Diversified Outlier Exposure for Out-of-Distribution Detection via Informative Extrapolation

Summary

The authors of this paper present an innovative methodology for out-of-distribution (OOD) detection. While existing methodologies typically involve the direct use of given OOD samples, this paper introduces a new approach that applies perturbations to OOD samples, allowing the model to experience a more diverse set of OOD samples during training. The authors define these perturbations using an adversarial loss based on the uniform distribution loss commonly applied to OOD samples. This creates directional guidance for each instance, determining the direction of the gradient and thus defining the perturbations applied to OOD samples. The results demonstrate that using perturbed OOD samples improves the performance of OOD detection across several key metrics, including False Positive Rate at 95% Recall (FPR95), Area Under the Receiver Operating Characteristic Curve (AUROC), and Area Under the Precision-Recall Curve (AUPR), when compared to existing methodologies.

Strengths

This paper's novel approach of applying perturbations to a given data instance in order to utilize a broader array of samples and those tightly located at the decision boundary is indeed a reasonable and intriguing choice. The authors' concept of adversariality against the uniform loss, which implies a concentration of prediction towards a particular class, exhibits an interesting property worth exploring further. Experimentally, the authors provide a substantial ablation study on the hyperparameters used in loss composition, which adds to the comprehensiveness of their methodology. Notably, the use of t-SNE based plotting allows for a clear visualization of how the OOD samples are perturbed to be situated very closely to in-class samples. It also arise the question of "how would ood behave for the different perturbation types?".

Weaknesses

The authors have presented an interesting methodology that applies adversarial perturbations based on a particular loss function to enhance the performance of out-of-distribution detection. However, it would be important for the authors to provide empirical evidence that demonstrates the superiority of this adversarial perturbation over other types of perturbations. This would require a systematic and rigorous experimentation design and would ideally be conducted across various datasets and under different conditions to ensure the results are robust and generalizable. In the final implementation of the authors' methodology, it's noted that both the perturbed and unperturbed out-of-distribution (OOD) samples are simultaneously considered in the loss function. However, the manuscript doesn't sufficiently explain the rationale behind this particular choice. It would be particularly interesting to see a comparison of results when using only perturbed samples, only unperturbed samples, or both, in the loss function. a crucial aspect that needs further clarification and discussion is the ratio of in-distribution to OOD samples used in the training process. The choice of this ratio can significantly affect the performance and robustness of the model. For instance, a too high proportion of OOD samples could make the model overly sensitive to outliers, while a too low proportion might not adequately expose the model to OOD scenarios. While the paper shows promising results in the specific contexts tested, it would be beneficial for the authors to provide a more extensive analysis covering a range of different OOD datasets. If the authors can provide empirical evidence demonstrating the consistent performance of their method across diverse OOD datasets, it would significantly strengthen their claims. it's unclear from the manuscript how each OOD sample is directed towards a specific class during this adversarial perturbation process. Specifically, they should explain how the gradient direction, which determines the perturbations applied to the OOD samples, correlates with the movement of these samples towards specific classes. I am more than eager to increase my score if the questions above are adequately answered.

Questions

Please see the section weaknesses.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Please see the section weaknesses.

Summary

The manuscript studies image-wide OOD detection in presence of auxiliary negative data. The negative data is often limited and therefore cannot fully encompass the distribution of inliers. Consequently, contemporary learning procedures fail to deliver classifiers resilient to outliers. To overcome this issue, the manuscript presents a method for extrapolating the negative data towards all modes of the inlier distribution. The proposed method first calculates the gradient of arbitrary OOD score over the input. Then, the sign of the gradient is used to direct the negative input samples towards the inlier distribution. The final learning algorithm uses both initial and extrapolated auxiliary negatives to train the classifier resilient to outliers. The proposed method outperforms relevant related works on small image benchmarks.

