DOS: Dreaming Outlier Semantics for Out-of-distribution Detection

Q5. Why use FPR95 instead of AUPR?

Reply: Firstly, in OOD detection community, FPR95 is more commonly used. Specifically, FPR95 is frequently utilized to evaluate the false positive rate at high true positive rates. Since DOS is capable of achieving a high true positive rate, using FPR95 is more appropriate in this context.

Second, AUPR is often used to when evaluating unbalanced datasets (where the number of positive and negative samples varies greatly). However, since we are following MCM's dataset setting, where the difference in the number of positive and negative samples is not substantial, using FPR95 is more suitable in this scenario.

Thirdly, to investigate the performance of MCM and DOS in terms of AUPR, we report the results when positive samples are fewer than negative samples: ImageNet10 (ID) and ImageNet20 (OOD), with positive samples being half the number of negative ones. The specific results are as follows. Our DOS also outperforms MCM on the AUPR metric.

Table: AUPR

Q6. In Figure 7, why are far-ood and fine-grained-ood tested with 100s of outlier class labels but near-ood only with a maximum of 10?

Reply: We would like to clarify that the number of outlier class labels is 100 instead of 10 for the near OOD task. Specifically, we ask LLM to return 10 outlier class labels for each ID class, rather than giving 10 outlier class labels for the entire dataset. Thus the total of outlier classes is 100 for ImageNet10(ID).

Q3. There should be more discussion around how each dataset is adapted to be ID-OOD, For example, how similar are iNet-10 and iNet-20 really? It depends on the subsets of classes chosen.

Reply: Thank you for your valuable feedback.

• In the far and near OOD tasks, we adhere to the setting of MCM. >>- The large-scale OOD datasets iNaturalist, SUN, Places, and Texture, curated by [1], are the standard benchmarks in the OOD detection area.

• The ImageNet-10 dataset curated by MCM mimics the class distribution of CIFAR-10. And the ImageNet-20 dataset consists of 20 classes semantically similar to ImageNet-10 (e.g., dog (ID) vs. wolf (OOD)).

• In the fine-grained task, We split CUB-200-2011, STANFORD-CARS, Food-101, and Oxford-IIIT Pet. Specifically, half of the classes from each dataset are randomly selected as ID data, while the remaining classes constitute OOD data.

All the above ID and OOD datasets have been guaranteed to have no overlap. We have added the above discussion of dataset selection in the revised section 4.1.

[1] Huang et al. MOS: Towards Scaling Out-of-distribution Detection for Large Semantic Space. In CVPR, 2021.

Q4. The design of the LLM prompt causes some information leakage, in that a different type of prompt is used for far-, near- and fine-grained OOD settings. This means there is an implicit assumption about what type of anomalies are likely to be seen in a given experiment. A fairer method would not have such assumption about the test data embedded into its LLM prompts.

Reply: We first would like to emphasize is that there is no data leakage in our method, as we do not use the actual OOD data.

Secondly, in OOD detection community, although there is no clear assumptation that we know the the types of anomalies in advance, existing approaches commonly evaluate different types (i.e., far and near OOD detection) individually. We thus follow this principle to design our prompts. Furthermore, in zero-shot OOD detection, all techniques necessitate prior knowledge of the ID class names that will be encountered during testing. We contend that possessing prior knowledge of the specific OOD task (far, near, or fine-grained) being assessed is analogous in information-level, and does not pose a risk of data leakage. On the other hand, experiments show that the proposed three prompts are universal and can be applied to various datasets for each task. This demonstrates its values in hanlding different scenarioes.

Third, insipred by your comments, we conducted experiments without this prior knowledge, where we use the far prompt in all tasks. The experimental results, reported in the table bloew, show that our DOS still outperforms MCM in most cases. Admittedly, using different prompts is one minor drawback of our method. In this paper, we hope to propose a new perspective, using LLMs to explore potential OOD canditates, for solving the zero-shot OOD detection task. We would like to design a universal prompt in future work to further light this new direction.

Table 1: using far OOD prompt in near OOD task

Table 2: using far OOD prompt in fine-grained OOD task

Q2. These experiments should be more consistent.

