GLOD: Gaussian Likelihood Out of Distribution Detector

Discriminative deep neural networks (DNNs) do well at classifying input associated with the classes they have been trained on. However, out-of-distribution (OOD) input poses a great challenge to such models and consequently represents a major risk when these models are used in safety-critical systems. In the last two years, extensive research has been performed in the domain of OOD detection. This research has relied mainly on training the model with OOD data or using an auxiliary (external) model for OOD detection. Such methods have limited capability in detecting OOD samples and may not be applicable in many real world use cases. In this paper, we propose GLOD - Gaussian likelihood out of distribution detector - an extended DNN classifier capable of efficiently detecting OOD samples without relying on OOD training data or an external detection model. GLOD uses a layer that models the Gaussian density function of the trained classes. The layer outputs are used to estimate a Log-Likelihood Ratio which is employed to detect OOD samples. We evaluate GLOD's detection performance on three datasets: SVHN, CIFAR-10, and CIFAR-100. Our results show that GLOD surpasses state-of-the-art OOD detection techniques in detection performance by a large margin.


Introduction
Deep neural networks (DNNs) have been applied successfully to many classification tasks in various domains, including image recognition (Xu et al. 2015), text classification (Chopra et al. 2016), and speech recognition (LeCun et al. 2015). While capable of learning complex patterns, DNNs are limited in their ability to correctly classify samples that do not have the same distribution as the data that was used to train them; such data is referred to as out-of-distribution (OOD) data. OOD detection (also referred to as distributional shift) was identified as one of the major risks of AI (Amodei et al. 2016, Mohseni et al. 2019).
Most popular DNN architectures today are discriminative. Given a test sample, a discriminative model classifies it into one of the classes observed in the training data, regardless of its distribution.
Such models classify the sample to one of the classes even if there is an indication in the DNN's internal representations that the tested sample is OOD.
This shortcoming becomes more significant in cases in which DNNs play an important role in safety-critical systems, for example, in autonomous driving and medical imaging. In such cases, due to the dynamic nature of these systems, the DNN-based model is likely to be exposed to OOD samples, thereby degrading the accuracy of the models, endangering the users that rely on the correct functioning of the system.
In last two years there has been a significant increase in the amount of research performed in this field. Previous studies used various approaches to address the OOD challenge. One approach uses additional auxiliary models, trained to detect OOD samples (Ren et al. 2019). Using auxiliary models increases inference time, memory consumption, and processing, and therefore cannot be used in many real-time applications. In a paper by Mohseni et al. 2019, the necessity of OOD detection in autonomous driving is explained; this is an area in which significant overhead in classification cannot be tolerated. In another approach, the DNN model is exposed to OOD data during training time (Mohseni et al. 2020, Hendrycks et al. 2018. Training on OOD data can be problematic in some cases, as it assumes prior knowledge on OOD data that the DNN model may encounter. Another approach is to replace the function of the last layer of a DNN to obtain OOD detection capability. For example, in a paper by Hsu et al. 2020, the authors suggest a new type of reparametrization for the softmax activation that enables OOD detection. While efficient, this kind of approach was unable to achieve state-of-the-art OOD detection performance. Contributions. In this paper, we propose a new method, GLOD -Gaussian likelihood OOD detector. GLOD is implemented as an alternative for the final layer in a DNN, featuring a Gaussian likelihood layer combined with a log likelihood ratios statistical test. The Gaussian likelihood layer uses the Gaussian density function to model the different classes in their penultimate layer representation of the DNN. We train the GLOD to model each class using a multivariate Gaussian. On inference we use the Gaussian likelihood for classification and the Log-Likelihood Ratio statistical test for OOD detection. Since GLOD is integrated as a layer in the model (as opposed to using an additional auxiliary classifier), it is fast and efficient, hence, it can be used in real-time applications. In addition, it does not require OOD data or adversarial samples during training.
We evaluate GLOD using three commonly used benchmark datasets for OOD detection: SVHN (Netzer et al. 2011), CIFAR-10 (Krizhevsky et al. 2009), and CIFAR-100 (Krizhevsky et al. 2009). The results of our evaluation show that GLOD outperforms state-of-the-art OOD methods by a large margin on all of the datasets.

Background
In this section, we provide the definition of the OOD problem encountered in classification tasks, the design considerations and intuition of GLOD and discuss other works that utilized Gaussian distribution in DNNs.

