# A Novel Statistical Measure for Out-of-Distribution Detection in Data
Quality Assurance

Tinghui Ouyang1, Isao Echizen1, and Yoshiki Seo2
1National Institute of Informatics, Japan
2Digital Architecture Research Center, National Institute of Advanced
Industrial Science and Technology, Japan
E-mail: {thouyang<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Data outside the problem domain poses significant threats to the security of
AI-based intelligent systems. Aiming to investigate the data domain and out-
of-distribution (OOD) data in AI quality management (AIQM) study, this paper
proposes to use deep learning techniques for feature representation and
develop a novel statistical measure for OOD detection. First, to extract low-
dimensional representative features distinguishing normal and OOD data, the
proposed research combines the deep auto-encoder (AE) architecture and neuron
activation status for feature engineering. Then, using local conditional
probability (LCP) in data reconstruction, a novel and superior statistical
measure is developed to calculate the score of OOD detection. Experiments and
evaluations are conducted on image benchmark datasets and an industrial
dataset. Through comparative analysis with other common statistical measures
in OOD detection, the proposed research is validated as feasible and effective
in OOD and AIQM studies.

###### Index Terms:

out-of-distribution (OOD), AI quality management (AIQM), local conditional
probability (LCP), data quality analysis,

##  I Introduction

In AI quality management (AIQM) [1], a reliable AI system is expected to have
the ability to make accurate decisions on both data within the problem domain
and unknown examples, e.g., to reject data out of the defined problem domain.
A well-known example is the postcode recognition system, designed to recognize
images of handwriting digital numbers of 0-9. However, things often don’t go
as planned in the practical operation scenario. An alphabet image is likely
fed to the given system for reasons but predicted to a class of 0-9. It is
easily understood that the prediction mismatches the realistic expectation
because of the absence of a sound problem domain analysis in AIQM. When a
similar issue happens in some safety-critical scenarios, like autonomous
driving [2, 3], no warning or hand-over of driving control may cause serious
accidents when facing unusual scenes. Therefore, for the consideration of
safety and security, it is vital to investigate the problem domain and study
data quality assurance in AIQM, especially detecting the usual data outside
the problem domain.

According to the knowledge of general AIs, especially classification or
recognition AI systems, their problem domains are usually designed based on
closed-world assumptions [4]. Their training and testing data are also assumed
to locate in the same problem domain. These problem domains are usually
expressed by data distribution in the perspective of data quality analysis,
while the unusual examples are regarded as data of out-of-distribution (OOD)
[5]. Therefore, the easy solution to warning dangerous scenarios in AIQM is
effectively detecting OOD data in advance. It is known that the problem of OOD
detection is a typical task in AI quality research and is deeply related to
anomaly detection (AD) [6], novelty detection (ND) [7], and open set
recognition (OSR) [8]. Its general idea is to use data distribution or related
structural characteristics (e.g., distance, density) for separating normal and
outlier data, so the straightforward methods are unsupervised learning-based
models. There are many OOD detection methods using different types of
structural characteristics reported in the literature. For example, the first
type uses probability or density, named probabilistic methods [9]. These
methods leverage the probability density function of a dataset $X$ under a
given model parameter $\Theta$, then determine data points having the smallest
likelihood $P(X|\Theta)$ as outliers, e.g., the Gaussian Mixture Model (GMM)
[10] fitting a number of Gaussian distributions for outlier detection.
Probabilistic principal component analysis (PPCA) [11] and least-squares
anomaly detection (LSA) [12] are other probabilistic OOD methods. The second
type is density-based method. For example, kernel density (KD) estimators [13]
approximate the density function of the dataset via kernel function
calculation and distinguish outliers by low density in OOD detection. The
third type is based on distance, using the idea that outliers are distant from
the distribution of normal data. For instance, Mahalanobis distance (MD) is
used to detect anomalies under the assumption of Gaussian-shaped data
distribution [14]. Moreover, there are also some other metrics used in OOD
detection methods, e.g., the local outlier factor (LOF) [15] and $k$NN [16]
leveraging the neighbors’ information, a method using the information-
theoretic measure (i.e., Kullback-Leibler (KL) divergence [17]) in OOD
investigation.

