# A Novel Data Augmentation Technique for Out-of-Distribution Sample Detection
using Compounded Corruptions

Ramya Hebbalaguppe1,2 Soumya Suvra Ghosal1 Jatin Prakash1
Harshad Khadilkar2 Chetan Arora1
1IIT Delhi  India 2TCS Research  India
https://github.com/cnc-ood This is the extended version of ECML’22 submission
that includes detailed description and experiments

###### Abstract

Modern deep neural network models are known to erroneously classify out-of-
distribution (OOD) test data into one of the in-distribution (ID) training
classes with high confidence. This can have disastrous consequences for
safety-critical applications. A popular mitigation strategy is to train a
separate classifier that can detect such OOD samples at test time. In most
practical settings OOD examples are not known at train time, and hence a key
question is: _how to augment the ID data with synthetic OOD samples for
training such an OOD detector?_ In this paper, we propose a novel Compounded
Corruption (CnC) technique for the OOD data augmentation. One of the major
advantages of CnC is that it does not require any hold-out data apart from
training set. Further, unlike current state-of-the-art (SOTA) techniques, CnC
does not require backpropagation or ensembling at the test time, making our
method much faster at inference. Our extensive comparison with $20$ methods
from the major conferences in last 4 years show that a model trained using CnC
based data augmentation, significantly outperforms SOTA, both in terms of OOD
detection accuracy as well as inference time. We include a detailed post-hoc
analysis to investigate the reasons for the success of our method and identify
higher relative entropy and diversity of CnC samples as probable causes.
Theoretical insights via a piece-wise decomposition analysis on a two-
dimensional dataset to reveal (visually and quantitatively) that our approach
leads to a tighter boundary around ID classes, leading to better detection of
OOD samples.

###### Keywords:

OOD detection Open Set recognition Data augmentation

##  1 Introduction

Deep neural network (DNN) models generalize well when the test data is
independent and identically distributed (IID) with respect to training data
[50]. However, the condition is difficult to enforce in the real world due to
distributional drifts, covariate shift, and/or adversarial perturbations. A
_reliable_ system based on a DNN model must be able to detect an OOD sample,
and either abstain from making any decision on such samples, or flag them for
human intervention. We assume that the in-distribution (ID) samples belong to
one of the $K$ known classes, and club all OOD samples into a new class called
a _reject_ /OOD class. We do not attempt to identify which specific class
(unseen label) the unknown sample belongs to. Our goal is to build a
classifier to accurately detect OOD samples as the $(K+1)^{\text{th}}$ OOD
class, with an objective to reject samples belonging to any novel class.

Most techniques for OOD detection assume the availability of validation
samples from the OOD set for tuning model hyper-parameters [36, 33, 3, 21].
Based on the samples, the techniques either update the model weights so as to
predict lower scores for the OOD samples, or try to learn correlation between
activations and the output score vector [33]. Such approaches have limited
utility as in most practical scenarios, either the OOD samples are not
available, or cover a tiny fraction of OOD sample space. Yet, other class of
techniques learn the threshold on the uncertainty of the output score using
deep ensembling [30] or MC dropout [10]. Understandably, OOD detection
capability of these techniques suffer when the samples from a different OOD
domain are presented.

The other popular class of OOD detectors do not use representative samples
from OOD domain, but generate them synthetically [19, 40, 41]. The synthetic
samples can be used to train any of the earlier mentioned SOTA models in lieu
of the real OOD samples. This obviates the need for any domain specific OOD
validation set. Such methods typically use natural corruptions (e.g. blur,
noise, and geometric transformations etc.) or adversarial perturbations to
generate samples near decision boundary of a classifier. This class also have
limited accuracy on real OOD datasets, as the synthetic images generated in
such a way are visually similar/semantically similar to the ID samples, and
the behavior of a DNN when shown natural OOD images much farther (in terms of
$\ell_{2}$ distance in RGB space) from the ID samples still remains unknown.

Recent theoretical works towards estimating or minimizing open set loss
recommend training with OOD samples covering as much of the probable input
space as possible. For example, [26] show that a piece-wise DNN model shatters
the input space into a polyhedral complex, and prove that empirical risk of a
DNN model in a region of input space scales inversely with the density of
training samples lying inside the polytope corresponding to the region.
Similarly, [9] show that under an unknown OOD distribution, the best way to
minimize the open set loss is by choosing OOD samples uniformly from the
support set in the input space. Encouraged by such theoretical results, we
propose a data augmentation technique which does not focus on generating
samples visually similar to the ID samples but synthesizing OOD samples in two
key regions of the input space: (i) finely distributed at the boundary of ID
classes, and (ii) coarsely distributed in the inter-ID sample space (See Sec.
3.3 for details). We list the key contributions:

  1. 1.

We propose a novel data augmentation strategy, Compounded Corruptions (CnC)
for OOD detection. Unlike contemporary techniques [14, 21, 33, 36] the
proposed approach does not need a separate OOD train or validation dataset.

  2. 2.

Unlike SOTA techniques which detect OOD samples by lowering the confidence of
ID classes [1, 20, 33, 38], we classify OOD samples into a separate reject
class. We show empirically that our approach leads to clearer separation
between ID and OOD samples in the embedding space (Fig. 5).

  3. 3.

Our method does not require any input pre-processing at the test time, or a
second forward pass with perturbation/noise. This makes it significantly
faster in inference as compared to the other SOTA methods [24, 36].

  4. 4.

Visualization and analysis of our results indicate that finer granularity of
the polyhedral complex around the ID regions learnt by a model is a good
indicator of performance of a OOD data augmentation technique. Based on our
analysis, we also recommend higher entropy and diversity of generated OOD
samples as good predictors for OOD detection performance.

  5. 5.

CnC yields SOTA results on multiple benchmark datasets. Using DenseNet [25],
CIFAR-100 as ID dataset, and SVHN [42] as OOD, we achieve TNR@TPR95 of
$98.7\%$, AUROC of $99.7\%$ and Detection Error of $2\%$. This outperforms
GODIN [24] by a large margin of $18.4\%$ in TNR@TPR95 (Tab. 1).

##  2 Related Work

Our approach is a hyper-parameter-free OOD detection technique, which does not
need access to a validation OOD dataset. We review contemporary works below.

#### Hyper-parameter tuning using OOD data

This class comprises of OOD detection methods that fine-tune hyper-parameters
on a validation set. ODIN [36] utilizes temperature scaling with input
perturbations using the OOD validation dataset to tune hyper-parameters for
calibrating the neural networks. However, hyper-parameters tuned with one OOD
dataset may not generalize to other datasets. Lee et al.[33] propose training
a logistic regression detector on the Mahalanobis distance vectors calculated
between test images’ feature representations and class conditional Gaussian
distribution at each layer.

#### Retraining a model using OOD data

G-ODIN [24] decompose confidence score along with modified input pre-
processing for detecting OOD, whereas ATOM [3] essentially makes a model
robust to the small perturbations, and hard negative mining for OOD samples.
MOOD [37] introduce multi-level OOD detection based on the complexity of input
data, and exploit simpler classifier for faster OOD inference.

#### Using a pre-trained model’s score for OOD detection

Hendrycks and Gimpel [20] use maximum confidence scores from a softmax output
to detect OOD. Liu et al.[38] use energy as a scoring function for OOD
detection without tuning hyper-parameters. Shastry and Oore [47] leverage
$p^{\text{th}}$-order Gram matrices to identify anomalies between activity
patterns and the predicted class. Blundell et al.[1] focus on a closed world
assumption which forces a DNN to choose from one of the ID classes, even for
the OOD data. _OpenMax_ estimates the probability of an input being from an
unknown class using a Weibull distribution. G-OpenMax[11] explicitly model OOD
samples and report findings on small datasets like MNIST.

####  OOD detection using uncertainty estimation

OOD samples can be rejected by thresholding on the uncertainty measure. Graves
et al.[13], Wen et al.[54] propose anomaly detection based on stochastic
Bayesian inference. Gal et al.[10] propose MC-dropout to measure uncertainty
of a model using multiple inferences. Deep Ensembles [30] use multiple
networks trained independently to improve uncertainty estimation.

#### Data augmentation for OOD detection

This line of research augments the training set to improve OOD detection. Data
augmentations like flipping and cropping generate samples that can be easily
classified by a pre-trained classifier. Generative techniques based on VAEs,
and GANs try to synthesize data samples near the decision boundary [8, 32, 35,
45, 55, 53, 46]. Other data augmentation strategies do not directly target OOD
detection, but domain generalization: SaliencyMix [52], CutOut[7],
GridMask[4], AugMix [22], RandomErase [60], PuzzleMix [28], RandAugment [5],
SuperMix [6]. Mixup [59] generates new data through convex combination of
training samples and labels to improve DNN generalization. CutMix [56] which
generates samples by replacing an image region with a patch from another
training image. The approach is not directly suitable for OOD detection, as
the generated samples lie on the line joining the training samples, and may
not cover the large input space[26, 9].

##  3 Proposed Approach

Figure 1: Creating augmented data samples using Compounded Corruptions (CnC).
Pane (a) shows block diagram of the training procedure: first we take a patch
based convex combination (PBCC) of patches chosen from image pair belonging to
$K\choose 2$ labels; second, we apply corruptions on the data points obtained
using PBCC. This proxy OOD data is then used to train a $(K+1)$ way
classifier, where, first $K$ classes correspond to the ID classes and
$(K+1)^{th}$ class contains synthesized OOD samples corresponding to
reject/OOD class. Pane (b) shows CnC synthesized sample images from cat and
dog classes. Intuitively, CnC gives two knobs for generating OOD samples: a
coarse exploration ability through linear combination of two ID classes
achieved through PBCC operation, and a finer warping capability through
corruption of these images. The order of the two operations (PBCC before
corruption) is important, as we show later.

###  3.1 Problem Formulation

We consider a training set, ${\mathcal{D}}_{\text{in}}^{\text{train}}$,
consisting of $N$ training samples: $(x_{n},y_{n})^{N}_{n=1}$, where samples
are drawn independently from a probability distribution:
${\mathcal{P}}_{X,Y}$. Here, $X\in{\mathcal{X}}$ is a random variable defined
in the image space, and $Y\in{\mathcal{Y}}=\\{1,\ldots,K\\}$ represents its
label. Traditionally, a classifier
$f_{\theta}:\mathcal{X}\rightarrow\mathcal{Y}$ is trained on in-distribution
samples drawn from a marginal distribution ${\mathcal{P}}_{X}$ of $X$ derived
from the joint distribution ${\mathcal{P}}_{X,Y}$. Let $\theta$ refers to
model parameters and ${\mathcal{Q}}_{X}$ be another distinct data distribution
defined on the image space ${\mathcal{X}}$. During testing phase, input images
are drawn from a conditional mixture distribution ${\mathcal{M}}_{X|Z}$ where
$Z\in\\{0,1\\}$, such that ${\mathcal{M}}_{X\mid Z=0}={\mathcal{P}}_{X}$, and
${\mathcal{M}}_{X\mid Z=1}={\mathcal{Q}}_{X}$. We define all
${\mathcal{Q}}_{X}\nsim{\mathcal{P}}_{X}$ as OOD distributions, and $Z$ is a
latent (binary) variable to denote ID if $Z=0$ and OOD if $Z=1$.

One possible approach to detecting an OOD sample is if confidence of
$f_{\theta}$ for a given input is low for all elements of $\mathcal{Y}$.
However, we use an alternative approach where we learn to map OOD samples
generated using our technique to an additional label $(K+1)$. Given any two ID
samples $x_{1},x_{2}\sim\mathcal{P}_{X}$, we generate the synthetic data using
the CnC operation
$C(x_{1},x_{2}):{\mathcal{X}}\times{\mathcal{X}}\rightarrow{\mathcal{X}}$. We
then define an extended label set $\mathcal{Y}^{+}=\\{1,\ldots,K+1\\}$, and
train a classifier $f_{\theta}^{+}$ over $\mathcal{Y}^{+}$. The goal is to
train $f_{\theta}^{+}$ to implicitly build an estimate $\hat{Z}$ of $Z$, such
that the output of $f_{\theta}^{+}$ is $(K+1)$ if $\hat{Z}=1$, and one of the
elements of $\mathcal{Y}$ if $\hat{Z}=0$.