Problem Formalization
Given a training dataset with C classes, observe a classification problem of a test sample x, where the class that x is associated with is denoted by c(x). In a DNN without OOD detection capability, there is an underlying assumption that x is associated with one of the classes in the training dataset. The solution to this problem can be expressed as the following term: OOD detection necessitates the option of classifying the input x as none of the learned classes, equivalent to solving for the following term: argmax i∈{1,...,C}∪{OOD} p(y i |∃j; c(x) = y j )

Design Considerations
The design considerations behind our OOD detection method are as follows: 1. In-distribution data only -Our model must be capable of handling scenarios where we can expect unknown OOD data, hence, we require that the model will be trained on the original (available) training dataset only. Some methods, such as the one proposed by Lee et al. 2018, use OOD samples from the same dataset used for evaluation. Other methods like the method proposed by Mohseni et al. 2020 use a additional dataset, which is different from the test dataset and original training dataset. We restrict our method to be exposed only to the data used in the original classification task.

2.
Low overhead -Our model must be able to be applied in scenarios where memory and computation resources are limited. Therefore, no additional overhead is permitted, beyond DNN runtime and memory consumption.
These design considerations prompted us to incorporate the OOD detection capabilities in the classifier itself and to induce OOD detection capabilities only from the training dataset. To address those challenges, we inspected the final layer's function in discriminative DNNs. The final layer usually consists of linear transformation and softmax activation. The output of this layer is then used to calculate the loss function, as shown by Dunne and Campbell 1997. Softmax output always totals to one, and it can technically be employed as a density function for OOD detection. However, studies have shown that the use of the softmax output for OOD detection is limited and more sophisticated methods can surpass its OOD performance Gimpel 2017, Liang et al. 2018). Instead of using the softmax output, in this research we focused on the penultimate layer representation. Representation analysis, as performed by Katzir andElovici 2019 andLee et al. 2018, explain the relations in the geometric nature of representations. These analysis showed that in the penultimate representation, the classes are naturally grouped in clusters, a finding which indicates that the penultimate layer has the potential to serve as the input to a density function. A density function representing each class enables the use of statistical tests on its output. We argue that a statistical test on a known density function output can be used for OOD detection while maintaining In-distribution data only only and Low overhead considerations.

Gaussian Distribution in DNNs
The use of Gaussian distribution in DNNs appeared in different tasks; Van den Oord and Schrauwen 2014 proposed a generalization of GMM to multiple layers, Wang et al. 2017 used Gaussian parameterization to perform speech separation, and Wan et al. 2018 showed Gaussian parameterization for classification.
An important study on OOD by Lee et al. 2018 (Mahalanobis Distance), also used the Gaussian distribution for OOD detection, however, the use of the Gaussain distribution function is external in Mahalanobis Distance, as oppose to the inherent approach we took in GLOD's architecture. GLOD learns the parameters of the Gaussians during training and use them for classification, where Mahalanobis Distance fits a conditional Gaussian distributions only after training the classifier.
Gaussian distribution has already been incorporated into DNNs in different areas of research. However, to the best of our knowledge, learning a Gaussian distribution for each class has not been done for OOD detection research.

OOD Detection Using Gaussian Log-Likelihood Ratio
In this section, we present a novel Gaussian Log-Likelihood Ratio based approach for OOD detection. We describe the proposed method's parameterization and optimization.

High-Level Overview
In the proposed method we replace the final layer with a layer which acts as a density function, referred to as the Gaussian likelihood layer. The Gaussian likelihood layer models each class as a multivariate Gaussian, producing a proper density function. This is in order to use the Log-Likelihood of the samples in the penultimate layer, which serves as the input to the Log-Likelihood Ratio (LLR) test. We use maximum likelihood for classification and LLR score for OOD detection.
Consider a classification task where x ∈ X be an input, y ∈ {1, . . . , C} be its label and the output of the penultimate layer of a neural network is denoted by f (·) ∈ R d . The Gaussian likelihood layer models each class as a multivariate Gaussian, with its own trainable parameters -a positive semidefinite covariance matrix (Σ c ∈ R d×d ) and a center vector (µ c ∈ R d ). Given the class parameters, the layer assigns a score for each class c, corresponding to the Log-Likelihood of the penultimate layer's output, modeled as a Gaussian (Anderson 1958, chap. 3): To avoid numerical instability, diagonal covariance matrices are used. The use of diagonal covariance matrices makes both the computation of the log(|Σ c |) and the matrices' inverses simple. This also allows efficient paralleled computation of the Gaussians.
In contrast to fully connected layers that are used for classification, this layer uses a proper density function to model the outputs. Like other types of layers that are used for classification, the decision is made by taking the argmax from the output of the layer, which corresponds to the most likely class:

