PaperlayerView exact revision on arXiv

Source-linked AI summary

In or Out? Fixing ImageNet Out-of-Distribution Detection Evaluation

Julian Bitterwolf, Maximilian Müller, Matthias Hein

arXiv:2306.00826v1cs.LGcs.CV

TL;DR

ImageNet-1K OOD evaluations often use datasets containing ID objects, undermining fair assessment of detectors. The paper characterizes this contamination, introduces the checked ID-free NINCO benchmark and synthetic unit-tests, and evaluates detectors across models and training schemes. It finds that contamination distorts conclusions, many detectors struggle with unit-tests, and pretraining type strongly affects performance.

  • Problem

    ImageNet-1K OOD benchmarks often contain ID classes or objects despite the requirement that OOD images contain no ID classes, compromising evaluation fairness.

  • Method

    The paper introduces NINCO, an individually checked ID-free dataset with 5 879 images in 64 OOD classes, alongside synthetic OOD unit-tests and broad detector evaluations.

  • Results

    ID contamination underestimates OOD performance and unjustly punishes stronger detectors; across evaluations, consistent improvement over MSP is difficult and pretraining type strongly affects results.

  • Takeaways & Limitations

    ID-free, fine-grained benchmarks and unit-tests support more precise analysis of detector strengths, weaknesses, and failure modes.

  • Takeaways & Limitations

    Aggregated performance numbers cannot capture all OOD behavior because they may hide outlier FPR values and application-specific error costs.

Abstract

from arXiv · show

Out-of-distribution (OOD) detection is the problem of identifying inputs which are unrelated to the in-distribution task. The OOD detection performance when the in-distribution (ID) is ImageNet-1K is commonly being tested on a small range of test OOD datasets. We find that most of the currently used test OOD datasets, including datasets from the open set recognition (OSR) literature, have severe issues: In some cases more than 50$\%$ of the dataset contains objects belonging to one of the ID classes. These erroneous samples heavily distort the evaluation of OOD detectors. As a solution, we introduce with NINCO a novel test OOD dataset, each sample checked to be ID free, which with its fine-grained range of OOD classes allows for a detailed analysis of an OOD detector's strengths and failure modes, particularly when paired with a number of synthetic "OOD unit-tests". We provide detailed evaluations across a large set of architectures and OOD detection methods on NINCO and the unit-tests, revealing new insights about model weaknesses and the effects of pretraining on OOD detection performance. We provide code and data at https://github.com/j-cb/NINCO.

1. Introduction

OOD detection aims to reject inputs unrelated to the trained task, but ImageNet-1K evaluations often include ID objects in supposedly OOD images. These contaminations distort conclusions, motivating the ID-free NINCO dataset and synthetic unit-tests.

  • Motivation: OOD detectors should reject unrelated inputs while allowing in-distribution inputs to pass.Rejection may involve human intervention, steering to a safe state, or abstention.
  • Problem: Most ImageNet-1K OOD test datasets violate the assumption that OOD images contain no ID class, including datasets used in open set recognition.The paper distinguishes categorical and incidental ID contamination.
  • Consequences: ID contamination underestimates true OOD detection performance and unjustly punishes stronger detectors.A stronger model may confidently recognize an incidental ID object, producing a false positive during OOD evaluation.
  • Contribution: NINCO provides 5 879 individually checked ID-free images across 64 fine-grained OOD classes for analyzing detector strengths and failure modes.The dataset is designed for ImageNet-1K evaluation.
  • Contribution: Synthetic OOD unit-tests complement natural images by targeting specific detector weaknesses, yet many detectors struggle with supposedly easy tests.Methods that work well on natural test data are particularly affected.
  • Evaluation: Across eleven methods, architectures, and training schemes, consistent improvement over the MSP baseline is difficult, while pretraining type strongly affects performance.The evaluation confirms that larger-dataset pretraining generally helps, especially for feature-based methods.

2. Existing test OOD datasets for ImageNet-1K

Common ImageNet-1K OOD and open-set benchmarks contain substantial ID contamination from semantic overlap and incidental objects. Cleaning these samples can substantially improve measured detector performance and change model comparisons.

