Out-of distribution (OOD), or novelty detection aims to distinguish samples in unseen distribution from the training distribution. A majority of novelty detection methods focus on noise filtering or representation learning. For example, we train an autoencoder to learn a mapping from the data to the bottleneck layer and use the bottleneck representation or reconstruction error to detect an OOD (Sakruada et al., 2014; Pidhorskyi et al., 2018). Recently, deep generative models (Kingma et al., 2014; Dinh et al., 2017; Goodfellow et al., 2014; Kingma et al., 2018; Schlegl et al., 2017)
are widely used for novelty detection due to their ability to model high dimensional data. However, OOD detection performance of deep generative models has been called into question since they have been observed to assign a higher likelihood to the OOD data than the training data(Nalisnick et al., 2019; Choi et al., 2018).
On the other hand, adversarial examples are widely employed to fool the classifier, and training classifiers against adversarial attacks has shown effectiveness in detecting unknown adversarial attacks(Tramer et al., 2018)
. In this work, we propose blurred data as the adversarial example. When we test novelty detection models on the blurred data generated by Singular Value Decomposition (SVD), we found that the novelty detection models assign higher confidence to the blurred data than the original data.
Motivated by this observation, we employ blurring to prevent the OOD detector from overfitting to low resolution. We propose a new OOD detection model, SVD-RND, which is trained using the idea of Random Network Distillation (RND) (Burda et al., 2019)
to discriminate the training data from the blurred image. SVD-RND is evaluated in the hard target to OOD domain where vanilla generative models show nearly 50% detection accuracy, such as CIFAR-10 to SVHN and ImageNet to CIFAR-10(Nalisnick et al., 2019). Compared to conventional baselines, SVD-RND shows a significant performance gain from 50% to over 90% in these domains. Moreover, SVD-RND shows improvements over baselines on domains where conventional OOD detection schemes show moderate results, such as CIFAR-10 to LSUN.
2 Problem Formulation and Related Work
The goal of OOD detection is to determine whether the data is sampled from the target distribution . Therefore, based on the training data , we train a scalar function that expresses the confidence, or uncertainty of the data. The performance of the OOD detector is tested on the against the OOD dataset . We denote a target and OOD pair as target : OOD in this paper, e.g., CIFAR-10 : SVHN.
In this section, we mention only closely related fields to our research. For a broader survey on deep OOD detection, we recommend the paper from Chalapathy et al. (2019).
OOD Detection: A majority of OOD detection methods rely on a reconstruction error and representation learning. Ruff et al. (2018)
trained a deep neural network to map data into a minimum volume hypersphere. Generative probabilistic novelty detection (GPND)(Pidhorskyi et al., 2018) employed the distance to the latent data manifold as the confidence measure and trained the adversarial autoencoder (AAE) to model the manifold. Deep generative models are widely employed for latent space modeling in OOD detection (Zenati et al., 2018; Sabokrou et al., 2018). However, a recent paper by Nalisnick et al. (2019) discovered that popular deep generative models, such as variational autoencoder (VAE) (Kingma et al., 2014) or GLOW (Kingma et al., 2018), fail to detect simple OOD from the training distribution. While adversarially trained generative models, such as generative adversarial networks (GAN) (Goodfellow et al., 2014) or AAE, are not discussed in Nalisnick et al. (2019), our experiments in GPND show that such models can also struggle to detect such simple OODs.
OOD Detection with Additional Data: Some methods try to solve OOD detection by appending additional data or labels for training. Hendrycks et al. (2019)
trained the detector to additional outlier data independent of the test OOD data.Ruff et al. (2019)2018) designed geometrically transformed data and trained the classifier to distinguish geometric transforms, such as translation, flipping, and rotation. Shalev et al. (2018) fine-tuned the image classifier to predict word embedding. However, the intuition behind these methods is to benefit from potential side information, while our self-generated blurred image focuses on compensating the deep model’s vulnerability to OOD data with a lower effective rank.