It is generally straightforward to use these statistical measures to detect
OOD data directly in the original data space and easily understood to achieve
a good performance on simple data. However, facing complex and high-
dimensional datasets, e.g., the image data, direct usage of these measures
usually fail to effectively detect OOD because of the bad computational
scalability and the curse of dimensionality. Therefore, suitable feature
engineering is required before applying these statistical measures in the OOD
study. Concerning the above issues, this paper proposes a novel OOD method
with consideration of both effective feature engineering and a useful
statistical measure. The concrete novelties and contributions of the proposed
method are summarized as follows:

1) A feature extraction method based on autoencoder (AE) [18] and neuron
activation status is proposed. It is commonly known that deep learning (DL)
has excellent feature learning ability and wildly succeeds in complex data,
e.g., image-based data processing. Meanwhile, as a typical DL algorithm for
feature learning, deep AEs attempt to learn low-dimensional salient features
to reproduce the original data. Therefore, to preserve image data’s
distribution information as much as possible and effectively reduce
computation complexity, deep AE is selected as the basic architecture for
feature learning in this paper. Then, assuming normal data and outliers may
have different neuron behaviors, feature extraction based on deep AE’s neuron
activation status is implemented on complex and high-dimensional data to
generate data for the OOD study.

2) A novel statistical measure for OOD detection is proposed based on local
conditional probability (LCP) and data reconstruction. Considering the
advantages of different types of OOD methods, e.g., the kernel-function-based
density having advantages at addressing data without parametric probability
density distribution (PDF) function, the effectiveness of LOF and $k$NN on
using neighbor information, this paper proposed a new metric combining these
two ideas. The new metric considers calculating probability via neighbors’
kernel distance, using the local conditional probability to reconstruct data,
and describing OOD data via reconstruction error. It can achieve comparative
superiority over conventional statistical measures in OOD detection. Details
are presented in Section 3.

3) The proposed method performs better than conventional OOD detection
methods. This paper selects four conventional statistical measures for OOD
study, such as KD, LOF, MD, and $k$NN. Then, experiments based on image
benchmark datasets and an industrial dataset are implemented. Results
illustrate the proposed method’s effectiveness and superiority on OOD data
description detection.

The rest of this paper is organized as follows. Section II introduces how to
describe the OOD data and formulate the detection of OOD data. Section III
presents the methodology of the proposed method, including the framework
description and LCP calculation. Section IV implemented experiments on image
benchmark datasets. Discussion based on numerical results is done. Finally,
Section V concluded and outlooked this paper.

##  II Description and Related work of OOD detection

According to the idea of OOD detection methods with different statistical
measures above, we can formulate the process of detecting OOD as Fig. 1.

Figure 1: Description of OOD data detection

Fig. 1 shows that OOD data are usually distant from the distribution of normal
data and have a low density. Based on this assumption, we can easily leverage
some data structural characteristics, like distribution probability, density,
or distance, to design rules distinguishing normal and outlier data. Then, the
formula of OOD detection can be expressed as:

$score(x)=SM(f(x),f(D_{T}))$ (1)

where $\textit{score}(\cdot)$ is defined as the numeric calculation of
describing a data based on a specific structural characteristic mentioned
above. $f(\cdot)$ is the function for feature learning, e.g., kernel learning
in OC-SVM and SVDD [19], deep feature learning, etc. Thus, representative
features can replace the original data for better data description and OOD
study. The function $SM(\cdot)$ is the statistical measure of the select
structural characteristic, which usually calculate the difference or
similarity between testing data $x$ and the training dataset $D_{T}$, e.g.,
KD, MD, $k$NN, and LOF.

1) Kernel Density (KD)

KD estimation is developed to address the problem of nonparametric density
estimation. When the natural distribution of data is hard to be described by
an existing parametric probability density distribution function, the kernel
function was applied for density estimation [23], as the following equation.