  • Dataset contamination: Common OOD benchmarks are assembled from datasets whose labels or images can overlap with ImageNet-1K classes.Examples include semantic overlap in PLACES, SPECIES, and OSR datasets, plus incidental objects in otherwise innocuous categories.
  • Model comparison: A stronger ViT can be penalized when it recognizes incidental ID objects, while a weaker ResNet-50 may be rewarded for failing to recognize them.For both models, the 95%TPR threshold is at a MSP of 38%.
  • Prevalence: More than 50% of samples in both PLACES and SPECIES are actually ID, whereas INATURALIST OOD PLANTS and OPENIMAGE-O contain 2.5% and 4.9% ID samples.The estimates come from visual inspection of 400 random samples per dataset, excluding unclear cases.
  • Evaluation impact: Figure 3 compares FPR at 95% TPR for MSP and Mahalanobis detectors on full versus cleaned OOD subsets using a ViT.The comparison isolates the effect of removing images containing ID objects.
  • Evaluation impact: Removing ID-contaminated images substantially improves both detectors, reducing FPR by more than 50% in some cases.A strong current detector’s SPECIES false positives contain ID objects in more than 85% of cases.

3. A new OOD test set for ImageNet-1K

The paper argues that existing ImageNet-1K OOD datasets often contain ID objects, compromising evaluation, and introduces NINCO as a manually checked, class-organized alternative. It also proposes evaluating detectors with synthetic unit-tests and distributions of per-class results rather than relying only on aggregate performance.

  • Dataset construction and contamination: ImageNet-1K OOD images must contain no objects from any ID class, but existing datasets often violate this through categorical or incidental contamination.The authors use WordNet glosses and dictionary definitions to apply a non-permissive interpretation of ImageNet class membership.
  • Dataset construction and contamination: NINCO contains 5 879 manually checked images organized into 64 OOD classes designed to be challenging, diverse, and ID-free.Its base classes come from multiple existing datasets and newly scraped sources, including SPECIES, PLACES, FOOD-101, CALTECH-101, MYNURSINGHOME, and ImageNet-21K.
  • Unit-tests and evaluation: Synthetic OOD unit-tests complement natural-image classes by exposing detector weaknesses that can be hidden by variable difficulty across datasets.The paper includes 17 pre-existing and newly proposed unit-tests, with pass-fail statistics preferred for these tests.
  • Unit-tests and evaluation: An OOD detector assigns higher scores to ID than OOD inputs, and evaluation reports the false-positive rate at a 95% true-positive rate.Maximum Softmax Probability is used as the standard baseline, while the paper also evaluates a range of other methods and architectures.
  • Unit-tests and evaluation: Mean FPR summarizes performance across NINCO’s 64 classes, but the paper recommends also reporting the full distribution and individual class results because aggregate scores can hide important failures.This is especially relevant when test-time OOD inputs cannot be modeled by a fixed probability distribution.
  • Empirical findings: Feature-based methods generally outperform MSP, yet detector performance varies sharply by OOD class and pretraining benefits depend strongly on the training data and method.ViT+Maha and ConvNext+Maha both struggle on some classes, while traditional IN-21K pretraining outperforms several alternative ViT training variants with RMaha.

4. Evaluation results for OOD Detectors

Evaluation on NINCO shows that detector performance depends strongly on both the method and classifier pretraining, with feature-based approaches often improving over MSP but exhibiting substantial model- and class-specific weaknesses.

  • OOD detection methods: Most feature-based methods outperform the MSP baseline, while MaxLogit and Energy also improve strongly; KNN performs much worse.Maha, RMaha, and ViM improve over MSP across FPR ranges, whereas MaxLogit’s gains mainly occur on easier OOD classes.
  • OOD detection methods: RMaha and relative or standard cosine similarity fairly consistently improve over MSP across models, whereas Maha is strongest with a pretrained ViT but less reliable with other models.The best-performing method generally accesses pre-logit features, except for the noisy-student model.
  • Pretraining: IN-21K pretraining improves feature-based OOD detection on NINCO beyond gains attributable to higher classification accuracy.Pretraining helps through both improved ID accuracy and feature embeddings that benefit feature-based detectors.
  • Pretraining: Higher accuracy from CLIP-pretraining or JFT does not necessarily yield better OOD detection than IN-21K pretraining.The precise pretraining data and training method strongly affect whether the resulting feature space benefits OOD detection.
  • Failure cases: OOD detection varies widely across NINCO classes: ViT and ConvNext both struggle on some classes, but each can detect classes the other misses.The ViT reaches 98% FPR on Galápagos fur seal and 91% on cat-faced spider, while ConvNext rarely improves where ViT has large FPR but succeeds on some other classes.
  • OOD unit-tests: Many detector-model combinations fail OOD unit-tests, including feature-based ViM, Maha, and RMaha, despite their strong natural-OOD results.Black, white, and grey inputs expose vulnerabilities that may matter in applications involving camera malfunction or occlusion.
  • OOD unit-tests: Cos and MCM/RCos fail multiple unit-tests for only 7/26 models and perform strongly across models with and without CLIP-pretraining.Unit-test robustness still needs to be examined for each detector individually.

