TriScore: Post-Hoc Out-of-Distribution Detection with Energy, Boundary Probes, and Transform Consistency

Ege Gursoy; Nicolas Mansard

cs.CVOct 19, 2026

TriScore: Post-Hoc Out-of-Distribution Detection with Energy, Boundary Probes, and Transform Consistency

Authors: Ege Gursoy, Nicolas Mansard

Organizations: LAAS-CNRS · ANITI

Abstract

Post-hoc out-of-distribution detection usually relies on a single signal extracted from a frozen classifier, such as confidence, energy, features, or gradients. This dependence becomes fragile under classifier-level adversarial shift, where the shift can preserve the detector's chosen cue while changing the model's decision behavior. We investigate whether this failure mode can be mitigated by combining complementary detection criteria instead of selecting a single score. We introduce TriScore, a post-hoc OOD detector that combines three ID-calibrated signals from the same frozen backbone: an energy prior, a boundary-fragility score, and a transform-consistency score. These signals are standardized on ID validation data and fused by an input-dependent ID-residual gate, requiring no OOD labels, auxiliary model, training, or stored feature bank. Across four ImageNet-scale backbones, TriScore achieves the best mean AUROC among 15 post-hoc baselines under a non-adaptive adversarial-shift protocol, while remaining competitive on standard OOD benchmarks. Ablations show that the gains come from combining complementary cues rather than optimizing a single detector signal. These results support multi-criterion post-hoc detection as a practical route toward more robust OOD detection under classifier-level shift. The source code is publicly available at github.com/gursoyege/TriScore.

Figures & tables

Figure 1: TriScore attaches to a frozen classifier. It computes class-centered energy, Boundary-Probe fragility, and transform consistency, then fuses the standardized branch scores using an ID-residual gate. Calibration uses ID validation data only.

Method	ResNet-50		RegNet		ViT-B/16		Swin-T
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	90.48	55.68	93.38	52.16	95.25	51.13	94.09	52.11
CADRef	87.62	58.70	87.47	58.92	89.86	56.81	82.30	62.64
DICE	92.28	53.04	87.80	61.08	87.52	59.35	88.16	65.24
EBO	91.67	54.60	82.76	70.29	91.98	59.57	91.61	59.40
GEN	90.92	55.50	81.36	70.16	84.68	61.99	80.65	65.43

Table 1: Non-adaptive adversarial-shift detection averaged over 10 classifier attacks for each backbone.

Method	ResNet-50		RegNet		ViT-B/16		Swin-T
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	41.45	86.96	64.65	76.43	95.61	52.38	94.88	45.55
CADRef	39.22	87.96	34.48	89.96	46.55	85.19	46.77	85.36
DICE	57.15	82.01	63.44	81.17	68.59	73.84	95.66	54.46
EBO	53.49	82.68	38.10	92.09	89.27	70.70	79.45	77.27
GEN	50.46	83.31	32.02	92.83	51.50	83.82	48.10	84.97

Table 2: Clean-OOD detection results for each backbone.

Appendix figures & tables43 assets

Supplementary material from the paper’s appendix.

Appendix

Attack	Objective	Norm	Implementation details
FGSM	classifier loss	$\ell_{\infty}$	OpenOOD/Foolbox default FGSM path
BIM	classifier loss	$\ell_{\infty}$	OpenOOD/Foolbox basic iterative attack
PGD	classifier loss	$\ell_{\infty}$	OpenOOD/Foolbox PGD defaults
PGD-BPDA	classifier loss	$\ell_{\infty}$	Foolbox LinfPGD with 100 steps through the BPDA model wrapper
AA	classifier loss	$\ell_{\infty}$	AutoAttack standard evaluation
APGD-CE	classifier cross-entropy	$\ell_{\infty}$	AutoAttack APGD-CE component

Appendix

Table 3: Adversarial-shift protocol used in the ImageNet attack tables.

Family	Score	Reference	Clean		Adversarial
			FPR@95	AUROC	FPR@95	AUROC
Energy	EBO	standard energy	63.23	81.82	89.50	60.97
Energy	E (Ours)	ID-centered energy	63.36	81.27	89.59	60.77
Boundary	Margin-only	top- $k$ margin only	50.94	83.96	87.03	58.86
Boundary	GradNorm	gradient baseline	84.19	55.70	93.66	50.06
Boundary	BP (Ours)	margin + late-feature gradient ratio	48.66	84.50	86.16	59.47

Appendix

Table 4: Branch-isolation results averaged.

Variant	Clean-OOD		Adversarial OOD
	FPR@95	AUROC	FPR@95	AUROC
E	65.0	80.8	89.5	61.0
E+TC	63.0	81.5	88.9	61.3
E+BP	58.9	81.9	83.1	64.0
BP	65.8	76.8	82.5	63.2
BP+TC	63.7	78.3	83.6	61.1

Appendix

Table 5: Branch-combination ablation averaged.

$k_{m}$	ResNet-50	RegNet	ViT-B/16	Swin-T
2	62.58	69.23	60.96	63.21
3	62.24	70.86	62.06	64.78
5 (default)	62.14	72.05	63.10	65.90
10	62.02	73.09	63.97	66.58

Appendix

Table 6: Top-

k_{m}

margin ablation, reporting adversarial AUROC scores.

Crop scale	ResNet-50	RegNet	ViT-B/16	Swin-T
0.8	63.14	71.95	63.12	65.93
0.9 (default)	62.14	72.05	63.10	65.90
0.95	61.61	72.08	63.10	65.87

Appendix

Table 7: Crop-scale ablation, reporting adversarial AUROC scores.

