Energy-based Hopfield Boosting for Out-of-Distribution Detection

Response to Weaknesses:

1. For the experiments comprising ImageNet-1K as the ID data set, we use images with size 224x224. This misunderstanding arises because we missed to report the resolutions we use for the ImageNet benchmark. We apologize for this error. We will make sure that the updated version of the manuscript contains this information.
2. The reviewer’s analysis is correct and we agree that generalization beyond the classes contained in the auxiliary outlier data set is a highly desirable property for OOD detection methods with OE. It is hard to say with absolute certainty that an OOD test data set does not contain any class overlap with the auxiliary outlier data set, but as far as we know, ImageNet-1K (the auxiliary outlier data set in the CIFAR-10 setting) and SVHN (an OOD test set in the CIFAR-10 setting) do not share common classes.

Response to Questions:

1. For our experiments, we selected auxiliary outlier data sets that cover a large and diverse region of the feature space. Optimally, one would have highly specific auxiliary data that is 100% indicative of the OOD samples. However, since the OOD samples are generally not known a-priori there is the option to fall back on such large and diverse auxiliary data sets. Such datasets then have the advantage that they likely contain samples that share some similarity with the OOD samples used for testing. This is a realistic setting for many applications since it is often possible to easily mine such auxiliary datasets. It is, however, unrealistic to expect to obtain an auxiliary outlier data set that will completely cover the entire OOD region. Therefore, Hopfield Boosting frequently samples data instances close to the decision boundary between the ID and OOD region. This allows Hopfield Boosting to learn a decision boundary that more tightly encapsulates the ID data. To verify the effectiveness of Hopfield Boosting trained on the ImageNet-1K benchmark with ImageNet-21K as auxiliary outlier data on noticeably different data sets, we evaluated the model on three additional OOD data sets: iCartoonFaces, RPC, and FourShapes (we refer to Appendix H.6 of the original manuscript for examples from these data sets). The results are as follows (all numbers in %):

   	FPR95	AUROC
   iCartoonFaces	3.7	98.76
   RPC	79.73	92.64
   FourShapes	0.0	99.84

2. We apologize for not reporting that we use images with size 224x224 for the ImageNet-1K benchmark. And, indeed, we also did miss to describe the used transformations, which follow Zhu et al. (2023) for comparability. Namely:

   • Resize to 224x224
   • RandomCrop 224x224, padding 4
   • RandomHorizontalFlip

   We will include this list of transformations in the Appendix of the final manuscript.

3. The mean ID accuracy for Hopfield Boosting is 94.02% for CIFAR-10 (ResNet-18), 75.08% for CIFAR-100 (ResNet-18), and 76.3% for ImageNet-1K (ResNet-50). In the PDF attached to the response on the top of this page, we also include an ablation on $\lambda$, the weight of our energy-based OOD loss. The experiment shows that decreasing $\lambda$ to $0.1$ will improve the ID accuracy when using Hopfield Boosting (from 94.02% to 94.98%), while only moderately influencing OOD detection performance (the FPR95 metric increases from 0.92% to 1.08%).

4. We will communicate more clearly that we use a resolution of 224x224 in the ImageNet-1K benchmark.

References:

Zhu et al., Diversified Outlier Exposure for Out-of-Distribution Detection via Informative Extrapolation, NeurIPS 2023

We provide the detailed ID classification results (including the F1 scores) of a model trained using Hopfield Boosting on CIFAR-10:

             precision    recall  f1-score   support


           0      0.934     0.947     0.940      1000
           1      0.961     0.974     0.967      1000
           2      0.928     0.914     0.921      1000
           3      0.860     0.873     0.867      1000
           4      0.933     0.950     0.942      1000
           5      0.881     0.892     0.886      1000
           6      0.963     0.955     0.959      1000
           7      0.978     0.947     0.962      1000
           8      0.961     0.961     0.961      1000
           9      0.967     0.949     0.958      1000


    accuracy                          0.936     10000
   macro avg      0.937     0.936     0.936     10000
weighted avg      0.937     0.936     0.936     10000

Response to Weaknesses:

• We agree with this. To demonstrate how Hopfield Boosting can interact in a classification task we created a toy example that resembles the ID classification setting (Figure 4 in the PDF attached to the response on the top of the page): The example shows the decision boundary and the inlier samples organized in two classes. We sample uniformly distributed auxiliary outliers. Then, we minimize the compound objective $\mathcal{L} = \mathcal{L}\_{CE}+\mathcal{L}\_{OOD}$ (applying the gradient updates on the patterns directly). This shows that $\mathcal{L}_{CE}$ is able to separate the two classes well and that $E_b$ still forms a tight decision boundary around the ID data.