5. Conclusions

The paper introduces NINCO, an ID-contamination-free and challenging OOD dataset for ImageNet-1K, and uses it with cleaned benchmarks and unit-tests to expose detector strengths and weaknesses. The results show that detector reliability depends on the classifier model and method combination, motivating more precise evaluation and development.

  • Conclusions: NINCO provides fine-grained, ID-contamination-free OOD evaluation for ImageNet-1K.The dataset is designed to support more precise development of reliable OOD detectors.
  • Conclusions: Many OOD detectors perform better than previously thought when evaluations exclude ID contaminations.Conversely, many detector-method combinations still fail synthetic OOD unit-tests and cannot be applied reliably with arbitrary classifier models.

A. Detailed results on NINCO

NINCO changes the observed ranking of OOD detectors and models relative to previously used contaminated datasets. Across metrics, results show that detector performance depends strongly on the model and pretraining scheme rather than one universally best method.

  • NINCO benchmark results: Mahalanobis paired with the two ViTs pretrained only on IN-21K outperforms other model–method combinations by a clear margin on NINCO.MSP performance does not explain this advantage, suggesting a favourable feature-space structure.
  • Pretraining overlap: NINCO classes were checked for overlap with the 21,843 IN-21K classes to assess whether pretraining classes were truly unseen.The authors use an IN-21K ViT classifier for this overlap check.
  • NINCO benchmark results: On NINCO, the best method for a pretrained ViT changes from ViM on prior datasets to Mahalanobis, while Relative Mahalanobis rises from sixth to second.The comparison uses mean FPR rankings across the evaluated datasets.
  • NINCO benchmark results: The clip-pretrained ViTs are strongest with MSP on previously used datasets but are outperformed by ConvNext-B on NINCO.This is another ranking reversal between contaminated datasets and the cleaned benchmark.
  • Evaluation metrics: Table 3 reports mean FPR across NINCO OOD classes, with lower values better and differences from MSP marked by colour.Tables 4–6 report mean AUROC, AUPR-S, and AUPR-E using the same comparison structure.

B. Models

The evaluation uses publicly available model implementations and weights, with specified repository versions and separate sources for BiT-s and zero-shot CLIP models.

  • Model sources: Most evaluated models and weights come from the publicly available timm repository, while BiT-s and zero-shot CLIP use their respective GitHub sources.The evaluated-model overview is provided in Table 8.
  • Implementation versions: The experiments use timm version 0.8.0dev0 for CLIP-finetuned and unpretrained ViTs, and version 0.6.12 for the other models.The passage distinguishes model groups by implementation version.

C. Methods

The paper evaluates logit-based and feature-based OOD scores, including distance, similarity, nearest-neighbour, feature-truncation, and virtual-logit methods. Feature-based methods operate directly on embeddings, whereas logit-based methods derive scores from classifier outputs.

