摘要：在对一个文档基准上的基于扰动的 OOD 检测器进行审计时，我们记录到 AUROC 为 0.326——远低于 0.5 的随机水平。原因是基准泄漏：被指定为“OOD”的类别实际上是模型训练过的类别，因此其样本位于分布内拟合集内，而检测器因正确地将其排序为熟悉样本而受到惩罚。删除该类别并在两个领域中重新训练 35 个模型后，得分升至 0.911。我们将这种污染提炼为一种泄漏指纹——近乎完美的监督式可解码性（AUROC 约为 1），同时无监督检测能力降至 0.65 以下——并在由 52 种设置构成的受控测试组中验证了它：其中包括 20 个泄漏设置和 32 个干净设置，覆盖 CIFAR-10/100 上的 ResNet-50 和 ViT-B/16；在嵌入空间中，灵敏度为 18/20，特异性为 31/32；与之匹配的“从拟合集排除”对照组则实现了 20/20 的完美结果。对 24 个标准近/远 OOD 基准配对进行的真实环境审计，仅在一个配对上触发警报（本质上困难的 CIFAR-100 对 CIFAR-10 配对），且没有任何远 OOD 配对触发，证实了该方法的特异性，也表明标准的跨数据集构建是干净的。在修正后的协议下，扰动信号可解码但不可检测：监督式读取器能够恢复 OOD 信号（AUROC 为 0.87-1.00），但没有无监督检测器能够做到；该扰动方法也没有优于普通 Mahalanobis 距离。我们从理论上解释了其中原因，并出于透明度考虑撤回了此前一个循环相关性结论。本文的贡献是修正后的协议和经过验证的泄漏诊断方法，而非一种新的 OOD 方法。

Abstract:While auditing a perturbation-based OOD detector on a document benchmark, we recorded an AUROC of 0.326 -- well below the 0.5 chance level. The cause is a benchmark leak: the designated "OOD" class is one the model was trained on, so its examples sit inside the in-distribution fit set and the detector is penalized for correctly ranking them as familiar. Deleting the class and retraining 35 models across two domains raises the score to 0.911. We distill the contamination into a leak fingerprint -- near-perfect supervised decodability (AUROC approximately 1) coupled with unsupervised detection collapsed below 0.65 -- and validate it on a controlled battery of 52 settings (20 leaked, 32 clean) across ResNet-50 and ViT-B/16 on CIFAR-10/100, achieving sensitivity 18/20 and specificity 31/32 in embedding space; the matched fit-set-exclusion controls are perfect at 20/20. An in-the-wild audit of 24 standard near/far OOD benchmark pairs fires on exactly one (the intrinsically hard CIFAR-100 vs CIFAR-10 pair) and on no far-OOD pair, confirming specificity and that standard cross-dataset construction is clean. Under the corrected protocol, perturbation signals are decodable but not detectable: a supervised reader recovers the OOD signal (AUROC 0.87-1.00) while no unsupervised detector does, and the perturbation method does not improve on plain Mahalanobis distance. We provide a theoretical account of why and, for transparency, retract an earlier circular correlation. The contributions are a corrected protocol and a validated leak diagnostic, not a new OOD method.