{'fraction_non_alphanumeric': 0.04163691386990377, 'fraction_numerical': 0.016627562990921146, 'mean_word_length': 4.568926339708389, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 2, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Igeood: An Information Geometry Approach to Out-of-Distribution Detection

Reliable out-of-distribution (OOD) detection is fundamental to implementing safer modern machine learning (ML) systems. In this paper, we introduce Igeood, an effective method for detecting OOD samples. Igeood applies to any pre-trained neural network, works under various degrees of access to the ML model, does not require OOD samples or assumptions on the OOD data but can also benefit (if available) from OOD samples. By building on the geodesic (Fisher-Rao) distance between the underlying data distributions, our discriminator can combine confidence scores from the logits outputs and the learned features of a deep neural network. Empirically, we show that Igeood outperforms competing state-of-the-art methods on a variety of network architectures and datasets.


INTRODUCTION
Deep neural networks (DNNs) reach the state-of-the-art in several classification tasks as they are known to generalize well on data with a distribution close to the training set. Whereas, in many practical applications, the training set does not reflect well enough the real-life environment (Quionero-Candela et al., 2009) which is often non-stationary and sometimes with unpredictable events. Therefore, matching the training scenario to reality can be impossible or too complex. The inability of machine learning (ML) models to adapt to non-stationary distributions could limit their adoption in mission-critical systems (e.g., autonomous devices, healthcare applications).
Out-of-Distribution (OOD) or novelty detection is one of the main objectives in conceiving reliable ML systems (Amodei et al., 2016). A typical application is monitoring ML-based online services for periodically shifting distributions. However, tracking changes in the underlying data distribution is challenging as they contain unusual (irregular or unexpected) events and have large dimensions. For instance, relying on the intrinsic properties of ML models and their statistical behavior in the presence of in-distribution data is essential to identify OOD samples. Classic approaches to OOD detection consist of deriving metrics for detecting those abnormalities from the lens of ML models (e.g., softmax output, latent representations across layers), provided that often only a single test example is available. Furthermore, these metrics are subject to potential limitations inherent in practical scenarios depending on the level of access to information in the ML model, e.g., having access only to the last layer or to all intermediate layers.
The baseline approach for OOD detection relies on the predictive uncertainty of DNNs. Hendrycks & Gimpel (2017) demonstrated that OOD samples, in general, induce DNN classifiers to output less confident softmax scores, while existing state-of-the-art methods on classification problems still output high accuracy even under dataset shift. For instance, Ovadia et al. (2019) show that as the accuracy of the underlying DNN increases, the supervisors' outlier detection accuracy also improves. Unfortunately, also the variance increases. Henriksson et al. (2021) observed that small changes in model parameters that marginally impact the accuracy could have a degrading impact on the performance of the OOD discriminator. This challenge is not exclusive to discriminative models. Deep generative models also fall short in discerning OOD from in-distribution samples. Nalisnick et al. (2019) raise awareness of the fact that deep generative models also may output a higher likelihood to OOD samples. They show that, even though the samples from the in-distribution CIFAR-10 (Krizhevsky et al., 2009) dataset (e.g., cats, dogs, airplanes, ships) are conceptually and visually different from house numbers from SVHN (Netzer et al., 2011) dataset, DNN-based classifiers may still assign a high likelihood to SVHN samples.
In this paper, we propose IGEOOD, a new unified and effective method to perform OOD detection by rigorously exploring the information-geometric properties of the feature space on various depths of a DNN. IGEOOD provides a flexible framework that applies to any pre-trained softmax neural classifier. A key ingredient of IGEOOD is the Fisher-Rao distance. This distance is used as an effective differential geometry tool for clustering and as a distance in the context of multivariate Gaussian pdfs (Pinele et al., 2020;Strapasson et al., 2016). In our context, we measure the dissimilarity between probability distributions (in and out), as the length of the shortest path within the manifold induced by the underlying class of distributions (i.e., the softmax probabilities of the neural classifier or the densities modeling the learned representations across the layers). By doing so, we can explore statistical invariances of the geometric properties of the learned features (Bronstein et al., 2021). Our method adapts to the various scenarios depending on the level of information access of the DNN and uses only in-distribution samples but can also benefit (if available) from OOD samples.

CONTRIBUTIONS
Our work investigates the problem of OOD detection and advances state-of-the-art in different ways.
i To the best of our knowledge, this is the first work studying information geometry tools to devise a unified metric for OOD detection. We derive an explicit characterization of the Fisher-Rao distance based on the information-geometric properties of the softmax probabilities of the neural classifier and the class of multivariate Gaussian pdfs. In general terms, our Fisher-Rao-based metric measures the mismatch-in the geometry space-between the probability density functions of the pre-trained DNN classifier conditioned on test and in-distribution samples. Section 3 details IGEOOD.
ii Experiments on BLACK-BOX and GREY-BOX setups using various datasets, architectures, and classification tasks show that IGEOOD is competitive with state-of-the-art methods. In the BLACK-BOX setup, we assume that only the outputs, i.e., the logits of the DNN, are available. In the GREY-BOX setup, we allow access to all parameters of the network; however, the detection must be performed using only the output softmax probabilities. The latter permits input pre-processing which introduces a small (additive) noise in the direction of the gradients w.r.t the test sample. This pre-processing allows for further discrimination between in-and out-of-distribution samples. Our benchmark contains two DNN architectures, three in-distribution datasets, and nine OOD datasets.
iii In a WHITE-BOX setting, we combine the logits with the low-level features of the DNN to leverage further useful statistical information of the encoded in-distribution data. We model the pre-trained latent representations as a mixture of Gaussian pdfs with a diagonal covariance matrix. Under this assumption, we derive a confidence score based on the Fisher-Rao distance between conditional pdfs corresponding to the test and the closest in-distribution samples. Experiments based on various datasets, architectures, and classification tasks clearly show consistent improvement of IGEOOD, achieving new state-of-the-art performance on a couple of benchmarks. In particular, we increased the average TNR at 95% TPR by 11.2% with tuning on OOD data and by 2.5% with tuning on adversarial data compared to Lee et al. (2018).

