PaperlayerView exact revision on arXiv

Source-linked AI summary

ATOM: Robustifying Out-of-distribution Detection Using Outlier Mining

Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, Somesh Jha

arXiv:2006.15207v4cs.LGstat.ML

TL;DR

OOD detectors can be brittle under adversarial inputs, and most auxiliary outliers may not improve the learned decision boundary. ATOM addresses this by mining uncertain outliers for adversarial training, achieving state-of-the-art performance across clean and perturbed OOD tasks while providing theoretical support for the approach.

  • Problem

    Existing OOD detection methods can be brittle under adversarial perturbations, while randomly selected auxiliary outliers may fail to improve or may hurt the detector’s decision boundary.

  • Method

    ATOM adaptively selects auxiliary OOD examples on which the detector is uncertain and uses them in adversarial training to improve the decision boundary.

  • Results

    ATOM achieves state-of-the-art performance across a broad family of clean and adversarial OOD tasks, including a 53.9% false positive rate reduction versus ACET on CIFAR-10 L∞ OOD.

  • Takeaways & Limitations

    Mining informative auxiliary outliers improves robust OOD detection and can generalize to unseen adversarial attacks.

  • Takeaways & Limitations

    The theoretical analysis uses a Gaussian data model, although the authors state that it can be generalized to mixtures of Gaussians.

Abstract

from arXiv · show

Detecting out-of-distribution (OOD) inputs is critical for safely deploying deep learning models in an open-world setting. However, existing OOD detection solutions can be brittle in the open world, facing various types of adversarial OOD inputs. While methods leveraging auxiliary OOD data have emerged, our analysis on illuminative examples reveals a key insight that the majority of auxiliary OOD examples may not meaningfully improve or even hurt the decision boundary of the OOD detector, which is also observed in empirical results on real data. In this paper, we provide a theoretically motivated method, Adversarial Training with informative Outlier Mining (ATOM), which improves the robustness of OOD detection. We show that, by mining informative auxiliary OOD data, one can significantly improve OOD detection performance, and somewhat surprisingly, generalize to unseen adversarial attacks. ATOM achieves state-of-the-art performance under a broad family of classic and adversarial OOD evaluation tasks. For example, on the CIFAR-10 in-distribution dataset, ATOM reduces the FPR (at TPR 95%) by up to 57.99% under adversarial OOD inputs, surpassing the previous best baseline by a large margin.

1 Introduction

OOD detectors can be brittle under diverse adversarial inputs, while randomly selected auxiliary outliers may fail to improve the decision boundary. ATOM selectively mines informative outliers and achieves strong performance across clean and adversarial OOD tasks.

  • OOD detection is important for reliable open-world machine learning, but existing methods can be brittle under adversarial perturbations.
  • 99.94% FPR under adversarial attack, versus 3.66% on CIFAR-10, exposes the vulnerability of a competitive Outlier Exposure method.
  • ATOM selectively mines low-OOD-score auxiliary examples to estimate a tighter ID–OOD decision boundary and improve robustness, including against unseen attacks.
  • ATOM achieves state-of-the-art performance across clean and adversarial OOD evaluation tasks, including substantially better performance than random-outlier baselines.
  • On CIFAR-10 L∞ OOD, ATOM achieves a 53.9% false positive rate reduction compared with ACET.
  • The paper also provides theoretical analysis and a unified evaluation framework for robust OOD detection research.

2 Preliminaries

The framework distinguishes training in-distribution data from auxiliary outliers and unknown test-time OOD data. Robust evaluation considers clean and worst-case perturbed OOD inputs, with the auxiliary and test OOD distributions allowed to differ.

  • The training setting uses i.i.d. labeled data from P_X,Y together with auxiliary outlier data drawn from U_X.
  • The OOD detector outputs 1 for in-distribution inputs and −1 for clean or perturbed OOD inputs.
  • Evaluation tests in-distribution samples from P_X and worst-case perturbations in Ω(x) for test OOD samples from Q_X.
  • The test-time OOD distribution Q_X is unknown and may differ from auxiliary distribution U_X, creating a distribution gap for learning the decision boundary.
  • The paper distinguishes training OOD examples, called outliers, from test-time anomalous inputs, called OOD data.

3 Method

ATOM trains with adversarial examples while adaptively selecting auxiliary outliers on which the detector is uncertain. The method targets samples near the ID–OOD boundary, tightening that boundary for robust detection.

  • Method overview: ATOM denotes selecting informative outlier training samples from an auxiliary outlier pool through outlier mining.
  • Method overview: Randomly sampled easy outliers can produce a loose OOD decision boundary, whereas boundary-near outliers improve OOD detection.
  • Training objective: The training objective combines in-distribution data with outliers in a (K+1)-way classifier whose additional class represents OOD.
  • Training objective: ATOM uses PGD for the inner maximization and applies adversarial training to half of each minibatch while keeping the other half clean.
  • Informative outlier mining: During each epoch, the method samples N auxiliary outliers, scores them, sorts them, and selects n < N examples beginning at rank qN.
  • Informative outlier mining: A larger q selects less informative examples, and mining is performed on non-adversarial auxiliary data before robust training.

