PWLR: Pairwise Witness Local Rejection for Boundary-Aware Out-of-Distribution Detection
Authors: Chengyao Jia, Ruixuan Wang
Organizations: Guanghua School of Stomatology Sun Yat-sen University Guangzhou, China Guangdong Provincial Key Laboratory of Stomatology Guangzhou, China · School of Computer Science and Engineering Sun Yat-sen University Guangzhou, China Key Laboratory of Machine Intelligence and Advanced Computing, MOE Guangzhou, China
Out-of-distribution (OOD) detection remains challenging for image classifiers, especially when near-OOD samples lie close to in-distribution (ID) class boundaries. Recent vision-language detectors improve OOD detection through class semantics, local prompting, or LLM-generated outlier concepts, but seldom use language as explicit boundary evidence between confusing ID classes. We propose Pairwise Witness Local Rejection (PWLR), which uses an MLLM offline to describe visible local cues that favor one ID class over a specific rival class. These cue phrases are then screened with ID-only data under a frozen vision-language backbone, so that only reliable local verifiers are kept. At inference, PWLR first retains a small set of globally plausible classes, then checks whether any of them is locally supported against its most relevant rivals, and finally combines this pairwise local evidence with the global class score through calibration. Experiments on ImageNet-100 far-OOD, cleaner/challenging OOD and near-OOD benchmarks show that PWLR consistently improves strong vision-language baselines across multiple backbones. Source code will be released.
Figures & tables
Figure 1. Pipeline for pairwise witness generation. Each ID class is first assigned to a coarse visual family, after which a small set of visually confusable rival classes is selected for each anchor class. For each directed anchor-rival pair, a vision-capable MLLM then generates witness phrases that describe local evidence supporting the anchor against the rival, forming a witness bank for later comparative verification. A workflow diagram showing how ID class names are first grouped into coarse visual families, how rival classes are selected for each anchor class, and how GPT-5.1 generates directed witness phrases that are stored in a witness bank.
Figure 2. Pipeline for graph construction and filtering. Text representations and class prototypes are fused to define both global class plausibility and semantic rival neighborhoods. Each witness is then fitted on ID samples under the frozen VLM backbone, and only those whose local responses remain consistently higher on anchor-class samples than on rival-class and other-class samples are retained as reliable local verifiers.
Figure 3. Pipeline for pairwise local witness verification. Given a test image, the pipeline first retains a small set of globally plausible classes using the fused global score, and then verifies each retained class only against its active rivals in the semantic-pruned witness graph. For each directed class pair, witness responses are computed from local views, standardized, and aggregated into a directed support score.
Method
iNaturalist
SUN
Places
Texture
Average
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
MCM
3.72
98.86
13.94
96.00
18.52
94.85
19.06
95.24
13.81
96.24
GL-MCM
3.00
99.22
13.50
96.53
17.62
95.46
17.20
95.93
12.83
96.78
MSP
13.74
95.99
20.10
94.23
25.62
93.53
11.98
97.43
17.86
95.30
Energy
7.32
97.90
16.44
95.33
22.50
94.77
8.64
97.70
13.73
96.43
ReAct
6.04
98.29
13.94
96.00
20.86
95.14
8.82
97.58
12.41
96.75
Table 1. OOD detection performance (%) on the conventional far-OOD benchmark, with ImageNet-100 as ID dataset and iNaturalist, SUN, Places, Textures as OOD datasets. The best and second-best results are shown in bold and underline, respectively.
Method
OpenImage-O
ImageNet-O
NINCO
Average
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
MCM
9.10
97.69
16.16
95.83
29.64
94.90
18.30
96.14
GL-MCM
7.96
98.17
14.76
96.33
25.52
95.44
16.08
96.65
MSP
13.24
96.84
18.36
95.62
24.18
94.69
18.59
95.72
Energy
10.38
97.09
15.38
96.18
26.78
94.23
17.51
95.83
ReAct
8.28
97.45
13.42
96.52
28.16
94.17
16.62
96.05
Table 2. OOD detection performance on the more challenging OOD benchmark, with ImageNet-100 as ID dataset and OpenImage-O, ImageNet-O, NINCO as OOD datasets.
Architecture
Method
Pet18/19
CUB100/100
FPR95 ↓
AUROC ↑
FPR95 ↓
AUROC ↑
SigLIP2-L16-256
MCM
38.01
93.48
63.72
84.85
PWLR-MCM
27.77
94.99
60.07
85.29
MSP
27.02
94.07
73.14
78.24
PWLR-MSP
29.91
94.81
70.61
80.76
NegLabel
27.19
92.81
63.30
84.40
Table 3. Multi-backbone results of different plug-in variants on the split near-OOD benchmarks. We report FPR95/AUROC on Pet18/19 and CUB100/100 under three frozen vision-language backbones.
