Research map / Label-efficient and robust learning / OOD and anomaly detection
Adversarially Robust Out-of-Distribution Detection Using Lyapunov-Stabilized Embeddings
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AROS, which combines a time-invariant neural ODE trained with Lyapunov-stability regularizers, fake OOD embeddings sampled from ID low-likelihood regions, and an orthogonal binary layer to make OOD detection robust to adversarial attacks without auxiliary OOD data.
Problem
OOD detectors are highly vulnerable to adversarial perturbations on both ID and OOD test inputs, and existing robust methods depend on auxiliary OOD datasets and adversarial training that are costly and fail to generalize.
Approach
Use a time-invariant NODE whose ID and fake-OOD embeddings are trained to be stable equilibria (via Lyapunov-based diagonal-dominance and norm regularizers), generate fake OOD embeddings from low-likelihood regions of ID class-conditional Gaussians, and separate equilibria with an orthogonal binary layer whose OOD probability is the score.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AROS instead of RODEO | OOD detection on CIFAR-10 vs CIFAR-100 · CIFAR-10 vs CIFAR-100, PGD^1000 | AUROC: 37.8 -> 80.1 | Helped |
| Use AROS instead of RODEO | OOD detection on CIFAR-100 vs CIFAR-10 · CIFAR-100 vs CIFAR-10, PGD^1000 | AUROC: 29.0 -> 67.0 | Helped |
| Use AROS instead of DHM | OOD detection on CIFAR-10 vs CIFAR-100 · CIFAR-10 vs CIFAR-100, clean | AUROC: 100.0 -> 88.2 | Hurt |
| Replace Lyapunov stability loss with cross-entropy loss (ablation) | AROS · CIFAR-10 vs CIFAR-100, PGD^1000 | AUROC: 80.1 -> 17.6 | Hurt |
| Use an adversarially trained backbone instead of standard training (ablation) | AROS · CIFAR-10 vs CIFAR-100, PGD^1000 | AUROC: 56.7 -> 80.1 | Helped |
| Use an orthogonal binary layer instead of a regular binary layer (ablation) | AROS · CIFAR-10 vs CIFAR-100, PGD^1000 | AUROC: 67.3 -> 80.1 | Helped |
| Use ID-conditioned fake OOD embeddings instead of random Gaussian noise (ablation) | AROS · CIFAR-10 vs CIFAR-100, PGD^1000 | AUROC: 76.5 -> 80.1 | Helped |
| Add Food-101 OOD images alongside fake OOD embeddings (ablation) | AROS · CIFAR-10 vs CIFAR-100, PGD^1000 | AUROC: 80.1 -> 81.6 | Helped |
Surprising findings
- DHM reaches near-zero AUROC under PGD attack despite the highest clean performance among methods on CIFAR-100 pairs.
- Random Gaussian fake OOD embeddings (Config D) are substantially less robust than the ID-conditioned fake OOD sampling, supporting nearby auxiliary OOD samples being more useful.
Limitations
- Clean-data performance trails state-of-the-art clean OOD detectors such as DHM by about 10 points.
- Adversarial robustness gains shrink under stronger perturbations (e.g., PGD-1000 at 16/255 drops CIFAR-10 vs CIFAR-100 to 70.3%).
- Backdoor detection results are modest on some attack types (e.g., 54.4% on GTSRB for WaNet).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet-1k SVHN Texture iNaturalist Places365 LSUN iSUN MNIST FMNIST Imagenette
Benchmarks: CIFAR-10 CIFAR-100 ImageNet-1k MNIST FMNIST Imagenette ADNI CIFAR-10-C CIFAR-100-C
Metrics: AUROC AUPR FPR95
Baselines: VOS DHM CATEX CSI ATOM ALOE ATD RODEO
Builds on: SODEF ODENet LyaDEQ ASODE outlier exposure
Closest papers by meaning
- Splitting & Integrating: Out-of-Distribution Detection via Adversarial Gradient Attribution (ICML 2025 · similarity 0.91)
- Leveraging Perturbation Robustness to Enhance Out-of-Distribution Detection (CVPR 2025 · similarity 0.91)
- OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shift (ICML 2024 · similarity 0.90)
- Detecting Out-of-Distribution Through the Lens of Neural Collapse (CVPR 2025 · similarity 0.89)
- Mysteries of the Deep: Role of Intermediate Representations in Out of Distribution Detection (NeurIPS 2025 · similarity 0.89)
- The Best of Both Worlds: On the Dilemma of Out-of-distribution Detection (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.