Out Of Distribution Detection¶
Core Idea¶
Out-of-distribution detection is the structural move of recognising, before issuing a verdict, that the current input lies outside the regime where the issuing system's competence has been calibrated. It separates the question "what does my system say about this case?" from the prior question "is this case the kind of case my system was built for?" — and routes negative answers to the second question onto a different path (defer, escalate, abstain, refer, demand new evidence) rather than letting the system answer anyway.
The pattern factors into three sharable parts. There is a competence region — the implicit set of cases the system was designed, trained, or licensed to handle. There is a scope detector — whatever tells the system that the current input falls outside that region. And there is a deferral path — the alternative response when the detector fires. Whether the competence region is a training distribution, a clinician's specialty, a court's jurisdiction, a sensor's calibration range, or a contract's coverage, the commitment is the same: judgments within competence stay in-system, while cases outside competence are routed elsewhere, and the system reports its own scope alongside its answers. What makes this a distinct prime rather than a special case of "uncertainty" is the coupled scope-judgement architecture: the same artefact that issues answers must also assess whether the question is within its remit. Without the pairing, one gets either a confident system that is silently wrong on out-of-scope cases or a scope-only system that can answer nothing. The prime names the move that makes these two faculties travel together.
How would you explain it like I'm…
Not My Pool
Know When To Pass
Knowing When You're Out Of Scope
Structural Signature¶
the decision system (answerer) — the competence region — the scope detector — the in/out-of-scope routing decision — the deferral path — the coupled scope-judgement architecture
A system performs out-of-distribution detection when each of the following holds:
- A decision system. There is an answerer that issues verdicts — a classifier, a clinician, a court, a sensor, a contract-bound procedure.
- A competence region. There is an implicit set of cases the system was designed, trained, or licensed to handle well — a training distribution, a specialty, a jurisdiction, a calibration range, a contract's coverage.
- A scope detector. A mechanism assesses whether the current input falls inside or outside the competence region — an OOD score, a triage gate, a standing/jurisdiction test, a range check, a precondition.
- A routing decision. Before (or alongside) issuing a verdict, the system asks the prior question "is this the kind of case I was built for?" and uses the detector's answer to decide whether to answer or to route away.
- A deferral path. The load-bearing alternative: when the detector fires, the case is routed to a different response — defer, escalate, abstain, refer, demand new evidence, enter a safe state — rather than answered anyway. The deferral path has its own failure modes (over-deferral collapses throughput; under-deferral yields silent overreach).
- Coupled scope-judgement architecture. The defining invariant: the same artefact that issues answers must also assess whether the question is within its remit. Without the coupling one gets either a confident system silently wrong out of scope, or a scope-only system that answers nothing. Scope detection is orthogonal to calibration — the latter tunes confidence inside the region and is blind to departures from it.
Composed: separating "is this in my competence?" from "what is my answer?" and binding a scope detector and deferral path to the answerer as architecture converts silent out-of-scope failure into an explicit referral — leaving in-distribution performance untouched.
What It Is Not¶
- Not
calibration. Calibration tunes how honest the confidence is inside the competence region; OOD detection recognizes departure from the region. Calibration is computed on in-distribution cases and is blind to novel ones — a perfectly calibrated model still answers confidently and wrongly out of scope. - Not
authority_delegation_under_uncertainty. The nearest embedding neighbor concerns who decides when an agent is unsure; OOD detection concerns recognizing the input is outside competence at all, before any delegation. Detection is the scope check; delegation is one possible deferral path downstream of it. - Not
overfitting. Overfitting is a model fitting noise in its training data, degrading in-distribution generalization; OOD detection is about recognizing inputs the training distribution never covered. One is a within-region quality failure, the other a scope-boundary recognition. - Not
screening. Screening sorts cases by a target property (disease, risk, eligibility) to act on them; OOD detection sorts by whether the case is within the system's competence to decide whether to act at all. Screening answers a question; OOD detection decides whether the question is answerable. - Not
classification. Classification assigns inputs to known classes; OOD detection recognizes inputs that belong to no known class (open-set), routing them away rather than forcing a label. A closed-set classifier always answers; OOD detection adds the option to abstain. - Not a confidence threshold alone. Low softmax confidence is not OOD detection: networks are notoriously confidently wrong on novel inputs. The detector must assess distance from the competence region (feature-space distance, density), a faculty orthogonal to the answerer's own confidence.