Figure 2: Intuition with an illustrative plot of OOD synthesis on a toy
dataset with four ID classes. Each sample is in $\mathbb{R}^{2}$. Consider
$\textbf{p}_{1}=(x_{1},y_{1})$, and $\textbf{p}_{2}=(x_{2},y_{2})$ to be the
two input samples belonging to distinct classes 1 and 2, then
$\textbf{p}_{3}=(x_{3},y_{3})$ is the geometric convex combination of
$\textbf{p}_{1}$ and $\textbf{p}_{2}$ such that:
$\textbf{p}_{3}=\lambda\textbf{p}_{1}+(1-\lambda)\textbf{p}_{2}$ ,
$0\leq\lambda\leq 1$. (a) training data corresponding to 4 distinct classes;
Synthesised OOD points are in red; (b) PBCC generates OOD points through a
convex combination of ID points from different classes in $4\choose 2$ ways,
whereas corruptions depicted in (c) can generate OOD points around each
cluster. Observe that points generated by CnC spans wider OOD space including
inter-ID-cluster area and outside the convex hull of ID points.

###  3.2 Synthetic OOD Data Generation

Our synthetic sample generation strategy consists of following two steps.

#### Step 1: Patch Based Convex Combination (PBCC)

We generate synthetic samples by convex combination of two input images. Let
$x\in\mathbb{R}^{W\times H\times C}$, and $y$ denote a training image and its
label respectively. Here, $W,H,C$ denote width, height, channels of the image
respectively. A new sample, ${\tilde{x}}$, is generated by a convex
combination of two training samples $(x_{A},y_{A})$, and $(x_{B},y_{B})$:

$\tilde{x}=\mathbf{M}\odot x_{A}+(\mathbf{1}-\mathbf{M})\odot x_{B}.$ (1)

Here, $x_{A}$ and $x_{B}$ do not belong to a same class ($y_{A}\neq y_{B}$),
and $\mathbf{M}\in\\{0,1\\}^{W\times H}$ denotes a rectangular binary mask
that indicates which region to drop, or use from the two images. $\mathbf{1}$
is a binary mask filled with ones, and $\odot$ is element-wise multiplication.
To sample $\mathbf{M}$, we first sample the bounding box coordinates
$\mathbf{B}=(r_{x},r_{y},r_{w},r_{h})$, indicating the top-left coordinates,
and width, and height of the box. The region $\mathbf{B}$ in $x_{A}$ is cut-
out and filled in with the patch cropped from $\mathbf{B}$ of $x_{B}$. The
coordinates of $\mathbf{B}$ is uniformly sampled according to:
$r_{x}\sim\text{U}(0,W),r_{w}=W\sqrt{1-\lambda}$ and similarly,
$r_{y}\sim\text{U}(0,H),r_{h}=H\sqrt{1-\lambda}$. Here, $\lambda\in[0,1]$
denotes the crop area ratio, and is fixed at different values for generating
random samples. The cropping mask $\mathbf{M}$ is generated by filling zeros
within the bounding box $\mathbf{B}$ and ones outside. We generate the samples
by choosing each pair of labels in $K\choose 2$ ways, and then randomly
selecting input images corresponding to the chosen labels. This generates OOD
samples spread across various inter-class regions in the embedding space. For
ablation on range of $\lambda$ to ensure that a large number of OOD samples
are generated outside the ID clusters see supplementary. We label all
generated samples as that of the $(K+1)^{\text{th}}$ reject class.

PBCC and CutMix [56]: Note that PBCC and CutMix[56] both rely on the same
basic operation convex combination of images, but for two very different
objectives. Whereas, CutMix uses the combination step to guide a model to
attend on less discriminative parts of objects e.g. leg as opposed to head of
a person letting the network generalize better on object detection. On the
other hand, we use PBCC as a first step for OOD data generation, where the
operation generates samples in a large OOD space between a pair of classes in
$K\choose 2$ ways.

PBCC Shortcomings: Note that PBCC performs a convex combination of the two ID
images belonging to two distinct classes. Hence, unlike adversarial
perturbations, it is able to generate sample points far from the ID points in
the RGB space. However, still it can generate samples from only within the
convex hull of the ID points corresponding to all classes.Thus, as we show in
our ablation studies, sample generated using this step alone are insufficient
to train a good OOD detector. Below we show how to improve upon the
shortcoming of PBCC.

#### Step 2: Compounded Corruptions

We aim to address the above shortcomings by using corruptions on top of PBCC
generated samples, thus increasing the sample density in inter-class regions
as well as generating samples outside the convex hull. We reason that such
compounded corruptions increase the spread of the augmented data to a much
wider region. Thus, a reasoning based on “per sample" generalisation error
bound from [26]:[Fig. 1, Equation 11] could be utilized for our problem. [26]
constructs an input-dependent generalization error bound by analysing the
subfunction membership of each input, and show that generalisation error bound
improves with smoother training sample density (as defined by number of
samples in each region). Intuitively, corruptions over PBCC produces a
smoother approximation of ID classes with a finer fit at the ID class
boundary. A detailed analysis is given in Fig. 3.3. To give an intuitive
understanding, Fig 2 shows visualizations of the generated OOD samples in red
using a 4 class toy dataset in two dimensions.

Hendrycks et al. [19] benchmark robustness of a DNN using $15$ algorithmically
generated image corruptions that mimic natural corruptions. Each corruption
severity ranges from $1$ to $5$ based on the intensity of corruption, where
$5$ is most severe. The corruptions can be seen as perturbing a sample point
in its local neighborhood, while remaining in the support space of the
probability distribution of valid images. We apply these corruptions on the
samples generated using PBCC step described earlier. Together, PBCC, and
corruptions, allow us to generate a synthetic sample far from, and outside the
convex hull of ID samples. At the same time, unlike pure random noise images,
the process maintains plausibility of the generated samples. Specifically we
apply following corruptions: Gaussian noise, Snow, Fog, Contrast, Shot
noise/Poisson noise, Elastic transform, JPEG compression, and blur such as
Defocus, Motion etc.

Fig. 1 gives a pictorial overview of the overall proposed scheme with a few
OOD image samples generated by our approach. CnC formulates the problem as
$(K+1)$ class classification which improves the model representation of
underlying distribution, and at the same time improves DNN calibration as seen
in Sec. 5.2. Please see Suppl. for the precise steps of our algorithm.

Figure 3: Visualization of trained classifiers as a result of OOD
augmentation. A ReLU type DNN is trained on the two-dimensional half-moon data
set shown in (a). The shattered neural networks [18] show that CnC has the
tightest fit around the ID regions, as measured by the area of the (white
colored) polytopes in which no training ID point is observed but a network
predicts a point in that region as ID. The measured areas for such polytopes
are (b)Vanilla training without data augmentation:5.65, (c)PBCC: 8.20, (d)
Corruption:0.40, (e)r-CnC: 5.66, (f)CnC: 0.37. Note: [26] state that the more
densely supported a polytope is by the training set, the more reliable the
network is in that region. Hence, the samples declared ID in the regions where
no ID sample is observed may actually be OOD with high probability. We observe
that PBCC/r-CnC/Vanilla, all predict ID in many such polytopes. Note: r-CnC we
reverse the order of PBCC and corruptions [Best viewed at 200%]

###  3.3 CnC Analysis via Polyhedral Decomposition of Input Space

While we validate the improved performance of CnC in Sec. 5, in this section
we seek to provide a plausible explanation for the CnC’s performance. We draw
inspiration from theoretical support provided in recent work by [26] who
formally derive and empirically test prediction unreliability for ReLU based
neural networks.

Consider a ReLU network with $n$ inputs and $m$ neurons in total. [26] show
that parameters of a trained model partition the input space into a polyhedral
complex (PC) consisting of individual convex polytopes (also called activation
regions in [26]). See Fig. 3 for an example with a 2D input space. Each
possible input corresponds to a unique state (active or inactive) of each of
the $m$ ReLU neurons, and the interior of each polytope corresponds to a
unique combination of states of all $m$ neurons. Thus a trained network
behaves linearly in the interior of corresponding polytopes. Each edge in the
PC corresponds to the state flip of a single neuron (active to inactive, or
vice versa).

For the purpose of classification based on the final layer activation, a key
corollary from [26] is that the decision boundary between two classes must be
a straight line within a polytope, and can only turn at the vertices. This is
an immediate consequence of the observation that the decision boundary is the
locus along which the two highest activations (most probable labels) in the
output layer remain equal to each other. This implies that smaller polytopes
near the decision boundary are needed for finer control over the boundary
between training samples from different classes. Note also that the authors in
[26]:[equation (11)] infer that (paraphrased) “the more a subfunction
(polytope) is surrounded by samples with accurate predictions, the lower its
empirical error and bound on generalization gap, and thus the lower its
expected error bound”.

The key question from OOD detection perspective is, how do we force a network
to create tighter polytopes at the ID class decision boundaries? We believe
the answer is to distribute a large number of the augmented samples (over
which we have control) with contrasting OOD and ID labels all around each ID
region, forcing the decision boundary to form a tight bounding surface. At the
same time, we must also retain a good fraction of the augmented samples in the
open space between ID classes, which can be covered by relatively large
polytopes (recall that the maximum number of polytopes is bounded by the
number of neurons, and thus small polytopes in one region may need to be
traded off by larger polytopes in another region). Neglecting the inter-ID
space entirely would run the risk of creating very large polytopes in this
region, which increases the empirical error bound ([26]:[equation (5) and
(11), large subfunctions have low probability mass and hence higher error
bound. Refer Supplementary for further details.]. CnC lets us achieve this
dual objective by using compounding to sample the space between ID classes,
and corruption to pepper the immediate neighborhoods around ID classes
(especially for $\lambda$ values near $0$ and $1$).

In Fig. 3, we show polyhedral complex corresponding to the DNN models trained
on two-dimensional half-moon dataset [18, 27], and OOD samples generated using
various techniques. The first plot shows the input space with training samples
from two ID classes (green and yellow semicircles). The learnt polytope
structure for vanilla uses a neural network of size $[2,32,32,2]$, while the
remaining three plots use $[2,32,32,3]$ (with an additional reject/OOD class).

Recall from Fig. 2 that PBCC produces samples sparsely between the ID classes,
but not around the ID class boundaries. Pure corruptions produce samples only
near and on ID classes, but not in the inter-ID space. On the other hand, CnC
produces samples both near the ID boundaries as well as in the inter-ID space.
In Fig. 3, we define any polytope that is fully or partially (decision
boundary crosses through it) classified as ID, as an “ID classified polytope”
and mark it in white color. Visually, we can see that the white polytopes
occupy a smaller total area when we compare Vanilla to CnC, with the actual
values noted in the caption. This indicates that the CnC produces the tightest
approximation of ID classes in our example, which in turn leads to better OOD
detection. Though we show for two-dimensional data, we posit that the same
generalizes to higher dimensional input data as well, and is the reason for
success of CnC based OOD detection.

CnC and Robustness to Adversarial Attacks: Note that, small polytopes in the
input space partitioned by a DNN may also provide better safety against black
box adversarial attacks as suggested by [18, 27]. This is because the black
box adversarial attacks extrapolate the gradients based upon a particular test
sample. Since the linearity of the output, and thus the gradients is only
valid inside a polytope, smaller polytopes near the ID or in the OOD region
makes it difficult for an adversary to extrapolate an output to a large
region. However, since adversarial robustness is not the focus of this paper,
we do not further explore this direction.

###  3.4 Training Procedure

We train a $(K+1)$ class classifier network $f_{\theta}^{+}$, where first $K$
classes correspond to the multi-classification ID classes, and the
$(K+1)^{th}$ class label indicates the OOD class. Our training objective takes
the form:

$\displaystyle\mathcal{L}=\operatorname*{minimize}_{\theta}\hskip
9.95863pt\mathbb{E}_{(x,y)\sim D_{\text{in}}^{\text{train}}}[{\mathcal{L}_{\rm
CE}}(x,y;f_{\theta}^{+}(x))]$ $\displaystyle+\alpha\cdot\mathbb{E}_{(x,y)\sim
D_{pbcc}^{corr}}[{\mathcal{L}_{\rm CE}}(x,K+1;f_{\theta}^{+}(x))],$ (2)

where ${\mathcal{L}_{\rm CE}}$ is the cross entropy loss, $f_{\theta}^{+}(x)$
denotes the softmax output of neural network for an input sample $x$. We use
$\alpha=1$ in our experiments based on the ablation study reported in the
supplementary material. For above experiments setup we set the ratio of
IID:OOD training points as $1:1$.

