Rethinking Out-of-Distribution Detection and Generalization with Collective Behavior Dynamics

Dear reviewer Sdub, thank you for your thoughtful review and constructive feedback on our manuscript. We are pleased that you recognize the refreshing theoretical perspective our proposed method brings, which distinguishes it from conventional approaches in the field. We address your specific comments and suggestions in detail below:

Q1: Weaknesses-1: The method requires the simultaneous estimation of complex PDE solutions, potentially resulting in increased GPU memory usage and reduced computational efficiency, especially in very large-scale or resource-constrained environments.

Thank you for your comment. A similar concern was raised by reviewer $\text{\textcolor{red}{jZnV}}$ in $\text{\textcolor{blue}{Q5}}$, and we have provided a detailed response there. Briefly, we acknowledge that our method introduces additional computational overhead during training due to the storage of intermediate computation graphs and automatic gradient calculations. To mitigate this, we adopt two strategies:

• Directly parameterizing steady-state solution instead of the full time-dependent functions.
• Using the Poisson-Boltzmann approximation to avoid solving the full integral form of the PDE.

These design choices reduce GPU memory usage while preserving the core physics-informed structure. At inference time, the overhead is negligible, and the additional model parameters account for only a small fraction of the total. Please refer to our response to reviewer $\text{\textcolor{red}{jZnV}}$'s $\text{\textcolor{blue}{Q5}}$ for further details.

Q2: Weaknesses-2: While some hyperparameter analyses are presented, a deeper understanding of the sensitivity and stability related to PDE discretization parameters, regularization strengths, or solver accuracy would significantly enhance the method's clarity and reproducibility.

We appreciate this insightful suggestion. However, we'd like to clarify a potential misunderstanding: Our method does not rely on an ODE/PDE solver to iteratively fit the particle distribution function $F(\mathbf{z}, \mathbf{v}, t)$ and electric potential $\phi (\mathbf{z}, t)$ over time steps. Instead, we use MLPs to directly predict the steady-state $F^* (\mathbf{z}, \mathbf{v}) and \\phi^* (\mathbf{z})$ in a single forward pass, completely bypassing numerical time integration. This fundamental distinction means that conventional ODE solver parameters (discretization step sizes, solver tolerance, numerical stability constraints, etc.) are not relevant to our method.

That said, we recognize the value in analyzing the sensitivity of MLPs hyperparameters (e.g., layer depth, width), which could impact the stability of the steady-state approximation. We have examined these variations (hyperparameter tuning details are in our response to reviewer $\text{\textcolor{red}{MQNz}}$'s question $\text{\textcolor{blue}{Q12}}$). Below, we present the sensitivity analysis results for several relevant parameters:

Table 3: OOD Detection on CIFAR-100 with MLP Hidden Dimension of 512

Table 4: OOD Detection on CIFAR-100 with MLP Depth of 2 Layers

Table 3 and Table 4 show that performance scales with the number of MLP parameters, underscoring the key role of these hyperparameters in improving the model's ability to approximate steady state solutions. While increasing MLP architectural complexity delivers gains, returns diminish beyond a certain threshold (e.g., hidden dim=512 vs. 1024). This highlights the need to balance MLP intricacy with computational efficiency during tuning. We believe these insights will inform further optimizations of our approach for real-world applications.

Q3: Weaknesses-3: The experimental evaluation is limited to relatively standard feature-extraction architectures, specifically ResNet and ViT, leaving the effectiveness of the approach on more diverse network architectures or modalities (e.g., text or multimodal data) unexplored.

We agree that more experimental evaluation would be useful to understand the details ofinteraction andenhancement. We would like to address this concern from several perspectives:

• Our experimental design strictly align with established evaluation protocols for OOD detection and generalization in the visual domain. Specifically, we adopted the experimental setups from the well-regarded benchmark frameworks OpenOOD [1] and DomainBed [2], including their datasets, evaluation metrics, and procedures. This ensures our results are comparable and consistent with recent existing works [3,4,5]. The datasets and backbone network models were carefully selected for their broad representativeness and ability to thoroughly validate the effectiveness of our approach.