- Common misclassification. Hoping a well-calibrated model is therefore safe out of scope. Catch it by separating the two failure types: a failure of the answer (in scope, decided wrongly — fix training) versus a failure of the scope check (a case answered that should have been deferred — fix the gate). They live in different layers and demand different fixes.
Broad Use¶
- Machine learning: explicit detectors in classifiers (energy scores, Mahalanobis distance, deep ensembles), open-set recognition, selective prediction with reject options, abstention in conformal prediction.
- Medicine: a generalist recognising "this is outside my scope" and referring to a specialist; triage gates that route patients to the right competence band before treatment commits.
- Law: courts dismissing cases for lack of jurisdiction or standing — the matter is routed to a competent forum rather than adjudicated badly.
- Engineering: flight envelopes, reactor safe-operating regions, and instrument calibration ranges, where a reading outside the calibrated range is reported as out-of-range rather than with false precision.
- Immunology: self/non-self discrimination is structurally an in/out-of-distribution check before mounting a response.
- Statistics and survey research: explicit refusal to generalise beyond the sampled population or outside the convex hull of training data.
- Finance: credit models that decline to score applicants from populations they were not trained on, rather than producing scores that look like predictions.
- Software: precondition checks and design-by-contract systems that throw on out-of-contract inputs rather than producing undefined behaviour.
Clarity¶
Naming the move forces a system to declare its competence region explicitly. Many disputes about failures dissolve once the conversation moves to: was this case in-distribution, and was the scope check armed and working? The diagnostic separates a failure of the answer — the system was in scope and got it wrong — from a failure of the scope check — the system answered a case it should have deferred. These have different fixes — better training versus better gating — and conflating them sends the intervention to the wrong layer.
The prime also clarifies a common false hope: that calibration alone can rescue an out-of-distribution system. Calibration tunes confidence on the in-distribution cases the calibration set saw; it says nothing about cases the calibration set did not contain. Recognising the scope problem as orthogonal to calibration — confidence accuracy inside the region versus recognising departure from the region — is what unblocks deployment in safety-critical settings, where the silent failures live precisely outside the region and are therefore invisible to any amount of in-region calibration.
Manages Complexity¶
The prime compresses a wide failure family — silent miscoverage, hallucination on novel inputs, jurisdiction overreach, mis-triaged patients, instrument readings outside calibration, structures loaded outside design assumptions — into a single architectural question: is the scope detector coupled to the decision system, and what is its deferral path? Once posed, the intervention space sorts cleanly into four moves: widen the competence region (train on more, certify the specialist more broadly); sharpen the detector (better scope score, better triage criteria, better jurisdictional rules); build the deferral path (referral protocol, escalation chain, safe-state fallback); and audit detector miss rates (the unknown-unknowns problem).
This four-way decomposition is what keeps the analysis tractable. A team facing a deployment failure no longer has to debate the entire system at once; it locates the failure in one of four layers and acts there. And because the four layers are substrate-independent, the same decomposition guides an AI deployment, an expert-hiring decision, a jurisdictional rule, and an instrumentation design without re-derivation.
Abstract Reasoning¶
Recognising the pattern enables several substrate-independent moves. Competence-region geometry: the detector implicitly carves the input space into in-region and out-of-region, and the shape of that region — together with the gaps where the detector fails — becomes a first-class design object; the boundary of a training distribution, of a court's jurisdiction, and of a sensor's calibration range are all geometries on input spaces that admit the same diagnostic. The unknown-unknown problem is detector blind-spot: failures concentrate where the detector wrongly says "in" for inputs that are out, which isolates the cost structure into false positives (over-deferral) and false negatives (silent out-of-scope answers) whose consequences are asymmetric across substrates. Coupled- system design: deploying an answerer without a scope detector is structurally analogous to running a sensor without a range light — the system gives outputs, but you cannot tell when to trust them. And deferral has its own failure modes: a detector that routes everything to escalation collapses the system's throughput, while one that routes nothing produces silent overreach, and both are failures of the deferral path distinct from the detector's quality.
