Textual Training for the Hassle-Free Removal of Unwanted Visual Data: Case Studies on OOD and Hateful Image Detection

Firstly, we thank you for your thorough review of our paper. We particularly appreciate your recognition of our innovative approach using only textual data for hate detection, which eliminates the need to source hateful images and addresses ethical concerns. Additionally, we value your acknowledgment of our comprehensive experimentation, ablation analysis, and the provision of implementation details and code for reproducibility.

We are also immensely grateful for your excellent suggestions that can enhance the contents of our paper. We will address each of your concerns in detail in the following:

Q1. The writing structure could be improved. The textual synthesis aspect is not clear to me and should be discussed in more detail in the main paper.

A1. We apologize for any inconvenience caused in understanding our paper. In our method, the purpose of textual data synthesis is to emulate the entire visual dataset for training. We assumed that using prompt templates, such as "a photo of a {}", to generate text data could effectively emulate visual data, based on observations of high CLIP zero-shot classification performance with similar prompts. Therefore, our textual data synthesis involves simply inserting numerous words into the prompt "This is a photo of a {}". In our experiments, we used approximately 370k predefined English words. Our results demonstrate that even this lightweight textual data synthesis method can produce a detector capable of identifying various types of unwanted images.

Q2. The method could also be used for generic image classification tasks which brings me to question the choice of why such classification results have not been shown.

A2. In fact, our proposed method can always perform generic image classification and unwanted data detection simultaneously. Figure 1 in our paper or the figure in our repository (https://github.com/HFTT-anonymous/HFTT) can aid in understanding this. HFTT utilizes the input embeddings and logit values as they are for zero-shot classification while simultaneously estimating the probability that an input sample is unwanted. For example, our method can be applied to solve a 1001-class classification task consisting of 1000 ImageNet classes plus one OOD class.

However, applying our method does not enhance the zero-shot image classification performance of VLMs. This is because our method focuses solely on optimizing trainable embeddings for out-distribution detection while keeping CLIP frozen. Consequently, the image classification performance of VLMs remains the same as their zero-shot classification performance even after applying our method. Hence, we did not present classification results. For instance, the ImageNet classification accuracy of CLIP-ViT-B/16 remains at 68.6%, regardless of whether our method is applied.

Q3. Some more discussion over the baselines would be good too.

A3. Thank you for your suggestion. We provide further discussion on the strongest baselines and present results for various foundation models here:

Comparison with SOTA OOD detection methods
NegLabel [1] and CLIPN [2] are cutting-edge OOD detection methods. NegLabel constructs an OOD corpus by selecting texts distant from the in-distribution texts from a predefined corpus, then compares the distances between the input image and those texts in the CLIP embedding space to detect OOD. While NegLabel shows high OOD detection performance on ImageNet (see Table B), it has the following limitations compared to our method:

• Although NegLabel does not require training additional parameters, it must compute the embeddings of all texts in the corpus and measure their similarity to the in-distribution texts to find the optimal OOD corpus for a given in-distribution. Our training method also requires nearly the same cost as obtaining the embeddings of all texts within a predefined corpus and calculating the similarities between those embeddings and the task+trainable embeddings, as discussed in Section 4.1. Thus, NegLabel and our method require the same level of optimization cost.
• Since NegLabel uses the embeddings of the determined OOD corpus as they are, it falls behind our method, which has trainable parameters, in terms of generalization. To demonstrate this, we further compare our method and NegLabel in the medical image domain. Specifically, we treat the ISIC-18 skin lesion diagnosis dataset [3] as in-distribution and the PathVQA [4] and PatchCamelyon [5] datasets as out-of-distribution. The ISIC-18 skin lesion diagnosis dataset is an image classification benchmark for seven skin disease categories.

Table A: OOD detection in the medical image domain

Table A illustrates the limitations of NegLabel in terms of generalization. While NegLabel fails to construct an effective OOD corpus for the medical image dataset, our method achieves significantly higher performance by learning optimal embeddings for detection.