Adversarial Examples and OOD Detection on Labeled Data: Some methods combine OOD detection with classification, resulting in OOD detection on labeled data. Adversarial examples can be viewed as generated OOD data that attacks the confidence of a pretrained classifier. Therefore, two fields share similar methodologies. For example, Hendrycks et al. (2017)
set the confidence as the maximum value of the probability output, which is vulnerable against the adversarial examples generated by the Fast Sign Gradient Method (FSGM)(Goodfellow et al., 2014). On the other hand, Liang et al. (2018) employed FSGM counterintuitively to shift the OOD data from the target further, therefore improving OOD detection. Lee et al. (2018) employed Mahalanobis distance to measure uncertainty in the hidden features of the network, which also proved efficient in adversarial defense.
Bayesian Uncertainty Calibration: Bayesian formulation is widely applied for better calibration of the model uncertainty. Recent works employed bayesian neural networks (Sun et al., 2017) or interpreted a neural network’s architecture in the bayesian formulation, such as dropout (Gal et al., 2016), and Adam optimizer (Khan et al., 2018). Our baseline, RND (Burda et al., 2019), can be viewed as the bayesian uncertainty of the model weight under randomly initialized prior (Osband et al., 2018).
In this section, we motivate our use of blurred data as adversarial examples to conventional deep OOD detection methods. Motivatied by the observation, we present our proposed algorithm, SVD-RND, and provide intuitions why SVD-RND help OOD detection.
3.1 Generating Blurred Data
In this work, blurred images function as adversarial examples. We directly employ the SVD on the data matrix of the single image in the training data and force the bottom non-zero singular values to zero to construct a blurred image. Suppose that data image consists of channels, where the -th channel has nonzero singular values . Then, the
-th channel can be represented as the weighted sum of orthonormal vectors.
We prune the bottom non-zero singular values of each channel to reconstruct the blurred image. We test conventional novelty detection methods on blurred images. We first train the VQ-VAE Oord et al. (2017) in the CIFAR-10 (Krizhevsky et al., 2009) dataset. Figure 1 shows the loss of VQ-VAE on the test data and blurred test data (). We follow the settings of the original paper. VQ-VAE assigns higher likelihood to the blurred data than the original data.
We note that this phenomenon is not constrained to the generative models. We trained the RND on the CIFAR-10 dataset and plot the loss in the test data and blurred test data in Figure 1. We refer Appendix B for detailed explanation and employed architecture for the RND in the experiment. We plot the loss on SVHN (Netzer et al., 2011) data for relevance. Multiple skip connections in residual blocks don’t resolve the information leakage on their own. Furthermore, we plot the average loss on the blurred test data and original test data during the training procedure. Throughout the training phase, the model assigns lower uncertainty to the blurred data. This trend is similar to the CIFAR-10 : SVHN phenomenon observed by Nalisnick et al. (2019), where the generative model assigns more confidence to the OOD data from the beginning.
While we employ SVD for our main blurring technique, conventional techniques in image processing can be applied for blurring, such as Discrete Cosine Transform (DCT) or Gaussian Blurring. However, DCT squares the size of the hyperparameter search space, therefore much harder to optimize than SVD. We further compare the performance between SVD and other blurring techniques in Section4.
3.2 OOD Detection Via SVD-RND
We now present our proposed algorithm, SVD-RND. SVD-RND trains the predictor network to discriminate between original and blurred datasets. We first generate blurred datasets from by zeroing the bottom non-zero singular values of each data channel (, where is the number of generated blurred datasets used for training). Then, we assign a different randomly initialized target network to each . Finally, we assign as the target network for the original dataset. Predictor network is trained to minimize the loss against the corresponding target network on each dataset. We do not update the target network during the training procedure.
When the new sample is given, SVD-RND outputs as the uncertainty to the sample. Figure 2 shows the training process of SVD-RND. While the original RND paper employs a single target network to train the predictor network, SVD-RND employs multiple target networks to discriminate the original data from the blurred images. No other regularization techniques or explicit metrics are employed in SVD-RND.
