Bounding Box Anomaly Scoring for simple and efficient Out-of-Distribution detection

Mohamed Bahi Yahiaoui; Geoffrey Daniel; Loïc Giraldi; Jérémie Bruyelle; Julyan Arbel

cs.LGMar 24, 2026

Bounding Box Anomaly Scoring for simple and efficient Out-of-Distribution detection

Authors: Mohamed Bahi Yahiaoui, Geoffrey Daniel, Loïc Giraldi, Jérémie Bruyelle, Julyan Arbel

Organizations: CEA, DES, IRESNE, DEC, SESC, Saint-Paul-lez-Durance, 13115, France · Université Paris-Saclay, CEA, SGLS, Gif-sur-Yvette, 91190, France · Université Grenoble Alpes, Inria, CNRS, Grenoble INP, LJK, Grenoble, 38000, France

Abstract

Out-of-distribution (OOD) detection aims to identify inputs that differ from the training distribution in order to reduce unreliable predictions by deep neural networks. Among post-hoc feature-space approaches, OOD detection is commonly performed by approximating the in-distribution support in the representation space of a pretrained network. Existing methods often reflect a trade-off between compact parametric models, such as Mahalanobis-based scores, and more flexible but reference-based methods, such as k-nearest neighbors. Bounding-box abstraction provides an attractive intermediate perspective by representing in-distribution support through compact axis-aligned summaries of hidden activations. In this paper, we introduce Bounding Box Anomaly Scoring (BBAS), a post-hoc OOD detection method that leverages bounding-box abstraction. BBAS combines graded anomaly scores based on interval exceedances, monitoring variables adapted to convolutional layers, and decoupled clustering and box construction for richer and multi-layer representations. Experiments on image-classification benchmarks show that BBAS provides robust separation between in-distribution and out-of-distribution samples while preserving the simplicity, compactness, and updateability of the bounding-box approach.

Figures & tables

Panel of Figure 1 — Figure 1: Complete BBAS pipeline processing: from constructing the monitor to runtime monitoring.

Panel of Figure 2 — Figure 2: Two-moons regression example illustrating the geometric interpretation of activation regions and cluster-wise bounding boxes for a ReLU neural network trained on $f(x)=\sin(\pi x_{1})+\sin(\pi x_{2})$ .

Panel of Figure 3 — Figure 3: t-SNE visualizations of different feature representations extracted from a ResNet trained on CIFAR-10. Across all representations, samples form compact, well-separated class clusters, demonstrating robust class-dependent structure.

Setting	CIFAR-10		CIFAR-100
Setting	Far-OOD $\uparrow$	Near-OOD $\uparrow$	Far-OOD $\uparrow$	Near-OOD $\uparrow$
a) Layer Choice
Penultimate only	92.52 $\pm$ 0.45	90.04 $\pm$ 0.35	83.48 $\pm$ 0.86	79.62 $\pm$ 0.34
Last 1 layer	92.94 $\pm$ 0.27	90.25 $\pm$ 0.36	84.74 $\pm$ 0.48	77.73 $\pm$ 0.61
Last 2 layers (default)	94.47 $\pm$ 0.24	90.67 $\pm$ 0.42	88.03 $\pm$ 0.66	77.45 $\pm$ 0.09
Last 3 layers	95.24 $\pm$ 0.33	90.75 $\pm$ 0.27	90.01 $\pm$ 0.32	77.05 $\pm$ 0.47

Table 1: Ablation study of layer selection, bounding-box feature, and clustering feature choices. We report AUROC (%) on Far-OOD (covariate and semantic shift) and Near-OOD (semantic shift only) datasets for CIFAR-10 and CIFAR-100. Bold values indicate the best performance within each ablation group.

Panel of Figure 4 — Figure 4: Effect of the clustering algorithm and the number of clusters per class on AUROC. Agglomerative clustering with complete linkage consistently yields the strongest performance for Far-OOD detection, while Near-OOD performance is less sensitive to the clustering choice.

