Title: ANOMALY DETECTION BY DEEP DIRECT DENSITY RA-TIO ESTIMATION

Abstract: Estimating the ratio of two probability densities without estimating each density separately has been shown to provide useful solutions to various machine learning tasks such as domain adaptation, anomaly detection, feature extraction, and conditional density estimation. However, density ratio estimation in the context of deep learning has not been extensively explored yet. In this paper, we apply a Bregman-divergence minimization method for density ratio estimation to deep neural networks and investigate its properties and practical performance in image anomaly detection. Our numerical experiments on the CIFAR-10, CIFAR-100 and Fashion-MNIST datasets demonstrate that deep direct density ratio estimation greatly improves the anomaly detection ability and reduces the computation time over state-of-the-art methods.

1. INTRODUCTION:

Anomaly detection (also known as outlier detection) has received a lot of attention in diverse research areas such as monitoring (Lavin & Ahmad, 2015) , credit card fraud detection (Phua et al., 2010) , and medical diagnosis (Schlegl et al., 2017) . The aim of anomaly detection is to identify outliers in a given dataset. A standard anomaly detection problem falls into the category of unsupervised learning, due to lack of labeled anomaly data. While (semi-)supervised anomaly detection methods perform better than unsupervised methods (Gao et al., 2006) , they require anomalous data for training, which are not always available in practice. Furthermore, the anomalous properties may be diverse, and thus such (semi-)supervised methods are not necessarily useful in detecting an unknown type of anomaly.

Traditional approaches for unsupervised anomaly detection such the as one-class support vector machine (OC-SVM) (Schölkopf et al., 2001) and support vector data description (SVDD) (Tax & Duin, 2004 ) have been widely used, which relies on the the assumption that a sample located in a low-density region is regarded as an outlier. However, these approaches often face difficulties when they are applied to high-dimensional data such as images, due to the curse of dimensionality. Furthermore, these approaches depend heavily on the choice of tuning parameters (e.g., the Gaussian kernel width) and there seems to be no universal method to appropriately determine the values of such tuning parameters.

Recently, convolutional neural networks (CNNs) have significantly improved their performance in various computer vision tasks, e.g., image classification and object detection (Krizhevsky et al., 2012; He et al., 2016; Redmon et al., 2016) . With the advent of deep learning, various methods have been developed for anomaly detection in the context images (Chalapathy & Chawla, 2019) . For example, the generative model methods, which are based either on Generative Adversarial Networks (GANs) (Goodfellow et al., 2014) or Autoencoders (AEs) (Hinton & Salakhutdinov, 2006) , have been applied in anomaly detection. While there are several other approaches, these are mostly based on the idea of obtaining a good representation, e.g., intermediate representations in AE, i.e., latent spaces in GANs, of normal data with a neural network. Then the obtained representation is used to define anomaly scores via reconstruction errors. However, since the representation learning and the anomaly score calculation are performed separately, methods based on deep generative models are suboptimal. To avoid such two-step optimization, different methods have been proposed based on SVDD (Ruff et al., 2018) , but they cannot utilize the superior representation power of neural networks. Also all these unsupervised approaches suffer the problem of hyperparameter optimization due to lack of supervision.

To overcome the weakness of unsupervised anomaly detection, weakly-supervised anomaly detection has been explored, where normal samples and unlabeled samples are utilized. More specifically, an approach based on density ratio estimation (Sugiyama et al., 2012a) has been investigated thoroughly. In this approach, the ratio of probability densities of normal and unlabeled samples are directly estimated without estimating each density separately, and it is used as an outlier score. A notable advantage of this direct density ratio estimation approach is that hyperparameter tuning can be performed objectively through cross-validation. So far, various direct density ratio estimation methods have been developed, e.g., unconstrained least-squares importance fitting (uLSIF) (Kanamori et al., 2009) and the Kullback-Leibler importance estimation procedure (KLIEP) (Sugiyama et al., 2008) . In the context of anomaly detection, kernel-base KLIEP was demonstrated to be superior in accuracy and stability compared to OC-SVM, kernel mean matching (KMM) (Huang et al., 2006) and uLSIF (Hido et al., 2011) .

