The Mahalanobis distance-based confidence score, a recently proposed anomaly detection method for pre-trained neural classifiers, achieves state-of-the-art performance on both out-of-distribution (OoD) and adversarial examples detection. This work analyzes why this method exhibits such strong performance in practical settings while imposing an implausible assumption; namely, that class conditional distributions of pre-trained features have tied covariance. Although the Mahalanobis distance-based method is claimed to be motivated by classification prediction confidence, we find that its superior performance stems from information not useful for classification. This suggests that the reason the Mahalanobis confidence score works so well is mistaken, and makes use of different information from ODIN, another popular OoD detection method based on prediction confidence. This perspective motivates us to combine these two methods, and the combined detector exhibits improved performance and robustness. These findings provide insight into the behavior of neural classifiers in response to anomalous inputs.
OOO Code Laboratory（Code Laboratory有限责任公司）；Perm State National Research University（彼尔姆国立研究大学）；Institute of Immunology and Physiology（免疫学与生理学研究所）
User activities generate a significant number of poor-quality or irrelevant images and data vectors that cannot be processed in the main data processing pipeline or included in the training dataset. Such samples can be found with manual analysis by an expert or with anomalous detection algorithms. There are several formal definitions for the anomaly samples. For neural networks, the anomalous is usually defined as out-of-distribution samples. This work proposes methods for supervised and semi-supervised detection of out-of-distribution samples in image datasets. Our approach extends a typical …
Anomaly detection is concerned with identifying examples in a dataset that do not conform to the expected behaviour. While a vast amount of anomaly detection algorithms exist, little attention has been paid to explaining why these algorithms flag certain examples as anomalies. However, such an explanation could be extremely useful to anyone interpreting the algorithms' output. This paper develops a method to explain the anomaly predictions of the state-of-the-art Isolation Forest anomaly detection algorithm. The method outputs an explanation vector that captures how important each attribute of…
Machine learning models encounter Out-of-Distribution (OoD) errors when the data seen at test time are generated from a different stochastic generator than the one used to generate the training data. One proposal to scale OoD detection to high-dimensional data is to learn a tractable likelihood approximation of the training distribution, and use it to reject unlikely inputs. However, likelihood models on natural data are themselves susceptible to OoD errors, and even assign large likelihoods to samples from other datasets. To mitigate this problem, we propose Generative Ensembles, which robust…
The problem of anomaly detection has been studied for a long time. In short, anomalies are abnormal or unlikely things. In financial networks, thieves and illegal activities are often anomalous in nature. Members of a network want to detect anomalies as soon as possible to prevent them from harming the network's community and integrity. Many Machine Learning techniques have been proposed to deal with this problem; some results appear to be quite promising but there is no obvious superior method. In this paper, we consider anomaly detection particular to the Bitcoin transaction network. Our goa…
Korea Advanced Institute of Science and Technology (KAIST)（韩国科学技术院（KAIST））
Identifying defects in the images of industrial products has been an important task to enhance quality control and reduce maintenance costs. In recent studies, industrial anomaly detection models were developed using pre-trained networks to learn nominal representations. To employ the relative positional information of each pixel, we present \textit{\textbf{N-pad}}, a novel method for anomaly detection and segmentation in a one-class learning setting that includes the neighborhood of the target pixel for model training and evaluation. Within the model architecture, pixel-wise nominal distribut…
StructCore: Structure-Aware Image-Level Scoring for Training-Free Unsupervised Anomaly Detection
Tsinghua University Shenzhen International Graduate School（清华大学深圳国际研究生院）；Ratel Soft；Affiliated Fifth Hospital, Wenzhou Medical University（温州医科大学附属第五医院）；Chinese Medicine Guangdong Laboratory（广东中医药实验室）
Current state-of-the-art anomaly detection (AD) methods exploit the powerful representations yielded by large-scale ImageNet training. However, catastrophic forgetting prevents the successful fine-tuning of pre-trained representations on new datasets in the semi-supervised setting, and representations are therefore commonly fixed. In our work, we propose a new method to overcome catastrophic forgetting and thus successfully fine-tune pre-trained representations for AD in the transfer learning setting. Specifically, we induce a multivariate Gaussian distribution for the normal class based on th…
Why Ranking Anomaly Detection Algorithms Isn't as Reliable as You May Think
Carnegie Mellon University（卡内基梅隆大学）；TU Dortmund University（多特蒙德工业大学）；Lamarr Institute for Machine Learning and Artificial Intelligence（拉马尔机器学习与人工智能研究所）；iits Consulting GmbH（iits咨询有限公司）；Fraunhofer Institute for Material Flow and Logistics IML（弗劳恩霍夫物流与材料流动研究所IML）
Why Does Counterintuitive Likelihood Behavior Rarely Emerge in Tabular Anomaly Detection?
