Mysteries of the Deep: Role of Intermediate Representations in Out of Distribution Detection

We appreciate the reviewer’s positive remarks on the paper’s clarity, experimental rigor, and architectural insights. Motivated by the suggestions, we have expanded our analysis in the revision to better characterize selection behaviors across metrics and architectures, and to clarify the benefits and limitations of our entropy-based strategy.

Q1: Which Layers Are Chosen by Each Selection Method?

We thank the reviewer for the question. To clarify the behavior of each selection method, we will include a dedicated section in the appendix describing the layers typically selected by different metrics. Below, we provide representative examples:

These results show that entropy consistently selects a mix of mid-to-deep layers (e.g., 3–8, 11), rather than simply favoring the final layers. In contrast, kurtosis, Gini, and JSD often focus on shallow–final pairs or layer 11 alone, leading to reduced performance. A qualitative explanation is provided in Figures G.11–G.12, where only entropy exhibits a stable correlation with FPR@95.

Q2: Do Certain Layers Consistently Contribute More to Performance?

To support the intuition that some layers are more valuable than others, we conducted a marginal utility analysis using ViT-B/16 on ImageNet. We ranked layers by their individual contribution to FPR reduction and AUROC improvement:

This confirms that layers 6–8 consistently provide strong utility and complement the final layer, reinforcing the idea that optimal combinations involve diverse mid-to-deep layers, not just the last n.

In addition, our consistency and diversity analysis (Figures E.8–E.9) shows:

• Within each ID dataset, top-10 oracle combinations have low pairwise Jaccard distance (≈ 0.48), indicating stable and convergent selections.
• Across datasets, the overlap drops (≈ 30–50%), and fixed layer sets perform worse (e.g., FPR: 0.300 vs 0.288 with entropy-based selection), emphasizing the benefit of dataset-specific layer selection.

Q3: Why Does Performance Degrade with More Layers in PEv1-B/16?

We hypothesize that the performance degradation in PEv1-B/16-224 when increasing the number of combined layers is due to its distilled architecture. Specifically, PE B/16 is distilled from the larger PE G model [1], which likely compresses most of the useful information into the final layers. This contrasts with CLIP models, which are trained end-to-end with contrastive objectives that promote semantic diversity across all layers.

As a result, intermediate representations in PEv1-B/16 tend to be less informative or redundant, and combining multiple layers introduces noise rather than complementary signals, ultimately harming OOD performance.

Q4: Do Selection Methods Adapt to PEv1-B/16 Behavior?

Yes. Our entropy-based selection method adapts accordingly and does not favor large N for PEv1-B/16. For example, it selects a small combination $[0, 1, 11]$, reflecting an attempt to minimize degradation. However, even this small combination performs slightly worse than using the final layer alone (FPR = 0.3816 vs. 0.3792), indicating that intermediate layers are not reliably useful in this model.

This outcome supports the idea that layer fusion is less beneficial for distilled architectures, where semantic abstraction is concentrated near the output and intermediate layers are poorly calibrated as shown in our analysis.

[1] Bolya et al. Perception Encoder: The best visual embeddings are not at the output of the network

We thank the reviewer for their feedback. We have carefully considered each suggestion and incorporated new analyses, comparisons, and clarifications to address the concerns. We hope these additions better convey the motivation, novelty, and practical value of our work.

Q1: Relation to Prior Work Using Intermediate Representations

While prior work [1–3] has explored intermediate layers for OOD detection, our method differs in both scope and design. Previous approaches focus on supervised models, require labeled ID data, auxiliar networks and select a single best layer using trained classifiers or regularization. In contrast, our method is fully training-free, uses no ID labels, and operates directly on pretrained CLIP models without fine-tuning. We fuse multiple intermediate layers instead of selecting just one, capturing complementary OOD signals and achieving consistent gains across datasets and architectures. Unlike prior work limited to CNNs, we conduct a systematic analysis across seven models with diverse training objectives, including contrastive and self-supervised vision-language models like CLIP, SiGLip-v2, and Perception Encoder. Our study reveals new insights into the role of intermediate representations for OOD detection and is orthogonal to scoring functions, making it complementary to existing methods (see Questions 2 and 5).

