I NTRA - CLASS M IXUP FOR O UT - OF -D ISTRIBUTION D ETECTION
Anonymous authors
Paper under double-blind review
A BSTRACT
Deep neural networks have found widespread adoption in solving image recognition and natural language processing tasks
However
, they make conﬁdent mispredic tions when presented with data that does not belong to the training distribution, i e. out-of-distribution (OoD) samples.
Inter-class mixup has been shown to improve model calibration aiding OoD detection.
However, we show that both empirical risk minimization and inter-class mixup create large angular spread in latent representation.
This reduces the separability of in-distribution data from OoD data.
In this paper we propose intra-class mixup supplemented with angular margin to improve
OoD detection.
Angular margin is the angle between the decision boundary normal and sample representation.
We show that intra-class mixup forces the network to learn representations with low angular spread in the latent space.
This improves the separability of OoD from in-distribution examples.
Our approach when applied to various existing OoD detection techniques shows an improvement of 4.68% and 6.08% in AUROC performance over empirical risk minimization and inter-class mixup, respectively.
Further, our approach aided with angular margin improves
AUROC performance by 7.36% and 9.10% over empirical risk minimization and inter-class mixup, respectively.
I NTRODUCTION
Deep Learning has been employed by many state of the art machine learning models to effectively solve image recognition (Krizhevsky et al., 2012; LeCun et al., 2015) and natural language processing (Andor et al., 2016) tasks.
Despite their effectiveness, recent research has shown the existence of inputs (Goodfellow et al., 2015b; Nguyen et al., 2015) that lead these networks to make conﬁdent mispredictions.
Two classes of such inputs have emerged in literature.
The ﬁrst class, adversarial examples (Bruna et al., 2014; Goodfellow et al., 2015a; Kurakin et al., 2017), are speciﬁcally crafted inputs with the intent of fooling deep neural nets.
The second class dubbed Out-of-Distribution (OoD) (Nguyen et al., 2015) examples are examples that do not belong to the underlying true distribution that the training dataset is drawn from.
High conﬁdence of the networks on such OoD examples makes it difﬁcult to identify false classiﬁcations and poses a challenge to their deployment in safety critical scenarios (Amodei et al., 2016), from medical diagnosis to self driving applications.
To address this problem several methods have been proposed which aim to identify out-of-distribution samples.
In the context of deep learning, OoD detection methods can be broadly classiﬁed into two categories, generative and discriminative methods.
Generative methods use various techniques such as Gaussian Discriminant Analysis (Lee et al., 2018b), Generative Adversarial Networks (GANs) (Deecke et al., 2018; Lee et al., 2018a;
Ren et al., 2019) or more generic generative methods (Wang et al., 2017) to model the underlying distribution and separate in-distribution samples from OoD samples.
On the other hand, discriminative methods (Hendrycks & Gimpel, 2017; Hendrycks et al., 2019; Hsu et al., 2020; Liang et al., 2018; Liu et al., 2020) detect OoD samples based on measures such as softmax probability (Hendrycks & Gimpel, 2017; Hendrycks et al., 2019), energy scores (Liu et al., 2020) or other metrics computed from the trained network.
Most of these metrics are a proxy for the distance of the sample representation from the decision boundary ( l 2 margin in Figure 1a).
Further, we show that existing techniques such as empirical risk minimization (ERM) and inter-class mixup (Zhang et al., 2018) result in networks learning representations that have large spread.
This large spread creates broad overlapping representations for in-distribution and OoD data, making it hard to separate in-distribution data from OoD data.
Additionally, the use of metrics that are proxies for distance from decision boundary have a disadvantage when OoD points have similar margin as in-distribution data.
For example, consider point “(b) OoD” in Figure 1a where the OoD data point is far from the class representation and has similar l 2 margin as in-distribution data; this OoD point will have similar OoD metric scores as in-distribution data.
Using angular margin would help separate
OoD data in such a case.
To account for these factors, we propose intra-class mixup supplemented with angular margin (refer to Figure 1a) to improve OoD detection where angular margin is the angle between the normal to the decision boundary and the sample representation.
[Figure]
We show that the proposed intra-class mixup forces the network to learn latent representations with low variance (i.e. small spread), thus improving in-distribution and OoD separability.
This is visualized in Figure 1, which plots the angular margin vs. l 2 margin for in-distribution and OoD data for ERM, inter-class mixup and intra-class mixup.
Further, we show that intra-class mixup trained, angular margin augmented OoD detector achieves on average 7.36% and 9.10% improvement in
AUROC performance over ERM and inter-class mixup, respectively.
