U NSUPERVISED O UT - OF -D ISTRIBUTION D ETECTION WITH B ATCH N ORMALIZATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Likelihood from a generative model is a natural statistic for detecting out-ofdistribution (OoD) samples.
However, generative models have been shown to assign higher likelihood to OoD samples compared to ones from the training distribution, preventing simple threshold-based detection rules.
We demonstrate that OoD detection fails even when using more sophisticated statistics based on the likelihoods of individual samples.
To address these issues, we propose a new method that leverages batch normalization.
We argue that batch normalization for generative models challenges the traditional i i d. data assumption and changes the corresponding maximum likelihood objective.
Based on this insight, we propose to exploit in-batch dependencies for OoD detection.
Empirical results suggest that this leads to more robust detection for high-dimensional images
I NTRODUCTION
Modern neural network models are known to make poorly calibrated predictions (Guo et al., 2017; Kuleshov et al., 2018), and can be highly conﬁdent even for unrecognizable or irrelevant inputs (Nguyen et al., 2015; Moosavi-Dezfooli et al., 2017).
This has serious implications for AI safety (Amodei & Clark, 2016) in real world deployments, where a model could receive inputs that are beyond its training distribution.
Detecting examples that are out of the training distribution becomes a viable solution: when encountering such samples, the model could choose to provide low conﬁdence estimates or even abstain from making predictions (Cortes et al., 2017).
Density estimation is one approach to detecting out-of-distribution (OoD) samples.
A likelihoodbased model is trained on the input samples; during evaluation, samples that have low likelihoods are assumed to be out-of-distribution.
For high-dimensional inputs (such as images), deep generative models have been able to generate realistic samples as well as achieving good compression capabilities, which indicates high likelihoods on the training distribution (Ballé et al., 2016; Kingma & Welling, 2013; Kingma & Dhariwal, 2018; van den Oord et al., 2016); thus, recent works have considered using deep generative models to detect out-of-distribution samples (Li et al., 2018).
However, contrary to popular belief, density estimates by deep generative models are highly inaccurate (Nalisnick et al., 2018).
For example, a Glow (Kingma & Dhariwal, 2018) model trained on CIFAR10 gives higher likelihood estimates to SVHN samples than CIFAR10 ones, which makes accurate OoD detection impossible.
While alternative statistics based on likelihood estimates have been proposed to alleviate this issue (Choi et al., 2018; Song et al., 2017), they are not able to detect OoD samples consistently.
In this paper, we propose a new statistic to detect OoD samples using deep generative models trained with batch normalization (Ioffe & Szegedy, 2015).
We argue that using batch normalization not only improves optimization (as argued in (Kohler et al., 2018;
Santurkar et al., 2018))
, but also challenges the i.i.d.
assumption underlying typical likelihood-based objectives.
We show in that the training objective of generative models with batch normalization can be interpreted as maximum pseudo-likelihood over a different joint distribution that does not assume data in the same batch are i.i.d.
samples.
Empirically, we demonstrate that over this joint distribution, the estimated likelihood of a batch of OoD samples is much lower than that of in-distribution samples .
This allows us to propose a permutation test which outperforms existing methods by a signiﬁcant margin without modifying how the underlying generative model is trained.
In particular, we achieve near-perfect performance even on cases such as Fashion MNIST vs. KMNIST, where the likelihood distributions for single samples are nearly identical (see Figure 1, left).
While generative models trained with BatchNorm
[Figure]
MNIST MNIST
Omniglot KMNIST − −   4 x 0.
D e n s i t y ( un o r m a li z e d ) p θ ( x ) p ( x ) might not provide state-of-the-art likelihood numbers on the test set, it remains competitive and could be more suited for the OoD detection problem (Kingma & Dhariwal, 2018; Nalisnick et al., 2018).
B ACKGROUND
Setup Let X = { x i } Ni =1 be a set of N observations; we assume that “in-distribution” samples are drawn i.i.d.
from some underlying distribution x ∼ p ( x ) .
Our goal is to detect whether a test sample x is “out-of-distribution”; we consider drawing the test samples from an unknown distribution q ( x ) , but we do not have access to samples from q ( x ) during training.
Following deﬁnitions in (Hendrycks & Gimpel, 2016; Liang et al., 2017), we deﬁne OoD examples as the test samples that have low densities under p ( x ) .
We note that samples from q ( x ) are not necessarily all OoD; for example, if q = p then most samples should not be classiﬁed as OoD. Detection of OoD samples is useful for applications such as anomaly detection (Li et al., 2018) and exploration in reinforcement learning (Ostrovski et al., 2017).
Likelihood-based generative models for out-of-distribution detection Likelihood-based models are trained by ﬁnding parameters θ such that the corresponding p θ ( x ) is as close as possible to the training distribution p ( x ) , in terms of Kullback-Leibler divergence (KL):
[Equation]
Finding appropriate solutions depends heavily on choosing the right family of (parametrized) probability distributions.