Knowledge Transfer¶
The roles map cleanly across domains: the competence region is the training distribution, the specialty, the jurisdiction, the calibration range, the contract's coverage; the scope detector is the OOD score, the triage gate, the standing/jurisdiction test, the range check, the precondition; the deferral path is the referral, the escalation, the abstention, the safe state, the demand for new evidence. Stripped of any single field's vocabulary, the prime reads: before answering, check whether the question is the kind your competence covers, and route the negative cases to something whose competence does — coupling the scope check to the answerer as architecture, not afterthought.
Concrete transfers run in several directions. The explicit "stay in lane, refer up" architecture of emergency-medicine triage ported wholesale into safety-critical machine learning: an answerer, plus a gate, plus a referral path, with the carried lesson that scope detection is neither optional nor free and must be designed explicitly. Jurisdictional doctrine — declare scope, dismiss out-of-scope matters, document the refusal criteria — transfers to AI governance as the practice of declaring a model's operating envelope and refusing cases outside it. The engineering calibration-range concept ports into conformal prediction as the set-valued prediction whose width grows as the input drifts from the calibration set. And the immunological self/non-self check — define normal, flag departures, defer the response — informed the early intrusion-detection literature and recurs in fraud detection and industrial monitoring. A single worked instance shows the move: a chest-X-ray classifier trained on adults, deployed at a paediatric clinic, confidently mis-diagnoses paediatric anatomy until a retrofit OOD detector flags those inputs as out-of-distribution and routes them to a human radiologist — in-distribution performance unchanged, the silent failure converted into an explicit referral. The structurally relevant artefact is never any single component but the triple of model, detector, and deferral path, and that triple is exactly what transfers.
Examples¶
Formal/abstract¶
Selective prediction with a reject option makes the prime's coupled architecture mathematically explicit. Take an image classifier trained on a competence region: a labeled distribution of, say, photographs of common objects. The decision system is the trained network, which outputs a class plus a confidence. Ordinary deployment answers every input. The prime's move is to bolt on a scope detector — a separate score that estimates whether the current input lies inside the training distribution. A standard construction uses the Mahalanobis distance of the input's feature representation to the nearest class-conditional Gaussian fitted on training features: in-distribution inputs land close to a training cluster (low distance), genuinely novel inputs land far (high distance). The routing decision thresholds this score: if the distance exceeds \(\tau\), the input is flagged out-of-distribution and sent to the deferral path (abstain, or escalate to a human) rather than classified. Crucially, this is orthogonal to calibration: temperature-scaling the network's softmax tunes how honest its confidence is on in-distribution cases, but a perfectly calibrated network still emits a confident, wrong label on a photo from a class it never saw — calibration is computed on the training distribution and is blind to departures from it, which is exactly why scope detection must be a separate faculty. The design exposes the prime's asymmetric cost structure as a tunable: raising \(\tau\) (defer less) increases silent overreach (false negatives — out-of-scope inputs answered anyway), while lowering it (defer more) increases over-deferral (false positives — in-scope inputs needlessly escalated, collapsing throughput). Conformal prediction formalizes the same coupling differently, emitting a prediction set whose size grows as the input drifts from the calibration data, so the system's own output width signals departure from competence. The intervention the prime prescribes is architectural: design the detector and the deferral path as first-class components alongside the answerer, and tune the threshold against the asymmetric cost of the two error types.
Mapped back: Selective prediction instantiates the full signature — an answerer, a feature-distance scope detector, a thresholded routing decision, and a deferral path — with the calibration-orthogonality showing precisely why "is this in my competence?" must be a separate faculty from "what is my answer?"