4 Experiments

ATOM is evaluated on clean, corruption-attacked, L∞-attacked, and compositionally attacked OOD inputs using CIFAR-10 and CIFAR-100 settings. It generally matches or exceeds strong baselines, with especially large gains on adversarial tasks.

  • ATOM vs. existing methods: ATOM achieves comparable or often better performance than current state-of-the-art methods on clean OOD data.
  • ATOM vs. existing methods: 53.9% FPR improvement over ACET is reported on CIFAR-10 for the L∞ OOD task.
  • ATOM vs. existing methods: 30.99% FPR improvement over the best baseline is reported on CIFAR-10 for corruption-attacked OOD inputs.
  • ATOM vs. existing methods: 57.99% FPR reduction is reported on CIFAR-10 for the hardest compositional OOD task.The method was not trained explicitly on corrupted OOD inputs.
  • Experimental setup: The evaluation covers natural, corruption-attacked, L∞-attacked, and compositionally attacked OOD inputs, using FPR and AUROC metrics.Results are averaged over six OOD test datasets and use DenseNet unless otherwise stated.
  • Ablations: Adversarial training and outlier mining are both important for strong robust OOD performance.NTOM is comparable on natural and corruption OOD but less robust on L∞ and compositional OOD inputs; training on overly easy outliers worsens performance.

5 Theoretical Analysis

The theoretical analysis studies how informative auxiliary outliers and mining affect robust OOD detection under simplified distributional assumptions. It shows that mining can reduce data requirements and remain effective when auxiliary data is mostly uninformative or harmful.

  • Results overview: Informative auxiliary OOD data can reduce the amount of in-distribution data needed to learn a robust detector.The analysis states that informative auxiliary data reduces sample complexity.
  • Setup: The formal model uses Gaussian in-distribution data, broad test OOD distributions, and bounded ℓ∞ adversarial perturbations.The detector family is parameterized by a center and radius, with margin and OOD-mass assumptions.
  • Scope: The analysis uses a simpler Gaussian model than practical data, although it states that the analysis can generalize to Gaussian mixtures.
  • Informative outlier mining: When auxiliary data includes many easy or harmful outliers, ordinary learning cannot reliably distinguish good and bad detectors.Easy outliers do not differentiate detectors, while some in-distribution-like auxiliary points can penalize good detectors and favor bad ones.
  • Informative outlier mining: Outlier mining selects auxiliary examples with mild confidence scores relative to an intermediate solution before optimizing the final detector.The final solution is obtained by applying the margin-based optimization only to the selected subset.
  • Guarantees: With sufficient auxiliary data, the mined procedure learns a good detector with fewer in-distribution samples even amid many uninformative or harmful outliers.For γ = Θ(d^1/8), the stated requirement is n = Õ(d), compared with Õ(d^3/4) without auxiliary data.

6 Related Work

Related OOD detection work includes confidence-based detectors, uncertainty estimation, distance- and energy-based scores, and auxiliary-data regularization. These approaches motivate ATOM’s focus on robustly using auxiliary outliers.

  • OOD detection methods: Early OOD detectors used maximum softmax probability from pretrained networks, followed by ensemble, calibrated-softmax, Mahalanobis, and energy-based scores.
  • Auxiliary OOD data: Other methods regularize models with realistic or GAN-generated anomalous data to reduce confidence on anomalous examples.

7 Conclusion

The conclusion presents ATOM as a robust OOD detection method that adaptively selects uncertain auxiliary examples, combines empirical evaluation with theory, and supports broader robustness evaluation.

  • Conclusion: ATOM enhances OOD detector robustness by adaptively selecting training examples about which the detector is uncertain.
  • Conclusion: Experiments report state-of-the-art performance across broad clean and perturbed OOD evaluation tasks.
  • Conclusion: Theoretical analysis provides justification for the benefits of outlier mining.
  • Conclusion: The unified evaluation framework is intended to support future study of OOD detector robustness.

Supplementary Material

The supplementary analysis formalizes robust OOD detection under perturbed OOD inputs and studies when auxiliary data can support learning a reliable detector.

  • The theoretical setting evaluates false negative rate on in-distribution data and worst-case false positive rate over perturbed OOD inputs.
  • A robust detector exists in the model, but learning one from in-distribution data alone requires sufficiently many samples.
  • The detector is parameterized by an estimated center and radius derived from in-distribution observations.
  • Concentration arguments establish that the estimated parameters yield a good detector when the in-distribution sample size is sufficiently large.

A.2 Learning With Informative Auxiliary OOD Data

The theory models informative auxiliary OOD data near the ID–OOD boundary and shows that mining such data can preserve guarantees despite uninformative or harmful auxiliary samples.