• We agree with the reviewer. The application of Hopfield Boosting influences the ID decision boundary: It decreases the ID classification accuracy on CIFAR-10 on average from 94.80% without Hopfield Boosting to 94.02% with Hopfield Boosting. Our work treats samples close to the decision boundary as weak learners. However, the wider ramifications of this behavior remain unclear. For example, the reviewer rightfully points towards a connection to adversarial examples. And indeed, one can also view the sampling of data instances close to the decision boundary as a form of adversarial training in that we search for something like “natural adversarial examples”: Loosely speaking, the usual adversarial example case starts with a given ID sample and corrupts it in a specific way to get the classifier to output the wrong class probabilities. In our case, we start with a large set of potential adversarial instances (the AUX data) and search for the ones that could be either ID or OOD samples. That is, the sampling process will more likely select data instances that are hard to discriminate for the model — for example, if the model is uncertain whether a leaf in an auxiliary outlier sample is a frog or not. Nonetheless, a closer systematic evaluation of the sharpened decision boundary of Hopfield Boosting is important to fully understand the potential implications w.r.t. adversarial examples. We view such an investigation as out-of-scope for this work. However, we consider it as an interesting avenue for future work and will mention so explicitly in the revised manuscript.

  We include the classification results (with the F1 scores) of a model trained with Hopfield Boosting on the CIFAR-10 benchmark in the official comment below. Table 1 in the PDF posted on top of the page also includes the ID accuracies of all compared methods. Figure 1 in the PDF shows the performance when ablating on $\lambda$, the weight of our OOD loss. We will add all those results in the Appendix of the updated manuscript.

Response to Questions:

1. We would like to thank the reviewer for this very interesting reference. The dichotomy between sharp and smooth decision boundaries is highly relevant to our work. We will discuss it in the updated manuscript. The smooth boundaries discussed in Anderson et al. (2022) help with “classical” adversarial examples. In this framing, our approach would produce different adversarial examples that are not based on noise, but are more akin to “natural adversarial examples” (see our answer to the weakness above). For example, it is perfectly fine for us that an OOD sample close to the boundary does not correspond to any of the ID classes. Furthermore, the noise based smoothing leads to adversarial robustness at the (potential) cost of degrading classification performance. Similarly, our sharpening of the boundaries leads to better discrimination between ID and OOD region at the (potential) cost of degrading classification performance.
2. The test data sets we employ for OOD (Tables 1 and 2 in the original manuscript) can be seen as a de-facto standard benchmark. They have been used in a wide range of other publications (e.g., Hendrycks et al., 2019; Ming et al., 2022; Zhu et al., 2023). We opted to follow the established work for the sake of comparability. However, we believe that the reviewer raises an excellent point in that the choice of OOD data sets needs to be more rigorously discussed by the community. Indeed, albeit the selection is not a focus of our work, we did take up upon the resulting problems with regard to benchmarking: In Appendix H.5 (original manuscript), we investigate the Places 365 data set and show that a substantial amount of instances contained in this data set contains semantic overlap with the ID classes of CIFAR-10. And, in Appendix H.6, we evaluate Hopfield Boosting for additional, noticeably different data sets (iCartoonFaces, 4 Shapes, RPC).
3. Yes, in Appendix H.5 of the original manuscript, we show that Hopfield Boosting identifies data instances from the OOD test data set Places 365 that contain classes of the ID data set CIFAR-10 (e.g., automobiles, dogs, trucks, and airplanes) as ID. This indicates that Hopfield Boosting learns semantically meaningful features.
4. This information is indeed missing in our manuscript and we will add it. In short: We utilize a ResNet-50 that was pre-trained on ImageNet-1K and is provided by Torchvision. We wanted to keep our method comparable to other outlier exposure methods and therefore closely follow the training protocol of Zhu et al. (2023) (hence, we fine-tune the pre-trained ResNet-50 for four epochs). We mainly chose the model because it is well-documented. The model achieves an ID accuracy of 76.3% after fine-tuning with Hopfield Boosting for four epochs. The pre-trained model achieves an ID accuracy of 76.1%.

