AUTO: Adaptive Outlier Optimization for Online Test-Time OOD Detection

Let $\mathcal{X}\subseteq\mathbb{R}^{n}$ be the input space, $\mathcal{Y}=\left\{1,...,C\right\}$ be the label space, and ${h}=\rho\circ\varphi:\mathcal{X}\to\mathbb{R}^{C}$ be the model, where $\rho$ is the classifier and $\varphi$ is the feature extractor. The supervised methods aim to learn the joint data distribution from the training set $\mathcal{D}_{{id}}$. Let $\mathcal{P}_{{ID}}$ and $\mathcal{P}_{{OOD}}$ denote the marginal ID and OOD distribution on $\mathcal{X}$, separately. The OOD detector $f_{\lambda}(\cdot)$ aims to find a proper model ${h}$ and score function $S(\cdot)$ to detect OOD data well:

where $\beta$ is a given threshold. OE [14] aims to get a better ${h}$ by regularizing the target model to produce low-confidence predictions for test OOD data. Thus OE introduces auxiliary outliers at training time. Let $\mathcal{D}_{aux}$ be the auxiliary OOD dataset on $\mathcal{X}$, which is also disjoint with the test OOD dataset. The learning objective can be written as:

where $\lambda$ is a trade-off hyperparameter and is set to 0.5 for vision tasks, $\ell_{\mathrm{CE}}$ is the cross-entropy loss, and $\ell_{\mathrm{OE}}$ is defined by Kullback-Leibler divergence of softmax predictions to the uniform distribution. For phraseology consistency, in this paper, we describe training-time examples as auxiliary outliers and exclusively use OOD data to describe test-time unknown inputs.

This paper formalizes the problem of enhancing OOD detection in an online unlabeled data stream at test time. With this new setting, concrete questions arise: (1) How to roughly distinguish test data as ID or OOD? Tackling this question will help select pseudo-OOD and pseudo-ID samples that AUTO learns from during testing. (2) Assuming the continual learning at the image-by-image level is effective, will constant changes lead to catastrophic forgetting? If it does, how to overcome it? (3) Different from training-phase methods, the update efficiency for test-time methods needs to be considered, especially for time-critical tasks. Thus, How to efficiently update the model?

We first model the distribution of open world data $\mathcal{P}_{OPEN}$ with the Huber contamination model [17]:

where $\kappa\in[0,1)$. The mixture of unlabeled data from $\mathcal{P}_{OPEN}$ posits a unique obstacle for differentiated optimization based on data distribution. In our method, pseudo-OOD samples are roughly distinguished from test ID data by our adaptive in-out-aware filter, which is initialized by the statistics from the training ID data. For instance, given ID examples ${x}_{id}^{i}\sim\mathcal{P}_{ID}~{},i\in[1,N]$, we compute the MSP [13] score $S^{0}({x}_{id}^{i})$ of each sample and then estimate the mean $\mu_{in}$ and standard deviation $\sigma_{in}$ of ID data:

Then, the outlier-aware and inner-aware margins are initialized as follows:

where $k_{1}$ and $k_{2}$ are hyperparameters. On the one hand, we regard a sample with a score higher than $m_{in}$ as a pseudo-ID sample. We keep $m_{in}$ fixed during training, and this setting works well in the experiments. On the other hand, the confidence scores of all samples are decreasing as we update models with the outliers [14, 27]. Taking this phenomenon into consideration, we update $m_{out}$ with a greedy strategy. A sample ${x}^{t}$ with a score lower than $m_{out}$ is recognized as a pseudo-OOD sample and rewritten as $\hat{{x}}^{t}_{ood}$. Then, we use $\hat{{x}}^{t}_{ood}$ to optimize the model as follows:

where ${h}^{t}$ represents the latest updated model.