###  3.5 Inference

After training, we obtain a trained model $F^{+}$. We use $F^{+}(x)[K+1]$ as
the OOD score of $x$ during testing, and define an OOD detector $D(x)$ as:

$D(x)=\begin{cases}0,&\text{if}\ F^{+}(x)[K+1]>\delta\\\ 1,&\text{if}\
F^{+}(x)[K+1]\leq\delta\\\ \end{cases}$ (3)

where, $D(x)=0$ indicates an OOD prediction, and $D(x)=1$ implies an ID sample
prediction. $\delta$ is a threshold such that TPR, i.e., fraction of ID images
correctly classified as ID is $95\%$. For images which are characterized as ID
by $D(x)$, the labels are given as:.

$\hat{y}=\operatorname*{arg\,max}_{i\in 1,\ldots,K}F^{+}(x)_{i}$ (4)

##  4 Dataset and Evaluation Methodology

In-Distribution Datasets: For ID samples, we use SVHN (10 classes) [42],
CIFAR-10 (10 classes), CIFAR-100 (100 classes)[29] containing images of size
$32\times 32$. We also use TinyImageNet (200 classes) [31] containing images
of resolution $64\times 64$ images. Out-of-Distribution Datasets: For
comparison, we use the following OOD datasets: TinyImageNet-crop (TINc),
TinyImageNet-resize (TINr), LSUN-crop (LSUNc), LSUN-resize (LSUNr), iSUN,
SVHN. Evaluation Metrics: We compare the performance of various approaches
using TNR@TPR95, AUROC and Detection Error. See Suppl. for description on
evaluation metrics.

$\mathcal{D}_{\text{in}}^{\text{train}}$ | Method | TNR@TPR95 | AUROC | DetErr | ID Acc.
---|---|---|---|---|---
$\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$ | $\boldsymbol{\uparrow}$
CIFAR-10 DenseNet-BC |  MSP (ICLR’17) [20] | 56.1 | 93.5 | 12.3 | 95.3
ODIN (ICLR’18)[36] | 92.4 | 98.4 | 5.8 | 95.3
Maha(NeurIPS’18)[33] | 83.9 | 93.5 | 10.2 | 95.3
Gen-ODIN (CVPR’20)[24] | 94.0 | 98.8 | 5.4 | 94.1
Gram Matrices(ICML’20)[47] | 96.4 | 99.3 | 3.6 | 95.3
ATOM(ECML’21) [3] | 98.3 | 99.2 | 1.2 | 94.5
CnC(Proposed) | 98.4 $\pm$ 0.8 | 99.5 $\pm$ 1.2 | 2.7 $\pm$ 0.2 | 94.7
CIFAR-100 DenseNet-BC |  MSP (ICLR’17) [20] | 21.7 | 75.2 | 31.4 | 77.8
ODIN (ICLR’18)[36] | 61.7 | 90.6 | 16.7 | 77.8
Gen-ODIN (CVPR’20)[24] | 86.5 | 97.4 | 8.0 | 74.6
Maha (NeurIPS’18)[33] | 68.3 | 92.8 | 13.4 | 77.8
Gram Matrices(ICML’20)[47] | 88.8 | 97.3 | 7.3 | 77.8
ATOM(ECML’21)[3] | 67.7 | 93 | 5.6 | 75.9
CnC(Proposed) | 97.1 $\pm$ 1.4 | 98.5 $\pm$ 0.4 | 4.6 $\pm$ 0.6 | 76.8
TIN RN50 |  MSP (ICLR’17) [20] | 53.15 | 85.3 | 22.1 | 57.0
ODIN (ICLR’18)[36] | 68.5 | 93.7 | 12.3 | 57.0
CnC(Proposed) | 97.8 $\pm$ 0.8 | 99.6 $\pm$ 0.2 | 2.1 $\pm$ 0.2 | 60.5
C-10 WRN |  OE (ICLR’19) [21] | 93.23 | 98.64 | 5.32 | 94.8
EBO (NeurIPS’20)[38] | 96.7 | 99.0 | 3.83 | 95.2
CnC(Proposed) |  96.2 $\pm$ 1.5 | 99.02 $\pm$ 0.1 |  4.5 $\pm$ 0.8 | 94.3
C-100 WRN |  OE (ICLR’19) [21] | 47.35 | 86.02 | 21.24 | 75.6
EBO (NeurIPS’20)[38] | 54.0 | 86.65 | 19.7 | 75.7
CnC(Proposed) | 97.6 $\pm$ 0.9 | 99.5 $\pm$ 0.1 | 2.2 $\pm$ 0.3 | 75.1
Table 1: Comparison of competing OOD detectors. TIN: TinyImageNet, and RN50: ResNet50, WRN : WideResNet-40-2 Values are averaged over all OOD benchmark datasets. We give individual dataset-wise results in the supplementary. Note that ATOM[3], and OE [21] require large image datasets like 80-Million Tiny Images [51] as representative of OOD samples. However, CnC synthesises its own OOD dataset using the ID training data. CnC models were trained using the same configuration as defined by OE [21] and EBO [38] paper, with the exception that CnC did not use any external auxiliary OOD dataset like [51] in training. CnC reasults are averaged on 3 evaluation runs. Data Augmentation Methods | TNR (95% TPR) | AUROC | Detection Err
---|---|---|---
| $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
Mixup (ICLR’18) [59] | 60.6 | 90.9 | 15.5
CutOut (arXiV’17) [7] | 80.8 | 94.8 | 10
CutMix (ICCV’19) [56] | 83.2 | 92.7 | 8.6
GridMask (arXiV’20) [4] | 50.3 | 79.1 | 23.6
SaliencyMix (ICLR’21) [52] | 85.3 | 95.7 | 8.0
AugMix (ICLR’20) [22] | 81.3 | 94.6 | 11.2
RandomErase (AAAI’20) [60] | 41.9 | 68.1 | 24.2
Corruptions (ICLR’19) [19] | 98.0 | 99.4 | 2.8
PuzzleMix (ICML’20) [28] | 66.8 | 84.1 | 15.2
RandAugment (NeurIPS’20) [5] | 89.5 | 97.9 | 4.7
Fmix (ICLR’21) [15] | 73 | 90.3 | 12.6
Standard Gaussian Noise | 71.5 | 93.2 | 11.7
CnC(Proposed) | 98.4 $\pm$ 0.8 | 99.5 $\pm$ 1.2 | 2.7 $\pm$ 0.2
Table 2: Comparison with other synthetic data generation methods. We consider
CIFAR10 as ID. The values are averaged over all OOD benchmarks. We have used
DenseNet[25] as the architecture for all methods trained for $(K+1)$ class
classification. Samples obtained through the listed data augmentation schemes
were assumed to be of $(K+1)^{\text{th}}$ class. Observe that CnC has superior
OOD detection performance. We report average and standard deviation of CnC
trained models computed over 3 runs.

##  5 Experiments and Results

To show that our data augmentation is effective across different feature
extractors, we train using both DenseNet-BC [25] and ResNet-34 [16]. DenseNet
has 100 layers with growth rate of 12. WideResNet [57] models have the same
training configuration as [38].

###  5.1 Comparison with State-of-the-art

####  OOD Detection Performance:

Tab. 1 shows comparison of CnC with recent state-of-the-art. The numbers
indicate averaged OOD detection performance on 6 datasets as mentioned in Sec.
4 (TinyImagenet, TinyImageNet-crop (TINc), TinyImageNet-resize (TINr), LSUN-
crop (LSUNc), LSUN-resize (LSUNr), iSUN, SVHN) with more details included in
the supplementary. We would like to emphasize that CnC does not need any
validation OOD data for fine-tuning. But ODIN [36] and Mahalanobis [33]
require OOD data for fine-tuning the hyper-parameters; the hyper-parameters
for ODIN and Mahalanobis methods [36, 33] are set by validating on 1K images
randomly sampled from the test set $\mathcal{D}^{\text{test}}_{\text{in}}$.
Tab. 1 clearly shows that CnC outperforms the existing methods.

#### Comparison with Other Data Generation Methods

: Tab. 2 shows how CnC fairs against recent OOD data generation methods. In
each case we train a $(K+1)$ way classier where first _K_ classes correspond
to ID and $(K+1)^{\text{th}}$ class comprised of OOD data generated by
corresponding method. As seen from the table, CnC outperforms the recent data
augmentation schemes.

###  5.2 Other Benefits of CnC

#### Detecting Domain Shift as OOD:

Method |<EMAIL_ADDRESS>| AUROC | DetErr
---|---|---|---
MSP (ICLR’17) [20] | 24.4 | 80.1 | 26.5
ODIN (ICLR”18) [36] | 46.0 | 88.6 | 18.9
Gen-ODIN (CVPR’20) [24] | 45.0 | 88.7 | 18.8
Mahalanobis (NeurIPS’18) [33] | 14.0 | 56.2 | 41.6
Gram Matrices (ICML’20) [47] | 35.0 | 81.5 | 25.8
CnC (Proposed) | 60.0 | 91.6 | 15.7
Table 3: Detecting domain shift using CnC. A model trained with CnC data on
CIFAR-100 as the ID using DenseNet-BC [25] feature extractor can successfully
detect the domain shift when observing ImageNet-R at the test time.

We analyze if a model trained with CnC augmented data can detect non-semantic
domain shift, i.e. images with the same label but different distribution. For
the experiments we use a model trained using CIFAR-100 as ID, and
ImageNet-O/ImageNet-R/Corrupted-ImageNet [23] as the OOD. While testing, we
downsample the images from ImageNet-O, ImageNet-R and TinyImageNet-C to a size
of $32\times 32$. Tab. 3 shows results on ImageNet-R OOD dataset. We
outperform the next best technique by 14% on<EMAIL_ADDRESS>2.9% in AUROC, 3.1%
in detection error. See supplementary for results on ImageNet-O and Corrupted
ImageNet.

#### Model Calibration

Another benefit of training with CnC is model calibration on ID data as well.
A classifier is said to be calibrated if the confidence probabilities matches
the empirical frequency of correctness [14, 17], hence a crucial to measure of
trust in classification models. Tables in the supplementary show the
calibration error for a model trained on CIFAR-10, and CIFAR-100 as the ID
data, with CnC samples as the $\text{(}K+1)^{\text{th}}$ class. Note that the
calibration error is measured only for the ID test samples. We compare the
error for a similar model, trained using only ID train data, and calibrated
using temperature scaling (TS) [14].

#### Time Efficiency

For applications demanding real-time performance, it is crucial to have low
latency in systems using DNN for inference. Supplementary reports the
competative performance of our method.

###  5.3 Ablation Studies

_Rationale for Design choice of K vs. (K+1) Classifier_ We empirically verify
having a separate class helps in better optimization/learning during training
a model using CnC augmentation. Fig. 5 shows the advantages of using a ($K+1$)
way classifier as compared to standard $K$ class training with better ID-OOD
separation. Supplementary material details the advantage of CnC with ACET [18]
(CVPR’19) for uncertainty quantification on a half-moon dataset.

#### Recommendation for a Good OOD detector

Method | TNR@ | AUROC | DetErr | Mean | Mean
---|---|---|---|---|---
0.95TPR | Diversity | Entropy
$\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$
PBCC | 93.7 | 98.6 | 6.2 | 2.30 | 0.33
Corruptions | 95.5 | 97.4 | 3.5 | 2.68 | 0.38
CnC | 98.3 | 99.6 | 2.6 | 3.40 | 0.80
Table 4: Using entropy/diversity of synthesized data to predict quality of OOD
detection. Please refer to text for more details.

We performed detailed comparison of various configurations of our technique to
understand the quantitative scores which can predict the quality of an OOD
detector. For the experiment we keep the input images used same across
configs, PBCC and corruptions applied are also fixed to remove any kind of
randomness. We use ResNet34 as feature extractor for all methods. CIFAR-10 is
used as ID dataset and TinyImageNet-crop as OOD dataset. We observe that the
quality of OOD detection improves as the diversity, and entropy of the
synthesized data increases (Tab 4). Here, entropy is computed as the average
entropy of the predicted probability vectors by the $K$ class model for the
synthesized data. We adapt data diversity from Zhang et al.[58] to measure
diversity of OOD data. Refer supplementary for Algorithm for diversity
computation.

Figure 4: We show sample t-SNE plots for $K$ Vs. $(K+1)$ classifiers, where
CIFAR-10 is used as ID and SVHN is used as OOD (marked in red). The K-class
classifier uses temperature scaling (TS) [14], where T is tuned on SVHN test
set. On the other hand, the $(K+1)$ class classifier uses SVHN data for
$(K+1)^{\text{th}}$ class during training. The visualization shows that the
OOD data (marked in red) is better separated in a $(K+1)$-class classifier as
compared to a $K$-class classifier

#### Limitations of CnC data augmentation

: Introduction of additional synthetic data indeed increases training time.
For eg., training a model with CnC data on TinyImageNet dataset takes 10 mins.
23 secs./epoch, whereas without CnC data it takes 5 mins 30 secs./epoch on the
same Nvidia V100 GPU. Performance gain the overhead of training time can be
discounted as inference time remains same. We assume the absence of
adversarial intentions in this approach, Our method fails when tested against
$L_{\infty}$ norm bounded perturbed image. In future we intend to look at OOD
detection using CnC variants for non-visual domains.