As explained above, direct density ratio estimation is a promising approach to anomaly detection. However, direct density ratio estimation in the context of deep learning has not been extensively explored yet. In this paper, we apply the Bergman-divergence minimization method for density ratio estimation to deep neural networks and investigate its properties and practical performance in image anomaly detection. An interesting finding is that batch normalization (BatchNorm), which is an effective method in training deep neural networks (Ioffe & Szegedy, 2015; Bjorck et al., 2018) , does not work well in our context. We explain the reason for this phenomenon and propose not to use BatchNorm in our proposed method. We perform numerical experiments on the CIFAR-10, CIFAR-100 and Fashion-MNIST datasets and demonstrate that deep direct density ratio estimation significantly improves the anomaly detection ability and reduces the computation time over stateof-the-art methods.

2. RELATED WORK:

An extensive review of classical anomaly detection methods can be found in Chandola et al. (2009) .

In this section we focus on anomaly detection in the context of images and deep learning.

2.1. DENSITY RATIO ESTIMATION:

Previous work (Nam & Sugiyama, 2015) has already applied deep density ratio estimation to anomaly detection. However, this study only reported that CNN-based uLSIF is superior to kernelbased uLSIF and kernel-based KLIEP for image datasets. However, from the kernel-based density ratio estimation studies (Sugiyama et al., 2012a) , it is known that KLIEP is more sensitive to outliers than uLSIF and is more effective in detecting outlier samples. In addition, LeNet-5 (LeCun et al., 1998) , which was used in Nam & Sugiyama (2015) , is a network architecture originally designed for hand-written character recognition. So it has poor expressive ability compared to more recently proposed neural network architecture for complex image datasets. To the best of our knowledge, there are no studies investigating whether deep density ratio estimation under the KLIEP criterion with modern deep learning techniques is effective compared to recent deep anomaly detection methods. This is what we will investigate in this paper.

2.2. DEEP GENERATIVE MODEL AND DEEP SVDD:

A typical method of deep anomaly detection in the context of image data is based on deep generative models such as AEs or GANs. The main idea is based on the fact that it is difficult to generate outlier samples from a latent space obtained by learning with only normal samples. In the context of anomaly detection, Schlegl et al. (2017) first introduced an approach based on GANs, which is called AnoGAN. AnoGAN uses a convex combination of the ℓ 2 norm and a discrimination loss between an input image and generated image as an anomaly score. Similary to AnoGAN, Deecke et al. (2018) proposed ADGAN that improved the performance slightly. Since ADGAN never uses the discriminator loss to calculate an anomaly score, the discriminator can be discard after training the GAN.

As a different method, Ruff et al. (2018) recently proposed an approach to detect outliers using a deep neural network inspired by SVDD, which is a widely used one-class classification method for anomaly detection. The main idea of the method, named Deep SVDD, is using a deep neural network to minimize the volume of a hyper-sphere that encloses the network representations of normal samples. Anomaly scores in the Deep SVDD approach is the distance of a data point from the center of the hyper-sphere.

2.3. GEOMETRIC TRANSFORMATIONS:

The geometric transformations (GTs) method (Golan & El-Yaniv, 2018) first creates a self-labeled dataset by performing 72 distinct geometric transformations consisting of horizontal flips, translations, and rotations on normal data. Then a multi-class classifier is trained over the self-labeled dataset, where the labels are the types of transformations. An anomaly score is defined based on the Dirichlet distribution obtained by maximum likelihood estimation using the softmax output from the classification network for the labels. GTs greatly exceed the accuracy of Deep SVDD and ADGAN on benchmark datasets. Thus, in this paper, we will compare it with our method.

3. ANOMALY DETECTION VIA DENSITY RATIO ESTIMATION:

Here we briefly review the framework of density ratio estimation by density ratio fitting under the Bregman divergence for anomaly detection (Sugiyama et al., 2012b) 1 .