Method	CIFAR-10		CIFAR-100		ImageNet-200		ImageNet-1K
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
General approach methods
MSP [ 17 ]	$31.72$	$90.73$	$58.70$	$77.76$	$35.43$	$90.13$	$51.45$	$85.23$
ODIN [ 33 ]	$57.62$	$87.96$	$58.86$	$79.28$	$34.23$	$91.71$	$43.96$	$89.47$
VIM [ 61 ]	$25.05$	$93.48$	$50.74$	$81.70$	$27.20$	$91.26$	$24.67$	$92.68$
GEN [ 35 ]	$34.73$	$91.35$	$56.71$	$79.68$	$32.10$	$91.36$	$35.61$	$89.76$

Table 2: Average performances on FarOOD benchmarks using ResNet architectures. Best performance is in bold , second best is underlined . We indicate a

-

when the result is not provided in the original paper of the method nor in the OpenOOD leader board.

Method	CIFAR-10		CIFAR-100		ImageNet-200		ImageNet-1K
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
General approach methods
MSP [ 17 ]	$48.17$	$88.03$	$54.80$	$80.27$	$54.82$	$83.34$	$65.68$	$76.02$
ODIN [ 33 ]	$76.19$	$82.87$	$57.91$	$79.90$	$66.76$	$80.27$	$72.50$	$74.75$
VIM [ 61 ]	$44.84$	$88.68$	$62.63$	$74.98$	$59.19$	$78.68$	$71.35$	$72.08$
GEN [ 35 ]	$53.67$	$88.20$	$54.42$	$81.31$	$55.20$	$83.68$	$65.32$	$76.85$

Table 3: Average performances on NearOOD benchmarks using ResNet architectures. Best performance is in bold , second best is underlined . We indicate a

-

when the result is not provided in the original paper of the method nor in the OpenOOD leader board.

Method	FarOOD		NearOOD
Method	ViT-B/16	Swin-T	ViT-B/16	Swin-T
General approach methods
MSP [ 17 ]	$86.04$	$86.30$	$73.52$	$76.75$
ODIN [ 33 ]	$-$	$73.29$	$-$	$68.15$
VIM [ 61 ]	$\mathbf{92.84}$	$\mathbf{93.20}$	$77.03$	$75.24$
SHE [ 66 ]	$92.42$	$89.84$	$76.11$	$76.59$

Table 4: Results for Transformer tests on ImageNet-1k (AUROC). Best performance is in bold , second best is underlined .

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Component	Time (in s)
Bounding-box construction	60
Model inference	46
Clustering	14
Bounding-box calculation	$<0.1$
Test-time post-processing (whole dataset)	4.8
Model inference	4

Appendix

Table 5: Runtime costs of the main components of the proposed pipeline on CIFAR-100, that are Bounding-box construction and Test-time post-processing on the whole dataset . Breakdown times into sub-components is reported under each.