RELATED WORKS
OOD discriminators consist of a binary classifier to distinguish between in-and out-of-distribution samples. A few works (Shalev et al., 2018;Hendrycks et al., 2019;Bitterwolf et al., 2020;Mohseni et al., 2020;Winkens et al., 2020;Vyas et al., 2018;Hein et al., 2019) propose retraining the base (or an auxiliary) model with synthetic or ground truth OOD samples to serve as a classifier and as an OOD discriminator. Disposing of both OOD and in-distribution samples during training en-ables the latent representations to learn the decision boundaries to facilitate OOD detection. These methods will not be compared to ours in this work, as they entail retraining or modifying the base neural network by using OOD data to further train parameters. Nagarajan et al. (2021) studies failure modes of OOD detection methods to better understand how to improve them, especially how spurious features like the background can vastly degrade detection performance. Lee et al. (2021) leverage OOD data as a regularization technique to improve the generalization and robustness of current neural networks. References (Schlegl et al., 2017;Kirichenko et al., 2020;Choi & Jang, 2018;Vernekar et al., 2019;Xiao et al., 2020;Ren et al., 2019;Zhang et al., 2021;Mahmood et al., 2021;Zhang et al., 2020;Zisselman & Tamar, 2020) study OOD detection in the context of generative models for density estimation. Open set recognition (Bendale & Boult, 2016), outlier or anomaly detection (Pimentel et al., 2014), concept drift detection (Quionero-Candela et al., 2009), and adversarial attacks detection (Goodfellow et al., 2015;Madry et al., 2018) are related topics.

BLACK-BOX and GREY-BOX scenarios.
It is often the case on ML as a service (Ribeiro et al., 2015) that the model's parameters knowledge and access are not allowed to the end-user, granting access only to the computation of the forward and the logits or softmax outputs. The baseline work (Hendrycks & Gimpel, 2017) for BLACK-BOX techniques simply consider the unscaled maximum value of the softmax (MSP) as OOD score. In some cases, this confidence score is enough to distinguish between in-distribution and out-of-distribution examples, but it also may assign overconfident values to OOD examples (Hein et al., 2019). ODIN's (Liang et al., 2018) method has two variations. The BLACK-BOX variation consists of temperature scaling the softmax outputs. While the GREY-BOX variation also uses an input pre-processing technique that calculates the gradient of the model parameters and adds to the input in an adversarial manner for a more effective OOD detection. Hsu et al. (2020) proposes a variation of ODIN that does not need access to OOD data for validation. Liu et al. (2020) proposes an energy-based OOD score. They substitute the softmax confidence score with the free energy function with a temperature parameter without retraining. They also propose a GREY-BOX variation with posterior processing for improved results. Fine-tuning is done differently across the literature and should be considered when comparing methodologies.

WHITE-BOX scenario.
This class of OOD detectors has access to all intermediate layer outputs. Naturally, discriminators have access to more information than the BLACK-BOX or GREY-BOX setups, warranting greater detection capacity. Batch-normalization statistics between layers are used (Quintanilha et al., 2019) to fit a logistic regression that serves as an OOD detection score. Sastry & Oore (2020) proposes high order Gram matrices to perform OOD detection by computing class-conditional pairwise feature correlations between the test sample and the training set across the hidden layers of the network. Lee et al. (2018) assume that latent features of DNN models trained under the softmax score follow a class-conditional Gaussian mixture distribution with tied covariance matrix and different class-conditional mean vectors. They calculate the Mahalanobis distance between a test sample as a single estimator of the mean of a class-conditional Gaussian distribution with a tied covariance matrix estimated on the training set. The importance of each lowlevel component and hyperparameters are tuned using validation data. Ren et al. (2021) modifies this method to improve detection of near-OOD data. They fit the layer-wise background distribution with a Gaussian distribution fit from the training set. They subtract the Mahalanobis distance between the test example and this distribution from the score proposed in Lee et al. (2018), reducing the importance of features shared by in-and out-of-distribution data.

BACKGROUND
Let X ⊆ R d be the feature space (continuous) and Y a label space. Moreover, let p XY be the underlying unknown probability density function (pdf) over X × Y. We define the in-distribution . . , C} is the output class among C possible classes and N denotes the number of training samples. The training dataset is characterized by the joint pdf p XY with in-distribution marginals X ∼ p X and Y ∼ P Y . The predictor denoted by f D N : X → Y is based on the inferred model P Y |X , i.e., f D N (x) ≡ f n (x; D N ) arg max y∈Y P Y |X (y|x; D N ). In order to model the underlying problem, we introduce an artificial binary random variable Z ∈ {0, 1} indicating with z = 1 that the test sample x is OOD and otherwise, it is in-distribution. The openworld data can then be modeled as a mixture distribution p X|Z defined by p X|Z (x|z = 0)  p X (x), and p X|Z (x|z = 1) q X (x). The intrinsic difficulty arises from the fact that very little can be assumed about the unknown distributions p X and q X , in particular for out-of-distribution.

IGEOOD: OOD DETECTION USING THE FISHER-RAO DISTANCE
This section introduces IGEOOD, a flexible framework for OOD detection. IGEOOD is implemented in two ways: at the level of the logits using temperature scaling (Section 3.2), which mitigates the high-confidence scores assigned to OOD examples, and layer-wise level (Section 3.3). The key ingredient of IGEOOD is the Fisher-Rao distance that allows for effective differentiation between in-distribution and out-of-distribution samples. This distance measures the dissimilarity between two probability models within a class of probability distributions by calculating the geodesic distance between two points on the learned manifold. This measure connects information geometry and differential geometry through the R. Fisher information matrix (Fisher, 1922). Closed-form expressions of this distance are known to multivariate normal distributions under certain assumptions, among others distributions (Pinele et al., 2020).

MOTIVATION FOR THE USE OF THE FISHER-RAO DISTANCE FOR OOD DETECTION
We introduce a simple example to demonstrate conceptually how Fisher-Rao distance is instrumental to OOD detection. It should be noted that this example is limited to one dimension. However, we expect similar behavior with more complex data under the Gaussianity assumptions.
Consider the case where we try to distinguish between samples from distinct Gaussian distributions on 1D. Assume that the in-distribution data follows a Gaussian N (µ 1 , σ 1 ) while OOD data is drawn according to either N (µ 2 , σ 1 ) or N (µ 2 , σ 2 ). These distributions are illustrated in Figures 1a and 1b. In this setup, distance-based approaches which are invariant to the variance of the distributions would have the performance limited to the information given by the difference between the means of the underlying distributions. For instance, in the case of the Mahalanobis distance, we would rely our discrimination on the difference between the sample and the in-distribution mean, rescaled by the in-distribution standard deviation only, but nothing further could be obtained. However, if we can estimate OOD standard deviations from actual or pseudo OOD data, we expect the Fisher-Rao distance between Gaussian distributions to be more effective in distinguishing between distributions. Figure 1c shows that the Fisher-Rao distance distinguishes better between "In-dist." and "OOD II" samples, while the other distances fail.