Transform pool	ResNet-50	RegNet	ViT-B/16	Swin-T
flip	61.32	72.85	63.02	68.07
flip+crop (default)	62.14	72.05	63.10	65.90
flip+crop+bright	62.39	69.98	62.22	64.01

Appendix

Table 8: Transform-pool ablation, reporting adversarial AUROC scores.

Backbone	Default	Grid min	Grid max	Range	Seed (mean $\pm$ std)
ResNet-50	62.10	61.61	62.33	0.72	$62.12\pm 0.03$
RegNet	72.01	71.74	72.18	0.44	$72.05\pm 0.04$
ViT-B/16	63.07	62.87	63.16	0.29	$63.08\pm 0.05$
Swin-T	65.84	65.41	66.57	1.16	$65.83\pm 0.07$

Appendix

Table 9: Gate grid and calibration sensitivity of the adversarial AUROC. Default is the published configuration

(0.90,0.70,0.70,s{=}0.6)

Method	Total (s)	Setup (s)	Setup note
ASH	40.5	0.0	-
CADRef	32.5	7.0	ID-train sweep.
DICE	23.5	4.3	ID-train sweep.
EBO	26.9	0.0	-
GEN	84.8	0.0	-
GradNorm	46.7	0.0	-

Appendix

Table 10: Runtime ablation on CIFAR-10 by method.

Fusion	ResNet-50	RegNet	ViT-B/16	Swin-T	Mean	Worst	Access
EBO+GradNorm+KNN	58.0	65.2	59.9	60.2	60.8	58.0	bank
GEN+ViM+GradNorm	57.5	65.6	61.5	65.9	62.6	57.5	ID-train
GEN+GradNorm+MSP	59.1	66.5	63.4	63.9	63.2	59.1	ID-val
GEN+KNN+MSP	61.1	71.7	64.5	69.7	66.8	61.1	bank
OOD-tuned logistic †	59.2	71.6	60.2	62.6	63.4	59.2	OOD
TriScore (ours)	62.1	72.1	63.1	65.9	65.8	62.1	ID-val

Appendix

Table 11: Fusions of existing detectors under the identical ID-only pipeline (10-attack mean). Mean / Worst are over the four backbones. Access : ID-val

=

ID-validation statistics only (bank-free, matched to TriScore), ID-train

=

ID-training statistics at setup, bank

=

additionally stores and searches the full ID-training feature bank at inference, OOD

=

uses OOD labels (out of setting).

\dagger

: OOD-tuned logistic.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
ASH	53.07	83.45	73.67	72.89	14.10	97.06	29.19	93.26	15.32	96.90
EBO	60.61	79.70	76.54	72.08	31.34	90.63	38.08	89.06	45.77	88.70
GEN	54.88	81.70	75.71	72.01	26.11	92.44	34.52	89.26	46.24	87.59
GradNorm	79.50	74.02	78.23	71.90	32.01	93.89	68.46	84.83	43.24	92.05
MLS	59.50	80.41	76.19	72.51	30.59	91.16	37.87	89.17	46.11	88.39
MSP	56.84	79.95	74.48	72.09	43.34	88.41	50.14	84.86	60.90	82.43

Appendix

Table 12: Clean-OOD detection results on ImageNet with ResNet-50.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
ASH	75.34	71.04	81.71	64.00	45.74	86.18	67.94	81.20	38.67	88.65
EBO	42.51	91.67	62.06	85.28	7.71	98.29	25.94	95.83	38.10	93.02
GEN	34.46	92.68	58.93	85.71	5.96	98.53	15.71	96.89	30.38	93.97
GradNorm	93.22	49.01	91.59	49.41	88.28	57.00	92.57	60.44	71.59	76.11
MLS	42.78	91.56	62.49	84.83	9.10	98.05	25.72	95.70	39.69	92.82
MSP	48.49	86.85	65.38	78.28	28.12	94.67	36.30	91.96	44.74	88.48

Appendix

Table 13: Clean-OOD detection results on ImageNet with RegNet.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
ASH	95.40	52.52	93.50	53.89	97.02	50.63	94.80	55.52	98.49	48.53
EBO	94.14	66.02	92.24	58.80	83.56	79.30	88.82	76.48	83.66	81.17
GEN	59.31	82.51	82.24	70.09	22.94	93.54	35.43	90.27	38.31	90.23
GradNorm	95.81	35.60	93.62	42.96	91.16	42.42	94.53	37.82	92.25	44.99
MLS	92.97	72.40	91.52	64.20	72.94	85.29	85.82	81.60	78.94	83.74
MSP	77.28	78.11	86.41	68.94	42.40	88.19	56.19	84.86	56.46	85.06

Appendix

Table 14: Clean-OOD detection results on ImageNet with ViT-B/16.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
ASH	94.38	47.07	95.70	45.87	94.24	46.62	93.74	45.64	96.16	41.66
EBO	79.16	78.25	87.45	68.21	61.52	85.13	80.81	79.86	84.45	78.96
GEN	48.04	85.18	79.19	72.75	20.51	94.23	32.69	90.56	44.57	88.15
GradNorm	94.07	44.81	93.57	50.36	95.12	38.23	96.99	33.47	97.73	34.71
MLS	75.00	80.89	86.52	70.44	49.19	88.99	74.45	83.72	79.80	81.68
MSP	61.21	81.72	80.90	71.78	37.31	89.86	49.30	85.77	60.87	83.27