References:

Anderson et al., Certified Robustness via Locally Biased Randomized Smoothing, PMLR 2022

Hendrycks et al., Deep Anomaly Detection with Outlier Exposure, ICLR 2019

Ming et al., POEM: Out-of-Distribution Detection with Posterior Sampling, ICML 2022

Zhu et al., Diversified Outlier Exposure for Out-of-Distribution Detection via Informative Extrapolation, NeurIPS 2023

Response to Weaknesses:

• We respectfully disagree with the claim that Hopfield Boosting is an incremental extension. We take it as a hint that we did not emphasize the novelty enough. Hopfield Boosting not only combines existing concepts in a novel, principled, and theoretically well-motivated way, but also includes specific innovations that have not been used in previous work: The novel energy function that, to our knowledge, is first introduced in our paper, fits a nonlinear decision boundary into the embedding space of a neural network. Hopfield Boosting samples patterns close to the decision boundary and computes the OOD loss using the same energy function. Our theoretical results are also novel. They show that the novel energy function is well-motivated from a probabilistic perspective. We will make sure that the revised manuscript states this more clearly.

Response to Questions:

• Adapting the setting of Zhang et al. (2023) to leverage OOD data in the way we do is not trivial. Probably, the most straightforward avenues to include AUX data in their setting are: (a) Use an existing OOD loss (e.g., the one from Hendrycks et al., 2019) to perform outlier exposure during training and use HE/SHE on the resulting model. (b) Use a model trained only on the ID data and adapt HE or SHE to include an MHE term that measures the energy of $\boldsymbol{\xi}$ on the AUX data. Due to time constraints, we only conducted experiment (b) for the rebuttal, but we will include both HE/SHE extensions in the camera-ready version of the manuscript.

  In specific, experiment (b) consists of two steps: First, we take CIFAR-10 as a benchmark and use the following score: $s_{\mathrm{mod}}(\boldsymbol{\xi}) \ = \ s_{\mathrm{HE}}(\boldsymbol{\xi}) - \mathrm{lse}(\beta, \boldsymbol{O}^T\boldsymbol{\xi})$, where $\boldsymbol{O}$ contains 50,000 randomly selected encoded patterns from the auxiliary outlier data set. Second, we tune $\beta$ such that $s_{\mathrm{mod}}$ performs well on the OOD Test data to obtain an upper bound on the possible performance. The $\beta$ we selected is $0.001$. The results are as follows (all numbers in %):

  	FPR95	AUROC
  SVHN	25.02	94.90
  Textures	17.42	97.08
  Places365	41.24	91.16
  LSUN-Crop	7.35	98.67
  LSUN-Resize	13.69	97.68
  iSUN	14.76	97.42
  Mean	19.91	96.15

  For comparison, Hopfield Boosting obtains a mean FPR95 of 0.92%. This indicates that the innovations introduced in our work are the main factors for the effectiveness of Hopfield Boosting.

• This question is best answered with an experiment that shows the effect of the memory size:

  We train Hopfield Boosting on CIFAR-10 (ID data) and ImageNet (AUX data). During the weight update process, we store 50,000 patterns in the memories $\boldsymbol{X}$ and $\boldsymbol{O}$, and then ablate the number of patterns stored in the memories for computing the score $s(\boldsymbol{\xi})$ at inference time. We evaluate the discriminative power of $s(\boldsymbol{\xi})$ on SVHN with 1, 5, 10, 50, 100, 500, 1,000, 5,000, 10,000, and 50,000 patterns stored in the memories $\boldsymbol{X}$ and $\boldsymbol{O}$. To investigate the influence of the stochastic process of sampling $N$ patterns from the ID and AUX data sets, we conduct 50 runs for all of the $N$ and create boxplots of the runs.

  The results (attached PDF) show that sampling $N=50,000$ patterns has the lowest variability of the individual trials. We argue that the reason for this is that by the time we reach $N=50,000$ the entire ID data set is stored in the Hopfield memory — which effectively eliminates stochasticity from randomly selecting $N$ patterns from the ID data.

  These are interesting results and we thank the reviewer for bringing the point up. We will include the results in the Appendix of our final paper.

• We see two notions of imbalance that could be relevant here:

  1. Imbalance w.r.t. the number of samples contained in the ID and AUX data sets: The experiments we conducted in the manuscript show that Hopfield Boosting can handle this notion of imbalance. CIFAR-10 (the ID data set) contains 50,000 training samples, while ImageNet (the AUX data set) contains 1,281,167 training samples. Hopfield Boosting uses all training data from CIFAR-10, but for ImageNet, we sample 50,000 data instances to match the memory size of the ID data set. This is a simple way to ensure that the score $s(\boldsymbol{\xi})$ is not influenced by the number of data instances contained in the ID and AUX data sets.
  2. Imbalance w.r.t. the number of samples stored in the Hopfield memories: This imbalance is indeed not tackled in the original manuscript, albeit it could be beneficial to store an imbalanced number of patterns in the memories $\boldsymbol{X}$ and $\boldsymbol{O}$. Hence, we do the following experiment to verify that we can use $s(\boldsymbol{\xi})$ when the number of patterns in $\boldsymbol{X}$ and $\boldsymbol{O}$ is imbalanced: We fill $\boldsymbol{X}$ with all 50,000 data instances of CIFAR-10 and fill $\boldsymbol{O}$ with 1, 5, 10, 50, 100, 500, 1000, 5000, 10,000, and 50,000 data instances. Then, we evaluate the discriminative power of $s(\boldsymbol{\xi})$ for the different instances. Our results (attached PDF) show that Hopfield Boosting is robust to an imbalance in the number of samples in $\boldsymbol{X}$ and $\boldsymbol{O}$. The setting with 50,000 samples in both memories (which is the setting we use in the experiments in our original manuscript) incurs the least variability. We will also include this experiment in the Appendix of the updated manuscript.