(a) Core branches
(b) Local comparison mechanisms
Global
Pairwise
Full
Reverse
Pruning
Full
Global Prior
✓
–
✓
Reverse Penalty
✓
–
✓
Pairwise Verification
–
✓
✓
Rival Pruning
–
✓
✓
FPR95 ↓
18.67
31.90
16.42
FPR95 ↓
16.64
16.90
16.42
AUROC ↑
95.13
93.69
96.23
AUROC ↑
96.23
96.20
96.44
Table 4. Ablation on the cleaner/challenging benchmarks. (a) Effect of the global prior branch and the pairwise witness verification branch. (b) Effect of two local comparison mechanisms: reverse-edge penalty and active rival pruning. In (b), both core branches are enabled by default.
λa
ρ
0.2
0.3
0.4
0.5
0.6
0.20
0.35
0.50
NegLabel FPR95 ↓
18.56
18.26
18.34
18.24
18.74
18.24
18.34
18.36
NegLabel AUROC ↑
95.73
95.93
96.07
96.16
96.16
96.09
96.07
96.07
CSP FPR95 ↓
20.82
20.54
20.06
19.56
20.06
20.04
20.06
20.16
CSP AUROC ↑
95.21
95.48
95.69
95.83
95.89
95.71
95.69
95.68
Table 5. Sensitivity analysis of the hyperparameters for PWLR-NegLabel and PWLR-CSP on the cleaner/challenging OOD benchmarks. Bold: best results within each hyperparameter scan. Underlined: the default settings used in the main experiments.
Statistic
Fixed support images
Directed pairs
500
Classes with outgoing pairs
100
Mean out-degree
5
Min out-degree
5
Max out-degree
5
Reverse-edge coverage
12%
Table 6. Statistics of the raw pairwise witness bank under the three-round prompting and cross-round merge protocol. For each directed pair (a,r) , we report the number of raw witness phrases accumulated across the three prompting rounds, the number of merged candidates after cross-round duplicate merging, and the average values of the visibility score and the context-risk score. The table also summarizes the induced directed rival structure at the raw-bank stage.
Statistic
Value
Evaluated directed edges
500
Surviving directed edges
493
Evaluated witness phrases
10890
Witnesses kept after ID-only screening
10575
Kept witnesses / surviving edge
21.45
Mean ew
1.679
Table 7. Statistics of the ID-only witness screening stage under the three-round witness bank. Starting from the directed witness bank constructed by three-round prompting and cross-round merge, the pipeline screens witness phrases on Dfit and retains only those that satisfy the mean-separation and tail-separation conditions in Section 2.2.
Statistic
Raw witness graph
Retained witness graph
Semantic-pruned rival subgraph
Directed edges
500
493
103
Classes with outgoing edges
100
100
100
Mean out-degree
5.00
4.93
1.03
Min out-degree
5.00
4.00
1.00
Max out-degree
5.00
5.00
2.00
Reverse-edge coverage
12.00%
10.76%
7.77%
Table 8. Graph statistics before and after the two contraction steps of the proposed pipeline. The retained witness graph is obtained after the ID-only screening stage, and the semantic-pruned rival subgraph is the final local comparison structure used by online pairwise verification.
Rejection reason
Count
Ratio
Tail-separation failure
272
86.35%
Both failures
43
13.65%
Table 9. Causes of witness rejection under the ID-only screening criteria in Section 2.2, based on the three-round witness bank. Rejected witnesses are categorized by whether they fail the mean-separation condition, the tail-separation condition, or both.
Plug-in
Base detector
PWLR
No pairwise local verification
Shuffled rival assignment
NegLabel
95.31 / 20.98
96.28 ± 0.09 / 16.97 ± 0.64
95.58 ± 0.17 / 20.25 ± 0.71
96.07 ± 0.05 / 19.15 ± 0.41
CSP
94.19 / 23.74
95.91 ± 0.09 / 18.49 ± 0.60
94.62 ± 0.27 / 22.01 ± 0.89
95.69 ± 0.18 / 20.97 ± 0.56
Table 10. Role of pairwise local verification on ImageNet-100 (ID) and NINCO (OOD) under fixed support images. Results are reported as AUROC/FPR95 (%).
Method
Generator
AUROC / FPR95
NegLabel
–
95.31 / 20.98
PWLR-NegLabel
GPT-5.1
96.28 ± 0.09 / 16.97 ± 0.64
PWLR-NegLabel
GPT-4o
96.37 ± 0.11 / 15.96 ± 0.73
PWLR-NegLabel
Qwen2.5-VL-7B
95.97 ± 0.15 / 17.20 ± 0.42
CSP
–
94.19 / 23.74
PWLR-CSP
GPT-5.1
95.91 ± 0.09 / 18.49 ± 0.60
Table 11. Comparison across different models for pairwise witness generation on ImageNet-100 (ID) and NINCO (OOD) under fixed support images. Results are reported as AUROC/FPR95 (%).