Appendix

Table 15: Clean-OOD detection results on ImageNet with Swin-T.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	95.50	52.08	95.46	52.12	88.62	59.91	86.52	62.24	74.61	73.27	93.48	48.94	92.52	52.05	86.33	63.02	96.46	46.40	95.33	46.81
EBO	96.22	49.83	96.34	49.85	89.77	59.55	88.23	60.95	78.17	73.49	92.23	52.61	93.94	49.37	88.82	62.33	96.87	44.33	96.08	43.71
GEN	95.04	52.15	95.14	52.18	89.63	58.80	88.19	60.28	77.72	71.92	91.23	53.69	92.72	51.28	88.67	61.91	95.97	46.58	94.91	46.25
GradNorm	98.18	43.96	98.19	43.94	88.78	62.20	88.21	63.44	81.20	72.42	97.72	39.93	96.03	47.21	89.48	61.85	98.11	39.40	97.75	40.75
MLS	96.15	50.31	96.28	50.32	89.60	59.67	88.12	61.04	77.65	73.41	92.10	52.74	93.82	49.56	88.55	62.58	96.82	44.43	96.02	43.87

Appendix

Table 16: Adversarial OOD detection results on ImageNet with ResNet-50.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	95.11	49.71	95.12	49.68	90.58	57.64	90.33	58.88	92.61	52.04	96.32	43.86	92.55	54.19	92.86	54.67	94.81	48.94	93.49	52.02
EBO	80.84	71.82	80.53	71.85	86.99	66.25	87.16	66.17	79.07	73.26	83.12	71.50	84.02	68.27	83.47	70.84	80.70	72.28	81.68	70.69
GEN	78.85	71.96	78.72	71.96	86.68	65.39	86.87	65.40	77.92	72.74	80.49	72.38	83.52	67.61	80.83	71.60	78.85	72.30	80.86	70.27
GradNorm	96.38	43.47	96.36	43.42	91.11	55.95	91.14	56.31	94.50	47.00	97.08	35.45	93.81	50.82	94.29	47.88	96.54	42.78	95.13	47.35
MLS	80.98	70.76	80.69	70.78	87.13	65.30	87.28	65.23	79.33	72.34	83.40	70.36	84.20	67.36	83.62	69.76	80.98	71.27	81.93	69.66

Appendix

Table 17: Adversarial OOD detection results on ImageNet with RegNet.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	94.49	52.91	94.40	53.02	95.79	48.37	95.74	48.55	94.37	53.67	94.47	55.91	95.70	49.01	97.41	47.25	94.68	52.29	95.49	50.28
EBO	92.13	59.70	92.06	59.69	94.34	51.74	94.44	51.62	89.88	64.17	88.64	69.83	93.11	55.97	91.01	64.62	91.76	60.07	92.41	58.27
GEN	82.48	62.53	82.28	62.57	93.63	52.45	93.48	52.93	77.89	67.02	75.82	74.07	90.15	57.00	79.96	69.69	83.69	62.36	87.38	59.32
GradNorm	93.31	53.92	93.33	53.90	94.36	51.14	94.48	50.89	91.52	55.10	91.49	53.25	93.38	52.99	93.09	52.17	92.70	53.84	92.99	54.07
MLS	91.79	59.50	91.80	59.51	94.48	51.96	94.55	52.01	89.68	63.83	88.05	68.36	93.07	56.09	90.32	63.88	91.54	59.89	92.28	58.15

Appendix

Table 18: Adversarial OOD detection results on ImageNet with ViT-B/16.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	93.86	53.92	93.98	54.15	94.57	51.89	94.71	51.66	93.15	54.20	92.16	51.58	93.95	53.99	97.41	40.07	93.30	54.93	93.82	54.76
EBO	91.90	58.76	92.01	58.80	93.30	55.33	93.32	55.15	90.20	62.79	89.70	63.45	92.13	58.62	91.26	60.27	90.85	60.86	91.40	59.99
GEN	76.86	67.92	76.24	68.00	91.28	55.84	91.20	56.20	75.03	70.53	70.65	72.78	86.67	61.69	81.16	67.21	76.25	68.79	81.13	65.33
GradNorm	94.25	45.62	94.24	45.62	93.39	53.01	93.68	52.10	93.00	47.71	92.90	44.71	93.72	51.32	93.31	48.51	93.72	46.70	93.59	50.17
MLS	91.63	59.57	91.68	59.60	93.34	55.09	93.32	55.03	90.02	63.57	89.46	63.24	91.96	58.78	91.01	60.18	90.45	61.58	91.22	60.28

Appendix

Table 19: Adversarial OOD detection results on ImageNet with Swin-T.

Family	Score	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
Energy	EBO	60.56	79.70	76.52	72.08	31.30	90.63	38.07	89.06	45.81	88.70
Energy	E (Ours)	62.45	77.36	78.90	68.10	34.68	87.87	38.27	87.83	42.81	88.78
Boundary	Margin-only	52.92	81.13	73.27	73.17	39.39	87.63	45.75	84.89	57.99	82.15
Boundary	GradNorm	79.50	74.01	78.22	71.90	32.08	93.89	68.51	84.82	43.36	92.04
Boundary	BP (Ours)	51.17	81.75	74.43	72.56	37.36	88.04	42.13	85.93	51.64	84.12
Consistency	Argmax	100.00	64.23	100.00	57.80	100.00	68.88	100.00	63.41	100.00	63.21

Appendix

Table 20: Clean-OOD branch-isolation results on ImageNet with ResNet-50.

