Out-of-Distribution Detection using Synthetic Data Generation

We would like to express our gratitude for your time and effort in reviewing our paper and providing a favorable recommendation. We appreciate your recognition of the novelty and clarity of our work, as well as your acknowledgment of the extensive experiments and promising results. We're glad to hear that the paper has provided useful insights into OOD detection.

1. Theoretically, you can directly prompt the model to generate OOD examples even for the far-OOD, instead of applying the two-stage approach.

While it's possible to directly prompt the model for far-OOD examples, we chose the two-stage approach to promote greater diversity in the generated samples. In our preliminary experiments, we did try the one-stage direct prompting method, but it produced less diverse outputs. By first generating a few seed samples and using them as in-context examples in the second stage, we guide the model to produce a wider range of plausible OOD samples (as confirmed later in Figure 4). By leveraging the seed samples in this way, we encourage the model to explore a wider range of potential OOD variations, rather than producing overly similar or constrained outputs that might occur with a direct prompt. We will make sure to include these preliminary findings and the comparison with the direct prompting method in the final draft.

2. Line 226-227 "we believe is due to the significant semantic similarity between the InD and OOD data, making the task especially challenging."

To elaborate on the point made in lines 226-227, the semantic similarity between InD and these OOD datasets stems from the fact that both BT (SEAC) and BT (DAWBS) are OOD datasets from the same BeaverTails dataset that contains the InD dataset "Non-Violent Unethical Behavior" (for details, please see Appendix B.2). BT (SEAC) corresponds to the "Sexually Explicit, Adult Content" category, and BT (DAWBS) corresponds to the "Drug Abuse, Weapons, Banned Substance" category. Although these OOD categories are different, they share substantial semantic similarity with the InD dataset (Non-Violent Unethical Behavior), as all these categories involve content moderation issues and deal with behaviors considered unethical or inappropriate.

This overlap in thematic content makes it particularly challenging for the model to distinguish between OOD and InD samples, as the content in these OOD categories is not drastically different in nature from the InD examples. Despite these challenges of the near-OOD datasets, our synthetic model is the only approach that performs close to the ideal model (Table 1).

6. Why ReAct is not included in experiments Section 4.2.3 and Figure 3?

Thank you for the comment. In our preliminary experiments, we found ReAct to perform similarly to other scoring baselines (e.g., MSP, Energy, DICE). We chose to exclude ReAct from the experiments in Section 4.2.3 and Figure 3 because it did not show significant improvements over the other baselines in our main results. Furthermore, to enhance the clarity and focus of the presentation, we decided not adding it, as the upper axis in Figure 3 was already becoming overcrowded. We will include it in the final draft to provide a complete comparison.

7. OOD proportion on the top axis of Figure 3, why is different for different approaches? The explanation of 'Risk' is not clear. Why not use accuracy at a given percentage?

The top axis in Figure 3 shows the remaining proportion of OOD data after each method has removed uncertain samples. Different methods remove OOD samples at different rates, which is why the proportions vary. The goal of selective classification (Geifman and El-Yaniv, 2017) is to abstain from making predictions when the model is uncertain, which is achieved by removing uncertain samples at each coverage level. Ideally, these uncertain samples should be OOD, so the more OOD samples removed, the better. As shown in the figure, our method removes the majority of OOD samples at a given coverage level, as compared to the baslines.

Regarding the use of "Risk", this is a standard metric in the selective classification literature (Geifman and El-Yaniv, 2017) and not a choice we explicitly made. Risk is essentially the complement of accuracy (1 - accuracy), which is commonly used to quantify model uncertainty and performance in this context.

Thank you for reviewing our paper. While our responses may be detailed, we have made every effort to be concise while ensuring clarity and comprehensiveness. We look forward to further discussion.

1. The underlying process of OOD generation proposed is not clear. The synthetic data generation method is not clearly explained. Besides the illustrated workflow, there is only a reference to the prompts in the Appendix. So, we do not know what is the intuition and way of inducing the diverse OOD generation paths.

We thank the reviewer for raising this important point. We would like to clarify that the underlying OOD generation process is described in Section 3.1 of the paper. As noted, Figure 1 serves only as a high-level illustration, while the specific prompt designs used for generating OOD data are comprehensively documented in Tables 10–14 of the Appendix.

To address the reviewer's main concern regarding how diverse OOD generation paths are induced, we emphasize the following:

We leverage in-context learning to induce diversity, with different strategies for near-OOD and far-OOD data:

For near-OOD, since it originates from the same domain as the InD data, we use InD examples as in-context demonstrations within prompts. For far-OOD, which comes from a different domain, we employ a two-stage prompting strategy. Initially, we prompt the LLM to generate a few seed samples, which are then used as in-context examples in the second stage to guide further generation. This process allows the LLM to generalize beyond the narrow decision boundary of the InD distribution and produce a diverse set of plausible yet OOD samples.