IGEOOD SCORE USING THE SOFTMAX PROBABILITY
The Fisher-Rao distance (Atkinson & Mitchell, 1981) takes as input two probability distributions. For the classification problem, we can take the temperature T scaled softmax function (Eq. (1)) as an approximation of a class-conditional probability distribution: . . , f C and f y (·) denotes the y-th logits output value of the DNN classifier. The Fisher-Rao distance d FR−Logits between two distributions resulting from the softmax probability evaluated at two data points is (see Appendix A): Class conditional centroid estimation. We model the training dataset class-conditional posterior distribution by calculating the centroid of the logits representations of this set. Precisely, we compute the empirical centroid for the logits of each class y ∈ Y = {1, . . . , C} of the in-distribution training dataset D N corresponding to the Fisher-Rao distance, i.e., where N y is the amount of training examples with label y. We optimize this expression offline using SGD algorithm, where the parameter to be tuned is µ in the logits space. This is equivalent to finding the centroid of a cluster using the Fisher-Rao distance, after each example has been assigned to a cluster. Please refer to the appendix (see Section B) for further details on this optimization.
OOD and confidence score. Using the softmax probability, we can define a confidence score to be the minimum of the Fisher-Rao distance between f (x) and the class-conditional centroids. As a sanity check, we show empirically in the appendix (see Section C) that this confidence score does not degrade the in-distribution test classification accuracy. Thus, the estimated class y FR follows as: However, we obtained slightly better OOD detection performance by using Eq. (5) instead of the minimal value. A likely explanation would be that this metric uses extra information from the other logits dimensions. We provide an empirical study comparing both methods in the appendix (see Section E.1). Thus, we propose the Fisher-Rao distance-based OOD detection score FR 0 (x) for the logits to be the sum of the distances between f (x) and each individual class conditional centroid µ y given by Eq. (3). By taking the sum instead of the minimal distance, we leverage useful information related to the example's confidence score for each class y. We denote it by Input pre-processing. In consonance with the literature (Liang et al., 2018;Liu et al., 2020;Lee et al., 2018), we also perform input pre-processing to enhance the detection between in-distribution and OOD samples and potentially improve OOD detection performance for the GREY-BOX discriminator. We add small magnitude perturbations ε in a Fast Gradient-Sign Method-style (FGSM) (Goodfellow et al., 2015) to each test sample x to increase the proposed metric, that is: The OOD detector. The detector consists of a threshold-based function for discriminating between in-distribution and OOD data. This threshold δ and parameters are set so that the true positive rate, i.e., the in-distribution samples correctly classified as in-distribution, becomes 95%. Mathematically, the BLACK-BOX OOD detector g BB and the GREY-BOX OOD detector g GB writes:

IGEOOD SCORE LEVERAGING LATENT FEATURES
For each layer, we define a set of class-conditional Gaussian distributions with diagonal standard deviation matrix σ ( ) and class-conditional mean µ ( ) y , where y ∈ {1, . . . , C} and is the index of the latent feature. We compute the empirical estimates of these parameters according to where j ∈ {1, . . . , k}, k is the size of feature , and f ( ) (·) is the output of the network for feature . The Fisher-Rao distance ρ FR between two arbitrary univariate Gaussian pdfs N (µ 1 , σ 2 1 ) and N (µ 2 , σ 2 2 ) is given by (See Section A) Similarly, the Fisher-Rao distance d FR−Gauss between two multivariate Gaussian pdfs with diagonal standard deviation matrix is derived from the univariate case and is given by where k is the cardinality of the distributions N (µ, σ) and N (µ , σ ), µ i is the i-th component of the vector µ, and σ i,i is the entry with index (i, i) of the standard deviation matrix σ.
Experimental support for a diagonal Gaussian mixture model. It is known that intermediate features of a DNN can be valuable for detecting abnormal samples as demonstrated by Lee et al. (2018). Nonetheless, we observed that the latent features covariance matrices are often ill-conditioned and are diagonal dominant. In other words, the condition number of the covariance matrix often diverges, and the magnitude of the diagonal entry in a row is greater than or equal to the sum of all the other entries in that row for most rows. Thus, a diagonal covariance matrix will be a favorable compromise for OOD detection. See Appendix, Section B.3 for further details.
Fisher-Rao distance-based feature-wise confidence score. We derive a confidence score by applying the Fisher-Rao distance between the test sample x and the closest class-conditional diagonal Gaussian distribution. Contrarily to the logits, taking the sum did not improve results, so we kept the minimal distance. We can consider two scenarios: (i) We do not have access to any validation OOD data whatsoever. In this case, the natural choice is to model the test samples as Gaussian distribution with the same diagonal standard deviation as the learned representation, i.e., and (ii) we dispose of a validation OOD dataset on which the features' diagonal standard deviation matrices σ ( ) and the means µ ( ) can be estimated, as well as the quantity: This validation dataset could be obtained from a synthetic dataset, a dataset different from the testing one, or even by adversarially creating OOD data by attacking the classifier model on the training dataset. In the appendix (Section B), we include pseudo-codes for calculating the IGEOOD score for the BLACK-BOX, GREY-BOX, and WHITE-BOX settings.
Feature ensemble. To further improve performance, we combine the confidence scores of the logits and the ones from the low-level features through a linear combination. Similarly to the strategy in Lee et al. (2018), we choose the weights α 0 , α and α ∈ R by training a logistic regression detector using validation samples. Thus, we ensure that the metric emphasizes features that demonstrate a greater capacity for detecting abnormal samples. IGEOOD score for the WHITE-BOX setting is: where FR 0 is given by equation (5), FR is given by equation (11) and FR considers a different validation diagonal covariance matrix for the test samples (equation (12)). We also apply input pre-processing similarly to the GREY-BOX setting (equation (6)), obtaining FR( x) as final score.
Unified metric. For the three settings, the metric is the same but has different formulations given the family of the distributions. For the DNN outputs, we use the softmax posterior probability distribution formulation. For the intermediate layers, it is under the model of diagonal Gaussian pdfs. Therefore, we have derived a unified OOD detection framework that combines a single distance for both the softmax outputs and the latent features of a neural network. Figure 2 illustrates how each of the presented techniques contributes towards separating in-distribution and OOD samples. Additional histograms of the detection scores are relegated to the appendix (see Section F).