CLIPN utilizes an additional "no" text encoder alongside CLIP. This additional text encoder predicts the probability that a given object is not present in an image. Thus, CLIPN predicts whether a given image is in-distribution or out-distribution by using the original CLIP text encoder and the "no" text encoder to estimate the probabilities, respectively. Images with a low probability of being in-distribution and a high probability of being out-distribution are identified as OOD.

Although CLIPN achieves high OOD detection performance on ImageNet (see Table B), it has the following limitations compared to our method:

Firstly, we thank you for your thorough review of our paper. We particularly appreciate your recognition that our method is the compelling approach of utilizing text-only mode for detecting data in other modes and that the training and inference processes are highly efficient. We are also immensely grateful for your excellent suggestions that can enhance the contents of our paper. We will address each of your concerns in detail in the following:

Q1. The trainable embedding learning process is unclear. According to the description, trainable embeddings are learned for N out-distribution data instances, which are then frozen during the test phase. It appears that the image embeddings obtained by the image encoder align with the frozen embeddings. If this is the case, the alignment process should be clearly elucidated. If not, the method for using the learned embeddings for images needs to be explained.

A1. In Section 3.1 of our paper, we presented a motivating example demonstrating that a classifier obtained using only textual data in the output space of a model like CLIP, where images and texts are well-aligned, can also be applied to image data. Based on this, we proceed as follows:

1. We define trainable embeddings in the output space of CLIP that serve as the parameters of a classifier distinguishing between in-distribution and out-distribution data.
2. We train these embeddings using only textual data.
3. We use these trained embeddings to detect unwanted images. In summary, the model parameters of CLIP remain fixed, and our trainable parameters are defined and trained within CLIP’s (image-text) joint embedding space. Thus, our method does not require any additional alignment process.

Q2. The parameter N, representing the number of out-distribution data used during training, intuitively suggests that a larger N would enhance accurate distribution learning. However, the results in Table 8 present a contradictory viewpoint. More explanation should be given.

A2. We apologize for any confusion caused by our notation. The "N" in Table 8 refers to the number of trainable embeddings, not the number of out-distribution data. The number of trainable embeddings in our method represents the complexity of the classifier that distinguishes between in-distribution and out-distribution data. If the data in CLIP's output space form a very low-dimensional manifold, it would be possible to distinguish between in- and out-distribution data with a small number of trainable embeddings. As we can see in Table 8, a large "N" is not necessary for high unwanted image detection results. Indeed, various studies support the notion that deep learning models possess low-dimensional data manifolds [1,2].
[1] Ansuini et al. "Intrinsic dimension of data representations in deep neural networks." NeurIPS 2019.
[2] Moayeri et al. "Text-to-concept (and back) via cross-model alignment." ICML 2023.

Q3. The test on other pre-trained models to view how the pre-learned cross-modal alignment knowledge impacts the text-only learning.

A3. Thank you very much for suggesting an expansion of our research domain. Video embedding models and detection tasks are less established than those in the image domain. We will investigate the experimental environment further and include results in the next version of our paper. Here, we provide the results for CLIP-L/14, BLIP-B/16, and BLIP-L/16 in addition to the CLIP-B/16 used in our study. Tables A, B, and C demonstrate that our method is effective across various vision-language models.

Table A: The experimental results on CLIP-L/14 (in-distribution: ImageNet)

Table B: The experimental results on BLIP-B/16 (in-distribution: ImageNet)

Table C: The experimental results on BLIP-L/16 (in-distribution: ImageNet)

Firstly, we thank you for your thorough review of our paper. We particularly appreciate your recognition that our paper has no significant weaknesses and is well-organized. We have made our best efforts to address your remaining concerns as follows. If our responses meet your expectations, we would be grateful if you could consider reflecting this in your rating:

Q1. This idea of training on textual content for transferring to visual content is interesting, could the authors provide more insights on more examples of applications of this method except for the OOD detection and hateful image detection? Is it possible to apply it to more binary classification tasks?