3.1. FORMULATION:

Let X Ă R d be the data domain for positive integer d. Suppose that we are given independent and identically distributed (i.i.d.) training samples tx tr i u ntr i"1 from a training distribution with density p tr pxq on X and i.i.d. test samples tx te j u nte j "1 from a test distribution with density p te pxq on X2 . The training samples tx tr i u ntr i"1 are all inliers, while the test samples tx te j u nte j "1 do not only contain inliers but can also contain some outliers if any. The goal of anomaly detection based on density ratio estimation is to estimate the density ratio,

EQUATION

)

from tx tr i u ntr i"1 and tx te j u nte j "1 . The density ratio is close to one when x is an inlier and it is close to zero when x is an outlier. Thus, the density ratio would be a suitable anomaly score.

A naive approach to estimate the density ratio Eq.( 1) is to first estimate the numerator and denominator densities separately from their associated samples and then take their ratio. However, such a two-step approach is not reliable because the first step of density estimation is performed without regard to the second step of taking the ratio. Below, we review a direct density ratio estimation method that does not involved density estimation.

3.2. DENSITY RATIO ESTIMATION UNDER BREGMAN DIVERGENCE:

The basic idea of direct density ratio estimation is to fit a density ratio model rpxq to the true density ratio function r ˚pxq under some divergence. Here we employ the Bregman (BR) divergence (Bregman, 1967) for measuring the discrepancy between the true density ratio function and the density ratio model. This framework includes various existing approaches of density ratio estimation as special cases.

The BR divergence from t ˚to t is defined as follows:

EQUATION

where f ptq is a strictly convex function and differentiable. Minimizing the BR divergence between the true density ratio r ˚pxq and a model of the density ratio rpxq, weighted by p te , gives BR 1 f pr ˚||r q -ż p te pxq rf pr ˚pxqq ´f pr pxqq ´Bf pr pxqq pr ˚pxq ´r pxqqs dx

EQUATION

where Cş p te pxqf pr ˚pxqqdx is a constant independent of the density ratio model r and BR f prq -ż p te pxqBf pr pxqqr pxqdx ´ż p te pxqf pr pxqqdx ´ż p tr pxqBf pr pxqqdx.

(4)

Then an empirical approximation y BR f prq of BR f prq is given by

y BR f prq - 1 n te nte ÿ j"1

Bf pr px te j qqr px te j q ´1 n te nte ÿ j"1

f pr px te j qq ´1 n tr ntr ÿ i"1

Bf pr px tr i qq.

(5)

This immediately gives the following optimization criterion:

EQUATION

As a particular BR divergence Eq.( 3), Basu's Power divergence (BA divergence) (Basu et al., 1998) can be induced by the function,

EQUATION

)

where α ą 0. By substituting Eq.( 7) into Eq.( 3), an empirical approximation y BA f prq of the BA divergence without an irrelevant constant term is given by

EQUATION

)

The BA divergence includes uLSIF (α " 1) and KLIEP (α Ñ 0) as special cases, and is more general.

To investigate robustness, let us take the derivative Eq.( 8) with respect to parameters in the densityratio model r and equate it to zero. Then we have the following estimation equation:

EQUATION

)

where ∇ is the differential operator with respect to the parameters in the density-ratio model r, b denotes the number of parameters, and 0 b denotes the b-dimensional vector with all zeros. In the case of α Ñ 0 which corresponds to KLIEP, the estimation equation is given as follows:

EQUATION

)

Comparing this with Eq.( 9), the BA method can be regarded as a weighted version of KLIEP according to rpx te j q α and rpx tr i q α . As mentioned above, since outliers tend to take smaller ratio values, the BA method down-weights the effect of those samples. Thus, the KLIEP (i.e., α Ñ 0) can provide a more sensitive anomaly score than uLSIF, which corresponds to α " 1, in the above sense. 2018) argued that its effect may be smoothing the loss surface. This enables training with larger learning rates, which results in faster convergence and better generalization. Despite its empirical success on many tasks and recent theoretical progress, we argue that BatchNorm is incompatible with density ratio estimation using deep neural networks.

To explain the reason, let us consider using CNN to estimates the density ratio function under the KLIEP criterion:

EQUATION

In the direct density ratio estimation problem, we use not only training data but also test data that include both inliers and outliers during density ratio fitting. Thus, outliers are heterogeneously distributed in a mini-batch.