Meanwhile, We record the mean of historical OOD score values of the pseudo-OOD samples. Then, we use the mean value to update $m_{out}$ as follows: Assuming that we have recorded the mean score of $M$ pseudo-OOD samples when the t-th sample inputs:

Dynamic ID memory bank. We introduce a dynamic memory bank $\mathcal{M}_{id}$ into the ID classification loss formulated in Eq. 2. The memory bank store one sample per category and is initialized with samples randomly selected from training data. We update the samples in the memory bank with the test-time ID data in the same category. Concretely, given a test-time sample $\hat{{x}}_{id}$ whose score is higher than the inner-aware margin $m_{in}$ and its pseudo label $\hat{{y}}_{id}$, we utilize it to update the memory bank as follows:

Empirically, we notice that the training with only $\mathcal{M}_{id}$ does not help improve OOD detection, thus we do not modify our model until encountering a $\hat{{x}}_{ood}$. The test-time ID objective $\mathcal{L}_{id}$ is formulated as follows:

Semantically-Consistent Objective. We find that at the beginning of test-time optimization, $m_{out}^{0}$ may misclassify some ID samples as OOD. Such misclassifications subsequently confuse the model during optimization. To address this problem, we propose to maintain the consistency between the predictions of the original model and the updated model. Specifically, at the beginning of the testing stage, we make a duplicate of the model ${h}^{0}$ and freeze its parameters. The prediction of the duplicated model is denoted as ${y}^{0}$. Intuitively, if the results predicted by the model remain consistent with ${y}^{0}$, the performance on the source task will not degrade. Let $p^{t}_{{y}}$ denote the softmax probability that the t-th sample belongs to the class ${y}$. Our objective is:

which enforces $p^{t}_{y^{t}}$ close to $p^{t}_{y^{0}}$ with a margin $\phi$. That means the prediction of $h^{t}$ is supposed to be higher than that of $h^{0}$ at least by $\phi$. In this work, we empirically set $\phi$ as a pre-defined value. It is worth noting that $\phi$ should not be too large that it may influence the optimization between the pseudo-OOD sample and the uniform distribution.

Let $\theta$ denote all the parameters of the model, updating $\theta$ is a natural choice, but it is sub-optimal for test-time OOD detection. Therefore, we consider optimizing part of the network parameters. While this operation is common in many tasks, there is still a lack of research on identifying which part should be updated to improve OOD detection performance efficiently. Following the partial updating principle [46], we explore the influence of optimizing different combinations of parameters, e.g., the last feature block $\theta_{last}$, all batch normalization layers $\theta_{bn}$, and the classifier $\theta_{fc}$. Table 7 displays the results that optimize the above combinations. We finally optimize $\theta_{last}$ while keeping the remaining parameters fixed during testing.

The overall test-time optimization objective is formulated as follows:

where $\lambda_{1},\lambda_{2}$ are set to 1 and 0.1, respectively. To adequately leverage the information in the outlier and the memory bank, we repeat the optimization process on each outlier iteratively for a given number of iterations, $T$. While seemingly separated from each other, the three components of AUTO are working collaboratively. First, the in-out-aware filter selects high-quality ID and OOD samples from the unlabeled test data, which facilitates the positive update of models. Second, the anti-forgetting components help model enlarges the margin between ID and OOD data, which paybacks to the filter and helps it select samples more accurately. The entire training process converges when the three components perform satisfactorily. The pseudo-code is illustrated in Appendix.

For modifying during testing, we use stochastic gradient descent with the learning rate set to that of the last epoch during training, which is 0.001 in all our experiments. We set weight decay and momentum to zero during test-time OOD detection, inspired by practice in [28, 10]. We do not tune our hyperparameters for each $\mathcal{D}_{open}^{test}$ distribution, so that $\mathcal{D}_{open}^{test}$ is kept unknown like with open-world scenarios. We use the cross-validation strategy to select $\lambda_{1},\lambda_{2},\phi,k_{1},k_{2}$, which is shown in Appendix.

Due to space constraints, additional experiments and ablation studies are included in Appendix.

AUTO outperforms baselines trained without auxiliary outliers. We compare AUTO with post hoc OOD detection methods, which include MSP [13], ODIN [25], Mahalanobis [22], Energy [27], Logitnorm [49], ReAct [39], DICE [40], and KNN [41]. Like post hoc OOD detection methods, AUTO does not require additional modifications at training time. As shown in Table 1, AUTO outperforms all post hoc methods by a large margin. Compared with the best baseline in each data-net pair, AUTO reduces the FPR95 by 30.24% (ResNet-34) and 27.18% (WRN) on CIFAR-10 and by 59.48%(ResNet-34) and 42.37% (WRN) on CIFAR-100. Besides, as shown in Table 2, Auto can further enhance OOD performance based on other post hoc methods. Accessing test OOD data greatly benefits AUTO with an acceptable inference time increase (as shown in Table 7). The superior performance demonstrates that AUTO could be a complementary method for all well-trained models to efficiently excavate their intrinsic OOD discriminative capability with lightweight modifications during testing.