Applied/industry¶
Emergency-medicine triage and judicial jurisdiction are the same scope-then-answer architecture in medicine and in law — and the medical case is in fact where the ML pattern was borrowed from. In an emergency department, the decision system is the treating clinician (or a care pathway), and the competence region is the band of conditions that clinician or unit is licensed and equipped to handle. Before committing to treatment, a triage gate assesses whether the presenting case is the kind of case this competence covers: a patient with symptoms outside the ED's scope (a complex cardiac case, a pediatric anatomy the unit is not set up for) is routed to the deferral path — referral to a specialist or transfer — rather than treated badly in place. The prime's lesson, carried wholesale into safety-critical ML, is that this scope check is neither optional nor free: "stay in lane, refer up" must be designed and staffed, not assumed. Jurisdiction is the identical structure in law: a court is the answerer, its competence region is its statutory jurisdiction and the standing requirements that define which disputes it may hear, and the scope detector is the jurisdiction-and-standing test applied before the merits. A case outside the court's remit is dismissed for lack of jurisdiction — routed to a competent forum — rather than adjudicated wrongly, which is exactly deferral, with the dismissal documenting the refusal criteria. The shared diagnostic the prime supplies separates two failure types that demand different fixes: a failure of the answer (in scope, decided wrongly — fix the training, the clinician's skill, the legal reasoning) versus a failure of the scope check (a case answered that should have been deferred — fix the gate, the triage criteria, the standing test). The concrete transfer is direct and documented: a chest-X-ray model trained on adults but deployed at a pediatric clinic confidently mis-reads pediatric anatomy until a retrofit OOD detector flags those inputs and routes them to a human radiologist — in-distribution performance untouched, the silent failure converted into an explicit referral, the medical triage architecture imported into the model as detector-plus-deferral.
Mapped back: Triage and jurisdiction are the same prime as selective prediction — an answerer coupled to a scope detector that routes out-of-competence cases to a deferral path — so the architecture and its answer-failure-versus-scope-failure diagnostic transfer across the medical, legal, and machine-learning substrates, with medical triage the documented source of the ML deployment pattern.
Structural Tensions¶
T1 — Scope Check versus Calibration (scopal). Detecting that an input is out of competence is orthogonal to tuning confidence inside the competence region; calibration is computed on in-distribution cases and is blind to departures from them. The competing concept is confidence calibration. The characteristic failure is the false hope that a well-calibrated model is safe out of scope — a perfectly calibrated network still emits a confident wrong label on a class it never saw. Diagnostic: is the system tuned for confidence accuracy inside the region, or for recognizing departure from it — and is the latter actually present?
T2 — Answer Failure versus Scope Failure (sign/direction). Two failures present alike but demand different fixes: the system was in scope and got it wrong (fix training) versus answered a case it should have deferred (fix gating). The boundary is between the answer layer and the scope layer. The characteristic failure is sending the intervention to the wrong layer — retraining the model when the gate was missing, or hardening the gate when the in-scope answer was simply wrong. Diagnostic: was the failing case in the competence region (answer failure) or out of it (scope failure)?
T3 — Over-Deferral versus Silent Overreach (measurement). The deferral threshold trades two asymmetric errors: defer too much and throughput collapses, defer too little and out-of-scope cases are answered anyway. The tension is the threshold setting. The characteristic failure is tuning for one error blind to the other — a detector that routes everything to escalation (useless) or nothing (silently wrong out of scope). Diagnostic: at the current threshold, what are the false-positive (over-deferral) and false-negative (silent overreach) rates, and is their asymmetric cost reflected?
T4 — Coupled Architecture versus Bolt-On Afterthought (coupling). The defining invariant is that the same artifact issuing answers must also assess its own remit; a scope detector designed as an afterthought may not see what the answerer sees. The competing concern is the integration of detection with judgment. The characteristic failure is deploying an answerer with no coupled detector (confident, silently wrong out of scope) or a detector disconnected from the answerer's actual feature space. Diagnostic: is scope detection bound to the answerer as architecture, or is it a separate component blind to the answerer's representation?