Figure 1 plots the transition of the averages of density ratio values 1 ntr ř ntr i"1 rpx tr i q and 1 nte ř nte j"1 rpx te j q during training with and without BatchNorm under the KLIEP criterion in Eq.( 11). Minimizing this objective function, the model is optimized to increase the second term in Eq.( 11). However, when BatchNorm is used, density ratio estimation becomes unstable and 1 ntr ř ntr i"1 rpx tr i q takes a large value suddenly compared to the case where BatchNorm is not used. In this figure, the density ratio obtained with BatchNorm diverges after the 1300th iteration, and consequently no outliers can be detected. Therefore, we decided not to use BatchNorm in this paper, which resulted in good empirical performance.

5. EXPERIMENTS:

In this section, we use benchmark datasets to demonstrate the effectiveness of our method in anomaly detection. All experiments were performed using the PyTorch (Paszke et al., 2017) library. We used the AWS p3.2xlarge instance which has a single NVIDIA V100 GPU.

5.1. DATASET:

Our method was evaluated on three publicly available benchmark image datasets: CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009) and Fashion-MNIST (Xiao et al., 2017) . (i.) CIFAR-10 consists of various color images, which has 50000 32ˆ32ˆ3 training images in ten classes. (ii.) CIFAR-100 is similar to CIFAR-10, but with 100 classes containing 500 images per class. These classes are grouped into 20 superclasses each containing five classes. We used 20 superclasses in our experiments. (iii.) Fashion-MNIST which consists of 70000 28ˆ28ˆ1 grayscale images depicting fashion items in ten classes. To compatible with CIFAR-10 and CIFAR-100 classification architectures, we resize the images to 32ˆ32.

5.2. EVALUATION STRATEGY:

Our experimental settings are the same as the previous work (Golan & El-Yaniv, 2018) . For all datasets, the inlier and outlier classes were defined as follows. One particular class was considered as the inlier class and all other classes were regarded as the outlier classes. For example, in the case of CIFAR-10, there are 5000 training data per class, so n tr " 5000. On the other hand, since there are 1000 test data for each class, the number of test samples is n te " 10000, which consists of 1000 inlier samples and 9000 outlier samples. The area under the receiver operating characteristic curve (AUROC) is used as a metric to evaluate whether an outlier class can be detected in the test data.

5.3. EXPERIMENTAL SETUP:

We used the VGG11 (Simonyan & Zisserman, 2014) model as the backbone architecture without BatchNorm for density ratio estimation. Multiple convolutional layers in VGG11 are followed by three fully-connected (FC) layers. The first and second layers have 4096 channels, and the third layer has 1 channels. We used dropout regularization where the dropout rate was set to 0.5 in the convolution and FC layers. Taking into account the non-negativity of the density ratio, the output layer was set to the softplus function logp1 `ex q. On the other hand, the Wide Residual Network (WRN) model (Zagoruyko & Komodakis, 2016) was only used as the backbone in Golan & El-Yaniv (2018) . Thus, we conducted numerical experiments not only with WRN but also with VGG11 as backbone models in GTs for comparison. In WRN, we set the depth and width of the model to 10 and 4, respectively.

For all dataset, CNN-based KLIEP was trained by stochastic gradient descent (SGD) (Bottou et al., 2018) with batch size of 128. We set the learning rate to 0.02 and the number of epochs to 30. We used weight decay of 10 ´4. Experiments were repeated over five trials. We converted the value of each pixel into the interval [0, 1] without other preprocesses and data augmentation. For fair comparison, GTs implemented by ourselves used the same settings such the batch size, optimizer and learning rate3 .

5.4. RESULTS:

The experimental results are shown in Table 1 . The proposed CNN-based KLIEP clearly outperforms GTs on the benchmark datasets. In CIFAR-100, we omitted the name of the superclasses due to lack of space. The correspondence between indices and superclasses is listed in Appendix A. The inlier class consists of multiple classes in CIFAR-100. Experimental results show that KLIEP can stably achieve higher accuracy than the existing methods even in the multiclass setting.

Table 2 shows the computation time of each method for each dataset. Since the GTs method needs to perform geometric transformations to create the self-labeled dataset and training using that dataset, the computation time is long compared to our method. From the above results, it can be said that our proposed method is superior not only in terms of accuracy but also in terms of computational efficiency.

