Skip to content

DisCoPatch: Taming Adversarially-driven Batch Statistics for Improved Out-of-Distribution Detection

Conference: ICCV 2025 arXiv: 2501.08005 Code: https://github.com/caetas/DisCoPatch Area: LLM Evaluation Keywords: Out-of-Distribution Detection, Batch Normalization, Adversarial VAE, Covariate Shift, Patch Strategy

TL;DR

This paper proposes DisCoPatch, a framework that exploits the inherent bias of BatchNorm toward batch statistics in adversarial VAEs to distinguish ID from OOD samples. At inference time, multiple patches from the same image are composed into a batch to ensure distributional consistency. The method achieves state-of-the-art performance on covariate-shift OOD detection (ImageNet-1K(-C) 95.5% AUROC) and near-OOD detection (95.0% AUROC), with a model size of only 25 MB and latency an order of magnitude lower than competing methods.

Background & Motivation

OOD detection aims to identify samples that deviate from the known data distribution, which is critical for ensuring system safety. It encompasses three types of distribution shift:

Semantic shift (e.g., novel categories) and domain shift (e.g., real images to sketches): boundaries are clear and have been extensively studied.

Covariate shift (e.g., subtle data corruptions such as blur or noise): easily confused with domain shift, yet more challenging due to its subtlety.

Existing OOD methods fall into generative model-based (VAE/GAN/NF/DDPM), reconstruction-based, and feature/logit-based categories. Generative approaches suffer from counter-intuitive likelihood estimation (OOD samples may receive higher likelihoods); reconstruction-based methods require careful tuning of the information bottleneck; feature-based methods are effective but bottlenecked by the inference speed of large transformers.

Core insight: In GAN/adversarial networks using BatchNorm, real and adversarial samples form two distinct domains with different batch statistics. This "dual-domain hypothesis" implies that BN naturally possesses the ability to separate ID and OOD samples based on batch statistics. However, BN also biases models toward exploiting non-robust features.

Solution: Decouple the advantages and disadvantages of BN via a patch strategy — during training, cross-image patches encourage the model to learn robust features; at inference, patches from the same image form a batch to ensure batch statistics correspond to a single distribution.

Method

Overall Architecture

DisCoPatch is an adversarial VAE framework comprising an encoder, a decoder (generator), and a discriminator. The VAE handles image reconstruction and generation (both serving as negative samples), while the discriminator leverages BatchNorm batch statistics to distinguish real patches from generated/reconstructed ones. Only the discriminator is used at inference time.

Key Designs

  1. Adversarial VAE Discriminator Training:

    • Function: Trains the discriminator to distinguish three sample types — real patches (positive), reconstructed patches (negative), and generated patches (negative).
    • Mechanism:
      • The VAE produces two types of negative samples via encoding-reconstruction \(z_{real}\) and random sampling \(z_{fake}\), respectively.
      • The discriminator minimizes: \(\mathcal{L}_D = \mathbb{E}_{x \sim p(x)}[\log(1-\mathcal{D}(x))] + \mathbb{E}_{x \sim p_\theta(x|z_{real})}[\log(\mathcal{D}(x))] + \mathbb{E}_{x \sim p_\theta(x|z_{fake})}[\log(\mathcal{D}(x))]\)
    • Design Motivation:
      • Reconstructed images typically lack high-frequency detail (blurring), training the discriminator to treat missing high frequencies as "fake."
      • Generated images often contain excessive high-frequency noise, training the discriminator to treat over-abundant high frequencies as "fake."
      • Together, they tighten the discriminator's characterization of the ID spectral boundary.

  2. Patch Strategy and PatchNorm:

    • Function: Crops 256×256 images into \(N\) patches of 64×64; at inference, patches from the same image form one batch.
    • Mechanism:
      • Training: patches from different images are mixed into a batch → encourages learning of consistent, robust cross-image features.
      • Inference: patches from the same image are normalized together → ensures BN batch statistics correspond to a single data distribution.
      • Introduces PatchNorm2D: retains BN weights and biases, but supports independent normalization of each group of \(N\) patches.
      • At inference, BN is set to \(m=1\) (using current batch statistics entirely, ignoring training running stats).
    • Design Motivation: If OOD samples are mixed into the inference batch, their batch statistics deviate from the ID distribution, undermining discrimination; the patch strategy ensures each image is evaluated independently and consistently.