While SVD-RND directly regularizes only on the blurred images, we expect such regularization generally improve OOD detection for the following two reasons. First, while RND fails on OODs generated by blurring, it performs moderately on OODs generated by the orthogonal direction to the dataset. For the evidence, we show in Appendix D on CIFAR-10 dataset that RND is able to detect OODs generated by adding noise orthogonal to the data. RND outputs higher uncertainty to every OOD dataset generated from 20 independent runs.
Second, Equation 2 forces the predictor network to output for the original data , and for the blurred data . Therefore, naturally learns to discriminate between the data and its low-rank projection. From such regularization, we expect to learn the target distribution-specific information from the projection vector, which is previously neglected in conventional deep OOD detection methods. We will verify our reasoning in further experiments.
4 Experimental Results
In this section, we examine the performance of SVD-RND on the target : OOD domain, where deep generative models have been observed to assign a higher likelihood to the OOD data.
4.1 Experiment Setting
SVD-RND is examined in the cases in Table 1. CIFAR-10 : SVHN, CelebA (Liu et al., 2015) : SVHN, and TinyImageNet (Deng et al., 2009) : (SVHN, CIFAR-10, CIFAR-100) are the cases reported by Nalisnick et al. (2019). We expect SVD-RND outperform conventional OOD detection methods by a large margin. We also studied CIFAR-10 : (LSUN (Yu et al., 2015)
, TinyImageNet), LSUN : (SVHN, CIFAR-10, CIFAR-100) and CelebA: (CIFAR-10, CIFAR-100) target : OOD pairs to examine potential tradeoffs of our method. We implement the baselines and SVD-RND in the PyTorch framework.111Our code is based on https://github.com/kuangliu/pytorch-cifar For a unified treatment, we resized all images in all datasets to 3232. We refer to a detailed setting in Appendix C.
For SVD-RND, we optimize the number of blurred non-zero singular values over different datasets. We choose the detector with the best performance across the validation data. We refer to all the parameter settings in Appendix C
. We also examine the case where the image is blurred by DCT and Gaussian blurring. For DCT, we apply the DCT to the image, discard low magnitude signals, and generate the blurred image by inverse DCT. In DCT-RND, we optimize the number of unpruned signals in the frequency domain. For gaussian blurring, we optimize the shape of the Gaussian kernel. We denote this method as GB-RND.
We compare the performance of SVD-RND, DCT-RND, and GB-RND to the following baselines.
Generative Probabilistic Novelty Detector: GPND (Pidhorskyi et al., 2018) is the conventional generative model based novelty detection method that models uncertainty as a deviation of data to the latent representation, which is modeled by the adversarial autoencoder. We trained GPND with further parameter optimization.
Geometric Transforms: We compare the effectiveness of the blurred image against geometric transforms (Golan et al., 2018). The authors use four types of geometric transforms: flip, rotation, vertical translation, and horizontal translation. We compute the independent effects of each transformation by setting them as OOD proxies in the RND framework. Moreover, we also investigate the effect of pixel inversion, contrast reduction, and shearing. We refer Cubuk et al. (2019) for detailed explanation of the augmentation strategies.
RND: We employ RND (Burda et al., 2019) to show the effectiveness of our regularizer directly.
Typicality Test: NalisNick et al. (2019) set the OOD metric of the generative model as the distance between the mean log likelihood of the model on the training data and the log likelihood of the model on the incoming data. We experiment typicality test on the RND framework by employing the test error of RND as the role of negative log likelihood in the generative models.
Five metrics on binary hypothesis testing are used to evaluate the OOD detectors: area under the Receiver Operating Characteristic curve (AUROC), area of the region under the Precision-Recall curve (AUPR), detection accuracy, and TNR (True negative rate) at% TPR (True positive rate). All criterions are bounded between and , and the result close to implies better OOD detection.
4.2 OOD Detection Results
in CIFAR-10 : (SVHN, LSUN, TinyImageNet) domain. Each filled region is 95% confidence interval of the detector. SVD-RND shows small confidence interval in the best performing parameters.Right: Histogram of SVD-RND’s test loss to CIFAR-10 and SVHN data.