In addition, Appendix B shows that transfer learning is also effective in density ratio estimation. In this work, we used weight decay of 0.1 for fine-tuning the ImageNet-pretrained network from the PyTorch class torchvision.models4 . We have also shown in Appendix B the result of changing the parameter α of the BA divergence in Eq.( 8). Overall, KLIEP (α Ñ 0) was found to be optimal for anomaly detection. This result is consistent with the theoretical analysis shown in Sec.3.2. 

6. CONCLUSION AND FUTURE WORK:

In this paper, density ratio estimation under the KLIEP criterion was performed with CNN, and its effectiveness for anomaly detection was investigated. The method of deep anomaly detection has been actively discussed in recent years, but its main approach is to use a deep generative model (Schlegl et al., 2017; Deecke et al., 2018) , Deep SVDD (Ruff et al., 2018) , and Geometric Transformations (Golan & El-Yaniv, 2018) . Our numerical experiments on the CIFAR-10, CIFAR-100 and Fashion-MNIST datasets demonstrated that deep direct density ratio estimation greatly improves the anomaly detection ability and reduces the computation time over state-of-the-art methods. We also showed that BatchNorm is not compatible with density ratio estimation using deep neural networks.

The objective function Eq.( 8) continues to decrease regardless of whether or not BatchNorm is adopted. A similar phenomenon has been investigated in the context of learning from positive and unlabeled data (Kiryo et al., 2017) , which caused overfitting when a model with high expressive ability such as a deep neural network is used. More specifically, the empirical risk tends to be negative during training, and they proposed to cleverly impose a non-negativity constraint to avoid overfitting. On the other hand, when density ratio estimation is performed under the BA divergence, there is a constant term C " ş p te pxqf pr ˚pxqqdx that is dropped during training. Since the value of C is unknown, we cannot directly impose a suitable non-negativity constraint in the current case. Thus, it is an important future work to explore a more stable learning algorithm for deep density ratio estimation. 

B ROBUSTNESS AND TRANSFER LEARNING:



:

See Sugiyama et al. (2012a) for a comprehensive review on the application of density ratio estimation to tasks other than anomaly detection.

We assume that p te pxq is strictly positive for all x P X .

For the details of the original implementation, refer to https://github.com/izikgo/AnomalyDetectionTransformations.

https://pytorch.org/docs/stable/torchvision/models.html

Figures and Tables:

Figure 1: Evolution of the averages of density ratio values for 1 ntr ři"1 rpx tr i q and 1 nte ř j"1 rpx te j q during training with the KLIEP criterion. The left graph contains results on without BatchNorm, while the right graph contains the results with BatchNorm.

Average AUROC in % with standard deviation (over 5 trials with different seeds) per method. The best performing method in terms of the mean AUC is specified by bold face.