AUTO achieves competitive results compared with OE-based counterparts. In Table 1, we contrast AUTO with OE-based methods, which include OE [14], Energy [27], POEM [31], WOODS [19], and DOE [48]. All the baseline methods are fine-tuned using the same pre-trained model. Despite not being optimal on CIFAR-10, AUTO’s improvement is still remarkable, with 7.93% (ResNet-34) and 3.71% (WRN) better results on CIFAR-100. Note that the tiny-ImageNet dataset is adopted as the auxiliary outlier, which is mainly different from the considered test OOD datasets. Thus, we highlight that AUTO reduces the distribution gap between auxiliary outliers and test OOD data, resulting in superior performance.

AUTO scales effectively to large datasets. Compared with CIFAR benchmarks, the ImageNet benchmark is more challenging due to the larger feature space (512 $\rightarrow$ 2048) and the larger label space (10/100 $\rightarrow$ 1000). In Table 3, we evaluate AUTO on ImageNet using a ResNet backbone and a Vision Transformer. For post hoc counterparts, we still perform better with both backbones. For OE-based methods, ImageNet-21K-P is adopted as the auxiliary outlier. Since OE-based methods on Imagenet have been published recently, and their codes have yet to be released, we refer to the results reported in original papers [48, 43] for now. Surprisingly, AUTO still significantly outperforms these latest works. The above results suggest that adjusting models at test time is obviously more efficient than predicting the unknowns during training in these complicated scenarios.

AUTO gets impressive OOD performance while maintaining comparable ID classification accuracy. Deployed models should maintain source task performance while detecting OOD examples in the open world. We compare the ID classification accuracy of AUTO in Table 1 and Table 3 with post hoc OOD detection methods. AUTO improves classification accuracy on ResNet-34 and Vision Transformer. Compared with the original models, it only underperforms on ResNet-50 and WideResNet-40-2 The gap is just 1.2% on CIFAR-10, 1.13% on CIFAR-100, and 2.74% on ImageNet. Such a loss is acceptable and will not affect the safe deployment of the model.

AUTO can handle mixed OOD scenarios. Previous testing scenarios only include one OOD data and one ID data. In this paper, we introduce mixed OOD scenarios. Models will encounter at least two kinds of OOD data at test time. Results in Table 4 suggest that the models’ performance in this new scenario differs from an arithmetic average of performances in single-OOD scenarios. The intricate composition of data presents challenges for all methods. Nevertheless, AUTO continues to demonstrate exceptional performance, exhibiting a greater performance advantage over OE and WOODS. This underscores AUTO’s superior capability to handle mixed OOD scenarios.

AUTO is flexible in time-series OOD scenarios. Except for the mixed OOD scenario, our paper also explores time-series OOD scenarios, where the environment may change over time. This means that simply sampling and learning from the target scenario before deployment may not be effective, as the OOD data may change. We evaluate this challenge and demonstrate that AUTO overcomes this problem by continuously adjusting models. As shown in Table 5, a model trained on CIFAR-100 encounters the LSUN-Resize and Places365 datasets sequentially. Post hoc methods are not affected by this change, but WOODS performs well only on LSUN-Resize and underperforms significantly on Places365. In contrast, AUTO constantly modifies the model, enabling it to adapt to the new CIFAR-100/Places365 scenario.

AUTO further enhances the OOD detection performance of models trained with auxiliary outliers. The aforementioned findings suggest that the incorporation of AUTO can effectively enhance the ability of models trained solely on ID data to detect OOD samples. To further investigate the potential of AUTO in improving OOD detection performance for models trained with auxiliary outliers, we conducted additional experiments. As presented in Table 6, with the help of AUTO, models trained with auxiliary outliers improve their OOD detection performance further. Moreover, results from Tables 5 and 6 also reveal that the model trained on LSUN-Resize before being deployed to Places365 achieves better performance than the model directly deployed to Places365. These findings demonstrate the versatility of AUTO.