We summarize our results on the TNR in 95 TPR in Table 2. We refer to full results in appendix A. In all target : OOD domains except the CelebA : (CIFAR-10, CIFAR-100) domain, SVD-RND outperforms all other baselines in every metric. Furthermore, all the proposed techniques outperform GPND and RND on all target : OOD domains, especially in CIFAR-10 : (LSUN, TinyImageNet) domains and CelebA: (CIFAR-10, CIFAR-100) domains where even GPND and RND show moderate results. For better understanding, we visualize the CIFAR-10 data before and after blurring in Appendix E
. We plot the performance of SVD-RND in 50 epochs over differentin Figure 3. We increase the number of seeds to 4 to check the stability of our result. In the best performing parameter for each OOD data, SVD-RND shows narrow confidence intervals. Furthermore, we extend the Figure 3 to small for comparison. We refer the results in Appendix F.
Furthermore, we plot the output of SVD-RND to target CIFAR-10 data and OOD SVHN data in . SVD-RND further separates SVHN data compared to Figure 1. Also, we compare the test uncertainty of SVD-RND against the test uncertainty of the RND on each (CIFAR-10, SVHN, LSUN, TinyImageNet) data. For SVD-RND, test-loss of each (CIFAR-10, SVHN, LSUN, TinyImageNet) data increases over its test loss of RND. Therefore, SVD-RND further discriminates OOD from the target distribution.
GPND and RND fail to discriminate OOD from the targets in CIFAR-10 : SVHN, LSUN : (SVHN, CIFAR-10, CIFAR-100), TinyImageNet : (SVHN, CIFAR-10, CIFAR-100), and CelebA : SVHN domains. Moreover, GPND performs the SVD of the jacobian matrix in test time, which makes GPND slower than SVD-RND. Furthermore, we visualize the uncertainty prediction of RND and SVD-RND. Figure 4 shows the top-9 examples on CIFAR-10 test data, where SVD-RND and RND assign the highest uncertainty. We observe that SVD-RND tends to assign higher uncertainty to blurry or hardly recognizable image compared to RND.
On the other hand, OOD detection schemes based on geometric transformations (Golan et al., 2018) show generally improved results against GPND and RND on detecting OOD data compared to RND and GPND. Especially in CelebA : (SVHN, CIFAR-10, CIFAR-100) domain, rotation and translation based methods show prominent performance. However, in the CIFAR-10 target domain, OOD detection schemes based on geometric transformations show degraded performance against RND or GPND on LSUN and TinyImageNet OOD data.
Furthermore, typicality test shows mixed results compared to the baseline algorithms.
Finally, we also investigate the case where limited training data is available. We examined the performance of SVD-RND and RND in CIFAR-10 : (LSUN, TinyImageNet) domains. Figure 4 shows the TNR at 95% TPR metric of each method when the number of training data is reduced. For each OOD data, we denote result on SVD-RND as OOD_SVD, and denote result on RND as OOD_RND. Compared to RND, SVD-RND shows consistent performance when only 20% of training data is available. Furthermore, SVD-RND outperforms RND until 16% of training data is available.
5 Further Analysis
In this section, we further analyze and apply SVD-RND for specific scenarios. In Section 5.1
, we examine whether SVD-RND learns better representation compared to the baseline. Furthermore, we propose a novel heuristic for training SVD-RND in Section5.2, where no validation OOD data is available. Finally, we show that we can further improve the performance of SVD-RND by incorporating geometric transformations.
|Activation map||SVD-RND (=28)||RND||Random|
5.1 Representation learning from SVD-RND
While SVD-RND outperforms RND on every target : OOD domains in Section 4, we provide further evidence that SVD-RND learns superior target distribution representation compared to RND. For the evidence, we fine-tune a classifier over the fixed activation map of SVD-RND and RND. We set the activation map as the output of the first 15 or 27 layers of RND and SVD-RND predictor network trained in CIFAR-10 datasets. For the fine-tuning, we either appended three residual blocks and a linear output layer with softmax activation (denoted as 7-layer in Table 3) or a linear layer (denoted as linear in Table 3). Then, we fine-tune the appended network for the CIFAR-10 classification task. The SGD optimizer with learning rate 0.1 is used for fine-tuning, and the learning rate is annealed to 0.01 and 0.001 after 30 and 60 epochs over 100 epochs of training, respectively. We average the result across three fixed random seeds.