EXPERIMENTAL RESULTS
We show the effectiveness of IGEOOD comparing to state-of-the-art methods. Details about the experimental setup 1 and additional results are given in appendices (see Sections C, D, and E). For models pre-trained on CIFAR-10, data from CIFAR-100 and SVHN are also considered OOD; for models pre-trained on CIFAR-100, data from CIFAR-10 and SVHN are considered OOD, and for models pre-trained on SVHN, CIFAR-10 and CIFAR-100 datasets are considered OOD. We resize the images to dimension 32 × 32 by downsampling and applying center crop when needed. We only use test data for evaluation. Even though we ran experiments with image data, IGEOOD could be applied to any neural-based classification task.
We measure the effectiveness of the OOD detectors with three standard evaluation metrics: (i) The true negative rate at 95% true positive rate (TNR at TPR-95%); (ii) the area under the receiving operating curve (AUROC); and (iii) the area under the precision-recall curve (AUPR). We use the scores over the test set of in-distribution and OOD datasets to calculate them. For the BLACK-BOX and GREY-BOX experimental settings, we tune hyperparameters for all of the OOD detectors only based on the DNN classifier architecture, the in-distribution dataset, and a validation dataset. The iSUN (Xu et al., 2015) dataset is chosen as a source of OOD validation data, independently from OOD test data. We choose the parameters that maximize the TNR at TPR-95% on the validation OOD dataset. For the WHITE-BOX framework, we allow both the benchmark and our method to tune either on adversarially generated data from in-distribution training samples or a separate validation dataset containing 1, 000 images from the OOD test dataset with feature ensemble described in Section 3.3. In this case, we evaluate performance on the remaining test samples.

RESULTS FOR THE BLACK-BOX AND THE GREY-BOX SETUPS
For comparing IGEOOD under the hypothesis of a BLACK-BOX scenario, we consider the Baseline (Hendrycks & Gimpel, 2017) method, ODIN (Liang et al., 2018) with temperature scaling only, and the free-energy-based metric (Liu et al., 2020) with temperature scaling only. The results for the BLACK-BOX setting are available in Table 1, where we show the average and one standard deviation OOD detection performance for each of the eight OOD detection method in six different image classification contexts (couple DNN model and in-distribution dataset). The extended results for each OOD dataset can be found in Table 13. For comparison under the GREY-BOX assumption, we consider ODIN and the free-energy-based methods, both with input pre-processing. The results for the GREY-BOX setup are provided in the appendix (see Section E and Table 10). For the BLACK-BOX setting, IGEOOD slight improves the benchmark by less than 1% in TNR at TPR-95%. While for the GREY-BOX setting, results show IGEOOD is outperformed by <1% in a few benchmarks by ODIN, which is greatly improved by input pre-processing techniques. Temperature scaling and input pre-processing. We observed that low values of temperature and moderate noise magnitude yield better detection performance for IGEOOD on the logits. For most models and datasets, we obtained better results for temperatures between 1 and 6 and noise magnitudes below 0.002. Detailed results and the best hyperparameters found for each configuration, as well as figures of their impact on performance, are delegated to the appendix (see Section E).
How the choice of validation dataset impacts performance. We include in the appendix (see Section E) the average OOD detection performance for each method when we change the validation set among the nine available ones. We show that the average TNR at TPR-95% for IGEOOD ranges between 63% and 72% on a BLACK-BOX scenario and between 65% and 74% on a GREY-BOX scenario.
The performances among the compared methods are consistent across validation datasets. We consider two scenarios for tuning hyperparameters for both Mahalanobis and IGEOOD: one with adversarially generated (FGSM) and in-distribution data and another one with 1,000 OOD samples and in-distribution data. We derive two methods: IGEOOD+, which is given by equation (13) and considers that we can calculate the statistics from OOD data as additional information; and IGEOOD, which doesn't consider any prior on OOD data, i.e., set α = 0 on equation (13).

RESULTS FOR THE WHITE-BOX SETTING
Comparison with current literature. For each DNN model and in-distribution dataset pair, we report the average and one standard deviation OOD detection performance for Mahalanobis (Lee et al., 2018), IGEOOD and IGEOOD+. Table 2 validates the contributions of our techniques. We observe substantial performance improvement in all experiments for the left-hand side of the table, where we outperform Mahalanobis on average for all test cases. IGEOOD+ show improvements of at least 2.1% up to 23% on TNR at TPR-95%. Since the results are usually above 90%, these improvements are significant. To assess the consistency of IGEOOD to the choice of validation data, we measured the detection performance when all hyperparameters are tuned only using indistribution and generated adversarial data, as observed in the right-hand side of Table 2. IGEOOD record improvements up to 10.5%, and improves by 2.5% the average TNR at TPR-95% across all datasets and models. We provide an extra benchmark against other WHITE-BOX methods (Sastry & Oore, 2020; Hsu et al., 2020; Zisselman & Tamar, 2020) (see Table 11 in the appendix). Ablation study. IGEOOD has three components, FR 0 , FR , and FR , that together compose the final metric of equation (13). The outputs of the network provide limited OOD detection capacity as observed in Table 1. When available, the intermediate features, i.e., FR , are a valuable resource for OOD detection. Moreover, when few reliable OOD data are available, calculating FR can further improve the detection performance (left-hand side column of Table 2). Also, data from a source other than in-distribution, e.g., adversarial samples, is enough for tuning hyperparameters and combining features (right-hand side column of Table 2). The detection capacity of each hidden layer before any tuning is studied in Appendix B.4. Experiments show that the Fisher-Rao metric effectively separates in-and out-of-distribution data for each of the features individually as well.

SUMMARY AND CONCLUDING REMARKS
This paper introduces IGEOOD, an effective and flexible method for OOD detection that applies to any pre-trained neural network. The main feature of IGEOOD relies on the geodesic distance of the probabilistic manifold of the learned latent representations that induces an effective measure for OOD detection. First, in a (GREY-) BLACK-BOX setup, we calculate the sum of the Fisher-Rao distance between the softmax output, corresponding to the test (pre-processed) sample, and a reference probability, corresponding to the conditional-class of softmax probabilities. Similarly, in a WHITE-BOX setup, we model the low-level features of a DNN as a diagonal Gaussian mixture. The Fisher-Rao distance between the pdf of the latent feature, corresponding to the test sample, and a reference pdf, corresponding to the conditional-class of pdfs, provides an effective confidence score. We considered diverse testing environments where prior knowledge of OOD data may or may not be available, reflecting diverse application scenarios. It is observed that IGEOOD significantly and consistently improves the accuracy of OOD detection on several DNN architectures across various datasets for a WHITE-BOX setting. Some perspectives for future work include studying causal factors, explainable components for OOD detection, and extensions to textual data. Willke. Out-of-distribution detection using an ensemble of self supervised leave-out classifiers.