##  6 Conclusions

We have introduced Compounded Corruptions(CnC), a novel data augmentation
technique for OOD detection in image classifiers. CnC outperforms all the SOTA
OOD detectors on standard benchmark datasets tested upon. The major benefit of
CnC over SOTA is absence of OOD exposure requirement for training or
validation. We also show additional results for robustness to distributional
drift, and calibration for CnC trained models. CnC requires just one inference
pass at the test time, and thus has much faster inference time compared to
SOTA. Finally, we also recommend high diversity and entropy of the synthesized
data as good measures to predict quality of OOD detection using it.

##  7 Acknowledgements

Thanks to Subhashis Banerjee, Rahul Narain, Lokender Tiwari, Sandeep
Subramanian for insightful comments.

Supplemental Material:
A Novel Data Augmentation Technique for Out-of-Distribution Sample Detection
using Compounded Corruptions

Ramya Hebbalaguppe 1,2 Soumya Suvra Ghosal1 Jatin Prakash1 Harshad Khadilkar2
Chetan Arora1
1Indian Institute of Technology Delhi, India 2TCS Research

This supplementary material comprises of:

  1. 1.

Algorithm 1 gives the precise steps to generate CnC OOD samples

  2. 2.

See Sec. 8 for details of hyperparameters used for some of the competing
methods in our comparisons.

  3. 3.

Sec. 9 details training methodology and lists the evaluation metrics

  4. 4.

Rationale for choosing a $(K+1)$ class classifier over a $K$ class one: Refer
Figure 5 for the t-SNE visualisation that shows better ID-OOD separation. In
Section 11 we study how choosing a $(K+1)$ class classifier over a $K$ class
classifier reduces the number of false positives and false negatives (Refer
Tables 6 and 7). Fig. 7 shows confidence plot of a NN trained using CnC data
on data points far away from ID data.

  5. 5.

Ablation studies to determine choice of $\alpha$ used in our optimisation
objective (Equation 2 in the main paper) such that it minimises the OOD
detection error (Fig. 6)

  6. 6.

Tab. 11 gives summary performance/conceptual differences of various
approaches.

  7. 7.

Comparison with other data synthesis configurations

  8. 8.

Time efficiency during inference.

  9. 9.

More experiments on datasets with distributional shift. See Sec. 16 where we
study OOD detection performance on datasets such as Imagenet-O, Corrupted OOD,
and Imagenet-R.

  10. 10.

Efficacy of our method on similar looking classes as OOD. We show a sample
illustration of performance of CIFAR 10 trained model which has the cat class
during training but tested on a very similar but different class images like
cougar, female lion, and tiger downloaded from internet. See Figure 8 for
further details.

  11. 11.

More comparisons of CnC with state-of-the-art (SOTA) methods for other
combinations of ID-OOD datasets apart from the tables reported in the main
manuscript. To ensure that CnC performance is feature extractor agnostic, we
consider two standard feature extractors, DenseNet-BC and Resnet-34. Please
refer to Tables 17 and 18 for results obtained using DenseNet as feature
extractor.

  12. 12.

Comparison of ROC curves for CnC, and other data augmentation methods (see
Figure 9).

  13. 13.

Additional results of comparison with other data generation methods: Table 3
in main manuscript gave an overview of comparison of CnC with other $12$
synthetic data generation methods when CIFAR10 is considered as ID and
TinyImagenet(crop) as OOD.

  14. 14.

Limitations of our method: we acknowledge the dip in performance of CnC for
non-semantic distribution shift, where the class labels remain the same but
the distribution shifts. This is a typical setting for domain adaptation.
However, we note that CnC still outperforms the recent state-of-the-art (see
Table 15).

Inputs: ${\mathcal{D}}^{\text{train}}_{\text{in}}$

// Train Set

${f_{\theta}^{+}}$, $m$

// Model, Number of epochs

$\mathcal{O}$ = {contrast, $\cdots$, frost}

// Corruption set

$\mathcal{S}$ = {1, 2, 3, 4, 5}

// Severity

$K+1$

// Number of Classes

Output: Trained Model $F^{+}$

Function  _CnCDataGen(_X ID_)_

X${}_{\text{pbcc}}\leftarrow$ Apply PBCC on XID as described in Sec. 3.2 of
main manuscript

X${}^{\text{corr}}_{\text{pbcc}}\leftarrow$ $\emptyset$

foreach  _x in X ${}_{\text{pbcc}}$_ do

op $\sim\mathcal{O}$

// Sample Corruptions

sev $\sim\mathcal{S}$

// Sample Severity

$x_{\text{corr}}\leftarrow\psi$($x$, op, sev) [19] // Augments $x$ with
corruption op of severity sev

$X^{\text{corr}}_{\text{pbcc}}\leftarrow$
{X${}^{\text{corr}}_{\text{pbcc}}\cup x_{\text{corr}}$}

return X${}^{corr}_{pbcc}$

for  _t = 1, 2, $\cdots$, m_ do

// Training Loop

foreach  _ $data$ in ${\mathcal{D}}^{\text{train}}_{\text{in}}$_ do

/* $data=$ (image, label) */

X${}_{ID},{\mathcal{Y}}$ = $data$

// XID represents a batch of ID images

X${}^{\text{corr}}_{\text{pbcc}}$ = CnCDataGen(_X ID_)

$\mathbf{\mathcal{L}}$ = ${\mathcal{L}_{\rm
CE}}$(X${}_{ID},{\mathcal{Y}}$;$f_{\theta}^{+}$) + ${\mathcal{L}_{\rm
CE}}$(X${}^{\text{corr}}_{\text{pbcc}}$, $K$+1;$f_{\theta}^{+}$)

Update model parameters $\theta$

Algorithm 1 Compounded Corruptions (CnC)

##  8 Description of State-of-the-art Methods

Due to the restrictions on the length, we could not include a description of
the state-of-the-art techniques compared with in the main manuscript. However,
to keep the manuscript self-contained we include a brief description of each
of the compared method here.

#### Maximum Softmax Probability (MSP) [20]

uses the maximum value corresponding to softmax probability vector,
$\max_{i}F_{i}(x)$ as confidence scores to detect OOD examples, where $F(x)$
is the softmax output of the neural network.

#### ODIN [36]

ODIN utilizes the calibrated confidence scores computed using temperature
scaling and input perturbations for OOD detection. For this study, we set
temperature parameter, T = 1000 for all experiments, since the gain gets
saturated after T = 1000 [36]. Perturbation Magnitude $\eta$ is chosen by
validating on 1000 images randomly sampled from in-distribution test set
($\mathcal{D}^{test}_{in}$). While using DenseNet as feature extractor, we set
$\eta$ = 0.0016 when ID is CIFAR-10, $\eta$ = 0.0012 when ID is CIFAR-100 and
$\eta$ = 0.0006 when ID is SVHN. For ResNet, we set $\eta$ = 0.0014 for
CIFAR-10, we set $\eta$ = 0.0028 for CIFAR-100 and we set $\eta$ = 0.0014 for
SVHN.

#### Mahalanobis [33]

uses Mahalanobis distance-based confidence scores for OOD detection. For fine-
tuning the perturbation magnitude $\eta$, we train a Logistic Regression model
using 1000 randomly sampled examples from ID test set
($\mathcal{D}^{test}_{in}$) and adversarial examples generated by applying
FGSM [12] on them with a perturbation of size 0.05. $\eta$ is chosen from
{0.0, 0.01, 0.005, 0.002, 0.0014, 0.001, 0.0005} such that it optimizes the
TNR@TPR95.

#### Generalized-ODIN [24]

Hsu et al.propose a decomposed confidence model for the purpose of OOD
detection, where the logits($f$) of a classifier is defined using a
dividend/divisor structure as follows: $f(x)=\frac{h(x)}{g(x)}$, where $h(x)$
and $g(x)$ are two functions. The authors propose three variants of OOD
detectors, namely, DeConf-I, DeConf-E and DeConf-C which uses Inner-Product,
Negative Euclidean Distance and Cosine Similarity for defining $h(x)$
respectively. In this study, we use the DeConf-C variant, since it is shown to
be the most robust of all the variants. For calculating OOD score we use the
output of $h(x)$ function.

#### Gram Matrices [47]

use the concept of Gram-Matrices to compute class-conditional bounds of
feature correlations at multiple layers of the network. Given a test image,
they compute the total deviation in terms of class conditional layer-wise
deviations ($\delta_{l}$) as: $\delta=\sum_{l}\alpha_{l}\delta_{l}$

The value of $\alpha_{l}$ is computed using a validation set of training data.

#### MixUp [59]

MixUp works on the principle of vicinical risk minimisation to enhance the
support of training distribution through a linear interpolation in the input
space with similar interpolation in the associated target space. This improves
model robustness to corrupt labels, avoids overfitting.

##  9 Training Details

Implementation Details of CnC: It is important to note that PBCC and
corruption operations are performed on the normalized image tensor. We train
the DenseNet model for 300 epochs with batch size of 64 and weight decay of
0.0001, whereas ResNet-34 is trained with batch size 128 for 200 epochs with
weight decay of 0.0005. We use SGD with momentum of 0.9, and initial learning
rate starts with $0.1$ and decreases by a factor of 0.1 at 50% and 75% of the
training epochs.

#### Description of Evaluation Metrics

We denote a sample as positive if it is ID, and negative for OOD samples.
Accordingly, we use TP, TN, FP, FN to denote true positives, true negatives,
false positives, and false negatives, respectively. The ‘R’ suffix in any of
the above refers to the ‘rate’ of the quantity. We also report test accuracy
on ID classes. We compare the performance of various approaches using the
following metrics:

  1. 1.

TNR@TPR95: shows the TNR at 95% TPR, where TPR = TP / (TP+FN), and TNR = TN
/(FP+TN). The OOD detectors aim to attain a high TNR@TPR95, i.e., fraction of
OOD samples correctly classified when 95% of ID samples are correctly
classified as ID.

  2. 2.

AUROC: is the Area Under the Receiver Operating Characteristic curve and
computed as the area under the FPR against TPR curve.

  3. 3.

Detection Error: measures the minimum mis-classification probability under the
assumption that positive and negative examples have equal probability in the
test set.

Figure 5: To understand the choice of $(K+1)$ over a $K$ class classifier for
OOD detection: we show sample t-SNE plots for both types of classifiers, where
CIFAR-10 is used as ID and SVHN is used as OOD (marked in red). The K-class
classifier uses temperature scaling [14], where the temperature parameter is
tuned on SVHN test set. On the other hand, the $(K+1)$ class classifier uses
SVHN data for $(K+1)^{\text{th}}$ class during training. The visualization
shows that the OOD data is better separated in a (K+1)-class classifier as
compared to a K-class classifier. We used ResNet-34 as feature extractor for
the experiment. Figure 6: Ablation on $\alpha$ (Eq. 2 in the main paper):
Detection Error of the proposed method, CnC, when $\alpha$ is varied in
optimisation objective such that it minimises the OOD detection error (main
manuscript): $\alpha$ is varied from $0.1$ to $1$. We use DenseNet-BC network
and CIFAR-10 dataset as ID for the experiment. We obtain the lowest value of
detection error for $\alpha=1$, when tested with Imagenet, LSUN and SVHN as
the OOD datasets.

##  10 Comparison with other data synthesis configurations

Table 5 compares performance of models trained using CnC data against the ones
trained

$\mathcal{D}_{\text{out}}^{\text{test}}$ | Method |  TNR@95TPR $\boldsymbol{\uparrow}$ |  AUROC $\boldsymbol{\uparrow}$ |  DetErr $\boldsymbol{\downarrow}$
---|---|---|---|---
$\mathbf{TINc}$ | PBCC | 93.7 | 98.7 | 5.4
Corruption | 96.7 | 99.2 | 4.0
r-CnC | 94.8 | 98.7 | 4.5
| CnC | 99.7 | 99.9 | 1.3
$\mathbf{LSUNc}$ | PBCC | 67.2 | 90.3 | 18.6
Corruption | 96.7 | 99.2 | 4.1
r-CnC | 95.4 | 98.7 | 5.9
| CnC | 98.3 | 99.6 | 3.1
Table 5: Comparison of various possible configurations of our technique using
a DenseNet architecture trained on CIFAR-100 as ID dataset. Recall, r-CnC
denotes applying corruptions followed by PBCC. See suppl. for ablation study.