We show our results in Table 3. SVD-RND consistently outperforms RND and the randomly initialized network on the fine-tuning task. Therefore, the result supports that SVD-RND learns better target distribution-specific knowledge. Surprisingly, when we fine-tune over 7-layer neural network, RND consistently underperforms over randomly initialized weights.
5.2 Log Effective Rank Criterion in SVD-RND in zero OOD validation data
In our main experiments in Section 4, we used the OOD validation data for tuning the novelty detection methods. However, in realistic scenarios, OOD data are generally unknown to the detector. We propose an effective rank (Roy et al., 2007) based design of SVD-RND that does not use the OOD validation dataset and compare its performance against the results in Section 4. Log effective rank of the single image matrix is defined as the entropy of the normalized singular values of the image matrix.
In equation 3, is defined as the entropy function. Then, effective rank is set to two to the power of log effective rank. We set the effective rank of image data as the averaged effective rank of each channel.
In SVD-RND, selecting each corresponds to regularization against OOD with similar effective rank. We propose selecting each such that average of log effective rank on each blurred dataset is equally spaced to each other. Specifically, suppose the log effective rank of the data averaged in training dataset is . Then, we set the target log effective rank as follows.
Then, we select such that the average of the log effective rank in the blurred dataset with discarded singular values is closest to . We test our criterion in CIFAR-10 and TinyImageNet data with different . We train SVD-RND for 25 epochs for , and 20 epochs for . We show the performance of SVD-RND based on uniform spacing of log effective rank in equation 4 in Table 4, which is denoted as SVD-RND (uniform). We also show results of SVD-RND optimized with the validation OOD data from Table 2 and denote them as SVD-RND (optimized) in Table 4. Uniform SVD-RND already outperforms the second-best methods in Table 2. Furthermore, as increases, uniform SVD-RND approaches the performance of the optimized SVD-RND.
|Target: CIFAR-10, OOD: SVHN/LSUN/TinyImageNet. Target: TinyImageNet (TIMG), OOD: SVHN/CIFAR-10/CIFAR-100|
|Dataset/||AUROC||TNR(95% TPR)||Detection accuracy||AUPR in||AUPR out|
5.3 Further improvement of SVD-RND
|Target: CelebA, OOD: SVHN/CIFAR-10/CIFAR-100|
|Method||AUROC||TNR(95 % TPR)||Detection accuracy||AUPR in||AUPR out|
While SVD-RND achieves reasonable OOD detection performance, combining SVD-RND with other baseline algorithms may further enhance the performance. For example, as shown in Table 2, training against rotated data benefits OOD detection in CelebA dataset. Therefore, we unify SVD-RND and geometric transform-based method to further improve SVD-RND. We treat both blurred data and geometrically transformed data as OOD and train the target network to discriminate the original data from the OOD. We combine rotation and vertical translation with SVD-RND and denote them as SVD-ROT-RND and SVD-VER-RND, respectively.
We compare the performance of SVD-ROT-RND and SVD-VER-RND against rotation and vertical translation in CelebA : (SVHN, CIFAR-10, CIFAR-100) domain. We refer readers to the results in Table 5. We observe that SVD-ROT-RND and SVD-VER-RND outperform their counterparts and SVD-RND. Especially, SVD-ROT-RND and SVD-VER-RND show significant performance gain in CelebA : (CIFAR-10, CIFAR-100) domains.