Method	MNIST		SVHN		Textures		Places365		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$23.33\pm{\scriptstyle 4.67}$	$90.50\pm{\scriptstyle 0.44}$	$25.40\pm{\scriptstyle 1.47}$	$89.77\pm{\scriptstyle 0.45}$	$31.50\pm{\scriptstyle 4.05}$	$89.58\pm{\scriptstyle 0.60}$	$38.52\pm{\scriptstyle 2.27}$	$88.63\pm{\scriptstyle 0.28}$	$29.69\pm{\scriptstyle 1.21}$	$89.62\pm{\scriptstyle 0.19}$
MSP	$23.64\pm{\scriptstyle 5.81}$	$92.63\pm{\scriptstyle 1.57}$	$25.82\pm{\scriptstyle 1.64}$	$91.46\pm{\scriptstyle 0.40}$	$34.96\pm{\scriptstyle 4.64}$	$89.89\pm{\scriptstyle 0.71}$	$42.47\pm{\scriptstyle 3.81}$	$88.92\pm{\scriptstyle 0.47}$	$31.72\pm{\scriptstyle 1.84}$	$90.73\pm{\scriptstyle 0.43}$
TempScale	$23.53\pm{\scriptstyle 7.05}$	$93.11\pm{\scriptstyle 1.77}$	$26.97\pm{\scriptstyle 2.65}$	$91.66\pm{\scriptstyle 0.52}$	$38.16\pm{\scriptstyle 5.89}$	$90.01\pm{\scriptstyle 0.74}$	$45.27\pm{\scriptstyle 4.50}$	$89.11\pm{\scriptstyle 0.52}$	$33.48\pm{\scriptstyle 2.39}$	$90.97\pm{\scriptstyle 0.52}$
ODIN	$23.83\pm{\scriptstyle 12.34}$	$95.24\pm{\scriptstyle 1.96}$	$68.61\pm{\scriptstyle 0.52}$	$84.58\pm{\scriptstyle 0.77}$	$67.70\pm{\scriptstyle 11.06}$	$86.94\pm{\scriptstyle 2.26}$	$70.36\pm{\scriptstyle 6.96}$	$85.07\pm{\scriptstyle 1.24}$	$57.62\pm{\scriptstyle 4.24}$	$87.96\pm{\scriptstyle 0.61}$
MDS	$27.30\pm{\scriptstyle 3.55}$	$90.10\pm{\scriptstyle 2.41}$	$25.96\pm{\scriptstyle 2.52}$	$91.18\pm{\scriptstyle 0.47}$	$27.94\pm{\scriptstyle 4.20}$	$92.69\pm{\scriptstyle 1.06}$	$47.67\pm{\scriptstyle 4.54}$	$84.90\pm{\scriptstyle 2.54}$	$32.22\pm{\scriptstyle 3.40}$	$89.72\pm{\scriptstyle 1.36}$

Appendix

Table 6: CIFAR-10 FarOOD Benchmark results on the ResNet18 architecture.

Method	CIFAR-100		TIN		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$48.06\pm{\scriptstyle 3.25}$	$86.91\pm{\scriptstyle 0.31}$	$39.18\pm{\scriptstyle 1.44}$	$88.32\pm{\scriptstyle 0.28}$	$43.62\pm{\scriptstyle 2.27}$	$87.62\pm{\scriptstyle 0.29}$
MSP	$53.08\pm{\scriptstyle 4.86}$	$87.19\pm{\scriptstyle 0.33}$	$43.27\pm{\scriptstyle 3.00}$	$88.87\pm{\scriptstyle 0.19}$	$48.17\pm{\scriptstyle 3.92}$	$88.03\pm{\scriptstyle 0.25}$
TempScale	$55.81\pm{\scriptstyle 5.07}$	$87.17\pm{\scriptstyle 0.40}$	$46.11\pm{\scriptstyle 3.63}$	$89.00\pm{\scriptstyle 0.23}$	$50.96\pm{\scriptstyle 4.32}$	$88.09\pm{\scriptstyle 0.31}$
ODIN	$77.00\pm{\scriptstyle 5.74}$	$82.18\pm{\scriptstyle 1.87}$	$75.38\pm{\scriptstyle 6.42}$	$83.55\pm{\scriptstyle 1.84}$	$76.19\pm{\scriptstyle 6.08}$	$82.87\pm{\scriptstyle 1.85}$
MDS	$52.81\pm{\scriptstyle 3.62}$	$83.59\pm{\scriptstyle 2.27}$	$46.99\pm{\scriptstyle 4.36}$	$84.81\pm{\scriptstyle 2.53}$	$49.90\pm{\scriptstyle 3.98}$	$84.20\pm{\scriptstyle 2.40}$

