensemble (Lakshminarayanan et al., 2017) of independently trained likelihood-based generative models (i.e., with random parameter initializations and random data shufﬂing) to approximate the Watanabe-Akaike Information
Criterion (Watanabe, 2010)
E p ( θ | D )
[log p ( x ∗ | θ )]
− Var p ( θ | D ) [log p ( x ∗ | θ )] .
The WAIC provides an asymptotically correct estimate between the training and test set expectations (assuming a ﬁxed underlying data distribution) and can be viewed as a corrected log-likelihood score which penalizes points x with a large variance in log-likelihoods.
Their approach has two shortcomings as compared to ours: Firstly, while we use stochastic gradient MCMC on a single model to obtain M approximate posterior samples, they train M independent models to form an ensemble, which (a) is not a principled way of doing approximate Bayesian inference (although connections can be made (Mandt et al., 2017) under certain conditions), and (b) is M times more computationally expensive in practice.
Secondly, independent of the quality of the posterior approximation, their score is not expected to work well, since it still relies on the suboptimal log-likelihood estimates (as we will demonstrate in the experiments).
Another recent unsupervised approach is the likelihood ratio method by Ren et al.
(2019), which corrects the likelihood log p ( x ∗ | θ ) for confounding general population level background statistics captured by a background model p ( x ∗ | θ 0 ) , resulting in the score log p ( x ∗ | θ ) − log p ( x ∗ | θ 0 ) .
The background model p ( x ∗ | θ 0 ) is in practice trained by perturbing the data D with noise to corrupt its semantic structure, i.e., by sampling input dimensions i.i.d.
from a Bernoulli distribution with rate µ ∈ [0 . 1 , 0 . 2] and replacing their values by uniform noise, e.g. x i ∼ U{ 0 , . . .
, 255 } for images.
Finally, Nalisnick et al.
(2019) proposed to use the score (cid:12)(cid:12) log p ( x ∗ | θ ) − 1 N (cid:80) x ∈ D log p ( x | θ ) (cid:12)(cid:12) to account for the typicality of the input x ∗ .
E XPERIMENTS
We now present some experimental results showing the competitiveness of our approach.
5. O UT - OF - DISTRIBUTION DETECTION IN INPUT SPACE
BVAE details.
We implemented the proposed BVAE model in PyTorch (see Appendix B for pseudocode), using the robust, scale adapted SGHMC variant proposed by Springenberg et al.
We follow Chen et al.
; Springenberg et al.
and use Gaussian priors over θ and φ , i.e., p ( θ )
= N (0 , λ − 1 θ ) and p ( φ ) =
N (0 , λ − 1 φ ) .
We also place Gamma hyperpriors over the precision parameters λ θ and λ φ , i.e., p ( λ θ ) =
Γ( α θ , β θ ) and p ( λ φ ) =
Γ( α φ , β φ ) , with α θ = β θ = α φ = β φ = 1 , and resample λ θ and λ φ after every training epoch (i.e., after an entire pass over D ).
We also follow the previous work and use a step size of 10 − 3 and momentum decay of 0 . 05 for SGHMC.
We discard samples within a burn-in phase of B = 1 epoch, and store a sample (of both encoder and decoder parameters) after every D = 1 epoch.
We only keep the 10 most recent samples to represent the posterior.
In addition to the BVAE described in Section 3.2 which uses the two ELBOs L θ,φ in Eq.
(1) and L θ in Eq.
(7) to train/sample from φ and θ , respectively (denoted by
BVAE )
, we also report results on the following variants: a BVAE that uses the ordinary VAE ELBO in Eq.
(1) for both φ and θ ( (cid:94) BVAE ; see Appendix C for pseudocode) and a VAE where only θ is integrated out and φ is estimated via maximum likelihood ( BVAE θ ).
We furthermore consider both alternative ways of estimating the log-likelihoods for computing the ESS (cf.
