How Does Unlabeled Data Provably Help Out-of-Distribution Detection?

Response to Reviewer ZN1X--part I

We are deeply encouraged that you recognize our method to be novel, significant, and solid in both the algorithm and theory and with remarkable empirical results. Your summary and comments are insightful and spot-on :) **A1. Verification of the assumptions on additional datasets** Thank you for the suggestion! As suggested, we verified the assumption of distribution discrepancy using CIFAR-10 as ID and five other OOD datasets, i.e., SVHN, PLACES365, LSUN-C, TEXTURES, and LSUN-R. The result is shown as follows and in **Appendix Section W**, and we can conclude that $\zeta$ can indeed satisfy the regulatory condition in Theorem 2, i.e., $\zeta > 1.011\sqrt{\pi}$. #### SVHN | $\pi$ | 0.05| 0.1 | 0.2 | 0.5 | 0.7 | 0.9 | 1.0 | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | | $\zeta$ | 0.26 | 0.37 |0.49 | 0.71 |0.97 | 1.24| 1.36| | 1.011 $\sqrt{\pi}$ | 0.23 |0.32| 0.45 |0.71| 0.84| 0.96| 1.0 | #### PLACES365 | $\pi$ | 0.05| 0.1 | 0.2 | 0.5 | 0.7 | 0.9 | 1.0 | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | | $\zeta$ | 0.28 | 0.33 |0.53 | 0.77| 0.85|0.98 | 1.04| | 1.011 $\sqrt{\pi}$ | 0.23 |0.32| 0.45 |0.71| 0.84| 0.96| 1.0 | #### LSUN-C | $\pi$ | 0.05| 0.1 | 0.2 | 0.5 | 0.7 | 0.9 | 1.0 | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | | $\zeta$ | 0.29 | 0.34 |0.47 | 0.72 | 0.87| 1.09 | 1.20 | | 1.011 $\sqrt{\pi}$ | 0.23 |0.32| 0.45 |0.71| 0.84| 0.96| 1.0 | #### TEXTURES | $\pi$ | 0.05| 0.1 | 0.2 | 0.5 | 0.7 | 0.9 | 1.0 | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | | $\zeta$ | 0.28| 0.33 |0.46 | 0.74 |0.85 | 0.96| 1.05| | 1.011 $\sqrt{\pi}$ | 0.23 |0.32| 0.45 |0.71| 0.84| 0.96| 1.0 | #### LSUN-R | $\pi$ | 0.05| 0.1 | 0.2 | 0.5 | 0.7 | 0.9 | 1.0 | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | | $\zeta$ | 0.28 | 0.35 |0.47 | 0.73 | 0.87| 1.10 | 1.22 | | 1.011 $\sqrt{\pi}$ | 0.23 |0.32| 0.45 |0.71| 0.84| 0.96| 1.0 |

Response to Reviewer dSEG--part I

We thank you for recognizing our method to be novel with promising results. We thank the reviewer for the thorough comments and suggestions, which we address below: **A1. Baselines** As suggested, we have additionally compared with the two related works (TSL [1] and STEP [2]). To ensure a fair comparison, we strictly follow the experimental setting in TSL [1], and rerun SAL under the identical setup. The comparison on CIFAR-100 is shown as follows. Accordingly, we have also added discussion and proper citations of the mentioned papers in the revised paper (See **related work section and Appendix Section U**). We thank you for pointing them out! | |LSUN-C | |LSUN-R | | | ------ | ----- | ----- |----- | ----- | | Method | FPR95 | AUROC |FPR95 | AUROC | | STEP | **0.00** |99.99 |9.81 |97.87| | TSL |**0.00** | **100.00**| 1.76| 99.57 | |SAL (Ours)|**0.00**| 99.99 |**0.58**| **99.95**| **A2. Discussion on weakly supervised OOD detection** We agree that weakly supervised OOD detection is indeed similar to the problem setting of SAL. We have already updated the **related work section** of our paper and included more discussions/citations on weakly supervised OOD detection. Thank you for pointing this out! **A3. Near-OOD Scenario** We are glad you bring that up. We have already evaluated the near-OOD detection in **Appendix J**. Specifically, we use the CIFAR-10 as the in-distribution data and the CIFAR-100 as the OOD data in the wild. During test time, we use the test set of CIFAR-100 as the OOD for evaluation. With a mixing ratio $\pi$ of 0.1, SAL achieves an FPR95 of 24.51% and AUROC of 95.55% compared to 38.92% (FPR95) and 93.27% (AUROC) of WOODS. In addition, we follow the suggested data setting by the reviewer, i.e., the first 50 classes of CIFAR-100 as ID and the last 50 classes as OOD. The comparison with the most competitive baseline is reported as follows. We have also added the new results to **Appendix Section J** in the revised manuscript. | | CIFAR-50| | | | ------ | ----- | ----- |----- | | Method | FPR95 | AUROC |ID ACC| | WOODS | 41.28 | 89.74| 74.17| |SAL (Ours)| **29.71**|**93.13** |73.86|