In the context of images, deep neural networks have demonstrated good performance.
Likelihood-based deep generative models include variational autoencoders (Kingma & Welling, 2013) (where variational lower bounds are optimized), autoregressive models (van den Oord et al., 2016;
Salimans et al., 2017), and invertible ﬂow models (Dinh et al., 2016; Kingma & Dhariwal, 2018) (where exact likelihood is optimized).
Given a sample x , we could attempt to test whether it is OoD or not by evaluating its likelihood − log p θ ( x ) .
Intuitively, if p θ ( x ) is sufﬁciently similar to p ( x ) , OoD samples should have low likelihood under p θ ( x ) .
However, this is not the case for some deep generative models (Nalisnick et al., 2018; Choi et al., 2018), where OoD samples are observed to have higher likelihoods than samples from the training distribution p ( x ) across several datasets and models.
For example, stateof-the-art models trained on CIFAR10 (Krizhevsky & Hinton, 2009) assign higher likelihood to SVHN (Netzer et al., 2011)
samples than CIFAR10 samples.
A similar phenomenon has also been observed by Nalisnick et al.
(2018) for models trained on Fashion MNIST (Xiao et al., 2017)
(Figure 1 (left)), where images with lower variance across pixels (such as MNIST) are assigned higher likelihoods.
This invalidates the assumption that OoD samples are assigned lower likelihoods by existing deep generative models.
To alleviate this issue, Choi et al.
(2018) use Watanabe Akaike Information Criterion (WAIC):
[Equation]
where the expectations are computed using independently trained model ensembles.
This method does not assign higher negative WAIC values for OoD samples in some simple cases, but is empirically observed it to be effective for certain datasets and generative models.
Likelihood-based permutation tests In the context of detecting adversarial examples, Song et al.
(2017) considered using permutation tests statistics to determine whether an input x (cid:48) comes from p ( x ) or not.
One such test statistic uses the rank of p θ ( x (cid:48) ) in { p θ ( x 1 ) , · · · , p θ ( x N ) } ,
where { x i } Ni =1 is a (training) dataset of N samples from p ( x ) :
[Equation]
where I is the indicator function.
When T perm ( x ) is large, x is assumed to be OoD. This addresses the case where higher likelihood is observed for certain out-of-distribution samples (such as the SVHN vs. CIFAR10 example in Nalisnick et al.
(2018)), as both “high-likelihood” and “low-likelihood” samples will have T perm close to N/ 2 (because of the absolute value) and be identiﬁed as OoD.
O UT - OF - DISTRIBUTION SAMPLES AND MODEL MIS - SPECIFICATION
Nalisnick et al.
ﬁnd it surprising that deep generative models assign higher likelihood to out-of-distribution samples, given their successful generalizing on a test dataset.
However, we argue that this is to be expected when the unerlying generative model p θ ( x ) is mis-speciﬁed, and perhaps this is more likely than previously anticipated in the literature.
We consider a simple example where a mis-speciﬁed model would overestimate the likelihood of out-of-distribution samples (Figure 1, right).
Let p ( x ) be a uniform mixture of two Gaussians on R 1 ,
N ( − 1 . 0 , 0 . 01) and N (1 . 0 , 0 . 01) , and p θ ( x ) = N ( µ, σ 2 ) be our model with parameters ( µ, σ ) .
The maximum likelihood solution is ( µ (cid:63) , σ (cid:63) )
≈ (0 . 0 , 1 . 0) , where mode-covering behavior occurs.
x =has the largest likelihood under p θ ( x ) , yet it is highly atypical in the original distribution.
This is also a failure mode for WAIC as discussed in (Choi et al., 2018).
Given the complexity of high-dimensional image distributions, existing likelihood-based generative models are likely to be mis-speciﬁed, which invalidates the use of likelihood estimates to perform
OoD detection (White, 1982).
Moreover, model selection is often based on the holdout method (Arlot et al., 2010), in which we evaluate log-likelihood over a validation set sampled from p ( x ) , but not over out-of-distribution samples.
As we do not know the entropy of p ( x ) , we can never check whether
D KL ( p ( x ) (cid:107) p θ ( x ))
≈
after training.
Because of the mode-seeking nature of D KL , an alternative distribution q ( x ) (cid:54) =
p ( x ) can have even lower KL-divergence with p θ ( x ) , i.e., D KL ( q ( x ) (cid:107) p θ ( x ))
(cid:28)
D KL ( p ( x ) (cid:107) p θ ( x )) even if p θ ( x ) is trained on samples from p ( x ) .
In Appendix B, we demonstrate that even more sophisticated tests over log-likelihood, such as likelihood-based permutation tests, cannot detect out-of-distribution samples effectively.