Reply: Thank you for your valuable feedback. Indeed, we followed the experimental setting of MCM[1]. In MCM, only its own performance was shown in far OOD task. On ImageNet dataset, we adopt the results of fine-tuning methods reported by MCM. After the work of MCM, only CLIPN[2] reported results on ImageNet-1K, so we did not compare with other other methods.

To make experiments be consistent, we add CLIPN baseline in the far OOD task. Moreover, we implement the Energy[3] and MaxLogit[4] scores on the CLIP backbone as two additional comparative methods, which have been added to all of our experiments (Table. 1, 2, 3, 4).

[1] Ming et al. Delving into Out-of-Distribution Detection with Vision-Language Representations. In NeurIPS, 2022.

[2] Wang et al. CLIPN for Zero-Shot OOD Detection: Teaching CLIP to Say No. ICCV 2023.

[3] Liu et al. Energy-based Out-of-distribution Detection. In NeurIPS, 2020.

[4] Hendrycks et al. Scaling out-of-distribution detection for real-world settings. In ICML, 2022.

Table 1: Far OOD, Due to characters limitations, Table 1 here only reports the average metrics for four ID datasets. For specific metrics of each ID dataset, please refer to Table 1 in the paper.

Table 2: ImageNet-1K(ID)

Table 3: Near OOD

Table 4: Fine-grained OOD

We thank the reviewer WwTG for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

Q1. Though the use of LLM to generate OOD labels is distinct from previous work, this alone does not seem like a strong novelty contribution compared to related works

Reply: We first would like to acknowledge that the reviewer identifies the diffrence between our method and previous methods. Moreover, we would like to clarify that our motivation is also new in the community. Our DOS is motivated by the observation that CLIP can achieve superior OOD detection performance when combined with ground truth OOD class labels. However, relying solely on the closed-set ID classes limits the original performance capabilities of CLIP. Since GT OOD class labels are unavailable, it is not easy to utlize candidate OOD names for solving the above issue. In this paper, we proposed employ LLM to dream outlier class labels to unleash extraordinary OOD detection capability in CLIP.

Based on the above motivation, we restate our novelty contribution as follows:

• We are the first to apply LLM to OOD detection task, and we have demonstrated the effectiveness of this approach. This provides a novel perspective for the OOD detection community.
• We design general LLM prompts specifically for OOD detection, which ask LLM to provide suitable dreamed OOD class labels.
• We design a new score function based on the proportionality between potential outlier class labels and ID class labels, helping the model effectively distinguish ID score distribution and OOD score distribution.
• In addition, our approach is generalized and not just limited to CLIP and GPT.

• Our approach not only unleashes the potential of CLIP in open-world scenarios but also achieves similar objectives on other VLMs, such as ALIGN. For instance, on ImageNet-1K, using the ALIGN backbone, our DOS (28.73%) improves the FPR95 by 29.90% compared to the baseline MCM (58.63%). Experimental results are in the Appendix. B (Table. 5).
• Our approach can also enhance OOD detection performance using other LLMs like LLaMA and Claude. Experimental results are in Section 4.3 (Figure. 6(c)).

• We conduct comprehensive experiments on various large-scale datasets to support our method.

• Our DOS outperforms most approaches that require fine-tuning or additional dataset training.
• We conducted sufficient ablation experiments to demonstrate the rationality of our design.

Dear Reviewer WwTG,

We sincerely appreciate your valuable feedback.

As the deadline for the author-reviewer discussion phase is approaching, we would like to check if you have any other remaining concerns about our paper.

We sincerely thank you for your dedication and effort in evaluating our submission. Please do not hesitate to let us know if you need any clarification or have additional suggestions.

Best Regards,

Authors.

Dear Reviewer WwTG,

As the rebuttal discussion phase ends in less than 12 hours, we want to express our gratitude for your engagement thus far. We would like to kindly remind you that after the 22nd (AOE) we will not be able to answer any further questions you may have. We really want to check with you whether our response addresses your concerns during the author-reviewer discussion phase.

Your feedback is really important to us. We eagerly await any potential updates to your ratings, as they play a critical role in the assessment of our paper. We sincerely hope our responses have addressed your concerns and provided satisfactory explanations. Your thoughtful evaluation greatly helps us improve the overall strength of our paper. We sincerely appreciate your dedication and time again.