$score(x_{t})=\frac{1}{\left|D_{T}\right|}\sum_{x_{i}\in D_{T}}k(x_{t},x_{i})$
(2)

where, $k(\cdot,\cdot)$ is a kernel function, usually chosen as a Gaussian
kernel. The kernel density (i.e., OOD score) is calculated through the average
kernel distance between the testing data $x_{t}$ and the whole training data
$D_{T}$. Then, based on the idea that outliers have a lower density than
normal data, we can detect OOD data based on low score values.

2) Mahalanobis Distance (MD)

With the assumption of Gaussian distributed data, MD is verified as effective
in defining the OOD score for anomaly detection. For example, assuming the
output of the classification model in each class is approximate to be
Gaussian, MD is used and verified superior in adversarial data detection [14].
The calculation of MD score is calculated below.

$score(x_{t})=(x_{t}-{\mu})^{\top}{\Sigma}^{-1}(x_{t}-{\mu})\\\ $ (3)
$\left\\{\begin{aligned} &\mu=\frac{1}{|D_{T}|}\sum_{x_{i}\in D_{T}}x_{i}\\\
&{\Sigma}=\frac{1}{|D_{T}|}\sum_{x_{i}\in
D_{T}}(x_{i}-{\mu})(x_{i}-{\mu})^{\top}\\\ \end{aligned}\right.$ (4)

Based on the score of MD measurement, OOD data is assumed to have a larger
distance than normal data to the center of the given data distribution.

3) $k$-Nearest Neighbors ($k$NN)

The idea of $k$NN in outlier detection is similar to that of KD and MD. It
mainly calculates the $k$NN distance and uses it for the OOD score directly,
as defined below

$score(x_{t})=\frac{1}{k}\sum_{x_{i}\in N_{k}(x_{t})}\|x_{t}-x_{i}\|^{2}$ (5)

where, $N_{k}(x_{t})$ represents the $k$-nearest neighbors of $x_{t}$. It is
seen that $k$NN utilizes the Euclidean distance instead of the kernel distance
in KD. Moreover, $k$NN considers the local distance as the OOD score instead
of the global distance in KD and MD. Similarly, if the score of a testing data
point is high, the data is assumed as OOD data.

4) Local Outlier Factor (LOF) [24]

LOF also makes use of the local characteristic instead of the global
characteristic. It describes the relative density of the testing data with
respect to its neighborhood. Its calculation is first to find $k$-nearest
neighbors of the testing data $x_{t}$, then to compute the local reachability
densities of $x_{t}$ and all its neighbors. The final score is the average
density ratio of $x_{t}$ to its neighbors, as expressed below.

$score(x_{t})=\frac{1}{\left|N_{k}(x_{t})\right|}\sum_{x_{i}\in
N_{k}(x_{t})}\frac{lrd(x_{i})}{lrd(x_{t})}$ (6)

$lrd(x)=\frac{\left|N_{k}(x)\right|}{\sum_{x_{i}\in N_{k}(x)}d(x,x_{i})}$ (7)

where, $lrd(\cdot)$ is the local reachability density function, $d$ is the
distance function. Then, under the assumption that OOD data are drawn from a
different distribution than normal data, so OOD data have larger local
reachability density, namely higher LOF scores.

Then, based on the scores calculated via different statistical measures, the
rule for determining normal and outlier data can be expressed as a Boolean
function, as below.

$\delta(score,\theta)=\left\\{\begin{aligned} &1,\ \text{normal data};\\\ &0,\
\text{outlier};\\\ \end{aligned}\right.$ (8)

where, $\theta$ is a given threshold for OOD detection.

##  III Methodology

From the above description in Section II, the core idea of OOD detection is to
use statistical measure, e.g., distribution probability or structural
characteristics (distance and density), to distinguish normal and outlier
data. However, in terms of complex and high-dimensional data, data’s
distribution and structural characteristics are not as apparent as that of
low-dimensional data. In this case, data transformation is required to
simplify data. Therefore, this paper proposes a general framework of the OOD
detection method via statistical measures in Fig. 2.