In this work, a blurred image is introduced as an adversarial example to the deep OOD detection method. SVD-RND is employed for adversarial defense against blurred images. SVD-RND achieves significant performance gain in all target : anomaly domains. Even without the validation OOD data, we can design SVD-RND to outperform conventional OOD detection models. We stress that such performance gain is achieved without external data or additional regularization techniques. Furthermore, experiments on SVD-RND and RND show that the neural network can potentially learn to perform OOD detection, however overfits to blurred data. Understanding this phenomenon will be beneficial to performance of the image-based models.
- Burda et al. (2019) Yuri Burda, Harrison Edwards, Amos Storkey, and Oleg Klimov. Exploration by random network distillation. International Conference on Learning Representations, 2019.
- Chalapathy et al. (2019) Raghavendra Chalapathy and Sanjay Chawla. Deep learning for anomaly detection: a survey. arXiv preprint arXiv:1901.03407, 2019.
- Choi et al. (2018) Hyunsun Choi, Eric Jang, and Alexander A. Alemi. WAIC, but why? generative ensembles for robust anomaly detection. arXiv preprint arXiv:1810.01392, 2018.
- Cubuk et al. (2019) Ekin D. Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V. Le. Autoaugment: learning augmentation policies from data. , 2019.
- Deng et al. (2009) Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: a large-scale hierarchical image database. IEEE Conference on Computer Vision and Pattern Recognition, 2009.
Dinh et al. (2017)
Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using Real NVP.International Conference on Learning Representations, 2017.
Gal et al. (2016)
Yarin Gal and Zoubin Ghahramani. Dropout as bayesian approximation: representing model uncertainty in deep learning.
International Conference on Machine Learning, 2016.
- Golan et al. (2018) Ian Golan and Ran El-Yaniv. Deep anomaly detection using geometric transformations. Neural Information Processing Systems, 2018.
- Goodfellow et al. (2014) Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Neural Information Processing Systems, 2014.
- Goodfellow et al. (2014) Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
- Hendrycks et al. (2017) Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. International Conference on Learning Representations, 2017.
- Hendrycks et al. (2019) Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. International Conference on Learning Representations, 2019.
- Khan et al. (2018) Mohammad Emtiyaz Khan, Didrik Nielsen, Voot Tangkaratt, Wu Lin, Yarin Gal, and Akash Srivastava. Fast and scalable bayesian deep learning by weight perturbation in adam. International Conference on Machine Learning, 2018.
- Kingma et al. (2014) Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. International Conference on Learning Representations, 2014.
- Kingma et al. (2018) Diederik P. Kingma and Prafulla Dhariwal. Glow: generative flow with invertible convolutions. Neural Information Processing Systems, 2018.
- Krizhevsky et al. (2009) Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical Report, University of Toronto, 2009.
- Lee et al. (2018) Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Neural Information Processing Systems, 2018.
- Liang et al. (2018) Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. International Conference on Learning Representations, 2018.
- Liu et al. (2015) Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. International Conference on Computer Vision, 2015.
- Nalisnick et al. (2019) Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don’t know? International Conference on Learning Representations, 2019.
- NalisNick et al. (2019) Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Detecting out-of-distribution inputs to deep generative models using a test for typicality. arXiv prerprint arXiv:1906.02994, 2019.
- Netzer et al. (2011) Yuval. Netzer, Tao. Wang, Adam. Coates, Alessandro. Bissacco, Bo. Wu, and Andrew. Y. Ng. Reading digits in natural images with unsupervised feature learning. NeuralIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
- Oord et al. (2017) Aaron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning. Neural Information Processing Systems, 2017.
- Osband et al. (2018) Ian Osband, John Aslanides, and Albin Cassirer. Randomized prior functions for deep reinforcement learning. arXiv preprint arXiv:1806.033335, 2018.
- Pidhorskyi et al. (2018) Stanislav Pidhorskyi, Ranya Almohsen, Donald A Adjeroh, and Gianfranco Doretto. Generative probabilistic novelty detection with adversarial autoencoders. Neural Information Processing Systems, 2018.
- Roy et al. (2007) Oliver Roy and Martin Vetterli. The effective rank: a measure of effective dimensionality. European Signal Processing Conference, 2007.