  • Informative auxiliary OOD data: Informative auxiliary OOD data are modeled near the boundary between in-distribution and outlier distributions.The ideal auxiliary distribution surrounds the in-distribution boundary with density controlled by η.
  • Informative outlier mining: Outlier mining selects auxiliary points with mild confidence scores, retaining boundary-near examples while filtering easy or mixed data.The practical mixture includes informative outliers, uninformative outliers, and in-distribution samples.
  • Informative outlier mining: The mined solution estimates the in-distribution center within distance σγ/4, which supports the theorem’s detector guarantees.
  • Sample complexity: Auxiliary data can reduce the required in-distribution sample size by a factor of γ^2.
  • Sample complexity: When γ = Θ(d^1/8), the required sample size is O(d^1/2 log(1/α)) with auxiliary data versus O(d^3/4 log(1/α)) without it.
  • Ideal auxiliary distribution: For uniform auxiliary data, averaging the mined points provides essentially the same guarantees with fewer auxiliary samples.

B.1 Experimental Settings

The experiments use image benchmarks, auxiliary OOD datasets, multiple detector baselines, and clean, corruption, norm-bounded, and compositional OOD attacks.

  • Datasets: Experiments use SVHN, CIFAR-10, and CIFAR-100 as in-distribution datasets, with TinyImages and ImageNet-RC as auxiliary OOD sources.
  • Datasets: OOD evaluation uses natural image datasets including SVHN, Textures, Places365, LSUN, and iSUN, with 32 × 32 evaluation images.
  • Baselines: The comparison includes standard confidence, distance-based, self-supervised, adversarial-training, and outlier-exposure methods.
  • Attacks: The evaluation covers natural OOD, corruption-attacked OOD, L∞-attacked OOD, and compositionally attacked OOD inputs.
  • Attacks: The default PGD attacks use ε = 8/255, 40 iterations, step size 1/255, and random starts.
  • Mining behavior: Without informative mining, OOD-score distributions become dominated by easy examples, so further training no longer improves the detector boundary.

B.9 Choose Best q Using Validation Dataset

Validation selects q for each in-distribution dataset, while CIFAR-10 training illustrates how OOD scores concentrate on easy auxiliary examples without mining.

  • Validation: The validation OOD set contains 10,000 TinyImages samples disjoint from training data, and q is selected by average FPR at 5% FNR across four OOD input types.
  • Validation: The selected q values are 0 for SVHN, 0.125 for CIFAR-10, and 0.5 for CIFAR-100.
  • CIFAR-10 analysis: On CIFAR-10, the no-mining experiment samples 400,000 auxiliary points at epoch 30 during 100-epoch DenseNet training.
  • CIFAR-10 analysis: The OOD-score distribution becomes dominated by easy examples, leaving the hardest mined examples as the informative training cases.
  • Evaluation: ATOM is evaluated against competitive methods across natural, corruption-attacked, L∞-attacked, and compositionally attacked OOD inputs.

B.11 Effect of Auxiliary OOD Datasets

Experiments examine ATOM across auxiliary OOD datasets, architectures, attack strengths, and evaluation settings. The reported results indicate that the selected auxiliary-data and training configuration remains effective across these variations while improving robustness and preserving in-distribution accuracy.

  • Auxiliary OOD datasets: For all three in-distribution datasets, q=0 produces the optimal performance when using the alternative auxiliary OOD dataset.The alternative dataset is evaluated with the same hyperparameters used for TinyImages auxiliary data.
  • Architecture robustness: The same hyperparameters selected for DenseNet also yield good results for ATOM with WideResNet.This comparison is reported in the WideResNet experiment against competitive OOD detection methods.
  • Auxiliary OOD datasets: Using ImageNet-RC as the auxiliary OOD dataset, the experiments compare ATOM with competitive methods across natural and three attacked OOD settings.The evaluation uses DenseNet and reports percentages for natural, corruption-attacked, L∞-attacked, and compositionally attacked OOD inputs.
  • Adversarial robustness: Under stronger PGD attacks with 100 iterations and five random restarts, ATOM outperforms ACET on L∞-attacked and compositionally attacked OOD inputs.The evaluation uses DenseNet and averages percentages over six OOD test datasets.
  • In-distribution performance: ATOM improves OOD detection performance while achieving in-distribution classification accuracy on par with a pre-trained network.The in-distribution evaluation reports FNR, prediction accuracy, and end-to-end prediction accuracy at a threshold classifying 95% of in-distribution data as in-distribution.
  • Evaluation coverage: Natural OOD performance is reported separately for SVHN, CIFAR-10, and CIFAR-100, alongside evaluations covering four OOD input types.The corresponding comparisons use DenseNet and include natural, corruption-attacked, L∞-attacked, and compositionally attacked inputs.
Loading 2006.15207v4…