Figure 2: The framework of the proposed OOD detection method

Fig. 2 shows the framework of the proposed OOD detection method, which makes
use of statistical measures as the score function in (1), then determines
outlier or normal data. Considering the structural characteristics of high-
dimensional data are not readily computed, so a deep AE architecture is used
for feature learning and dimensionality reduction first, as shown in Fig. 2.
Then, some conventional statistical measures are used to calculate the OOD
score based on this framework. In this paper, a new statistical measure for
better OOD description and detection performance is also come up with, namely
the LCP measure in Fig. 2. Details for its implementation are described as
follows.

###  III-A activation traces

As mentioned, the proposed framework utilizes deep AE for feature learning and
dimensionality reduction. Considering normal and outlier data may have
different neuron behaviours in deep learning, this paper proposes to use
latent features’ neuron activation status for better OOD study instead of
original data. This idea is inspired by [20], which proposed that using
neurons’ status with respect to a testing data point is a good way to describe
data’s behavior. For example, the neuron’s activation value is one of the most
straightforward descriptions of data behaviors with respect to the given DL
model, as well as the sign of neuron outputs. Then, based on these activation
statuses, some neuron coverage metrics [21] were defined to describe the
data’s behaviors. In this paper, we can simply define the activation values as
the trace of neuron behavior.

By assuming a given deep learning architecture consisting of a set of neurons
$N=\\{n_{1},n_{2},\cdots\\}$, then, for a given testing data
$x\in\\{X|x_{1},x_{2},\cdots\\}$, its activation trace with respect to $N$can
be defined as $A(x)=\sigma_{N}(x)$. Generally, considering a DL model contains
a huge number of neurons, it is more effective to calculate the activation
trace of an ordered (sub)set of neurons $N_{s}\subseteq N$, instead of all
neurons. Inspired by the paper [22], which demonstrates abnormal and normal
data have different neuron activation statuses on the information channel and
the activation network, this paper considers choosing the most active neurons
in testing in order to reduce feature dimensionality and computation cost.
Moreover, according to the description of the proposed framework, an AE
architecture is used for feature representation from high-dimensional and
complex data space to low-dimensional space. AEs have the advantage of
learning the most representative features with low rank so that they can
preserve important information of original data in the dimensionality
reduction process. Therefore, the activation traces of active neurons in the
latent space of AE are calculated as the features for OOD detection in
accordance with the proposed framework in Fig. 2.

###  III-B local conditional probability (LCP)

Then, based on the data’s features of activation trace, different statistical
measures are applied to calculate the OOD data score, like KD, MD, $k$NN, and
LOF in Fig. 2. However, summarizing these measures, it is found that the main
ideas of these methods are to leverage the average distance as the
representation of probability or density in OOD scoring. For example, KD uses
the average kernel distances from the global dataset, MD to calculate the
Mahanalobis distance. Unlike KD and MD, $k$NN calculates the average Euclidean
distance in a local neighborhood domain. Even though LOF is totally different
from the other methods, it also makes use of local neighbors’ information,
namely the average reachability in the OOD score definition. With
consideration of effectiveness of these methods in OOD detection, this paper
propose to combine both neighborhood information and distance to develop a
statistical measurement for OOD scoring.