Using only PBCC, only Corruptions, and r-CnC generated data. Note that in
r-CnC we reverse the order of PBCC and corruptions operations. In
supplementary, we also compare the UMAP visualization of OOD samples generated
using CnC and r-CnC. Intuitively, the embedding vectors after applying only
corruptions remain close to the clusters of ID samples. Hence applying PBCC on
top of the corrupted point simply generates OOD samples in the line connecting
the two points that does not span a wider area outside ID clusters, and are
not much useful for training an OOD detector. In contrast, CnC synthesized OOD
data exhibits higher diversity in the embedding space making CnC desirable.

##  11 Using a K vs. a (K+1) Class Classifier

#### Why K+1 class classifier?

DNNs are easily fooled with images which humans do not consider meaningful
because the closed set nature forces them to choose from one of the known $K$
classes leading to such artifacts which prove to be catastrophic. Recognition
in the real world is open set meaning the recognition system should reject
novel/unknown/unseen/reject classes at test time. Related work have shown how
to produce “fooling” [43] or “rubbish” [12] images. Even when the images are
visually far from the desired class, they produce high confidence scores [18].
This suggests that thresholding on uncertainty is not sufficient to determine
what is unknown/novel class [12] . Thus, we propose CnC utilizing $(K+1)$
class training with an OOD class.

#### How do we differ from prior approaches using K+1 classifier?

our approach is inspired by concepts from [48], however, distinctively
different from theirs; [1] propose a new layer, Openmax, but ours is a data
augmentation scheme. ATOM[3] tries to overcome the brittleness of DNN models
in the open-world by proposing a (K+1) way classifier. However, they use
auxiliary data for effective outlier mining. They argue that using all
examples in an auxiliary OOD data for training a classifier can be misleading
because of the presence of samples which are non-informative in nature.
Recently [40] propose to extend the last layer of a deep neural net with K
additional nodes specifically for OOD detection. However, unlike our proposed
method their training is based on using additional validation set for OOD data
along with ID data. We hypothesize that training a K-way classifier using
auxiliary data generated using CnC method can hurt the decision boundary of
the classifier and we empirically show the same.

#### Visualisation of $K$ Vs. $K+1$ class classifier

We show that introducing a $K+1^{th}$ class for OOD detection instead of K-way
classifier design does not increase in the number of false negatives (ID
classified as OOD). For example, when ID is CIFAR-100 and OOD is SVHN, using
DenseNet architecture, a confusion matrix is shown in Table 6 and Table 7.
Table 7 shows the confusion matrix for Maximum Softmax Probability (MSP) [20]
OOD detector that uses a K-way classifier. On other hand, Table 6 shows the
confusion matrix for CnC trained OOD detector which uses a $K+1$ way
classifier. We can clearly observe that there is a decrease in number of False
Positives when a CnC trained K+1 way model is used, as compared to K-way
classifier. Refer Figure 5 to understand how the OOD data is better separated
in a (K+1)-class classifier as compared to a K-class classifier.

Figure 7: Confidence plot of a NN trained using CnC data on data points far
away from ID data. Yellow indicates high confidence, and Purple implies low
confidence. Row 1: is output of ACET (K class classifier) [18], Row 2: is for
the same $K$-class classifier, but using CnC data during training, whereas Row
3: is for CnC trained $(K+1)$ class classifier. We observe that the confidence
plots for CnC are in general better; those for $(K+1)$ class classifier are
better than $K$-class one.

ACET [18] report that despite adversarial training confidence of a ReLU based
network far away from the ID points remains high. For a given input
${\mathbf{x}}$, we obtain ${\mathbf{y}}$, where ${\mathbf{y}}$ is the Softmax
output from a trained NN model $f_{\theta}(\textbf{x})$. We define confidence
measure as ${\max(\textbf{y}[:2])}$ (max of ID softmax values). First row of
the Fig. 7 shows the confidence plot for the half moon dataset, with the
training data for positive(Red) and negative classes (Green). Yellow color
shows high confidence, and purple show the low confidence. Note that the scale
of the inputs changes from left to right. As one can see for ACET the
classifier indeed outputs low confidence near the ID region but as the scale
increases (far from the ID points), we see more and more high confidence
regions, showing the fragility of the OOD detection based on the confidence
scores. In the second row we show the $K$ class classifier trained with CnC
generated data. As we can that the confidence is much lower even in the far
off points. We see that the classifier confidence further improves (low in far
away regions) with $(K+1)$ class classifier and CnC based training. Note that
for $(K+1)$ class classification, though the classification is $K$-way, the
confidence depicted is still ${\max(\textbf{y}[:K])}$. The Fig. 7 serves to
illustrate (1) the benefit of CnC for $K$ class classification, and (2) merit
of using $(K+1)$ over a $K$ class classifier.

|  | $\mathbf{Actual}$
---|---|---
|  | ID | OOD
$\mathbf{Predicted}$ |  ID | True Positive = 9514 | False Positive = 151
| (TP) | (FP)
OOD | False Negative = 486 | True Negative = 9849
| (FN) | (TN)
Table 6: Confusion Matrix for K+1 way CnC trained Classifier |  | $\mathbf{Actual}$
---|---|---
|  | ID | OOD
$\mathbf{Predicted}$ |  ID | True Positive = 9354 | False Positive = 7732
| (TP) | (FP)
OOD | False Negative = 646 | True Negative = 2268
| (FN) | (TN)
Table 7: Confusion Matrix for K-way MSP [20] trained Classifier

Figure 8: We study the efficacy of CnC trained model on boundary cases. (a) t-SNE mapping of images that are similar to "Cat" class of CIFAR-10 but are semantically a different class: Examples shown are cougar, tiger and lioness.We test the CnC model trained on Cat class on a semantically similar but a different class such as cougar, tiger and lioness downloaded from internet. (b) GradCAM [49] and GradCAM++ [2] visualizations of corresponding images. Note that CnC is able to successfully classify them as OOD with high probability $0.877$, $0.997$, and $0.983$ $\mathcal{D}_{\text{in}}^{\text{train}}$ | Range ($\lambda$) | TNR@TPR95 | AUROC | DetErr
---|---|---|---|---
$\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-10}$ | U(0.0, 1.0) | 99.8 | 99.9 | 0.9
$U(0.1,0.9)$ | 84.1 | 96.5 | 9.0
$U(0.2,0.8)$ | 79.3 | 96.5 | 9.5
$U(0.3,0.7)$ | 78.9 | 96.4 | 9.8
$U(0.4,0.6)$ | 77.8 | 96.2 | 10.3
Table 8: Ablation of sampling range [$\lambda,(1-\lambda$)] on uniform distribution (U) to ensure maximum number of CnC generated OOD samples do not lie on ID regions. Recall from the main manuscript, the cut-out region is determined by $(1-\lambda)$ for bounding box in our proposed algorithm. We use DenseNet as network architecture, CIFAR-10 as ID dataset and Tiny-ImageNet(Crop), LSUN(Crop) and SVHN as OOD Dataset for all methods. | RMS CE $\downarrow$ | ECE CE $\downarrow$
---|---|---
$\mathcal{D}_{in}$ | TS | CnC | TS | CnC
CIFAR-10 | 11.09 | 6.18 | 5.12 | 3.15
CIFAR-100 | 26.01 | 19.36 | 19.57 | 15.4
Table 9: Calibration Results for temperature tuned baseline and CnC trained
model. Lower calibration error is better.

In Table 9, we compare TS against our proposed CnC trained model in terms of
calibration. For TS method, we find optimal temperature by tuning on
validation set of ID datasets and for CnC we keep T=1 (original). The proposed
method, CnC achieves better calibration than TS, thus making it more reliable.

Additionally, our proposed method is better than TS in terms of robustness as
we train on several types of corruptions (proxy for OOD). Note: ODIN [36] uses
temperature scaling for OOD detection, however, OOD test sets have
significantly different distributions than the training distribution. Hence in
this case TS is not guaranteed to produce a calibrated probability. Guo et
al.explicitly mention temperature scaling fails in the case of adversarial
setting or when test samples are noisy [14].

##  12 Effect of Diversity on OOD Detection

We adapt data diversity from Zhang et al[58] to measure OOD diversity. Refer
to Algorithm 2 to compute diversity. For computing entropy, we use
$H(x)=-\sum_{n=1}^{K}p_{i}\log(p_{i})$. Here $p_{i}$ is the model-generated
probability that the data point belongs to class $i$, and $K$ is he number of
classes. As reported in the main manuscript, we observe that higher entropy
and higher diversity leads to better OOD detection.

The objective of this experiment is to corroborate the fact that higher the
diversity of generated OOD samples, better the OOD detection performance
measured using metrics such as AUROC, TNR@TPR95 and Detection Error. To this
end, we train two (K+1) class classifiers, in first we generate proxy OOD
samples by applying _Gaussian_ noise and similarly in second we use _Speckle_
noise as corruptions. The parameters of Gaussian/Speckle noise are same as the
default settings proposed in Hendrycks and Dietterich
https://github.com/hendrycks/robustness

We compute the mean diversity of proxy OOD samples generated using Speckle
noise and Gaussian noise. We find the diversity of Speckle noise as $2.16$ and
that of the Gaussian counter part to be $1.71$ using Algorithm 2. In Table 10,
we show that Speckle noise trained OOD detector performs better as compared to
Gaussian trained OOD detector, thus, providing an evidence to our hypothesis,
higher diversity of OOD points yields better OOD detection.

$\mathcal{D}_{\text{in}}^{\text{train}}$ | $\mathcal{D}_{\text{out}}^{\text{test}}$ | Method | TNR (95% TPR) | AUROC | DetErr
---|---|---|---|---|---
$\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-10}$ | $\mathbf{TINc}$ | Gaussian Noise | 75.8 | 93.6 | 12.1
Speckle Noise | 95.2 | 98.8 | 4.7
$\mathbf{TINr}$ | Gaussian Noise | 72.5 | 93.1 | 13
Speckle Noise | 97.5 | 99.4 | 2.8
$\mathbf{LSUNc}$ | Gaussian Noise | 77 | 92.2 | 12.3
Speckle Noise | 80.2 | 94.9 | 10.6
$\mathbf{LSUNr}$ | Gaussian Noise | 83.1 | 96.1 | 9.5
Speckle Noise | 98.5 | 99.6 | 2.1
$\mathbf{iSUN}$ | Gaussian Noise | 77.4 | 94.5 | 11.3
Speckle Noise | 97.1 | 99.4 | 3.2
$\mathbf{SVHN}$ | Gaussian Noise | 78.6 | 93.1 | 13
Speckle Noise | 97.5 | 99.4 | 2.8
Table 10: Comparison between Gaussian and Speckle noise trained OOD
classifiers. We use DenseNet as network architecture for all methods.

##  13 Subfunction Error bound

In this section, we briefly explain the empirical error bounds for subfunction
as provided in [26] for the sake of completeness/self sufficiency. Consider a
distribution $D_{S}$ over size-N datasets that have the same activation region
data distributions and dataset sizes as $S$, where $S$ is the training dataset
$(\mathcal{X}\times\mathcal{Y})^{N}$ drawn IID from $D_{S}$. Then for all
$i\in[1,C]$, for any given $\delta\in(0,1]$, with probability > $1-\delta$ :

$\underbrace{R^{*}_{D_{S}}(h_{i})\triangleq\mathbb{E}_{S}[\hat{R}^{*}_{S}(h_{i})]}_{\text{expected
smooth
error}}\leq\overbrace{\underbrace{\hat{R}^{*}_{S}(h_{i})}_{\text{empirical
smooth
error}}+\underbrace{\cfrac{1}{\mathbb{P}(h_{i})}\sqrt{\cfrac{log\frac{2}{\delta}}{2N}}}_{\text{generalization
gap}}}^{\text{bound on expected smooth error}}$

where,

$\mathbb{P}(h_{i})\triangleq\cfrac{\sum_{j\in[1,C]}N_{j}k(h_{i},h_{j})}{\sum_{l\in[1,C]}\sum_{j\in[1,C]}N_{j}k(h_{l},h_{j})}$

for any non-negative weighting distance function between subfunctions,
$k:H\times H\rightarrow\mathbb{R}^{\geq 0}$. Note: C varies as $1/sqrt(N)$
where C is number of polytopes and N the number of training samples.

