Paper deep dive
Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection
Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, Sanjay Madria
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/26/2026, 1:49:39 AM
Summary
The paper introduces 'Prototype Fusion', a training-free, model-agnostic framework for out-of-distribution (OOD) detection. It challenges the reliance on penultimate-layer activations by aggregating class-wise mean embeddings (prototypes) from multiple intermediate layers of a pretrained neural network. By computing cosine similarity between test samples and these multi-layer prototypes, the method effectively distinguishes ID from OOD samples, achieving significant improvements in AUROC and reductions in FPR across diverse architectures and benchmarks.
Entities (6)
Relation Signals (4)
Prototype Fusion → improves → AUROC
confidence 95% · it improves AUROC by up to 4.41%
Prototype Fusion → reduces → FPR
confidence 95% · reduces FPR by 13.58%
Prototype Fusion → uses → Cosine Similarity
confidence 95% · cosine similarity between test features and these prototypes serves as an OOD score
Prototype Fusion → appliedto → Neural Networks
confidence 90% · model-agnostic approach that leverages internal representations across multiple layers
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Deep learning models are increasingly deployed in safety-critical applications, where reliable out-of-distribution (OOD) detection is essential to ensure robustness. Existing methods predominantly rely on the penultimate-layer activations of neural networks, assuming they encapsulate the most informative in-distribution (ID) representations. In this work, we revisit this assumption to show that intermediate layers encode equally rich and discriminative information for OOD detection. Based on this observation, we propose a simple yet effective model-agnostic approach that leverages internal representations across multiple layers. Our scheme aggregates features from successive convolutional blocks, computes class-wise mean embeddings, and applies L_2 normalization to form compact ID prototypes capturing class semantics. During inference, cosine similarity between test features and these prototypes serves as an OOD score--ID samples exhibit strong affinity to at least one prototype, whereas OOD samples remain uniformly distant. Extensive experiments on state-of-the-art OOD benchmarks across diverse architectures demonstrate that our approach delivers robust, architecture-agnostic performance and strong generalization for image classification. Notably, it improves AUROC by up to 4.41% and reduces FPR by 13.58%, highlighting multi-layer feature aggregation as a powerful yet underexplored signal for OOD detection, challenging the dominance of penultimate-layer-based methods. Our code is available at: this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2603.23677v1
- Canonical: https://arxiv.org/abs/2603.23677v1
Trouble viewing inline? Open PDF directly →
Full Text
34,848 characters extracted from source content.
Expand or collapse full text
Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection Shreen Gul 1 , Mohamed Elmahallawy 2⋆ , Ardhendu Tripathy 3 , and Sanjay Madria 1 1 Missouri University of Science and Technology, Rolla, MO 65401, USA sgchr,madrias@mst.edu 2 Washington State University, Richland, WA 99354, USA mohamed.elmahallawy@wsu.edu 3 ardhendutr@gmail.com Abstract. Deep learning models are increasingly deployed in safety-critical ap- plications, where reliable out-of-distribution (OOD) detection is essential to en- sure robustness. Existing methods predominantly rely on the penultimate-layer activations of neural networks, assuming they encapsulate the most informative in-distribution (ID) representations. In this work, we revisit this assumption to show that intermediate layers encode equally rich and discriminative information for OOD detection. Based on this observation, we propose a simple yet effective model-agnostic approach that leverages internal representations across multiple layers. Our scheme aggregates features from successive convolutional blocks, com- putes class-wise mean embeddings, and applies L 2 normalization to form compact ID prototypes capturing class semantics. During inference, cosine similarity be- tween test features and these prototypes serves as an OOD score—ID samples exhibit strong affinity to at least one prototype, whereas OOD samples remain uni- formly distant. Extensive experiments on state-of-the-art OOD benchmarks across diverse architectures demonstrate that our approach delivers robust, architecture- agnostic performance and strong generalization for image