• Extending experimental evaluation from visual data to text, tabular data or multimodal data would require fundamental redesign of our method and development of specialized components for different modality characteristics. Text and multimodal OOD problems differ inherently from visual OOD problems and require distinct technical approaches, including but not limited to: prompt engineering, modality-specific fine-tuning strategies, cross-modal alignment techniques, and multimodal fusion mechanisms. These technical challenges constitute separate research directions in their own right.

• Nevertheless, to address your suggestion and preliminarily explore the extensibility of our method, we conducted exploratory experiments on multimodal model CLIP. Specifically, we followed the ERM with CLIP method described in [6] and adopted the following experimental setup: we first initialized the classifier head weights using text embeddings extracted by the CLIP text encoder. Then, we fine-tuned the CLIP image encoder along with two additional MLP branches, with the overall experimental configuration following the standard implementation from [7]. Unlike [7] which only used standard ERM loss, we additionally integrated our three proposed loss components during training: the Vlasov loss $\mathcal{L}_ {\text{Vlasov}}$, the Poisson loss $\mathcal{L}_ {\text{Poisson}}$, and the Dispersion Relation loss $\mathcal{L}_ {\text{disp}}$. The results are shown in Table 5. This preliminary multimodal experiment validates the potential extensibility of our approach. We hope this additional multimodal experiment and the detailed explanation above effectively address your concerns while clearly indicating that our current research remains focused on image-based OOD problems and their theoretical foundations.

Table 5: Accuracy on the PACS and OfficeHome Datasets with Domain Shift.

We fully agree with your suggestion. For the specific cases you mentioned, our method will require further customization. The approach based on discrete electric fields is conceptually similar to addressing OOD and related issues, and we plan to further explore this direction in future work.

[1] Openood: Benchmarking generalized out-of-distribution detection. NeurIPS 2022.
[2] In Search of Lost Domain Generalization. ICLR 2021.
[3] Gradient-Guided Annealing for Domain Generalization. CVPR 2025.
[4] Extremely Simple Activation Shaping for Out-of-Distribution Detection. ICLR 2023.
[5] Out-of-distribution detection based on in-distribution data patterns memorization with modern hopfield energy. ICLR 2023.
[6] Clipood: Generalizing clip to out-of-distributions. ICML 2023.
[7] Robust fine-tuning of zero-shot models. CVPR 2022.

Thank you for your thoughtful suggestions and constructive feedback. We're delighted that you see our work as providing a fresh perspective for OOD detection and generalization. We have responded to your comments and questions below.

Q1: Weaknesses-1: This paper lacks a comprehensive comparison between... how it fundamentally differs from... Weakness-2: The framework assumes... this analogy meaningfully holds for deep neural networks. Questions-1: What is the theoretical or empirical justification for modeling high-level features as charged particles... What unique modeling capabilities or interpretability does the proposed framework offer?

We appreciate your thoughtful question. Since the first and second point in Weaknesses and the first point in Questions address similar concerns, we respond to both together. The following we will explore the core aspects of this question from three aspects:

1. Why model features as charged particles under Vlasov–Poisson system?

Our adoption of the Vlasov-Poisson system is methodologically motivated by the need to explicitly model global interactions among high-level features in deep network latent spaces. The theoretical foundation is as follows:

• Current some OOD detection and generalization approaches utilizing KNN methods (score computation based on sample-neighbor distances) [1] or local graph-based structures [2,3] (scores derived from graph isomorphism/connectivity) implicitly encode feature interactions. These interactions naturally parallel physical forces, where similar features exhibit mutual attraction and dissimilar features demonstrate repulsion, analogous to electrostatic interactions among charged particles. The Vlasov-Poisson system explicitly captures this phenomenon through a self-consistent field related formulation: each particle (representing high-level features) $\mathbf{z}$ evolves under the collective field $E(\mathbf{z}, t)$ generated by all particles (governed by equation $\frac{\partial F}{\partial t}+\mathbf{v} \cdot \nabla_\mathbf{z} F+\nabla_\mathbf{v} \cdot \mathbf{E}=0$), effectively aggregating global information. The resulting steady-state particle distribution function $F^* (\mathbf{z}, \mathbf{v})$ and steady-state potential $\phi^* (\mathbf{z})$ serve as natural scoring mechanisms.
• Crucially, while traditional approaches such as KNN or graph-based methods rely on localized feature interactions (such as $p(x)= {\textstyle \prod_{i}} p(x_i)$), the Vlasov-Poisson system enables globally-informed particle dynamics. This fundamental distinction provides theoretical justification for expecting superior OOD detection and generalization performance.
• As elaborated in our response to reviewer $\text{\textcolor{red}{KKbs}}$'s question $\text{\textcolor{blue}{Q1}}$, the physical quantities emerging in the Vlasov-Poisson system (such as particles, self-consistent electric forces, and mass) all have corresponding abstract interpretations derived from the properties of high-level features.

2. Comparison to traditional statistical methods.

A key distinction is that most conventional methods produce point-wise scores that fail to account for how samples relate structurally to one another, or only consider local neighborhood relationships. In contrast, the Vlasov-Poisson system inherently captures collective interactions, making it particularly well-suited for subtle OOD problems, as we demonstrate through the sharp gradient properties near decision boundaries established in Corollary 2.3 of our paper.

3. Unique modeling advantages & interpretability.

• From an interpretability perspective, the physical metaphor (e.g., attraction/repulsion/chaos) provides an intuitive lens for understanding why certain samples are classified as OOD—not simply due to "low confidence" or "low density" scores, but because they fundamentally violate the governing field structure learned from InD data.
• A key methodological distinction is that our method constitutes a system governed by PDEs that models the "collective dynamics" of the entire distribution. Unlike conventional static approaches, each sample is assessed within its relational context to all other samples through self-consistent field interactions, enabling us to capture global distributional shifts and inter-sample dependencies critical for robust OOD problems.

Q2: Weaknesses-3: The limitation of the proposed theoretical framework is not discussed. In particular... Questions-2: Are there specific cases where CBD fails to detect OOD or generalize...

You raise a valid concern. Our hyperparameter analysis (final subplot in Figure 6) demonstrates that insufficient batch sizes during training can indeed degrade performance, we provide additional details in our response to reviewer $\text{\textcolor{red}{KKbs}}$'s question $\text{\textcolor{blue}{Q6}}$. Regarding the dimensionality issues you mention, we employ several mitigation strategies, which we address comprehensively in our response to Reviewer $\text{\textcolor{red}{KKbs}}$'s question $\text{\textcolor{blue}{Q2}}$.

Q3: Weaknesses-4: The method is built around visual features... non-image modalities... Questions-2: Can the authors evaluate CBD in additional domains... Limitations-1: The experimental design is limited to imaging data...

Thank you for raising this point. We respectfully encourage you to refer to $\text{\textcolor{blue}{Q3}}$ in our response to reviewer $\text{\textcolor{red}{Sdub}}$.

Q4: Weaknesses-5: The writing is overly complex and lacks clear organization...

Thank you for highlighting the writing issues. Reviewer $\text{\textcolor{red}{MQNz}}$ raised similar concerns in \text{\textcolor{blue}{Q1 \sim Q7}} and $\text{\textcolor{blue}{Q9}}$, which we've addressed in detail. We encourage you to refer to those responses. We will integrate these changes into the revised manuscript to enhance readability.

Q5: Limitations-2: ... increase computational and memory overhead.

