Surprisingly consistent failures of post-hoc OOD detectors reveal security concerns in open-set recognition with modern CNNs and ViTs, stemming from representation mismatch

Although many OOD detection methods have been proposed, no clear winner can be identified as winners are benchmark-specific. One problem with evaluating OOD detectors is the imprecise definition of the "out" distribution, as many commonly used OOD datasets designed to test for 'semantic shift' contain a substantial proportion of 'covariate shift' samples. Moreover, recent work finds that, on carefully crafted benchmarks focused on semantic shift, modern OOD detectors yield little improvement over the baseline MSP. We analyzed a vast number of post-hoc OOD detectors on these benchmarks. We found that they consistently misclassify a common, substantial subset of samples across modern CNN and ViT architectures. We showed that failures across all OOD detectors on this benchmark are primarily due to learned feature representations: we observe that feature extractors map many semantically distant OOD samples closer to ImageNet classes than some in-distribution samples. This misalignment raises safety concerns about DNNs operating in open-set recognition scenarios. We publish a new benchmark, along with a reproducible construction protocol, that focuses on shared hard examples drawn from semantically distinct datasets, including NINCO and ImageNet-OoD. Our new benchmark can reveal fundamental security gaps in current DNNs, as they fail to reliably distinguish semantically distant OOD samples from in-distribution samples.