D ETECTING OUT - OF - DISTRIBUTION SAMPLES WITH BATCH NORMALIZATION
In the following sections, we argue that by taking advantage of batch normalization (BatchNorm), outof-distribution samples can be detected with existing deep generative models.
For a batch of inputs z = { z i } bi =1 of batch size b , batch normalization (Ioffe & Szegedy, 2015) performs normalization over the inputs followed by a parametrized afﬁne transformation:
[Equation]
where γ , β are trainable parameters, and (cid:15) is a hyperparameter for numerical stability.
The mean E [ z ] and variance Var[ z ] are computed over a single batch in training mode , and over the entire training set in evaluation mode 1 .
For deep generative models using batch normalization, existing literature evaluate the log-likelihood on some validation set in evaluation mode .
The role of training mode is generally perceived to accelerate optimization (Kohler et al., 2018;
Santurkar et al., 2018), similar to supervised learning.
[Table]
4. T RAINING MODE DECREASES LIKELIHOOD OF O O D BATCHES
Our central observation is that likelihoods assigned by the model under training mode and evaluation mode are signiﬁcantly different for OoD samples
[Table]
but much less so for in-distribution samples , i.e., when we use BatchNorm statistics computed over a single batch.
We evaluate log-likelihood (measured in bits per dimension, BPD 2 ) on Fashion MNIST, MNIST, CIFAR and SVHN test sets with several models including RealNVP, VAE and PixelCNN++ 3 .
Pre-activation batch normalization layers are used within the residual block for RealNVP and PixelCNN++, and before each convolutional layer for VAE.
The datasets are evaluated in both evaluation mode and training mode .
In Table 1 we found that in evaluation mode MNIST samples have smaller BPD than Fashion MNIST for models trained on Fashion MNIST; SVHN samples have smaller BPD than CIFAR10 for models trained on CIFAR10, which agrees with the observations in (Nalisnick et al., 2018).
However, as we change from evaluation mode to training mode , the log-likelihood of the in-distribution samples does not change signiﬁcantly, while that of OoD samples plummets (see ∆ in Table 1).
In Appendix C.3, we demonstrate that this sudden decrease in log-likelihood not only happens for samples from other datasets, but also adversarial samples that are able to fool likelihood models and likelihood-based permutation tests.
This empirically suggests that simply by using training mode during evaluation, we are able to consistently detect a batch of out-of-distribution samples.
We further note that no special modiﬁcations is made over the training procedure, and no additional OoD datasets are required.
[Figure]
4. E XPLAINING THE EFFECTIVENESS OF BATCH NORMALIZATION
Why is batch normalization effective at detecting OoD batches while other likelihood-based generative models (e.g., Glow trained with ActNorm) fail?
First we provide an example to illustrate why training mode and evaluation mode provide different likelihood estimates for OoD distributions.
Then we argue that with training mode , the learned generative model no longer assumes samples are i.i.d., which differs from models without BatchNorm.
4.2. E XAMPLE OF B ATCH N ORM M ITIGATING M ODEL M IS - SPECIFICATION
In Figure 2, we illustrate a case where BatchNorm could be useful for OoD detection.
Suppose we try to learn some distribution p ( x ) with a 2-d ﬂow model with one coupling layer (Dinh et al., 2016):
f : ( x 1 , x 2 ) (cid:55)→ ( z 1 , z 2 ) where z 1 = x 1 , z
=
x
2 + ( x 1 − E ( x 1 )) /
(cid:112) V ( x 1 ) · γ + β with learnable parameters γ, β ; E ( x 1 ) , V ( x 1 ) are the empirical mean and variance of a batch of x 1 in training mode , and the mean and variance of p ( x 1 ) in evaluation mode .
To simplify our analysis,
We assume that the training distribution p ( x 1 , x 2 ) =
p ( x 1 ) p ( x 2 ) where p ( x 1 ) is a mixture of two
Gaussians ( N ( − 1 , σ 2 ) and N (1 , σ 2 ) with σ → 0 ) and p ( x 2 ) =
δ 0 ( x 2 ) (Dirac delta) and batch sizes are inﬁnite; hence z 2 ≈ ( x 1 − E ( x 1 )) /
(cid:112) V ( x 1 ) · γ + β .
Since the Jacobian of f is triangular and has a determinant of 1, the likelihood of the ﬂow model is simply p f ( x 1 , x 2 ) =
p ( f ( x 1 , x 2 ))
; we assume the prior p ( z 1 , z 2 ) is standard Gaussian N (0 , I ) .
The optimal parameters are then γ ≈ 1 4 and β = 0 .
Now let us consider q ( x 1 , x 2 )
=
q ( x 1 ) p ( x 2 ) where q ( x 1 ) =
Uniform( − 0 .
In evaluation mode , z 2 ≈ x 1 and E q [log p
f
( x )]
≈ − 1 . 92 ; in training mode , z 2 ≈ √ 12 x 1 , which decreases the log-likelihood to E q [log p
f
( x )]
≈ − 2 .
