New Theory Explains Self-Poisoning in Adaptive OOD Detection

Adaptive out-of-distribution (OOD) detection systems are designed to identify data points that differ significantly from their training distribution, often by updating a memory bank with unlabelled data streams. However, this research uncovers a critical vulnerability: these systems can "self-poison." The paper models the impurity of the memory bank using a generalized Pólya urn, demonstrating a provable dynamical law that governs this self-poisoning. It shows that if a certain "reproduction number" exceeds one, the memory bank becomes fully poisoned, leading to the collapse of the OOD detector. This near-critical design is observed across various encoder families. To combat this, the researchers propose a certified admission gate. This gate operates by referencing a frozen reserve of data, effectively severing the feedback loop that causes poisoning. This mechanism prevents the detector's collapse, even under adversarial contamination, while maintaining control over false positives without requiring labels. For scenarios where static calibration fails due to data drift, the paper introduces CDC, a method that restores nominal false positive rates, again without labels. Finally, the research presents a "two-world impossibility theorem," which establishes that drift and contamination are fundamentally indistinguishable without labels. This theorem defines a closed-form power ceiling for label-free adaptive OOD detection, which the proposed procedures approach. Together, these contributions provide a comprehensive understanding and practical solutions for robust label-free adaptive OOD detection.