Q2: Generalization to Other Scoring Methods

We thank the reviewer for this suggestion. Based on it, we conducted additional evaluations using alternative scoring functions. While our main focus is on MCM due to its strong and stable performance, our method is compatible with a wide range of scoring strategies. We will include the detailed results in the revised version.

ResNet (RN50x4)

ViT-B/32

ViT-B/16

Q3: Validity of Random Projections for Geometry Preservation

As detailed in Appendix I, our use of fixed random projections is supported both theoretically and empirically. The Johnson–Lindenstrauss lemma [10, 32, 40] guarantees that such projections approximately preserve pairwise distances. Empirically, RanPAC [40] shows that random projections maintain the discriminative structure of visual features across domains, validating their use for aligning intermediate features without retraining.

Q4: Computational Overhead of Using Intermediate Layers

In response to the reviewer’s suggestion, we evaluated the computational overhead introduced by our method on both ResNet and ViT-B/16. At batch size 8 (averaged over 5 runs), ResNet shows a memory increase from 0.41 GB to 0.50 GB, latency from 17.1 ms to 19.5 ms, and a 12% drop in throughput (58.6 → 51.4 img/s). For ViT-B/16, memory increases from 0.57 GB to 0.69 GB, while latency remains stable (57.5 ms to 54.5 ms) and throughput is unchanged (54.1 to 54.4 img/s). These results support that, as requested, our method incurs minimal additional cost, particularly for transformer-based architectures. Full details will be included in the appendix.

Q5: Comparison to State-of-the-Art Methods

This is an interesting point, and we thank the reviewer for highlighting it. While recent methods such as CSP[4], NegLabel [5], and CLIPScope [6] achieve strong results, they typically rely on external resources such as WordNet hierarchies or handcrafted prompts, and use scoring functions specifically designed for their frameworks. In contrast, our method is orthogonal to these approaches. It focuses on the internal structure of the model and leverages intermediate-layer fusion, making it broadly compatible with other scoring strategies. To illustrate this, we applied our method to NegLabel and observed consistent improvements:

Q6: Why Do Metrics Like Kurtosis, Gini, and JSD Perform Worse Than Random?

Heuristics like kurtosis, Gini, and JSD perform worse than random because they often select redundant or uninformative layers, typically shallow or final ones, which limits the diversity needed for effective OOD detection. In contrast, entropy consistently selects mid-to-deep layers (such as 6 to 8) that offer a better balance between abstraction and diversity, achieving lower FPRs (e.g., 0.307 compared to up to 0.435). This is supported by our SVCCA and agreement analyses (Figures 3 and 4), the entropy–FPR correlation in Figures G.11 and G.12, and the marginal utility study. Random selection, although unguided, sometimes includes strong layers by chance, which explains its surprisingly competitive average performance. For further details, we refer to Response Q1 to Reviewer V3xf, which compares selection strategies, and Response Q2, which analyzes the individual utility of each layer.

Thank you for engaging. By combining CSP with intermediate layers, we observe a notable improvement, achieving lower FPR and higher AUROC:

One point to highlight is that CSP already consumes ~17,654 MB of VRAM, and our method can be seamlessly integrated without introducing any additional memory or computational overhead. We will include these results in the final version of the paper.

We thank Reviewer rDhG for the thoughtful and encouraging feedback. Below, we address each of the reviewer’s questions in detail. We elaborate on the intuition behind the effectiveness of intermediate layers for near-OOD shifts, discuss potential extensions involving OOD supervision, and clarify our evaluation choices and directions for future work.

Q1: Why do intermediate layers help particularly with near-OOD shifts?

Intermediate layers help in these cases because they capture diverse and complementary features that are often lost in the final layer. As shown in Figure F.10, early layers focus on textures and materials, middle layers on object parts and natural elements, while final layers emphasize high-level semantic concepts. By fusing signals from intermediate layers, our method retains fine-grained information critical for distinguishing near-OOD samples, leading to improved performance on datasets such as NINCO, and SSB-Hard.