We acknowledge that our physics-inspired approach incurs additional computational overhead. To mitigate this, we employed two techniques to reduce this overhead, including directly parameterizing $F^* (\mathbf{z}, \mathbf{v})$ and $\phi^* (\mathbf{z})$ rather than the full time-dependent $F(\mathbf{z}, \mathbf{v}, t)$ and $\phi(\mathbf{z}, t)$, and using the Poisson-Boltzmann approximation $\phi^* (\mathbf{z}) = - \frac{1}{\epsilon_0} (e^{-\phi^* (\mathbf{z})} - \rho_{\text {ion }}(\mathbf{z}))$ in place of integral $\nabla^{2} \phi^* (\mathbf{z}) = -\frac{1}{\epsilon_{0}} ( \int F^* (\mathbf{z}, \mathbf{v}) \mathrm{d} \mathbf{v} - \rho_ {\mathrm{ion}} (\mathbf{z}) )$. The primary computational cost arises during training, driven by GPU memory demands for storing intermediate computation graphs and performing automatic gradient calculations. During inference, however, these intermediate computations are unnecessary, resulting in minimal impact on inference speed. Moreover, the added MLP branches contribute only a small fraction of model parameters (2.7% for ViT-b16 and 4.7% for ResNet-18, as detailed in Appendix Table 5), ensuring negligible effects on model storage and inference costs.

Q6: Limitations-3: Several derivations... may not capture the full complexity of real-world feature distributions.

Thank you for raising this point. We believe there may be a misunderstanding here.

• For OOD detection, our post-hoc method CDB-De does not modify pre-trained parameters, so InD feature distributions remain unaffected by physical assumptions.
• For OOD generalization, our physical loss serves as a strong structural constraint. Rather than merely acting as regularization, this constraint actively guides the feature learning process to discover representations that respect underlying physical laws, thereby improving robustness across domains.

We acknowledge these potential limitations and plan to explore relaxed assumptions in future work.

[1] Out-of-distribution detection with deep nearest neighbors. ICML 2022.
[2] Environment-aware dynamic graph learning for out-of-distribution generalization. NeurIPS 2023.
[3] Learning invariant graph representations for out-of-distribution generalization. NeurIPS 2022.

Dear reviewer jZnV, we greatly appreciate your continued engagement. We have carefully considered both of your concerns and provide our response below:

Regarding the curse of dimensionality and empirical validation.

We have conducted relevant comparison experiments to address this concern. As detailed in our response to reviewer Sdub, Tables 6 and 7 present the comparison between MLP direct steady-state prediction (with high-dimensional mitigation) and numerical solvers using time integration for PDE solutions (without mitigation strategies), providing the empirical effectiveness demonstration you requested. The results quantify the impact of our strategy to mitigate the curse of dimensionality: while numerical PDE solvers that solve the full time-dependent system achieve marginally higher AUROC on complex datasets (improvements of 0.30%-0.42%), they suffer from computational complexity explosion and substantial GPU memory consumption, which are classic manifestations of the curse of dimensionality. In contrast, the MLP direct steady-state prediction approach maintains competitive performance while dramatically reducing computational complexity (AUROC gaps of only 0.02%-0.06% on simpler datasets). The experimental evidence demonstrates that our dimensionality mitigation strategy achieves practical effectiveness with minimal performance trade-offs.

We appreciate your constructive feedback and acknowledgment of the innovative aspects of our work. Our detailed responses are as follows.

Q1: Weaknesses-1: The paper... treating feature vectors as charged particles... how much deviation will this approximation...

We appreciate your concerns about modeling feature vectors as charged particles under the Vlasov-Poisson system. You questioned whether mapping computational entities to physical quantities introduces bias. We identify 3 potential sources of bias from your feedback (please note if we missed any) and address each by demonstrating our model's alignment with neural network.

• Appropriateness of Analogizing High-Level Features to Charged Particles: This analogy represents mathematical abstraction leveraging collective behavior of interacting entities, not literal physical equivalence. Neural network features share key properties with particle systems: distributed nature (features occupy high-dimensional spaces with continuous distributions, analogous to particle phase space), interaction patterns (features influence each other through attention mechanisms and nonlinear transformations), conservation properties (information flow follows conservation principles similar to physical laws) [1,2], and statistical behavior (both systems benefit from statistical mechanics when handling large ensembles).