classification. Notably, it improves AUROC by up to 4.41% and reduces FPR by 13.58%, highlighting multi-layer feature aggregation as a powerful yet underexplored signal for OOD de- tection, challenging the dominance of penultimate-layer-based methods. Our code is available at: https://github.com/sgchr273/cosine-layers.git. Keywords: Deep Neural Networks· OOD Detection· Representation Learning 1 Introduction Neural networks (NNs) have remarkable ability to perform complex tasks such as classi- fication, detection, and segmentation with high accuracy. However, despite their success, they exhibit a critical flaw — a tendency to be overconfident when presented with sam- ples that lie outside the training distribution. This overconfidence can lead to catastrophic failures in safety-critical applications such as autonomous driving and medical diagnos- tics [1]. Hence, it is imperative to design effective methods for out-of-distribution (OOD) detection to ensure the robust deployment of NNs in such domains. ⋆ To appear in Proceedings of PAKDD 2026: The 30 th Pacific-Asia Conference on Knowledge Discovery and Data Mining. arXiv:2603.23677v1 [cs.CV] 24 Mar 2026 2Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, and Sanjay Madria A large body of work has focused on leveraging signals from the penultimate layer of NNs for OOD detection. For instance, Guan et al. [4] compute mean feature vectors in the penultimate feature space and exploit the observation that in-distribution (ID) samples exhibit higher similarity to these means than OOD samples. Similarly, KNN [17] measures the distance between test and training features, classifying a sample as OOD if the distance exceeds a threshold. NNGuide [14] refines OOD scores by averaging cosine similarities to the k nearest ID neighbors in feature space, while NCI [12] defines a proximity score based on the norm of the projection of a centered feature onto its class weight vector, with larger norms indicating ID-like behavior. Although these methods achieve competitive results, they primarily depend on the penultimate representation and often fail to capture the richer class-level structure distributed across intermediate layers. As a result, their performance degrades substantially when faced with far-OOD samples [3]. Recent work shows that informative OOD signals are not restricted to the penultimate layer but also appear in intermediate representations. ESOOD [19], for instance, trains multiple one-class SVM detectors at different depths and uses a layer-selection policy for each test sample while using early stopping to terminate inference, but this can be computationally expensive due to the need to handle many layer-specific detectors (e.g., several SVMs per backbone in a ResNet). Ag-EBO [5] instead regularizes intermediate layers with an energy-based contrastive loss and aggregates several layers into a single OOD score, yet it does not identify which specific layers should be regularized to maxi- mize performance. NMD [3] exploits batch-normalization statistics for OOD detection, a direction further supported by [4,11,10]; however, these methods do not explicitly encode class-specific information, which limits their discriminative power. To address these limitations, we propose a method that combines fine-grained class information, captured via class prototypes, with comprehensive multi-layer feature utiliza- tion in NNs. Specifically, we construct L 2 -normalized class prototypes from intermediate layers, which serve as compact, semantically rich representations of ID data. During in- ference, we compute the cosine similarity between a test sample and each class prototype. For each layer, we retain the maximum similarity across all classes, and a weighted average across layers produces the final confidence score. We observe that ID samples consistently exhibit higher cosine similarity than OOD samples, highlighting cosine similarity as a robust metric for OOD detection. Conceptually, our approach identifies anomalies by ana- lyzing the angles in feature space: ID samples form smaller angles (higher similarity) with class prototypes, whereas OOD samples form larger angles. Our main contributions are summarized as follows: – We propose a novel, simple, and training-free OOD detection framework that jointly leverages the class-aware structure of ID data and the network’s internal layers. – Our method exploits geometric relationships in the feature space by computing cosine similarity between class prototypes and intermediate-layer activations. For each layer, the maximum class-wise similarity is retained, and a weighted aggregation across layers yields the final confidence score—enabling robust separation of ID and OOD samples. – Extensive experiments across multiple ID datasets and diverse network architectures demonstrate that our approach consistently enhances OOD detection performance and generalizes effectively across domains. In particular, it improves AUROC by up to 4.7% and reduces FPR by 13.58%. Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection3 2 Related Work Neural-collapse-based methods : A recent thread of work leverages the geometric phenomena of neural collapse (NC) to improve OOD detection. Training-time strategies enforce feature-space separation: for example, Wu et al. [20] push OOD features into the subspace orthogonal to the ID weight span via a simple orthogonality loss under outlier exposure. Post-hoc alternatives avoid retraining by extracting NC-consistent signals from a trained model: Liu and Qin [?] score samples using the proximity of centered features to the predicted class weight together with feature norm, while NECO uses NC/PCA structure to distinguish ID from OOD without fine-tuning [1]. Complementary work by Harun et al. [6] studies how controlling the degree of neural collapse across layers trades off OOD detection and OOD generalization, proposing entropy regularization on the encoder plus an equiangular tight frame (ETF) projector on the head to balance the two objectives. Our method fits naturally within this line: we aggregate intermediate-layer activations into L 2 -normalized class prototypes and score samples with cosine similarity, thereby capturing discriminative geometry that appears prior to full collapse while remaining post-hoc and model-agnostic. Output- and representation-based OOD detection methods : Another large class of methods transforms a frozen network’s outputs or representations into confidence scores. Output-based scores include the maximum softmax probability (MSP), which gauges peak- iness, and MaxLogit, which uses the largest logit directly to mitigate softmax satura- tion. Energy-based scores replace the max with a log-sum-exp (negative free energy) aggregation to leverage the whole logit spectrum and often sharpen ID/OOD separa- tion. Representation-based techniques instead exploit feature geometry: ViM decomposes penultimate features into an ID-aligned principal subspace plus a residual to form a virtual logit margin, while residual- or reconstruction-style methods score samples by reconstruc- tion error or distance to a class subspace. Our method complements these approaches by extending geometric scoring beyond the penultimate layer: we build multi-stage, L 2 - normalized class prototypes from intermediate features and apply cosine similarity, which captures early discriminative cues and yields a simple, effective post-hoc detector that is broadly applicable across architectures. Entropy-based OOD detection methods : The method [?] extends Maximum Con- cept Matching using intermediate-layer features from CLIP-like vision–language models. It applies an entropy-based rule to select and fuse informative layers for training-free OOD detection. This works best when the backbone has rich, diverse intermediate representa- tions. Thus it becomes less effective and stable on models with flatter or redundant layers, such as MAE or Perception Encoder. In contrast, [21] models information flow by estimat- ing conditional entropy between consecutive blocks. It defines a Conditional Entropy Ratio (CER) from ID and jigsaw-based pseudo-OOD images to locate the most discriminative block. However, EOOD needs jigsaw pseudo-OOD generation and k-N–based entropy es- timation, adding notable overhead. LaREx [2] proposes uncertainty-based scores LaRED and LaREM using dropout/DropBlock (zMCD) on latent features. It fits the entropy density of ID samples with kernel density estimation or a Gaussian model. Yet LaREx still requires Monte Carlo sampling and architecture-specific tuning of the noise layer and its size. So no universal, computation-light configuration exists, and nontrivial overhead remains. 4Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, and Sanjay Madria 3 Problem Statement and Proposed Methodology Recent studies indicate that the hidden layers of NNs encode rich, discriminative infor- mation about the training data. Motivated by this, we leverage the activations of hidden convolutional layers to design our OOD detection method. To focus on class-specific infor- mation and reduce the influence of noise, we compute a mean feature (prototype) for each ID class at every hidden layer. At test time, each sample is compared to these per-layer prototypes, and the resulting similarities are aggregated across layers. This yields a sim- ple, training-free OOD detector that fuses cosine similarities between samples and class prototypes computed from multiple intermediate layers of a pretrained network. A small ID calibration set is used to construct the prototypes, and OOD scores are obtained by taking the maximum cosine similarity to the prototypes, aggregated across layers ( Fig. 1). The problem statement and details of our method are presented below. 