PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Anomaly Detection with Outlier Exposure

Dan Hendrycks, Mantas Mazeika, Thomas Dietterich

arXiv:1812.04606v3cs.LGcs.CLcs.CVstat.ML

TL;DR

Deploying deep models safely requires detecting inputs that differ from training data, but such anomalies can receive high-confidence predictions. The paper proposes Outlier Exposure, training detectors with auxiliary outlier data, and reports improved OOD detection across vision and language tasks, with gains in calibration and applicability.

  • Problem

    Distribution mismatch makes it difficult for deep learning systems to distinguish anomalous inputs from in-distribution examples, while anomalous inputs may receive high-confidence predictions.

  • Method

    Outlier Exposure trains anomaly detectors against diverse auxiliary outlier datasets to learn heuristics for detecting unmodeled inputs.

  • Results

    Outlier Exposure significantly improves OOD detection across natural language processing and small- and large-scale vision tasks, including unseen anomaly distributions.

  • Takeaways & Limitations

    Outlier Exposure is a broadly applicable, computationally inexpensive complement that can improve OOD detection, calibration, and density estimates.

  • Takeaways & Limitations

    GAN-based comparisons exclude Tiny ImageNet, Places365, and text because DCGANs cannot stably generate those images or text reliably.

Abstract

from arXiv · show

It is important to detect anomalous inputs when deploying machine learning systems. The use of larger and more complex inputs in deep learning magnifies the difficulty of distinguishing between anomalous and in-distribution examples. At the same time, diverse image and text data are available in enormous quantities. We propose leveraging these data to improve deep anomaly detection by training anomaly detectors against an auxiliary dataset of outliers, an approach we call Outlier Exposure (OE). This enables anomaly detectors to generalize and detect unseen anomalies. In extensive experiments on natural language processing and small- and large-scale vision tasks, we find that Outlier Exposure significantly improves detection performance. We also observe that cutting-edge generative models trained on CIFAR-10 may assign higher likelihoods to SVHN images than to CIFAR-10 images; we use OE to mitigate this issue. We also analyze the flexibility and robustness of Outlier Exposure, and identify characteristics of the auxiliary dataset that improve performance.

1 INTRODUCTION

Deep models can perform well when test data resembles training data, but distribution mismatch can produce confident predictions on anomalies. Outlier Exposure addresses this challenge by training detectors with diverse auxiliary outlier data and improves detection across vision and language settings.

  • Motivation: Distribution mismatch can make deep classifiers assign high confidence to anomalous test examples, undermining prediction probabilities as calibrated confidence estimates.This makes anomaly detection important for safely handling unfamiliar inputs.
  • Contribution: Outlier Exposure trains models on out-of-distribution examples to learn cues for unmodeled inputs and a more conservative concept of inliers.The method uses diverse, realistic auxiliary datasets and complements existing OOD detectors.
  • Evidence: Outlier Exposure helps anomaly detectors generalize to unseen outlier distributions, including large-scale image settings.The experiments cover computer vision and natural language processing tasks.
  • Evidence: Outlier Exposure improves existing OOD approaches, supports varied model and outlier-distribution choices, and enhances density-estimation usefulness and classifier calibration.These findings span multiple detection and modeling settings.

2 RELATED WORK

Prior work uses classifier confidence, auxiliary branches, GAN-generated samples, and auxiliary datasets to improve out-of-distribution detection. Unlike methods tuned to specific anomaly distributions, this work trains without such test-distribution tuning.

  • Pre-trained classifiers can use lower maximum softmax probabilities on anomalous examples as an out-of-distribution detection signal.
  • Auxiliary approaches add a branch to a pre-trained classifier or train classifiers to assign lower confidence to GAN samples.
  • Auxiliary datasets have been used for adversarial robustness and unsupervised representation learning from web images or Amazon reviews.

3 OUTLIER EXPOSURE

Outlier Exposure trains an OOD detector using an auxiliary dataset disjoint from test-time data, then relies on learned signals and heuristics that generalize to unseen anomaly distributions. Its loss is task-dependent and can support both labeled and unlabeled settings.

  • Outlier Exposure uses an auxiliary dataset disjoint from test-time data to teach better representations for anomaly detection.
  • The model learns signals and heuristics for distinguishing samples from Din and the OE dataset DOE_out, and these heuristics generalize to unseen Dout distributions.
  • OE augments an original learning objective with an exposure objective LOE over the parameters of the detector.
  • The formulation of LOE depends on the task and detector, including uniform-distribution cross-entropy for maximum softmax probability detection and margin ranking for density estimation.

4 EXPERIMENTS

The experiments evaluate Outlier Exposure across image, text, confidence-branch, and density-estimation settings using disjoint auxiliary outlier datasets. Across these settings, OE improves detection and generalizes to unseen anomaly distributions without tuning to each test distribution.