A1. Our method can be applied to more binary classification tasks. We additionally demonstrate the applicability of our method, HFTT, in detecting low-quality images, which are commonly unwanted visual data beyond OOD and hate images. Specifically, we assume the task of detecting corrupted images lurking within a raw visual dataset consisting of 1000 ImageNet classes. For this experiment, we use ImageNet and ImageNet-C. As shown in Table A below, HFTT consistently surpasses existing methods in the detection of corrupted images.

Table A: Corrupted image detection

Q2. What encoders are used to obtain the task embedding? The authors mentioned using CLIP as the vision backbone, and is the text encoder during training also from CLIP?

A2. As discussed in Section 3.1 of our paper, our method assumes that text and image are well-aligned through contrastive learning, similar to CLIP. Therefore, if CLIP is used as the vision encoder, the text encoder must also be CLIP. If text and image are well-aligned, our method can be applied to models other than CLIP. To demonstrate this, we additionally apply our method to BLIP and observe the results. Table B shows that our method is also effective for BLIP.

Table B: The experimental results on BLIP (in-distribution: ImageNet)

Q3. How do you decide the number of task embeddings?

A3. The number of task embeddings is not a hyper-parameter but is determined by the in-distribution task. For example, if the in-distribution is ImageNet, the task embeddings are the text embeddings for the 1,000 ImageNet classes, such as ["a photo of a tench", ..., "a photo of a toilet paper"]. In the case of hateful image detection, we used representative hate phrases defined by the dataset as task embeddings. The number of trainable embeddings in our method is a hyper-parameter. We present an ablation study on this in Table 8 of Appendix C, and the results show that our method is not sensitive to this parameter.

Q4. The paper mentions using the proposed method to detect unwanted content and uses two tasks (OOD detection and hateful image detection. If I understand correctly, my key concern is that the focus of this paper is closer to a novel method for binary classification with an application that classifies unwanted content. Could the authors share more thoughts regarding this? If so, I would suggest slightly paraphrasing the introduction to better reflect the contribution and indicate more potential applications.

A4. We are hesitant to consider our method as a novel approach for binary classification. Generally, binary classification is defined as the task of finding patterns that best distinguish between two different classes. However, in our scenario, we assume that only one (in-distribution) of the two classes has patterns, while we make no assumptions about the other class to cover all possible cases. Therefore, for binary classification tasks where both classes have specific patterns, our method may not lead to a good solution compared to methods that consider patterns of both classes. Thus, we would like to distinguish our method from general binary classification methods. We appreciate the reviewer for prompting us to view our method in this light.

Q5. Can this method be extended to multi-class classifications?

A5. In fact, our proposed method can always perform multi-class classification and unwanted data detection simultaneously. Figure 1 in our paper or the figure in our repository (https://github.com/HFTT-anonymous/HFTT) can aid in understanding this. HFTT utilizes the input embeddings and logit values as they are for zero-shot classification while simultaneously estimating the probability that an input sample is unwanted. For example, our method can be applied to solve a 1001-class classification task consisting of 1000 ImageNet classes plus one OOD class.

However, applying our method does not enhance the zero-shot image classification performance of VLMs. This is because our method focuses solely on optimizing trainable embeddings for out-distribution detection while keeping CLIP frozen. Consequently, the image classification performance of VLMs remains the same as their zero-shot classification performance even after applying our method. For instance, the ImageNet classification accuracy of CLIP-ViT-B/16 remains at 68.6%, regardless of whether our method is applied.

Firstly, we express our gratitude for your thorough review of our manuscript. Particularly, we appreciate your recognition of our method as valuable and useful in practice, as well as your acknowledgment that the justification of our method is well-motivated and clearly presented. Furthermore, we appreciate your invaluable suggestions, which significantly enrich the substance of our work. In the subsequent sections, we meticulously address each of your concerns as follows:

W1. The related work section lacks comprehensiveness. While the authors mention some CLIP-based methods, they overlook approaches closely related to their own. Notably, NegLabel (ICLR2024) and CLIPN (ICCV2023) also use textual features for OOD detection and are very similar to the proposed method. The authors should include these works in their related work section, provide benchmarks, and critically analyze the advantages of their approach compared to these existing methods.