3.1 Problem Statement We consider a pretrained classifier f ◦ h : X → Y, where X denotes the input space (e.g., images), Y = 1,...,K the set of class labels, h : X →R d a feature extractor (backbone), and f :R d → Y the classifier head. The model is trained on in-distribution (ID) data drawn from a distribution P in . In addition, we are given a small labeled calibration set D calib ID ⊂X ×Y, sampled from P in , which we use to construct class prototypes at a collection of hidden layers L. At test time, a sample x ∈ X may originate either from the in-distribution P in or from an unknown out-of-distribution P out . Our goal is to design, using only the frozen network f◦h and the prototype bank built from D calib ID , a scalar score function S(x) ∈R that separates ID and OOD samples. The resulting detector is expressed as a decision function G :X →0, 1, G(x) = ( 1, if S(x)≥ τ(x is ID), 0, if S(x) < τ(x is OOD), (1) where τ ∈R is a threshold chosen on a validation set. 3.2 Multi-layer Feature Representations Let f θ be a pretrained classifier with parameters θ, trained on an ID dataset with K classes. We select a set of internal layers as: L =ℓ 1 ,ℓ 2 ,...,ℓ L ,(2) which may include intermediate convolutional blocks. For an input image x, each layer ℓ∈L produces an activation map as: h ℓ (x)∈R C ℓ ×H ℓ ×W ℓ ,(3) where C ℓ is the number of output channels while H ℓ and W ℓ are the spatial height and width of the layer’s feature map. To obtain a fixed-length representation for layer ℓ, Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection5 Fig. 1: Overview of the proposed training-free OOD detector. A pretrained CNN is tapped at layers ℓ 1 –ℓ 3 . ID calibration images are passed through the network, and per-layer fea- tures are global-average-pooled and L 2 -normalized to form K class prototypes (green regions). For a test image (ID or OOD), we compute cosine similarity between its features and each layer’s prototypes (green arrows for ID, red arrows for OOD). At each layer, we retain the maximum class-wise similarity, and these per-layer maxima are averaged to produce an ID affinity score, with OODScore = 1 − affinity. The heatmaps on the right show that ID samples yield strong, consistent similarities across layers and classes, whereas OOD samples produce weaker and less coherent similarity patterns. we apply global average pooling over the spatial dimensions (H ℓ ,W ℓ ). For channel c ∈ 1,...,C ℓ , we define z ℓ (x) c = 1 H ℓ W ℓ H ℓ X i=1 W ℓ X j=1 h ℓ (x) c,i,j .(4) This yields a channel-wise pooled descriptor z ℓ (x)∈R C ℓ . We then apply L 2 -normalization to obtain a unit-norm feature vector, which can be given as: ̃z ℓ (x) = z ℓ (x) ∥z ℓ (x)∥ 2 ∈R C ℓ .(5) After this step, each input x is represented by a collection of unit-normalized vectors, one per selected convolutional layer ̃z ℓ (x) ℓ∈L . 3.3 Class Prototypes in Feature Space We construct a prototype representation for each ID class in each selected layer ℓ ∈ L. Let D calib ID = (x n ,y n ) N n=1 , y n ∈ 0,...,K − 1 denotes a labeled calibration set of ID samples. For each layer ℓ ∈ L and each class c ∈ 0,...,K − 1, we define the empirical mean feature as: ̄p ℓ,c = 1 N ℓ,c X n:y n =c ̃z ℓ (x n ), N ℓ,c = n : y n = c .(6) 6Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, and Sanjay Madria We then normalize this class mean to unit length p ℓ,c = ̄p ℓ,c ∥ ̄p ℓ,c ∥ 2 ∈R C ℓ . The resulting matrix of class prototypes for each layer ℓ can be represented as: P ℓ = p ⊤ ℓ,0 p ⊤ ℓ,1 . . . p ⊤ ℓ,K−1 ∈R K×C ℓ .(7) Thus, for every chosen layer ℓ, we obtain a bank of K unit-norm prototype vectors, one per ID class. 3.4 Cosine Similarity to Known-Class Manifolds Given a test sample x, we extract its normalized feature vector ̃z ℓ (x) for each layer ℓ∈L, as described in section 3.2. We then compute the cosine similarity between ̃z ℓ (x) and each class prototype p ℓ,c in that layer: sim ℓ (x,c) = ̃z ℓ (x) ⊤ p ℓ,c , c = 0,...,K− 1.(8) Next, for each layer, we retain the maximum similarity over classes as: m ℓ (x) =max c∈0,...,K−1 sim ℓ (x,c).