A REVIEW OF FISHER-RAO DISTANCE (FRD)
In this section, we review some results from references Atkinson & Mitchell (1981); Pinele et al. (2020). We intend to clarify some basic concepts surrounding the Fisher-Rao distance while motivating this measure in the context of OOD detection.
In few words, the Fisher-Rao's distance is given by the geodesic distance, i.e., the shortest path between points in a Riemannian space induced by a parametric family. Consider the family C of probability distributions over the class of discrete concepts or labels: We are interested in measuring the distance between probability distributions q θ (·|x) with respect to the testing input x and a population of inputs drawn accordingly to the in-distribution data set. To this end, we first need to characterize the Fisher-Rao distance for two inputs or for two probability distributions q θ , q θ ∈ C.
Assume that the following regularity conditions hold (Atkinson & Mitchell, 1981): Notice that if (i) holds, (ii) also holds immediately for discrete distributions over finite spaces (assuming that y∈Y and ∇ x are interchangeable operations) as in our case. When (i)-(iii) are met, the variance of the differential form ∇ x log q θ (Y |x)dx can be interpreted as the square of a differential arc length ds 2 in the space C, which yields Thus, G, which is the Fisher Information Matrix (FIM), can be adopted as a metric tensor. We now consider a curve γ : [0, 1] → X connecting a pair of arbitrary points x, x in the input space X , i.e., γ(0) = x and γ(1) = x . Notice that any curve γ induces a curve q θ (·|γ(t)) for t ∈ [0, 1] in the space C. The Fisher-Rao distance between the distributions q θ = q θ (·|x) and q θ = q θ (·|x ) will be denoted as d R,C (q θ , q θ ) and is formally defined by the expression: where the infimum is taken over all piecewise smooth curves. This means that the FRD is the length of the geodesic between points x and x using the FIM as the metric tensor. In general, the minimization of the functional in equation (15) is a problem that can be solved using the well-known Euler-Lagrange differential equation.

DISTRIBUTIONS
The direct computation of the FIM of the family C with q θ (y|x) in the form of the softmax probability distribution function given by equation (1) can be shown to be singular, i.e., rank(G(x)) ≤ C −1, where C − 1 is the number of degrees of freedom of the manifold C. To overcome this issue, we introduce the probability simplex P defined by Next, we consider the following parametrization for any distribution q ∈ P: From this expression, we consider the statistical manifold D = q(·|z) : z 2 = 4, z y ≥ 0, ∀y ∈ Y . Note that the parameter vector z belongs to the positive portion of a sphere of radius 2 and centered at the origin in R C . The computation of the FIM for z on D yields: where {e y } are the canonical basis vectors in R C and I is the identity matrix. From equation (18) we can conclude that the Fisher-Rao metric in this parametric space is equal to the Euclidean metric. Also, since the parameter vector lies on a sphere, the FRD between the distributions q = q(·|z) and q = q (·|z ) can be written as the radius of the sphere times the angle between the vectors z and z . Which leads to expression: Finally, we can compute the FRD for softmax distributions in C as obtaining the same form of equation (2). Notice that 0 ≤ d FR−Logits (q θ , q θ ) ≤ π for all x, x ∈ X ⊆ R C , being zero when q θ (·|x) = q θ (·|x ) and maximum when the vectors q θ (1|x), . . . , q θ (C|x) and q θ (1|x ) , . . . , q θ (C|x ) are orthogonal.

A.2 DERIVATION OF FISHER-RAO DISTANCE FOR MULTIVARIATE GAUSSIAN
DISTRIBUTIONS Consider a broader statistical manifold S {p θ = p(x; θ) : θ = (θ 1 , θ 2 , . . . , θ m ) ∈ Θ} of multivariate differential probability density functions. The Fisher information matrix G(θ) = [g ij (θ)] in this parametric space is provided by: Next, consider a multivariate Gaussian distribution: where x ∈ R k is the variable vector, µ ∈ R k is the mean vector, Σ ∈ P k (R) is the covariance matrix, and P k (R) is the space of k positive definite symmetric matrices. We can define the statistical manifold composed by these distributions as M = {p θ ; θ = (µ, Σ) ∈ R k ×P k (R)}. By substituting equation (22) in equation (21), we can derive the Fisher information matrix for this parametrization, obtaining: which induces the following square differential arc length in M: Here, dµ = (dµ 1 , . . . , dµ n ) ∈ R k and dΣ = [dσ ij ] ∈ P k (R). We observe that this metric is invariant to affine transformations (Pinele et al., 2020), i.e., for any (c, Q) ∈ R k × GL k (R), with GL k (R) the space of non-singular order k matrices, the map (µ, Σ) → Qµ + c, QΣQ is an isometry in M. Thus, the Fisher-Rao distance between two multivariate normal distributions with parameters θ 1 = (µ 1 , Σ 1 ) and θ 2 = (µ 2 , Σ 2 ) in M satisfies: (25) Unfortunately, a closed-form solution for the Fisher-Rao distance remains unknown. This is still an open problem for an arbitrary covariance matrix Σ and mean vector µ. Fortunately, the FRD is known for the univariate case and hence, for the submanifold where Σ is diagonal. Notice that in this case equation (24) admits an additive form.

B IGEOOD ALGORITHMS AND COMPUTATION DETAILS
In this section, we provide pseudo-code for calculating the IGEOOD score from the logits (Algorithm 1) and from the latent features (Algorithm 2). The BLACK-BOX IGEOOD score is obtained with Algorithm 1 by setting ε = 0, while the GREY-BOX IGEOOD score is obtained with ε > 0. We calculated the centroid of the logits for the in-distribution training set by optimizing the objective function given by equation (3) through a gradient descent algorithm for each DNN. We used a constant learning rate of 0.01 and a batch size of 128 for 100 epochs. Finally, the WHITE-BOX IGEOOD score is obtained by combining the outputs of Algorithms 1 and 2 through fitting the multiplicative weights α through a logistic function classifier on a labeled mixture dataset composed from in-and out-of-distribution data according to a validation dataset, which leads to expression equation (13).
Note that the calculation of the training logits centroids µ y , as well as the latent representations' mean vectors µ ( ) y and standard covariance matrices σ ( ) is performed beforehand, prior to inference. In this way, we retrieve the objects from memory at inference time. Also, we define k as the cardinality of feature , or |f ( ) | and ρ FR as the Fisher-Rao distance between univariate Gaussian distribution given by expression equation (9).
Algorithm 1: Evaluating IGEOOD score based on the logits. Input : Test sample x, temperature T and noise magnitude ε parameters, and training set . Output: FR 0 : IGEOOD score in the logits level.