T5 — Detector Blind-Spot versus Unknown Unknowns (measurement). Failures concentrate exactly where the detector wrongly says "in" for inputs that are out — the detector's own false negatives. The boundary is with the unknown-unknowns problem. The characteristic failure is trusting a scope check whose miss rate on truly novel inputs is unmeasured, so the most dangerous out-of-scope cases pass as in-scope. Diagnostic: has the detector's miss rate on genuinely out-of-distribution inputs been audited, or only its behavior on inputs already known to be out?
T6 — Deferral Path Existence versus Quality (scalar). A deferral path is only as good as where it routes; an escalation chain that overloads the human, or a safe state that is itself unsafe, fails even when the detector fires correctly. The competing concern is the capacity and quality of the fallback. The characteristic failure is firing the detector correctly into a deferral path that cannot absorb the volume or makes a worse decision than answering would have. Diagnostic: when the detector fires, does the deferral path have the capacity and competence to handle the routed cases, or does it merely move the failure?
Structural–Framed Character¶
Out-of-distribution detection sits on the structural side of the middle of the structural–framed spectrum — mixed-structural, aggregate 0.3, the most structural-leaning of the mixed primes in this batch. The coupled scope-detector-deferral architecture is a clean three-part structure that recurs genuinely across substrates, and only two diagnostics register any framed load.
The structural core is strong and pulls the grade down toward zero: the coupled architecture — a competence region, a scope detector, and a deferral path bound to an answerer — recognizes a pattern present across ML selective prediction, emergency-medicine triage, judicial jurisdiction, engineering flight envelopes, and immunological self/non-self discrimination, the last being a biological instance with no human practice involved. Two criteria read fully structural at 0: evaluative_weight (no normative load — routing an out-of-scope case is value-neutral) and human_practice_bound (0 — the immunological self/non-self check shows the scope-then-defer structure running in a biological substrate indifferently, so it does not require a human practice to exist). The two half-framed marks are modest. vocab_travels (0.5): the ML-origin lexicon — OOD score, distribution, deferral, selective prediction — travels usable but with translation into medicine and law. institutional_origin (0.5): the named origin is ML reliability engineering. import_vs_recognize (0.5): invoking OOD detection imports the scope-detector-plus-deferral frame, though it is mostly recognized as a bare structure (the prime is largely about spotting an architecture already implicit in triage or jurisdiction). The three-part scope-and-defer skeleton is genuinely cross-substrate with a clean signature and a biological instance, which is why this earns the lowest framed score in the mixed band; the ML-origin vocabulary is essentially the only thing keeping it off a structural zero, consistent with 0.3.
Substrate Independence¶
Out-of-distribution detection is a highly substrate-independent prime — composite 4 / 5 on the substrate-independence scale. Its structural abstraction is high (4): the signature is a clean three-part coupling — a competence scope, a detector that flags inputs outside it, and a deferral or abstention action — that carries no commitment to what kind of system holds the scope. Domain breadth is wide (4): the same structure operates with the same force across machine learning (energy scores, Mahalanobis distance, open-set recognition, conformal abstention), medicine (a generalist recognizing "this is outside my scope" and referring on; triage gates), law (courts dismissing for lack of jurisdiction or standing, routing to a competent forum), engineering (flight envelopes, reactor safe-operating regions, instrument calibration ranges that report out-of-range rather than false precision), and — decisively beyond designed and institutional systems — immunology, where self/non-self discrimination is structurally an in/out-of-distribution check before mounting a response, a genuine biological instance. Transfer evidence is concrete (4): the same scope/detector/deferral pattern is documented across ML, clinical triage, jurisdictional law, engineering envelopes, and immune recognition, with the reject-option and design-by-contract precondition-check being recognizably the same move in software. Genuinely cross-substrate spread — including a non-anthropic biological case — together with a clean medium-neutral signature lifts the composite to a strong 4, just short of the top because the bulk of named instances are designed or institutional competence-bounded systems.
- Composite substrate independence — 4 / 5
- Domain breadth — 4 / 5
- Structural abstraction — 4 / 5
- Transfer evidence — 4 / 5
Neighborhood in Abstraction Space¶
Out Of Distribution Detection sits in a sparse region of abstraction space (97th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely rather than landing on a neighbor.
