Jul 27, 2025

Thermodynamics-inspired OOD Detection

Salmaan Barday, Gary Louw

A different approach to Thermodynamics-inspired Out-of-distribution detection Detection.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow
Arrow
Arrow

The authors present a method for out-of-distribution detection using pre-trained image classifiers. The way they've quantified performance is clear, and figure 1 suggests their method beats an energy-based baseline, which is exciting. The presentation could be clearer - I'm not sure how they define "blockwise energy" E_\ell(x) (I think it's based off projecting to logits for each layer but am not very certain). These results add to a growing body of work showing that intermediate-layer activations may be more useful for probing tasks than final layer activations (see e.g. https://arxiv.org/pdf/2412.09563v1). Confirming/refuting such theories seems like a nice goal for a hackathon.

The project investigates energy-based out-of-distribution detection by studying an extension of that method, in which the energy is computed at every residual block. The approach makes sense and the results are presented clearly. However, no mention is made of AI safety, and the project would have benefited from articulating a clear connection between the research performed and AI safety challenges.

Very interesting work! Seeing comparisons in OOD performance with other methods would indeed be interesting, as you note. The questions with new tools is always *whether they work*. In terms of detecting OOD samples better, this is really valuable and having a strong framework for doing this seems important for nearly all relevant real-world fields of NN use, such as medical and law, providing a heuristic for rejecting answers or at least providing human-readable warnings on the outputs.

However, I think there's another extension of all this work that would be really interesting: Whether we can evaluate the fuzzy boundaries of what is OOD to the models and what isn't. And whether we can see examples of algorithmic generalization (e.g. learning addition instead of memorizing results of single-digit addition tasks) through this method. I'm not certain how feasible it is, but having a proper evaluation of generalized OOD performance that transcends single tasks (i.e. through a benchmark-based method) seems incredibly important and like a feasible extension to the concepts and tools introduced in this work.

While the method is interesting and a reasonable extension, the experimental setup is unclear and limits reproducibility. For example, it isn’t specified how intermediate block activations are mapped to class logits per block (auxiliary heads? a shared classifier? pooling + linear map?), yet the energy definition requires logits.

Block‑wise energy pooling is a tidy proof‑of‑concept, but its benefit over the OOD detector from Liu et al. was unmotivated and unclear. A minimal result could have been to compare this with the reference, and to contextualize this a bit more within the literature (as it was the only reference used). I'm not convinced that this approach has any real implications for AI safety.

The authors could also have explained their experiments and plots more carefully.

Cite this work

@misc {

title={

(HckPrj) Thermodynamics-inspired OOD Detection

},

author={

Salmaan Barday, Gary Louw

},

date={

7/27/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Jan 11, 2026

Eliciting Deception on Generative Search Engines

Large language models (LLMs) with web browsing capabilities are vulnerable to adversarial content injection—where malicious actors embed deceptive claims in web pages to manipulate model outputs. We investigate whether frontier LLMs can be deceived into providing incorrect product recommendations when exposed to adversarial pages.

We evaluate four OpenAI models (gpt-4.1-mini, gpt-4.1, gpt-5-nano, gpt-5-mini) across 30 comparison questions spanning 10 product categories, comparing responses between baseline (truthful) and adversarial (injected) conditions. Our results reveal significant variation: gpt-4.1-mini showed 45.5% deception rate, while gpt-4.1 demonstrated complete resistance. Even frontier gpt-5 models exhibited non-zero deception rates (3.3–7.1%), confirming that adversarial injection remains effective against current models.

These findings underscore the need for robust defenses before deploying LLMs in high-stakes recommendation contexts.

Read More

Jan 11, 2026

SycophantSee - Activation-based diagnostics for prompt engineering: monitoring sycophancy at prompt and generation time

Activation monitoring reveals that prompt framing affects a model's internal state before generation begins.

Read More

Jan 11, 2026

Who Does Your AI Serve? Manipulation By and Of AI Assistants

AI assistants can be both instruments and targets of manipulation. In our project, we investigated both directions across three studies.

AI as Instrument: Operators can instruct AI to prioritise their interests at the expense of users. We found models comply with such instructions 8–52% of the time (Study 1, 12 models, 22 scenarios). In a controlled experiment with 80 human participants, an upselling AI reliably withheld cheaper alternatives from users - not once recommending the cheapest product when explicitly asked - and ~one third of participants failed to detect the manipulation (Study 2).

AI as Target: Users can attempt to manipulate AI into bypassing safety guidelines through psychological tactics. Resistance varied dramatically - from 40% (Mistral Large 3) to 99% (Claude 4.5 Opus) - with strategic deception and boundary erosion proving most effective (Study 3, 153 scenarios, AI judge validated against human raters r=0.83).

Our key finding was that model selection matters significantly in both settings. We learned some models complied with manipulative requests at much higher rates. And we found some models readily follow operator instructions that come at the user's expense - highlighting a tension for model developers between serving paying operators and protecting end users.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.