##  14 Time Efficiency

For applications demanding real-time performance, it is crucial to have low
latency in systems using DNN for inference. To analyze the comparative
efficiency, we run the experiments on a desktop system with Intel Core i7 (9th
Gen) processor, $16$GB RAM, and NVidia RTX 2060 GPU . We report inference time
in _ms_ averaged over $10K$ images at test time. CnC took the least time when
compared to other SOTA techniques. We report that both MSP [20] and CnC model
took $0.7$ms whereas ODIN [36] and Generalised-ODIN [24] took $3.1$ms and
$3.3$ms respectively. Inference time of Mahalanobis [33] was $8.8$ms while
GRAM matrices[47] took $10$ms. We use CIFAR10 trained models with [25] as the
feature extractor for this experiment.

##  15 Summary performance of various approaches

As is a practice in the literature we show the summary performance of various
approaches, along with their key conceptual differences as shown in Tab. 11

Method | IP | OV | RT
---|---|---|---
MSP (ICLR’17) [20] | $\times$ | $\times$ | $\times$
ODIN (ICLR’18) [36] | $\surd$ | $\surd$ | $\times$
Gen-ODIN (CVPR’21) [24] | $\surd$ | $\times$ | $\surd$
Maha (NeurIPS’18) [33] | $\times$ | $\surd$ | $\times$
Gram Matrices (ICML’20)[47] | $\times$ | $\times$ | $\times$
ACET (CVPR’20) [18] | $\times$ | $\times$ | $\surd$
ATOM (ECML’21) [3] | $\times$ | $\times$ | $\surd$
CnC(Proposed) | $\times$ | $\times$ | $\surd$
Table 11:  We show the conceptual differences between various techniques.
Notation: IP indicates whether a method needs input pre-processing or not
during inference, OV marks those methods which requires OOD validation set for
fine-tuning hyper-parameters, and RT defines whether re-training of neural
network is required or not.

##  16 Experiments on More Datasets

We compare our proposed method against existing literature on distribution
shift benchmark datasets such as Imagenet-O and Imagenet-R. We also show
empirically that our proposed method outperforms the existing literature by a
large margin when tested against corrupted OOD dataset such as Tiny-
ImageNet-C.

#### ImageNet-O

ImageNet-O is a natural adversarial out-of-distribution dataset curated in
[23]. It consists of images which are natural, unmodified, real-world examples
and are selected to cause a model to make a mistake, as with synthetic
adversarial examples. The design is such that it causes models to mistake the
examples as high-confidence in-distribution examples. It allows us to estimate
model uncertainty due to data distribution shift. It comprises of 2000 test
images which occur naturally but mimic synthetic adversarial examples.

#### ImageNet-R.

ImageNet-R is a $30000$ image test set containing various renditions of 200
ImageNet object classes. These renditions belong to either of following
categories - art, cartoons, graffiti, embroidery, graphics, origami,
paintings, patterns, plastic objects, plush objects, sculptures, sketches,
tattoos, toys, and video games.

#### Corrupted OOD

To mimic OOD occurring more naturally in physical world, we also compare
against TinyImageNet-C , which consists of corrupted versions of images in
Tiny-ImageNet. For fair comparison, in this study, we use CnC-3 for testing
instead of CnC which uses all types of corruptions in training. Also, during
testing we remove those corruption types from TinyImagenet-C which were used
for training in CnC-3, specifically contrast, frost and saturate which are
determined empirically to show higher diversity in embedding space than
individual noise types considered in isolation. We strictly maintain that
training and testing corruption sets are exhaustive and mutually exclusive.

While testing, images in ImageNet-O, ImageNet-R and TinyImageNet-C are down-
sampled to a size of $32\times 32$. Table 12, Table 4 (main), and Table 13
present experimental results that back CnC for robustness. We note that CnC
not only excels against natural OOD transforms but also is resistant to
certain adversarial perturbations and corruption transforms.

$\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---
| $\mathbf{(95\%TPR)}$ |  |
| $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
MSP [20] | 16.3 | 75.1 | 30.3
ODIN [36] | 26.6 | 80.2 | 26.5
Gen-ODIN [24] | 43.8 | 86.2 | 21.5
Mahalanobis [33] | 25.9 | 67.9 | 34.5
Gram Matrices [47] | 31.28 | 79.86 | 27.4
CnC | 44.2 | 86.9 | 20.9
Table 12: Experiment results for $\mathbf{ImageNet-O}$ dataset. We use DenseNet as feature extractor and CIFAR-100 as in-distribution.  $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---
| $\mathbf{(95\%TPR)}$ |  |
| $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
MSP [20] | 20.5 | 77.5 | 28.5
ODIN [36] | 22.9 | 79.4 | 27.3
Gen-ODIN [24] | 0.2 | 50.0 | 18.3
Mahalanobis [33] | 10.7 | 59.0 | 43.3
Gram Matrices [47] | 16.1 | 69.3 | 35.7
CnC-3 | 27.8 | 81.2 | 25.9
Table 13: Experiment results for $\mathbf{Tiny-ImageNet-C}$ dataset. We use
DenseNet as feature extractor and CIFAR-100 as in-distribution. The values are
averaged over corrupted versions of OOD benchmark datasets. We show that even
training with CnC samples generated by applying a subset of corruptions
mentioned in [19], we get an almost optimal OOD detection performance.

##  17 Performance on Non-Semantic Data Shift

In this section, we aim to show the efficacy of CnC algorithm when tested
against a non-semantic data shift. For this, we use PACS [61] dataset,
commonly used as benchmark for domain generalization. It consists of four
domains, namely Photo (1,670 images), Art Painting (2,048 images), Cartoon
(2,344 images) and Sketch (3,929 images), where images are of dimension
$227\times 227$. Each domain contains seven classes which are dog, elephant,
giraffe, horse, house, person and guitar. Table 14 and Table 15 tabulates the
experimental results. Table 4 in the main manuscript presented the performance
of OOD detectors under domain shift, extending this, Table 15 illustrated that
CnC trained on one domain in PACS dataset and tested on the others outperforms
Generalised-ODIN [24]. Similarly results are consistent in Table 14.

$\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-10}$ | $\mathbf{PACS(Dog)}$ |  MSP [20] | 37.7 | 87.4 | 18.9
ODIN [36] | 71.1 | 91.7 | 15.0
Gen-ODIN [24] | 74.7 | 93.3 | 14.1
Mahalanobis [33] | 15.1 | 40.6 | 44.4
Gram Matrices [47] | 28.6 | 85.1 | 21.5
CnC(Proposed) | 78.5 | 94.2 | 11.9
$\mathbf{PACS(Horse)}$ |  MSP [20] | 24.1 | 78.3 | 28.3
ODIN [36] | 52.9 | 87.1 | 20.8
Gen-ODIN [24] | 65.1 | 90.8 | 17.4
Mahalanobis [33] | 9.9 | 34.8 | 46.8
Gram Matrices [47] | 46.4 | 88.3 | 18.3
CnC(Proposed) | 73.3 | 93.7 | 12.5
Table 14: Comparison of CnC with competitive OOD detection methods when a model is trained on CIFAR10 and tested on samples from class dog and horse in PACS[34]. To test fairly for non-semantic shift, we only consider the dog and horse class, as CIFAR-10 also has natural images of dog and horse in its training set. We use DenseNet as network architecture for all methods. $\mathcal{D}_{\text{in}}^{\text{train}}$ | $\mathcal{D}_{\text{out}}^{\text{test}}$ | TNR@TPR95 | AUROC | DetErr
---|---|---|---|---
$\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
|  |  CnC / Gen-ODIN [24]
$\mathbf{Photo}$ | Art and Painting |  86.7/52.7 |  96.0/ 88.0 |  7.7/19.8
Sketch |  15.3/99.7 |  57.8/99.9 |  38.8/1.2
Cartoon |  34.1/77.2 |  64.5/95.0 |  31.3/12.0
$\mathbf{Cartoon}$ | Photo |  92.4/68.2 |  96.6/90.2 |  6.1/16.8
Sketch |  97.1/76.2 |  97.6/95.4 |  3.9/10.9
Art and Painting |  98.8/75.1 |  99.5/94.9 |  2.5/11.4
$\mathbf{Sketch}$ | Art and Painting |  100.0/99.9 | 100.0/100.0 |  0.1/0.2
Photo |  100.0/100.0 |  100.0/100.0 |  0.1/0.1
Cartoon |  100.0/99.8 | 100.0/100.0 |  0.3/0.5
$\mathbf{Art\&Painting}$ | Photo |  57.3/30.0 |  83.0/89.0 |  15.4/17.5
Sketch |  98.9/17.3 |  99.6/76.1 |  2.8/29.3
Cartoon |  49.1/31.6 |  86.5/72.1 |  16.1/18.5
Table 15: Results of non-semantic shift, when we train on one domain in PACS dataset [61] and test on other three. Observe that the CnC trained model performs better than Gen-ODIN [24] in certain cases. $\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-100}$ | $\mathbf{TINc}$ | PBCC | 93.7 | 98.7 | 5.4
Corruption | 96.7 | 99.2 | 4.0
r-CnC | 94.8 | 98.7 | 4.5
| CnC | 99.7 | 99.9 | 1.3
$\mathbf{TINr}$ | PBCC | 91.0 | 98.3 | 6.9
Corruption | 94.5 | 98.9 | 5.0
r-CnC | 93.2 | 97.9 | 6.1
| CnC | 99.6 | 99.8 | 1.6
$\mathbf{LSUNc}$ | PBCC | 67.2 | 90.3 | 18.6
Corruption | 96.7 | 99.2 | 4.1
r-CnC | 95.4 | 98.7 | 5.9
| CnC | 98.3 | 99.6 | 3.1
$\mathbf{LSUNr}$ | PBCC | 97.2 | 99.4 | 3.4
Corruption | 95.7 | 99.1 | 4.5
r-CnC | 94.7 | 98.6 | 5.6
| CnC | 99.9 | 99.9 | 0.9
$\mathbf{iSUN}$ | PBCC | 95.2 | 99 | 4.8
Corruption | 94.0 | 98.8 | 5.3
r-CnC | 93.5 | 97.7 | 4.5
| CnC | 99.6 | 99.9 | 1.4
$\mathbf{SVHN}$ | PBCC | 10.4 | 72.2 | 32.6
Corruption | 98.5 | 99.5 | 2.8
r-CnC | 98.0 | 98.5 | 10.8
| CnC | 98.7 | 99.7 | 2.0
Table 16: Ablation: We use DenseNet as network architecture for all methods.
CnC denotes our proposed method Corruption Over PBCC and r-CnC denotes
PBCCOverCorruption.