  • Evaluation setup: Each evaluation combines an in-distribution dataset, an auxiliary outlier dataset, and a baseline detector to assess OOD detection.The study reports AUROC, AUPR, and FPRN, with lower FPRN indicating fewer false alarms at a strict threshold.
  • Multiclass classification: OE improves detectors on unseen text and image anomalies without access to the test distribution during training or tuning.The experiments also report gains over existing OOD detection approaches and evaluate OE across multiple tasks and model types.
  • Datasets: OE uses disjoint real datasets matched to each task, including 80 Million Tiny Images, ImageNet-22K, and WikiText-2.The auxiliary sources are used for vision and language tasks without overlapping the corresponding in-distribution datasets.
  • Multiclass classification: For multiclass classifiers, OE fine-tunes the posterior toward a uniform distribution on auxiliary outliers, while its loss formulation varies with the detector and task.For the MSP detector, the OE loss uses cross-entropy between the model posterior and the uniform distribution; density estimation instead uses a margin-ranking loss on log probabilities.
  • Synthetic outliers: Using real and diverse outliers outperforms synthetic outliers, while noisy synthetic examples can be memorized without improving detection of new OOD examples.The comparison reports large gains from OE with a real and diverse dataset over GAN-generated samples.
  • Density estimation: PixelCNN++ without OE assigns lower BPP to SVHN than CIFAR-10, but OE significantly improves results across all tested outlier datasets.BPP is defined as negative log-likelihood divided by the number of pixels and serves as the density estimator’s OOD score.
  • Density estimation: In language-model experiments, OE improves every reported result, with especially large gains for the word-level model.The models are trained on Penn Treebank and fine-tuned with OE on WikiText-2.

5 DISCUSSION

Outlier Exposure is flexible across classification regimes and auxiliary datasets, but its effectiveness depends on the realism, diversity, and preprocessing of exposed outliers. The method can improve generalization, calibration, and detection of unseen anomalies, while some choices offer limited gains or trade-offs.

  • Extensions to Multilabel Classifiers and the Reject Option: 97.1% mean AUROC follows 88.8% for a CIFAR-10 multilabel classifier after training with OE.The authors report that OE improves multilabel OOD detection, although multiclass outputs remain more competitive.
  • Flexibility in Choosing DOE: Realistic, diverse outlier datasets generalized to unseen test distributions, unlike Gaussian-noise or synthetic anomalies for complex in-distribution data.The discussion identifies realism and diversity, alongside dataset size and closeness, as important characteristics of DOE.
  • Flexibility in Choosing DOE: 85.3% average AUPR was reached with 50 CIFAR-100 outlier classes, after which additional classes barely improved performance.Increasing exposure from 10 to 30 classes raised average AUPR from 78.5% to 85.1%, suggesting diversity matters more than size alone.
  • Flexibility in Choosing DOE: 50,000 examples from 80 Million Tiny Images caused negligible degradation in detection performance.Experiments often used around 1% of the dataset because models were only briefly fine-tuned.
  • Flexibility in Choosing DOE: 90.1% average AUROC resulted from Project Gutenberg outliers versus 89.3% with WikiText-2 in SST experiments.The similar performance supports flexibility in choosing auxiliary datasets with different statistics.
  • Flexibility in Choosing DOE: OE improved MNIST AUPR from 94.2% to 97.0% using 80 Million Tiny Images as the auxiliary dataset.The authors also observed improved SVHN detection using natural-scene outliers despite differences between the exposed and test anomalies.
  • Flexibility in Choosing DOE: Preprocessing outliers to be closer to in-distribution data significantly improved NLP OOD detection, whereas hard-example mining improved only the hardest anomalies.Without preprocessing, easy-to-learn cues can produce unintended OE objectives; hard-example mining slightly reduced detection of noise-like anomalies.
  • OE Improves Calibration: OE improved calibration when test-time data included both in-distribution and OOD examples, encouraging low-confidence predictions for classless OOD inputs.The authors extended temperature-tuning calibration to this mixed setting and summarized results in Figure 3.

6 CONCLUSION

The paper concludes that Outlier Exposure is a broadly applicable, complementary technique for improving out-of-distribution detection. It supports detection across vision and language settings while also improving calibration and density-based detection with low computational overhead.

  • 6 CONCLUSION: Outlier Exposure enhances many current OOD detectors across diverse settings by teaching heuristics for detecting new, unmodeled examples.The authors report broad applicability in vision and natural language, including large-scale image tasks.
  • 6 CONCLUSION: OE improves model calibration, several anomaly-detection techniques, and the usefulness of density estimates for OOD detection.The conclusion presents these as additional benefits beyond the core detection improvements.
  • 6 CONCLUSION: Outlier Exposure is computationally inexpensive and can be applied to existing systems with low overhead.

A EXPANDED MULTICLASS RESULTS

The expanded multiclass evaluation compares OOD detectors across numerous artificial and real anomalous distributions in vision and language. The benchmark uses substantially more test distributions than most previous work and includes diverse corruption-based and dataset-based anomalies.