Best regards,

Authors

Q3. The reviewer would like some additional clarification regarding the T-SNE visualization in Section 4.4. In particular, it is unclear from initial viewing why the T-SNE visualization implies improved OOD detection performances, as one can similarly argue how the singlular clustering of OOD representations may lead to better OOD detection.

Reply: From the T-SNE visualization, it's indeed challenging to discern the improved OOD detection performances of DOS. This is because the baseline MCM has already achieved an impressive 5% FPR95 on ImageNet10. The marginal 1% improvement is nuanced and not easily observable in the T-SNE visualization. Nevertheless, the primary purpose of presenting the T-SNE visualization is not to highlight our advancements in OOD detection performance. Rather, our focus is to elucidate and demonstrate how the dreamed outlier class labels perform in OOD detection. We specifically show that samples that are more visually similar to the dreamed outlier classes are clustered together. This clustering result suggests that our DOS approach is more semantically interpretable in distinguishing outlier data.

We thank the reviewer vW8h for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

Q1. The reviewer would personally like to see additional experimental evaluations beyond CLIP models, such as ALIGN[1] or FLAVA[2].

Reply: Thank you for your valuable feedback! We believe that evaluations beyond CLIP models are crucial, and have therefore conducted experiments on ImageNet-1K using the pretrained ALIGN model, with the results shown in the table below. By using ALIGN as the VLM, our DOS can also consistently improve the baseline MCM. In addition, when using ALIGN as the VLM, our DOS's performance is significantly better than MCM(an enhancement of 29.90% in FPR95). These results indicate that our DOS is more generalizable to different VLMs. We have added the above experiments in Section 4.2 and Appendix. B (Table. 5) in the reivsion.

Q2. Additional experiments with other standard OOD detection benchmarks such as CIFAR-10/CIFAR-100 (SVHN, LSUN, DTD, Places365) would give further empirical support for the methodology.

Reply: Thanks for the constructive advice. We conducted experiments on the CIFAR-10/CIFAR-100 (SVHN, LSUN, DTD, Places365) datasets and the results are shown in the table below. Furthermore, we incorporated the widely used Energy and MaxLogit scores for comparison. All comparison methods utilize CLIP (ViT-B/16 as the visual encoder) as the VLM. Clearly, DOS achieves superior results on this standard OOD detection benchmark. We have added the above experiments in Section 4.2 and Appendix. C (Table. 6) in the reivsion.

Dear Reviewer vW8h,

We sincerely appreciate your valuable feedback.

As the deadline for the author-reviewer discussion phase is approaching, we would like to check if you have any other remaining concerns about our paper.

We sincerely thank you for your dedication and effort in evaluating our submission. Please do not hesitate to let us know if you need any clarification or have additional suggestions.

Best Regards,

Authors.

Q2.2. Assess the extent of overlap between the generated categories and the actual OD categories.

Reply: Good question. We found that our approach fewly hits the GT OOD classes. For example, the number of hitting classes is less than 3 when using ImageNet10 as the ID set and ImageNet20 as the OOD set.

In fact, hitting the GT OOD class is impractical because the OOD data that models encounter can be diverse and unpredictable. This is why our method can be beneficial to the OOD community. Based on the visual features of ID classes, we ask LLM to dream potential outlier classes that could easily be confused with ID classes. Even without hitting the GT OOD, this approach can still enhance our performance in OOD detection.

For example, suppose we have an ID class 'horse'. When the model encounters OOD data 'gazelle', it might mistakenly identify it as a 'horse'. If LLM returns the outlier class label 'deer', it is likely that the model will classify 'gazelle' as 'deer', thereby correctly identifying it as OOD data and consequently enhancing performance.

Q2.3. Additionally, an in-depth analysis of the impact of these categories on the final accuracy of the OOD detection system is missing.

Reply: We have conducted experiments to evaluate the impact of generated categoties in two apsects.