Input : Test sample x and training set
// Online computation Compute the OOD score for :

B.1 LOGITS CENTROIDS ESTIMATION DETAILS
In order to obtain the logits centroids given the Fisher-Rao distance in the space of softmax probability distributions, we designed a simple optimization problem. This problem aims to minimize the average distance between the class conditional training samples and the centroids as given by equation (3). We initialized the C centroids, where C is the number of classes of a given model, with the identity matrix of size C × C. Note that the initial centroid for class i is given by the matrix's line number i. We minimized the expression in equation (3) with a gradient descent optimizer for 100 epochs with a fixed learning rate equal to 0.1 for every DNN model and in-distribution dataset.
The computation of the logits centroid is done offline, and the loss of the centroid estimation converges fast. We show in Table 3 the execution time for some operations in the OOD detection pipeline accelerated by one GPU. The left-hand column shows the offline computations needed to run our setup. They are as follow: • Save train set logits: We first do a forward pass through all the training sets and save in memory the resulting logits for a given network, which takes on average 83s for CIFAR-10 and CIFAR-100; • Centroid estimation: We load the training logits from memory and run the Gradient Descent algorithm, which takes on average 1.2s for CIFAR-10 and 11s for CIFAR-100; Algorithm 3: Evaluating feature-wise IGEOOD+ score.
for each feature ∈ {1, . . . , L} do // Offline computation Calculate class conditional means: µ ( ) Calculate the diagonal standard deviation matrix from training data: Calculate the diagonal standard deviation matrix from OOD data: // Online computation Compute the OOD scores for : The right-hand side of Table 3 shows the average online computation time for one test sample in a BLACK-BOX setting.
• Model inference: The average time needed to complete one forward pass for a DenseNet-BC-100 model is 28 ms and 19 ms for CIFAR-10 and CIFAR-100, respectively. • MSP and BLACK-BOX IGEOOD computations. Computing the OOD detection scores from the calculated softmax output is roughly 100 to 1000 times faster than the inference time taken by the model.
Hence, computing the Fisher-Rao distance between a test sample and the class-conditional centroids does not account for a considerable overhead in execution time. We model the latent output probability distributions as Gaussian distributions with diagonal covariance matrix calculated with equation (8). We chose this model motivated by a closed form for the FRD and by observing that the standard covariance matrix for the latent features is often illconditioned and diagonal dominant. The condition number of a matrix correlates to its numerical stability, i.e., a small rounding error in its estimation may cause a large difference in its values. So, a matrix with a low condition number is said to be well-conditioned, while a matrix with a high condition number is said to be ill-conditioned. We calculate the condition number of the covariance matrices with the formula κ(Σ) = Σ −1 ∞ Σ ∞ , where · ∞ is the infinity norm. For each of the four dense blocks outputs of a DenseNet trained on CIFAR-10, we obtained the condition numbers κ Σ = {2.8e10, 3.5e6, 3.1e5, 3.5e21}. While for the diagonal covariance matrix, we obtained smaller values of condition numbers: κ Σ D = {1.0e3, 3.0e1, 1.4e1, 7.6e20}. We associate the high value for the last feature mainly because the last feature is high dimensional and coarse, i.e., most of the values in the diagonal are close to zero.

B.3 GAUSSIANITY TEST OF THE HIDDEN LAYERS' OUTPUTS
In order to test if the Gaussian assumption is valid for the outputs of the hidden feature, we conduct a Shapiro & Wilk (1965) normality test for each coordinate of the features for the training data of a DenseNet model. We calculated the test's W statistic for each coordinate and class and averaged them. We chose a univariate normality test because they are often powerful and the problem is high dimensional, which would be unfavorable for a multivariate statistic test. Thus, this study should be considered with caution, given the considered hypothesis. In Figure 3, we also show the standardized histograms for the first coordinate of each layer. Note that, apart from the penultimate layer, if we consider the coordinates of the hidden features independently, the Gaussianity assumption holds, as we obtain a W statistics close to 1. However, for the last block, this assumption sometimes does not hold. Hence, modeling the penultimate layer with a more powerful density estimator, and using a metric that considers this more complex distribution, may be favorable for OOD detection.

B.4 FEATURE IMPORTANCE REGRESSION DETAILS
For both Mahalanobis and IGEOOD methods, we fitted a logistic regression model with crossvalidation using 1,000 OOD and 1,000 in-distribution data samples. Each regression parameter multiplies the layer scores outputs with the objective function of maximizing the TNR at TPR-95%. We set the maximum number of iterations to 100.
In order to investigate which hidden feature assists the most in OOD detection, we calculate the TNR at TPR-95% for the scores in the outputs of Blocks 1, 2 and 3 of a DenseNet pre-trained on CIFAR-10. We took as OOD data the SVHN dataset. Figure 4 shows the histogram and detection performance for each layer as well as the results from the logistic regression. Note that for the IGEOOD score in this study, we did not consider the logits.

