Research map / Label-efficient and robust learning / OOD and anomaly detection

Leveraging Perturbation Robustness to Enhance Out-of-Distribution Detection

CVPR 2025 · Label-efficient and robust learning › OOD and anomaly detection · approach: Spurious-aware OOD detection · 9 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Perturbation Rectified OOD (PRO), a post-hoc method that runs multi-step gradient descent on the input to minimize softmax-based OOD scores, exploiting that OOD confidence drops more under perturbation, and pairs it with adversarially robust models for improved near-OOD detection.

Problem

Out-of-distribution detection for image classifiers, especially the harder near-OOD setting, where softmax-based scores often assign high confidence to OOD inputs.

Approach

An adversarial score function g*(x) = min over bounded perturbations of g(x+δ), computed by sign-gradient descent with minimum taken over intermediate iterates, so that OOD scores drop more than IND scores; adversarially trained models make IND scores more stable, further separating the two.

Key results

• On a CIFAR-10 model with adversarial training (LRR), PRO-MSP-T reduces near-OOD average FPR@95 to 19.95 versus 32.85 for MSP, and beats the best prior baseline by more than 10 points.
• PRO variants achieve the best near-OOD FPR@95 and AUROC on CIFAR-10 default and robust models, and are competitive on CIFAR-100 near-OOD.
• On ImageNet-1K, PRO gives little benefit for far-OOD and its gains diminish as model scale and class count grow, with activation-based methods (Scale, ASH, ReAct) performing best there.

Measured effects reported in the paper

Surprising findings

• ODIN, which also uses gradient-based input perturbation, degrades MSP performance on CIFAR-10 and near-OOD settings, whereas PRO's minimization direction helps.
• PRO benefits even standard models without adversarial training, because standard training already yields smoother IND score landscapes.

Limitations

• PRO's gains shrink as model scale and class count increase (e.g., ImageNet-1K), since IND scores become more perturbation-sensitive.
• Requires per-benchmark search over perturbation size and step number on a validation set; the paper uses OOD-specific hyperparameter selection.
• Gains on far-OOD and ImageNet are limited; the approach is best suited to small-scale models.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 ImageNet-1K

Benchmarks: OpenOOD RobustBench CIFAR-100 TIN MNIST SVHN Texture Places365

Metrics: AUROC FPR@95

Baselines: MSP ODIN MDS GEN EBO VIM KNN ASH Scale GradNorm ReAct MLS

Builds on: ODIN Maximum Softmax Probability GEN OpenOOD RobustBench

Closest papers by meaning

• Splitting & Integrating: Out-of-Distribution Detection via Adversarial Gradient Attribution (ICML 2025 · similarity 0.91)
• Enhancing the Power of OOD Detection via Sample-Aware Model Selection (CVPR 2024 · similarity 0.89)
• Revisiting Logit Distributions for Reliable Out-of-Distribution Detection (NeurIPS 2025 · similarity 0.89)
• CADRef: Robust Out-of-Distribution Detection via Class-Aware Decoupled Relative Feature Leveraging (CVPR 2025 · similarity 0.89)
• The Best of Both Worlds: On the Dilemma of Out-of-distribution Detection (NeurIPS 2024 · similarity 0.89)
• SeTAR: Out-of-Distribution Detection with Selective Low-Rank Approximation (NeurIPS 2024 · similarity 0.89)