Department of Industrial Engineering, University of Yonsei, Republic of Korea, Seoul（延世大学工业工程系）；H. Milton Stewart School of Industrial and Systems Engineering (ISyE), Georgia Institute of Technology, USA, GA（佐治亚理工学院H.米尔顿·斯图尔特工业与系统工程学院）
Shanghai Jiao Tong University（上海交通大学）；University of Texas at Austin（德克萨斯大学奥斯汀分校）
Surrogate task based methods have recently shown great promise for unsupervised image anomaly detection. However, there is no guarantee that the surrogate tasks share the consistent optimization direction with anomaly detection. In this paper, we return to a direct objective function for anomaly detection with information theory, which maximizes the distance between normal and anomalous data in terms of the joint distribution of images and their representation. Unfortunately, this objective function is not directly optimizable under the unsupervised setting where no anomalous data is provided …
The use of deep features coming from pre-trained neural networks for unsupervised anomaly detection purposes has recently gathered momentum in the computer vision field. In particular, industrial inspection applications can take advantage of such features, as demonstrated by the multiple successes of related methods on the MVTec Anomaly Detection (MVTec AD) dataset. These methods make use of neural networks pre-trained on auxiliary classification tasks such as ImageNet. However, to our knowledge, no comparative study of robustness to the low data regimes between these approaches has been condu…
We consider the problem of detecting anomalies in a large dataset. We propose a framework called Partial Identification which captures the intuition that anomalies are easy to distinguish from the overwhelming majority of points by relatively few attribute values. Formalizing this intuition, we propose a geometric anomaly measure for a point that we call PIDScore, which measures the minimum density of data points over all subcubes containing the point. We present PIDForest: a random forest based algorithm that finds anomalies based on this definition. We show that it performs favorably in comp…
Geometry-Aware Semantic Reasoning for Training Free Video Anomaly Detection
School of Computing, Engineering \& Mathematical Sciences, La Trobe University, Melbourne, Australia School of Engineering；Applied Sciences, GIFT University, Gujranwala 52250, Pakistan
Data Science Group, IBS（基础科学研究院数据科学组）；School of Computing, KAIST（韩国科学技术院计算学院）
Anomaly detection aims at identifying deviant instances from the normal data distribution. Many advances have been made in the field, including the innovative use of unsupervised contrastive learning. However, existing methods generally assume clean training data and are limited when the data contain unknown anomalies. This paper presents Elsa, a novel semi-supervised anomaly detection approach that unifies the concept of energy-based models with unsupervised contrastive learning. Elsa instills robustness against any data contamination by a carefully designed fine-tuning step based on the new …
Dept. of Automation and Systems Engineering（自动化与系统工程系）；Universidade de Vigo（维戈大学）；Dept. of Communication and Information Technologies（通信与信息科技系）；Technical University of Cartagena（卡塔赫纳技术大学）
Institute of Imaging & Computer Vision（成像与计算机视觉研究所）；RWTH Aachen University（亚琛工业大学）
Anomaly Detection (AD) in images is a fundamental computer vision problem and refers to identifying images and image substructures that deviate significantly from the norm. Popular AD algorithms commonly try to learn a model of normality from scratch using task specific datasets, but are limited to semi-supervised approaches employing mostly normal data due to the inaccessibility of anomalies on a large scale combined with the ambiguous nature of anomaly appearance. We follow an alternative approach and demonstrate that deep feature representations learned by discriminative models on large nat…
VACE: Learning Geometrically Structured Representations for Time Series Anomaly Detection
Andalusian Research Institute in Data Science and Computational Intelligence (DaSCI)（安达卢西亚数据科学与计算智能研究 institute）；Department of Computer Science and Artificial Intelligence (DECSAI), University of Granada（格拉纳达大学计算机科学与人工智能系）
Unsupervised Anomaly detection (AD) requires building a notion of normalcy, distinguishing in-distribution (ID) and out-of-distribution (OOD) data, using only available ID samples. Recently, large gains were made on this task for the domain of natural images using self-supervised contrastive feature learning as a first step followed by kNN or traditional one-class classifiers for feature scoring. Learned representations that are non-uniformly distributed on the unit hypersphere have been shown to be beneficial for this task. We go a step further and investigate how the \emph {geometrical compa…
Ningxia University（宁夏大学）；Collaborative Innovation Center for Ningxia Big Data and Artificial Intelligence Co-founded by Ningxia Municipality and Ministry of Education（宁夏回族自治区与教育部共建宁夏大数据与人工智能协同创新中心）
A common study area in anomaly identification is industrial images anomaly detection based on texture background. The interference of texture images and the minuteness of texture anomalies are the main reasons why many existing models fail to detect anomalies. We propose a strategy for anomaly detection that combines dictionary learning and normalizing flow based on the aforementioned questions. The two-stage anomaly detection approach already in use is enhanced by our method. In order to improve baseline method, this research add normalizing flow in representation learning and combines deep l…
