Out-of-Distribution Detection

These are the simplest and most common baseline techniques, leveraging the model's final classification layer. They assume that in-distribution (ID) data will produce high-confidence, peaked probability distributions, while out-of-distribution (OOD) data will result in lower, more uniform confidence.

• Maximum Softmax Probability (MSP): The most straightforward method, where the highest predicted class probability is used as the OOD score. Lower scores indicate OOD data.
• ODIN (Out-of-DistriIbutioN Detector): Enhances MSP by applying temperature scaling to the softmax and adding small input perturbations to further separate ID and OOD confidence distributions.

Limitation: These methods can fail when models are overconfident, even on nonsense inputs, a phenomenon known as overconfident prediction.

These techniques measure the statistical distance between a test sample's feature representation and the known distribution of training data features in the model's latent space.

• Mahalanobis Distance: Calculates the distance of a test sample's features from the closest class-conditional Gaussian distribution fitted on the training data's features. Larger distances signal OOD inputs.
• k-Nearest Neighbors (k-NN): Uses the distance to the k-nearest training samples in the feature space. OOD samples are expected to have larger distances to their neighbors.

These methods are more robust than softmax-based approaches as they operate directly on the learned feature representations, which often better capture data semantics.

These methods explicitly model the probability distribution of the training data in the feature space. A test sample is flagged as OOD if it falls in a region of low probability density.

• Normalizing Flows: A type of generative model that learns an invertible transformation to map the complex data distribution to a simple base distribution (e.g., Gaussian). The likelihood under the learned model serves as the OOD score.
• Energy-Based Models (EBMs): Associate a scalar energy value with each input configuration. ID data is assigned lower energy. The energy score can be derived directly from a discriminative classifier's logits, providing a more reliable signal than softmax probability.

These provide a principled probabilistic framework but can be computationally expensive to train and evaluate.

These techniques analyze the model's gradients—the sensitivity of its loss or output to input perturbations—to detect OOD samples. The hypothesis is that the model's behavior under perturbation differs for ID vs. OOD data.

• GradNorm: Uses the vector norm of gradients backpropagated from the KL divergence between the softmax output and a uniform distribution. OOD data often produces larger gradient norms.
• ReAct (Rectified Activations): Applies a simple threshold (rectification) to the penultimate layer's activations to suppress abnormally high activations caused by OOD data, improving the separation when used with other scores like MSP or Mahalanobis distance.

These methods offer an alternative signal derived from the model's internal dynamics rather than just its final output.

Leveraging multiple models or predictions to improve detection reliability by capturing epistemic uncertainty—the model's uncertainty due to a lack of knowledge about OOD inputs.

• Deep Ensembles: Train multiple models with different random initializations. The variance or disagreement in their predictions is higher for OOD data. Metrics like predictive entropy or mutual information across the ensemble are used as OOD scores.
• Monte Carlo Dropout: Treats dropout at inference time as an approximate Bayesian neural network. Multiple stochastic forward passes generate a distribution of predictions; the variance of this distribution indicates OOD.

These are among the most effective but also most computationally intensive techniques, as they require multiple model evaluations per input.

A training-time regularization technique that explicitly exposes the model to auxiliary OOD data during training to learn a better decision boundary. Unlike other post-hoc methods, it modifies the model's objective.

• The model is trained on a mixture of ID data and a diverse, large-scale auxiliary dataset (e.g., 80 Million Tiny Images). An auxiliary loss encourages the model to output a uniform distribution or low confidence for these auxiliary OOD examples.
• This teaches the model the concept of "unknown," significantly improving post-training detection performance with methods like MSP or energy scores.

Key Challenge: Requires a relevant and diverse auxiliary dataset that does not contaminate the model's primary task performance.

Adversarial robustness is a model's ability to maintain correct predictions when subjected to deliberately crafted, often imperceptible input perturbations designed to cause misclassification. While OOD detection identifies data that is statistically novel, adversarial robustness defends against data that is maliciously engineered to be within the training distribution but at its most vulnerable points.

• Key Distinction: OOD handles novelty; adversarial robustness handles malicious in-distribution samples.
• Defensive Synergy: A robust system often employs both OOD detection to flag unfamiliar inputs and adversarial training to harden against known attack patterns.

Uncertainty quantification is the process of measuring and communicating the confidence or reliability of a model's predictions. OOD detection is a direct application of uncertainty quantification, as models should express high uncertainty (e.g., low confidence scores, high predictive entropy) on inputs far from their training data.

• Core Techniques: Methods like Monte Carlo Dropout, Deep Ensembles, and evidential deep learning estimate both aleatoric (data noise) and epistemic (model ignorance) uncertainty.
• Practical Output: These techniques provide a scalar or distributional measure of confidence that can be thresholded to trigger OOD detection alerts.

Data poisoning is an attack where an adversary injects malicious or corrupted data into a model's training set to compromise its performance or integrity. This creates a direct link to OOD detection: poisoned data points are often statistical outliers that can be flagged during data curation, and a poisoned model may exhibit abnormal behavior on specific, attacker-chosen inputs that could be detected as OOD during inference.

• Pre-Training Defense: OOD detection methods can screen training datasets to filter potential poison samples.
• Post-Attack Symptom: A successfully poisoned model may misclassify triggered inputs, which OOD detectors might flag due to the model's anomalous internal activations.

Anomaly detection is the broader machine learning task of identifying rare items, events, or observations that deviate significantly from the majority of the data. OOD detection is a specific instance of anomaly detection applied to the input space of a trained model.

• Broader Scope: Anomaly detection is used in fraud detection, network security, and industrial fault monitoring, often without a pre-trained model.
• Shared Methods: Both fields utilize similar statistical and deep learning techniques, such as one-class classification, reconstruction error (using autoencoders), and density estimation.

Domain adaptation is a set of techniques used to improve model performance on a target data distribution that differs from the source (training) distribution. It is a proactive counterpart to OOD detection. Instead of merely flagging distributional shift, domain adaptation actively attempts to align the model's understanding between the source and target domains.

• Contrast with OOD: OOD detection says "this is different and may fail." Domain adaptation says "this is different, so let's adapt the model to handle it."
• Use Case Sequence: OOD detection can identify when a significant, unhandled domain shift occurs, triggering a need for domain adaptation or model retraining.

Model calibration refers to the property where a model's predicted confidence scores accurately reflect its true likelihood of being correct. A well-calibrated model is crucial for effective OOD detection, as its low-confidence predictions on novel inputs should reliably indicate a high probability of error.

• The Miscalibration Problem: Modern neural networks are often poorly calibrated, being overconfident even on wildly OOD inputs, which breaks most simple confidence-thresholding OOD methods.
• Enabling OOD: Techniques like temperature scaling and label smoothing improve calibration, making confidence scores a more reliable signal for identifying OOD samples.