OOD Detection with Relative Angles

Thank you for the careful reading and for highlighting the geometric link we drew between fDBD and ORA. We address each point below.

1 Clarifying the regularization term

How raw distance, fDBD, and ORA relate

A. From distance to angles

Raw distance to the decision boundary is $d(z,z_{db})$.

by shifting all points by the ID mean $\mu$ and applying the law of sines, this distance can be written as:

$d(z, z_{db}) = \||z - \mu\|| \cdot \frac{\sin\theta}{\sin\alpha}$

• $\theta$ – angle between z and its projection on the boundary (contains ID/OOD signal).
• $\alpha$ – auxiliary angle at the origin (Fig. 2 shows almost no ID/OOD signal).
• $\||z − \mu\||$ – feature distance to the ID mean; varies with image scale, brightness, etc.

B. Why fDBD beats raw distance

fDBD divides by the feature distance to the ID mean:

$\text{fDBD} = \frac{d(z, z_{db})}{\|| z - \mu \||} = \frac{\sin\theta}{\sin\alpha}$.

Dividing removes the scale term, so scores are no longer sensitive to simple rescalings of the feature vector. This alone improves AUROC / FPR95 compared with raw distance.

C. Why ORA beats fDBD

Empirically, $\sin \alpha$ is nearly identical for ID and OOD (Fig. 2), so the factor ($\sin\alpha$) adds variance but no separation. ORA therefore keeps only the informative part:

$\text{ORA} \propto \theta$

D. Resulting hierarchy

$\boxed{\text{raw distance} < \text{fDBD} < \text{ORA}}$

• Raw distance suffers from scale noise.
• fDBD fixes scale noise but still carries $\frac{1}{\sin\alpha}$ noise.
• ORA fixes both, explaining its per‑model gains and its suitability for scale‑invariant ensembling.

Q: Do hyper‑parameter‑free, model‑agnostic, scale‑invariant also apply to fDBD?

A. Yes—fDBD shares these three traits, and for that reason it is our primary baseline throughout Tables 1, 2, 3, 4, 8, 9, 14, 15, 17, 18, 19. Across all experiments ORA never trails fDBD and often surpasses it.

2 “Modest improvements”

On ImageNet OOD (nine architectures) ORA is #1 on 5/9 backbones, never worse than top‑3, and reduces mean FPR95 by $3.18 \%$ versus the next best method (Pcos). ORA also achieves the single best score overall ($25.04 \%$ FPR95 on ResNet‑SCL), motivating our deeper dive into contrastive features (CLIP, Section 4.2). Similar gains appear for model ensembles and activation‑shaping plug‑ins.

3 Extra evidence on “ID points lie further from the decision boundary”

To confirm that the observation holds even for very simple data / models, we trained a LeNet‑5 on MNIST as suggested by the reviewer and measured the distance to the decision boundary for MNIST (ID) and Fashion‑MNIST (OOD).

ID samples are, on average, 1.1 units further from the decision boundary than OOD samples.

Intuition. Cross‑entropy training maximizes class‑conditional log‑likelihood, which drives features to align strongly with their corresponding weight vectors (confident regions), i.e. deep inside their class cones and therefore away from the boundary. OOD images do not match strong class‑specific patterns, so their features align less and end up nearer to the boundary, exactly as the distance statistics show.

This experiment supports the geometric premise shared by fDBD and ORA on the toy dataset.

We hope these clarifications resolve your concerns and underscore how ORA both simplifies and strengthens the fDBD insight.

Thanks to the author for the concise and precise response. I acknowledge that my understanding of ORA in the initial review was incorrect. Now, I would like to reassess this work: The geometric interpretation of fDBD is highly interesting. In particular, leveraging the law of sines to clearly illustrate the connection between fDBD and the proposed method is insightful and appealing. Moreover, this new perspective provides important practical guidance - the empirical observation of $\sin \alpha$ revealed it to be an insignificant term that can be eliminated. Indeed, removing $\sin \alpha$ resulted in a stable improvement in OOD detection performance. Although this work extends fDBD, it introduces an intriguing perspective, and this novel viewpoint effectively enhances performance, making it strong work overall. Therefore, I have increased my rating.

Thank you for the thoughtful comments. We reply to each weakness in the same order.

1 ORA, minority/majority classes and per‑class behavior

Per‑class centering experiment. To test whether ORA favors or penalizes specific classes, we present the scores on CIFAR‑10 and ImageNet while centering each time on one class mean (instead of the global mean). The table below reports, for every class, OOD performance (FPR95 ↓, AUROC ↑) and the corresponding in‑distribution accuracy (“ID Acc”) of that class’s classifier outputs:

Takeaway. (i) There is no clear correlation between a class’s ID accuracy and its OOD performance when used as the reference; and (ii) using a single global mean (ORA) is slightly better most of the time than any individual class, supporting our choice. For imbalanced datasets the global mean can be replaced by a weighted mean or by the weighted combination of per‑class angles discussed in our response to Reviewer JVzv (future work).

2 “ORA as a confidence measure”

We agree that the wording was hand‑wavy. Our intended meaning is:

• Angle‑based scores naturally convey model confidence: for ORA a large angle (relative to the global mean) implies the feature lies well inside its class cone, hence is likely ID; a small angle indicates uncertainty.
• Because angles are scale‑invariant, ORA detection scores from different backbones can be summed directly. Meaning that, a model with a low confidence contributes a small value, while a high confidence one contributes a large value. This underpins the ensemble experiment.

We will replace “confidence measure” with the more precise phrasing above in Section 3.2.