• Reasonableness of Feature Evolution Driven by Self-Consistent Electric Fields: The attention mechanism captures relationships between tokens, analogous to self-consistent electric fields where electrons (high-level features) move under Coulomb forces from all other electrons. This analogy reveals our approach as a novel form of interaction: (i) query-key interactions represent forces, with attention weights as force magnitudes; (ii) attention implements a mean field approximation where each feature interacts with the average effect of all others; (iii) queries function as test charges probing the electrostatic field generated by keys (source charges); (iv) self-consistency emerges as attention depends on features distribution. Coulomb forces thus provide a universal interaction kernel in high-dimensional feature space, unconstrained by the physical properties of real charged particles.

• Lack of Mass in High-Level Features Compared to Physical Electrons: As we answered reviewer $\text{\textcolor{red}{MQNz}}$ in question $\text{\textcolor{blue}{Q10}}$, in neural networks, we can interpret "mass" as the "inertia" or "stability" of features, so features with higher mass resist deviation during learning or optimization processes, just as mass affects trajectories in physics.

Moreover, selective borrowing from physics is standard practice in physics-inspired machine learning. For example, [2] omits specific force laws and particle properties, while [4] disregards charge characteristics. Our charged particle modeling does constitute a form of bias. However, structured deviation are often beneficial in deep learning: CNNs assume spatial locality, Transformers assume positional ordering, and RNNs assume sequential dependencies. Our physical constraints enhance transparency and interpretability compared to black-box alternatives. While we acknowledge the limitations of this modeling choice, we believe the resulting performance gains and interpretability benefits justify the trade-off in our application domain. We hope this addresses your concerns.

Q2: Weaknesses-2: "Curse of dimensionality" problem.

We appreciate your insightful concern regarding the curse of dimensionality. You are absolutely correct that the Vlasov-Poisson system, being a system of partial differential equations, becomes computationally prohibitive in high-dimensional settings. We would like to address how our approach mitigates these challenges:

• Rather than solving the full time-dependent system $F(\mathbf{z}, \mathbf{v}, t)$ and $\phi(\mathbf{z}, t)$, which would require computationally expensive ODE integration, we directly parameterize the steady-state distributions $F^* (\mathbf{z}, \mathbf{v})$ and potential $\phi^* (\mathbf{z})$ using neural networks (Eq. 4). While this introduces some approximation error, it dramatically reduces computational complexity.
• Instead of computing the integral $\nabla^{2} \phi^* (\mathbf{z}) = -\frac{1}{\epsilon_{0}} ( \int F^* (\mathbf{z}, \mathbf{v}) \mathrm{d} \mathbf{v} - \rho_ {\mathrm{ion}} (\mathbf{z}) )$ required by the original Vlasov-Poisson formulation, we employ the Poisson-Boltzmann approximation: $\phi^* (\mathbf{z}) = - \frac{1}{\epsilon_0} (e^{-\phi^* (\mathbf{z})} - \rho_{\text {ion }}(\mathbf{z}))$, which eliminates expensive integral computations.
• In traditional physics, solving the Vlasov-Poisson equation typically requires complete discretization of the phase space. In our neural network approach, we conveniently employ Monte Carlo methods for random sampling of the phase space. As shown in the last subplot of Figure 6, increasing batch size allows our stochastic sampling to gradually approximate full grid-based methods.
• We operate directly on high-level features extracted by deep networks, which have been shown to naturally capture low-dimensional manifold structure within high-dimensional spaces [5], effectively reducing the intrinsic dimensionality of the problem.

Though a full theoretical analysis of high-dimensional convergence is challenging, our experiments show that these designs effectively overcome the curse of dimensionality in practice.

Q3: Weaknesses-3: Hyperparameter analysis.

We have already provided hyperparameter analysis for all mentioned parameters in the Experiments section: loss weights (α, β) are analyzed in the "Hyperparameter Analysis" subsection with results in Figure 6 (subplots 4-5), while the wavevector scaling factor (σ) and wavenumber (N) are analyzed in the "Plane Wave Analysis" subsection with results in Figure 7.

Q4: Questions-1: Regarding In-Distribution Structure.