Modulation parameters. We evaluate the impact of different optimization objects, as presented in Table 7. On the one hand, taking both ID and OOD tasks into account, the performance of optimizing the last feature block is superior. On the other hand, models in open-world scenarios, particularly those engaged in online stream applications, need to notice the optimization efficiency. We note that the inference time per sample is approximately 5ms. AUTO necessitates only a modest 2.4x increase in processing time. Such an increment in time cost is absolutely tolerable. Thus, we conclude that the utilization of the last feature block as the optimization objective is a more efficient strategy.

Components in AUTO. Results presented in Table 8 evaluate the efficacy of various components. Our results demonstrate that training the model solely with an ID memory bank leads to similar performance as the method without optimization, indicating that optimizing on ID data alone does not effectively enhance OOD detection. Furthermore, while training on outliers alone improves OOD detection, it results in catastrophic forgetting, as evidenced by the decline in ID classification accuracy. With the help of the ID memory bank, the model jointly updated by both ID and OOD samples already exhibits progress in both OOD detection and ID classification. However, we want to achieve a higher level of ID performance. Our results show that the incorporation of a semantically-consistent objective makes this goal come true.

Parameter analysis of $\mathcal{L}_{SC}$. We conduct a parameter analysis of $\mathcal{L}_{SC}$ to evaluate the impact of $\lambda_{2}$ and $\phi$ on the model. Firstly, we examine the effect of different values of $\lambda_{2}$ in Figure LABEL:fig:subfig:a and LABEL:fig:subfig:b, with $\phi=0.2$. Empirical results demonstrate that a larger $\lambda_{2}$ prioritizes the ID classification task over OOD detection. The larger $\lambda_{2}$ also weakens the ID information learned from dynamic ID memory, harming both ID and OOD tasks. Furthermore, we investigate how the parameter $\phi$ affects OOD detection and ID classification in Figure LABEL:fig:subfig:c and LABEL:fig:subfig:d, with $\lambda_{2}=0.1$. Our findings confirm that $\phi$ should not be excessively large to preserve the optimization between OOD examples and the uniform distribution. While the impact of $\phi$ on ID performance is minimal, as shown in Table 8, it does supplement part of the remaining ID deficiencies from dynamic ID memory.

Sensitivity analysis on $\kappa$ and $T$. We conduct a sensitivity analysis on the parameters $\kappa$ and $T$, as summarized in Table 9. Increasing the percentage of OOD data (decreasing $\kappa$) in the test set generally improves the performance of AUTO, as it allows the model to access more OOD samples and make more iterations. The model’s performance sometimes suffers from an increase in OOD data, as it can contaminate the ID memory, more details can be found in Appendix. Subsequently, we examined the effect of $T$, the number of iterations when each OOD sample is encountered. Multiple iterations can expedite the model’s convergence and facilitate the detection of OOD data that may have been missed during the convergence process, thereby improving model performance. However, we found that the incremental benefits diminish as $T$ increases beyond two iterations. Considering both performance and speed, we recommend setting $T=2$ as the standard iteration frequency.

Approximate estimation of the mean and standard deviation on training ID data. In order to initialize the in-out-aware filter, the statistics of the training ID data $\mu_{in}$ and $\sigma_{in}$ are estimated using all available training samples. This method introduces high computation costs before deployments. Actually, the statistics can be approximated using a small subset of the training data. Table 10 presents these approximate statistics and corresponding performances. Our findings suggest that approximate statistics facilitate the initialization of AUTO, significantly reducing computation costs and streamlining model deployment.

Firstly, we summarize the ID configurations in Table 11. For CIFAR benchmarks, we use the standard split with 50,000 training and 10,000 test images. For the ImageNet benchmark, we use the standard validation split with 50,000 images as ID samples at test time.

Then, we summarize the OOD configurations for CIFAR and ImageNet benchmarks.

For CIFAR benchmarks, we follow the common OOD settings in [27]. Details are shown in Table 12.