We include a more detailed analysis in Appendix D. In this case, BatchNorm manages to learn a global property of the input distribution (variance), and use this to counteract major distributional shifts (e.g. the proposed uniform distribution q ( x ) ).
The effect leads to lower log-likelihoods in training mode compared to that in evaluation mode .
4.2. R EVISITING THE I . I . D . A SSUMPTIONS FOR B ATCH - NORMALIZED G ENERATIVE M ODELS
While it is difﬁcult to analytically characterize the change of likelihood estimates in training mode for high-dimensional images and deep neural networks, we provide a probabilistic interpretation as to why training mode exhibits different behaviors than evaluation mode .
Training mode breaks the i.i.d.
data assumption In training mode , the output for a particular sample x j is affected by other samples in the same batch (denoted as x − j ), so they are not treated as i.i.d for the generative models in training mode .
This suggest that using BatchNorm when training generative models not only changes the optimization landscape but also modiﬁes the objective: it is no longer 1 N (cid:80)
Ni =1 log p θ ( x i ) where each sample is assumed to be i.i.d.
Pseudo-likelihood perspective of training mode How should we interpret the training objective with batch normalization?
For each sample x j , its corresponding “likelihood” objective depends on the other samples from the same batch ; we denote this as (cid:96) θ ( x j ; x − j ) .
First, we show that the integral of exp( (cid:96) θ ( x j ; x − j )) over any particular sample ( x j ) when we ﬁx the other samples in the batch ( x − j ) is one; this allows us to treat exp( (cid:96) ) as a probability density function 5 .
Proposition 1.
Let b ∈ N , b > 1 be the batch size, and for all possible batch of samples of size ( b − 1) , denoted as x − j , if (cid:96) θ ( x j ; x − j ) is the training objective over x j for a likelihood-based generative model with batch normalization, then:
[Equation]
where we consider likelihood-based generative models that sample either via some parametrized distribution (such as VAE and PixelCNN) or via parametrized invertible transformations constructed via afﬁne coupling layers (such as RealNVP).
[Equation]
For VAE, we assume that the inference distribution is always optimal, i.e., there is no gap between the evidence lower bound and the log-likelihood, so we can treat the objective as exact maximum likelihood.
We defer the proofs in Appendix A.1.
Moreover, if we interpret (cid:96) θ ( x j ; x − j ) as the conditional loglikelihood under a certain joint generative model ˜ p θ over an entire batch, our existing “log-likelihood” objective is a surrogate to the log-likelihood objective over the joint distribution ˜
p
θ ( x 1 , x 2 , . . .
, x b ) .
Proposition 2.
There exists a joint distribution ˜
p
θ ( x 1 , x 2 , . . .
, x b ) such that for all j , ˜
p
θ ( x j | x − j )
→ (cid:96) θ ( x j ; x − j ) as b → ∞ .
Then, the objective for one batch { x j } bj =1 in training mode
[Equation]
is the pseudo-log-likelihood for the joint distribution ˜
p
θ ( x 1 , x 2 , . . .
, x b ) as b → ∞ .
Training mode versus evaluation mode In evaluation mode , the samples are treated as i.i.d., since the batch statistics is ﬁxed and samples within the same batch do not affect each other.
The objective for one batch { x j } bj =1 evaluated in evaluation mode is simply:
[Equation]
It is evident that L train and L eval are not the same objective due to the differences in i.i.d.
assumptions for samples within the same batch.
L train depends on the input batch statistics, whereas L eval does not.
If we consider OoD batches that exhibit major distributional shifts, then it is likely that L train differs from L eval .
From the empirical evidence in Table 1, OoD samples have much lower BPD on training mode than on evaluation mode , whereas the same does not happen for in-distribution samples.
A PERMUTATION TEST BASED ON BATCH NORMALIZATION
Assume that during testing we have access to some “test dataset” ˆ X , and our goal is to identify for each test sample ˆ x ∈ ˆ X whether it is OoD or not.
Based on the observations over OoD batches, we propose a permutation test for each test sample ˆ x .
Interpolation between training and evaluation First, we propose a procedure that interpolates between training mode and evaluation mode , generalizing the settings in Section 4.
We randomly obtain a batch of samples ˆ X b 1 from ˆ X with size b 1 and a batch of samples X b 0 from p ( x ) with size b 0 (e.g., from the training dataset X used to ﬁt the generative model).
For each ˆ x j ∈ ˆ X b 1 indexed by j , we compute its log-likelihood under training mode by mixing ˆ X b 1 and X b 0 in the same batch:
[Equation]
Let b = b 1 + b 0 be the batch size and let r
=
b 1 /b be the ratio of the test samples in the entire batch.
We note that the above procedure interpolates evaluation with training mode and evaluation with evaluation mode .
