WeiPer: OOD Detection using Weight Perturbations of Class Projections

Summary

The paper introduces WeiPer, an post-hoc method for out-of-distribution (OOD) detection that leverages weight perturbations in the final layer of neural networks to enhance detection performance. Contributions: 1. Introducing linear projections of the penultimate layer by perturbing the final layer's weights to improve OOD detection. 2. Discovering a fingerprint-like nature of in-distribution (ID) samples in both penultimate and newly perturbed spaces, leveraging this structure for a novel detection method. 3. Proposing a KL-divergence-based scoring function and evaluating it alongside MSP and ReAct methods, showing state-of-the-art performance on near OOD tasks using the OpenOOD benchmark.

Strengths

Simple methods with good empirical results. Technical novelty is limited but this is not a concern if it outperforms previous methods.

Weaknesses

**Related Work Missing Strong Baselines: Data Depths and Information Projections** Data depths and information projections are gaining significant interest in the OOD detection community. However, these approaches are notably absent in the related work section. It is essential to address these gaps to provide a comprehensive overview of the field. Relevant works include: M. Darrin. "Unsupervised Layer-wise Score Aggregation for Textual OOD Detection." M. Darrin. "Rainproof: An Umbrella To Shield Text Generators From Out-Of-Distribution Data." M. Picot. "Adversarial Attack Detection Under Realistic Constraints." M. Picot. "A Simple Unsupervised Data Depth-based Method to Detect Adversarial Images." M. Picot. "A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection." TMLR 2023. P. Colombo. "Beyond Mahalanobis Distance for Textual OOD Detection." NeurIPS 2022. P. Colombo. "Toward Stronger Textual Attack Detectors." **Lack of Strong Baselines for Empirical Comparison** The current work lacks strong baseline comparisons, particularly those involving data depth methods. This omission undermines the robustness of empirical evaluations. Incorporating these baselines is crucial for a fair and thorough comparison with existing methods. Key references that should be considered for baseline comparisons include: E. Gomes. "A Functional Perspective on Multi-Layer Out-of-Distribution Detection." M. Picot. "A Simple Unsupervised Data Depth-based Method to Detect Adversarial Images." M. Picot. "A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection." TMLR 2023.

Questions

1. Why did you not mention the data depths and only rely on Mahanalobis? 2. Why not use information projections? 3. Can you compare against the baselines previously introduced? **I thank the authors for their rebuttal, i have increased my grade.**

Rating

6

Confidence

3

Soundness

2

Presentation

3

Contribution

2

Limitations

NA

Summary

This work proposes a component, WeiPer, that can benefit OOD detection. WeiPer adds random perturbations (sampled from standard normal) to the class projection weight vectors and essentially expands the output dimension (compared to the original logit space). WeiPer can be combined with multiple existing OOD detection scoring functions (e.g., MSP, ReAct). The authors further propose a KL-divergence-based scoring mechanism that works particularly well with WeiPer. Experiments show that WeiPer+KLD yields state-of-the-art results on the challenging OpenOOD benchmarks, including the near-OOD one on ImageNet-1K.

Strengths

1. The proposed WeiPer is to my knowledge novel. It also has generality since it can be combined with many existing OOD scoring functions. 2. Extensive analyses are presented along the introduction of the method, which well justifies each design choice and makes the underlying intuition/insight clear. 3. Most importantly, unlike many other papers that use arbitrary or easy OOD benchmarks for evaluation, this work demonstrates notable improvements on the challenging OpenOOD, especially with the ImageNet-1K near-OOD benchmark (with ~2% AUROC increase over the previous SOTA ASH).

Weaknesses

A few weaknesses have been discussed by the authors in Sec. 4 and 5, e.g., WeiPer is less powerful on ViT and could induce higher memory consumption.

Questions

Since WeiPer essentially expands the output logit space and is expected to encode richer information, is it possible to leverage WeiPer for other tasks such as OOD generalization, beyond OOD detection?

Rating

7

Confidence

5

Soundness

3

Presentation

3

Contribution

3

Limitations

The authors adequately addressed the limitations.

Summary

The manuscript proposes a post-hoc OOD detection method, which is broadly applicable and can improve existing OOD detection methods.

Strengths

- The methodology is post-hoc, making it more practical. - Results for near OOD evaluation are promising. - The method can be combined with existing OOD detection strategies and improve their performance, thus increasing the potential impact of this work.

Weaknesses

Since memory usage is a limitation of the proposed methodology, the manuscript should present a comparison of computational cost (time and memory) between the multiple OOD detection methodologies that are considered.

Questions

How does your methodology compare to the state-of-the-art in terms of required memory and time?

Rating

7

Confidence

2

Soundness

4

Presentation

4

Contribution

3

Limitations

The authors clearly stated the method's limitations.

Summary

The paper introduces "WeiPer," a method that improves existing out-of-distribution (OOD) detection techniques by perturbing class projection weights. This method leverages the class-discriminative ability of pre-trained neural network classifiers by introducing weight perturbations in the final fully connected layer, creating richer representations of the input. The authors demonstrate that this technique significantly enhances OOD detection performance across multiple benchmarks, especially in challenging near-OOD scenarios. Additionally, a KL-divergence-based scoring method is proposed to utilize the properties of the augmented WeiPer space, supported by theoretical motivations and empirical observations.

Strengths

1. WeiPer introduces a novel and effective technique for OOD detection by incorporating weight perturbations, broadening the scope of current methods. 2. The paper provides extensive experimental evidence demonstrating the superior performance of the WeiPer method across multiple benchmarks and includes detailed ablation studies to validate the contributions of each component.

Weaknesses

1. WeiPer introduces additional computational complexity and memory requirements, which might limit its applicability in resource-constrained environments. 2. The proposed method involves several hyperparameters that need tuning, potentially increasing the difficulty of practical implementation. 3. Compared with other methods, the superior performance is not very stable. While the method performs well across several benchmarks, additional validation on a wider variety of datasets would further demonstrate its generalizability.

Questions

Can you provide more discussion on the motivation of the approach and its contribution to making the OOD field more robust?

Rating

5

Confidence

4

Soundness

3

Presentation

2

Contribution

3

Limitations

The authors have addressed the limitations.

Thanks for the rebuttal

I have read the rebuttal and have no further questions. I maintain my score.