We use 80 Million Tiny Images [44] dataset as $\mathcal{D}_{aux}$ for OE-based methods. The 80 Million Tiny Images is a large-scale, diverse dataset of 32×32 natural images scrapped from the Internet. Following the OE setting, we remove all examples of 80 Million Tiny Images which appear in the CIFAR datasets. In particular, we change the auxiliary data set $\mathcal{D}_{aux}^{wood}$ for the WOODS method according to the number of OOD samples (Table 12). For $\mathcal{D}_{id}^{train}$, 45000 images are utilized for training the model, and the other 5000 images are utilized for validation.

For the ImageNet benchmark, we follow the common setting from [16]. Details are shown in Table 12.

We directly use the pre-trained model in the ImageNet benchmark, the training set $\mathcal{D}_{id}^{train}$ is utilized to sample the ID memory bank.

For both CIFAR and ImageNet benchmarks, the main results reported in our paper are tested on the test set, which is denoted as:

For training the classification models on CIFAR-10/100 data, we use the ResNet-34 [11] and the Wide ResNet [54] architecture with 40 layers and widen factor of 2. These models are optimized by stochastic gradient descent with Nesterov momentum [8]. We set the momentum to 0.9 and the weight decay coefficient to 0.0005. Models are trained for 200 epochs. The start learning rate is 0.1 and decays by a factor of 10 at epochs 80 and 140. We use a batch size of 128 and a dropout rate of 0.3.

For training OOD detectors with auxiliary data, we follow the OE[14] and energy [27] setting, we use the default: $\lambda=0.5$ in OE; $m_{in}=-7$, $m_{out}=-25$ and $\beta=0.1$ in energy. Models are trained from scratch for 200 epochs.

To evaluate the baselines, we follow the original definition in MSP [13], ODIN score [25], Mahalanobis score [22], Energy score [27], ReAct [39], LogitNorm [49], DICE [40], and KNN distance [41].

For ODIN, we set the temperature $T$ as 1000.

For Energy, the temperature is set to be $T=1$.

For ReAct, the rectification threshold $p$ is set to 1. More discussions are shown in Table 14.

For LogitNorm, we set the temperature hyperparameter $\tau$ as 0.04 for CIFAR-10 and 0.0085 for CIFAR-100. More discussions are shown in Table 15.

For DICE, the sparsity ratio is set to $90\%$.

For POEM and DOE, models are trained from scratch.

Before the proposition of AUTO, we systemically study the existing methods and find some experiment results interesting. These methods substantially improve OOD detection performance with a fixed setting, but sometimes they will unintentionally make a negative optimization.

Effectiveness of ReAct [39]. ReAct [39] is a successful method to improve OOD detection performance in most of scenarios, the central hyperparameter -rectification threshold- always set to a small value (e.g. 1,2). However, we find that ReAct is negative when the rectification threshold $p$ is set small for the model trained on ImageNet [5] using Vision Transformer [6]. Results is shown in Table 14. We believe that if $p$ is dynamically adjusted during testing, the influence of ReAct would be positive.

Effectiveness of LogitNorm [49]. LogitNorm [49] substantially mitigate the overconfident problem of neural networks. It can be easily adopted in practical settings without changing the loss and training theme. However, the performance of this method is heavily influenced by its temperature parameter $\tau$, which modulates the magnitude of the logits. Authors of Logitnorm state that $\tau$ should decrease as the number of categories increases. For instance, it is set to 0.04 on CIFAR-10 and 0.01 on CIFAR-100 [20]. However, we discover that this conclusion is empirical. Effect on the $\tau$ is shown in Table 15. It suggests that we need to dynamically search for the best value of $\tau$ at a finer granularity level during testing. Because the best $\tau$ may be different in various test scenarios.

The influence of hyperparameters. Hyperparameters in our work are set as follows: $\lambda_{1}=1,\lambda_{2}=0.1,\phi=0.2,T=2$, these parameters have been discussed in the main text. The initialization of the inner-aware and outlier-aware margins are validated in the following experiments. We evaluate the value of $k_{1},k_{2}$ with the cross-validation strategy. For instance, we utilize the Texture [4] dataset to choose $k_{1},k_{2}$ when the model is deployed in the scenario which is consists of CIFAR-100 and SVHN [35]. Considering variations of the ID data and OOD data, we choose a set of parameters for each model. Results are shown in Table 16 and Table 17.