- Ruff et al. (2018) Lukas Ruff, Robert Vandermeulen, Nico Göermitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. International Conference on Machine Learning, 2018.
- Ruff et al. (2019) Lukas Ruff, Robert Vandermeulen, Nico Göermitz, Lucas Deecke, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft. Deep semi-supervised anomaly detection. arXiv preprint arXiv:1906.02694, 2019.
- Sabokrou et al. (2018) Mohammad Sabokrou, Mohammad Khalooei, Mahmood Fathy, and Ehsan Adeli. Adversarially learned one-class classifier for novelty detection. IEEE Conference on Computer Vision and Pattern Recognition, 2018.
- Sakruada et al. (2014) Mayu Sakurada and Takehisa Yairi. Anomaly detection using autoencoders with nonlinear dimensionality reduction. Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, 2014.
- Schlegl et al. (2017) Thomas Schlegl, Philipp Seeböck, Sebastian M. Waidstein, Ursula Schmidt-Erfurth, and George Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. Proceedings of the International Conference on Information Processing in Medical Imaging, 2017.
- Shalev et al. (2018) Gabi Shalev, Yossi Adi, and Joseph Keshet. Out-of-distribution detection using multiple semantic label representations. Neural Information Processing Systems, 2018.
Sun et al. (2017)
Shengyang Sun, Changyou Chen, and Lawrence Carin. Learning structured weight uncertainty in bayesian neural networks.
International Conference on Artificial Intelligence and Statistics, 2017.
- Tramer et al. (2018) Florian Tramer, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: attacks and defenses. International Conference on Learning Representations, 2018.
- Yu et al. (2015) Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. LSUN: construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365, 2015.
- Zenati et al. (2018) Houssam Zenati, Chuan Sheng Foo, Bruno Lecouat, Gaurav Manek, and Vijay Ramaseshan Chandrasekhar. Efficient GAN-based anomaly detection. arXiv preprint arXiv:1802.06222, 2018.
Appendix A Full OOD detection Results
|Target: CIFAR-10, OOD: SVHN/LSUN/TinyImageNet|
|Method||AUROC||TNR(95% TPR)||Detection accuracy||AUPR in||AUPR out|
|Target: TinyImageNet, OOD: SVHN/CIFAR-10/CIFAR-100|
|Method||AUROC||TNR(95% TPR)||Detection accuracy||AUPR in||AUPR out|
|Target: LSUN, OOD: SVHN/CIFAR-10/CIFAR-100|
|Method||AUROC||TNR(95% TPR)||Detection accuracy||AUPR in||AUPR out|
|GB-RND (proposed )||0.993/0.538/0.601||0.986/0.176/0.266||0.989/0.566/0.609||0.967/0.534/0.570||0.997/0.580/0.656|
|Target: CelebA, OOD: SVHN, CIFAR-10, CIFAR-100|
|Method||AUROC||TNR(95% TPR)||Detection accuracy||AUPR in||AUPR out|
Appendix B Random Network Distillation
We use RND (Burda et al., 2019) as the base model of our OOD detector. RND consists of the trainable predictor network , and randomly initialized target network . The predictor network is trained to minimize the distance against the target network on training data. We do not update the target network throughout the training phase.
Then, for the newly encountered data , RND outputs as an uncertainty to the data. The main intuition of the RND is to reduce the distance between and only on the target distribution, hence naturally threshold between the target and the OOD distribution.
We employ RND for our base OOD detector due to its simplicity over generative models. Also, RND has already shown to be effective in novelty detection on MNIST dataset (Burda et al., 2019).
In RND, is generated by appending two fully connected layers in the network of , where consists of 3 convolution layers and a fully connected layer. In our experiments, we set
as the first 33 layers of ResNet34 without ReLU activation in the end.is constructed by appending two sequential residual blocks. The output size of each residual block is 1024 and 512. We also discard ReLU activation in the second residual block to match the form of .