Section 3.3), i.e., the case where log-likelihoods are computed using samples Φ of encoders and Θ of decoders that are treated as independent ( ESS ), and the case where the log-likelihoods are computed using coupled samples { ( φ j , θ j ) } Mj =
( ESS θφ ).
Experimental setup.
We use two benchmarks: (a) FashionMNIST (in-distribution) vs. MNIST (OoD)
(Hendrycks et al., 2018; Nalisnick et al., 2018;
Ren et al., 2019; Zenati et al., 2018;
Akcay et al., 2018), and (b) eight classes of FashionMNIST (in-distribution) vs. the remaining two classes (OoD), using ﬁve different splits { (0 , 1) , (2 , 3) , (4 , 5) , (6 , 7) , (8 , 9) } of held-out classes (Ahmed &
Courville, 2019).
We compare against the log-likelihood ( LL ) as well as three state-of-the-art methods for unsupervised OoD detection (all described in Section 4): (1) The generative ensemble based method by Choi & Jang (2018) composed of ﬁve independently trained models ( WAIC ), (2) the likelihood ratio method by Ren et al.
(2019) ( LLR ), using Bernoulli rates µ = 0 .
2 for the FashionMNIST vs. MNIST experiment (Ren et al., 2019), and µ = 0 .
15 for the other experiment, and (3) the test for typicality by Nalisnick et al.
(2019) ( TT ).
All methods use VAEs for the log-likelihood [-estimation 
-]estimation.
They are evaluated by randomly selecting 5000 in-distribution and OoD inputs from held-out test sets and computing the following threshold independent metrics (Hendrycks & Gimpel, 2016; Liang et al., 2017; Hendrycks et al., 2018;
Alemi et al., 2018;
Ren et al., 2019): (i) The area under the ROC curve (AUROC ↑ ), (ii) the area under the precision-recall curve (AUPRC ↑ ), and (iii) the false-positive rate at 80% true-positive rate (FPR80 ↓ ).
Results.
Table 1 shows that our approaches generally perform better on the considered benchmarks.
Coupling the encoder and decoder samples appears beneﬁcial, which might be due to the fact that we actually take the samples in couples after every epoch.
Being Bayesian about the encoder parameters φ also seems to help.
Fig.
2 show the precision-recall and ROC curves used to compute the metrics, for the FashionMNIST vs. MNIST experiment (see Appendix E for the curves for the other experiment).
Fig.
1 shows histograms of the log-likelihoods (left) and of the BVAE-ESS scores (right) on FashionMNIST in-distribution (blue) vs. MNIST OoD (orange) test data.
While the log-likelihoods strongly overlap, the ESS scores more clearly separate in-distribution data (closer to
ESS = 10 on the r.h.s.)
from OoD data (closer to ESS = 1 on the l.h.s.).
5. O UT - OF - DISTRIBUTION DETECTION IN LATENT SPACE
While input space OoD detection is a well-studied problem, OoD detection in latent space was only recently identiﬁed as an important open problem (G´omez-Bombarelli et al., 2018; Grifﬁths &
Hern´andez-Lobato, 2017; Mahmood & Hern´andez-Lobato, 2019; Alperstein et al., 2019) (see also
Section 1).
Thus, there is a lack of suitable experimental benchmarks, making a quantitative evaluation challenging.
A major issue in designing toy benchmarks based on commonly-used datasets such as MNIST or FashionMNIST (i.e., as typically used for assessing input space OoD detection) is that it is not clear how to obtain ground truth labels for which latent points are OoD and which are not, as we require OoD labels for all possible latent vectors z ∗ ∈ R d , not just for those corresponding to inputs x ∗ from some training or test set.
As a ﬁrst step to facilitate a systematic empirical evaluation of latent space OoD detection techniques, we propose the following experimental protocol.