Table content: <table><tr><td>Dataset</td><td>inlier class</td><td>GTs</td><td>GTs</td><td>KLIEP</td></tr><tr><td/><td/><td>(VGG11)</td><td>(WRN)</td><td/></tr><tr><td/><td>plane</td><td colspan="3">69.0 ˘1.0 76.3 ˘0.6 93.6 ˘0.3</td></tr><tr><td/><td>car</td><td colspan="3">94.3 ˘0.3 95.0 ˘0.1 94.8 ˘0.7</td></tr><tr><td/><td>bird</td><td colspan="3">76.2 ˘2.0 84.9 ˘1.0 86.7 ˘0.3</td></tr><tr><td/><td>cat</td><td colspan="3">64.1 ˘0.8 77.1 ˘0.4 85.8 ˘0.6</td></tr><tr><td/><td>deer</td><td colspan="3">83.4 ˘1.0 88.5 ˘0.2 89.1 ˘0.5</td></tr><tr><td>CIFAR-10</td><td>dog</td><td colspan="3">83.7 ˘0.8 86.7 ˘0.3 87.4 ˘1.0</td></tr><tr><td/><td>frog</td><td colspan="3">89.3 ˘1.0 88.4 ˘0.1 93.2 ˘0.4</td></tr><tr><td/><td>horse</td><td colspan="3">94.5 ˘0.2 95.8 ˘0.0 88.5 ˘0.5</td></tr><tr><td/><td>ship</td><td colspan="3">92.2 ˘0.2 94.3 ˘0.1 95.6 ˘0.3</td></tr><tr><td/><td>truck</td><td colspan="3">90.0 ˘0.2 90.9 ˘0.1 92.6 ˘1.0</td></tr><tr><td/><td>avg</td><td>83.7</td><td>87.8</td><td>90.7</td></tr><tr><td/><td>0</td><td colspan="3">72.9 ˘1.4 76.8 ˘1.1 84.5 ˘0.5</td></tr><tr><td/><td>1</td><td colspan="3">66.0 ˘1.9 66.2 ˘2.0 81.9 ˘2.6</td></tr><tr><td/><td>2</td><td colspan="3">74.3 ˘1.4 78.8 ˘1.9 96.0 ˘0.3</td></tr><tr><td/><td>3</td><td colspan="3">76.3 ˘0.7 73.3 ˘3.1 86.7 ˘1.0</td></tr><tr><td/><td>4</td><td colspan="3">76.2 ˘1.5 78.2 ˘1.4 90.8 ˘1.6</td></tr><tr><td/><td>5</td><td colspan="3">59.8 ˘2.7 54.9 ˘2.7 81.9 ˘1.2</td></tr><tr><td/><td>6</td><td colspan="3">69.2 ˘1.8 72.5 ˘2.6 86.7 ˘1.1</td></tr><tr><td/><td>7</td><td colspan="3">65.2 ˘2.1 63.5 ˘1.4 88.2 ˘0.5</td></tr><tr><td/><td>8</td><td colspan="3">75.3 ˘2.0 86.6 ˘0.7 82.7 ˘0.5</td></tr><tr><td/><td>9</td><td colspan="3">87.3 ˘0.4 89.1 ˘0.3 92.0 ˘0.5</td></tr><tr><td>CIFAR-100</td><td>10</td><td colspan="3">78.9 ˘1.7 85.4 ˘2.1 94.1 ˘0.3</td></tr><tr><td/><td>11</td><td colspan="3">83.1 ˘0.3 85.7 ˘0.4 85.4 ˘0.7</td></tr><tr><td/><td>12</td><td colspan="3">78.3 ˘0.5 84.1 ˘0.8 84.0 ˘0.5</td></tr><tr><td/><td>13</td><td colspan="3">59.5 ˘1.2 57.3 ˘0.7 74.8 ˘1.6</td></tr><tr><td/><td>14</td><td colspan="3">82.5 ˘0.6 90.7 ˘0.9 90.1 ˘1.6</td></tr><tr><td/><td>15</td><td colspan="3">66.1 ˘0.7 70.5 ˘0.8 78.1 ˘1.1</td></tr><tr><td/><td>16</td><td colspan="3">64.1 ˘1.5 73.0 ˘1.7 82.0 ˘0.5</td></tr><tr><td/><td>17</td><td colspan="3">92.5 ˘0.2 93.9 ˘0.3 96.0 ˘0.2</td></tr><tr><td/><td>18</td><td colspan="3">89.0 ˘0.2 90.2 ˘0.5 90.1 ˘0.9</td></tr><tr><td/><td>19</td><td colspan="3">82.6 ˘0.7 82.8 ˘1.7 87.2 ˘0.7</td></tr><tr><td/><td>avg</td><td>75.0</td><td>77.7</td><td>86.7</td></tr><tr><td/><td colspan="4">T-shirt/top 88.2 ˘0.3 94.1 ˘0.3 98.4 ˘0.1</td></tr><tr><td/><td>Trouser</td><td colspan="3">98.9 ˘0.3 99.0 ˘0.5 99.9 ˘0.0</td></tr><tr><td/><td>Pullover</td><td colspan="3">86.9 ˘0.6 92.2 ˘0.2 98.5 ˘0.1</td></tr><tr><td/><td>Dress</td><td colspan="3">92.7 ˘0.3 89.3 ˘1.1 99.2 ˘0.0</td></tr><tr><td/><td>Coat</td><td colspan="3">91.1 ˘0.1 91.7 ˘0.7 98.3 ˘0.1</td></tr><tr><td>Fashion-MNIST</td><td>Sandal</td><td colspan="3">95.7 ˘0.4 92.8 ˘0.5 99.8 ˘0.1</td></tr><tr><td/><td>Shirt</td><td colspan="3">83.6 ˘0.4 85.2 ˘0.2 95.7 ˘0.2</td></tr><tr><td/><td>Sneaker</td><td colspan="3">95.8 ˘0.3 97.9 ˘0.1 99.8 ˘0.0</td></tr><tr><td/><td>Bag</td><td colspan="3">98.0 ˘0.1 96.7 ˘0.2 99.8 ˘0.1</td></tr><tr><td/><td colspan="4">Ankle boot 99.4 ˘0.0 99.4 ˘0.4 99.8 ˘0.0</td></tr><tr><td/><td>avg</td><td>93.0</td><td>93.8</td><td>98.9</td></tr></table>