As r → 0 , the effect on the batch statistics is dominated by the training samples
X b 0 , so Equation 5 converges to evaluation mode ; as r → 1 , the effect on the batch statistics is dominated by the test samples ˆ X b 1 , so Equation 5 converges to training mode .
As we increase r from 0 to 1, we are moving from evaluation mode to training mode .
The observations in Section 4 suggest that log ˜
p
θ (ˆ x j | x − j ) should be relatively stable if q ( x ) is close to p ( x ) and increase signiﬁcantly if q ( x ) is far from p ( x ) , which is indeed the case empirically.
We consider evaluating the average log-likelihood on the test samples when the ratio r is varied, and show the results on several datasets and models in Figure 3.
As we increase the ratio of test samples, the corresponding log-likelihood decreases dramatically for OoD samples, but is relatively stable for in-distribution samples.
Permutation test with BatchNorm We proceed to propose a permutation test statistics based on training mode evaluation.
For a test sample ˆ x , a ﬁxed batch size b and ﬁxed ratio r , we select ( rb − 1) samples from q ( x ) and (1 − r )
b
samples from p ( x ) .
The expected conditional likelihood of ˆ x is used as the test statistic:
[Equation]
where X (
[Equation]
p ( x
[Equation]
X
[Equation]
x
[Equation] [Equation]
[Figure]
In practice
[Figure]
we use monte carlo estimates for the expectation in S b,r ( x (cid:48) ) .
We select two different ratios r 1 , r 2 ∈ (0 , 1) where r 1 < r
[Figure]
and compute the differences in S b,r ( x (cid:48) ) : ∆
[Equation]
[Equation]
=
[Equation]
We proceed to use the rank of ∆ b,r 1 ,r 2 (ˆ x ) in the training set as our test statistic:
[Equation]
For in-distribution samples, we expect ∆ b,r 1 ,r 2 to be small across all choices of r 1 and r 2 ; for out-of-distribution samples, ∆ b,r 1 ,r 2 should be large if ( r 2 − r 1 ) is large.
Therefore, if q ( x ) = p ( x ) , then the statistics computed over the x ∼ q ( x ) should be approximately uniformly distributed over [0 , N ] , whereas if q ( x ) (cid:54) =
p ( x ) , then the statistics computed over out-of-distribution samples would be concentrated around N .
E XPERIMENTS
We verify the effectiveness of our proposed test statistic on several datasets and models, including
RealNVP, VAE and PixelCNN++, and compare against several baselines including log-likelihood, permutation test and WAIC.
First, we train a model ˜
p
θ ( x ) on a dataset p ( x ) ; then we proceed to obtain the test statistic for each sample in q ( x ) , where q ( x ) are several different datasets.
For each q ( x ) (cid:54) = p ( x ) , we consider a binary classiﬁcation problem, where the prediction is the test statistic for each sample x , and the label is whether x is out-of-distribution (label 1) or not (label 0); larger prediction values indicate x is more likely to be out-of-distribution.
We evaluate the area under the ROC curve (AUC) and average precision (AP) for each binary classiﬁcation task, following the procedure in (Hendrycks & Gimpel, 2016).
We select r 1 = 0 .
1 and r 2 = 0 .
9 for our proposed test statistic, and the batch size B = 64 .
The OoD detection results are shown in Table 2.
As expected, using log p θ ( x ) results in poor AUC and AP in cases where the OoD samples have higher log-likelihoods; T perm outperforms log p θ ( x ) in cases where we also consider high log-likelihood samples as OoD; WAIC achieves higher AUC / AP than log p θ ( x ) , yet its improvement is inconsistent across different models (RealNVP improvements are lower than VAE on Fashion MNIST).
Our proposed statistic is able to detect all the out-ofdistribution samples by achieving near-optimal AUC / AP in most cases; this is most notable on
CIFAR vs. ImageNet and Fashion MNIST vs. KMNIST as the sample have very similar likelihood distributions in evaluation mode .
In Appendix C.4, we show that our method works well even with r 1 → 0 and r 2 = 0 .
15 ; therefore, the method is not very sensitive to the r 1 , r 2 hyperparameters. This
[Table] suggest that in practice, even when the test samples contains only a small portion of the OoD samples we can still detect them reliably by selecting r 1 → 0 (evaluation mode) and r 2 → 1 (training mode).
Additionally, we also perform permutation tests over entire batches of test samples, where the BPD of evaluation mode are averaged. The AUC / AP of CIFAR10 versus OoD datasets are 1.00 /
[Table]
(SVHN), 0.56 / 0.64 (CIFAR100), 0.82 / 0.68 (LSUN), and 0.56 / 0.68 (ImageNet).
These results are signiﬁcantly lower than evaluated with training mode where the AUC / AP are near-perfect, which demonstrates that utilizing training mode is behind the improvements for OoD detection.
