Nearest neighbor-based out-of-distribution detection via label smoothing

Thank you for the review.

RE: "the drawbacks of using softmax predictions". We clearly provide one reason in the third paragraph -- "This is largely because the softmax probabilities sum to 1 and thus must assign the probability weights accordingly." This does not apply to our method since there is no explicit constraint on the model's learned embeddings.

RE: notation. While we feel the notation is easy to follow, so that there is no confusion, we will clarify all notation used for the camera ready.

RE: "unsupervised". In our setup, the user trains a machine learning model on labeled samples $X_\text{in:train}$ ($\sim p_\text{in}$) and deploys it in the real world. Now, the model receives a query sample and the user would like to know whether this sample is from $p_\text{in}$ or not. Our method uses the user's trained model and $X_\text{in:train}$. Many other OOD methods, such as POEM, require samples from an auxiliary distribution $p_\text{aux}$ in order to discriminate between $p_\text{in}$ and the test distribution $p_\text{out}$. A limitation of these methods is that for them to work well, $p_\text{aux}$ often needs to be similar or representative of $p_\text{out}$, but the latter is not known beforehand. Our method sidesteps this as it does not require any auxiliary data.

Thank you for your reply. I re-evaluate the work and have a better understanding now. The core of the proposed method is similar to the likelihood ratio test, where the proposed "radius ratio" acts as a proxy of the likelihood ratio. Does the corollary 1 state the precision for such a "radius ratio"? The provided proof serves only Theorem 1, and Corollary 1 from Theorem 1 does not look like an immediate derivation to me. Can you provide a complete proof from Theorem 1 to Corollary 1?

We appreciate the detailed review.

1. Yu. et al trains a model with two classification heads with two losses -- the usual supervised cross-entropy loss on the labeled in-distribution samples, and another loss that encourages maximum discrepancy between the two heads on unlabeled points. Points that the heads disagree on are deemed OOD. This method requires auxiliary (unlabeled) OOD points and the performance degrades when the auxiliary samples are not from the test distribution. In contrast, our method does not require auxiliary samples. Meanwhile, react of Sun et. al truncates the activations of the model's penultimate layer, where the threshold c is chosen via a percentile on ID data. Any existing OOD detection scheme can then be used with the modified model (they use energy scoring). React is an interesting scheme; we will try to benchmark against it before the rebuttal deadline but if not, then we can do it upon acceptance for the camera ready.

2. We understand how the separation may not be readily apparent. We could report true negative and true positive rates at a range of thresholds but this might be too much. Would reporting the ROC-AUC (which is the same performance metric we use in experiments) for each chart help?

3. It may be difficult to quantify the theoretical results, because many constants are unknown, such as the extent to which the label smoothed hypothesis holds, as well as the density and the intrinsic dimension of the data. Rather, our theoretical result was motivated by the results we saw empirically.

4. The datasets we use have 10, 100, and 1000 classes. We find that our distance-based k-NN does well across the spectrum, with very large improvements over label-distribution-based control when the in-distribution dataset is Fashion MNIST.

Thank you for the review.

While there is no theory on using multiple latent representations, our combination is fairly simple -- for each layer, we normalize the query's k-NN score (where score is the k-NN density estimate) by the average in-distribution k-NN score, and then we average this quantity across layers. The normalization helps make the per-layer scores more comparable, since distances between embeddings can be larger in one layer than another. While the purpose of pooling across layers is to make the statistic more reliable (as is done in the Robust k-NN baseline), in our ablations, we show that using just a single layer (the penultimate one) does pretty well. In the single layer case, our statistic is equivalent to the k-NN score, since the normalizing constant does not matter.

RE: "ImageNet-1k scale". Thank you for the suggestion. Here are the results when when the training / in-distribution (ID) is CelebA and SVHN and the OOD dataset is the validation set of resized Imagenet-1k (https://www.tensorflow.org/datasets/catalog/imagenet_resized ; 32x32 size). In both cases, our proposed method does well, and it is a leading method among the baselines when the ID is CelebA.

RE: "Proposition 1". We provided an intuitive explanation of Proposition 1 before the statement, which says “that under certain regularity conditions on the density and X, we have that the ratio of the k-NN distance between an out-of-distribution point and an in-distribution point increases after this mapping,” where mapping refers to the one implied by the Label Smoothed Embedding Hypothesis when mapping from embeddings obtained w/o label smoothing to embeddings w/ label smoothing. We will further clarify this in the paper.

RE: "summary of the theory". The main non-trivial assumption we make is the Label Smoothed Embedding Hypothesis, which we parameterize by $\gamma_{in}$ and $\gamma_{out}$, and our results rigorously formalize the implications of these assumptions on the behavior of k-NN distances, which in turn implies that our k-NN based procedure is more effective under label smoothing. While the reviewer is correct that this isn’t a standard assumption, we stress that such an assumption is not unreasonable given that this phenomenon has been established empirically several times before. Our results require the use of theoretical techniques that were established less than a decade ago, and don’t immediately follow from known results.

Thank you for the thoughtful review.

The noteworthy cases where our method underperforms is when the (in, out) pair is (CIFAR10, SVHN) and (CelebA, SVHN). In these cases, control and POEM do better than all other baselines. While it can be challenging to pinpoint a cause for these particular losses, we suspect that the SVHN examples produce intermediate activations similar to those of CIFAR10 and CelebA (what the backbone network is trained on).

RE: "plus sign before x0 and proj(x)". The reviewer is correct that it should be a plus sign before each of these. We thank the reviewer for such a detailed reading of the paper and we apologize for any confusion it may have caused.