Firstly, instead of calculating the average distance, this paper proposes to
reconstruct the testing data via a linear combination of the given training
data and then calculate the reconstruction distance as the final OOD score, as
defined below

$score(x_{t})=\|x_{t}-w_{i}\cdot x_{i}\|^{2},x_{i}\in\mathbf{X}$ (9)

where $w_{i}$ is the weight for each individual data point $x_{i}$. It is
known that this reconstruction idea is also a useful strategy in OOD detection
and shares some similar concepts with that of the distance-based method. For
example, KD and $k$NN can also be regarded to calculate the distance between
the testing data $x_{t}$ and the center of the whole data and neighbors,
respectively. The $w_{i}$ can be thought of as equal weights in KD/$k$NN even
though they are not for reconstruction. However, with consideration of data
reconstruction, the weights $w_{i}$ should be specified to well reproduce the
testing data $x_{t}$ and satisfy $\sum w_{i}=1$. Therefore, a kind of
similarity based on local conditional probability (LCP) is defined as the
weights in this paper, as below

$w_{i}=\frac{d(x_{t},x_{i})}{\sum_{0\leq j\leq|D_{T}|}d(x_{t},x_{j})}$ (10)

where, $d(x_{t},x_{i})$ is the distance between $x_{t}$ and $x_{i}$. With the
assumption of data obeying Gaussian distribution, the distance function is
usually selected as the Gaussian kernel function
$k(x,y)=exp(-\frac{\|x-y\|^{2}}{2\sigma^{2}})$. In this way, data can be
regarded to distribute as a Gaussian distribution centering on data $x_{t}$
with a variance $\sigma$, so that it is easy to distinguish data nearby or
distant to data $x_{t}$.

Secondly, as the above description, some distant points have no significant
influence on data $x_{t}$’s reconstruction, it is not necessary to consider
all data points in $D_{T}$ in computation. Therefore, for the consideration of
efficient computation, we can consider a neighborhood for data reconstruction.
Then, then final ODD score with consideration of LCP can be rewritten as

$\displaystyle score(x_{t})=\|x_{t}-w_{i}\cdot x_{i}\|^{2},$ (11)
$\displaystyle w_{i}=\frac{\|x_{t}-x_{i}\|^{2}/2\sigma_{i}^{2}}{\sum_{x_{j}\in
N_{k}(x_{t})}\|x_{t}-x_{j}\|^{2}/2\sigma_{j}^{2}}$

Moreover, considering the distances between two points vary a lot and have
different effects on the Gaussian kernel, so the value of $\sigma$ in this
paper is considered to be selected based on the binary search method in [25].

##  IV Experiments and Results

In this paper, to evaluate the performance of the proposed method on OOD data
detection, especially detecting abnormal data for AI quality assurance, two
image benchmark datasets, such as MNIST [26] and CIFAR10 [27] datasets, and
one industrial dataset are studied in this section. Moreover, considering OOD
data are out of the studied problem domain, we can simply use an external
dataset as outlier for evaluation experiment in this paper, e.g., CIFAR10 data
can be anomalies out of the problem domain of MNIST data.

1) Example 1: MNIST dataset

The MNIST dataset is a benchmark dataset consisting of images of hard-writing
digital numbers from 0 to 9, it is widely used in deep learning studies. It
contains 50,000 training images and 10,000 testing images, with a pixel
resolution of 28*28. It is seen that the original data is high-dimensional and
not very suitable for OOD detection directly. According to the proposed OOD
detection framework in Section II, a deep AE with 5 layers is first
constructed for feature learning on MNIST data and then trained on the given
training dataset. For convenience, we can then extract the activation trace of
the output of the encoder as the features in the OOD study since they have
acceptable dimensionality and good representation ability to the original
data. Subsequently, we can utilize the extracted features for the calculation
of OOD scores via different statistical measurements defined in Section III.
Based on the proposed LCP measurement, which is actually based on data
reconstruction, so first we can show the distribution of reconstruction error
by using LCP in data reconstruction, as shown in Fig. 3.

Figure 3: Distribution of reconstruction error by using LCP

Fig. 3 plots reconstruction errors in 4 dimensions. It is seen that
conditional probability distributions of reconstruction error match well with
the Gaussian distribution, which satisfies our hypothesis in Section III.C.
Therefore, it is verified feasible to use LCP measurement for OOD data
description. Then, we can calculate the reconstruction error via (10) for OOD
data detection. In order to generate OOD data for evaluation, random noise and
formatted CIFAR10 images are separately considered in the experiments. Results
via ROC [28] curves are shown in Fig. 4.