• Ablation study of the visually resemble prompt: Firstly, varying constraints in prompts result in the generation of diverse OD categories. We thus conducted ablation experiments on visually resemble, please refer to Section4.3 in our paper. Essentially, this is ablation study about OD categories, emphasizing their influence on the final accuracy of the OOD detection system. We have demonstrated that OD categories visually similar to ID categories are beneficial for improving the accuracy of the OOD detection system, with results presented in the response to Q1.2.
• Ablation study of the number of OD categories: We conduct experiments to investigate the impact of the number of OD categories generated by LLM, i.e. $L$. For the far and fine-grained OOD detection, we instruct the LLM to return $L=100$, $L=300$, and $L=500$ OD categories for each ID dataset. For the near OOD detection, we ask the LLM to return OD categories in quantities of $1$, $3$, and $10$ for each ID class. Although $L$ influences DOS performance, DOS can consistently outperform the baseline MCM and achieve relatively stable performance when $L$ is not too small. The results are shown in the tables below.

Table 1: Far OOD

Table 2: Near OOD, $N$ is the number of categories in the ID dataset.

Table 3: Fine-grained OOD

Last, we present the names of OD categories generated by different prompts for a deeper understanding, taking ID clases 'horse' and 'swiss mountain dog' as an example. The OD categories given by different LLM prompts are as follows.

From the above OD categories and experimental results, we can draw the following conclusions: With visual resemblance constraints, LLM will return OD categories that are visually similar to the ID classes, which can help improve the accuracy of the OOD detection system. On the contrary, the generated OD categories are not beneficial for OOD detection without visual resemblance constraints.

We thank the reviewer yFD8 for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

Q1.1. Although it is a good idea to introduce LLM into the OOD detection task, the way it is introduced in this paper is somewhat rigid. The paper primarily utilizes LLM to generate names for OD samples, which are then employed for training purposes.

Reply: We would like to further explain the motivation and implementation of our method.

• Motivation. Our DOS is motivated by the observation that CLIP can achieve superior OOD detection performance when combined with ground truth OOD class labels. However, relying solely on the closed-set ID classes limits the original performance capabilities of CLIP. Since GT OOD class labels are unavailable in practice, we proposed employ the powerful knowledge of LLM to dream potential informative outlier class labels. This novel strategy enables us unleash extraordinary OOD detection capability in CLIP.
• Implementation. We would like to emphasize that our DOS does not require any training. All experiments are conducted in zero-shot setting, without training samples. This zero-shot setting has been clearly explained in both the abstract and the main text.

Q1.2. However, there is a lack of effective measures to ensure the reasonability of the OD categories generated by LLM.

Reply: Our well-designed prompt requires that the OD categories returned by the LLM are visually resemble to the ID categories. Therefore, we have conducted ablation experiments (see Sec.4.3 and Figure 6) to ensure the reasonableness of OD categories that is visually resemble to ID categories. Specifically, different LLM prompts will lead the LLM to generate OD categories with diverse characteristics. We have designed two types of LLM prompts, one termed visually irrelevant and the other visually dissimilar, as well as maintaining the rest of the LLM prompts constant. Specifically, the irrelevant LLM prompt instructs the LLM to generate arbitrary outlier class labels for the ID class without adhering to a visually resemble constraint. Conversely, the dissimilar LLM prompt asks the LLM to dream outlier class labels for the ID class under a visual dissimilar constraint. The results on ImageNet10(ID) are shown in the table below.

Table: ImageNet10(ID), ImageNet20(OOD)

Without the visually resemble constraint proposed in our DOS, the OOD performance degrades on both FPR95 and AUROC metrics, indicating the importance of the proposed constraint. This demonstrates the reasonability of the OD categories generated by the LLM under the constraint of visual resemble.

We also provide a further analysis of our approach by investigating the overlap between the generated and ground-truth OOD names (as your suggestion). Please refer to Q2.2.

Q2.1. Explore the performance of various LLM models.

Reply: Good suggestion. We conduct experiments with various LLMs to provide a more comprehensive understanding of the approach's effectiveness. Specifically, we use LLaMA2-7B or Claude2 to dream outlier class labels. The results on ImageNet10 (ID) are shown in the following table. All the variants, which use different LLMs, achieve better results than the baseline MCM. Moreover, Claude2 outperforms gpt-3.5-turbo in the FPR95 metric. These results demonstrate the universality of our method. We add the results in Fig. 6(c) in our revised paper.

