ODIN Detector

ODIN divides the logits by a temperature constant T > 1 before applying the softmax function. This process softens the probability distribution, making the model less overconfident on OOD inputs. Higher temperatures push the softmax scores of all classes closer to a uniform distribution, but the effect is more pronounced for OOD samples, widening the separation gap.

• Mechanism: softmax(logits / T)
• Typical range: T ∈ [1, 1000]
• Effect: Reduces maximum softmax probability for OOD inputs more aggressively than for in-distribution inputs

ODIN adds a small, calibrated perturbation to the input before inference. The perturbation is computed as the sign of the gradient of the softmax score with respect to the input, scaled by a magnitude ε. This step is the inverse of adversarial example generation—instead of fooling the model, it amplifies the model's confidence on in-distribution data while leaving OOD inputs relatively unaffected.

• Formula: x̃ = x - ε · sign(-∇_x log S_ŷ(x; T))
• Typical ε: 0.0014 to 0.0028
• Key insight: In-distribution samples move toward higher confidence; OOD samples do not benefit from the same gradient alignment

The core innovation of ODIN is the synergistic effect of temperature scaling and input perturbation. Neither technique alone achieves optimal OOD detection, but together they create a substantial separation between the softmax score distributions of in-distribution and OOD data.

• In-distribution: Scores remain high or increase after perturbation
• OOD: Scores drop significantly due to lack of gradient alignment
• Result: A clear bimodal distribution that enables simple threshold-based rejection
• AUROC improvement: Typically 10-30% over baseline Maximum Softmax Probability (MSP)

ODIN operates as a post-hoc detection method, meaning it can be applied to any pre-trained neural network classifier without modifying the architecture, loss function, or training procedure. This makes it immediately deployable in production systems.

• Compatibility: Works with any softmax-based classifier (ResNet, DenseNet, WideResNet)
• Deployment: Wraps the existing inference pipeline with a preprocessing step
• Overhead: Minimal—one additional forward pass and one backward pass for gradient computation
• Calibration: Requires a small validation set of OOD samples to tune T and ε hyperparameters

ODIN's performance depends critically on selecting the right temperature (T) and perturbation magnitude (ε). These are tuned on a held-out validation set containing both in-distribution and OOD samples to maximize detection AUROC.

• Grid search: Evaluate combinations of T and ε
• T selection: Start with T=1000 and reduce until in-distribution scores remain distinguishable
• ε selection: Increase until OOD scores begin to drop without degrading in-distribution accuracy
• Dataset-specific: Optimal values vary by model architecture and training dataset (e.g., CIFAR-10 vs. ImageNet)

ODIN is not a universal OOD detector and exhibits specific failure modes that practitioners must understand.

• Near-OOD sensitivity: Performance degrades on semantically similar OOD inputs (e.g., CIFAR-100 vs. CIFAR-10) where distributions overlap
• Gradient obfuscation: Adversarially crafted OOD inputs can mimic in-distribution gradient patterns
• Computational cost: The backward pass for gradient computation adds latency unsuitable for real-time, high-throughput systems
• Calibration drift: Hyperparameters tuned on one OOD distribution may not transfer to unseen OOD types