(a) noise outliers

(b) CIFAR10 outliers

Figure 4: ROC curves of different OOD data detection

To quantitatively analyze the above results, the following table calculates
and presents the AUC values of ROC curves.

TABLE I: AUC-ROC of OOD detection on MNIST dataset | KD | LOF | MD |  kNN | OURS
---|---|---|---|---|---
O(Noise) | 0.9822 | 0.94157 | 0.9581 | 0.9980 | 1.0000
O(CIFAR) | 0.9787 | 0.9328 | 0.8794 | 0.9713 | 0.9962

From results of Fig. 4 and Table I, we can see that, in comparison among
conventional methods, $k$NN and KD perform better than LOF and MD. One
possible reason for this is that MD requires strict Gaussian distribution on
all data. In this paper’s experiments, we did not consider sub-pattern
learning in MNIST data, so the latent features destroy this Gaussian
assumption on all data. However, $k$NN and LCP can get rid of this global
assumption since they use only local information. Moreover, since the proposed
LCP inherits the advantages of both KD and $k$NN, it is found to outperform
all other methods on noise and CIFAR10 outlier detection from the above
results, demonstrating its effectiveness on OOD detection.

Figure 5: MNIST samples with high OOD scores via LCP

Additionally, with the demonstration of LCP’s superiority in OOD detection,
Fig. 5 shows some examples of MNIST data with high OOD scores using LCP
measurement. These data with high OOD scores are assumed to be corner case
data [29] with a high risk of wrong decision. For example, as seen in Fig. 5,
some abnormal images with additional patterns, incomplete shape, unsuitable
rotation, or shape confusion are found. Therefore, it can further
qualitatively demonstrate the ability of LCP measurement in OOD description.

2) Example 2: CIFAR10 dataset

Besides the MNIST dataset, CIFAR10 is also a benchmark dataset in deep
learning study, which contains 10 classes of 3*32*32 images. Following the
same implementation steps above, we first construct AE for feature learning,
then use the learned features for OOD study. To generate OOD data for
evaluation, random noise images and reformatted MNIST data are considered
outliers in this experiment. Then, OOD detection performance based on the
mentioned five statistical measurements is calculated and presented below.

TABLE II: AUC-ROC of OOD detection on CIFAR10 dataset | KD | LOF | MD |  kNN | OURS
---|---|---|---|---|---
O(Noise) | 0.9878 | 0.9906 | 0.9858 | 0.9788 | 0.9880
O(MNIST) | 0.9984 | 0.7013 | 0.9012 | 0.9789 | 1.0000

Based on the results of Table II, we can find the same conclusion that the
proposed LCP measurement outperforms other metrics on both noise and MNIST
outlier detection. Therefore, the feasibility and effectiveness of the LCP-
based OOD detection method are further proved on the CIFAR10 dataset.
Moreover, we can also utilize the OOD score via LCP measurement to show some
corner case data, as below

Figure 6: CIFAR10 data with high OOD scores via LCP

From the given CIFAR10 images with high OOD scores, we can find that some
images are cropped, e.g., images of cat, horse, and car highlighted with red
frame in Fig. 6. Same to the incomplete images in the MNIST dataset, cropped
CIFAR10 images have a loss of information compared with normal data, so they
have a risk in training and testing. Through the proposed OOD detection
method, it is possible for developers to clean these kinds of data for data
quality assurance.

3) Example 3: German Traffic Sign Recognition Benchmark (GTSRB) dataset [30]

Furthermore, to study the generation ability of the proposed method, this
paper proposes to use an industrial dataset for evaluation, e.g., the GTSRB
dataset. This dataset contains 43 classes of traffic signs. By unifying the
input images as the size of 3*32*32 and feeding them to train an AE model for
feature learning. Then, based on the proposed framework in Fig. 2, activation
traces of the latent features in AE are used for the OOD study. Four
traditional OOD methods based on KD, MD, $k$NN, and LOF are implemented along
with the proposed LCP-based method. Numerical results on AUC-ROC are presented
in Table III.