In summary the contributions of this paper are as follows:
• We propose intra-class mixup to improve OoD detection.
We show that intra-class mixup learnt latent space representations have lower angular spread when compared to ERM and inter-class mixup, thus, improving separability of OoD examples.
We attribute this to the reduced input variance resulting from intra-class mixup.
• We show existing discriminiative OoD detection methods that use proxies for distance from the decision boundary beneﬁt from intra-class mixup when compared to ERM and inter-class mixup.
• We leverage better angular separability to improve OoD detection.
We show that supplementing angular margin with existing OoD detection scores improves OoD detection performance on various existing techniques.
R ELATED W ORK
In the context of deep-learning, the approaches to detect OoD examples can be broadly classiﬁed into two categories discriminative and generative methods.
Under discriminative methods recent works (Hendrycks & Gimpel, 2017; Hendrycks et al., 2019; Hsu et al., 2020; Liang et al., 2018) have leveraged softmax probability scores to detect anomalous examples.
The authors of Hendrycks &
Gimpel (2017) presented their results on using softmax scores to detect OoD examples on several machine learning tasks.
The idea of utilizing softmax scores was further extended in Hendrycks et al.
(2019) by modifying the standard loss function used to train the classiﬁer.
The network was trained on an in-distribution dataset as well as an additional auxiliary or outlier dataset.
The authors claim that such outlier exposure enables the detector to generalize and detect unseen anomalies.
Further, the authors also observed characteristic properties of the auxiliary dataset which help improve detection performance.
Another approach that leverages softmax scores are the ODIN (Hsu et al., 2020; Liang et al., 2018) techniques, which showed improvement to OoD detection without having to explicitly tune the out-of-distribution dataset which the authors argue is generally hard to deﬁne a priori .
The authors proposed decomposing the conﬁdence score and modifying the input pre-processing method.
Other recent work under the discriminative techniques proposed the use of energy score (Liu et al., 2020) instead of softmax scores arguing that softmax based approaches suffer from overconﬁdent posterior distributions for out-of-distribution samples.
They claim that energy scores are theoretically aligned with the probability density of the inputs and is therefore less likely to result in overconﬁdent predictions.
Further, in a non deep learning context angular distance based approaches (Kriegel et al., 2008) have been successfully used in literature to avoid the curse of dimensionality.
Generative methods attempt to model the underlying true distribution and hence, identify samples outside the modelled distribution.
The authors of Lee et al.
(2018b) proposed a technique that modelled a class conditional Gaussian distribution with respect to features of the deep network and used a Mahalanobis distance based conﬁdence score calculated from the Gaussian model to detect OoD examples.
In Lee et al.
(2018a)
the authors proposed the use of Generative Adversarial
Networks (GANs) (Goodfellow et al., 2014) to generate OoD samples to improve OoD detector training.
They proposed two additional loss terms that were added to the original loss function.
One of the proposed terms forced the classiﬁer to be less conﬁdent on OoD samples while the other helped generate more effective OoD examples.
Another work that investigated a generative model based approach for OoD detection was Ren et al.
(2019) which proposed a likelihood ratio method which corrected for background statistics and achieved competitive performance on vision and sequence classiﬁcation tasks.
Approaches under both categories have focused on networks trained using
Empirical Risk Minimization (ERM) which has been observed to result in undesirable behaviors such as memorization (Zhang et al., 2016) and sensitivity outside the training examples (Bruna et al., 2014).
Inter-class mixup (Zhang et al., 2018) has been shown to be effective against such undesirable behaviours (Zhang et al., 2018; Thulasidasan et al., 2019) and has been shown to improve calibration and OoD performance (Thulasidasan et al., 2019).
However, we show that inter-class mixup and ERM trained networks learn representations with large variance (i.e. large spread), impacting their OoD detection performance.
To counter this effect, in this paper we propose intra-class mixup aided with angular margin for improving OoD detection.
B ACKGROUND
In-distribution.
The training and testing samples used for a machine learning task are drawn from some underlying distribution, also called the true distribution.
The samples from this underlying true distribution are called in-distribution samples and are represented by D in in this work.
However, in most practical learning scenarios the true distribution is unknown a priori and hence, the training distribution, D train , is used as a proxy for D in .
Out-of-distribution.
A sample is said to be Out-of-distribution (OoD) if it does not belong to the underlying true distribution D in , and is denoted by D out .
Since we do not have access to the true underlying distribution, for our experiments we use uniform noise, Gaussian noise and samples from other datasets for similar tasks as a proxy for Out-of-distribution samples or D out .