Family	Score	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
Energy	EBO	42.53	91.67	62.01	85.29	7.72	98.29	26.03	95.83	38.11	93.02
Energy	E (Ours)	42.95	91.25	65.25	83.53	8.72	98.08	22.39	96.18	36.57	93.68
Boundary	Margin-only	47.94	87.43	67.92	78.77	26.84	93.36	34.22	91.29	44.66	88.58
Boundary	GradNorm	93.25	49.01	91.59	49.42	88.22	56.99	92.57	60.44	71.55	76.12
Boundary	BP (Ours)	46.84	87.57	68.89	78.47	26.41	93.47	33.16	91.61	42.14	89.10
Consistency	Argmax	100.00	60.57	100.00	55.93	100.00	66.38	100.00	62.20	100.00	64.28

Appendix

Table 21: Clean-OOD branch-isolation results on ImageNet with RegNet.

Family	Score	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
Energy	EBO	94.18	66.02	92.22	58.80	83.64	79.30	88.82	76.48	83.62	81.16
Energy	E (Ours)	94.22	66.32	92.44	58.61	84.43	78.80	89.30	76.13	84.04	81.09
Boundary	Margin-only	56.21	81.73	80.51	71.71	36.66	88.94	43.16	86.82	47.94	85.96
Boundary	GradNorm	95.79	35.60	93.62	42.96	91.17	42.42	94.51	37.83	92.27	45.00
Boundary	BP (Ours)	55.05	82.21	84.06	70.18	32.82	89.80	37.28	88.20	39.98	87.98
Consistency	Argmax	100.00	63.69	100.00	57.13	100.00	69.96	100.00	65.58	100.00	65.16

Appendix

Table 22: Clean-OOD branch-isolation results on ImageNet with ViT-B/16.

Family	Score	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
Energy	EBO	79.16	78.25	87.45	68.21	61.52	85.13	80.81	79.86	84.45	78.96
Energy	E (Ours)	77.98	78.85	87.09	68.46	61.04	85.30	80.04	80.08	83.66	79.00
Boundary	Margin-only	53.15	82.92	76.26	73.17	34.94	89.42	44.08	86.53	54.91	83.60
Boundary	GradNorm	94.07	44.81	93.57	50.36	95.12	38.23	96.99	33.47	97.73	34.71
Boundary	BP (Ours)	51.10	83.35	80.31	72.19	32.31	90.01	38.74	87.81	47.37	85.60
Consistency	Argmax	100.00	63.36	100.00	56.37	100.00	69.78	100.00	63.47	100.00	64.23

Appendix

Table 23: Clean-OOD branch-isolation results on ImageNet with Swin-T.

Family	Score	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
		FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
Energy	EBO	96.22	49.83	96.34	49.85	89.78	59.55	88.23	60.95	78.17	73.49	92.23	52.61	93.95	49.37	88.82	62.33	96.86	44.32	96.07	43.71
Energy	E (Ours)	96.19	49.99	96.25	50.02	89.80	58.79	88.32	60.30	77.68	72.52	91.83	52.81	93.83	49.65	88.78	61.55	96.82	44.98	96.06	44.30
Boundary	Margin-only	89.82	57.27	89.90	57.26	88.25	59.41	87.25	60.35	74.34	70.47	87.62	55.56	86.01	55.01	86.57	63.08	91.23	50.39	89.29	50.88
Boundary	GradNorm	98.18	43.96	98.19	43.94	88.79	62.20	88.22	63.44	81.21	72.42	97.72	39.93	96.04	47.21	89.47	61.85	98.11	39.40	97.75	40.75
Boundary	BP (Ours)	89.36	57.97	89.36	57.97	87.78	59.40	86.26	60.55	74.35	70.38	86.49	56.31	85.99	55.72	86.64	63.23	91.82	50.99	89.37	51.65

Appendix

Table 24: Adversarial OOD branch-isolation results on ImageNet with ResNet-50.

Family	Score	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
		FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
Energy	EBO	80.82	71.83	80.51	71.85	87.02	66.25	87.17	66.17	79.08	73.27	83.11	71.50	84.05	68.26	83.47	70.84	80.69	72.28	81.69	70.69
Energy	E (Ours)	81.07	71.34	81.27	71.36	87.56	65.61	87.63	65.76	79.40	72.74	83.34	71.13	84.57	67.85	83.85	70.41	81.07	71.78	82.43	70.22
Boundary	Margin-only	85.44	61.71	85.42	61.69	88.25	58.08	88.86	57.87	84.67	64.34	85.23	61.78	87.86	59.85	85.54	61.12	85.40	62.75	86.53	61.17
Boundary	GradNorm	96.38	43.47	96.36	43.42	91.09	55.95	91.14	56.31	94.50	47.01	97.08	35.44	93.80	50.83	94.29	47.88	96.54	42.78	95.14	47.36
Boundary	BP (Ours)	84.79	61.86	84.74	61.85	87.84	58.08	88.52	57.94	84.24	64.40	84.34	61.98	87.52	59.93	84.85	61.36	84.70	62.90	85.96	61.28

Appendix

Table 25: Adversarial OOD branch-isolation results on ImageNet with RegNet.