R ELATED WORK
Task-dependent OoD detection Out-of-distribution detection is crucial to applications such as anomaly detection (Pidhorskyi et al., 2018; Hendrycks & Gimpel, 2016;
Vyas et al., 2018), adversarial defense (Song et al., 2017; 2018), and novelty detection for exploration (Marsland, 2003;
Bellemare et al., 2016; Fu et al., 2017).
In the context of supervised learning, OoD detection methods (Hendrycks & Gimpel, 2016; Liang et al., 2017; DeVries & Taylor, 2018; Gal & Ghahramani, 2016; Lakshminarayanan et al., 2017) are applied to prevent poorly-calibrated neural networks (Guo et al., 2017) from making high-conﬁdence predictions on nonsensical inputs (Szegedy et al., 2013;
Goodfellow et al., 2014); these methods are task dependent and are not suitable for task-independent cases, such as exploration over novel states (Fu et al., 2017; Ostrovski et al., 2017).
Generative models for task-independent OoD detection For high-dimensional inputs such as images, deep generative models are widely applied for density estimation (van den Oord et al., 2016;
Dinh et al., 2016; Kingma & Dhariwal, 2018), and thus are naturally considered for task-independent
OoD detection (Chalapathy et al., 2018; Xu et al., 2018; Kliger & Fleishman, 2018; Ostrovski et al., 2017; Li et al., 2018).
However, recent empirical evidence suggest that likelihood estimates by popular deep generative models are not reliable enough for OoD detection, even against samples that are not adversarial by construction (Nalisnick et al., 2018;
Hendrycks et al., 2018).
To address these issues, Škvára et al.
propose tuning the hyperparameters of VAEs with additional OoD data.
Choi et al.
(Choi et al., 2018) address this empirically by assuming that OoD samples have higher variance likelihood estimates under different independently trained models.
Ren et al.
consider learning a separate density model for potentially confounding background statistics.
Statistical tests for OoD detection OoD detection can be posed as a hypothesis test where the null hypothesis assumes the data is OoD. One could also consider a more speciﬁc goodness-of-ﬁt (GoF) test which determines whether a dataset is drawn from a speciﬁc distribution.
Nalisnick et al.
(2019) considers Kernelized Stein discrepancy (Chwialkowski et al., 2016;
Liu et al., 2016) and
Maximum-mean discrepancy (Gretton et al., 2012) as two GoF tests that scales to generative models.
They propose to compare the empirical cross-entropy of the samples with entropy of the dataset, which is related to the permutation test proposed in Song et al.
Our permutation test can also be cast as a GoF test with r → 1 , where all test samples in the same batch with training mode , but we can also provide individual OoD predictions via different r values.
C ONCLUSION
In this work, we revisit the i.i.d.
assumptions in generative models trained with batch normalization, which results in an alternative interpretation to the training objective.
The difference between the training objective and the evaluation objective explains the intriguing observation that likelihood estimates over OoD examples in training mode are much lower than that in evaluation mode .
This allows us to develop a permutation test based on batch normalization, with which we can reliably detect OoD examples even for difﬁcult cases such as Fashion MNIST vs. KMNIST.
We argue that batch normalization is merely one approach to introducing non-independence between observation variables in deep generative models.
Neural processes (Garnelo et al., 2018), for example, considers generative models conditioned on certain observation contexts, which may differ signiﬁcantly between regular and OoD batches.
It would be interesting to investigate if such models could be utilized for more reliable out-of-distribution detection methods for high-dimensional data.
A P ROOFS A. P ROOF OF P ROPOSITION
Proposition 1.
Let b ∈ N , b > 1 be the batch size, and for all possible batch of samples of size ( b − 1) , denoted as x − j , if (cid:96) θ ( x j ; x − j ) is the training objective over x j for a likelihood-based generative model with batch normalization, then:
[Equation]
where we consider likelihood-based generative models that sample either via some parametrized distribution (such as VAE and PixelCNN) or via parametrized invertible transformations constructed via afﬁne coupling layers (such as RealNVP).
Proof.
Note that in training mode , we can write down the batch norm function explicitly:
[Equation]
if we ﬁx z − i , γ , β and (cid:15) , then BatchNorm ( z ; γ, β, (cid:15) ) is a deterministic function over z i .
The corresponding neural network g θ ( x i ; x − i ) is also a deterministic function over x i (given x − i ).
We summarize likelihood-based generative models into two types:
• In the ﬁrst type, the neural network produces the parameters for a certain tractable distribution, which is used to compute the likelihood (or its lower bound).
This includes VAE and autoregressive models.
Since the distribution over x i is parametrized by the deterministic function g θ , so the likelihood is naturally normalized.