Strengths

S1. The manuscript deals with an important issue. S2. Extrapolation of auxiliary negative data towards modes of inlier distribution intuitively makes sense. S3. The developed method achieves competitive results on considered benchmarks. S4. The developed method can be combined with existing OOD detectors (e.g. Energy, MSP, ... )

Weaknesses

W1. The manuscript does not discuss the effectiveness of the method when there is only a small auxiliary dataset available. It seems that the developed method still requires a broad OE dataset (Tiny-ImageNet as stated in L236). W2. The manuscript does not consider relevant related works which use synthetic negatives created by generative models [a,b,c]. Synthetic negatives are an effective way for augmenting the auxiliary dataset and the proposed method should outperform methods trained on a mixture of real and synthetic negative data. W4. The manuscript does not reflect on the additional computational budget (time and memory) required by the method over the OE baseline. [a] Shu Kong, Deva Ramanan: OpenGAN: Open-Set Recognition via Open Data Generation. ICCV 2021 [b] Matej Grcic, Petra Bevandic, Sinisa Segvic: Dense Open-set Recognition with Synthetic Outliers Generated by Real NVP. VISAPP 2021. [c] Kimin Lee, Honglak Lee, Kibok Lee, Jinwoo Shin: Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samples. ICLR 2018.

Questions

C1. Can the proposed method work on large-scale experiments [d] C2. Is the extrapolation of outlier data towards inliers always possible or there are some requirements that should be met? Analysis similar to [e] could improve the manuscript. [d] Haoqi Wang, Zhizhong Li, Litong Feng, Wayne Zhang: ViM: Out-Of-Distribution with Virtual-logit Matching. CVPR 2022. [e] Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, Feng Liu: Is Out-of-Distribution Detection Learnable? NeurIPS 2022

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

Although promised in Appendix D (L435), the limitations are not clearly stated. One possible limitation might be W1.

Summary

The paper tries to solve the problem that sampled auxiliary informative outliers may not be sufficient and diverse enough to recover the data boundary in the OOD detection setting. To achieve this, the authors propose a new learning objective with information extrapolation, where second term expands the surrogate OOD distributions towards a more diversified one. The authors have provided theoretical analysis to show that for Gaussian mixture model and binary classification problem, DivOE can extrapolate the outlier boundary towards ID data. In the experiments, the authors adopt image ID datasets such as CIFAR10, CIFAR100, and results show that DivOE achieves better performances over several evaluation metrics.

Strengths

S1. The paper targets an important research problem within the OOD detection research community, and proposes a new auxiliary outlier generation and learning objective to target the research problem that surrogate auxiliary outliers are not sufficient and diverse enough. S2. The learning objective is simple but adaptable to different post-hoc scoring functions, augmentation techniques and sampling techniques to auxiliary outliers. S3. The paper has provided a solid theoretical analysis that shows the effectiveness of DivOE within a simplified binary classification setting. The result of Theorem 3.1 is consistent with the authors' explanations and observations in the previous sections. S4. The paper provides good experiment comparison to exciting methods. They have used several evaluation metrics to demonstrate the effectiveness of the approach. S5. The writing is very clear and presentation is easy to understand.

Weaknesses

W1. In Theorem 3.1, The hypothesis class of the binary classification problem is overly simplified to only linear decision boundary. It would be nicer if the authors can provide theoretical results that generalize to more complex hypothesis class. W2. As Figure 4 shows, the extrapolation ratio and diversified strength are two variables that affect the OOD detection results. If extrapolation ratio is between 0.9~1.0, the performance may degrade and become worse than OE. However, the authors have not mentioned any general guidance to tune those two variables, especially for unseen OOD detection problems. W3. The authors should consider to include a table comparing the number of outliers generated by DivOE and other benchmark methods in order to achieve similar detection performance scores during experiments. W4. The authors should also include bold numbers for the best performing algorithms for Table 11, Table 12 and Table 13.

Questions

Q1. The experiments are only performed on two simple image classification tasks with CIFAR10 and CIFAR100. The reviewer is wondering whether the authors have used other image datasets or tabular datasets for evaluation. Q2. Is there a general guideline in how to choose the extrapolation ratio, augmentation techniques, diversified strength, OOD scores when using DivOE on unseen OOD detection task? It seems that the four factors play an important role in detection performance. Q3. How would $\eta$ and $\alpha$ play an effect in the training steps of DivOE? Q4. Could different data augmentation techniques be used in combination with the inner-maximization function? Would the augmentation function boost up the performance?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

The authors have adequately addressed the limitations and potential negative societal impact of their work, as listed in the NeurIPS checklist. The reviewer would appreciate if the authors can address the question and weakness section.