We believe there is a misunderstanding. Our method does not assume unimodal in-distribution data. The unimodal illustrations are purely for visualization clarity, just as commonly seen in other OOD detection or DA papers.

Our theoretical framework imposes no constraints on the shape of the InD—it accommodates arbitrary multimodal distributions. The steady-state formulation characterizes the equilibrium of the underlying dynamical system, not the geometric structure of the data distribution itself.

Q5: Questions-2: Regarding the Model Choice.

The Vlasov-Poisson system lies at the heart of our framework because it uniquely captures the collective interactions of high-level features as "charged particles": the "clustering" of features under InD data (i.e., convergence toward steady state) versus the chaos or instability of features under OOD data (see Figure 4). This arises from the system's kinetic-potential energy balance, enabling us to quantify distributional deviations through a physics-motivated lens, which providing novel theoretical insights for OOD problems.

Alternative dynamical systems typically describe individual particle trajectories or employ low-order approximations, sacrificing the precise modeling of collective effects that is essential for comprehensive InD/OOD characterization. Energy-based models similarly rely on static energy minimization to identify InD stable states and OOD high-energy anomalies, but neglect the collective interactions that are critical for capturing temporal dependencies and nonlinear effects in phase space. We kindly refer you to our response to Reviewer $\text{\textcolor{red}{jZnV}}$'s $\text{\textcolor{blue}{Q1}}$, which provides detailed motivation for our modeling approach.

Q6: Questions-3: Regarding steady state.

Thanks for raising concerns about the steady-state assumption, which lies at the heart of our theoretical framework. To address this, we offer the following clarifications:

• With small batch sizes, the steady state is indeed more susceptible to disruption, as noted in the hyperparameter analysis within our Experiments section (see the final subplot in Figure 6). Our results demonstrate that larger batch sizes make the steady state increasingly robust, with stabilization occurring beyond a certain threshold.
• In our experiments, the steady state solution exhibits residual fluctuations due to limited sampling from the batch sizes used, resulting in incomplete field descriptions per iteration. Through repeated sampling, the learning process gradually refines the field’s representation, requiring multiple iterations for an accurate steady-state solution.

Q7: Questions-4: Regarding assumption.

We appreciate this question about our uniform initial velocity assumption. We conducted additional experiments with different initialization strategies: uniform vectors with values of 0.5 matching the feature dimension, and random vectors of matching dimension. Random initialization slightly underperforms uniform, but differences are minimal, showing robustness. The uniform assumption maintains effectiveness while simplifying computation.

Table 1: OOD Detection on CIFAR-100

Table 2: OOD Generalization on PACS

[1] Neural conservation laws: A divergence-free perspective. NeurIPS 2022.
[2] Hamiltonian neural networks. NeurIPS 2019.
[3] Mean-field and kinetic descriptions of neural differential equations. arXiv 2020.
[4] Poisson flow generative models. NeurIPS 2022.
[5] Representation learning: A review and new perspectives. TPAMI 2013.

Thank you for the positive feedback and insightful questions. We really appreciate your kind words about our work, and your suggestions will help us improve both the quality and clarity of our research. Below, we will address your concerns one by one.

Q1: Key terms like... are not clearly defined early in the paper, making it very hard to appreciate clearly without several passes.

We acknowledge that key terms lack clear definitions early in the paper. In the revision, we will include the following definitions in the Introduction:

• Collective behavior: Emergent system-wide phenomena resulting from multi-particle interactions. In our work, where high-level features are treated as charged particles, this represents the temporal evolution of feature distributions driven by inter-feature interactions.
• Self-consistent electric field: Field where particles generate the electric field that governs their motion, creating iterative dynamics. Particles produce a field, which drives their movement, redistributing the particles and generating a new field until equilibrium is reached, leading to collective behavior.
• Macroscopic properties: System-level characteristics, which in our work refer to the particle distribution function $F(\mathbf{z},\mathbf{v},t)$.
• Perturbation: Minor deviations from the steady-state particle distribution function and electric potential (line 161).

Q2: Many technical statements are vague or confusing (e.g., "Plane wave modes"... what "its" refers to).