Family	Score	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
		FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
Energy	EBO	92.11	59.70	92.03	59.69	94.34	51.74	94.42	51.62	89.89	64.17	88.64	69.83	93.10	55.97	90.98	64.62	91.76	60.07	92.41	58.27
Energy	E (Ours)	92.05	59.62	92.03	59.61	94.41	51.86	94.52	51.62	89.83	64.04	88.64	69.70	93.08	55.92	90.98	64.53	91.82	59.97	92.43	58.20
Boundary	Margin-only	88.99	56.52	88.74	56.50	94.07	52.13	94.12	52.49	86.84	60.16	82.32	62.49	92.32	54.94	85.03	59.52	89.39	57.19	91.02	55.90
Boundary	GradNorm	93.31	53.92	93.32	53.90	94.38	51.14	94.47	50.89	91.53	55.09	91.51	53.25	93.39	52.99	93.08	52.17	92.69	53.84	93.00	54.07
Boundary	BP (Ours)	88.73	57.08	88.66	57.07	94.54	51.69	94.20	52.37	86.36	60.70	80.37	64.89	92.57	54.85	83.41	61.29	89.27	57.60	91.25	55.95

Appendix

Table 26: Adversarial OOD branch-isolation results on ImageNet with ViT-B/16.

Family	Score	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
		FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
Energy	EBO	91.90	58.76	92.01	58.80	93.30	55.33	93.32	55.15	90.20	62.79	89.70	63.45	92.13	58.62	91.26	60.27	90.85	60.86	91.40	59.99
Energy	E (Ours)	91.92	58.63	91.97	58.67	93.31	55.36	93.34	55.09	90.29	62.62	89.82	63.27	92.07	58.52	91.24	60.11	90.83	60.70	91.40	59.86
Boundary	Margin-only	82.40	61.36	82.31	61.40	92.07	53.74	92.24	53.94	82.51	64.02	78.56	63.04	89.57	57.60	85.66	59.59	82.86	62.28	86.63	59.45
Boundary	GradNorm	94.25	45.62	94.24	45.62	93.39	53.01	93.68	52.10	93.00	47.71	92.90	44.71	93.72	51.32	93.31	48.51	93.72	46.70	93.59	50.17
Boundary	BP (Ours)	79.77	63.15	79.52	63.20	91.62	53.89	91.81	54.24	78.74	65.51	73.94	65.54	88.15	58.31	83.88	61.24	80.05	63.83	84.71	60.57

Appendix

Table 27: Adversarial OOD branch-isolation results on ImageNet with Swin-T.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
E	59.83	80.29	76.27	72.42	30.51	91.14	37.77	89.19	46.25	88.49
E+TC	57.28	80.38	75.95	71.98	31.68	87.16	37.99	84.97	46.50	83.40
E+BP	53.97	80.80	73.45	73.05	40.26	85.56	43.51	84.84	60.38	80.26
BP	60.32	77.23	77.69	70.24	63.22	76.27	65.43	76.70	88.86	68.20
BP+TC	60.14	78.00	77.48	70.22	61.10	78.82	64.16	77.15	88.39	70.35
TC	55.00	78.47	75.12	69.58	41.68	80.41	49.69	77.11	61.97	72.85

Appendix

Table 28: Clean-OOD branch-combination results on ImageNet with ResNet-50.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
E	42.55	91.67	62.09	85.28	7.72	98.29	25.95	95.83	38.18	93.02
E+TC	39.01	90.36	62.04	83.04	11.43	95.97	22.76	93.95	37.98	91.24
E+BP	38.26	90.31	57.99	83.21	18.23	95.94	25.38	94.32	40.61	90.38
BP	54.59	82.11	72.73	74.86	49.39	83.90	48.42	84.43	65.60	80.39
BP+TC	54.54	82.56	72.76	74.87	47.39	85.42	47.67	84.76	65.35	81.65
TC	48.79	83.53	71.03	75.30	27.51	87.52	37.38	84.69	47.17	84.40

Appendix

Table 29: Clean-OOD branch-combination results on ImageNet with RegNet.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
E	94.16	66.02	92.25	58.80	83.58	79.30	88.79	76.48	83.65	81.17
E+TC	92.75	74.06	91.38	64.90	70.60	85.60	85.33	81.59	78.72	83.09
E+BP	79.72	76.48	86.85	67.15	57.11	84.18	68.41	82.27	69.12	82.69
BP	57.88	79.59	82.42	68.94	52.28	81.40	53.77	80.93	72.90	76.66
BP+TC	55.94	81.52	82.39	69.18	45.92	85.36	49.63	82.67	67.14	79.05
TC	57.76	81.66	86.05	67.92	35.13	87.44	45.46	83.21	53.67	81.07

Appendix

Table 30: Clean-OOD branch-combination results on ImageNet with ViT-B/16.

