Research map / Adversarial robustness and security / Certified and empirical robustness
Splitting & Integrating: Out-of-Distribution Detection via Adversarial Gradient Attribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes S&I, a post-hoc OOD detector that splits intermediate layers and integrates adversarial-example attribution gradients along the path from adversarial examples to inputs.
Problem
Gradient-based OOD detection (e.g., GAIA) relies on non-zero attribution gradients, but these are poorly discriminative for OOD samples, especially under random perturbations in high-dimensional input space.
Approach
Use adversarial examples as attribution baselines instead of black images, update adversarial examples layer by layer with layer splitting, and integrate per-layer attribution gradients to obtain more faithful explanation patterns for ID vs OOD separation.
Key results
- Average FPR95 of 29.05% on CIFAR100 with ResNet34 (vs GAIA 29.10%) and 38.61% with WRN40 (vs GAIA 38.63%).
- Average FPR95 of 37.31% on ImageNet with BiT-S, versus 38.33% for GAIA (AUROC 91.84%).
- Gains over GAIA are marginal on CIFAR100 (about 0.05 to 0.02 points FPR95), and larger only on ImageNet (about 1 point).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use S&I instead of GAIA | OOD detection with ResNet34 · CIFAR100 (AVG) | FPR95: 29.1 -> 29.05 | Helped |
| Use S&I instead of GAIA | OOD detection with ResNet34 · CIFAR100 (AVG) | AUROC: 94.93 -> 94.93 | No clear effect |
| Use S&I instead of GAIA | OOD detection with WRN40 · CIFAR100 (AVG) | FPR95: 38.63 -> 38.61 | Helped |
| Use S&I instead of GAIA | OOD detection with WRN40 · CIFAR100 (AVG) | AUROC: 90.3 -> 90.3 | No clear effect |
| Use S&I instead of GAIA | OOD detection with BiT-S · ImageNet (AVG) | FPR95: 38.33 -> 37.31 | Helped |
| Use S&I instead of GAIA | OOD detection with BiT-S · ImageNet (AVG) | AUROC: 91.67 -> 91.84 | Helped |
| Add adversarial attacks (ablation) | S&I · OOD detection benchmarks | OOD detection performance | Helped |
| Add layer splitting (ablation) | S&I · OOD detection benchmarks | OOD detection performance | Helped |
Surprising findings
- On CIFAR100 the improvement over GAIA is negligible, which the authors attribute to low inter-class feature distinction in small label spaces limiting adversarial amplification.
Limitations
- Improvement over GAIA on CIFAR100 is marginal.
- Adversarial attack iterations add computational cost relative to single-pass gradient methods.
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNet-1K SVHN LSUN TinyImageNet Places Textures iNaturalist SUN
Benchmarks: CIFAR100 (CIFAR10 ID) OOD benchmark ImageNet-1K OOD benchmark
Metrics: FPR95 AUROC
Baselines: MSP ODIN Energy GradNorm Rankfeat ReAct GAIA
Builds on: GAIA Integrated Gradients BIG adversarial examples (FGSM-style iterative attack)
Closest papers by meaning
- GAIA: Delving into Gradient-based Attribution Abnormality for Out-of-distribution Detection (NeurIPS 2023 · similarity 0.93)
- Your Out-of-Distribution Detection Method is Not Robust! (NeurIPS 2022 · similarity 0.92)
- Leveraging Perturbation Robustness to Enhance Out-of-Distribution Detection (CVPR 2025 · similarity 0.91)
- Mysteries of the Deep: Role of Intermediate Representations in Out of Distribution Detection (NeurIPS 2025 · similarity 0.91)
- Detecting Out-of-Distribution Through the Lens of Neural Collapse (CVPR 2025 · similarity 0.90)
- Double Descent Meets Out-of-Distribution Detection: Theoretical Insights and Empirical Analysis on the Role of Model Complexity (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.