This is common practice in literature (Hendrycks & Gimpel, 2017; Hendrycks et al., 2019; Hsu et al., 2020; Lee et al., 2018b; Liang et al., 2018).
Empirical Risk Minimization (ERM) .
The objective of learning algorithms, when the true underlying distribution is known, is to learn an optimal mapping f ( . )
from the input x to an output y , where ( x , y ) ∼ D in .
This objective is satisﬁed by learning a function f ( . ) that minimizes a loss function
L ( f ( x ) , y ) over the entire distribution.
We can compute the expectation of the loss function as shown in Equation 1.
This is know as expected risk.
[Equation]
As in most realistic scenarios, we do not have access to the true data distribution, and hence, it is common to use available empirical data as proposed in Vapnik (1998) to approximate the expected risk.
This form of approximation, presented in Equation 2, is know as Empirical Risk Minimization (ERM).
[Equation]
where ( x i , y i ) ∼ D train and N e is the number of training samples in D train .
M ETHODOLOGY 4. A NGULAR M ARGIN
In this subsection we deﬁne angular margin.
Angular margin θ can be described by the following equations:
[Equation]
where W ˆ yc is the weight vector of the ﬁnal (classiﬁer) layer of the deep neural net (DNN) for the predicted class ˆ y , n is the unit vector orthogonal to the decision boundary 1 , a inp is the latent space vector representation for the un-mixed input (i.e. activations of the penultimate layer of the DNN).
Further, we ignore the bias term when calculating the angular margin therefore W ˆ yc does not include the bias term.
4. I NTRA - CLASS M IXUP
In this subsection we explore the properties of intra-class mixup trained deep neural nets and how they can be leveraged to improve OoD detection performance.
Inter-class mixup (Zhang et al., 2018) is a technique that helps improve the generalization of a machine learning classiﬁer.
Mixup trains a neural net on a convex combinations of examples and their corresponding soft labels.
Consider a pair of training input, label tuples ( x i , y i ) and ( x j , y j ).
Inter-class mixup obtains a new augmented sample ( ˆ x , ˆ y ) for training the classiﬁer described by Equation 5.
[Equation]
where, λ ∈ [0 , 1] represents the mixing parameter.
In the same fashion as inter-class mixup (Zhang et al., 2018) λ ∼ Beta ( α, α ) and for our experiments we set α = 1 .
Such an augmentation scheme forces the model to learn smooth interpolations between the samples of the training dataset.
The proposed technique of intra-class mixup imposes an additional constraint on Equation 5 such that
ˆ y =
y i
=
y j , forcing the training sample to be a convex combination of inputs within the same class.
It can be shown that the additional constraint on ˆ y reduces the class conditional input variance (see Appendix A.1).
[Equation]
Since λ
[Equation]
where σ 2ˆ X is the variance of the input after mixup and σ 2 X is the variance of the input prior to mixup.
Therefore intra-class mixup results in reduction of class conditional variance at the input.
We observe that deep neural nets trained on intra-class mixup learn to represent even unmixed images with lower angular spread (i.e. reduction of the class conditional representation variance) compared to ERM or inter-class mixup.
The angular spread refers to the standard deviation of the angular margin for a given dataset.
This reduced angular spread increases the angular margin between in-distribution and
OoD samples improving OoD detection performance.
4. S UPPLEMENTING A NGULAR M ARGIN
In this subsection we describe how angular margin scores can be supplemented with various OoD scores to improve detection performance.
We observe from Figure 1, that traditional scores that use the l 2 margin can separate OoD data from in-distribution data.
From Figure 1, this can be interpreted as higher values along the y-axis are more likely to be OoD. But using only l 2 ignores information in the angular margin that can be used to separate in-distribution samples from OoD samples.
From
Figure 1, we see that using angular margin improves separability (using two axes instead of one).
This is also observed in our experimental results (refer to Table 3 and 4).
Therefore we propose supplementing OoD score J s is given by
[Equation]
where J is the OoD score from a detector of choice, θ is the angular margin of the test sample described in Equation 4.
The OoD score J is different for different detection schemes.
For MSP (Hendrycks & Gimpel, 2017)
J would be the softmax probability of the predicted class while J would be the energy score (Liu et al., 2020) when using energy score detector, and so on.
To complete our analysis we also use “Vanilla cos ( θ ) ” which is when J s = cos ( θ ) .
The following section details various experiments to evaluate the performance of the proposed method.
E XPERIMENTS
We perform experiments which aim to understand and show the role of intra-class mixup in improving
OoD detection performance.