Appendix

Table 7: CIFAR-10 NearOOD Benchmark results on the ResNet18 architecture

Method	MNIST		SVHN		Textures		Places365		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$53.82\pm{\scriptstyle 4.74}$	$76.01\pm{\scriptstyle 1.39}$	$53.20\pm{\scriptstyle 1.78}$	$82.07\pm{\scriptstyle 1.53}$	$56.12\pm{\scriptstyle 1.91}$	$80.56\pm{\scriptstyle 0.09}$	$\underline{54.85}\pm{\scriptstyle 1.42}$	$79.29\pm{\scriptstyle 0.40}$	$54.50\pm{\scriptstyle 0.68}$	$79.48\pm{\scriptstyle 0.41}$
MSP	$57.23\pm{\scriptstyle 4.68}$	$76.08\pm{\scriptstyle 1.86}$	$59.07\pm{\scriptstyle 2.53}$	$78.42\pm{\scriptstyle 0.89}$	$61.88\pm{\scriptstyle 1.28}$	$77.32\pm{\scriptstyle 0.71}$	$56.62\pm{\scriptstyle 0.87}$	$79.22\pm{\scriptstyle 0.29}$	$58.70\pm{\scriptstyle 1.06}$	$77.76\pm{\scriptstyle 0.44}$
TempScale	$56.05\pm{\scriptstyle 4.61}$	$77.27\pm{\scriptstyle 1.85}$	$57.71\pm{\scriptstyle 2.68}$	$79.79\pm{\scriptstyle 1.05}$	$61.56\pm{\scriptstyle 1.43}$	$78.11\pm{\scriptstyle 0.72}$	$56.46\pm{\scriptstyle 0.94}$	$79.80\pm{\scriptstyle 0.25}$	$57.94\pm{\scriptstyle 1.14}$	$78.74\pm{\scriptstyle 0.51}$
ODIN	$45.94\pm{\scriptstyle 3.29}$	$83.79\pm{\scriptstyle 1.31}$	$67.41\pm{\scriptstyle 3.88}$	$74.54\pm{\scriptstyle 0.76}$	$62.37\pm{\scriptstyle 2.96}$	$79.33\pm{\scriptstyle 1.08}$	$59.71\pm{\scriptstyle 0.92}$	$79.45\pm{\scriptstyle 0.26}$	$58.86\pm{\scriptstyle 0.79}$	$79.28\pm{\scriptstyle 0.21}$
MDS	$71.72\pm{\scriptstyle 2.94}$	$67.47\pm{\scriptstyle 0.81}$	$67.21\pm{\scriptstyle 6.09}$	$70.68\pm{\scriptstyle 6.40}$	$70.49\pm{\scriptstyle 2.48}$	$76.26\pm{\scriptstyle 0.69}$	$79.61\pm{\scriptstyle 0.34}$	$63.15\pm{\scriptstyle 0.49}$	$72.26\pm{\scriptstyle 1.56}$	$69.39\pm{\scriptstyle 1.39}$

Appendix

Table 8: CIFAR-100 FarOOD Benchmark results on the ResNet18 architecture

Method	CIFAR-10		TIN		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$60.17\pm{\scriptstyle 0.97}$	$74.38\pm{\scriptstyle 0.37}$	$52.99\pm{\scriptstyle 0.51}$	$78.44\pm{\scriptstyle 0.14}$	$56.58\pm{\scriptstyle 0.73}$	$76.41\pm{\scriptstyle 0.25}$
MSP	$58.91\pm{\scriptstyle 0.93}$	$78.47\pm{\scriptstyle 0.07}$	$50.70\pm{\scriptstyle 0.34}$	$82.07\pm{\scriptstyle 0.17}$	$54.80\pm{\scriptstyle 0.33}$	$80.27\pm{\scriptstyle 0.11}$
TempScale	$\mathbf{58.72}\pm{\scriptstyle 0.81}$	$79.02\pm{\scriptstyle 0.06}$	$50.26\pm{\scriptstyle 0.16}$	$82.79\pm{\scriptstyle 0.09}$	$\underline{54.49}\pm{\scriptstyle 0.48}$	$80.90\pm{\scriptstyle 0.07}$
ODIN	$60.64\pm{\scriptstyle 0.56}$	$78.18\pm{\scriptstyle 0.14}$	$55.19\pm{\scriptstyle 0.57}$	$81.63\pm{\scriptstyle 0.08}$	$57.91\pm{\scriptstyle 0.51}$	$79.90\pm{\scriptstyle 0.11}$
MDS	$88.00\pm{\scriptstyle 0.49}$	$55.87\pm{\scriptstyle 0.22}$	$79.05\pm{\scriptstyle 1.22}$	$61.50\pm{\scriptstyle 0.28}$	$83.53\pm{\scriptstyle 0.60}$	$58.69\pm{\scriptstyle 0.09}$