References:

Hendrycks et al., Deep Anomaly Detection with Outlier Exposure, ICLR 2019

Zhang et al., Out-of-Distribution Detection based on In-Distribution Data Patterns Memorization with Modern Hopfield Energy, ICLR 2023

Response to Weaknesses:

• Because of the highly competitive nature of the CIFAR-10 benchmark, we view every improvement as important (e.g., the previous methods' AUROC were already above 99%; e.g., POEM achieves an AUROC of 99.21%). That said, we agree that more evaluations w.r.t. the individual components introduced in Hopfield Boosting will shed more light on which factors influence the good performance of Hopfield Boosting, and thank the reviewer for this suggestion. To find the contribution of the individual elements of Hopfield Boosting, we evaluate the performance of the following ablated training procedures on the CIFAR-10 benchmark:

  1. Random sampling instead of weighted sampling
  2. Random sampling instead of weighted sampling and no projection head
  3. No application of $\\mathcal{L}_{OOD}$

  The results in the PDF (Table 2) attached to the answer on top of the page show that all of weighted sampling, the projection head, and $\\mathcal{L}_{OOD}$ are important factors that contribute to Hopfield Boosting’s performance. We will include these experimental results in the Appendix.

• We agree with the reviewer that the manuscript will benefit from a more detailed description of the validation process. We will expand the experimental section with additional information regarding the validation and model selection process, as follows:

  For validation and model selection, we evaluate the model on the OOD data sets MNIST and ImageNet-RC with different preprocessing than in training (resize to 32x32 pixels instead of crop to 32x32 pixels), as well as Gaussian and uniform noise. We train models using a grid search with $\lambda$ selected from the set $\\{0.1, 0.25, 0.5, 1.0\\}$, and $\beta$ selected from the set $\\{2, 4, 8, 16, 32\\}$. From said hyperparameter configurations, we select the model with the lowest mean FPR95 metric (where the mean is taken over the validation OOD data sets) and do not consider the ID classification accuracy for model selection.

• We agree with the reviewer that reporting the ID accuracy will help the reader to better understand the influence between outlier exposure methods and the ID classifier’s performance. Therefore, we have compiled the ID accuracies achieved by the individual outlier exposure methods and included results in the PDF attached.

  There is usually an inherent tradeoff between ID accuracy and OOD detection performance when employing outlier exposure methods. We do however not view it as a crucial aspect of our work, since in practice one can always improve the tradeoff by using models with more capacity — in the extreme case practitioners can even train a separate ID network. Hence, the model selection process we employed so far only considered the OOD detection performance and did not take the ID accuracy into account. That said, we still agree with the general sentiment of the reviewer. Thus, we decided to examine the tradeoff by conducting the following experiment:

  We (1) ablate the $\\lambda$ hyperparameter (the weight of the out-of-distribution loss $\\mathcal{L}_{OOD}$) and run Hopfield Boosting on the CIFAR-10 benchmark; (2) select $\\lambda$ from the range $[0, 1]$ with a step size of $0.1$; and (3) record the OOD detection performance (the mean FPR95 where the mean is taken over the OOD test data sets) and the ID classification error for the individual settings of $\\lambda$.

  The results indicate that decreasing the $\\lambda$ hyperparameter improves the ID classification accuracy of Hopfield Boosting (Figure 1). At the same time, the mean OOD AUROC is only moderately influenced: When setting $\\lambda = 0.5$, the hyperparameter setting reported in the original manuscript, the mean ID classification error is 5.98%, and the mean FPR95 is 0.92%. When decreasing $\\lambda$ to 0.1, the mean ID classification error improves to 5.02%. Similarly, the FPR95 only slightly increases to 1.08% (which is still substantially better than the second-best outlier exposed method, POEM, which achieves a mean FPR95 of 2.28%). Hence, practitioners can control the tradeoff between ID classification accuracy and OOD detection performance.

  Our update will include the ID accuracy results and the tradeoff Figure.