The experiments’ goals are summarized below
• To show intra-class mixup trained networks learn representations that have lower angular spread and improved angular separability (Section 5.1).
• To show intra-class mixup improves OoD detection on methods that use distance proxies (Section 5.2).
• To show that supplemental use of angular margin improves OoD detection performance (Section 5.3).
5. S EPARABILITY
In this section we provide evidence for improved OoD separability resulting from intra-class mixup .
To show that intra-class mixup improves OoD separability we evaluate the angular margin for indistribution and OoD examples.
The improvement in separability resulting from intra-class mixup can be observed using a separability metric S given by
[Equation]
where θ o
and θ i are the angular margins for OoD data and in-distribution data respectively, σ o and σ i are the angular scatter/spread (i [Table] e. standard deviation) of the angular margin.
The metric S is the angular version of the Fisher’s criterion (Fisher et al., 1936)
[Table] Table 1 shows the angular separability of empirical risk minimization (ERM), inter-class mixup
(Zhang et al., 2018) and the proposed intra-class mixup.
From Table 1 we clearly see improved OoD separability from intra-class mixup.
For each in-distribution dataset in Table 1, the numbers show the average angular margin and angular spread computed over 5 differently seeded ResNet networks evaluated on the test set of SVHN (Netzer et al., 2011), CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009), Places365 (Zhou et al., 2017), Textures (Cimpoi et al., 2014), LSUN (Yu et al., 2015),
TinyImageNet (Li et al.), Gaussian Noise and Uniform Noise as OoD datasets.
5. I NTRA - CLASS M IXUP FOR O O D DETECTION
We have seen in the previous subsection that intra-class mixup improves OoD separability.
In this subsection we provide evidence for improved OoD detection performance of intra-class mixup trained
DNNs.
We present the results of applying intra-class mixup on a few unsupervised methods that use proxies for distance from the decision boundary such as Maximum Softmax Probability (MSP) detection (Hendrycks & Gimpel, 2017), ODIN (Liang et al., 2018) and Energy score detection (Liu et al., 2020).
To evaluate the performance of the detectors we use a variety of metrics which are brieﬂy described in the following section.
Metrics.
The performance of binary classiﬁcation algorithm can be evaluated using Recall or True
Positive Rate (TPR), False Positive Rate (FPR), Precision or a variety of other metrics.
Recall (TPR),
FPR and Precision are deﬁned by equations (9), (10) and (11) respectively.
[Equation]
where, TP is True Positive, FP is False Positive, TN is True Negative and FN is False Negative.
Metrics commonly used in literature (Hendrycks & Gimpel, 2017; Hendrycks et al., 2019; Lee et al., 2018b) to evaluate the performance of OoD detectors are: [Table]
• AUROC :
The Receiver Operating Characteristic (ROC), the plot of the True Positive Rate (TPR) against the False Positive Rate (FPR).
The area under the ROC is called Area Under the Receiver Operating Characteristic (AUROC).
AUROC of 1 denotes an ideal detection scheme, since the ideal detection algorithm results in 0 false positive and false negative samples.
• AUPRC : The Precision Recall Characteristic (PRC), the plot of the Precision against the Recall.
The area under the PR is called AUPRC and should similarly be 1 for a ideal detection scheme.
• FPR at TPR of 95% (FPR95) : denotes the FPR when the TPR is 95%.
Lower value of FPR at TPR of 95% indicates a better classiﬁer.
To evaluate the effect of intra-class mixup on existing OoD detection techniques, we traineddifferently seeded models each with ERM, inter-class mixup and intra-class mixup.
We trained
ResNet18 (He et al., 2016) networks on CIFAR-10, CIFAR-100, SVHN and TinyImageNet datasets till convergence (baseline accuracies are presented in Table 2).
The training procedure used the SGD optimizer with a momentum of 0.9 and weight decay of 5 × 10 − 4 .
The training used a 90%-10% training-validation split with the initial learning rate set to 10 − 2 and it was scaled down by a factor of 10 at 60% and 80% completion using a learning rate scheduler.
It is common practice in literature (Hendrycks & Gimpel, 2017; Lee et al., 2018b; Liang et al., 2018; Ren et al., 2019) to use data from distributions other than the training set as OoD data. We follow the same approach. For example, if a network is trained on CIFAR-10, datasets other than CIFAR- (SVHN, Places365, Textures, LSUN, TinyImageNet, Gaussian Noise and Uniform Noise) are used as
OoD data. Table 3 (which is a condensed version of Table 5, 6 and 7) reports AUROC, AUPR and
FPR95 results of applying MSP (Maximum Softmax Probability Detector (Hendrycks & Gimpel, 2017)), ODIN (Liang et al., 2018) and Energy Score (Liu et al., 2020) on ERM, inter-class mixup and intra-class mixup trained models.