Appendix C Data preprocessing, network settings, parameter settings for main experiment
To make the OOD detection task harder, we reduce CelebA, TinyImageNet, and LSUN data into 50000 training data (for test dataset, we reduce the CelebA test data to 26032 examples). For TinyImageNet data, we discard half of the images in each class, resulting in 250 training samples for each 200 class. Reduction in LSUN dataset results in 5000 data for each 10 class. Also, the first 1000 images of the test OOD data are used for validation. For SVD-RND, and all other RND based detectors, we use the same structure for and defined in Appendix B. The number of parameter updates is fixed across the experiments. The Adam optimizer, with a learning rate of , is used for RND based OOD detection methods. The learning rate is annealed to in half of the training process. For our main experiment, we average the result across two fixed random seeds.
In SVD-RND, DCT-RND, and GB-RND, we used one blurred data for CIFAR-10 and CelebA dataset, and two blurred data for TinyImageNet and LSUN dataset. For SVD-RND, We optimize across in the CIFAR-10 and CelebA datasets. For TinyImageNet and LSUN datasets, we optimize over and . In DCT-RND, we define as the number of unpruned signals in the frequency domain. For CIFAR-10 and CelebA datasets, we optimize across . For TinyImageNet and LSUN datasets, we optimize over and . For gaussian blurring, we optimize over the shape of the Gaussian kernel. We optimized the parameter over for each blurred data. To fix the number of updates, we train SVD-RND, DCT-RND, and GB-RND for 50 epochs in the CIFAR-10 and CelebA datasets, and 34 epochs for the rest.
For GPND, the settings for the original paper are followed. Furthermore, we optimize the reconstruction loss and adversarial loss for discriminator across and . We choose the parameters with the best validation performance in 100 epochs,
For RND, we trained over 100 epochs.
For geometric transforms, we optimize the magnitude of the shift of shear, horizontal translation and vertical translation methods. We optimize the magnitude of translation across and choose the parameter with the best validation performance. Detector is trained for epochs, where is the number of transformations. The number of transformations is 1 in flipping and invert, 2 for horizontal translation, vertical translation, and shear, and 3 for rotation and contrast.
Finally, for typicality test, we estimated the average test loss of the RND for 50000 training data as the mean. Then, when every time a sample is given, we set the distance of the test loss of the sample to the mean as the OOD metric. For fair comparison, we assumed that one sample is given in a test time.
Appendix D RND on generated OODs by incrementing orthogonal vector
In Section 3.2, we proposed that data in the blurred direction is the main weakness of the conventional novelty detection methods. For the evidence, we present the results on OODs generated by adding vectors orthogonal to the data. Precisely, we sample a Gaussian vector and compute the component of the random vector that is orthogonal to the data x.
We scaled the norm of the orthogonal vector on each data to be % of the norm of the signal. We plot the average uncertainty of RND on the original data, blurred data, and the perturbed data in Table 7. From the 20 independent runs on the perturbed data, we report the case with smallest test uncertainty in Table 7. We varied from 5 to 20. While blurring reduces average test uncertainty of RND, adding orthogonal vector to the data incerases the test uncertainty of RND.
Appendix E Visualization of different blurring techniques
For the visualization, we plot the CIFAR-10 image and blurred version processed by SVD-RND, DCT-RND, and GB-RND in Figure 5. Images in the same column are processed with the same technique. Furthermore, column (b), (d), (e) is the best performing parameter of SVD-RND, DCT-RND, and GB-RND on SVHN OOD data. Likewise, (c), (e), (f) is the best performing parameter of SVD-RND, DCT-RND, and GB-RND on TinyImageNet OOD data.
Appendix F Extended version of Figure 3
We further extend Figure 3 to analyze the behavior of SVD-RND when small number of singular values are discarded. Therefore, we experiment SVD-RND where and plot the result in Figure 6. When , this corresponds to training a target network to follow between and . Therefore, we use the test metric for sample as . We also set the test metric as and this shows TNR(at 95% TPR) of 0.07/0.04/0.06.