Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Survey

TL;DR

The paper addresses a critical reliability issue for DNNs: how to handle inputs that are both out-of-distribution and adversarially manipulated. It proposes a taxonomy based on distributional shifts and analyzes two main directions—robust OOD detection and unified robustness—through comprehensive reviews of methods, experimental setups, and benchmarks. Key contributions include a structured taxonomy, a synthesis of data-, model-, and score-based approaches, and a discussion of limitations (e.g., benchmarks, scalability, and certifiable guarantees) with concrete future directions. The work advances practical understanding of how to build DNN systems that remain reliable under challenging real-world input distributions and adversarial conditions, supporting safer deployment in safety-critical applications.

Abstract

Deep neural networks (DNNs) deployed in real-world applications can encounter out-of-distribution (OOD) data and adversarial examples. These represent distinct forms of distributional shifts that can significantly impact DNNs' reliability and robustness. Traditionally, research has addressed OOD detection and adversarial robustness as separate challenges. This survey focuses on the intersection of these two areas, examining how the research community has investigated them together. Consequently, we identify two key research directions: robust OOD detection and unified robustness. Robust OOD detection aims to differentiate between in-distribution (ID) data and OOD data, even when they are adversarially manipulated to deceive the OOD detector. Unified robustness seeks a single approach to make DNNs robust against both adversarial attacks and OOD inputs. Accordingly, first, we establish a taxonomy based on the concept of distributional shifts. This framework clarifies how robust OOD detection and unified robustness relate to other research areas addressing distributional shifts, such as OOD detection, open set recognition, and anomaly detection. Subsequently, we review existing work on robust OOD detection and unified robustness. Finally, we highlight the limitations of the existing work and propose promising research directions that explore adversarial and OOD inputs within a unified framework.

Figures (8)

• Figure 1: Types of distributional shifts. The x and y axes represent the different forms of covariate and semantic shifts, respectively.
• Figure 2: Adversarial examples and OOD detection. The coloured regions represent the regions corresponding to different ID classes, and the margin represents the model's decision boundary.
• Figure 3: Visualisation of robust OOD detection and unified robustness in relation to standard OOD detection and adversarial robustness. ( Note - * indicates adversarial examples attempting to evade the OOD detector, and # indicates adversarial examples aimed at deceiving the primary classifier.)
• Figure 4: The proposed taxonomy based on different forms of distributional shifts. Primarily, distributional shifts are categorised into semantic and covariate shifts. Under semantic shifts, we encounter OOD inputs, while adversarial examples fall under covariate shifts. Our focus lies at the intersection of these two categories, specifically on robust OOD detection and unified robustness.
• Figure 5: A robust OOD detector correctly detects ID and OOD inputs even if they are adversarially perturbed. ( Note - * denotes adversarial inputs attempting to evade the OOD detector.)