[1] Oikarinen et al.: CLIP-Dissect: Automatic Description of Neuron Representations in Deep Vision Networks

Q2: Can intermediate layer selection be further improved using OOD data?

Thank you for the suggestion. While leveraging OOD data (e.g., Outlier Exposure [2]) can enhance robustness, it alters the problem setting by requiring access to OOD samples. In contrast, to explore the potential of OOD usage without supervision, we conducted an oracle-based analysis using per-sample dynamic layer selection. The results show clear room for improvement: average FPR@95 drops to 0.2004 for ViT-B/32 and 0.1680 for ViT-B/16. This highlights the potential of combining test-time adaptive strategies with OOD data as a promising future direction.

[2] Hendrycks et al.: Deep Anomaly Detection with Outlier Exposure

Q3: Any empirical evaluations on OOD detection tasks beyond image or on lower resolution CIFAR-based datasets?

Yes. we also evaluate on Pascal VOC. Results are provided in Table 5.1. We do not use CIFAR-based benchmarks, as their low resolution images lack the semantic complexity needed for OOD detection with models like CLIP, and they are not widely used in recent CLIP-based OOD benchmarks.

I would like to thank the authors for addressing my questions and clarifying the details. While I would still encourage the authors to consider strengthening their evaluation by including the CIFAR benchmark (given its common use in OOD detection) I do understand the reasoning behind its omission. Consequently, I will maintain my score as I continue to believe the work meets the standards for acceptance.

We sincerely thank the reviewer for their thoughtful and encouraging feedback. We are pleased to hear that the writing, motivation, and experimental rigor of our work were appreciated. In response to the reviewer’s suggestions, including the evaluation on more architectures, per-instance selection, computational overhead, and comparisons to additional metrics, we conducted new experiments and analyses, which we detail below. Each point raised has been carefully addressed in the revised response.

Q1: Clarification on Pascal-VOC Results

Thank you for pointing this out. This was a typographical error in the text. The correct performance values are those reported in Table 5.1, which reflect the actual evaluation. We will update the manuscript to resolve this inconsistency in the final version.

Q2: Per-Instance Dynamic Layer Selection

We thank the reviewer for this valuable suggestion. While we did not implement per-instance dynamic selection in our current method, we conducted an oracle-based analysis to assess its potential. Specifically, for each architecture and dataset, we identified the best-performing combination of layers per input sample, allowing the selected layers to vary dynamically across instances.

This yields the following lower-bound FPR@95 results:

• ViT-B/32: iNat 0.0575, DTD 0.2472, SUN 0.2122, Places 0.2845 → Avg FPR@95: 0.2004
• ViT-B/16: iNat 0.0693, DTD 0.1397, SUN 0.2305, Places 0.2325 → Avg FPR@95: 0.1680

These results indicate that per-sample dynamic layer selection could lead to further improvements, particularly on challenging datasets. While our current method performs entropy-based selection at the dataset level, this oracle highlights a promising direction for future work on test-time adaptive strategies.

Q3: Generalization to CNNs and Deeper Vision Architectures

Following the reviewer’s suggestion, we extended our evaluation to include both convolutional and deeper transformer-based vision architectures. Specifically, we tested our method on CLIP RN50x4 and CLIP ViT-L/14. The results below confirm that our approach generalizes well across different CLIP architectural types.

CLIP RN50x4 (ResNet)

CLIP ViT-L/14 (24-layer Transformer)

A: Model-Specific Behavior

While ViT-L/14 shows smaller gains, this aligns with our analysis in Section 3. Figures 2–4 and lines 142–146 show that ViT-L/14 exhibits greater redundancy and flatter entropy profiles across layers, limiting the benefits of fusion. This is further influenced by its sharper softmax distribution, which required a lower temperature setting (0.01). In contrast, ResNet-based models like RN50x4 benefit more from fusion due to higher inter-layer diversity and smoother confidence dynamics.

Q4: Computational Overhead

As requested, we performed additional experiments to quantify the computational overhead of our method. We evaluated inference time, memory usage, and throughput on ViT-B/32, comparing the use of the last layer versus our intermediate-layer fusion strategy. The results show that the use of intermediate layers introduces negligible overhead: memory usage increases by at most 0.04 GB, latency remains virtually unchanged, and throughput is preserved across all batch sizes.