(9) The scalar m ℓ (x) quantifies how well sample x matches any known ID class at layer ℓ. 3.5 Cross-layer Aggregation and OOD Scoring As different layers capture different forms of structure, we aggregate evidence across all selected layers. We assign a non-negative weight w ℓ > 0 to each layer ℓ ∈ L. For a test input x, we compute a normalized weighted average of the per-layer match scores as: s(x) = P ℓ∈L w ℓ m ℓ (x) P ℓ∈L w ℓ ,(10) We interpret s(x) as an ID affinity score, then define the final OOD detection score as: OODScore(x) = 1− s(x).(11) A higher OODScore(x) indicates that the sample is less consistent with the set of ID class prototypes across all monitored layers, and is therefore more likely to be OOD. Algorithm 1 outlines the scoring procedure. 4 Performance Evaluation 4.1 Experimental setup ID & OOD Datasets. We evaluate our method on three standard benchmarks for OOD detection: CIFAR-10, CIFAR-100, and ImageNet-1k as the ID datasets, following the experimental protocols of prior work [4]. For CIFAR-10, we report results under two widely used evaluation protocols: (i) the small OOD benchmark suite consisting of iSUN, LSUN, iNaturalist, Textures, and Places, and (i) the NECO protocol [1], where CIFAR-10 (resp. CIFAR-100) serves as the ID dataset and CIFAR-100 (resp. CIFAR-10) together with SVHN are used as OOD datasets. For ImageNet-1k as the ID dataset, we evaluate OOD detection performance against SUN, Textures, Places, and iNaturalist. Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection7 Algorithm 1: Prototype-based multi-layer OOD scoring Data: test sample x Inputs: f θ (pretrained net), L (selected layers), p ℓ,c (class prototypes), w ℓ (layer weights) Output: OODScore(x) foreach ℓ∈L do h ℓ (x)← activations of layer ℓ on x z ℓ (x)← GlobalAvgPool(h ℓ (x)) // ∈R C ℓ ̃z ℓ (x)← z ℓ (x)/∥z ℓ (x)∥ 2 m ℓ (x)← max c ̃z ℓ (x) ⊤ p ℓ,c // max cosine sim s(x)← P ℓ∈L w ℓ m ℓ (x) P ℓ∈L w ℓ OODScore(x)← 1− s(x) return OODScore(x) Model Configuration. Our method involves two key hyperparameters: (i) the weights assigned to the internal layers of the N, and (i) the number of samples selected from the ID training data to construct the calibration set (α). We conduct an extensive analysis to study the impact of these hyperparameters on the overall OOD detection performance (see results in Figs. 2 and 4). Baselines. We compare our method against nine widely used OOD detection baselines. All these methods are post-hoc, meaning they operate on pretrained networks without requiring access to model weights, gradients, or retraining losses. This makes them suit- able baselines for our method, which is also post-hoc by design. The compared methods include MSP [8], MaxLogit [7], Energy [13], Mahalanobis [15], GradNorm [9], NNGuide [14], NECO [1], ReAct [16], and ViM [18]. Evaluation Metrics. We follow the same preprocessing, calibration, and evaluation pro- cedures as in [4]: a small held-out ID calibration set is used to build prototypes, and all OOD scores are computed post-hoc on pretrained models. Performance is evaluated us- ing the most widely adopted OOD detection metrics: (i) the Area Under the Receiver Operating Characteristic curve (AUROC) and (i) the False Positive Rate at 95% True Positive Rate (FPR@95% TPR). Results are averaged across all OOD datasets unless stated otherwise. Higher AUROC and lower FPR@95% TPR indicate better OOD detec- tion performance. 4.2 Performance Results Tables 1, 2, and 3 report the results of our method compared to all baselines across multiple architectures. In all experiments, we use a uniform weighting of layers. In Table 1, for ResNet-18, our method improves AUROC by 2.34% over ESOOD and 3.66% over NNGuide, while reducing FPR by 10.88% and 7.25%, respectively. For DenseNet-100, our approach increases AUROC by 1.1% over ViM and 2.5% over Energy, and reduces FPR by 3.49% and 4.26%, respectively. In Table 2 (ResNet-18, ID = CIFAR-10), our method improves AUROC over ESOOD and NNGuide by 0.85% and 0.69%, while reducing FPR by approximately 0.75% and 4.63%, respectively. For ID = CIFAR-100 on ResNet-18, our method improves AUROC by about 1.99% over ESOOD and 8.83% over NNGuide, and reduces FPR by roughly 6.97% 8Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, and Sanjay Madria Table 1: OOD detection results on the CIFAR-10 dataset. ↑/↓ denote that higher/lower values are better. The first, second, and third best results are highlighted in green, orange, and blue, respectively (values in %). Model Method iSUNLSUNPlacesiNatTexturesAverage AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ ResNet-18 MSP89.79 47.4494.68 15.2689.66 48.3289.59 44.3387.18 63.9690.75 39.75 MaxLogit90.08 52.8494.63 25.8289.65 55.0689.37 51.1986.35 73.8690.74 46.60 Energy88.42 63.0092.34 51.4887.97 62.8787.46 59.1484.24 79.1089.02 57.46 Mahalanobis86.86 51.3280.99 53.8484.80 49.9380.25 