# Out-of-Distribution Detection

Near-out-of-distribution (near-OOD) inputs resemble the training classes closely, and existing post-hoc detectors that excel on far-OOD inputs lose that edge here. PLUS does not replace a detector: it uses a sparse autoencoder to pick each class's most active neurons, spans a low-dimensional subspace, and scores an input by that class's whitened Mahalanobis distance, adding the signal to any calibrated base score at one fixed weight. On the ImageNet-1K OpenOOD v1.5 benchmark, near-OOD AUROC improves in all 126 detector-backbone combinations across 18 detectors and seven backbones, while far-OOD performance is broadly maintained, with declines of at most one point where the base score is already near-saturated.

Near-out-of-distribution (near-OOD) inputs resemble the training classes closely, and existing post-hoc detectors that excel on far-OOD inputs lose that edge here. PLUS does not replace a detector: it uses a sparse autoencoder to pick each class's most active neurons, spans a low-dimensional subspace, and scores an input by that class's whitened Mahalanobis distance, adding the signal to any calibrated base score at one fixed weight. On the ImageNet-1K OpenOOD v1.5 benchmark, near-OOD AUROC improves in all 126 detector-backbone combinations across 18 detectors and seven backbones, while far-OOD performance is broadly maintained, with declines of at most one point where the base score is already near-saturated.

Earth-observation foundation models such as AlphaEarth and Tessera compress each 10-metre pixel into a dense vector whose individual dimensions often mix several land-surface concepts. Sparse autoencoders expand that vector over an overcomplete dictionary and keep only a few atoms active, yielding sparse, approximately monosemantic features. At matched sparsity, three sparse-autoencoder variants reconstruct better than PCA, ICA, NMF and raw dimensions; yet a control whose decoder is a frozen random dictionary also shows more specific features and finer spatial scales, so those two properties follow from sparsity itself, and only a learned dictionary cuts AlphaEarth's unexplained variance eightfold.

Earth-observation foundation models such as AlphaEarth and Tessera compress each 10-metre pixel into a dense vector whose individual dimensions often mix several land-surface concepts. Sparse autoencoders expand that vector over an overcomplete dictionary and keep only a few atoms active, yielding sparse, approximately monosemantic features. At matched sparsity, three sparse-autoencoder variants reconstruct better than PCA, ICA, NMF and raw dimensions; yet a control whose decoder is a frozen random dictionary also shows more specific features and finer spatial scales, so those two properties follow from sparsity itself, and only a learned dictionary cuts AlphaEarth's unexplained variance eightfold.

Organizations checking whether an LLM reply breaks internal policy have relied on fine-tuned detectors or a second LLM judging each exchange, both costly to train and to run. The new approach recasts violation detection as out-of-distribution detection in activation space: a whitening transform estimated from policy text and a few examples standardizes compliant hidden states, and the Euclidean norm of the whitened vector is compared with a calibrated threshold. On the DynaBench test set with a Qwen2.5-7B-Instruct backbone, F1 reaches 86.0%, above the fine-tuned detectors and LLM-as-a-judge baselines listed in the comparison table.

Organizations checking whether an LLM reply breaks internal policy have relied on fine-tuned detectors or a second LLM judging each exchange, both costly to train and to run. The new approach recasts violation detection as out-of-distribution detection in activation space: a whitening transform estimated from policy text and a few examples standardizes compliant hidden states, and the Euclidean norm of the whitened vector is compared with a calibrated threshold. On the DynaBench test set with a Qwen2.5-7B-Instruct backbone, F1 reaches 86.0%, above the fine-tuned detectors and LLM-as-a-judge baselines listed in the comparison table.

On strictly paired vulnerable and patched C/C++ functions, whitened CodeBERT layer-3 embeddings with nearest-neighbour distance separate unfamiliar samples from familiar ones at a mean OOD AUROC of 0.739, and expose a cross-project patch false-positive rate as high as 0.507.

On strictly paired vulnerable and patched C/C++ functions, whitened CodeBERT layer-3 embeddings with nearest-neighbour distance separate unfamiliar samples from familiar ones at a mean OOD AUROC of 0.739, and expose a cross-project patch false-positive rate as high as 0.507.

LLM agents use activation probes as runtime monitors for prompt injection, jailbreaks and unsafe requests, reading the model's own hidden state. A cheap move appends a short classification instruction after the user's turn so the model represents the request as a class, concentrating the signal the probe must separate. Under strict leave-one-dataset-out evaluation across 13 safety benchmarks and three open-weight model families, a classification suffix consistently beats no suffix on a single-position probe, improving out-of-distribution detection by up to about 4 AUC points, and the gain comes from the classification format rather than the named criterion.

LLM agents use activation probes as runtime monitors for prompt injection, jailbreaks and unsafe requests, reading the model's own hidden state. A cheap move appends a short classification instruction after the user's turn so the model represents the request as a class, concentrating the signal the probe must separate. Under strict leave-one-dataset-out evaluation across 13 safety benchmarks and three open-weight model families, a classification suffix consistently beats no suffix on a single-position probe, improving out-of-distribution detection by up to about 4 AUC points, and the gain comes from the classification format rather than the named criterion.

This study used a Leave-One-Class-Out out-of-distribution detection setup in motor imagery BCIs, training a model on some classes and observing whether an unfamiliar movement class can be detected via increased uncertainty; it found that because of the high intrinsic variability of EEG signals, many users show higher uncertainty for familiar in-distribution classes than for out-of-distribution classes, so many OOD detection methods that perform well in other machine learning domains prove ineffective here, yet OOD detection performance correlates with on-task performance, and Deep Ensemble and MC-Dropout models achieved on-task AUROC above 0.9 and OOD detection ability up to about 0.7, showing that rejecting unfamiliar cognitive states becomes feasible when task performance is high.

This study used a Leave-One-Class-Out out-of-distribution detection setup in motor imagery BCIs, training a model on some classes and observing whether an unfamiliar movement class can be detected via increased uncertainty; it found that because of the high intrinsic variability of EEG signals, many users show higher uncertainty for familiar in-distribution classes than for out-of-distribution classes, so many OOD detection methods that perform well in other machine learning domains prove ineffective here, yet OOD detection performance correlates with on-task performance, and Deep Ensemble and MC-Dropout models achieved on-task AUROC above 0.9 and OOD detection ability up to about 0.7, showing that rejecting unfamiliar cognitive states becomes feasible when task performance is high.