Method
Enc.
Score
Total
Peak Mem.
(ms/img)
(ms/img)
(ms/img)
(MB)
NegLabel
30.08
6.81
36.89
3978
CSP
56.03
28.97
85.01
4031
NNGuide
35.94
53.92
89.86
14069
SeTAR
154.82
12.70
167.51
14123
PWLR-NegLabel
130.37
33.41
163.78
5468
Table 12. Average inference overhead per image on a T4 GPU.
Stage
Model
Calls
Total tokens
Time
Family assignment
GPT-4o-mini
9
6,279
31.9 s
Rival selection
GPT-5.1
100
47,710
221.7 s
Witness generation
GPT-5.1
1,500
2,075,365
5.64 h
Total
–
1,609
2,129,354
5.71 h
Table 13. Offline construction cost for the ImageNet-100 witness bank.
Dataset
Method
Base
Main
B (mean ± std)
C (mean ± std)
All (mean ± std)
OpenImage-O
PWLR-NegLabel
97.93 / 10.64
98.60 / 6.72
98.79 ± 0.02 / 6.06 ± 0.05
98.75 ± 0.02 / 6.26 ± 0.14
98.74 ± 0.07 / 6.24 ± 0.25
PWLR-CSP
97.41 / 12.20
98.47 / 7.28
98.67 ± 0.01 / 6.57 ± 0.10
98.64 ± 0.02 / 6.91 ± 0.29
98.63 ± 0.07 / 6.82 ± 0.32
ImageNet-O
PWLR-NegLabel
96.36 / 16.46
97.16 / 12.56
97.45 ± 0.03 / 10.59 ± 0.55
97.41 ± 0.06 / 11.36 ± 0.51
97.39 ± 0.11 / 11.20 ± 0.83
PWLR-CSP
95.98 / 17.42
97.17 / 12.66
97.46 ± 0.03 / 10.63 ± 0.51
97.42 ± 0.04 / 11.23 ± 0.35
97.40 ± 0.11 / 11.18 ± 0.80
NINCO
PWLR-NegLabel
95.31 / 20.98
96.08 / 18.30
96.48 ± 0.06 / 15.72 ± 0.29
96.28 ± 0.09 / 16.97 ± 0.64
96.34 ± 0.16 / 16.62 ± 1.05
PWLR-CSP
94.19 / 23.74
95.70 / 20.18
96.11 ± 0.06 / 17.12 ± 0.45
95.91 ± 0.09 / 18.49 ± 0.60
95.97 ± 0.16 / 18.15 ± 1.21
Table 14. Stability under repeated witness generation on the more challenging benchmark with ImageNet-100 as the ID dataset. Entries are reported as AUROC/FPR95 (%). “Base” denotes the fixed base detector from the main paper. “Main” denotes the single instantiated witness bank reported in the main paper. “B” denotes three independent full witness-bank regenerations, while “C” denotes three independent regenerations with fixed support images. Repeated results are reported as mean ± std over three runs. “All” summarizes the main-paper witness bank together with B1–B3 and C1–C3.
Dataset
Method
Base
Main
B (mean ± std)
C (mean ± std)
All (mean ± std)
CUB100/100
PWLR-NegLabel
84.40 / 63.30
85.09 / 61.97
85.60 ± 0.55 / 61.14 ± 2.51
85.63 ± 0.10 / 60.53 ± 0.38
85.54 ± 0.38 / 61.00 ± 1.56
PWLR-CSP
84.34 / 64.21
85.19 / 61.89
86.11 ± 0.54 / 58.92 ± 2.57
86.16 ± 0.11 / 59.75 ± 0.77
86.00 ± 0.48 / 59.70 ± 1.87
Table 15. Stability under repeated witness generation on the CUB100/100 split under SigLIP2-L16-256. Entries are reported as AUROC/FPR95 (%). “Base” denotes the fixed base detector from the main manuscript. “Main” denotes the single instantiated witness bank reported in the main manuscript, using the corrected PWLR-CSP AUROC value of 85.19. “B” denotes three independent full witness-bank regenerations, while “C” denotes three independent regenerations with fixed support images. Repeated results are reported as mean ± std over three runs. “All” summarizes the corrected main-paper witness bank together with B1–B3 and C1–C3.