Response to Reviewer dSEG

Dear Reviewer dSEG, Thank you for taking the time to read our response and increasing your score! We are glad to hear that the response solved your concern. We will make sure the discussion and results will be added in the final version! Thanks, Authors

Response to Reviewer XJRS

We are glad to see that the reviewer finds our work significant and novel from various perspectives. We thank the reviewer for the thorough comments and suggestions. We are happy to clarify as follows: **A1. ID accuracy** Great observation! As explained in **paragraph 2 of Section 5.2** in the original submission, the slight discrepancy is due to that our method only observes 25,000 labeled ID samples, whereas baseline methods (without using wild data) utilize the entire CIFAR training data with 50,000 samples. We have used bold fonts to highlight it in the revision. **A2. Additional experiment results with varying $\pi$** Thank you for your suggestion! In our main experiment, we default $\pi$ to be 0.1, which strictly follows the original setting in WOODS [1]. This reflects the practical scenario that the majority of test data may remain ID. Compared to larger $\pi$, our setting with $\pi=0.1$ is also more challenging due to limited information of OOD data. We would like to point the reviewer to the **Appendix Table 6** of the original submission, where we report the OOD detection result and the filtering error on SVHN with different mixing ratios $\pi$. The result aligns well with our observation of the bounds presented in Section 4.1 of the main paper. During rebuttal, we provide additional results on more OOD datasets with varying $\pi$, i.e., 0.05, 0.2, 0.5, 0.9, and contrast with the baselines, which are added to **Appendix Section T**, and also shown below (CIFAR-100 as the in-distribution dataset). We found that the advantage of SAL still holds. | | SVHN| | Places365 | |LSUN-C | |LSUN-R | | Textures| | ID ACC | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | ----- |----- | ----- |----- | | $\pi=0.05$| | Method | FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC | | | | | OE | 2.78 | 98.84|63.63 |80.22 | 6.73| 98.37| 2.06| 99.19 | 32.86| 90.88| 71.98| | Energy w/ OE|2.02 | 99.17| 56.18| 83.33| 4.32| 98.42| 3.96| 99.29| 40.41 | 89.80 | 73.45| | WOODS |0.26 |99.89 |32.71 | 90.01| **0.64**| 99.77| **0.79**| 99.10 | 12.26| 94.48| 74.15| |SAL (Ours)| **0.17** | **99.90** | **6.21** | **96.87** |0.94 | **99.79**|0.84 |**99.37** |**5.77** | **97.12**|73.99 | | | $\pi=0.2$| | Method | FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC | | | | | OE | 2.59| 98.90| 55.68| 84.36| 4.91|99.02 | 1.97| 99.37|25.62 |93.65 | 73.72| | Energy w/ OE|1.79 | 99.25| 47.28|86.78 | 4.18| 99.00| 3.15| 99.35|36.80 | 91.48| 73.91| | WOODS | 0.22| 99.82 | 29.78 | 91.28 | 0.52|99.79 | 0.89|99.56 |10.06 |95.23 |73.49| |SAL (Ours)| **0.08** | **99.92**| **2.80**| **99.31**|**0.05**| **99.94** | **0.02**| **99.97**| **5.71**| **98.71**| 73.86| | $\pi=0.5$| | Method | FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC | | | | | OE | 2.86| 99.05| 40.21| 88.75| 4.13|99.05 | 1.25| 99.38|22.86 | 94.63| 73.38| | Energy w/ OE| 2.71| 99.34| 34.82|90.05 | 3.27|99.18 | 2.54|99.23| 30.16| 94.76|72.76| | WOODS | 0.17| 99.80| 21.87| 93.73| 0.48| 99.61| 1.24| 99.54 | 9.95|95.97 | 73.91| |SAL (Ours)| **0.02** | **99.98** | **1.27**| **99.62**| **0.04**| **99.96** | **0.01**| **99.99**| **5.64**|**99.16** |73.77| | $\pi=0.9$| | Method | FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC | | | | | OE | 0.84 | 99.36| 19.78| 96.29| 1.64| 99.57 | 0.51| 99.75 |12.74 |94.95 | 72.02 | | Energy w/ OE| 0.97| 99.64|17.52 |96.53 | 1.36|99.73 |0.94 | 99.59 | 14.01 | 95.73| 73.62| | WOODS | 0.05 | 99.98| 11.34| 95.83| 0.07 | **99.99** | 0.03| **99.99**|6.72 |98.73 | 73.86| |SAL (Ours)| **0.03** | **99.99** | **2.79**|**99.89** |**0.05**| **99.99**| **0.01**| **99.99**| **5.88**| **99.53**| 74.01| [1] Julian Katz-Samuels et al. Training ood detectors in their natural habitats. In International Conference on Machine Learning, 2022. **A3. Additional experiments on multiple principal components** Another great point! In our original submission, we reported results using multiple principal components in **Appendix Section K**. We observed that using the top 1 singular vector for projection achieves the best performance. **A4. Discussion on using gradient norm** We have already evaluated the GradNorm score as suggested in **Table 2**, where we replace the filtering score in SAL with the GradNorm score and then train the OOD classifier. The result underperforms SAL, showcasing the effectiveness of our filtering score. We have also extensively discussed the design rationale of the filtering scores of SAL in **Section 3.1**, saying that the scores in SAL for ID and OOD data are shown to be provably well-separated (**Remark 1**) and thus ensure a low filtering error, while the norm of the gradient is not. Both the theoretical result and empirical verification can demonstrate the advantage of SAL compared with GradNorm.