$\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-10}$ | $\mathbf{TINc}$ | MSP [20] | 56.7 | 93.8 | 11.9
ODIN [36] | 96.8 | 99.2 | 4.0
Gen-ODIN [24] | 93.0 | 98.6 | 5.9
Mahalanobis [33] | 75.0 | 89.6 | 13.7
Gram Matrices [47] | 96.7 | 99.3 | 3.9
CnC(Proposed) | 99.9 | 100 | 0.6
$\mathbf{TINr}$ | MSP | 58.9 | 94.1 | 11.5
ODIN [36] | 90.6 | 98.2 | 6.7
Gen-ODIN [24] | 94.9 | 99.0 | 5.0
Mahalanobis [33] | 84.9 | 94.0 | 9.9
Gram Matrices [47] | 98.8 | 99.7 | 2.1
CnC(Proposed) | 99.9 | 100.0 | 0.8
$\mathbf{LSUNc}$ | MSP | 51.8 | 92.9 | 13.1
ODIN [36] | 98.1 | 99.5 | 3.3
Gen-ODIN [24] | 92.1 | 98.4 | 6.4
Mahalanobis [33] | 85.0 | 92.6 | 10.0
Gram Matrices [47] | 88.4 | 97.5 | 8.0
CnC(Proposed) | 99.8 | 99.9 | 1.0
$\mathbf{LSUNr}$ | MSP | 66.6 | 95.4 | 9.7
ODIN [36] | 96.7 | 99.2 | 4.0
Gen-ODIN [24] | 97.4 | 99.4 | 3.5
Mahalanobis [33] | 88.0 | 95.8 | 8.4
Gram Matrices [47] | 99.5 | 99.9 | 1.4
CnC(Proposed) | 100.0 | 100.0 | 0.6
$\mathbf{iSUN}$ | MSP | 62.5 | 94.7 | 10.8
ODIN [36] | 95.5 | 99.0 | 4.7
Gen-ODIN [24] | 97.6 | 99.4 | 3.6
Mahalanobis [33] | 87.0 | 96.0 | 8.8
Gram Matrices [47] | 99.0 | 99.8 | 2.1
CnC(Proposed) | 99.9 | 100.0 | 0.7
$\mathbf{SVHN}$ | MSP | 40.2 | 89.9 | 16.8
ODIN [36] | 76.8 | 95.3 | 11.9
Gen-ODIN [24] | 89.0 | 98.0 | 7.8
Mahalanobis [33] | 83.2 | 93.0 | 10.7
Gram Matrices [47] | 96.1 | 99.1 | 4.1
CnC(Proposed) | 99.7 | 99.9 | 0.9

Table 17: Comparison with competitive OOD detection methods . We use DenseNet as network architecture for all methods.  $\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-100}$ | $\mathbf{TINc}$ | MSP [20] | 24.6 | 76.2 | 31
ODIN [36] | 84.6 | 97.2 | 8.9
Gen-ODIN [24] | 86.5 | 97.3 | 8.2
Mahalanobis [33] | 53.8 | 93.1 | 15.1
Gram Matrices [47] | 89.0 | 97.7 | 7.5
CnC(Proposed) | 99.7 | 99.9 | 1.3
$\mathbf{TINr}$ | MSP [20] | 17.6 | 71.6 | 34.3
ODIN [36] | 64.6 | 92.8 | 15.2
Gen-ODIN [24] | 91.6 | 98.3 | 6.4
Mahalanobis [33] | 79.1 | 93.6 | 11.7
Gram Matrices [47] | 95.7 | 99.0 | 4.5
CnC(Proposed) | 99.6 | 99.8 | 1.6
$\mathbf{LSUNc}$ | MSP [20] | 28.6 | 80.2 | 27.3
ODIN [36] | 84.6 | 97.3 | 8.7
Gen-ODIN [24] | 77.5 | 95.8 | 11.1
Mahalanobis [33] | 69.5 | 93.1 | 12.4
Gram Matrices [47] | 65.5 | 91.4 | 16.4
CnC(Proposed) | 98.3 | 99.6 | 3.1
$\mathbf{LSUNr}$ | MSP [20] | 17.6 | 70.8 | 35
ODIN [36] | 65.2 | 93.4 | 14.2
Gen-ODIN [24] | 91.4 | 98.2 | 6.3
Mahalanobis [33] | 81 | 95.6 | 10.6
Gram Matrices [47] | 97.2 | 99.3 | 3.6
CnC(Proposed) | 99.9 | 99.9 | 0.9
$\mathbf{iSUN}$ | MSP [20] | 14.9 | 69.5 | 36.2
ODIN [36] | 61.1 | 92.1 | 19.6
Gen-ODIN [24] | 91.2 | 98.3 | 6.6
Mahalanobis [33] | 79.8 | 94.6 | 11.0
Gram Matrices [47] | 95.9 | 99.0 | 4.4
CnC(Proposed) | 99.6 | 99.9 | 1.4
$\mathbf{SVHN}$ | MSP [20] | 20.9 | 82.7 | 24.4
ODIN [36] | 10.0 | 70.5 | 33.6
Gen-ODIN [24] | 80.3 | 96.6 | 9.7
Mahalanobis [33] | 46.5 | 86.3 | 19.6
Gram Matrices [47] | 89.3 | 97.3 | 7.6
CnC(Proposed) | 98.7 | 99.7 | 2.0
Table 18: Comparison with competitive OOD detection methods . We use DenseNet
as network architecture for all methods.

$\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-10}$ | $\mathbf{TINc}$ | MSP [20] | 43.9 | 91.0 | 15.2
ODIN [36] | 66.2 | 92.6 | 15.6
Gen-ODIN [24] | 84.6 | 97.1 | 8.8
Mahalanobis [33] | 76.0 | 95.0 | 12.6
Gram Matrices [47] | 96.7 | 99.2 | 3.9
CnC(Proposed) | 100.0 | 100.0 | 0.5
$\mathbf{TINr}$ | MSP [20] | 42.1 | 90.3 | 15.8
ODIN [36] | 69.0 | 93.1 | 14.8
Gen-ODIN [24] | 83.8 | 96.8 | 9.1
Mahalanobis [33] | 85.5 | 96.8 | 9.3
Gram Matrices [47] | 98.7 | 99.7 | 3.2
CnC(Proposed) | 99.9 | 100.0 | 0.9
$\mathbf{LSUNc}$ | MSP [20] | 45.8 | 91.7 | 13.6
ODIN [36] | 63.6 | 91.4 | 17.0
Gen-ODIN [24] | 89.2 | 98.0 | 7.4
Mahalanobis [33] | 70.4 | 93.0 | 14.7
Gram Matrices [47] | 89.8 | 97.8 | 8.4
CnC(Proposed) | 99.9 | 100.0 | 0.8
$\mathbf{LSUNr}$ | MSP [20] | 41.2 | 90.1 | 15.8
ODIN [36] | 70.6 | 93.2 | 14.4
Gen-ODIN [24] | 92.9 | 98.5 | 5.8
Mahalanobis [33] | 87.3 | 97.2 | 8.4
Gram Matrices [47] | 98.7 | 99.7 | 1.4
CnC(Proposed) | 100.0 | 100.0 | 0.7
$\mathbf{iSUN}$ | MSP [20] | 41.9 | 90.3 | 15.7
ODIN [36] | 71.0 | 93.5 | 14.3
Gen-ODIN [24] | 91.6 | 98.3 | 6.3
Mahalanobis [33] | 86.0 | 97.0 | 9.1
Gram Matrices [47] | 99.3 | 99.8 | 1.9
CnC(Proposed) | 100.0 | 100.0 | 0.7
$\mathbf{SVHN}$ | MSP [20] | 27.9 | 89.3 | 14.9
ODIN [36] | 39.1 | 84.9 | 24.4
Gen-ODIN [24] | 90.8 | 98.4 | 6.6
Mahalanobis [33] | 96.8 | 99.1 | 3.8
Gram Matrices [47] | 97.6 | 99.5 | 3.3
CnC(Proposed) | 99.6 | 99.9 | 1.2

Table 19: Comparison with competitive OOD detection methods . We use ResNet as network architecture for all methods.  $\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-100}$ | $\mathbf{TINc}$ | MSP [20] | 21.8 | 77.1 | 29.6
ODIN [36] | 41.8 | 84.3 | 22.7
Gen-ODIN [24] | 80.4 | 96.6 | 9.7
Mahalanobis [33] | 49.8 | 85.0 | 23.0
Gram Matrices [47] | 88.5 | 97.7 | 7.8
CnC(Proposed) | 99.5 | 99.8 | 1.8
$\mathbf{TINr}$ | MSP [20] | 17.6 | 73.4 | 32.0
ODIN [36] | 45.5 | 86.1 | 21.6
Gen-ODIN [24] | 87.3 | 97.6 | 7.9
Mahalanobis [33] | 59.0 | 88.1 | 19.6
Gram Matrices [47] | 94.8 | 98.9 | 5.0
CnC(Proposed) | 99.0 | 99.7 | 2.2
$\mathbf{LSUNc}$ | MSP [20] | 16.1 | 74.1 | 31.8
ODIN [36] | 26.7 | 77.5 | 28.9
Gen-ODIN [24] | 69.5 | 94.6 | 13
Mahalanobis [33] | 37.0 | 80.2 | 28.4
Gram Matrices [47] | 64.8 | 92.1 | 15.8
CnC(Proposed) | 98.4 | 99.6 | 2.9
$\mathbf{LSUNr}$ | MSP [20] | 14.9 | 70.9 | 33.9
ODIN [36] | 39.8 | 82.8 | 24.5
Gen-ODIN [24] | 86.1 | 97.5 | 7.8
Mahalanobis [33] | 56.5 | 91.0 | 17.3
Gram Matrices [47] | 96.6 | 99.2 | 3.3
CnC(Proposed) | 99.6 | 99.9 | 1.6
$\mathbf{iSUN}$ | MSP [20] | 15.1 | 72.6 | 32.7
ODIN [36] | 43.8 | 84.5 | 22.9
Gen-ODIN [24] | 84.6 | 97.1 | 8.8
Mahalanobis [33] | 60.0 | 90.3 | 17.4
Gram Matrices [47] | 94.8 | 98.8 | 4.4
CnC(Proposed) | 98.6 | 99.6 | 2.4
$\mathbf{SVHN}$ | MSP [20] | 14.9 | 76.4 | 29.1
ODIN [36] | 21.6 | 73.9 | 32.1
Gen-ODIN [24] | 48.0 | 91.8 | 14.9
Mahalanobis [33] | 33.8 | 86.0 | 21.3
Gram Matrices [47] | 80.8 | 96.0 | 10.4
CnC(Proposed) | 98.3 | 99.6 | 2.3
Table 20: Comparison with competitive OOD detection methods . We use ResNet as network architecture for all methods.  $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$ | $\mathbf{Mean}$ | $\mathbf{Mean}$
---|---|---|---|---|---
| $\mathbf{(95\%TPR)}$ |  |  | Diversity | Entropy
| $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$
CnC(proposed) | 98.3 | 99.6 | 2.6 | 3.4 | 0.4
PBCC | 93.7 | 98.6 | 6.2 | 2.27 | 0.33
Corruptions | 97.5 | 99.4 | 3.5 | 3.38 | 0.38
AnC | 70.2 | 94.4 | 14.1 | 1.57 | 0.92
CnM | 68.3 | 92.5 | 14.0 | 3.3 | 0.32
Table 21: We aim to show that although adversarially perturbed images can
cause a model to generate low confidence probability vectors for OOD class (
This means high entropy on samples that correspond to OOD) but generate sub-
optimal results. Thus the higher entropy argument does not hold for
adversarially perturbed images although the higher diversity leading to higher
OOD detection performance holds true. Experimental Setup : We consider
CIFAR-10 dataset as ID and a K-class classifier pretrained on CIFAR-10 as
input. To ensure a controlled setting, we first generate and save PBCC images
locally. Now we adversarially perturb PBCC images using PGD-L2 attack [39] to
ensure that they cause the model to generate low confidence probability
vectors close to uniform distribution. We name this method of generating proxy
OOD samples as AnC (Adversarial Perturbations over PBCC) Comparison of OOD
detection performance metrics CnC (Proposed), PBCC, Corruptions [19], AnC and
CnM OOD detectors. Note CnM refers to Corruption over Mixup[44] augmentation
technique (See description of CnM on Table 22). We use ResNet as network
architecture, CIFAR-10 as ID dataset and TinyImageNet(Crop) as OOD dataset for
all methods.

##  18 More Comparison with State-of-the-art

To demonstrate the effectiveness of CnC based data augmentation, we provide
results of<EMAIL_ADDRESS>AUROC and Detection Error of our method against the
competing methods. We demonstrate that our method yields superior results on
standard benchmark ID-OOD dataset pairs. To show the results are superior and
also independent of feature extractor, we perform comparison using two
standard feature extractors, DenseNet-BC and Resnet-34. Please refer to Table
17, Table 18 for results obtained using DenseNet as feature extractor. In
Table 19, Table 20 we show results when ResNet-34 backbone is used for
experimentation.