C DETAILED EXPERIMENTAL SETUP C.1 DNN MODELS AND TRAINING DETAILS
We describe the DNN models used in the experiments: • DenseNet. Densely Connected Convolutional Networks (Huang et al., 2017), or DenseNet for short, are compositions of dense blocks, which are composed of multiple layers directly connected to every other layer in a feed-forward fashion. In this work, we use the DenseNet-BC-100 architecture. The BC stands for a model with 1x1 convolutional bottleneck (B) layers and channel number compression (C) of 0.5. The models have depth L = 100 and growth rate k = 12. We consider the outputs of each dense block after the transition layer (3 in total) and the first convolutional layer output as the latent features.
• ResNet. Residual Networks (He et al., 2016), or ResNet, are deep neural networks composed of residual blocks. Each residual block is composed of layers connected in a feed-forward manner plus a skip connection. We use the ResNet with 34 layers pretrained on CIFAR-10, CIFAR-100, and SVHN datasets. We take the output of every residual block (4 in total) and the first convolutional layer for calculating the score on   We train each model by minimizing the cross-entropy loss using SGD with Nesterov momentum equal to 0.9, weight decay equal to 0.0001, and a multi-step learning rate schedule starting at 0.1 for 300 epochs. The pre-trained models is available at 2 . We report their test set accuracy in Table  4 with the softmax function and by replacing it with the Fisher-Rao distance between the training class-conditional centroids and the test sample outputs. Also, it is worth noting that one high-end GPU is sufficient for running every experiment presented in this work.   We introduce below standard binary classification performance metrics used to evaluate the OOD discriminators.
• True Negative Rate at 95% True Positive Rate (TNR at TPR-95% (%)). This metric measures the true negative rate (TNR) at a specific true positive rate (TPR). The operating point is chosen such that the TPR of the in-distribution test set is fixed to some value, 95% in this case. Mathematically, let TP, TN, FP, and FN denote true positive, true negative, false positive and false negative, respectively. We measure TNR = TN/(FP + TN), when TPR = TP/(TP + FN) is 95%.
• Area Under the Receiver Operating Characteristic curve (AUROC (%)). The ROC curve is constructed by plotting the true positive rate (TPR) against the false positive rate (= FP/(FP + TN)) at various threshold values. The area under this curve tells how much the OOD discriminator can distinguish in-distribution and OOD data in a thresholdindependent manner.
• Area Under the Precision-Recall curve (AUPR (%)). The PR curve plots the precision (= TP/(TP + FP)) against the recall (= TP/(TP + FN)) by varying a threshold. For the experiments, in-distribution data are specified as positives while OOD data as negative.
Note that the TNR at TPR-95% is significant because we want to identify OOD data and preserve a sufficiently good performance on identifying in-distribution data, which is not the case for the other metrics.

C.3 DATASETS
We use natural image examples from the following image classification and synthetic datasets in our experiments. We normalize the test samples with the in-distribution dataset statistics.
• CIFAR-10. The CIFAR-10 (Krizhevsky et al., 2009) dataset is composed of 32 × 32 natural images of 10 different classes, e.g., airplane, ship, bird, etc. The training set comprises 50,000 images, and the test set is composed of 10,000 images. The classes are approximately equally distributed (5,000 examples each label). The CIFAR-10 dataset is under the MIT license.
• CIFAR-100. The CIFAR-100 (Krizhevsky et al., 2009) dataset contains similar natural images to the CIFAR-10 dataset, but with 90 additional categories. Its set repartition is 50,000 for training and 10,000 for the test set. We expect around 500 samples for each class of the training set. It is also under the MIT license.
• SVHN. The SVHN (Netzer et al., 2011) dataset collects street house numbers for digit classification. It contains 73,257 training and 26,032 test RGB images of size 32 × 32 of printed digits (from 0 to 9). We take only the first 10,000 examples of the test set for evaluating the methods to have a balanced dataset of in-distribution and out-of-distribution data. This dataset is subject to a non-commercial license.
• Tiny-ImageNet. The Tiny-ImageNet (Le & Yang, 2015) dataset is a subset of the largescale natural image dataset ImageNet (Deng et al., 2009). It contains 200 different classes and 10,000 test examples. We downsize the images from their original resolution to images of dimension 32 × 32 × 3.
• LSUN. The LSUN (Yu et al., 2015) dataset, which has equally 10,000 test examples, is used for the large-scale scene classification of different scene categories (e.g., bedroom, bridge, kitchen, etc.). Similarly, we resize the images following the same procedure for the Tiny-ImageNet dataset. LSUN is under the Apache 2.0 license. The test set has 8925 images, which we downsample to 32 × 32 × 3. We use this dataset as a source of OOD for validation purposes as an independent dataset from the test OOD data.
• Textures. The Describable Textures Dataset (DTD) (Cimpoi et al., 2014) is a collection of textural pattern images observed in nature. It contains 47 categories totaling 5640 images of various sizes, which are resized and center cropped to fit into the input size of 32 × 32.
• Chars74K. The Chars74K dataset (de Campos et al., 2009) contains 74,000 samples of 62 classes of characters found in natural images, handwritten text, and synthesized from computer fonts. We used as OOD data only the EnglishImg dataset split, which contains 7705 characters from natural scenes. We resized and center-cropped the images.
• Places365. The Places365 dataset (Zhou et al., 2017) contains images of 365 natural scenes categories. We used the small images validation split as OOD data in our experiments. It contains 36,500 RGB images which were downsampled from 256 × 256 to 32 × 32.
• Gaussian. For the Gaussian dataset, we generated 10,000 synthetic RGB images from 2D Gaussian noise, where each RGB pixel is sampled from an i.i.d Gaussian distribution with mean 0.5 and variance 1.0. The pixel values are clipped to [0, 1] interval. This synthetic data was introduced in previous work as an easy benchmark (Hendrycks & Gimpel, 2017).

C.4 ADVERSARIAL DATA GENERATION
We generate adversarial samples from the in-distribution dataset using the fast gradient sign method (FGSM). This method works by exploiting the gradients of the neural network to create a nontargeted adversarial attack. For an input image x i , the method computes the sign of the gradients of the loss function J with respect to the input image to create a new image x adv i that maximizes the loss as given by equation (29). This fabricated image is called an adversarial image, which we use for tuning the hyperparameters of the OOD detection methods in the WHITE-BOX case. Mathematically, where ε adv > 0 is the additive noise magnitude parameter. Table 5 shows the resulting L ∞ mean perturbation and classification accuracy on adversarial samples.

D BENCHMARK METHODS
This section briefly introduces the benchmark OOD detection methods with a standardized notation.

D.1 BASELINE
DNNs tend to assign lower confidence for OOD samples. So, calculating the Maximum Softmax Probability (MSP) (Hendrycks & Gimpel, 2017) is a natural baseline for OOD detection. In other words, provided an input data x, a pre-trained neural network f (·), and a confidence threshold δ, the OOD score, and the discriminator are given by y ∈Y e f y (x) and S(x; δ) = respectively. Here, f y (x) indicates the y-th logits output. A limitation of this method is that unscaled softmax posterior distributions are usually spiky, i.e., softmax trained deep neural models are incorrectly calibrated, which does not favor OOD detection (Lakshminarayanan et al., 2017).