  • General setup: A network is decomposed into a feature extractor h and final layer g, producing logits o that softmax converts into probabilities p.OOD methods return a scalar score s, with larger values intended for ID data and smaller values for OOD data.
  • Logit-based methods: MSP, Max-Logit, Energy, and KL-Matching derive OOD scores from classifier probabilities or logits.KL-Matching compares a test probability vector with class-wise mean probability vectors.
  • Feature-space methods: KNN normalizes features, computes distances to all normalized training features, and uses the Kth-smallest distance as a negative OOD score.The evaluation sets K = 1000.
  • Distance-based methods: Mahalanobis distance fits class-conditional Gaussians with shared covariance and scores a test feature by its distance to the closest class mean.Relative Mahalanobis additionally fits a global Gaussian and subtracts its distance from the original score.
  • Feature transformation: ReAct truncates feature activations element-wise before converting them into rectified logits and applying rectified Energy.The threshold is chosen so that 1% of training activations are truncated.
  • Virtual-logit methods: ViM models ID features in a principal subspace, treats the orthogonal residual as OOD evidence, and appends a scaled virtual logit to the original logits.The resulting softmax probability of the virtual logit is the final OOD score.
  • Similarity-based methods: Cosine and MCM/RCos compare test features with class or concept embeddings, with MCM/RCos additionally applying softmax scaling to cosine similarities.For conventional classifiers, class-wise training means serve as concept vectors.

D. Definitions of OOD detection metrics

The paper evaluates OOD detectors using thresholded acceptance decisions and reports the false positive rate at a fixed true positive rate. Lower FPR indicates fewer OOD inputs are incorrectly accepted.

  • FPR definition: FPR@TPR_Q measures the fraction of OOD inputs falsely accepted when the threshold accepts Q% of ID inputs.The detector accepts an input when S(x) ≥ τ and rejects it as OOD when S(x) < τ.
  • Dataset cleaning: The NINCO cleaning process excludes samples overlapping with ID classes and retains samples from the same OOD classes after cleaning.Figure 9 contrasts excluded and retained examples.

F. Details of the NINCO dataset.

This section documents NINCO’s class metadata and the reproducible construction of its 17 synthetic OOD unit-tests, including pixel-, colour-, noise-, and permutation-based inputs.

  • NINCO’s class table records each OOD class, dataset source, sample count, and whether its class overlaps with IN-21K.
  • 400 samples are provided for each of 17 OOD unit-tests, using the same sizes and file formats as random ImageNet samples.
  • Several unit-tests generate structured colour patterns, including monochrome, tricolour, primary tricolour, and horizontal or vertical stripes.
  • Noise-based unit-tests include smooth noise variants, smooth colour, uniform noise, Gaussian noise, Rademacher noise, and blobs.
  • Other unit-tests use shuffled ImageNet pixels, constant black or white images, or grayscale images with equal RGB channels.

H. Examples images from each OOD class in NINCO and from OOD unit-tests

The appendix provides visual examples of NINCO classes and OOD unit-tests, alongside tables reporting unit-test false-positive rates across model families.

  • Figures 10–12 show samples from each NINCO class across three figure panels.
  • Figure 13 shows representative samples from each OOD unit-test.
  • Table 10 reports false-positive rates for pretrained transformers, with its caption highlighting few failures for ImageNet-21k-only ViTs.
  • Tables 11–13 report false-positive rates for pretrained and untrained convolutional networks and transformers on OOD unit-tests.

J. Effect of ID contamination on all models

The appendix compares OOD detection on cleaned and original datasets and reports that the main conclusions persist across these evaluations, while dataset difficulty affects false-positive rates.

  • False-positive rates in Table 14 are averaged across cleaned subsampled datasets underlying the main-paper evaluation.
  • Tables 15–18 compare false-positive rates on full uncleaned and cleaned subsampled versions of multiple OOD datasets.
  • TEXTURES and iNaturalist are relatively easy test OOD datasets, so most models have lower false-positive rates there than on NINCO.
  • Feature-based methods outperform methods without explicit pre-logit feature access, although some models still fail on these evaluations.
  • Pretraining only on IN-21k yields the best OOD detectors, while Cosine and MCM/RCos often improve over MSP and can be best-performing methods.

K. Results on NINCO classes with and without overlap with IN-21K

Results are separated by whether NINCO classes overlap with IN-21K, revealing differences in detector performance and method advantages across the two groups.

  • NINCO classes are evaluated separately according to IN-21K overlap, but the groups differ in size and individual-class difficulty.
  • Most models and methods perform better on NINCO classes with IN-21K overlap than on classes without overlap.
  • ViT+Maha is the best OOD detector for both NINCO groups.
  • RMaha and (Relative) Cosine provide the most consistent improvements over MSP across both groups, while ViM is comparatively stronger without overlap.
  • Pretraining only on IN-21K yields the best OOD detectors for both overlap groups.
Loading 2306.00826v1…