In many applications, an anomaly detection system presents the most anomalous data instance to a human analyst, who then must determine whether the instance is truly of interest (e.g. a threat in a security setting). Unfortunately, most anomaly detectors provide no explanation about why an instance was considered anomalous, leaving the analyst with no guidance about where to begin the investigation. To address this issue, we study the problems of computing and evaluating sequential feature explanations (SFEs) for anomaly detectors. An SFE of an anomaly is a sequence of features, which are pres…
In the research area of anomaly detection, novel and promising methods are frequently developed. However, most existing studies exclusively focus on the detection task only and ignore the interpretability of the underlying models as well as their detection results. Nevertheless, anomaly interpretation, which aims to provide explanation of why specific data instances are identified as anomalies, is an equally important task in many real-world applications. In this work, we propose a novel framework which synergizes several machine learning and data mining techniques to automatically learn invar…
Graph anomaly detection has attracted a lot of interest recently. Despite their successes, existing detectors have at least two of the three weaknesses: (a) high computational cost which limits them to small-scale networks only; (b) existing treatment of subgraphs produces suboptimal detection accuracy; and (c) unable to provide an explanation as to why a node is anomalous, once it is identified. We identify that the root cause of these weaknesses is a lack of a proper treatment for subgraphs. A treatment called Subgraph Centralization for graph anomaly detection is proposed to address all the…
Telefónica（西班牙电信）；Universidad Politécnica de Madrid（马德里理工大学）
OneClass SVM is a popular method for unsupervised anomaly detection. As many other methods, it suffers from the black box problem: it is difficult to justify, in an intuitive and simple manner, why the decision frontier is identifying data points as anomalous or non anomalous. Such type of problem is being widely addressed for supervised models. However, it is still an uncharted area for unsupervised learning. In this paper, we evaluate several rule extraction techniques over OneClass SVM models, as well as present alternative designs for some of those algorithms. Together with that, we propos…
An Explainable LLM Agent Layer for Open-World Anomaly Detection in Oil Wells
Laboratory of Scientific Computing and Visualization, Federal University of Alagoas（阿拉戈斯联邦大学科学计算与可视化实验室）；Computing Institute, Federal University of Alagoas（阿拉戈斯联邦大学计算学院）
Anomaly detection algorithms are often thought to be limited because they don't facilitate the process of validating results performed by domain experts. In Contrast, deep learning algorithms for anomaly detection, such as autoencoders, point out the outliers, saving experts the time-consuming task of examining normal cases in order to find anomalies. Most outlier detection algorithms output a score for each instance in the database. The top-k most intense outliers are returned to the user for further inspection; however the manual validation of results becomes challenging without additional c…
Anomaly-based Intrusion Detection System (IDS) has been a hot research topic because of its ability to detect new threats rather than only memorized signatures threats of signature-based IDS. Especially after the availability of advanced technologies that increase the number of hacking tools and increase the risk impact of an attack. The problem of any anomaly-based model is its high false-positive rate. The high false-positive rate is the reason why anomaly IDS is not commonly applied in practice. Because anomaly-based models classify an unseen pattern as a threat where it may be normal but n…
Complex devices are connected daily and eagerly generate vast streams of multidimensional state measurements. These devices often operate in distinct modes based on external conditions (day/night, occupied/vacant, etc.), and to prevent complete or partial system outage, we would like to recognize as early as possible when these devices begin to operate outside the normal modes. Unfortunately, it is often impractical or impossible to predict failures using rules or supervised machine learning, because failure modes are too complex, devices are too new to adequately characterize in a specific en…
Unveiling the Unseen: A Comprehensive Survey on Explainable Anomaly Detection in Images and Videos
Department of Electrical and Computer Engineering, Northeastern University（电气与计算机工程系，东北大学）；School of Data Science, University of Virginia（数据科学学院，弗吉尼亚大学）；Department of Electrical and Computer Engineering and Khoury College of Computer Science, Northeastern University（电气与计算机工程系和Khoury计算机科学学院，东北大学）
Université Clermont Auvergne, CNRS, LPCA（克莱蒙特奥弗涅大学、法国国家科学研究中心、LPCA研究所）；National Research University Higher School of Economics（俄罗斯国民研究大学高等经济学院）；The Oskar Klein Centre, Department of Astronomy, Stockholm University（斯德哥尔摩大学奥斯特基尔克中心、天文学系）；Faculty of Physics, Lomonosov Moscow State University（莫斯科罗蒙诺索夫莫斯科国立大学物理系）；McWilliams Center for Cosmology and Astrophysics, Department of Physics, Carnegie Mellon University（卡内基梅隆大学天体物理学与宇宙学中心、物理系）；Sternberg Astronomical Institute, Lomonosov Moscow State University（莫斯科罗蒙诺索夫莫斯科国立大学斯特尔贝格天文研究所）；Physics department, University of Surrey（萨里大学物理系）；Space Research Institute of the Russian Academy of Sciences（俄罗斯科学院空间研究 institutes）