TABLE III: AUC-ROC of OOD detection on GTSRB dataset | KD | LOF | MD |  kNN | OURS
---|---|---|---|---|---
O(Noise) | 0.7020 | 0.7492 | 0.7128 | 0.6052 | 0.7703
O(MNIST) | 0.7175 | 0.9593 | 0.9790 | 0.9729 | 0.9985
O(CIFAR) | 0.6263 | 0.7874 | 0.6244 | 0.8620 | 0.9147

In Table III, outliers based on noise, MNIST data, and CIFAR10 data are
implemented, respectively. Through the comparison among different OOD methods,
the superiority of the proposed LCP-based method is again verified in the
industrial dataset. Moreover, these methods seem to perform better in
detecting MNIST outliers than the other two, and this is because MNIST data
have more discriminative features compared with GTSRB data. Furthermore, by
using the LCP-based data reconstruction error as the OOD data score, the
possible outliers inside the original dataset are shown in Fig. 7.

Figure 7: GTSRB data with high OOD scores via LCP

Among these GTSRB images with high OOD scores in Fig. 7, it is seen that there
are some images with low brightness, blurred, or shielded with other objects,
which might be the reasons leading to high OOD scores and lower data quality
in AIQM.

##  V Conclusions

In this paper, we addressed the issue of out-of-distribution (OOD) data in AI
quality management by proposing a framework that combines deep learning and
statistical measures for OOD detection. Initially, we leveraged the strong
feature representation and dimensionality reduction capabilities of AE to
extract activation traces from hidden neurons as input features for OOD
analysis. Subsequently, we employed five statistical measures, namely KD, LOF,
MD, $k$NN, and the proposed LCP, using these representative features for OOD
detection. Our findings revealed that the proposed LCP, which incorporates
both neighbor information and data reconstruction error, outperforms the other
measures in OOD detection. Thus, it was proved to be valuable for describing
and detecting OOD data. Furthermore, this research extracted reasonable corner
case data with high OOD scores from the given datasets, such as MNIST,
CIFAR10, and GTSRB datasets. These corner case data have high OOD scores and
exhibit abnormal characteristics compared to normal data. Therefore, detecting
such data using the proposed method is helpful in future AI quality assurance,
particularly for quality analysis related to data security.

##  VI Acknowledgement

This research is supported by the New Energy and Industrial Technology
Development Organization (NEDO) project ’JPNP20006’, and JSPS Grant-in-Aid for
Early-Career Scientists (Grant Number 22K17961).