Optimization and Initialization
The optimization of GLOD is done on all model's parameters in order to achieve both classification and OOD detection capabilities. To optimize classification, as in the case of a fully connected layer, we utilize the paired softmax-cross entropy loss (L ce ). We use L ce on the outputs of the Gaussian layer.
The challenge that arises when learning the parameters using only L ce is it does not force the penultimate representation of the different classes into Gaussian form. To address this, similar to Wan et al. 2018, a regularization term that maximizes the likelihood of the correct outputs is employed. Given a sample {x i , y i } m i=1 (where m is the sample size), the regularization term is defined as follows: In some other implementations of a Gaussian model, it is assumed that the covariance matrix is a scaled identity matrix. However, in our method, the covariance matrix is learned and adapted for OOD detection. During the optimization process, we employ a clipping projected gradient descent to keep the covariance matrix diagonal elements positive. Optimizing only towards increasing the likelihood of the outputs of (5) can cause enlargement of the covariance matrices' values. To balance this without violating the Gaussian model, we add an L 2 regularizer on the covariance matrices. Intuitively, the regularizer limits the penultimate representation of the DNN. Samples within the same class are forced to have small spread in their penultimate representation.
The model optimization target can be summarized as: Where λ and β are hyperparameters. Minimizing the cross-entropy enforces the separation of the Gaussians from one another. The optimization of the maximum likelihood term paired with the crossentropy loss and the L 2 covariance regularizer produces a DNN which outputs useful log-likelihood scores for OOD detection.
For Gaussian layer parameters initialization -they can be initialized randomly or by manual calculation. When calculating manually the Gaussian layer parameters, we use a DNN pretrained on the same training data. We use the penultimate representation of the training data to empirically calculate the centers and covariance of each class. For this paper we used manual calculation.

Gaussian-based LLR for OOD detection
The proposed model outputs proper density values that correspond to the log-likelihood of the class Gaussians in the penultimate representation. We employ the LLR test on the Gaussians' log-likelihood values for OOD detection.
In order to use the LLR test, we define two Log-Likelihood scores, one for the predicted class(in class) and one for the other classes: In class score: Other classes score: We define the LLR score as: We explain the LLR terms as follows: the In class score is the likelihood of a sample to be in the in class distribution and the other classes score is the likelihood of the sample to be out of the predicted class distribution. Finally, for OOD detection, we use the scalar output from the LLR.
Note that this method complies with our design considerations (in-distribution data only and low overhead, mentioned in Section 2.2). The optimization process does not include any data other than the original training dataset, i.e., only the distributions of the training dataset classes are modeled by a Gaussian. Also, GLOD does not include any auxiliary methods or data preprocessing, thus, running in discriminative like runtime and has similar memory consumption.

Experimental Setup
In this section, we demonstrate the proposed method's capabilities using three image datasets: CIFAR-10, CIFAR-100, and SVHN, which are considered the standard datasets for OOD detection. For evaluation purposes, the datasets that the networks train on (in-distribution) are considered the positive class, and the OOD benchmarks, including LSUN and Tiny ImageNet, are considered the negative class (out-of-distribution).
We evaluate the proposed methods using the following, commonly used, metrics: • TNR95: The true negative rate (TNR) when the true positive rate (TPR) is 95%, which is a measure of how much OOD data is detected when we set the threshold so that the detector detects 5% of the in distribution as OOD. This metric is the most popular in recent literature. • TNR99: The true negative rate (TNR) when the true positive rate (TPR) is 99%, which is a measure of how much OOD data is detected when we set the threshold so that the detector detects 1% of the in distribution as OOD. • AUROC: The area under the receiver operating characteristic curve, which is a measure of how well the detector is when varying the detection threshold. • Detection accuracy: The overall detection accuracy when adjusting the threshold for maximum detection between in distribution and OOD.
We performed our evaluation using Pytorch deep learning framework on Nvidia 2080 Ti GPU. For the evaluation of GLOD's OOD detection performance, we trained a ResNet34 (He et al. 2016) with a Gaussian likelihood layer as its final layer. As for optimization -the values for λ (R M L coefficient) and β(Covariance regulizer coefficient) used for the presented experiments are both 0.01. The optimization was done using RMSprop. We also trained a WideResnet40-2 (Zagoruyko and Komodakis 2016) which produced similar detection results in all the evaluations we performed in this paper. Our code for both architectures, can be found in our git, along with all the other methods evaluation scripts. 3 For the evaluation of models requiring optimization, including GLOD-the proposed model, we trained five instances of each method. All methods reproductions are based on Resnet34 architecture. The presented results are an average of the detection results of each method. We reproduced the methods using the code that was published by the authors or sent to us by the authors.

Baseline methods for comparison
The detection methods selected for evaluation include all of the current state-of-the-art in the OOD detection area. Most methods have several variations that either have different computation complexities or use external data for calibration -we use the variation featuring the best OOD detection results. The methods we included in our evaluation are: 1. Max Softmax Probability (MSP) -a baseline for OOD detection introduced by Hendrycks and Gimpel 2017. This detector is based on the assumption that max c p(y = c|x) should be lower for OOD inputs. Liang et al. 2018 for OOD detection which uses temperature scaling and input prepossessing. the study suggests adding adversarial-like perturbations to the input and using temperature scaling in order to obtain a score which can be used for OOD detection.