Method	Near-OOD NINCO FPR@95	Near-OOD NINCO AUROC	Near-OOD SSB-Hard FPR@95	Near-OOD SSB-Hard AUROC	Far-OOD iNaturalist FPR@95	Far-OOD iNaturalist AUROC	Far-OOD OpenImage-O FPR@95	Far-OOD OpenImage-O AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
E	79.16	78.25	87.45	68.21	61.52	85.13	80.81	79.86	84.45	78.96
E+TC	77.44	80.30	87.16	69.55	54.52	87.00	78.30	81.40	82.39	79.74
E+BP	63.14	82.01	83.56	71.21	45.05	86.07	60.94	82.95	78.51	78.62
BP	60.92	79.45	82.87	69.04	54.24	80.63	57.85	79.82	83.24	72.41
BP+TC	57.45	81.53	82.78	69.74	45.14	84.75	52.14	81.55	79.50	75.46
TC	55.08	81.71	83.80	69.14	35.23	86.60	47.15	81.84	61.65	78.42

Appendix

Table 31: Clean-OOD branch-combination results on ImageNet with Swin-T.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
E	96.17	50.19	96.29	50.20	89.62	59.62	88.14	61.00	77.76	73.43	92.12	52.70	93.83	49.51	88.62	62.51	96.83	44.40	96.03	43.83
E+TC	93.19	59.92	93.22	59.97	89.56	57.93	88.16	58.98	76.00	69.79	89.32	60.58	91.24	59.10	88.30	60.58	94.45	58.84	93.59	57.27
E+BP	87.86	60.62	87.86	60.64	87.48	61.11	85.87	62.19	74.34	71.50	85.11	59.71	84.94	59.24	86.34	65.21	90.54	54.68	88.26	55.68
BP	75.11	69.48	74.81	69.49	87.06	60.53	87.48	61.09	81.92	66.44	79.87	64.37	76.24	66.56	86.71	64.97	74.08	65.01	74.03	66.40
BP+TC	75.18	69.47	74.90	69.51	87.10	58.89	87.51	59.39	81.75	66.15	79.94	65.35	76.36	66.95	86.74	62.50	74.21	67.75	74.19	67.58

Appendix

Table 32: Adversarial OOD branch-combination results on ImageNet with ResNet-50.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
E	80.84	71.82	80.53	71.85	86.99	66.25	87.16	66.17	79.07	73.26	83.12	71.50	84.02	68.27	83.47	70.84	80.70	72.28	81.68	70.69
E+TC	81.11	68.40	80.96	68.38	87.26	63.30	87.44	63.22	79.69	69.80	83.52	67.96	84.30	65.30	83.68	67.28	81.23	68.86	82.22	67.42
E+BP	69.84	72.46	70.37	72.45	80.82	65.89	81.24	65.84	74.79	71.49	75.20	70.72	77.30	68.62	75.81	70.01	71.03	73.03	73.39	71.19
BP	74.48	68.01	74.22	67.99	83.30	61.44	83.73	61.48	82.46	64.97	77.14	65.28	81.58	64.43	80.80	64.34	75.08	68.82	78.06	66.89
BP+TC	75.87	65.10	75.50	65.08	84.16	59.16	84.58	59.18	83.40	62.92	78.25	63.07	82.42	61.98	81.68	61.80	76.30	65.91	79.04	64.13

Appendix

Table 33: Adversarial OOD branch-combination results on ImageNet with RegNet.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
E	92.13	59.70	92.06	59.69	94.34	51.74	94.44	51.62	89.88	64.17	88.64	69.83	93.11	55.97	91.01	64.62	91.76	60.07	92.41	58.27
E+TC	91.38	59.28	91.35	59.29	94.33	52.09	94.36	52.06	88.75	63.16	87.04	68.23	92.74	55.94	89.68	63.55	91.04	59.60	91.89	57.94
E+BP	84.11	61.39	84.30	61.42	92.58	53.33	92.69	53.43	81.65	64.32	79.65	68.16	88.86	58.02	85.68	63.80	84.44	61.92	86.66	59.98
BP	86.18	59.19	86.33	59.21	92.59	53.27	92.82	53.49	85.81	60.71	82.89	62.57	89.48	57.08	87.97	59.25	86.67	59.98	88.14	58.36
BP+TC	86.20	58.45	86.34	58.48	92.59	53.03	92.82	53.25	85.81	59.88	82.91	61.71	89.49	56.45	87.98	58.67	86.68	59.07	88.13	57.62

Appendix

Table 34: Adversarial OOD branch-combination results on ImageNet with ViT-B/16.

Method	AA		APGD-CE		C&W		DF		FGSM		M-PGD		PGD		Square		BIM		PGD-BPDA
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
E	91.90	58.76	92.01	58.80	93.30	55.33	93.32	55.15	90.20	62.79	89.70	63.45	92.13	58.62	91.26	60.27	90.85	60.86	91.40	59.99
E+TC	91.76	58.66	91.90	58.70	93.27	54.76	93.29	54.69	90.31	61.97	89.43	62.09	92.02	57.96	90.81	59.58	90.66	60.46	91.47	59.27
E+BP	83.75	66.06	83.32	66.10	90.88	58.02	90.73	58.09	84.21	66.42	82.42	66.60	87.84	62.20	85.99	64.09	81.97	67.44	84.75	65.04
BP	78.83	67.45	78.99	67.44	89.52	57.66	89.74	57.99	82.28	64.99	79.16	64.50	85.92	61.55	85.69	62.90	79.71	67.91	82.41	64.90
BP+TC	83.12	61.60	82.80	61.58	91.33	53.97	91.45	54.13	85.56	60.49	85.07	58.49	88.92	56.86	88.33	57.25	83.12	62.06	86.06	59.38

Appendix

Table 35: Adversarial OOD branch-combination results on ImageNet with Swin-T.

$\lambda$	ResNet-50	RegNet	ViT-B/16	Swin-T
0.00	77.0	44.7	33.2	16.3
0.25	96.0	97.2	82.4	98.9
0.50	95.3	97.1	86.5	99.3
1.00	70.7	87.4	80.6	97.4
2.00	26.2	17.6	24.7	31.0
4.00	24.2	14.8	20.2	21.6

Appendix

Table 36: Adaptive attack: JOINT@5 (%) versus the trade-off

\lambda

, per backbone.