58.4892.64 34.9986.61 46.26 GradNorm83.44 70.9291.86 37.2079.30 74.9890.81 44.2981.20 82.7586.56 57.97 NNGuide89.45 50.1295.18 13.8489.82 45.3490.00 41.8991.23 30.3391.71 32.93 NECO84.69 54.9285.32 53.1481.87 61.7883.80 56.5191.74 42.2387.08 50.14 ReAct85.78 75.5391.70 50.8884.21 79.6384.66 73.8380.95 92.1986.49 69.73 ViM88.52 55.1687.28 38.3688.13 48.8882.90 59.0593.88 30.7889.40 42.46 ESOOD96.70 8.3696.26 12.0084.51 65.9284.40 59.8596.30 18.3792.66 29.30 LaREx89.00 39.6286.57 48.32 94.70 22.6889.94 45.76 98.63 5.8391.77 32.44 Ours93.51 28.50 96.34 17.9791.61 34.60 92.82 29.2396.99 16.06 95.00 22.05 DenseNet-100 MSP96.13 14.1892.64 20.0789.94 33.0288.10 40.2690.86 31.3991.86 26.11 MaxLogit98.68 6.9295.95 16.2692.53 33.2787.74 50.9591.29 42.6693.73 27.37 Energy98.77 6.6596.08 16.10 92.63 33.2687.73 50.9591.33 42.7893.80 27.31 Mahalanobis97.12 15.9096.52 15.1370.75 77.4675.42 71.1095.97 25.1188.83 36.69 GradNorm95.91 26.7887.71 65.6380.30 77.3280.70 75.7279.09 91.2186.35 61.91 NNGuide95.49 18.6893.28 19.2488.94 42.7989.81 34.0892.92 24.6692.37 26.34 NECO98.71 6.8896.00 16.0192.52 33.3387.55 50.9191.54 40.8193.74 27.02 ReAct98.45 9.1695.59 18.2692.37 32.2890.31 37.9592.17 34.5794.05 24.94 ViM99.50 2.25 98.62 6.5990.91 38.3585.72 54.5196.76 19.0195.13 20.68 ESOOD97.34 10.5683.45 53.5687.50 68.9085.78 65.6634.32 96.5681.68 58.65 LaREx96.54 20.3491.34 35.4590.98 36.7888.33 39.0296.01 15.4492.64 29.41 Ours98.24 9.8197.67 10.7390.07 40.08 94.14 23.59 97.92 12.41 96.13 17.19 and 19.03%. On DenseNet-100 with ID = CIFAR-10, our method improves AUROC by 0.5% over ViM and 1.31% over MSP, and reduces FPR by 3.5% and 5.68% relative to ViM and MSP, respectively. For CIFAR-100, ESOOD edges out our method in AUROC by 0.04%, but our method achieves a 5.09% lower FPR. ViM ranks third in AUROC, trailing ours by 0.05%, and second in FPR, with 2.63% higher than ours. In Table 3 (ResNet-50), our method achieves the best Average score, improving AU- ROC by 3.38% over Mahalanobis and 4.47% over NNGuide, while reducing FPR by 7.9% and 14.53%, respectively. For RegNet, our method is the second-best performer after ReAct, with an AUROC lower by 3.52% and an FPR higher by 6.35%, whereas ReAct performs poorly on ResNet-50, highlighting that it is extrapolating the signal received by Energy. Compared to the third-place NNGuide, our approach improves AUROC by 4.41% and reduces FPR by 13.58%. 4.3 Ablation Studies Our method builds an ID representation that captures variations across both classes and hierarchical depths of the backbone network. Accordingly, we analyze two key factors: (i) the stage-level features of the backbone used for prototype construction, and (i) the size of the calibration set drawn from the ID data to form class prototypes. Size of Calibration Set. We study the impact of calibration set size (α) on performance, averaging results across four OOD datasets (Fig. 2). For CIFAR-10, AUROC improves modestly up to α ≈ 10% before plateauing, with FPR reaching its minimum near that point. For CIFAR-100, most gains occur by α ≈ 5%, with incremental improvement Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection9 (a) CIFAR-10 AUROC(b) CIFAR-100 AUROC(c) ImageNet-1k AUROC (d) CIFAR-10 FPR(e) CIFAR-100 FPR(f) ImageNet-1k FPR Fig. 2: Effect of calibration set size on AUROC (top row) and false positive rate (bottom row) for CIFAR-10, CIFAR-100, and ImageNet-1k. Fig. 3: AUROC and FPR using the penultimate layer vs. the last three layers across three ID datasets: CIFAR-10 (Exp1), CIFAR-100 (Exp2), and ImageNet-1K (Exp3). Fig. 4: Impact of weighting schemes across layers on overall detection performance. up to α ≈ 25%, where AUROC peaks and FPR is near its minimum. For ImageNet- 1K, AUROC rises steadily up to α ≈ 25% and then levels off, while FPR decreases 10Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, and Sanjay Madria Table 2: OOD detection results where CIFAR-10 is ID and OOD = CIFAR-100, SVHN) and ID = CIFAR-100 (OOD = CIFAR-10, SVHN). ↑/↓ denote that higher/lower is bet- ter. The first, second, and third best results are highlighted in green, orange, and blue respectively (values in %). ID = CIFAR-10ID = CIFAR-100 Model MethodCIFAR-100SVHNAverageCIFAR-10SVHNAverage AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ ResNet-18 MSP88.76 46.2993.60 19.1791.18 32.7375.62 77.2672.92 83.0174.27 80.14 MaxLogit88.09 53.9994.36 20.8691.22 37.4272.75 84.3967.27 90.2570.01 87.32 Energy85.04 64.9093.69 29.2089.37 47.0566.38 86.8158.26 91.6862.32 89.25 Mahalanobis82.11 59.5994.12 29.0088.12 44.3070.44 78.4677.92 61.7674.18 70.11 GradNorm76.00 77.3492.76 37.6584.38 57.5027.77 97.3722.41 98.0525.09 97.71 NNGuide89.55 41.6294.59 