We acknowledge that several technical statements require clarification:

• Regarding the x-axis label in the Figure 2: It should be labeled 'time'. Plane wave modes decompose perturbations into constituent waves with distinct directions and wavelengths, similar to how Fourier transforms decompose images into frequency components, revealing each wave's contribution to the overall perturbation.
• Regarding unclear pronoun references: In the expression 'measure its boundary', the pronoun 'its' specifically refers to the 'basin of attraction'.

We will conduct a thorough review of the manuscript and revise any instances of ambiguous words in the revised submission.

Q3: The flow of theoretical principles... lacks sufficient intuitive grounding and logical coherence.

We sincerely apologize for the unclear logical progression of our theoretical principles and thank you for this valuable feedback. We respectfully encourage you to refer to our response to Reviewer $\text{\textcolor{red}{jZnV}}$'s question $\text{\textcolor{blue}{Q1}}$ for the motivation behind our modeling approach. Building upon that foundation, the relationships among our theoretical principles follow this logical sequence:

• Theorem 2.1 establishes that steady-state solutions of Vlasov-Poisson systems provide a theoretical foundation for OOD detection.
• Since directly solving the steady-state electric field $E^* (\mathbf{z})$ (Eq 4) involves computationally challenging integrals, Definition 2.2 introduces a tractable condition via the Poisson-Boltzmann equation for the steady-state electric potential $\phi^* (\mathbf{z})$, simplifying the computation of $E^*(\mathbf{z})$.
• Corollary 2.3 connects the basin of attraction $\mathcal{B}$, its boundary $\partial \mathcal{B}$, and the steady-state potential $\phi^*(\mathbf{z})$, revealing sharp gradients near $\partial \mathcal{B}$ that further justify the system's applicability to OOD detection.
• Theorem 2.4 proves that our proposed dispersion loss expands the basin of attraction $\mathcal{B}$.
• Theorem 2.5 and Corollary 2.6 demonstrate that this expansion enhances neural network robustness.

We will clarify these logical connections with appropriate transitional explanations in the revision.

Q4: Figures errors (with all small points).

Thank you for the detailed observations! We will revise all relevant figures in the revision to correct labeling errors, improve axis descriptions, fix spelling errors, and ensure the figures accurately reflect the collective dynamics discussed in the text.

Q5: There is an over-reliance on jargon.

We apologize for not adequately considering the accessibility of our mathematical and physics concepts for readers with diverse backgrounds. To improve clarity, we will add accessible explanations in the introduction footnotes, and provide intuitive descriptions of technical terms in the appendix. We hope these revisions address your concerns.

Q6: It's not transparent from the main body how the method is actually used... the method is post-hoc... I like the idea but I felt unclear what the method itself actually is until reading the appendix...

We thank you for appreciating the core idea. We acknowledge that the main text inadequately explained the post-hoc nature of our method and the OOD implementation process. In the revised manuscript, we will:

• Explicitly present the OOD detection loss $\mathcal{L}_ {\text{De}} = \mathcal{L}_ {\text{Vlasov}} + \mathcal{L}_ {\text{Poisson}}$ and OOD generalization loss $\mathcal{L}_ {\text{Gen}} = \mathcal{L}_ {\text{Classify}} + \alpha(\mathcal{L}_ {\text{Vlasov}} + \mathcal{L}_ {\text{Poisson}}) + \beta \mathcal{L}_ {\text{disp}}$ in the methodology section.
• Clarify in the Introduction that CBD-De is a post-hoc detection method that does not require modifying pre-trained network parameters.
• Label the input as InD data in the left subplot of Figure 3 to clarify that $F$ and $\phi$ are learned on the InD data.

Q7: The use of "batch" in the pseudocode is ambiguous...

The batches in our pseudocode are used exclusively during training to fit $F^* (\mathbf{z}, \mathbf{v})$ and $\phi^* (\mathbf{z})$, while at test time we process singleton inputs (or arbitrary batch sizes). We will clarify this distinction in the revised manuscript.