  3. Composite Loss Function:

    • Function: Balances VAE reconstruction/regularization with adversarial learning.
    • Core formula: \(\mathcal{L}_{DCP} = \|x - \mathcal{G}(z)\|^2 - \frac{\omega_{KL}}{2}\sum(\text{KL term}) + \omega_{Rec}\mathbb{E}[\text{reconstruction adversarial}] + \omega_{Gen}\mathbb{E}[\text{generation adversarial}]\)
    • Design Motivation: End-to-end training naturally improves VAE output quality over time, progressively tightening the discriminator's ID boundary.

Loss & Training

VAE loss = reconstruction MSE + KL regularization + adversarial loss (encouraging reconstructed/generated images to fool the discriminator). Discriminator loss = standard three-class cross-entropy. Joint end-to-end training.

Key Experimental Results

Main Results

Model Near-OOD(SSB) Near-OOD(NINCO) Far-OOD(iNat) Far-OOD(DTD) Cov.Shift
MOODv2(BEiTv2) 85.0/58.1 92.7/38.2 99.6/1.8 94.3/24.7 70.5/73.9
SCALE(ResNet-50) 77.4/67.7 85.4/51.8 98.0/9.5 97.6/11.9 83.3/54.1
NNGuide(RegNet) 84.7/54.7 93.7/28.9 99.9/1.8 95.8/17.0 78.5/61.6
RankFeat(Rv2-101) 89.4/47.9 90.0/39.3 96.0/13.0 95.0/25.4 91.3/38.7
DisCoPatch-64 95.8/19.8 94.3/39.0 99.1/3.6 96.4/18.9 97.2/10.6

Average near-OOD AUROC of 95.0% (SOTA); covariate-shift AUROC of 95.5% (substantially ahead of competitors); far-OOD performance is near the best but not SOTA.

Ablation Study

Configuration Description OOD Detection Performance
Standard BN (eval mode) Uses training running stats Poor
BN (track_running_stats=False) Uses only current batch statistics Significant improvement
PatchNorm (m=1) Independent normalization per group Best
DisCoPatch-16 Fewer patches Already surpasses all baselines
DisCoPatch-64 More patches Best (no notable gain beyond 64)

Key Findings

  • Using current batch statistics at inference (rather than training running stats) is critical for OOD detection.
  • Model size is only 25 MB; latency is 12× lower than MOODv2 and 19× lower than NNGuide.
  • UMAP visualization shows near-OOD samples cluster near ID, and far-OOD samples are distant, indicating well-structured feature space.
  • Performance improves consistently as patch count increases from 16 to 64, saturating beyond 64.
  • Covariate-shift detection yields the largest gain (5.9% absolute improvement over the second-best), as reconstruction and generation naturally cover the low-frequency and high-frequency degradation modes, respectively.

Highlights & Insights

  • Converts BN's "weakness" (sensitivity to batch statistics) into an advantage for OOD detection — an elegant inversion of conventional thinking.
  • The use of VAE reconstruction (lacking high frequencies) and generation (excess high frequencies) as complementary negative samples tightens the spectral boundary in a principled manner.
  • The patch strategy simultaneously addresses both training (learning robust features) and inference (ensuring distributional consistency).
  • The model is extremely compact and efficient, fully meeting real-time deployment requirements.

Limitations & Future Work

  • Far-OOD detection does not achieve SOTA (though it is competitive and substantially faster).
  • Evaluation is currently limited to ImageNet-1K as the ID dataset.
  • Applicability to high-stakes domains such as medical imaging remains unexplored.
  • Stronger reconstruction/generation models (e.g., VQ-GAN, DDPM) could potentially replace the simple VAE.
  • Signal-processing-level analysis of feature propagation and suppression is lacking.
  • The "dual-domain hypothesis" (real vs. adversarial samples forming distinct distributions in BN) serves as the theoretical foundation of this work.
  • Patch-based methods have precedent in anomaly detection (PatchCore), but leveraging BN statistics from this perspective is novel.
  • The approach is generalizable to other scenarios requiring efficient OOD detection: industrial inspection, autonomous driving safety gating.

Rating

  • Novelty: ⭐⭐⭐⭐⭐ Combining BN batch statistics with adversarial VAEs for OOD detection is a highly distinctive perspective.
  • Experimental Thoroughness: ⭐⭐⭐⭐ Covers near/far/covariate three OOD types + multiple baselines + BN ablation + latency comparison.
  • Writing Quality: ⭐⭐⭐⭐ Motivation is clear; the core idea is well articulated in the introduction.
  • Value: ⭐⭐⭐⭐⭐ Highly practical — SOTA performance, 25 MB model, ultra-low latency; an ideal solution for industrial deployment.