Appendix

Table 9: CIFAR-100 NearOOD Benchmark results on the ResNet18 architecture

Method	iNaturalist		Textures		OpenImage-O		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$24.53\pm{\scriptstyle 0.96}$	$92.32\pm{\scriptstyle 0.32}$	$36.80\pm{\scriptstyle 0.55}$	$90.21\pm{\scriptstyle 0.07}$	$38.03\pm{\scriptstyle 0.49}$	$88.07\pm{\scriptstyle 0.14}$	$33.12\pm{\scriptstyle 0.66}$	$90.20\pm{\scriptstyle 0.17}$
MSP	$26.48\pm{\scriptstyle 0.73}$	$92.80\pm{\scriptstyle 0.25}$	$44.58\pm{\scriptstyle 0.68}$	$88.36\pm{\scriptstyle 0.13}$	$35.23\pm{\scriptstyle 0.18}$	$89.24\pm{\scriptstyle 0.02}$	$35.43\pm{\scriptstyle 0.38}$	$90.13\pm{\scriptstyle 0.09}$
TempScale	$24.39\pm{\scriptstyle 0.79}$	$93.39\pm{\scriptstyle 0.25}$	$43.57\pm{\scriptstyle 0.77}$	$89.24\pm{\scriptstyle 0.11}$	$34.04\pm{\scriptstyle 0.31}$	$89.84\pm{\scriptstyle 0.02}$	$34.00\pm{\scriptstyle 0.37}$	$90.82\pm{\scriptstyle 0.09}$
ODIN	$22.39\pm{\scriptstyle 1.87}$	$94.37\pm{\scriptstyle 0.41}$	$42.99\pm{\scriptstyle 1.56}$	$90.65\pm{\scriptstyle 0.20}$	$37.30\pm{\scriptstyle 0.59}$	$90.11\pm{\scriptstyle 0.15}$	$34.23\pm{\scriptstyle 1.05}$	$91.71\pm{\scriptstyle 0.19}$
MDS	$58.53\pm{\scriptstyle 0.75}$	$75.03\pm{\scriptstyle 0.76}$	$58.16\pm{\scriptstyle 0.84}$	$79.25\pm{\scriptstyle 0.33}$	$68.29\pm{\scriptstyle 0.28}$	$69.87\pm{\scriptstyle 0.14}$	$61.66\pm{\scriptstyle 0.27}$	$74.72\pm{\scriptstyle 0.26}$

Appendix

Table 10: ImageNet-200 FarOOD Benchmark results on the ResNet18 architecture

Method	SSB-hard		NINCO		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$72.37\pm{\scriptstyle 0.11}$	$77.53\pm{\scriptstyle 0.08}$	$54.59\pm{\scriptstyle 0.54}$	$83.01\pm{\scriptstyle 0.17}$	$63.48\pm{\scriptstyle 0.25}$	$80.27\pm{\scriptstyle 0.10}$
MSP	$\mathbf{66.00}\pm{\scriptstyle 0.10}$	$80.38\pm{\scriptstyle 0.03}$	$43.65\pm{\scriptstyle 0.75}$	$86.29\pm{\scriptstyle 0.11}$	$54.82\pm{\scriptstyle 0.35}$	$83.34\pm{\scriptstyle 0.06}$
TempScale	$\underline{66.43}\pm{\scriptstyle 0.26}$	$80.71\pm{\scriptstyle 0.02}$	$\underline{43.21}\pm{\scriptstyle 0.70}$	$\underline{86.67}\pm{\scriptstyle 0.08}$	$\underline{54.82}\pm{\scriptstyle 0.23}$	$83.69\pm{\scriptstyle 0.04}$
ODIN	$73.51\pm{\scriptstyle 0.38}$	$77.19\pm{\scriptstyle 0.06}$	$60.00\pm{\scriptstyle 0.80}$	$83.34\pm{\scriptstyle 0.12}$	$66.76\pm{\scriptstyle 0.26}$	$80.27\pm{\scriptstyle 0.08}$
MDS	$83.65\pm{\scriptstyle 0.47}$	$58.38\pm{\scriptstyle 0.58}$	$74.57\pm{\scriptstyle 0.15}$	$65.48\pm{\scriptstyle 0.46}$	$79.11\pm{\scriptstyle 0.31}$	$61.93\pm{\scriptstyle 0.51}$