Summary

This paper improves the methods of utilizing auxiliary outlier data for fine-tuning. Specifically, it synthesizes informative outlier samples close to in-distribution at the decision boundary by adding noise to existing auxiliary data and utilizes them in learning. As a result, it shows improved results by applying the proposed method to various outlier exposure methodologies.

Strengths

1. This paper's method is simple and clearly explained. This paper's approach is novel in explicitly adding noise to outlier data to synthesize and utilize outlier data. 2. Theoretically, the proposed method looks a reasonable way to select samples closer to in-distribution data at the decision boundary than existing methods. 3. The experiments are generally fair and show performance improvements when this method is applied as an add-on to a variety of methods. In particular, this paper suggests a method of synthesizing and utilizing outlier data, which presents the possibility of improving the performance of fine-tuning using outlier data. 4. Additionally, this paper shows that this method is an effective way to improve the performance of fine-tuning using outlier data by applying it to a variety of outlier exposure methodologies and showing improved results.

Weaknesses

1. The novelty and superiority in outlier synthesis against DOE [Wang et al., 2023] are not clear against DOE [Wang et al., 2023]. 2. The term "diversified" is not well-defined, and it is not clear how it differs from the term "informative" used in ATOM [Chen et al., 2021]. 3. The experiments also lack comparison and discussion with the most similar papers MixOE [Zhang et al., 2023] and DOE [Wang et al., 2023] that use outlier synthesis. For example, there is no comparison between the proposed method and DOE [Wang et al., 2023] when it is applied as an add-on to a variety of existing methods. 4. The rationale for using PGD (Projected Gradient Descent) based noise is not well-explained. It is not clear if it has superiority over other attack-based noise. 5. It is not clear how the proposed method of explicitly synthesizing outlier samples differs from implicitly synthesizing them in terms of new effects or novelty.

Questions

1. What is the difference from the most important outlier synthesis methodologies (e.g., MixOE [Zhang et al., 2023] and DOE [Wang et al., 2023]). 2. The fact that the outlier close to the boundary in the left figure of Figure 2 is a diversified outlier is not clearly explained. It is necessary to explain how the informative and diversified are different. 3. The process of moving from Equation 4 to Equation 5 is not clear. Additional detailed explanations are needed. 4. Equation 4 synthesizes all outlier data and leverages only loss, while Equation 5 synthesizes and calculates loss for a portion of outlier data. It seems that the two equations are different methods. Please explain how the two equations are connected. 5. It is necessary to discuss direct comparison and difference with DOE in TABLE1. 6. Please add the comparison results of each when combined with DOE and MixOE in TABLE2. 7. Please add experiments on the ImageNet benchmark [A], as discussed in DOE. 8. Please add experiments on the application of DivOE to OECC [B] in TABLE2. [A] Tal Ridnik, Emanuel Ben Baruch, Asaf Noy, and Lihi Zelnik. Imagenet-21k pretraining for the masses. In NeurIPS Datasets and Benchmarks, 2021. [B] Papadopoulos, Aristotelis-Angelos, et al. Outlier exposure with confidence control for out-of-distribution detection. Neurocomputing, 2021, 441: 138-150.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Yes. The author adequately addressed the limitations

Response to the Authors

The authors have addressed my concerns very thoroughly and have provided detailed experiments to support their claims. While the reviewer is still concerned about Theorem 3.1 (if it is generalizable to non-linear classifiers) and hyper-parameter tuning for extrapolation factors (lack of experiments/ablation studies for this), the reviewer would keep the current score and recommend acceptance of the paper.

Post Rebuttal

The authors thoroughly resolved my concerns hence I increase my score.

Author-Reviewer Discussion Period Closing Soon

Thank you reviewers for your work in evaluating this submission, and thank you authors for responding to the reviewers’ questions and concerns. We are entering the final phase of the discussion period, which will run until August 21st, and some of the authors' responses have to been acknowledged by all the reviewers. Reviewers: If you have any lingering questions or comments on the rebuttal or the responses, now is the time to express them. At the very least, please acknowledge that you have read the authors’ response to your review. Thank you everyone for making the review process a fruitful, constructive, and civil process. AC