We use the BVAE variant where only θ is integrated out and φ is estimated via maximum likelihood (denoted by BVAE θ in Section 5.1, using the same prior and hyperprior as described there). We [Table] in
[Figure] MNIST (out-of-distribution). The ESS score separates the data more clearly than the LL score. [Figure]
[Figure]
[Figure]
[Figure]
P r e c
i s i o n
Precision-Recall curves (out)
LL LLR TT
WAIC BVAE-ESS BVAE-ESS
BVAE -ESS BVAE -ESS
BVAE -ESS
[Figure]
train this BVAE model on some dataset (we will use FashionMNIST here), and then sample N = 10000 latent test vectors z ∗ from the Gaussian N ( 0 , b · I d ) where b ∈ R + , following Mahmood &
Hern´andez-Lobato (2019) (we use b = 10000 ).
Since there does not exist a ground truth label for whether a given latent point z ∗ is OoD or not, we instead compute some OoD proxy score (to be detailed below) for each of the N latent test vectors and then simply deﬁne the N/ 2 latents with the lowest scores to be in-distribution, and the N/ 2 latents with the highest scores to be OoD.
For this OoD score, we propose to train an ensemble of J convolutional neural network classiﬁers with parameters W = { w j } Jj =1 on FashionMNIST (Lakshminarayanan et al., 2017).
We then approximate the mutual information score 4 proposed by Houlsby et al.
(2011), i.e., I ( w , y | x ∗ , D )
=
H ( p ( y | x ∗ , D ))
− E p ( w | D )
[ H ( p ( y | x ∗ , w ))] , where E p ( w | D )
[ H ( p ( y | x ∗ , w ))] (cid:39)
J (cid:80) w ∈ W H ( p ( y | x ∗ , w )) is the average entropy of the predictive class distribution of the classiﬁer with parameters w , and H ( p ( y | x ∗ , D ))
(cid:39) H (cid:0) 1 J (cid:80) w ∈ W p ( y | x ∗ , w ) (cid:1) is the entropy of the mixture 1 J (cid:80) w ∈ W p ( y | x ∗ , w ) of categorical distributions p ( y | x ∗ , w ) (which is again categorical with averaged probits).
Note that this score requires a test input x ∗ .
Since in our setting, we only know the latent code z ∗ corresponding to x ∗ , we instead use the expected mutual information under the mixture decoding distribution p ( x | z ∗ , D ) deﬁned by the decoder ensemble Θ , i.e.,
E p ( x | z ∗ , D )
[ I ( w , y | x , D )] (cid:39) 1 N (cid:80)
Nn
=
I ( w , y | x n , D ) where x n ∼ p ( x | z ∗ , D ) .
In practice, we use an ensemble of J = 5 classiﬁers and N = 32 input samples for the expectation.
We compare the expected ESS (see Section 3.4, with N = 32 ) against two baselines: (a) The distance of z ∗ ∈ R d to the spherical annulus of radius √ d − 1 , since that is where most probability mass lies under our prior N ( 0 , I d ) ( Annulus ) (Alperstein et al., 2019).
(b) the log-probability of z ∗ under the training data distribution in latent space q ( z )
= 1 N (cid:80) x ∈ D q ( z | x , φ ) , i.e., a uniform mixture of N Gaussians in our case ( qz )
(Mahmood & Hern´andez-Lobato, 2019).
Fig.
3 shows that our proposed method signiﬁcantly outperforms the two baselines on this benchmark task.
C ONCLUSION
We proposed a new approach to unsupervised out-of-distribution detection in input space as well as in latent space, using information-theoretic metrics based on the approximated posterior over the parameters of a variational autoencoder.