ODIN -A detection method proposed by
3. Mahalanobis Distance -A detection method suggested by Lee et al. 2018 that is based on the analysis of the hidden representation of the DNN using conditional Gaussian distribution. Similar to ODIN, this method also leverages adversarial-like input preprocessing in order to enlarge the difference in the detection scores of in-distribution samples and out-distribution samples. Hendrycks et al. 2018 in which the DNN is fine-tuned in several additional epochs with batches that contain both in-distribution samples and OOD samples (which are not part of the test set). The OOD samples are used to optimize a loss function which includes an additional term that forces the DNN to output the same value for all classes. 5. Self-Supervised Learning for OOD detection (SSL) -A detection method proposed by Mohseni et al. 2020, in which the last layer of the DNN is extended with several additional neurons that are trained using OOD data (which is not a part of the test set). The sum of the additional neurons outputs is used as a score for OOD detection.

Outlier Exposer (OE) -A detection method proposed by
Note that in this comparison we include state-of-the-art methods for OOD detection, regardless of whether they took into consideration the previously mentioned in-distribution data only and low overhead. The ODIN and Mahalanobis Distance detection methods use input preprocessing which significantly increases their runtime overhead compared to a single feedforward operation. Hence, they do not comply to low overhead. The Self-Supervised Learning and Outlier Exposer methods train on validation OOD samples from a dataset which is different from the train dataset and the dataset they evaluate on, meaning that they fail to meet in-distribution data only. Mahalanobis Distance and ODIN methods calibrate on validation OOD data which is from the same dataset distribution they perform evaluation on, hence, they also do not comply to in-distribution data only. Mahalanobis Distance method can use adversarial samples for calibration instead of OOD. Only using adversarial examples means that it will comply to in-distribution data only, but this harms detection results. We use the Mahalanobis Distance variation that calibrates on OOD data and does not comply to in distribution data only and has better detection results.

Results
In this section, we present a comparison of the OOD detection results for the evaluated methods, comparing GLOD to the methods described in the previous section.
D in D out TNR95 AUROC Detection Accuracy MSP / ODIN / Mahalalnobis / OE/ SSL/ GLOD CIFAR-100 SVHN Tiny-Imagenet(r) LSUN(r) Table 1 shows that GLOD outperforms all of the other methods in detecting OOD samples and moreover, in TNR95 and detection accuracy, the results cannot be improved further. Note that representation analysis-based methods, such as Mahalanobis and ODIN, are able to maintain their performance on difficult datasets like CIFAR-100, while methods that are based on training on OOD data fail to do so. Figure 1 provides a better sense of how well GLOD separates the in-distribution and OOD samples; these graphs present the LLR scores of some of the GLOD models that were used in the comparison presented in Table 1. Figure 1: Visualization of the Log-Likelihood Ratio (LLR) scores for different GLOD models in Table 1.
Notice the separation between the in-distribution samples and out of distribution samples on CIFAR-100 plots. Figure 1 shows that OOD can be perfectly detected using the LLR score of GLOD. Although there are other methods that perform well on the proposed datasets, like Mahalanobis and SSL, none of them is able to fully separate OOD samples from in-distribution samples. In order to numerically demonstrate the superiority of GLOD over the other methods, we more rigorously examine the score assigned by the detection methods to the in-distribution and OOD samples. We observed that in some cases a large portion of the OOD samples can be assigned a score that is within 5% range of the in-distribution scores. Given this, we propose using the TNR99 metric in addition to the TNR95 metric. The TNR99 metric is similar to the TNR95 metric, but it forces the detection algorithm to detect almost all of the in-distribution samples correctly. We present a comparison of all the evaluated detection methods using the TNR99 metric in Table 2.

Limitations and Drawbacks
We found that on average, when training GLOD from scratch (random initilazation), in-distribution classification is 3% lower than a discriminative DNN. Better classification results can be achieved by initializing using a pretrained DNN as described in section 3.2, leading to a drop of only 1% classification accuracy.

Discussion and Conclusion
In this paper we introduced GLOD, a method based on a DNN whose final layer features a Gaussian density function and utilize a Log-Likelihood Ratio statistical test for OOD detection. GLOD does not include any auxiliary models and does not require OOD data for training. It performs OOD detection efficiently and accurately. We showed that GLOD surpasses state-of-the-art OOD detection methods on three vision datasets. We hypothesize that this design can be used for other problems like certainty estimations and active learning. We hope that in the future, real world applications will benefit from this method and the design considerations we applied to it.