3 Clarifying the role of Fig. 2

Figure 2 compares the density of $\sin\alpha$  for ID versus OOD data, where $\alpha$ is the auxiliary angle that appears in the geometric derivation of fDBD. In our formulation the ORA score is proportional only to $\sin\theta$ ($\theta$ = relative angle to the decision boundary); we justified omitting sin α because Fig. 2 shows that ID and OOD distributions of $\sin\alpha$ almost perfectly overlap, therefore, $\alpha$ carries no discriminative signal and can even impede the performance. This directly motivates why ORA outperforms fDBD while remaining simpler. We will add two clarifying sentences before Fig. 2 to make this link explicit.

We believe these additions address the reviewer’s concerns and will further clarify ORA’s design and empirical behavior.

Thank you for the constructive review. We respond to each point below.

1 Lack of theoretical justification

Appendix C already contains a proof that relative angles are invariant to any positive‑definite scaling of the feature space. In other words, if the feature extractor is perturbed by arbitrary class‑agnostic affine re‑weightings the ORA score is unchanged. We will make this proof more visible by briefly referencing it in Section 3 and adding an intuitive one‑sentence takeaway: “ORA is provably robust to all invertible diagonal scalings and global translations, two transformations that leave ID decision boundaries intact but can derail norm‑based scores.”

We acknowledge that Appendix C stops short of a formal risk bound on false positives; to our knowledge, no existing OOD detector that operates on fixed, pretrained features offers such a guarantee. Nonetheless, our analysis clarifies why ORA’s scale-invariant property is less susceptible to manipulation than norm-based scores, and we will highlight this perspective in the revised draft.

If the reviewer has a specific type of theoretical result in mind we are happy to explore it for future work.

2 Missing comparisons to NECO [T1], Mahalanobis++ [T2], and NCI [T3]

Table 1. FPR95 (↓) on ImageNet‑based OOD benchmark

We evaluated recent state-of-the-art methods NCI, Mahalanobis++, and NECO on the three backbones and OOD splits used in our main paper. Due to time constraints, results for the remaining backbones will be included in the final version. All detectors were evaluated on the four standard OOD datasets (iNaturalist, SUN, Places, Textures). Results show that ORA achieves the lowest average FPR95, outperforming NCI, Mahalanobis++ and NECO by a margin of 4.49% on average. ORA performs best on two out of three backbones (ResNet‑50 and Swin‑B), and is almost on par with Mahalanobis++ on DeiT‑B.

Minor comments

• Title. We will expand the acronym and rename the paper “Out‑of‑Distribution Detection with Relative Angles (ORA)” as suggested.
• Reference year. The missing year for Galil et al. will be added (2023).

We hope these revisions address the reviewer’s concerns and improve the clarity and completeness of the paper.

We sincerely thank the reviewer for the detailed and constructive feedback. Below we address each concern in turn.

1 Main‐text discussion of experimental findings

Reviewer comment (Weakness #1): “A discussion of the findings and takeaways from these experiments would improve the impact of this paper on future development of OOD detection methods.”

Response. In the camera‑ready version we will add a concise “Take‑aways” paragraph at the end of Section 4 that briefly summarizes what each block of experiments teaches us:

• 9 ImageNet models (Section 4.1). Angle‑based scores (RCOS, PCOS, ORA) and R‑Mahalanobis rank consistently among the top performers. Importantly, R‑Mah, RCOS, and PCOS require per‑class means, whereas ORA needs only the global in‑distribution mean, reducing memory/compute overhead.
• CLIP zero‑shot (Section 4.2). The structured latent space of CLIP favors decision‑boundary‑aware metrics (FDBD, ORA) and R‑Mah, again reflecting ORA’s ability to exploit well‑separated features. The same trend is observed with the ResNet‑SCL backbone, reinforcing that better‑structured latents amplify ORA’s gains. This also hints that contrastive models are “safer” for OOD alarms.
• Model ensembling (Section 4.3). Scale‑invariant angle scores make different models' scores comparable. An ORA ensemble outperforms every single backbone, suggesting that ensemble‑based OOD detection is a promising, under‑explored direction.

These clarifications will be inserted without expanding the page budget.

2 Near‑OOD performance

Reviewer comment (Weakness #2): “The performance of ORA on near‑OOD datasets (average 76.12 % AUROC) is on par with or slightly below state‑of‑the‑art … It would be helpful for the paper to comment on the near‑OOD performance in the main text.”

Response. We agree that near‑OOD detection deserves explicit discussion and will add a short subsection summarizing our findings:

• The quoted 76.12% refers to the ID accuracy column; the correct mean AUROC of ORA on SSB‑Hard + NINCO is 78.53 %, slightly above ASH’s 78.17 % (ResNet‑50).
• In near‑OOD regimes the ranking of methods fluctuates noticeably across backbones, making it hard to argue there is a state-of-the-art method. We view near‑OOD detection as a complementary task to far-OOD and will make this distinction explicit.

3 Future‑work discussion

Reviewer suggestion (Limitations): “A discussion on future works based on the experimental findings of this paper would improve the impact and reach of this paper.”

Response. During preliminary trials we experimented with several alternative “reference frames” for the angle computation: (a) centering w.r.t. each individual class mean and (b) centering only on the predicted class’s mean. Neither variant yielded consistent gains over our global‑mean formulation.

A natural next step is therefore to move from an either‑or choice to a weighted combination of per‑class angle scores. The weights could be set heuristically or learned from held‑out ID data, for example

• inversely proportional to the in‑distribution feature variance of each class, or
• proportional to the ID accuracy (or confidence) for that class.

Such a weighting scheme retains ORA’s hyper‑parameter‑free spirit when the weights are derived from readily available ID statistics, allowing the detector to adaptively emphasize the most reliable class anchors. We leave a systematic exploration of this idea to future work.

We hope these revisions address the reviewer’s concerns and clarify the contribution of ORA.