16.0992.07 28.8575.82 79.3376.51 68.2576.17 73.79 NECO76.86 67.7295.04 32.2685.95 49.9939.79 95.2745.93 91.0642.86 93.16 ReAct80.06 82.3391.64 46.3185.85 64.3228.57 95.9536.60 92.7632.59 94.36 ViM85.55 53.8395.69 22.5290.62 38.1764.48 86.9376.72 68.1570.60 77.54 ESOOD84.56 62.3498.19 8.6791.38 35.51 79.78 80.6590.19 35.4584.99 58.05 LaREx88.20 53.4595.32 18.5091.76 35.9873.11 82.4590.45 36.0981.78 59.27 Ours87.94 50.27 98.94 5.92 93.44 28.1074.47 79.84 95.52 22.31 85.00 51.08 DenseNet-100 MSP86.78 47.0693.46 17.7190.12 32.3975.72 62.1579.82 52.7477.77 57.45 MaxLogit86.41 59.1196.17 14.1891.29 36.6577.10 63.5783.45 48.0980.28 55.83 Energy86.44 59.1296.28 14.1291.36 36.6276.99 63.5483.44 48.1080.22 55.82 Mahalanobis78.99 67.9797.18 15.4288.09 41.7040.51 95.5389.23 43.2564.87 69.39 GradNorm60.24 94.3094.37 34.8277.31 64.5660.23 90.0582.86 64.1071.55 77.07 NNGuide87.20 46.6093.78 18.5990.49 32.6072.79 83.5183.04 41.8677.92 62.69 NECO86.56 58.0796.14 14.1691.35 36.12 77.12 63.5083.85 47.1980.49 55.35 ReAct87.33 51.9795.43 17.4491.38 34.7175.46 68.2485.63 41.7080.55 54.97 ViM86.65 57.02 99.29 3.3992.97 30.2171.68 69.7093.66 28.3788.85 37.74 ESOOD86.56 58.6797.89 11.3292.23 35.0073.45 65.6794.56 30.32 88.94 40.20 LaREx89.34 50.1597.99 10.15 93.67 30.1575.12 70.0593.49 29.9884.31 50.02 Ours88.34 45.8198.74 6.5393.54 26.1767.57 79.15 96.33 17.9188.90 35.11 Fig. 5: Per-layer cosine similarity scores for the last three layers of ResNet-18 on ID data (CIFAR-10)and four OOD datasets (SVHN, Textures, LSUN, Places). monotonically. Overall, small calibration sets (α ≈ 5%–10%) already perform well, with diminishing yet non-trivial benefits up to α≈ 25%. Cosine Scores across Layers. Fig. 5 visualizes cosine similarity distributions for CIFAR- 10 (ID) and four OOD datasets across the last three stages of ResNet-18. The ID scores remain sharply peaked near 1.0, while OOD scores cluster lower (∼ 0.75−0.90) and shift slightly leftward with depth, increasing the separation between ID and OOD samples. This behavior supports cosine similarity as an effective and stable criterion for OOD detection across intermediate layers. Weightage of Backbone Stages. We evaluate the contribution of different backbone stages under two configurations: Prototype Fusion: A Training-Free Multi-Layer Approach to OOD Detection11 Table 3: OOD detection results on the ImageNet-1k dataset. ↑/↓ denote that higher/lower values are better. The first, second, and third best results are highlighted in green, orange, and blue, respectively (values in %). Model Method SUNPlacesiNatTexturesAverage AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ AUROC↑ FPR↓ ResNet-50 MSP79.25 79.4877.48 78.5984.65 62.6974.78 87.7679.04 77.13 MaxLogit74.78 85.8172.64 85.9080.25 76.4769.25 91.7474.23 84.98 Energy50.82 89.7250.55 90.2351.27 87.5148.57 94.2850.30 90.44 Mahalanobis79.60 54.9777.26 65.6690.48 29.8987.13 53.0983.62 50.90 GradNorm30.01 94.0929.56 95.3130.72 90.8939.25 91.0632.38 92.84 NNGuide81.14 73.11 79.40 72.72 97.21 12.7972.39 71.5182.53 57.53 NECO25.13 97.4023.98 97.6723.85 97.1351.02 89.2831.00 95.37 ReAct24.10 96.4523.08 97.3723.87 95.2635.14 94.5226.55 95.90 ViM51.78 90.4551.36 90.5982.38 55.9849.41 93.8858.73 82.72 ESOOD83.45 60.6775.67 80.3879.76 57.8768.87 76.8976.94 68.95 LareX82.98 61.1485.60 70.0791.02 30.7896.34 20.4988.99 45.62 Ours80.68 59.2777.68 66.0293.56 27.25 96.08 19.55 87.00 43.02 RegNet MSP83.36 58.3281.51 58.4489.84 39.1380.74 64.7983.86 55.17 MaxLogit79.12 63.3375.80 61.5485.63 44.8973.44 69.4878.50 59.81 Energy84.05 58.2582.10 58.5290.69 39.1081.46 64.8584.57 55.18 Mahalanobis50.94 85.9952.84 85.0157.14 79.5184.98 53.6261.48 76.03 GradNorm78.64 74.4271.62 81.5587.02 54.1781.86 67.5079.78 69.41 NECO83.17 63.4981.02 66.2990.30 37.0084.19 47.9884.67 53.69 ReAct92.78 32.86 90.18 41.80 97.02 14.4391.69 35.21 92.92 31.08 ViM53.48 84.0655.05 83.3760.16 77.4089.62 44.1664.58 72.25 NNGuide74.55 79.4483.72 55.5292.08 33.3189.60 35.7684.99 51.01 ESOOD81.01 65.3480.98 59.3391.98 35.2180.23 40.6583.55 50.13 LareX83.03 60.9289.75 63.7291.43 29.1497.76 15.6190.49 42.35 Ours83.83 56.2880.52 63.7994.76 22.45 98.48 7.2089.40 37.43 1. Feature source: We compare multi-stage features—the final activations from the last three residual stages (before global average pooling)—against using only the penulti- mate (top) stage. As shown in Fig. 3, aggregating features from the last three stages consistently yields lower FPR and higher AUROC than relying solely on the penulti- mate stage across all three benchmarks. 