The detection performance (AUROC, AUPR and FPR95) was obtained by aggregating results from 5 differently seeded models and OoD datasets.
We used
Gaussian Noise, Uniform Noise, SVHN, CIFAR-10, CIFAR-100, Places365, Textures, LSUN and
TinyImageNet as OoD datasets, excluding the corresponding in-distribution dataset.
We also compare the effect of using only cos ( θ ) as the OoD score, referred in Table 3 as to “Vanilla cos ( θ ) ”. Using only cos ( θ ) ignores information from the l 2 margin, thus when existing techniques are provided with angular information, we observe improved performance. Table 3 demonstrates that using “Vanilla cos ( θ ) ” performs better than MSP, ODIN and Energy score based detectors. Further, in Table 4 we observe adding angular information to existing techniques enhances their performance.
On average we observe an improvement of 4.68% , 3.98% and 9.97% on AUROC, AUPR and FPR metrics respectively on unsupervised OoD detection schemes with the use of intra-class mixup over empirical risk minimization.
Further, we observe an improvement of 6.08% , and 21.63% on AUROC and FPR95 metrics over inter-class mixup and near identical AUPR performance when compared to inter-class mixup.
5. S UPPLEMENTING A NGULAR M ARGIN
In this subsection we present the performance results when the OoD detection score is supplemented angular margin.
We show that the use of the cosine of the angular margin as the OoD detection score [Table] improves performance.
The supplemented score is obtained by adding the OoD score to the cosine of the angular margin as described in Equation
[Table]
Figure 2 and Table 4 compare the OoD detection performance of methods that use distance proxies when used with intra-class mixup aided with angular margin.
Table 4 reports mean and standard deviation obtained by averaging 5 different seeds for each in-distribution dataset and averaged over various OoD datasets as used for Table 3.
We observe that on average the use of angular margin with intra-class mixup improves OoD detection performance (AUROC) by 7.36% over empirical risk minimization and 9.10% over inter-class mixup.
C ONCLUSION
There have been numerous approaches to tackle the problem of OoD detection.
In this paper we explore the use of intra-class mixup to train OoD detectors.
We show that intra-class mixup reduces the angular spread of the learnt latent space representation, improving the angular separability of in-distribution and out-of-distribution data.
We observe that the use of intra-class mixup on detection techniques that use distance proxies improves AUROC performance by 4.68% and 6.08% over empirical risk minimization and inter-class mixup trained models respectively.
Further, the use of the cosine of the angular margin to supplement detection scores improves AUROC performance by 7.36% over empirical risk minimization and 9.10% over inter-class mixup trained networks.
Our ﬁndings reveal that intra-class mixup can be an effective tool for training OoD detectors.
I MPACT S TATEMENT
The research presented in this paper focuses on improving the reliability of deep learning techniques in detecting anomalies, reducing the barriers to the deployment of deep learning in safety critical applications such as medical diagnosis, self driving cars etc.
Hence it promises a positive impact on the society.
However, one must be aware of the limitations of the speciﬁc techniques applied in conjunction with the technique proposed in the paper to ensure reliable and secure deployment in safety critical applications.
This paper does not utilize human-derived data and does not utilize any datasets that have been discredited by the creators.
A A PPENDIX A. V ARIANCE OF INPUT DUE TO INTRA - CLASS MIXUP
Consider two random variables X 0 , X 1 ∼ X where X is a class conditional distribution for class ˆ y with mean µ X and variance σ 2 X .
Then the variance of ˆ X = a 0 X
+ a 1 X 1 where a 0 = λ and a 1 = 1 − λ is given by
[Equation]
The Cov ( X 0 , X 1 ) = 0 because X 0 and X 1 are drawn independently, therefore the equation is reduces to
[Equation]
Since λ 2 +
[Equation]
[Equation]
λ
[Equation]
A.
E XPANDED R ESULTS FOR V ARIOUS D ETECTION S CHEMES
[Figure]
Places
[Figure]
[Figure]
[Table]
[Figure] [Figure]
[Figure]
[Table] [Figure] [Table] [Figure]
[Table]
[Figure]
[Table] [Figure] [Table]
[Figure] [Figure]
[Table]
[Figure]
[Table] [Table] [Table]
[Table] [Table] [Table] [Table]