• In the second type, RealNVP models are composed by afﬁne coupling layers (Dinh et al., 2014), which contains transformations ( x, y )
(cid:55)→
( x (cid:48) , y (cid:48) )
where
[Equation]
where s ( · ) and t ( · ) are neural networks (potentially with batch normalization layers).
This has the reverse
[Equation]
Since BatchNorm is a deterministic function over z i when z − i is ﬁxed, the corresponding s ( · ) and t ( · ) functions also have the same property.
Therefore, the corresponding RealNVP model over x i with ﬁxed x − i is also invertible.
As g θ is a deterministic function over x i , the corresponding conditional likelihood is also normalized.
This completes the argument for likelihood-based generative models.
A. P ROOF OF P ROPOSITION
Proposition 2.
There exists a joint distribution ˜
p
θ ( x 1 , x 2 , . . .
, x b ) such that for all j , ˜
p
θ ( x j | x − j )
→ (cid:96) θ ( x j ; x − j ) as b → ∞ .
Then, the objective for one batch { x j } bj =1 in training mode
[Equation]
is the pseudo-log-likelihood for the joint distribution ˜
p
θ ( x 1 , x 2 , . . .
, x b ) as b → ∞ .
Proof.
We treat each sample in the batch as a separate random variable, and consider the corresponding graphical model where batch normalization is involved.
Since training mode aggregates the statistics of all the samples, all the random variables are connected to each other.
First, we need to show that for large enough b , there exists a joint distribution ˜
p
θ ( x 1 , x 2 , . . .
, x b ) that is compatible with all the conditional distributions we deﬁned (Arnold & Press, S. James, 1989).
From Theorem 4.1 in (Arnold & Press, S. James, 1989), we need to show that there exists a function f such that
[Equation]
Let f ( x − j ) =
E x j [ (cid:80) k
(cid:54) =
j log ˜
p θ ( x k | x − k )] be the sum of conditional log-likelihood of x k under the expectation of some distribution over x j .
For large enough b , the value of x j will not affect the batch statistics, so f ( x − j )
= (cid:80) k
(cid:54) =
j log ˜
p θ ( x k | x − k ) , so the condition for compatibility in Equationholds, and there exists a compatible joint distribution, which we denote as ˜ p
θ ( x 1 , x 2 , . . .
, x b ) .
Next, we verify the conditions under which the product of the conditional likelihoods is a pseudolikelihood of ˜ p
θ ( x 1 , x 2 , . . .
, x b ) .
The conditional likelihood for any sample x j is independent of x − j conditioned on its neighbors (which are x − j ), so
[Equation]
is the pseudo-log-likelihood objective (Besag, 1975) for { x j } bj =1 , which approximates the loglikelihood of the joint distribution.
B F OOLING LIKELIHOOD - BASED PERMUTATION TESTS
As suggested by empirical evidence, we assume that model mis-speciﬁcation always occurs and that our likelihood estimates cannot be used naively for detecting out-of-distribution samples due to the mode seeking nature of D KL .
Under this assumption, likelihood-based permutation tests may seems more effective than simple thresholding rules for detecting out-of-distribution samples, as it treats both high-likelihood and low-likelihood samples as OoD. In this section, however, we show that likelihood-based permutation test can also be easily fooled, making them infeasible for OoD detection in a straightforward manner.
We consider fooling a model p θ ( x ) using samples generated from another model q φ ( x ) (trained on another dataset), where we modify the “temperature” T of the generative model (Kingma &
Dhariwal, 2018) (see Appendix C.2 for details).
Then we gather the likelihood estimates for samples in p ( x ) and q ( x ) and obtain the area under the ROC curve (AUC) using T perm as prediction values to classify if x is OoD. We consider a RealNVP (Dinh et al., 2016) model trained on CIFAR and a
PixelCNN++ (Salimans et al., 2017) model trained on Fashion MNIST.
We use a RealNVP trained on SVHN, and a PixelCNN++ trained on MNIST to fool the two p θ ( x ) models respectively.
For
RealNVP we set T = 1 . 10 and for PixelCNN++ we set T = 1 . 17 .
In Figure 4, we show that it is possible to produce a distribution q φ ( x ) with generative models such that its likelihood distribution evaluated by p θ ( x ) lies around the median likelihood in p ( x ) .
This results in low AUC and thereby confusing the test based on T perm .
We show some out-of-distribution sample with similar bits-per-dimension (BPD) to training samples in Figure 5, where the generated samples look drastically different from training samples visually, even though they have similar log-likelihoods.
We note that ﬂipping the classiﬁer predictions (i.e. using − T perm ) will not address this issue, since we would then treat low likelihood samples as more likely to be in-distribution.
C A DDITIONAL E XPERIMENTAL D ETAILS C. M ODEL A RCHITECTURES
For RealNVP (Dinh et al., 2016), we consider downscale once, with 4 residual blocks for each afﬁne coupling layer and 32 channels for each convolutional layer, except for CIFAR where we haveresidual blocks with 64 channels for each convolutional layer.