2. Stage weighting: Within the multi-stage setting, we vary the relative weights as- signed to each stage. Fig. 4 evaluates four weighting schemes: shallow-heavy (largest weight on the earliest stage), middle-heavy (largest weight on the middle stage), top- heavy (largest weight on the deepest stage), and uniform (equal weights). The uniform weighting consistently achieves the strongest performance across datasets. 5 Conclusion and Future Work We proposed a novel post-hoc, training-free OOD detection method that leverages internal network representations and class labels from ID data. By constructing class-specific pro- totypes from intermediate features and comparing test samples via cosine similarity, our approach captures discriminative cues across multiple layers. Extensive experiments show consistent improvements over existing post-hoc detectors across diverse OOD datasets and ID benchmarks, including large-scale settings such as ImageNet-1K, where it improves AU- ROC by 4.14% and reduces FPR by up to 13.85%. We hope our work underscores the 12Shreen Gul, Mohamed Elmahallawy, Ardhendu Tripathy, and Sanjay Madria value of internal feature geometry for OOD detection and inspires research that further integrates representation learning with reliable uncertainty estimation. References 1. Ammar, M.B., Belkhir, N., Popescu, S., Manzanera, A., Franchi, G.: Neco: Neural collapse based out-of-distribution detection. arXiv (2023) 2. Arnez, F., et al.: Latent representation entropy density for distribution shift detection. In: Proceedings of the Conference on Uncertainty in Artificial Intelligence (UAI) (2024) 3. Dong, X., Guo, J., Li, A., Ting, W.M., Liu, C., Kung, H.T.: Neural mean discrepancy for efficient out-of-distribution detection. In: Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR). p. 19195–19205 (2021) 4. Guan, X., Chen, J., Bu, S., Zhou, Y., Zheng, W., Wang, R.: Exploiting discrepancy in fea- ture statistic for out-of-distribution detection. In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI). vol. 38, p. 19858–19866 (2024) 5. Guglielmo, Masana: Leveraging intermediate representations for better out-of-distribution detection. arXiv (2025) 6. Harun, M.Y., Gallardo, J., Kanan, C.: Controlling neural collapse enhances out-of- distribution detection and transfer learning. arXiv (2025) 7. Hendrycks, D., Basart, S., Mazeika, M., Zou, A., Kwon, J., Mostajabi, M., Steinhardt, J., Song, D.: Scaling out-of-distribution detection for real-world settings. arXiv (2019) 8. Hendrycks, D., Gimpel, K.: A baseline for detecting misclassified and out-of-distribution examples in neural networks. arXiv (2016) 9. Huang, R., Geng, A., Li, Y.: On the importance of gradients for detecting distributional shifts in the wild. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 34, p. 677–689 (2021) 10. Jelenić, et al.: Out-of-distribution detection by leveraging between-layer transformation smoothness. arXiv (2023) 11. Lambert, B., Forbes, F., Doyle, S., Dojat, M.: Multi-layer aggregation as a key to feature- based ood detection. In: International Workshop on Uncertainty for Safe Utilization of Ma- chine Learning in Medical Imaging. p. 104–114 (2023) 12. Liu, L., Qin, Y.: Detecting out-of-distribution through the lens of neural collapse. In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). p. 15424–15433 (2025) 13. Liu, W., Wang, X., Owens, J., Li, Y.: Energy-based out-of-distribution detection. In: Ad- vances in Neural Information Processing Systems (NeurIPS). vol. 33, p. 21464–21475 (2020) 14. Park, J., Jung, Y.G., Teoh, A.B.J.: Nearest neighbor guidance for out-of-distribution de- tection. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). p. 1686–1695 (2023) 15. Sehwag, V., Chiang, M., Mittal, P.: Ssd: A unified framework for self-supervised outlier detection. arXiv (2021) 16. Sun, Y., Guo, C., Li, Y.: React: Out-of-distribution detection with rectified activations. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 34, p. 144–157 (2021) 17. Sun, Y., et al.: Out-of-distribution detection with deep nearest neighbors. In: Proceedings of the 39th International Conference on Machine Learning (ICML). p. 20827–20840. Proceed- ings of Machine Learning Research (PMLR) (2022) 18. Wang, H., Li, Z., Feng, L., Zhang, W.: Vim: Out-of-distribution detection with virtual-logit matching. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). p. 4921–4930 (2022) 19. Wang, H., Zhao, C., Chen, F.: Efficient out-of-distribution detection via layer-adaptive scoring and early stopping. Frontiers in Big Data 7, 1444634 (2024) 20. Wu, Y., et al.: Pursuing feature separation based on neural collapse for out-of-distribution detection. In: International Conference on Learning Representations (ICLR) (2025) 21. Yang, G., et al.: Eood: Entropy-based out-of-distribution detection. arXiv (2025)