Verification on Out-of-Distribution Detectors Under Natural Perturbations

Abstract

Out-of-distribution (OOD) detectors play a vital role in distinguishing between OOD data and in-distribution data. However, the vulnerability of OOD detectors to natural perturbations, such as rotation and lighting variations, can potentially lead to catastrophic accidents in safety-critical applications. Current attack techniques lack robustness guarantees for OOD detectors. Neural network (NN) verification methods are limited to standard NN structures and cannot be applied to OOD detectors due to their non-standard structure. To address this issue, we propose a verification framework called Vood that offers robustness guarantees for OOD detectors under natural perturbations. Our approach begins by proving the Lipschitz continuity of most OOD detection functions under natural transformations. We then estimate the Lipschitz constant using Extreme Value Theory, incorporating a dynamically estimated safety factor. Vood transforms the verification problem into an optimization challenge, which is then effectively addressed using space-filling Lipschitz optimization techniques. Additionally, Vood is a black-box verifier, which can tackle natural perturbations on a wide range of OOD detectors. Through empirical analysis, we demonstrate that Vood outperforms baseline methods in both accuracy and efficiency. Our work represents a pioneering effort in establishing robustness verification for OOD detectors with provable guarantees.