\lambda{=}0

is non-adaptive.

Backbone	$\lambda$	$n$	Mis.	Evade@5	Joint@5	$\ell_{\infty}$	LP-flip	LP-crop
ResNet-50	0.25	1512	99.8	96.2	96.0	$4/255$	90.0	86.3
RegNet	0.25	1706	100.0	97.2	97.2	$4/255$	96.6	95.2
ViT-B/16	0.50	1601	99.7	85.1	85.1	$4/255$	96.8	90.0
Swin-T	0.50	1621	100.0	99.4	99.4	$4/255$	96.6	90.8

Appendix

Table 37: Decomposition of the adaptive attack at the best

\lambda

, on the initially-correctly-classified population. Mis. : classifier misclassification rate, Evade@5 / Joint@5 : detector evasion and joint success at

5\%

ID FPR,

\ell_{\infty}

: realized per-image budget. LP-flip / LP-crop : ID-only label-preservation rate of the flip and crop views.

Backbone	1st pct.	50th pct.	99th pct.	floor ( $\\|g\\|_{2}^{2}\!\leq\!10\varepsilon$ )
ResNet-50	0.12	0.20	0.40	0.00%
RegNet	1.96	5.81	21.6	0.00%
ViT-B/16	0.46	2.20	10.7	0.00%
Swin-T	1.08	5.03	23.2	0.00%

Appendix

Table 38: Percentiles of the Boundary-Probe feature-gradient norm

\|g_{t}(x)\|_{2}

on the ID test split and the fraction of samples at the numerical floor.

Hook	Clean-OOD	Adversarial
layer2	79.67	62.14
layer3	79.76	62.93
layer4 (default)	80.50	64.08

Appendix

Table 39: Hook-location sensitivity of Boundary-Probe on ResNet-50 AUROC scores.

Panel	Backbone	BP	$1-\mathrm{MSP}$	BP $\mid$ MSP
A: ID misclass. (clean)	ResNet-50	78.4	77.5	58.7
	RegNet	81.4	83.9	55.2
	ViT-B/16	75.7	75.7	56.1
	Swin-T	73.5	77.8	51.8
B: OOD det. (adv.)	ResNet-50	60.1	59.7	55.2
	RegNet	70.5	61.4	70.0

Appendix

Table 40: Boundary-Probe versus softmax uncertainty (AUROC). "A" (clean): detecting ID misclassification. "B" (adversarial): OOD-versus-ID detection under attack.

	Clean ID			Under PGD
Backbone	$E+BP$	$E+TC$	$BP+TC$	$E+BP$	$E+TC$	$BP+TC$
ResNet-50	0.85	0.71	0.89	0.74	0.40	0.68
RegNet	0.30	0.51	0.68	0.44	0.55	0.73
ViT-B/16	0.27	0.31	0.78	0.30	0.34	0.79
Swin-T	0.45	0.50	0.76	0.50	0.58	0.76

Appendix

Table 41: Spearman

\rho

between standardized branches, on clean ID data and under PGD.

	Detection rate (%)				Unique detection (%)
Backbone	$E$	BP	TC	Fused	only $E$	only BP	only TC
ResNet-50	7.4	8.8	13.3	13.2	3.6	3.3	8.9
RegNet	16.9	12.9	8.0	10.5	9.2	3.6	1.6
ViT-B/16	6.8	8.3	6.3	6.4	2.9	3.2	2.7
Swin-T	7.8	10.2	6.0	6.8	2.5	3.8	2.4

Appendix

Table 42: FPR-controlled branch error overlap on the pooled adversarial splits. Fused is the gated TriScore at a matched

5\%

total ID FPR. Left block: adversarial detection rate (%). Right block: fraction detected only by that branch.

Backbone	TriScore	GEN	$\Delta$ (TriScore $-$ GEN)
ResNet-50	62.14 [61.90, 62.40]	55.58 [55.32, 55.87]	$+6.57$ [ $6.21$ , $6.93$ ]
RegNet	72.05 [71.78, 72.33]	70.17 [69.93, 70.41]	$+1.88$ [ $1.51$ , $2.26$ ]
ViT-B/16	63.10 [62.83, 63.38]	62.02 [61.73, 62.29]	$+1.09$ [ $0.71$ , $1.50$ ]
Swin-T	65.90 [65.61, 66.18]	65.46 [65.19, 65.76]	$+0.44$ [ $0.07$ , $0.82$ ]

Appendix

Table 43: Paired per-image bootstrap (

500

resamples) of the adversarial

10

-attack mean AUROC. Brackets are

95\%

percentile intervals,

\Delta

is the paired TriScore-GEN difference (+ favours TriScore).

Method	Near-OOD Tiny ImageNet FPR@95	Near-OOD Tiny ImageNet AUROC	Far-OOD MNIST FPR@95	Far-OOD MNIST AUROC	Far-OOD Places365 FPR@95	Far-OOD Places365 AUROC	Far-OOD SVHN FPR@95	Far-OOD SVHN AUROC	Far-OOD Textures FPR@95	Far-OOD Textures AUROC
ASH	88.09	75.58	67.89	84.07	67.82	85.08	83.79	70.21	87.06	74.06
EBO	62.41	88.31	15.49	96.32	56.38	89.64	30.13	92.38	60.22	88.64
GEN	51.82	88.87	18.01	95.00	45.81	89.74	24.76	92.04	45.87	89.36
GradNorm	95.09	54.80	78.93	70.06	89.42	67.95	91.03	49.90	98.00	46.29
MLS	62.41	88.22	15.53	96.12	56.37	89.51	30.13	92.24	60.08	88.55
MSP	47.20	88.64	19.21	93.95	41.83	89.35	24.24	91.57	40.43	89.13

Appendix

Table 44: Clean-OOD detection results on CIFAR-10 with ResNet-18.

