Adapting Contrastive Language-Image Pretrained (CLIP) Models for Out-of-Distribution Detection

TL;DR

This paper investigates how pretrained CLIP models can be adapted for out-of-distribution detection without fine-tuning, introduces a new scalable method called pseudo-label probing, and evaluates robustness against adversarial OOD samples.

Contribution

It proposes pseudo-label probing (PLP) for OOD detection, demonstrating its superiority over previous methods and analyzing CLIP's robustness to adversarial OOD data.

Findings

PLP outperforms previous state-of-the-art on large-scale benchmarks.

Linear probing surpasses fine-tuning for CLIP architectures.

Billion-parameter CLIP models are vulnerable to adversarial OOD samples.

Abstract

We present a comprehensive experimental study on pretrained feature extractors for visual out-of-distribution (OOD) detection, focusing on adapting contrastive language-image pretrained (CLIP) models. Without fine-tuning on the training data, we are able to establish a positive correlation ($R^2\geq0.92$) between in-distribution classification and unsupervised OOD detection for CLIP models in $4$ benchmarks. We further propose a new simple and scalable method called \textit{pseudo-label probing} (PLP) that adapts vision-language models for OOD detection. Given a set of label names of the training set, PLP trains a linear layer using the pseudo-labels derived from the text encoder of CLIP. To test the OOD detection robustness of pretrained models, we develop a novel feature-based adversarial OOD data manipulation approach to create adversarial samples. Intriguingly, we show that (i) PLP outperforms the previous state-of-the-art \citep{ming2022mcm} on all $5$ large-scale benchmarks based on ImageNet, specifically by an average AUROC gain of 3.4\% using the largest CLIP model (ViT-G), (ii) we show that linear probing outperforms fine-tuning by large margins for CLIP architectures (i.e. CLIP ViT-H achieves a mean gain of 7.3\% AUROC on average on all ImageNet-based benchmarks), and (iii) billion-parameter CLIP models still fail at detecting adversarially manipulated OOD images. The code and adversarially created datasets will be made publicly available.