基于视觉基础模型的对抗鲁棒小样本异常检测
Adversarially Robust Few-Shot Anomaly Detection with Vision Foundation Models
AI总结：
该研究针对视觉基础模型的小样本异常检测场景，提出无需训练骨干网络的对抗鲁棒方法，经实验在多数据集上提升了对抗检测性能，且保持较高干净准确率。
摘要：
DINOv2等视觉基础模型通过对冻结的补丁特征进行简单的非参数k近邻（k-NN）评分，可实现强大的小样本异常检测（FSAD）。现有鲁棒异常检测方法假设存在大量正常类训练集，并对特征提取器进行对抗训练。尽管小样本场景（检测器由冻结的骨干网络和非参数评分器组成）应用广泛，但该场景下的鲁棒异常检测问题尚未得到解决。我们开发了适用于k-NN记忆库检测器的白盒攻击框架，并提出了一种针对骨干网络无需训练的对抗鲁棒FSAD方法。我们引入DistanceProbe（DP），这是一种通过回归训练的轻量级多层感知机（MLP），可直接从冻结特征预测每个补丁的k-NN距离，为针对非参数评分器的基于梯度攻击提供所需的可微代理。我们进一步提出两级组合防御，仅利用正常参考支持集图像运行：输入级的PatchShift（PS）对像素应用随机偏移，以利用对抗扰动与编码器补丁网格的错位，通过元素级中值池化聚合多个偏移视图的评分；特征级的FeaturePurifier（FP）是一种在干净和对抗增强的支持特征上训练的轻量级残差MLP，用于将受扰动表示投影回干净特征流形。通过在多种对抗设置下的全面实验，我们表明，在MVTec-AD、VisA和MPDD数据集、k=4个样本的设置下，与未防御的受攻击基线相比，我们的方法在图像级AUROC上实现了约27%的性能提升，在像素级PRO上实现了约51%的性能提升，同时将干净准确率保持在3%以内，在像素级AUROC上与全样本对抗训练基线相当，且能抵御自适应攻击。
英文摘要：
Vision foundation models such as DINOv2 enable strong few-shot anomaly detection (FSAD) through simple non-parametric k-nearest-neighbor (k-NN) scoring over frozen patch features. Existing robust anomaly detection methods assume large normal-class training sets and adversarial training of the feature extractor. The few-shot regime, where the detector consists of a frozen backbone and a non-parametric scorer, has remained unaddressed despite its widespread deployment. We develop a white-box attack framework adapted to k-NN memory-bank detectors and introduce an adversarially robust FSAD method which is training-free with respect to the backbone. We introduce the DistanceProbe (DP), a lightweight MLP trained by regression to predict per-patch k-NN distance directly from frozen features, providing the differentiable proxy required for gradient-based attacks against non-parametric scorers. We further propose a two-level combined defense that operates using only the normal reference support set images. At the input level, PatchShift (PS) applies random pixel shifts to exploit the misalignment of adversarial perturbations with the encoder's patch grid, aggregating scores across multiple shifted views via element-wise median pooling. At the feature level we employ the FeaturePurifier (FP), a lightweight residual MLP trained on clean and adversarially augmented support features to project perturbed representations back toward the clean feature manifold. Through comprehensive experiments under various adversarial settings, we show that our method exhibits robust detection and localization with performance gains of ~27% image-level AUROC and ~51% pixel-level PRO over the undefended attacked baseline across MVTec-AD, VisA, and MPDD at k=4 shots, while preserving clean accuracy within 3%, matching full-shot adversarially-trained baselines on pixel-level AUROC, and holding under adaptive attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