## References

  * [1] The National Institute of Advanced Industrial Science and Technology (AIST). Machine learning quality management guideline, 2023. https://www.digiarc.aist.go.jp/en/publication/aiqm/.
  * [2] Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. Deepxplore: Automated whitebox testing of deep learning systems. In proceedings of the 26th Symposium on Operating Systems Principles, pages 1–18, 2017.
  * [3] Tinghui Ouyang, Yoshinao Isobe, Saima Sultana, Yoshiki Seo, and Yutaka Oiwa. Autonomous driving quality assurance with data uncertainty analysis. In 2022 International Joint Conference on Neural Networks (IJCNN), pages 1–7. IEEE, 2022.
  * [4] Guansong Pang, Jundong Li, Anton van den Hengel, Longbing Cao, and Thomas G Dietterich. Anomaly and novelty detection, explanation, and accommodation (andea). In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 4145–4146, 2021.
  * [5] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110.11334, 2021.
  * [6] Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey. ACM computing surveys (CSUR), 41(3):1–58, 2009.
  * [7] Marco AF Pimentel, David A Clifton, Lei Clifton, and Lionel Tarassenko. A review of novelty detection. Signal processing, 99:215–249, 2014.
  * [8] Chuanxing Geng, Sheng-jun Huang, and Songcan Chen. Recent advances in open set recognition: A survey. IEEE transactions on pattern analysis and machine intelligence, 43(10):3614–3631, 2020.
  * [9] R´emi Domingues, Maurizio Filippone, Pietro Michiardi, and Jihane Zouaoui. A comparative evaluation of outlier detection algorithms: Experiments and analyses. Pattern recognition, 74:406–421, 2018.
  * [10] Jing Li, Pengbo Lv, Huijun Li, and Wanghu Chen. Outlier detection based on stacked autoencoder and gaussian mixture model. In 2022 IEEE International Conference on Big Data (Big Data), pages 3763–3769. IEEE, 2022.
  * [11] Michael E Tipping and Christopher M Bishop. Probabilistic principal component analysis. Journal of the Royal Statistical Society Series B: Statistical Methodology, 61(3):611–622, 1999.
  * [12] John A Quinn and Masashi Sugiyama. A least-squares approach to anomaly detection in static and sequential data. Pattern Recognition Letters, 40:36–40, 2014.
  * [13] Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410, 2017.
  * [14] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems, 31, 2018.
  * [15] Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280, 2017.
  * [16] Ahmed Abusnaina, Yuhang Wu, Sunpreet Arora, Yizhen Wang, Fei Wang, Hao Yang, and David Mohaisen. Adversarial example detection using latent neighborhood graph. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7687–7696, 2021.
  * [17] Bruno Andriamanalimanana, Ali Tekeoglu, Korkut Bekiroglu, Saumendra Sengupta, Chen-Fu Chiang, Michael Reale, and Jorge Novillo. Symmetric kullback-leibler divergence of softmaxed distributions for anomaly scores. In 2019 IEEE Conference on Communications and Network Security (CNS), pages 1–6. IEEE, 2019.
  * [18] Jianbo Yu, Xiaoyun Zheng, and Shijin Wang. A deep autoencoder feature learning method for process pattern recognition. Journal of Process Control, 79:1–15, 2019.
  * [19] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel M¨uller, and Marius Kloft. Deep one-class classification. In International conference on machine learning, pages 4393–4402. PMLR, 2018.
  * [20] Jinhan Kim, Robert Feldt, and Shin Yoo. Guiding deep learning system testing using surprise adequacy. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), pages 1039–1049. IEEE, 2019.
  * [21] Zenan Li, Xiaoxing Ma, Chang Xu, and Chun Cao. Structural coverage criteria for neural networks could be misleading. In 2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER), pages 89–92. IEEE, 2019.
  * [22] Shiqing Ma, Yingqi Liu, Guanhong Tao, Wen-Chuan Lee, and Xiangyu Zhang. Nic: Detecting adversarial samples with neural network invariant checking. In 26th Annual Network And Distributed System Security Symposium (NDSS 2019). Internet Soc, 2019.
  * [23] Tarem Ahmed. Online anomaly detection using kde. In GLOBECOM 2009-2009 IEEE Global Telecommunications Conference, pages 1–8. IEEE, 2009.
  * [24] Siying Xu, Huiyi Liu, Liting Duan, andWenjingWu. An improved lof outlier detection algorithm. In 2021 IEEE International Conference on Artificial Intelligence and Computer Applications (ICAICA), pages 113–117. IEEE, 2021.
  * [25] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
  * [26] Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/, 1998.
  * [27] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
  * [28] Tom Fawcett. An introduction to roc analysis. Pattern recognition letters, 27(8):861–874, 2006.
  * [29] Tinghui Ouyang, Vicent Sanz Marco, Yoshinao Isobe, Hideki Asoh, Yutaka Oiwa, and Yoshiki Seo. Corner case data description and detection. In 2021 IEEE/ACM 1st Workshop on AI Engineering-Software Engineering for AI (WAIN), pages 19–26. IEEE, 2021.
  * [30] Stallkamp, Johannes, Marc Schlipsing, Jan Salmen, and Christian Igel. The German traffic sign recognition benchmark: a multi-class classification competition. In The 2011 international joint conference on neural networks, pages 1453-1460. IEEE, 2011.