ID dataset
Method
iNaturalist
SUN
Places
Textures
Average
CUB-200-2011
MCM
99.79/0.78
99.85/0.59
99.67/0.74
99.87/0.50
99.80/0.65
GL-MCM
99.86/ 0.54
99.90 / 0.36
99.71/ 0.57
99.93 / 0.32
99.85/ 0.45
MSP
99.78/0.91
99.85/0.70
99.67/0.86
99.87/0.57
99.79/0.76
NegLabel
99.99 / 0.00
100.00 / 0.00
99.90 / 0.00
100.00 / 0.00
99.97 / 0.00
CSP
99.99 / 0.00
100.00 / 0.00
99.90 / 0.00
100.00 / 0.00
99.97 / 0.00
PWLR-CSP
100.00 / 0.00
100.00 / 0.00
99.96 / 0.00
100.00 / 0.00
99.99 / 0.00
Table 16. OOD detection performance on additional fine-grained ID datasets under the conventional far-OOD benchmark. Results are reported as AUROC/FPR95 (%). The best and second-best results are shown in bold and underline, respectively.
Recent studies show that using potential out-of-distribution (OOD) labels from large corpora as auxiliary information can improve OOD detection in vision-language models (VLMs). However, these methods often fail when real-world OOD samples fall outside the predefined OOD label set. To address this limitation, we propose DynProto, a novel approach that learns OOD prototypes dynamically during testing using only in-distribution (ID) information. DynProto is inspired by a key observation: OOD samples predicted as the same ID class tend to cluster in the feature space. With this insight, we leverage easy-to-detect OOD samples as ``anchors'' to find their harder-to-detect, similar counterparts. To this end, DynProto introduces two modules: Coarse OOD Pattern Capturing Module caches OOD patterns that are easily confused with each ID class during testing, and Fine-grained OOD Pattern Refinement Module subsequently clusters these patterns within each cache and aggregates them into representative OOD prototypes. By measuring similarity to ID and dynamic OOD prototypes, DynProto enables accurate OOD detection. DynProto significantly outperforms prior methods across multiple benchmarks. On ImageNet OOD benchmark, DynProto reduces FPR95 by 11.60% and improves AUROC by 4.70%. Moreover, the framework is architecture-agnostic and can be integrated into various backbones.
Yanqi Wu, Xinhua Lu, Runhe Lai +4
School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou 510275, China · Peng Cheng Laboratory, Shenzhen 518066, China · Key Laboratory of Machine Intelligence and Advanced Computing, MOE, Guangzhou 510275, China +2
Out-of-distribution (OOD) detection has emerged as a popular technique to enhance the reliability of machine learning models by identifying unexpected inputs from unknown classes. Recent progress in pre-trained vision-language models (VLMs) has enabled zero-shot OOD detection without access to in-distribution (ID) training data; in this setting, existing methods commonly treat text embeddings of class names as class prototypes. In this paper, we challenge the widely adopted text-as-prototype paradigm by theoretically showing that off-the-shelf textual prototypes are generally misaligned with the optimal visual prototypes, yielding an intrinsic modality gap that cannot be eliminated by prompt engineering alone. To mitigate this gap under the post-hoc constraint, this paper presents an online pseudo-supervised framework that directly learns class prototypes in the visual feature space using unlabeled test-time data streams and soft predictions from the pre-trained VLMs. We provide theoretical guarantees for the convergence of the online optimization procedure. Extensive experiments empirically demonstrate that our method achieves a new state of the art across a variety of OOD detection setups.
Yuanwei Hu, Bo Peng, Yadan Luo +3
University of Technology Sydney · The University of Queensland
Continual vision-language models (VLMs) encounter a stream of environments and must also reject inputs that do not belong to the environment at hand. Class information from earlier environments can aid out-of-distribution (OOD) detection, yet existing detectors score each environment in isolation, and when previous environments help or hurt is theoretically unclear. We develop a theory of environment-aware OOD detection built on contribution scores, pairwise cosine expectations measuring how the image and text features of one environment align with those of another. We propose a cross-environment maximum-concept-matching (MCM) score with two terms: a primary term matching the test image against the current class texts, and a secondary term matching it against the class texts of a previous environment, weighted by the intra-modal alignment between the two environments. We prove that, under a positive environment transition and a bounded class-matching margin for OOD inputs, this score attains a false-positive rate no larger than that of the standard MCM detector at an adjusted threshold. We then show that the score gap of an MCM detector between two environments equals the self-contribution of the in-distribution environment minus its cross-modal contribution into the OOD environment, which separates soft OOD environments, with explicit AUROC, true-positive, and false-positive guarantees, from hard ones, which no threshold that retains the in-distribution data can reliably reject. For cascaded detection, in which the text prototypes of all seen environments are pooled, the false-positive rate on every past environment is non-decreasing in time, and we characterize when detection provably fails. A contribution balance factor applied to the gradients of the classification loss and of a smoothed false-positive rate completes the framework.