Family — Unclustered & Miscellaneous (91 primes)
Nearest neighbors
- Signal Detection Theory — 0.71
- Self Checking — 0.67
- Absence Of Evidence Vs Evidence Of Absence — 0.65
- Boundary Signal Spillover — 0.65
- Underspecification — 0.65
Computed from structural-signature embeddings · 2026-06-14
Not to Be Confused With¶
The most consequential confusion is with calibration, because both concern when to trust a system's outputs and both are invoked in safety-critical deployment — yet they are orthogonal faculties, and conflating them is the single most dangerous error the prime guards against. Calibration tunes the honesty of confidence inside the competence region: a well-calibrated model that reports 80% confidence is right about 80% of the time on cases drawn from its training distribution. It is computed entirely on in-distribution data. Out-of-distribution detection recognizes that the current input is not from that distribution at all. The decisive fact is that calibration is structurally blind to out-of-scope inputs: a perfectly calibrated network still emits a confident, wrong label on a photograph from a class it never saw, because nothing in the calibration procedure ever measured behavior outside the region. This is why low confidence cannot substitute for OOD detection — neural networks are notoriously confidently wrong on novel inputs, assigning high softmax probability to garbage. A practitioner who believes "we calibrated the model, so it knows when it doesn't know" has made exactly the false-hope error the prime names: calibration says how reliable the answer is given the question is in scope; OOD detection asks the prior question of whether the question is in scope at all, and the two must be separate components.
A second genuine confusion is with authority_delegation_under_uncertainty, the embedding-nearest neighbor (similarity 0.84), and the difference is between recognizing an out-of-competence case and routing it. Authority delegation concerns the question of who should decide when the primary agent is uncertain or unauthorized — the escalation chain, the hand-off to a higher authority, the rules governing when a subordinate defers upward. Out-of-distribution detection concerns the prior question of recognizing that the input falls outside competence in the first place. In the prime's own decomposition, OOD detection is the scope detector plus routing decision, while authority delegation is one possible deferral path — what happens after the detector fires. The two chain (detect out-of-scope, then delegate to the appropriate authority), but they are distinct and fail independently. A system can have an excellent delegation structure (clear escalation, capable humans on call) yet no scope detector, so out-of-competence cases are never recognized and never escalated — answered silently and wrongly. Conversely, a sharp detector routing into a delegation path that overloads the human or lacks competence fails even when the detector fires correctly. Confusing them sends the intervention to the wrong layer: building a better escalation chain does nothing if the gate that decides what to escalate is absent.
A third confusion worth marking is with screening, since both sort inputs into act/don't-act buckets via a gate applied before the main decision. The difference is what the gate sorts on. Screening sorts cases by a target property of interest — does this patient likely have the disease, is this applicant creditworthy, is this transaction fraudulent — in order to decide how to act on them. The sorted property is the very thing the system cares about. Out-of-distribution detection sorts by a meta-property: whether the case is the kind of case the system is competent to judge at all, in order to decide whether to act. A screening gate that flags a high-risk patient is making a substantive judgment within competence; an OOD gate that flags an input is declining to make a judgment because the input is outside competence. The error of conflating them is to treat the scope check as if it were a substantive triage by target property — tuning it to catch "important" cases rather than "out-of-competence" ones — when its job is precisely the orthogonal one of detecting departure from the training distribution regardless of how important or unimportant the case's content is.
For a practitioner these distinctions resolve into keeping four faculties separate: how honest is the confidence within scope (calibration), whether the input is within scope at all (OOD detection — scope detector plus routing), who decides once it is flagged out of scope (authority delegation — the deferral path), and sorting in-scope cases by a target property (screening). Out-of-distribution detection is specifically the scope-recognition-and-routing faculty — and its irreducible contribution, which none of the others supply, is the coupled architecture that asks "is this the kind of case I was built for?" before committing to an answer, converting silent out-of-scope failure into an explicit referral.
Solution Archetypes¶
No catalogued solution archetypes reference this prime yet.