For future work, we are keen to explore extensions of our approach to (i) state-of-the-art VAE architectures (e.g., using more sophisticated posteriors (Rezende & Mohamed, 2015), priors (Tomczak & Welling, 2017; Papamakarios et al., 2017; Bauer & Mnih, 2019), decoders, etc., which is all complementary); (ii) use alternative lower bounds to the marginal log-likelihood, such as the importance weighted lower bound used in an IWAE (Burda et al., 2015), or combinations of the VAE and IWAE lower bounds, as proposed in (Rainforth et al., 2018); (iii) alternative approximate inference techniques for estimating the posterior distribution over model parameters; (iv) other likelihood-based deep generative models (e.g., ﬂow-based and auto-regressive deep generative models); (v) exploit label information (e.g., by using a hybrid model combining our
BVAE with a predictive model, to enable semi-supervised OoD detection)
A SVHN VS . CIFAR10 RESULTS FOR O O D DETECTION IN INPUT SPACE
We performed additional experiments on OoD detection in input space on the higher-dimensional
SVHN (in-distribution) vs. CIFAR10 (OoD) benchmark 6 (Hendrycks et al., 2018; Nalisnick et al., 2019; Choi & Jang, 2018), following the same experimental protocol as described in Section 5.1. Looking at Table 2 and Fig. 5, we arrive at the same conclusion as with the benchmarks considered in Section 5.1 in that our approaches appear to signiﬁcantly outperform the baselines we compare against. While the variants BVAE-ESS and BVAE-ESS θφ are not as strong as the other BVAE-ESS variants on this benchmark (as compared to the benchmarks considered in Section 3.3), they still outperform the other baselines.
The histograms in Fig.
4 again show that the BVAE-ESS scores (right) more clearly separate in-distribution data from OoD data than the log-likelihood scores (left).
[Table]
-ESS θφ
[Table]
[Table]
θφ
[Table]
BVAE θ -ESS
[Table] [Figure] B P SEUDOCODE OF BVAE TRAINING PROCEDURE Algorithm 1 shows the overall Bayesian VAE (BVAE) training procedure, which produces sets Φ = { φ B , φ B + D , φ B +2 D , . .
. , φ T } and Θ = { θ B , θ B + D , θ B +2 D , . .
, θ T } of M =
( T − B ) /D
+ sequentially generated posterior samples φ t ∼ p ( φ | D ) and θ t ∼ p ( θ | D ) that do not fall into the
Markov chain’s burn-in phase of B epochs and are D epochs apart from each other (to avoid correlation).
Note that Algorithm 1 can in practice be conveniently implemented by exploiting automatic differentiation tools commonly employed by modern deep learning frameworks. [Figure] 1.0 Recall 0. P r e c
i s i o n
Precision-Recall
(out) LL LLR TT WAIC BVAE-ESS BVAE-ESS BVAE -ESS BVAE -ESS
BVAE -ESS 0.
[Figure]
Recall
[Figure]
[Figure]
P r
[Figure]
i
[Figure]
i
[Figure]
n
[Figure]
ROC
[Figure]
Input: Dataset D , generative model p ( x , z , θ ) , inference model q ( z | x , φ ) , burn-in length B , sample distance D , mini-batch size | M |
Initialize φ 0 , θ 0 and Φ = ∅ , Θ = ∅
Deﬁne number of mini-batches per epoch N b = | D | | M | for t = 1 , . .
, T do
Set ˆ φ 0 =
φ t − 1 , ˆ θ
= θ t −for b = 1 , . .
. , N b do
Sample minibatch M ∼ D
Set Θ ∗ =
{ ˆ θ b − 1 } if t ≤ B else Θ ∗ =
Θ
Set Φ ∗ =
{ ˆ φ b − 1 } if t ≤ B else Φ ∗ =
Φ
Compute ∇ φ ˜ U
(ˆ φ b − 1 , Θ ∗ , M ) , update ˆ φ b − 1 → ˆ φ b via SGHMC
Compute ∇ θ ˜ U
(ˆ θ b − 1 , Φ ∗ , M ) , update ˆ θ b − 1 → ˆ θ b via SGHMC end for
Set φ t =
ˆ φ N b , θ t
= ˆ θ N b if t ≥ B and ( t − B ) mod D = 0 then
Add Φ = Φ ∪ { φ t } and Θ =
Θ ∪ { θ t } end if end for
Output: Posterior samples Φ and Θ ∇ φ ˜ U
(ˆ φ b − 1 , Θ ∗ , M ) and ∇ θ ˜ U
(ˆ θ b − 1 , Φ ∗ , M ) are approximations to the stochastic gradient in Eq.