We find that $k_{1},k_{2}$ are insensitive on CIFAR-10/CIFAR-100 benchmarks. Although the performance is similar, a bigger interval means more samples are utilized to modify models. Thus, the increased computational cost due to the initialization is noteworthy. In summary, we set $k_{1}=0,k_{2}=3$ for models trained on all ID datasets using ResNet/WideResNet [54] architectures. For models trained on the ImageNet using the Vision Transformer, we set $k_{1}=0,k_{2}=0$.

A class prototype memory bank enhances both ID and OOD performance. When sufficient ID data is available, it is possible to build a fixed class prototype memory bank. Table 18 shows that incorporating such a memory bank can facilitate further improvements in both OOD and ID performance. However, it may not be practical to construct such a memory bank, particularly if ID samples are scarce. Additionally, while the class prototype memory bank slightly outperforms dynamically updating the memory bank using test data, the latter approach is more convenient and flexible. Therefore, we have opted for the latter approach in AUTO.

A gradually reducing weighting factor for $\mathcal{L}_{SC}$. As we mentioned in the main text, setting a large $\lambda_{2}$ for $\mathcal{L}_{SC}$ can lead to underperformance on both ID and OOD tasks. To address this issue, we propose a gradually decreasing weighting factor $\beta$, which decreases as the number of iterations increases. Table 19 demonstrates that this factor effectively prevents the degradation of OOD performance, but it also reduces the gain of $\mathcal{L}_{SC}$ on ID performance. Since $\mathcal{L}_{SC}$ is initially proposed to enhance ID performance, we decide not to incorporate this factor into our framework.

Results on test-time methods. Existing test-time optimization methods have primarily focused on adaptation tasks. Although these methods are not developed with OOD detection in mind, as a paradigm for accessing data in the testing phase, it is still necessary to provide a comparison and explanation. In Table 20, we investigate two settings where models are trained on CIFAR-100 during training and tested on (1) CIFAR-100/Places365 scenario or (2) CIFAR-100-C/Places365 scenario. We can summarize that (1) OOD data proves to be detrimental to Tent, which attempts to fit the OOD data into the known data distribution. This not only fails to detect OOD data, but also harms ID performance. (2) Introducing covariate shift to ID data during testing is a new scenario that cannot be covered by OOD detection methods. Additionally, this new scenario is not aligned with the OOD detection paradigm.

The results presented in Table 20 demonstrate that OOD detection methods fail to perform in the CIFAR-100-C scenario. To further investigate this phenomenon, we conduct additional experiments as shown in Table 21, where we train our model on CIFAR-100 and evaluated its performance on a CIFAR-100/CIFAR-100-C scenario. Our findings reveal that OOD detection methods treat CIFAR-100-C data as OOD data, as evidenced by the MSP method successfully detecting CIFAR-100-C, similar to its detection of Places365. Meanwhile, by utilizing AUTO, the pre-trained model is able to accurately distinguish between CIFAR-100-C and CIFAR-100 during testing.

Based on the aforementioned experimental results, it is evident that attempting to force Tent to fit OOD data or OOD detection methods to fit ID data with covariance shift is unreasonable. It is clear that novel experimental settings (CIFAR-100 $\rightarrow$ CIFAR-100-C/Places365) necessitate the development of innovative methodologies.

AUTO outperforms the test-time self-supervised OOD detection method. As mentioned in Related Works, ELET [9] is an OOD detection method that learns a detector from scratch at test time. We compare AUTO and ELET in Table 22. Results show that AUTO is better than ELET.

AUTO with different score functions. To further verify the generality and the effectiveness of AUTO, we test AUTO with three representative OOD scoring functions, namely, MSP [13], Free energy [27], and MaxLogit [12]. Regarding all the cases with different scoring functions, our AUTO always achieves good performance (Table 23), demonstrating that our proposal can genuinely make the target model learn from OOD knowledge for OOD detection.

Results on Individual Datasets. For models trained on CIFAR-10 (Table 24) and CIFAR-100 (Table 25), we report their specific results on six OOD datasets respectively.