  • Expanded Results: Vision tables report MSP baseline and OE-fine-tuned MSP detection results as percentages averaged over 10 runs.Values are rounded, and the expanded results appear in Tables 7 and 8.
  • Expanded Results: NLP tables report MSP baseline and OE-fine-tuned MSP detection results as percentages averaged over 10 runs.The table covers NLP OOD example detection and rounds reported percentages.
  • Anomalous Data: Approximately twice as many test distributions are compared for each learned in-distribution dataset as in most previous works.The evaluation includes both artificial and real anomalous distributions.
  • Anomalous Data: CIFAR-10 and CIFAR-100 are used reciprocally as OOD datasets because their classes do not overlap.The evaluation also includes Chars74K, Places69, and multiple NLP datasets as auxiliary or anomalous sources.
  • Anomalous Data: Artificial anomalies include uniform noise, Gaussian, Rademacher, Bernoulli, blobs, pixelwise means, geometric means, and jigsaw permutations.These validation and test sources are generated from distributions or by corrupting in-distribution images.

B ARCHITECTURES AND TRAINING DETAILS

The experiments use Wide Residual Networks for most vision tasks and two-layer GRUs for NLP, with brief OE fine-tuning from pretrained or initially trained models. Auxiliary datasets differ by modality.

  • Architectures and Training Details: Vision models use 40-2 Wide Residual Networks trained for 100 epochs with dropout rate 0.3 and cosine learning-rate schedules.The vision setup uses standard flipping and cropping augmentation; Places365 instead uses a pretrained ResNet-18.

C TRAINING FROM SCRATCH WITH OUTLIER EXPOSURE USUALLY IMPROVES DETECTION PERFORMANCE

Training a network from scratch while simultaneously exposing it to outliers tends to outperform normal training and fine-tuning with OE on the reported CIFAR-10 Wide ResNet example.

  • 5.16% classification error and 34.94% FPR95 are obtained by a normally trained CIFAR-10 Wide ResNet.
  • 5.27% classification error and 9.50% FPR95 are obtained when this network is fine-tuned with OE.
  • Training from scratch while simultaneously exposing the network to outliers tends to give superior results.

D OE WORKS ON OTHER VISION ARCHITECTURES

Outlier Exposure improves vision OOD detection across multiple architectures and scoring methods, including All Convolutional Networks and entropy-based scores.

  • Outlier Exposure improves vision OOD detection for All Convolutional Networks, not only Wide ResNets.Table 9 reports results for All Convolutional Network architectures.
  • OE models can outperform MSP by using H(U; f(x)), which accounts for probability mass across all classes and trains anomalous examples toward a uniform posterior.The improvement is most pronounced on datasets with many classes.
  • 97.1% AUROC is obtained with H(U; f(x)) versus 76.5% with MSP when Dtest_out is Gaussian.This comparison is reported for a network trained with OE.

F EXPANDED LANGUAGE MODELING RESULTS

The paper reports expanded language-modeling OOD results using Penn Treebank examples and English Web Treebank outliers, while also describing calibration metrics and scope constraints.

  • OOD detection results for language modeling are reported on Penn Treebank examples and English Web Treebank outliers.The English Web Treebank contains text from five domains: Yahoo! Answers, emails, newsgroups, product reviews, and weblogs.
  • Outlier datasets that violate the language-modeling assumption of continuity are excluded from evaluation.The paper explicitly limits evaluation to outlier datasets satisfying that assumption.
  • Outlier Exposure is used to control confidence on out-of-distribution samples, and the calibration results are reported in Table 12.The setup compares temperature-tuned classifiers with and without OE.
  • The calibration evaluation presents RMS Calibration Error, MAD Calibration Error, and Soft F1 Score.RMS and MAD compare confidence with accuracy, while Soft F1 addresses severe imbalance between mistakes and correct decisions.

G.2 SETUP AND RESULTS

The calibration setup compares confidence estimators and temperature tuning with OE across in-distribution and OOD datasets, including Tiny ImageNet-based visual evaluations.

  • Setup: Confidence is estimated from a logistic branch, transformed logits, or maximum logits, with a modified maximum-logit estimate used as the baseline.The discussed confidence estimates map model outputs into [0, 1].
  • Setup: Softmax temperature tuning fits T on a validation set after network training to maximize log likelihood.The tuned softmax is the calibration baseline.
  • Results: The calibration experiment fine-tunes classifiers with OE and evaluates confidence on equally sized in-distribution and OOD samples.The evaluated classifiers include SVHN, CIFAR-10, CIFAR-100, and Tiny ImageNet.
  • Results: Outlier Exposure noticeably improves model calibration over the temperature-tuned baseline.The comparison is reported in Table 12, with additional posterior-rescaling results in Table 13.
  • Results: Posterior Rescaling addresses the 1/k lower bound of temperature-tuned softmax confidence for out-of-distribution examples.The affine transformation maps confidence values from [1/k, 1] to a range beginning at zero.
  • Results: Figure 4 provides PR and ROC curves for Tiny ImageNet against Textures, Places365, LSUN, and ImageNet anomalies.The plotted curves compare the MSP baseline detector with the MSP detector using OE.
Loading 1812.04606v3…