Inputs: $\mathcal{D}^{train}_{OOD}$

// proxy OOD samples

$F$

// K class classifier pre-trained on $\mathcal{D}^{train}_{in}$

$Diversity$

// training set diversity

Output: Diversity $DataDiv$

Function  _OodDiversity(_$X$_)_

// $X$ is an array of logits

$div\leftarrow$ $\emptyset$

foreach  _$x_{i}$ in $X$_ do

l = $\min$ $d(x_{i},x_{j})$ // d(.) is distance metric, and $i\neq j$

$div\leftarrow$ {$div\cup l$}

return $average(div)$

// Main loop

$X\leftarrow$ $\emptyset$

foreach  _ $image$ in $\mathcal{D}^{train}_{\texttt{OOD}}$_ do

$out$ = F($image$)

// out is the logits obtained having K dimensions

$X\leftarrow$ {$X\cup out$}

$DataDiv\leftarrow$OodDiversity(_X_)

Algorithm 2 Measuring OOD diversity Figure 9: Comparison of ROC curves of CnC with PBCC, Corruptions [19] and r-CnC on DenseNet-BC-100 network, where CIFAR-10 and SVHN, Imagenet, LSUN are in- and out-of-distribution datasets, respectively $\mathcal{D}_{in}^{train}$ | $\mathcal{D}_{out}^{test}$ | $\mathbf{Method}$ | $\mathbf{TNR}$ | $\mathbf{AUROC}$ | $\mathbf{DetErr}$
---|---|---|---|---|---
|  |  | $\mathbf{(95\%TPR)}$ |  |
|  |  | $\boldsymbol{\uparrow}$ | $\boldsymbol{\uparrow}$ | $\boldsymbol{\downarrow}$
$\mathbf{CIFAR-10}$ | $\mathbf{TINc}$ | CnM | 68.3 | 92.5 | 14.0
CnC | 100.0 | 100.0 | 0.5
$\mathbf{TINr}$ | CnM | 60.2 | 90.4 | 16.4
CnC | 99.9 | 100.0 | 0.9
$\mathbf{LSUNc}$ | CnM | 86.7 | 96.8 | 8.6
CnC | 99.9 | 100.0 | 0.8
$\mathbf{LSUNr}$ | CnM | 71.1 | 93.5 | 13.0
CnC | 100.0 | 100.0 | 0.7
$\mathbf{iSUN}$ | CnM | 82.4 | 95.0 | 10.6
CnC | 100.0 | 100.0 | 0.7
$\mathbf{SVHN}$ | CnM | 56.7 | 93.8 | 11.9
CnC | 99.6 | 99.9 | 1.2
Table 22: We show that Compounded Corruptions (Corruption Over PBCC (CnC))
generates better proxy OOD samples as compared to Corruption over Mixup [59]
(CnM). Mixup [59] generates new data through convex combination of training
samples and labels to improve DNN generalization. We hypothesize that PBCC
generates more diverse samples and thus spans a larger region of the OOD space
as compared to Mixup [59], hence, better exploration of the OOD space and
better accuracy at test time. Using Algorithm 2, we find the mean diversity of
CnM generated samples are $3.29$ where as that of CnC is $3.40$ (as indicated
in Table 21). We use ResNet as network architecture for all methods.

## References

  * [1] Bendale, A., Boult, T.E.: Towards open set deep networks. In: Proceedings of the IEEE CVPR. pp. 1563–1572 (2016)
  * [2] Chattopadhay, A., Sarkar, A., Howlader, P., Balasubramanian, V.N.: Grad-cam++: Generalized gradient-based visual explanations for deep convolutional networks. In: 2018 IEEE Winter Conference on Applications of Computer Vision (WACV). pp. 839–847 (2018). https://doi.org/10.1109/WACV.2018.00097
  * [3] Chen, J., Li, Y., Wu, X., Liang, Y., Jha, S.: Atom: Robustifying out-of-distribution detection using outlier mining. In Proceedings of European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD) (2021)
  * [4] Chen, P., Liu, S., Zhao, H., Jia, J.: Gridmask data augmentation (2020)
  * [5] Cubuk, E.D., Zoph, B., Shlens, J., Le, Q.: Randaugment: Practical automated data augmentation with a reduced search space. In: Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M.F., Lin, H. (eds.) Advances in NeurIPS (2020)
  * [6] Dabouei, A., Soleymani, S., Taherkhani, F., Nasrabadi, N.M.: Supermix: Supervising the mixing data augmentation. In: Proceedings of the IEEE/CVF CVPR. pp. 13794–13803 (2021)
  * [7] DeVries, T., Taylor, G.W.: Improved regularization of convolutional neural networks with cutout (2017)
  * [8] Du, X., Wang, Z., Cai, M., Li, Y.: VOS: learning what you don’t know by virtual outlier synthesis. ICLR (2022)
  * [9] Fang, Z., Lu, J., Liu, A., Liu, F., Zhang, G.: Learning bounds for open-set learning. In: International Conference on Machine Learning. pp. 3122–3132. PMLR (2021)
  * [10] Gal, Y., Ghahramani, Z.: Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In: ICML (2016)
  * [11] Ge, Z., Demyanov, S., Chen, Z., Garnavi, R.: Generative openmax for multi-class open set classification. In: BMVC (2017)
  * [12] Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. International Conference on Learning Representations (ICLR) (2015)
  * [13] Graves, A.: Practical variational inference for neural networks. In: Shawe-Taylor, J., Zemel, R.S., Bartlett, P.L., Pereira, F., Weinberger, K.Q. (eds.) Advances in Neural Information Processing Systems 24, pp. 2348–2356 (2011)
  * [14] Guo, C., Pleiss, G., Sun, Y., Weinberger, K.Q.: On calibration of modern neural networks. In: ICML. pp. 1321–1330 (2017)
  * [15] Harris, E., Marcu, A., Painter, M., Niranjan, M., Prügel-Bennett, A., Hare, J.: Fmix: Enhancing mixed sample data augmentation (2021)
  * [16] He, K., Zhang, X., Ren, S., Sun, J.: Identity mappings in deep residual networks (2016)
  * [17] Hebbalaguppe, R., Prakash, J., Madan, N., Arora, C.: A stitch in time saves nine: A train-time regularizing loss for improved neural network calibration. In: Proceedings of the IEEE/CVF CVPR. pp. 16081–16090 (2022)
  * [18] Hein, M., Andriushchenko, M., Bitterwolf, J.: Why relu networks yield high-confidence predictions far away from the training data and how to mitigate the problem. In: Proceedings of the IEEE/CVF CVPR. pp. 41–50 (2019)
  * [19] Hendrycks, D., Dietterich, T.: Benchmarking neural network robustness to common corruptions and perturbations. In: ICLR (2018)
  * [20] Hendrycks, D., Gimpel, K.: A baseline for detecting misclassified and out-of-distribution examples in neural networks. ICLR (2017)
  * [21] Hendrycks, D., Mazeika, M., Dietterich, T.: Deep anomaly detection with outlier exposure. International Conference on Learning Representations (ICLR) (2019)
  * [22] Hendrycks*, D., Mu*, N., Cubuk, E.D., Zoph, B., Gilmer, J., Lakshminarayanan, B.: Augmix: A simple method to improve robustness and uncertainty under data shift. In: International Conference on Learning Representations (2020)
  * [23] Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., Song, D.: Natural adversarial examples. In: Proceedings of the IEEE/CVF CVPR. pp. 15262–15271 (2021)
  * [24] Hsu, Y.C., Shen, Y., Jin, H., Kira, Z.: Generalized odin: Detecting out-of-distribution image without learning from out-of-distribution data. In: Proceedings of the IEEE/CVF CVPR. pp. 10951–10960 (2020)
  * [25] Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 4700–4708 (2017)
  * [26] Ji, X., Pascanu, R., Hjelm, R.D., Vedaldi, A., Lakshminarayanan, B., Bengio, Y.: Predicting unreliable predictions by shattering a neural network. CoRR abs/2106.08365 (2021), https://arxiv.org/abs/2106.08365
  * [27] Jordan, M., Lewis, J., Dimakis, A.G.: Provable certificates for adversarial examples: Fitting a ball in the union of polytopes. 33rd Conference on Neural Information Processing Systems (NeurIPS) (2019)
  * [28] Kim, J.H., Choo, W., Song, H.O.: Puzzle mix: Exploiting saliency and local statistics for optimal mixup. In: ICML (2020)
  * [29] Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)
  * [30] Lakshminarayanan, B., Pritzel, A., Blundell, C.: Simple and scalable predictive uncertainty estimation using deep ensembles. In: Advances in NeurIPS. pp. 6402–6413 (2017)
  * [31] Le, Y., Yang, X.: Tiny imagenet visual recognition challenge. CS 231N p. 3 (2015)
  * [32] Lee, K., Lee, H., Lee, K., Shin, J.: Training confidence-calibrated classifiers for detecting out-of-distribution samples. arXiv preprint arXiv:1711.09325 (2017)
  * [33] Lee, K., Lee, K., Lee, H., Shin, J.: A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in NeurIPS 31 (2018)
  * [34] Li, D., Yang, Y., Song, Y.Z., Hospedales, T.M.: Deeper, broader and artier domain generalization (2017)
  * [35] Li, D., Chen, D., Goh, J., Ng, S.k.: Anomaly detection with generative adversarial networks for multivariate time series. ACM KDD
  * [36] Liang, S., Li, Y., Srikant, R.: Enhancing the reliability of out-of-distribution image detection in neural networks. In: ICLR (2018)
  * [37] Lin, Z., Roy, S.D., Li, Y.: Mood: Multi-level out-of-distribution detection. In: Proceedings of the IEEE/CVF CVPR. pp. 15313–15323 (2021)
  * [38] Liu, W., Wang, X., Owens, J., Li, Y.: Energy-based out-of-distribution detection. Advances in Neural Information Processing Systems (NeurIPS) (2020)
  * [39] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. ICLR (2018)
  * [40] Mohseni, S., Pitale, M., Yadawa, J., Wang, Z.: Self-supervised learning for generalizable out-of-distribution detection. AAAI pp. 5216–5223 (Apr 2020)
  * [41] Neal, L., Olson, M., Fern, X., Wong, W.K., Li, F.: Open set learning with counterfactual images. In: ECCV. pp. 613–628 (2018)
  * [42] Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A.Y.: Reading digits in natural images with unsupervised feature learning. In: NeurIPS’21 (2011)
  * [43] Nguyen, A., Yosinski, J., Clune, J.: Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In: Proceedings of the IEEE CVPR. pp. 427–436 (2015)
  * [44] Pang*, T., Xu*, K., Zhu, J.: Mixup inference: Better exploiting mixup to defend adversarial attacks. In: International Conference on Learning Representations (2020)
  * [45] Perera, P., Nallapati, R., Xiang, B.: Ocgan: One-class novelty detection using gans with constrained latent representations. In: IEEE/CVF CVPR (2019)
  * [46] Ramírez Rivera, A., Khan, A., Bekkouch, I.E.I., Sheikh, T.S.: Anomaly detection based on zero-shot outlier synthesis and hierarchical feature distillation. IEEE Transactions on Neural Networks and Learning Systems 33(1), 281–291 (2022)
  * [47] Sastry, C.S., Oore, S.: Detecting out-of-distribution examples with gram matrices. In: International Conference on Machine Learning. pp. 8491–8501. PMLR (2020)
  * [48] Scheirer, W.J., Jain, L.P., Boult, T.E.: Probability models for open set recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence (T-PAMI) 36 (2014)
  * [49] Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., Batra, D.: Grad-cam: Visual explanations from deep networks via gradient-based localization. In: 2017 IEEE International Conference on Computer Vision (ICCV). pp. 618–626 (2017). https://doi.org/10.1109/ICCV.2017.74
  * [50] Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)
  * [51] Torralba, A., Fergus, R., Freeman, W.T.: 80 million tiny images: A large data set for nonparametric object and scene recognition. IEEE Trans. on PAMI (2008)
  * [52] Uddin, S., Monira, M.S., Shin, W., Chung, T., Bae, S.H.: Saliencymix: A saliency guided data augmentation strategy for better regularization. In: ICLR (2021)
  * [53] Wang, W., Wang, A., Tamar, A., Chen, X., Abbeel, P.: Safer classification by synthesis. arXiv preprint arXiv:1711.08534 (2017)
  * [54] Wen, Y., Vicol, P., Ba, J., Tran, D., Grosse, R.: Flipout: Efficient pseudo-independent weight perturbations on mini-batches. In: ICLR (2018)
  * [55] Xiao, Z., Yan, Q., Amit, Y.: Likelihood regret: An out-of-distribution detection score for variational auto-encoder. Advances in Neural Information Processing Systems (2020)
  * [56] Yun, S., Han, D., Oh, S.J., Chun, S., Choe, J., Yoo, Y.: Cutmix: Regularization strategy to train strong classifiers with localizable features. In: Proceedings of the IEEE/CVF ICCV. pp. 6023–6032 (2019)
  * [57] Zagoruyko, S., Komodakis, N.: Wide residual networks. BMVC (2016)
  * [58] Zhang, C., Öztireli, C., Mandt, S., Salvi, G.: Active mini-batch sampling using repulsive point processes. In: AAAI. vol. 33, pp. 5741–5748 (2019)
  * [59] Zhang, H., Cisse, M., Dauphin, Y.N., Lopez-Paz, D.: mixup: Beyond empirical risk minimization. In: ICLR (2018)
  * [60] Zhong, Z., Zheng, L., Kang, G., Li, S., Yang, Y.: Random erasing data augmentation. In: AAAI. vol. 34, pp. 13001–13008 (2020)
  * [61] Zhou, K., Yang, Y., Hospedales, T., Xiang, T.: Deep domain-adversarial image generation for domain generalisation. AAAI 34, 13025–13032 (Apr 2020)