[Figure]
[Figure]
a RealNVP trained on
CIFAR.
(Bottom) p θ ( x ) is a PixelCNN++ trained on Fashion MNIST.
For VAE (Kingma & Welling, 2013; van den Berg et al., 2018), our inference network has 6 convolutional layers followed by a fully connected layer, and the generator network has 8 deconvolutional layers.
We add batch normalization to all the convolutional layers and deconvolutional layers, except for the last two deconvolutional layers.
We detail the convolutional layer hyperparameters in Table 3.
[Table]
For PixelCNN++, we made two simple modiﬁcations to default hyperparameters (Salimans et al., 2017).
We reduce the number of ﬁlters in each ResNet block from 160 to 80, and we use batch normalization after convolution as opposed to adding weight normalization over convolution.
All the models are trained with default optimizer hyperparameters with a batch size of 64.
We use a batch size of 64 also in evaluation mode.
C. E XPERIMENTAL PROCEDURES FOR S ECTION B
We consider controlling the entropy of the generated samples by controlling a temperature hyperparameter T .
In RealNVP, this is realized by multiplying the latent variable by a factor of T , which is equivalent to sampling from N (0 , T 2 I ) .
In PixelCNN++, this is realized by dividing each pre-softmax scalar output by T ; larger T values would lead to higher entropy samples.
C. L IKELIHOOD DIFFERENCES BETWEEN TRAINING MODE AND TESTING MODE ON GENERATED DATA
We consider measuring the likelihood differences between training mode and testing mode using a
RealNVP trained on CIFAR.
The samples are generated from a RealNVP trained on SVHN, with several temperatures T ∈ { 0 . 7 , 1 . 0 , 1 . 3 } .
Similar to the observation with SVHN samples, there is a large gap between training mode and evaluation mode evaluations.
[Table]
C. O UT - OF - DISTRIBUTION DETECTION WITH ALTERNATIVE VALUES OF r 1 AND r
We include additional results with alternative values of r 1 and r 2 .
If our method is able to achieve high performance with small r 2 , this suggests that we can detect the OoD examples realiably even as they occupy a small portion within the batch.
We consider r 1 → 0 (which is evaluation mode ) and r 2 ∈ { 0 . 15 , 0 . 3 , 0 . 5 , 0 . 9 } ; we show our results in Table 5.
C. H ISTOGRAMS OF LOG - LIKELIHOODS
We further show the histograms of log-likelihoods of several test datasets when the model is a
RealNVP trained on CIFAR-10 datasets in Figure 6; the mean BPD is computed with evaluation mode.
D D ETAILS FOR THE DERIVATION IN S ECTION 4.2.
Suppose we try to learn some distribution p ( x ) with a 2-d ﬂow model with one coupling layer (Dinh et al., 2016):
f : ( x 1 , x 2 ) (cid:55)→ ( z 1 , z 2 ) where
[Equation]
[Equation] [Table] LSUN 0.77 / 0. CIFAR
PixelCNN++
Rotation 0.87 / 0.
SVHN 0.76 / 0.
ImageNet 0.62 / 0. LSUN 0.72 / 0. [Figure] with learnable parameters γ, β ; E ( x 1 ) , V ( x 1 ) are the empirical mean and variance of a batch of xin training mode , and the mean and variance of p ( x 1 ) in evaluation mode .
We assume the distribution p ( x 1 ) to be a even mixture of two Gaussians ( N ( − 1 , σ 2 ) and N (1 , σ 2 ) with σ → 0 , so it concentrates around − 1 and 1 ), and p ( x 2 ) =
δ 0 ( x 2 ) ( x 2 concentrates at zero), so z 2 ≈ ( x 1 − E ( x 1 )
[Equation] / (cid:112) V ( x
[Equation]
· γ + β .
The Jacobian of f is:
[Equation]
so its determinant is one.
The likelihood of the ﬂow model is simply
[Equation]
We assume the prior p ( z 1 , z 2 ) is standard Gaussian N (0 , I ) .
Therefore, we have:
[Equation]
where ϕ ( x ) is the probability density function for the standard Gaussian distribution.
Note that γ, β only depends on the second term.
The maximum likelihood solution for β = 0 (due to symmetry); for γ , we can treat p ( x 1 ) as two point distributions at − 1 and 1 , so we have the optimal γ ≈ arg min s − s 2 / 2 + log s = 1 .
Moreover, E p [ x 1 ] =
and Var p
[ x 1 ] ≈ 1 .
For p ( x 1 , x 2 ) in evaluation mode, we have
[Equation]
For q ( x 1 , x 2 ) in evaluation mode, we have
[Equation]
For q ( x 1 , x 2 ) in training mode, E ( x 1 ) = 0 , V ( x 1 ) = 1 / √ 12 , so we have:
[Equation]