Method	CIFAR-6		CIFAR-50		TIN-20		MNIST-6
	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC	FPR@95	AUROC
ASH	75.14	84.76	54.25	82.14	65.57	73.74	8.65	97.79
EBO	75.14	84.76	54.25	82.14	65.57	73.74	8.65	97.79
GEN	73.77	85.16	54.03	82.24	65.13	73.79	9.75	97.57
GradNorm	91.92	63.61	86.28	68.13	81.54	69.65	36.16	93.50
MLS	75.14	84.74	54.14	82.10	65.13	73.64	8.77	97.74

Appendix

Table 45: Open-set Recognition Results.

OOD Detection

Out-of-distribution (OOD) detection identifies inputs unlike a model’s training data so systems can flag uncertainty, reject inputs, or adapt safely.

See all 215 papers

May 5, 2026

A Robust Out-of-Distribution Detection Framework via Synergistic Smoothing

Reliable out-of-distribution (OOD) detection is a critical requirement for the safe deployment of machine learning systems. Despite recent progress, state-of-the-art OOD detectors are highly susceptible to adversarial attacks, which undermines their trustworthiness in automated systems. To address this vulnerability, we apply median smoothing to baseline OOD detection scores, balancing clean and adversarial accuracies. Our key insight is that the noisy samples generated for median smoothing can be repurposed to quantify the local instability of the base score. We observe that OOD samples exhibit higher instability under perturbation. Based on this, we propose ROSS, a novel and robust post-hoc OOD detector that leverages the instability of baseline scores to further distinguish between in-distribution (ID) and OOD samples. ROSS achieves symmetric robustness, performing strongly against both score-minimising and score-maximising attacks, unlike prior work. This symmetric defence leads to state-of-the-art robustness, outperforming prior methods by up to 40 AUROC points. We demonstrate ROSS's effectiveness on extensive experiments across CIFAR-10, CIFAR-100, and ImageNet. Code is available at: https://github.com/Abdu-Hekal/ROSS.

Maria Stoica, Abdelrahman Hekal, Alessio Lomuscio

Imperial College London · Zeroth Research

Adversarial Robustness OOD Detection

Ask PDF

Mar 27, 2026

Ranked Activation Shift for Post-Hoc Out-of-Distribution Detection

State-of-the-art post-hoc out-of-distribution detection methods rely on intermediate layer activation editing. However, they exhibit inconsistent performance across datasets and models. We show that this instability is driven by differences in the activation distributions, and identify a failure mode of scaling-based methods that arises when penultimate layer activations are not rectified. Motivated by this analysis, we propose RAS, a hyperparameter-free post-hoc method that replaces sorted activation magnitudes with a fixed in-distribution reference profile. Our simple plug-and-play method shows strong and consistent performance across datasets and architectures without assumptions on the penultimate layer activation function, and without requiring any hyperparameter tuning, while empirically preserving in-distribution classification accuracy. We further analyze what drives the improvement, showing that both inhibiting and exciting activation shifts independently contribute to better out-of-distribution discrimination.

Gianluca Guglielmo, Marc Masana

Graz University of Technology

Distribution Shift Detection OOD Detection

Ask PDF

May 1, 2026

GEODE: Angle-Adaptive OOD Detection with Universal Scorer Compatibility

Outlier Exposure (OE) is among the strongest training-based OOD detectors on standard benchmarks but exhibits scorer-dependent tradeoffs (e.g., strong on MSP, weak on KNN) and requires curated auxiliary data. We show why OE works: its features sit at the same geometric locus as real near-OOD data, with the boundary-adjacent quartile driving nearly all of OE's gain. OE is boundary calibration, not OOD coverage. GEODE (GEOmetry-preserving DEtection) replicates this calibration synthetically through an angle-adaptive norm loss in which targets scale per-sample with cosine similarity to the nearest class mean, preserving feature geometry where boundary structure matters. Four theorems grounded in neural collapse justify the design. GEODE works across all seven standard scorers on CIFAR-10 (near-OOD AUROC 89.0-92.3, far-OOD reaching 93.05; no catastrophic failure on any scorer). Since the OOD regime is unknown at deployment, this is the test that matters. GEODE outperforms vanilla CE at matched epoch counts. Combined with OE, GEODE reaches 95.0 MSP / 94.8 KNN on CIFAR-10 and beats OE on every scorer on CIFAR-100. The gains hold on WRN-28-10 (+4.5 Energy, 3 seeds). Unlike methods that push OOD into the classifier null space (e.g., PFS, 14.38 KNN AUROC, worse than random), GEODE's adaptive target preserves the geometry that distance-based scorers depend on.

Bruno Abrahao

NYU Shanghai · Leonard N. Stern School of Business, NYU

OOD Detection

Ask PDF

Abstract

OOD Detection

Explore similar work

A Robust Out-of-Distribution Detection Framework via Synergistic Smoothing

Ranked Activation Shift for Post-Hoc Out-of-Distribution Detection

GEODE: Angle-Adaptive OOD Detection with Universal Scorer Compatibility