Dear Reviewer yFD8,

We sincerely appreciate your valuable feedback.

As the deadline for the author-reviewer discussion phase is approaching, we would like to check if you have any other remaining concerns about our paper.

We sincerely thank you for your dedication and effort in evaluating our submission. Please do not hesitate to let us know if you need any clarification or have additional suggestions.

Best Regards,

Authors.

Dear Reviewer yFD8,

As the rebuttal discussion phase ends in less than 12 hours, we want to express our gratitude for your engagement thus far. We would like to kindly remind you that after the 22nd (AOE) we will not be able to answer any further questions you may have. We really want to check with you whether our response addresses your concerns during the author-reviewer discussion phase.

Your feedback is really important to us. We eagerly await any potential updates to your ratings, as they play a critical role in the assessment of our paper. We sincerely hope our responses have addressed your concerns and provided satisfactory explanations. Your thoughtful evaluation greatly helps us improve the overall strength of our paper. We sincerely appreciate your dedication and time again.

Best regards,

Authors

We thank the reviewer 5Vrp for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

Q1. Can you add those GT OOD classes w/ ID classes in your Table 1,2,3,4 for the Oracle experiment?

Reply: Thanks for the constructive advice. We have added the results with the GT OOD classes in Tables 1-4. Note that several OOD datasets used in Tables 1 and 2 are subsets of the entire datasets without providing GT: including iNaturalist, SUN, and Places, curated by [1]. Thus, the GT names for them cannot be obtained. If we use the GT of the entire datasets, there will be an overlap with the ID dataset. We have solved this problem for the Places dataset by extracting the GT names from the image file names. However, this solution is not available for the iNaturalist and SUN datasets. We thus did not report the GT results for the iNaturalist and SUN datasets in Table 1 and 2.

As shown in Table 1-4, after adding GT OOD classes, the performance is superior, verifying the motivation of this paper. In some scenarios, our DOS can achieve similar results to the one using GT, as shown in Table 1. We have included these results in the revised paper.

[1] Huang et al. MOS: Towards Scaling Out-of-distribution Detection for Large Semantic Space. In CVPR, 2021.

Table 1: We report the average values of metrics after adding the GT OOD classes to four ID datasets. ID datasets: CUB-200-2011, STANFORD-CARS, Food-101 and Oxford-IIIT Pet. For detailed results of each ID dataset, please refer to Table 1 in our paper.

Table 2: ID dataset: ImageNet-1K

Table 3: Near OOD

Table 4: Fine-grained OOD

Q3. In table 2, the performance of the Texture dataset is not good. Do you have any insight on the reason?

Reply: Good question. Texture is a unique dataset consisting entirely of textural images. Since our designed prompt is generic and not optimized for specific OOD datasets (e.g., asking LLM to return visually textural categories), it results in the dreamed outlier class labels being visually irrelevant to texture. Consequently, the performance on the Texture dataset is not satisfactory.

Q4. For your generated OOD class prompts, can you conduct some similarity measures between your prompts and GTs? I would like to see how much chance LLMs can hit the GT OOD classes.

Reply: Good question. We found that our approach fewly hits the GT OOD classes. For example, the number of hitting classes is less than 3 when using ImageNet10 as the ID set and ImageNet20 as the OOD set.

In fact, hitting the GT OOD class is impractical because the OOD data that models encounter can be diverse and unpredictable. This is why our method can be beneficial to the OOD community. Based on the visual features of ID classes, we ask LLM to dream potential outlier classes that could easily be confused with ID classes. Even without hitting the GT OOD, this approach can still enhance our performance in OOD detection.

For example, suppose we have an ID class 'horse'. When the model encounters OOD data 'gazelle', it might mistakenly identify it as a 'horse'. If LLM returns the outlier class label 'deer', it is likely that the model will classify 'gazelle' as 'deer', thereby correctly identifying it as OOD data and consequently enhancing performance.

Q2.1. Can you elaborate more on this scoring function design?