Q8: ... from 'we posit...' to 'how can we enlarge...' may unintentionally suggest that the hypothesis is taken as established fact.

We acknowledge this logical leap and thank you for this important observation. The transition from positing our hypothesis ('robustness improves as the basin's range expands') to immediately asking how to enlarge the basin was premature, as it assumed the hypothesis was valid. Our intent was to explore a promising direction, not assert a fact. While Theorem 2.5 and Corollary 2.6 provide theoretical support for this hypothesis, we will revise the manuscript to explicitly frame basin enlargement as a hypothesis-driven investigation.

Q9: ... $L_1$, $L_\infty$, $n_i(z)$, $\delta(v−v_0)$ is introduced without definition.

Thank you for highlighting the missing definitions in Theorem 2.1. This was an oversight on our part. In the revision, we've added the following explanations:

• $L^1(\mathbb{R})$ refers to the space of integrable functions on $\mathbb{R}$, while $L^\infty(\mathbb{R})$ denotes the space of essentially bounded functions.
• $n_i(z)$ represents the spatial density for the $i$-th system.
• $\delta(v - v_0)$ is the Dirac delta distribution centered at $v = v_0$, indicating a velocity distribution focused at that point.

Q10: ... (particles, mass, steady state) is inconsistently applied and appears more illustrative than foundational...

That's a great question. It gives us a chance to elaborate on our thinking about neural networks, especially the concept of "mass".

• In physics, particles have position. It's reasonable to use "particles" for advanced features because they behave like discrete entities in a high-dimensional feature space, akin to charged particles in plasma driving dynamics similar to network training.
• "Mass" relates to inertia—the property that allows an object to maintain its state of motion (rest or constant velocity), with greater mass requiring more force to induce change. In neural networks, we can interpret "mass" as a feature's "inertia" or "stability", so features with higher mass resist shifts during learning or optimization, much like mass influences trajectories in physics. This could link to the feature's impact on network output.
• As for "steady state," it corresponds to the condition where the partial derivative of the distribution function $F(\mathbf{z}, \mathbf{v}, t)$ with respect to time equals zero, indicating equilibrium.

We’ll include dedicated sentences in the revision to expand on these ideas.

Q11: Modulo my lack of clarity on the exact evaluation setting...

Thanks for the feedback. The batch definition is addressed in our response to $\text{\textcolor{blue}{Q7}}$. Confidence intervals in the tables reflect mean ± standard error over three independent test runs. We'll clarify this in the table captions.

Q12: Full training and testing procedure and hyperparameter tuning.

• For OOD detection: We freeze a pre-trained model and add two MLP branches after the feature extractor (Figure 3), training only these branches on InD data with loss $\mathcal{L}_{\text{De}}$ and batch size 128. At test time, scores are computed from MLP outputs (Eq.9) with flexible batch sizing.
• For OOD generalization: We train all model parameters and MLP branches with loss $\mathcal{L}_{\text{Gen}}$ using batch size 32 (24 for DomainNet). Figure 6 provides batch size analysis. Testing uses classifier outputs only, with arbitrary batch sizes supported.
• Hyperparameter tuning: We employed Optuna with systematic optimization based on GPU memory constraints and domain knowledge from related OOD literature. Using TPE sampling across 30 trials, each configuration was evaluated with 3 random seeds for stability. For example, the search space on CBD-De included:

{
    'batch_size': [32, 64, 128],
    'learning_rate': [1e-3, 5e-4, 1e-4, 5e-5], 
    'hidden_dim': [128, 256, 512, 1024],
    'MLP_layers': [1, 2],
    ...
}

All reported results use the optimal configurations identified through this process.

Dear reviewer MQNz,

We greatly appreciate your time and effort in reviewing our work, and understand that you may have a busy schedule. We are eager to ensure that we have adequately addressed your concerns and are prepared to offer further clarifications or address any additional questions you may have.

Since the discussion period will end in around 40 hours, we will be available and happy to respond to any feedback or questions you may have regarding our rebuttal. We would be grateful if you could share your thoughts with us.

Best regards,

Authors