Appendix

Table 11: ImageNet-200 NearOOD Benchmark results on the ResNet18 architecture

Method	iNaturalist		Textures		OpenImage-O		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$25.29$	$92.05$	$40.26$	$88.10$	$37.39$	$87.62$	$34.31$	$89.26$
MSP	$43.34$	$88.41$	$60.87$	$82.43$	$50.13$	$84.86$	$51.45$	$85.23$
TempScale	$37.63$	$90.50$	$56.90$	$84.95$	$45.40$	$87.22$	$46.64$	$87.56$
ODIN	$35.98$	$91.17$	$49.24$	$89.00$	$46.67$	$88.23$	$43.96$	$89.47$
MDS	$73.81$	$63.67$	$42.79$	$89.80$	$72.15$	$69.27$	$62.92$	$74.25$

Appendix

Table 12: ImageNet-1k FarOOD Benchmark results on the ResNet50 architecture.

Method	SSB-hard		NINCO		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$77.33$	$71.37$	$60.81$	$78.17$	$69.07$	$74.77$
MSP	$74.49$	$72.09$	$56.88$	$79.95$	$65.68$	$76.02$
TempScale	$\underline{73.9}$	$72.87$	$55.1$	$81.41$	$64.5$	$77.14$
ODIN	$76.83$	$71.74$	$68.16$	$77.77$	$72.5$	$74.75$
MDS	$92.1$	$48.5$	$78.8$	$62.38$	$85.45$	$55.44$

Appendix

Table 13: ImageNet-1k NearOOD Benchmark results on the ResNet50 architecture.

Method	iNaturalist		Textures		OpenImage-O		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$19.62$	$94.93$	$73.07$	$85.52$	$73.82$	$87.36$	$55.5$	$89.27$
MSP	$42.4$	$88.19$	$56.46$	$85.06$	$56.19$	$84.86$	$51.69$	$86.04$
TempScale	$43.09$	$88.54$	$58.16$	$85.39$	$59.98$	$85.04$	$53.74$	$86.32$
ODIN	$-$	$-$	$-$	$-$	$-$	$-$	$-$	$-$
MDS	$20.64$	$96.01$	$38.91$	$89.41$	$30.35$	$\mathbf{92.38}$	$29.97$	$\mathbf{92.6}$

Appendix

Table 14: ImageNet-1k FarOOD benchmark results on the ViT-B/16 architecture.

Method	SSB-hard		NINCO		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$89.19$	$68.6$	$88.33$	$78.68$	$88.76$	$73.64$
MSP	$86.41$	$68.94$	$77.28$	$78.11$	$81.85$	$73.52$
TempScale	$87.35$	$68.55$	$81.88$	$77.8$	$84.62$	$73.18$
ODIN	$-$	$-$	$-$	$-$	$-$	$-$
MDS	$83.47$	$71.57$	$48.77$	$86.52$	$66.12$	$79.04$

Appendix

Table 15: ImageNet-1k NearOOD benchmark results on the ViT-B/16 architecture.