A1. Thank you for your feedback on the two related studies. We can compare our method with each of these studies as follows. This discussion will be added to the final version of our paper:

Comparison with NegLabel
NegLabel constructs an OOD corpus by selecting texts distant from the in-distribution texts from a predefined corpus, then compares the distances between the input image and those texts in the CLIP embedding space to detect OOD. While NegLabel shows high OOD detection performance on ImageNet (see Table B), it has the following limitations compared to our method:

• Although NegLabel does not require training additional parameters, it must compute the embeddings of all texts in the corpus and measure their similarities to the in-distribution texts to find the optimal OOD corpus for a given in-distribution. Our training method also requires nearly the same cost as obtaining the embeddings of all texts within a predefined corpus and calculating the similarities between those embeddings and the task+trainable embeddings, as discussed in Section 4.1. Thus, NegLabel and our method require the same level of optimization cost.
• Since NegLabel uses the embeddings of the determined OOD corpus as they are, it falls behind our method, which has trainable parameters, in terms of generalization. To demonstrate this, we further compare our method and NegLabel in the medical image domain. Specifically, we treat the ISIC-18 skin lesion diagnosis dataset [1] as in-distribution and the PathVQA [2] and PatchCamelyon [3] datasets as out-of-distribution. The ISIC-18 skin lesion diagnosis dataset is an image classification benchmark for seven skin disease categories.

Table A: OOD detection in the medical image domain

Table A illustrates the limitations of NegLabel in terms of generalization. While NegLabel fails to construct an effective OOD corpus for the medical image dataset, our method achieves significantly higher performance by learning optimal embeddings for detection.

Comparison with CLIPN
CLIPN utilizes an additional "no" text encoder alongside CLIP. This additional text encoder predicts the probability that a given object is not present in an image. Thus, CLIPN predicts whether a given image is in-distribution or out-distribution by using the original CLIP text encoder and the "no" text encoder to estimate the probabilities, respectively. Images with a low probability of being in-distribution and a high probability of being out-distribution are identified as OOD.

Although CLIPN achieves high OOD detection performance on ImageNet (see Table B), it has the following limitations compared to our method:

• CLIPN requires significantly higher inference costs due to the use of an additional text encoder.
• While our method requires lightweight training that does not involve images, CLIPN demands extensive and expensive training of the "no" text encoder on large vision-language datasets.
• CLIPN can only be applied to tasks where the distinction between in-distribution and out-distribution is clear and straightforward, such as classification datasets. This is because all training images must be classified as either "yes" or "no" images. Therefore, it is unsuitable for tasks dealing with abstract concepts, such as hateful image detection, as discussed in Section 4.3 of our paper.
• Our method can be easily applied to any detection task defined in natural language, whereas CLIPN shows significantly degraded performance for in-distribution tasks that fall outside the training distribution of the "no" text encoder. In terms of applicability, our proposed method surpasses CLIPN. To demonstrate this, we further compare our method with CLIPN in the medical image domain. Table A illustrates the limitations of CLIPN in terms of generalization. While CLIPN effectively detects PCAM, it exhibits very low detection performance on PVQA. In contrast, our method achieves high performance on both OOD tasks.

Table B: OOD detection performance on ImageNet in-distribution (average for Texture, Places, SUN, and iNaturalist)

[1] Codella, Noel, et al. "Skin lesion analysis toward melanoma detection 2018: A challenge hosted by the international skin imaging collaboration (isic)." arXiv 2019.
[2] He, Xuehai, et al. "Pathvqa: 30000+ questions for medical visual question answering." arXiv 2020.
[3] Veeling, Bastiaan S., et al. "Rotation equivariant CNNs for digital pathology." MICCAI 2018.