The deployment scenarios often include conditions not anticipated during training. Therefore, Out-of-Distribution (OOD) detection is essential for ensuring the reliability and security of neural networks. However, many existing OOD detectors suffer from instability, with performance degrading significantly when the dataset or model changes. This challenge highlights the need to approach OOD detection by examining intrinsic differences between In-Distribution (ID) and OOD samples in terms of model capacities, rather than relying on their observable characteristics. In this article, we propose Gradient-based Attribution Reliability for OOD Detection (GAROD), a novel method grounded in the capacity of invariance to irrelevant inputs, an important property linked to model generalization. We hypothesize that models exhibit such properties with ID samples, and samples for which the model lacks this invariance are classified as OOD. Specifically, GAROD leverages gradient-based attribution to separate relevant and irrelevant pixels in the input samples and observes how a model’s decisions change after removing irrelevant pixels. The approach most closely related to ours is attribution reliability evaluation (e.g., Insertion or Deletion metrics). However, these methods have never been applied to OOD detection. Moreover, directly using classical reliability metrics does not yield effective results. We identify two key issues: (1) model outputs are insufficient to capture decision changes effectively, and (2) using Insertion or Deletion metrics individually lacks comprehensiveness. In GAROD, we address these by observing final features instead, fusing both metrics to achieve robust OOD detection. Extensive experiments on CIFAR and ImageNet benchmarks demonstrate GAROD’s superiority over state-of-the-art post hoc methods, as well as its resilience to performance degradation under dataset/model variations. Code: https://github.com/iceshade000/GAROD .

The blackbox nature of deep models has prompted a growing interest in explaining their inner workings and decision-making processes. Although backpropagation (BP)-based attribution methods are popular for visual interpretation, existing methods frequently yield implausible outcomes. For example, gradient-based attribution methods tend to highlight irrelevant regions and generate noise, while CAM-based attributions suffer from low resolution and blurry results. These limitations undermine their ability to correctly identify the target objects and fail to provide the desired justification to guarantee the credibility of the model's decision-making. In this article, we analyze plausibility issues in the frequency domain and point out that the plausibility issues correspond to frequency-domain incompleteness, i.e., the frequency-domain representation of explanations lacks low- or high-frequency components. Then, we propose a straightforward yet effective approach, threshold interception and fusion (TIF), to address this issue by fusing multilayer attributions. Our strategy involves collecting attribution results for all neurons and dividing the attribution map into a concept region that represents the current neuron and background regions based on a given threshold value$\alpha$. We then fuse these concept regions with the neuron weights in each layer and upsample the layer attributions to match the input size. Finally, we obtain the overall attribution by summing the layer attributions pixelwise. Our experiments demonstrate TIF efficacy by consistently enhancing visual performance across a variety of gradient-based attributions. To further demonstrate the ability to provide compact and fine-grained target objects, we directly employ TIF for the weakly supervised semantic segmentation task. Our results illustrate that TIF significantly outperforms existing methods without additional supervision or architectural modifications. We also observe an overall TIF improvement in the fidelity metric, suggesting that compactness and fine-graininess are not only plausibility issues but also fidelity issues.

Adversarial examples provide an opportunity as well as impose a challenge for understanding image classification systems. Based on the analysis of the adversarial training solution—Adversarial Logits Pairing (ALP), we observed in this work that: (1) The inference of adversarially robust model tends to rely on fewer high-contribution features compared with vulnerable ones. (2) The training target of ALP does not fit well to a noticeable part of samples, where the logits pairing loss is overemphasized and obstructs minimizing the classification loss. Motivated by these observations, we design an Adaptive Adversarial Logits Pairing (AALP) solution by modifying the training process and training target of ALP. Specifically, AALP consists of an adaptive feature optimization module with Guided Dropout to systematically pursue fewer high-contribution features, and an adaptive sample weighting module by setting sample-specific training weights to balance between logits pairing loss and classification loss. The proposed AALP solution demonstrates superior defense performance on multiple datasets with extensive experiments.