2. How do we know that the OOD is diverse and relevant?

We thank the reviewer for the thoughtful question and respond with two key empirical findings:

a) Effectiveness of Synthetic OOD Data (Figure 4): We demonstrate that the synthetic proxy data forms more generalized clusters and expands the decision boundary around the InD data. This suggests the generated OOD data captures a wider, non-linear space, thereby enabling detection of a diverse range of OOD test samples.

b) Cross-modal OOD generalization (Figure 5): We show that a model trained on our synthetic OOD data (ToxiGen and GSM8K) achieves perfect FPR95 on the real MBPP test set—despite not being explicitly trained on MBPP. The performance matches that of an ideal model, indicating the diversity and relevance of our synthetic OOD data across modalities.

We hope this addresses the reviewer’s concerns and clarifies both the intuition and the effectiveness behind our OOD data generation methodology.

3. A motivating point such as comparison with other (non-LLM) synthetic OOD generation methods is missing.

We appreciate the reviewer’s point. The use of synthetic OOD generation, particularly in the text modality, is still an emerging area, and we are not aware of established non-LLM synthetic OOD generation methods that serve as competitive baselines for comparison.

To address this gap, we employ the ideal baseline, which is trained on real OOD data. This baseline is highly competitive, offering a benchmark that reflects optimal performance. However, it is rarely used in OOD research, as it does not align with real-world conditions where OOD data is both highly diverse and often inaccessible. As shown in Table 1, our synthetic approach either outperforms or matches the ideal baseline on far-OOD datasets. Furthermore, for the challenging near-OOD datasets, our synthetic model is the only method that performs closely to the ideal model.

Moreover, if the reviewer has any specific baselines in mind, we would be grateful if they could share them, and will gladly consider incorporating them in the final version.

4. Table 1 is too small. Maybe the most important numbers (metrics ) can be included in the main part of the paper.

Thank you for the suggestion. We will incorporate this change in the final draft to improve clarity and presentation.

5. The far-OOD task seems rather trivial.

We appreciate the feedback. However, we want to emphasize that far-OOD detection is crucial in real-world systems that need to detect and handle tasks such as math or coding problems differently. For instance, these tasks often need to bypass unnecessary processes, like harmful content filters, which are useful for general text but become costly and irrelevant when applied to specialized domains like math or code. Thus, far-OOD detection is not just a theoretical challenge but a practical necessity for optimizing system performance across diverse use cases.

We sincerely thank the reviewer for their thoughtful feedback. We greatly appreciate your recognition of the clarity of our work, as well as your acknowledgment of the extensive experiments and promising results.

1. My main reason for rejection is the relatively old-fashioned methodology that underlies the whole paper, along with a lack of discussion on LLM-based alternatives.I would ask preemptively for their respective pros and cons, when compared with the authors' proposed method.

We appreciate the reviewer’s thoughtful and detailed feedback.

Regarding the suggestion of prompting an LLM with a few in-domain examples followed by a query to determine in-domain status: while conceptually valid, this approach is computationally intensive and difficult to scale in practice. Text inputs can be excessively long, and including several in-domain examples for each query increases input length substantially. This not only slows down inference but also imposes significant memory and latency costs, which makes it impractical for real-world deployment—especially in scenarios where OOD detection is expected to act as a fast, lightweight filtering step.

Additionally, relying on in-context learning for OOD detection on base LLMs can be unstable and yield suboptimal performance, as base models are not fine-tuned to discriminate in/out-of-distribution samples based on limited demonstrations alone. In contrast, well-trained OOD detectors are typically designed for efficiency and robustness at scale, which our approach directly supports.

We also examined the survey mentioned and would like to clarify that most methods discussed—including AnomalyGPT (Zhang et al., 2023), Myriad (Li et al., 2023b), Tabular (Li et al., 2024a), AnoCLIP (Deng et al., 2023), CLIP-AD (Chen et al., 2023b), MCM (Ming et al., 2022), Miyai et al. (2023), SETAR (Li et al., 2024d), and AnomalyRuler (Yang et al., 2024c)—are developed for image, video, tabular, or multimodal modalities, and are not directly applicable to the text-based OOD detection setting we study.

In fact, text-focused, LLM-based OOD generation or detection methods is still an emerging area, and we are not aware of established LLM-based methods that serve as competitive baselines for comparison.

To address this gap, we employ the ideal baseline, which is trained on real OOD data. This baseline is highly competitive, offering a benchmark that reflects optimal performance. However, it is rarely used in OOD research, as it does not align with real-world conditions where OOD data is both highly diverse and often inaccessible. As shown in Table 1, our synthetic approach either outperforms or matches the ideal baseline on far-OOD datasets. Furthermore, for the challenging near-OOD datasets, our synthetic model is the only method that performs closely to the ideal model.

Moreover, if the reviewer has any specific baselines in mind, we would be grateful if they could share them, and will gladly consider incorporating them in the final version.

Finally, we agree that a discussion of recent LLM-based approaches is valuable. In the final draft, we will include a dedicated section discussing these methods from the survey, along with their applicability and limitations in the context of text-based OOD detection.