Reply: We elaborate on the design of our DOS score from two aspects:

• How to utilize dreamed outlier class labels: The utilization of the dreamed class is a crucial aspect. Based on the MSP score, an intuitive idea is to incorporate the dreamed class into the denominator（i.e., $S_{\text{MSP}}(x) = \max_{i \in [1, K]} \frac{e^{s_i(x)/\tau}}{\sum_{j=1}^{K+L} e^{s_j(x)/\tau}}$). However, in this case, the dreamed class only functions in the denominator, which doesn't significantly impact the final score distribution, implying that the dreamed class is not fully utilized. To amplify the role of the dream class, DOS further subtracts the second item($- \max_{k \in [K+1, K+L]} \frac{\beta e^{s_k(x)/\tau}}{\sum_{j=1}^{K+L} e^{s_j(x)/\tau}}$). It stems from an intuition: samples visually similar to the dreamed class should have lower scores, thus making it easier to distinguish between the ID and OOD score distribution.
• How to balance the number of dreamed outlier class labels: When L is large, the dreamed outlier class, merely being in the denominator, already significantly influences the overall score distribution. If we set $\beta=1$, this may lead to the dreamed outlier class overly influencing the score distribution, potentially causing a decline in performance. Therefore, it is reasonable to adaptively adjust $\beta$ based on the size of L. We have thus designed $\beta=\frac{K}{K+L}$, ensuring a balanced influence of the dreamed outlier class.

In summary, the design of $S_\text{DOS}$ jointly considers two key aspects: the utilization of dreamed outlier class labels and the balancing of their quantity. In addition, expriments show that our $S_\text{DOS}$ is universal and does not require hyperparameter adjustments based on different ID/OOD datasets. It can achieve excellent experimental results across various datasets. We have included the above discussion in Appendix.A in the reivsion.

Q2.2. In Figure 6(a), the performance gains from S_DOS to S_MSP are minor.

Reply: We would like to clarify that it is non-trival to obtain improvement on the ImageNet10/20 setting. Specifically, the baseline MCM has attained an impressive 5% FPR95 on ImageNet10, and it is not easy to improve further. Therefore, the performance gained from $S_\text{DOS}$ (4%) is not minor compared to $S_\text{MSP}$ (6.5%).

Q2.3. Also, it will be interesting to test your method on other well-known scoring functions such as Max logit score; Energy function; gradients, etc.

Reply: Good suggestion. We further conducted experiments with Max logit and Energy score. Specifically, based on dreamed outlier class labels, we design $S_\text{MaxLogit}$ and $S_\text{Energy}$ as follows:

$

S_{\text{Energy}}(x) = -T \left(\log \sum_{i=1}^K e^{s_i(x) / T} - \log \sum_{j=K+1}^L e^{s_j(x) / T}\right)

$

$

S_{\text{MaxLogit}}(x) = \max_{i \in [1, K]} s_i(x)- \max_{j \in [K+1, K+L]} s_j(x),

$

We test $S_{\text{Energy}}$ with varying choices of T(0.01, 1, 10, 100, 1000) and the best reported result is obtained with T=0.01. The comparison of different score function on ImageNet10(ID) are reported the table below. Our DOS outperforms $S_{\text{Energy}}$ and $S_{\text{MaxLogit}}$. We have added the above experiments in Section 4.3 (Fig. 6(a)) in the reivsion.

Table: ImageNet10 (ID), ImageNet20 (OOD)

Dear Reviewer 5Vrp,

We sincerely appreciate your valuable feedback.

As the deadline for the author-reviewer discussion phase is approaching, we would like to check if you have any other remaining concerns about our paper.

We sincerely thank you for your dedication and effort in evaluating our submission. Please do not hesitate to let us know if you need any clarification or have additional suggestions.

Best Regards,

Authors.

Dear Reviewer 5Vrp,

As the rebuttal discussion phase ends in less than 12 hours, we want to express our gratitude for your engagement thus far. We would like to kindly remind you that after the 22nd (AOE) we will not be able to answer any further questions you may have. We really want to check with you whether our response addresses your concerns during the author-reviewer discussion phase.

Your feedback is really important to us. We eagerly await any potential updates to your ratings, as they play a critical role in the assessment of our paper. We sincerely hope our responses have addressed your concerns and provided satisfactory explanations. Your thoughtful evaluation greatly helps us improve the overall strength of our paper. We sincerely appreciate your dedication and time again.

Best regards,

Authors