D.2 ODIN: OOD DETECTOR FOR NEURAL NETWORKS
In summary, ODIN (Liang et al., 2018) explores the weaknesses of the MSP criterion by recalibrating the output's confidence to the task of OOD detection. They improve the MSP baseline by using the temperature scaled softmax function (equation (1)) instead. Also, ODIN adds small adversarial noise perturbation to the inputs, i.e., where ε is the perturbation magnitude. Hyperparameters T and ε are tuned on a validation dataset without requiring prior knowledge of test OOD data. They calculate the confidence score by taking the maximum of the perturbed input temperature scaled softmax outputs.

D.3 ENERGY-BASED OOD DETECTOR
An energy-based OOD discriminator is proposed by Liu et al. (2020), where the differences of energies between in-distribution and OOD samples allow for distribution distinction. The energy-based model substitutes the softmax function with the Helmholtz free energy equation to extract a confidence score. They observed that examples with higher energy have a low likelihood of occurrence, concluding that they are likely OOD. The free energy expression is: Note that, differently from ODIN and MSP, they use the information of all of the logits output values through the sum operation. Besides, they apply input pre-processing for further separating OOD data from in-distribution.

D.4 MAHALANOBIS DISTANCE-BASED CONFIDENCE SCORE
The Mahalanobis-based method in Lee et al. (2018) fits the DNN training data features as classconditional Gaussian distributions. These use the outputs of every DNN latent block to leverage useful information for discrimination. For a test sample x, the confidence score from the -th feature is calculated based on the Mahalanobis distance between f ( ) (x) and the closest class-conditional distribution: where f ( ) (x) is the -th latent feature output, and µ ( ) y and Σ are, respectively, the empirical class mean and covariance matrix estimates. The covariance matrix is often not full rank, so the pseudoinverse is calculated instead of the inverse. In addition, input pre-processing and feature ensemble are also used to boost performance. A logistic regression model learns the multiplicative weights α for each layer score, which predicts 1 for in-distribution and 0 for OOD examples from a mixture validation dataset. Finally, the Mahalanobis-based discriminator is given by thresholding expression α M (x). From Picot et al. (2021), the Kullback-Leibler divergence (KL) is connected to the Fisher-Rao distance between softmax probability distributions (d R,D ) by the inequality:

E.1 FISHER-RAO DISTANCE VERSUS KULLBACK-LEIBLER DIVERGENCE
To verify how the KL divergence would behave for OOD detection, we ran experiments with our BLACK-BOX setting, where we calculated the class conditional centroids with the KL divergence. We calculated the divergence of the test sample w.r.t each of these centroids during test time, then aggregated the results with a sum or by taking the minimal value. The results are displayed in Table  6. We can conclude from these experiments that taking the sum of the outputs instead of the minimal value is overall advantageous for Fisher-Rao distance and KL divergence.

E.2 HYPERPARAMETERS TUNING
For temperature T , we ran a Bayesian optimization for 500 epochs in the interval of temperature values between 1 and 1000, where the objective function was to maximize the TNR at TPR-95% metric for the validation set. We took the best temperature among five runs with different random seeds. For the input pre-processing noise magnitude ε tuning, we ran a grid search optimization with 21 equally spaced values in the interval [0, 0.002]. Table 7 shows the best hyperparameters we found for the methods in the BLACK-BOX, GREY-BOX, and WHITE-BOX settings.

E.3 TEMPERATURE SCALING AND NOISE MAGNITUDE PLOTS
In Figure 5 and 6, we plot on the left hand side column the effect of the temperature parameter in the performance for the BLACK-BOX setup. We set the noise magnitude to zero and measured the TNR at TPR-95% for 500 different temperatures values found by a Bayesian optimization for a variety of DNN models. The performance is evaluated on the iSUN dataset. The right hand side column of Figure 5 and 6 show the effect of the noise magnitude parameter in the performance of IGEOOD score in the GREY-BOX setup. We set the temperature to the best found in the BLACK-BOX case.
Then, we measured the OOD performance for 21 values of noise magnitude ε equally spaced in the interval [0, 0.004]. The best couple (T, ε) for each method and model is used to evaluate the GREY-BOX performances. The best hyperparameters found are detailed in Table 7.

E.4 CONSISTENCY OF IGEOOD SCORE CONCERNING THE CHOICE OF THE VALIDATION DATA
To verify the consistency of IGEOOD and other methods to the choice of validation data, we measured the TNR at TPR-95% after tuning our method in a BLACK-BOX and GREY-BOX scenario on nine validation datasets. In Table 8, the first column shows the validation dataset, while we used the remaining OOD datasets to evaluate performance. We obtained consistent results, ranging from 63.4% to 72.0% the average TNR at TPR-95% in the BLACK-BOX case and from 65.0% to 73.4% in the GREY-BOX setting. We show that input pre-processing provides mild amelioration for our method and can be considered a fine-tuning step.

E.5 ERROR BARS AND STANDARD DEVIATION
We conduct all of our experiments during inference time. Provided that we fix the DNN, the indistribution, and the out-of-distribution datasets, there is not a source of randomness to our algorithm because the weights α of the feature ensemble method and centroids are initialized deterministically. Thus, the OOD scores for the same experimental setting do not change. To confirm this, we ran the same experiment five times and obtained the same results in all of them. However, if we allow for retraining the DNN from scratch, we might obtain different parameters, leading to slightly different model accuracy and potentially OOD detection performance. With this in mind, we retrained a DenseNet-BC-100 model on CIFAR-10 five times with five different random seeds. The results for OOD detection in a BLACK-BOX setting for the 5 models can be found in Table 9.    Even though Lee et al. (2018) shares the closest setup to ours, recent literature also shows promising results for OOD detection in a WHITE-BOX setting, achieving state-of-the-art in a few benchmarks. Notably, the works from Sastry & Oore (2020); Hsu et al. (2020); Zisselman & Tamar (2020) achieve remarkable performance in a range of benchmarks. Thus, we gathered the reported results from the original works and displayed them in Table 11 and 12, which considers that a few OOD samples and only adversarial samples are available for tuning, respectively. We highlight that Sastry & Oore (2020) extracts, in addition to the outputs of the blocks, intra-block features for the ResNet and DenseNet models.

E.7 EXTENDED OOD DETECTION RESULTS
We show in Table 13 extended OOD detection results of Table 1. It contains the OOD detection performance for each model, in-distribution dataset and OOD dataset in a BLACK-BOX setting.
In Table 14, we show the performance of ODIN, energy-based, and IGEOOD scores in the task of OOD detection in a GREY-BOX setup for each OOD dataset. In Table 15 and 16, we show additional results referring to the right-hand column and left-hand column of