(3) required for the SGHMC updates, deﬁned as
[Equation]
[Equation] with ELBO gradient ∇ φ L ˆ φ b − 1 ( x ) as in Eq.
(5), and ∇
[Equation]
15) with ELBO gradient ∇ θ L ˆ θ b − 1 ( x ) as in Eq.
C P SEUDOCODE OF ALTERNATIVE BVAE TRAINING PROCEDURE
Algorithm 2 shows pseudocode of an alternative Bayesian VAE (BVAE) training procedure, which essentially is identical to the training of an ordinary VAE, but using the SGHMC sampler instead of a stochastic gradient optimizer.
The posterior samples Θ and Φ are thus not used during training (as in Algorithm 1), but only for test time prediction.
Algorithm
Input: Dataset D , generative model p ( x , z , θ ) , inference model q x φ , burn-in length B , sample distance D , mini-batch size | M |
Initialize φ 0 , θ 0 and Φ = ∅ , Θ = ∅
Deﬁne number of mini-batches per epoch N b = | D | | M | for t = 1 , . .
, T do
Set ˆ φ 0 =
φ t − 1 , ˆ θ
= θ t −for b = 1 , . .
. , N b do
Sample minibatch M ∼ D
Compute ∇ φ ˜ U
(ˆ φ b − 1 , ˆ θ b − 1 , M ) , update ˆ φ b − 1 →
ˆ φ b via SGHMC
Compute ∇ θ ˜ U
(ˆ φ b − 1 , ˆ θ b − 1 , M ) , update ˆ θ b − 1 → ˆ θ b via SGHMC end for
Set φ t =
ˆ φ N b , θ t
= ˆ θ N b if t ≥ B and ( t − B ) mod D = 0 then
Add Φ = Φ ∪ { φ t } and Θ =
Θ ∪ { θ t } end if end for
Output: Posterior samples Φ and Θ
We have
[Equation]
(16) with the standard VAE ELBO as in Eq.
(1), i.e.,
[Equation]
D N UMERICALLY STABLE IMPLEMENTATION OF THE ESS SCORE
For numerical stability, we in practice always work with log-probabilities (since raw probabilities may get arbitrarily close to and thus be rounded to zero).
I.e., instead of directly computing p ( x | θ ) in Eq.
(12) based on the probabilities p ( x | z , θ ) , p ( z ) and q ( z | x , φ ) , we compute log p ( x | θ ) based on the respective log-probabilities log p ( x | z , θ ) , log p ( z ) and log q ( z | x , φ ) as follows:
[Equation]
where z k ∼ q ( z | x , D ) , where the last equality uses log exp( a ) exp( b ) = log(exp( a − b ))
= a − b , and where logmeanexp is a variant of the commonly used numerically stable logsumexp function which computes the mean instead of the sum.
We thus obtain the vector p =
[ p θ ] θ ∈ Θ = [log p ( x | θ )] θ ∈ Θ of log-likelihoods, which we can then use to compute the vector w =
[ w θ ] θ ∈ Θ of weights w θ in Eq.
(9) by passing p through the numerically stable softmax function, i [Figure] e., w
[Equation]
(18) where p ∗ = max( p ) = max { log p ( x | θ ) | θ ∈ Θ } is the largest log-likelihood value across all θ ∈ Θ .
E P RECISION -ROC AND PR C URVES FOR F ASHION MNIST ( HELD - OUT CLASSES ) BENCHMARK
[Figure]
[Figure] [Figure]
[Figure] [Figure]