ViT-B/32 | Last Layer vs Intermediate Layers

Q5: How does the proposed method perform when applied to real-world scenarios or domain-specific?

Our method could be well suited for real-world applications where inference efficiency, scalability, and reliability are essential, based on the computational results shown in the previous table. Unlike methods that require retraining or computationally expensive ensembles, our approach is lightweight and don't need a retraining.

Despite this, we acknowledge that real-world scenarios often involve challenges such as long-tailed class distributions and subtle distribution shifts factors known to significantly impact OOD detection performance [1, 2, 3]. While our current study focuses on standard benchmarks, the proposed method is modular, lightweight, and inference-only, making it a promising candidate for extension to safety-critical domains. We consider this an important direction for future work.

References [1] Miao et al. Out-of-Distribution Detection in Long-Tailed Recognition with Calibrated Outlier Class Learning [2] Wei et al. EAT: Towards Long-Tailed Out-of-Distribution Detection [3] Miao et al. Long-Tailed Out-of-Distribution Detection via Normalized Outlier Distribution Adaptation

Q6: Have you tried other statistical metrics for layer selection beyond entropy?

Yes, we explored several metrics for layer selection, as shown in Section 6 and Figure 6. These include entropy, kurtosis, Gini, JSD, and random selection. Entropy consistently performs best, selecting mid-to-deep layers (e.g., 6, 8, 11) that offer complementary information and result in the lowest FPR and highest AUROC. In contrast, other metrics often favor shallow or final layers, leading to weaker performance. We will include additional metrics and visualizations in the revised version to provide more detailed comparisons.

I thank the authors for the rebuttal.

For Q1, Q3, Q4, Q6, they are well addressed.

For Q2, this is interesting and I encourage the authors to include and discuss more in the revision.

For Q6, I understand that the time is limited for the rebuttal, but include some practical dataset setups would significantly strengthen the paper.

Overall, I will increase the final rating.

We thank the reviewer for their thoughtful and encouraging feedback. We are glad the strengths of our work, including its clarity, experimental depth, and visualizations, resonated with you. In response to your main suggestion, we will expanded our evaluation and provide a more detailed discussion on performance across architectures and modalities. Below, we address your questions and comments point by point.

Q: Evaluation on more models/architectures

We do demonstrate that the method performs well across a diverse range of vision architectures. Our systematic evaluation covers 7 vision architectures of diverse types: supervised (ViT), self-supervised (MAE, MoCo-v3, DINOv2), and contrastive (CLIP, SiGLip-v2, Perception Encoder). This allows discovering consistent trends (see next answer). We propose to include additional results from larger models, namely CLIP ViT-L/14 and PEv2-L/14 in the final version of the paper.

Q: How does the method perform across architectures?

The systematic evaluation across architectures shows that contrastive models (e.g. CLIP) consistently benefit from intermediate-layer fusion due to their high inter-layer diversity and stable prediction profiles. In contrast, supervised and self-supervised models often exhibit redundant or unstable representations across layers, which limits the benefits of fusion. These differences are driven both by the training objective and the dataset scale, which together influence cross-layer complementarity.

Q: Other modalities

The extension to other modalities such as text would be very interesting because similar layer-wise computations are likely at play. Indeed, prior work like Layer-by-Layer [1] and DoLa [2] shows that intermediate representations can improve performance and reduce hallucinations in LLMs. Some modality-specific adaptations would be required, for example replacing patch-based fusion with token-level strategies. We propose to add relevant discussion and suggestions in the "Future Work" section.

[1] Skean et al. Layer by Layer: Uncovering Hidden Representations in Language Models

[2] Chuang et al. DoLa: Decoding by Contrasting Layers Improves Factuality in Large Language Models

We're glad to hear that the clarity, visualizations, and experimental depth of our work resonated with you. We appreciate your suggestions regarding evaluation across architectures and modalities, and we’re happy our responses addressed your concerns. Thank you for your engagement and for maintaining your positive evaluation.