Response to Reviewer BtG8

We thank the reviewer for the thorough comments and suggestions. We are encouraged that you recognize our method to be novel and effective, and with robust theoretical analysis. We address your questions below: **A1. Different outlier dataset from the actual test OOD** We are glad you bring that up! In the original submission, we have included the result where the OOD data in the wild is different from the test OOD data (please see **Appendix Section I and Table 8**). Specifically, we use 300K RANDOM IMAGES from outlier exposure [1] to create the wild OOD training dataset. We evaluate on SVHN, PLACES365, LSUN-C, LSUN-RESIZE, and TEXTURES as the test unseen OOD data. We observe that SAL can perform competitively on unseen OOD datasets as well, compared to the most relevant baseline WOODS. [1] Hendrycks et al. Deep anomaly detection with outlier exposure. In Proceedings of the International Conference on Learning Representations, 2019. **A2. Quality of the unlabeled data** To address your concern, we have designed the following experiment where the quality of the unlabeled data deteriorates. The results of SAL and competitive baselines are shown in the table below and have also been added to the **Appendix Section S**. Specifically, we corrupt the outlier data in the wild with additive Gaussian noise [2]. As such, the filtered candidate outliers will have a much lower quality compared to the outliers in SAL. We use the CIFAR-10 as the in-distribution dataset and keep other configurations the same. | | SVHN| | Places365 | |LSUN-C | |LSUN-R | | Textures| | Average | | ID ACC | | ------ | ----- | ----- |----- | ----- |----- | ----- |----- | ----- |----- | ----- |----- |----- |----- | | Method | FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC |FPR95 | AUROC | | | OE | 23.11 | 86.61| 32.01| 86.27| 22.98| 82.75 | 19.53| 87.43 | 25.68 |84.46 | 24.66 |85.50 |93.81 | | Energy w/ OE| 26.76 | 85.91|26.09 | 87.48|22.32 | 82.26| 22.69 | 85.77|27.49 |82.18 | 25.07 |84.72 |92.38 | | WOODS | 18.33 | 89.83| 23.45| 90.04| 19.70| 84.27| 17.79| 90.82| 22.37| 84.83| 20.33| 87.95| 94.00| |SAL (Ours)|**15.23** | **91.22**| **18.23**| **93.51**| **14.62**| **89.04**| **13.93**| **91.82**| **18.58**| **92.42**|**16.12** |**91.60** | 93.91| [2] Hendrycks et.al., Benchmarking neural network robustness to common corruptions and surface variations. In Proceedings of the International Conference on Learning Representations, 2019. **A3. ID accuracy** Great observation! As explained in **paragraph 2 of Section 5.2** in the original submission, the slight discrepancy is due to that our method only observes 25,000 labeled ID samples, whereas baseline methods (without using wild data) utilize the entire CIFAR training data with 50,000 samples. We have used bold fonts to highlight it in the revision.