Method	iNaturalist		Textures		OpenImage-O		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$19.28$	$95.08$	$77.31$	$82.75$	$60.76$	$87.84$	$52.45$	$88.56$
MSP	$37.31$	$89.86$	$60.87$	$83.27$	$49.3$	$85.77$	$49.16$	$86.3$
TempScale	$36.66$	$90.37$	$62.55$	$83.68$	$50.93$	$86.14$	$50.05$	$86.73$
ODIN	$79.35$	$78.1$	$85.46$	$72.86$	$89.82$	$68.93$	$84.88$	$73.29$
MDS	$21.56$	$93.59$	$37.49$	$89.81$	$30.56$	$91.05$	$29.87$	$91.49$

Appendix

Table 16: ImageNet-1k FarOOD benchmark results on the Swin-T architecture.

Method	SSB-hard		NINCO		Average
Method	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$	FPR95 $\downarrow$	AUROC $\uparrow$
OpenMax	$85.5$	$71.56$	$72.58$	$81.66$	$79.04$	$76.61$
MSP	$80.9$	$71.78$	$61.21$	$81.72$	$71.06$	$76.75$
TempScale	$82.25$	$71.86$	$63.24$	$82.1$	$72.75$	$76.98$
ODIN	$86.45$	$66.94$	$86.05$	$69.35$	$86.25$	$68.15$
MDS	$83.6$	$68.61$	$53.71$	$81.75$	$68.65$	$75.18$

Appendix

Table 17: ImageNet-1k NearOOD benchmark results on the Swin-T architecture.

OOD Detection

Out-of-distribution (OOD) detection identifies inputs unlike a model’s training data so systems can flag uncertainty, reject inputs, or adapt safely.

See all 222 papers

Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection
Mar 24, 2026Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy +1OOD Detection
Missouri University of Science and Technology, Rolla, MO 65401, USA · Washington State University, Richland, WA 99354, USA
A Robust Out-of-Distribution Detection Framework via Synergistic Smoothing
May 5, 2026Maria Stoica, Abdelrahman Hekal, Alessio LomuscioAdversarial Robustness OOD Detection
Imperial College London · Zeroth Research
Sparse Autoencoders for Interpretable Out-of-Distribution Detection
Jul 13, 2026Ayush Karmacharya, Luke Luschwitz, Lucia Romero +2OOD Detection
Purdue University · EPFL

Mar 24, 2026J/K move · Enter open · S save

Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection

Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, Sanjay Madria

Missouri University of Science and Technology, Rolla, MO 65401, USA · Washington State University, Richland, WA 99354, USA

OOD Detection

Open paper AskPDF arXiv

Deep learning models are increasingly deployed in safety-critical applications, where reliable out-of-distribution (OOD) detection is essential to ensure robustness. Existing methods predominantly rely on the penultimate-layer activations of neural networks, assuming they encapsulate the most informative in-distribution (ID) representations. In this work, we revisit this assumption to show that intermediate layers encode equally rich and discriminative information for OOD detection. Based on this observation, we propose a simple yet effective model-agnostic approach that leverages internal representations across multiple layers. Our scheme aggregates features from successive convolutional blocks, computes class-wise mean embeddings, and applies L_2 normalization to form compact ID prototypes capturing class semantics. During inference, cosine similarity between test features and these prototypes serves as an OOD score--ID samples exhibit strong affinity to at least one prototype, whereas OOD samples remain uniformly distant. Extensive experiments on state-of-the-art OOD benchmarks across diverse architectures demonstrate that our approach delivers robust, architecture-agnostic performance and strong generalization for image classification. Notably, it improves AUROC by up to 4.41% and reduces FPR by 13.58%, highlighting multi-layer feature aggregation as a powerful yet underexplored signal for OOD detection, challenging the dominance of penultimate-layer-based methods. Our code is available at: https://github.com/sgchr273/cosine-layers.git.

Abstract

OOD Detection

Explore similar work

Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection

A Robust Out-of-Distribution Detection Framework via Synergistic Smoothing

Sparse Autoencoders for Interpretable Out-of-Distribution Detection