Average computation time in seconds with standard deviation for training on each datasets per methods.

Table content: <table><tr><td>Dataset</td><td>GTs</td><td>KLIEP</td></tr><tr><td>CIFAR-10</td><td colspan="2">450.1 ˘1.8 85.8 ˘0.1</td></tr><tr><td>CIFAR-100</td><td colspan="2">380.6 ˘1.0 47.0 ˘0.1</td></tr><tr><td colspan="3">Fashion-MNIST 436.3 ˘2.0 100.1 ˘0.2</td></tr></table>

Average AUROC in % with standard deviation (over 5 trials with different seeds) per method.

Table content: <table><tr><td>Dataset</td><td>inlier class</td><td/><td>BA divergence</td><td/><td>KLIEP</td></tr><tr><td/><td/><td>(α " 1)</td><td>(α " 0.5)</td><td>(α Ñ 0)</td><td>(ImageNet)</td></tr><tr><td/><td>plane</td><td>73.8 ˘6.7</td><td>82.2 ˘5.2</td><td>93.6 ˘0.3</td><td>96.9 ˘0.4</td></tr><tr><td/><td>car</td><td>80.2 ˘6.7</td><td>94.4 ˘2.0</td><td>94.8 ˘0.7</td><td>99.0 ˘0.1</td></tr><tr><td/><td>bird</td><td>82.4 ˘2.3</td><td>82.5 ˘1.3</td><td>86.7 ˘0.3</td><td>94.3 ˘0.3</td></tr><tr><td/><td>cat</td><td>80.2 ˘1.2</td><td>81.7 ˘2.0</td><td>85.8</td><td>˘0.8</td></tr><tr><td/><td>deer</td><td>80.2 ˘1.1</td><td>85.6 ˘0.8</td><td>89.1 ˘0.5</td><td>96.1 ˘0.2</td></tr><tr><td>CIFAR-10</td><td>dog</td><td>79.7 ˘3.5</td><td>86.2 ˘0.7</td><td>87.4 ˘1.0</td><td>94.5 ˘0.6</td></tr><tr><td/><td>frog</td><td>83.3 ˘3.4</td><td>90.8 ˘0.7</td><td>93.2 ˘0.4</td><td>97.5 ˘0.4</td></tr><tr><td/><td>horse</td><td>73.8 ˘6.7</td><td>88.9 ˘3.4</td><td>88.5 ˘0.5</td><td>97.3 ˘0.2</td></tr><tr><td/><td>ship</td><td>89.4 ˘2.5</td><td>93.1 ˘2.6</td><td>95.6 ˘0.3</td><td>98.6 ˘0.3</td></tr><tr><td/><td>truck</td><td>83.4 ˘1.1</td><td>92.2 ˘0.7</td><td>92.6 ˘1.0</td><td>98.5 ˘0.1</td></tr><tr><td/><td>avg</td><td>80.6</td><td>87.8</td><td>90.7</td><td>96.4</td></tr><tr><td/><td>0</td><td>76.3 ˘0.5</td><td>91.4 ˘2.5</td><td>84.5 ˘0.5</td><td>90.4 ˘1.4</td></tr><tr><td/><td>1</td><td>67.7 ˘2.3</td><td>87.8 ˘1.3</td><td>81.9 ˘2.6</td><td>89.9 ˘0.9</td></tr><tr><td/><td>2</td><td>85.3 ˘3.6</td><td>77.3 ˘7.5</td><td>96.0 ˘0.3</td><td>96.4 ˘1.3</td></tr><tr><td/><td>3</td><td>66.3 ˘4.3</td><td>81.6 ˘1.6</td><td>86.7 ˘1.0</td><td>94.6 ˘0.4</td></tr><tr><td/><td>4</td><td>70.8 ˘1.9</td><td>83.5 ˘1.7</td><td>90.8 ˘1.6</td><td>93.1 ˘2.2</td></tr><tr><td/><td>5</td><td>62.5 ˘1.5</td><td>74.1 ˘2.0</td><td>81.9 ˘1.2</td><td>92.2 ˘0.7</td></tr><tr><td/><td>6</td><td>67.9 ˘4.5</td><td>83.9 ˘4.8</td><td>86.7 ˘1.1</td><td>94.0 ˘0.7</td></tr><tr><td/><td>7</td><td>74.6 ˘4.3</td><td>73.7 ˘6.9</td><td>88.2 ˘0.5</td><td>92.5 ˘0.5</td></tr><tr><td/><td>8</td><td>76.2 ˘3.4</td><td>79.1 ˘2.7</td><td>82.7 ˘0.5</td><td>89.3 ˘4.7</td></tr><tr><td/><td>9</td><td>79.8 ˘6.4</td><td>79.4 ˘2.9</td><td>92.0 ˘0.5</td><td>97.1 ˘0.3</td></tr><tr><td>CIFAR-100</td><td>10</td><td>86.5 ˘0.5</td><td>69.7 ˘4.5</td><td>94.1 ˘0.3</td><td>95.9 ˘0.5</td></tr><tr><td/><td>11</td><td>72.5 ˘3.6</td><td>75.2 ˘4.1</td><td>85.4 ˘0.7</td><td>88.0 ˘4.4</td></tr><tr><td/><td>12</td><td>75.0 ˘1.6</td><td>87.3 ˘1.1</td><td>84.0 ˘0.5</td><td>89.2 ˘0.6</td></tr><tr><td/><td>13</td><td>71.9 ˘1.5</td><td>78.9 ˘2.9</td><td>74.8 ˘1.6</td><td>88.0 ˘1.2</td></tr><tr><td/><td>14</td><td>71.3 ˘9.2</td><td>77.2 ˘5.9</td><td>90.1 ˘1.6</td><td>93.7 ˘1.4</td></tr><tr><td/><td>15</td><td>73.7 ˘1.7</td><td>74.6 ˘5.8</td><td>78.1 ˘1.1</td><td>86.7 ˘1.4</td></tr><tr><td/><td>16</td><td>76.0 ˘2.4</td><td>72.4 ˘1.3</td><td>82.0 ˘0.5</td><td>89.2 ˘0.2</td></tr><tr><td/><td>17</td><td>79.3 ˘6.6</td><td>92.4 ˘1.0</td><td>96.0 ˘0.2</td><td>97.4 ˘1.8</td></tr><tr><td/><td>18</td><td>71.7 ˘8.8</td><td>83.0 ˘1.2</td><td>90.1 ˘0.9</td><td>95.1 ˘0.8</td></tr><tr><td/><td>19</td><td>73.2 ˘3.6</td><td>79.9 ˘3.3</td><td>87.2 ˘0.7</td><td>93.4 ˘0.7</td></tr><tr><td/><td>avg</td><td>73.9</td><td>80.1</td><td>86.2</td><td>92.3</td></tr><tr><td/><td colspan="2">T-shirt/top 93.4 ˘3.1</td><td>97.8 ˘0.2</td><td>98.4 ˘0.1</td><td>-</td></tr><tr><td/><td>Trouser</td><td>86.1 ˘2.7</td><td>99.8 ˘0.2</td><td>99.9 ˘0.0</td><td>-</td></tr><tr><td/><td>Pullover</td><td>94.3 ˘1.8</td><td>97.1 ˘1.3</td><td>98.5 ˘0.1</td><td>-</td></tr><tr><td/><td>Dress</td><td>95.1 ˘0.8</td><td>98.6 ˘0.1</td><td>99.2 ˘0.0</td><td>-</td></tr><tr><td/><td>Coat</td><td>89.2 ˘4.9</td><td>97.3 ˘0.6</td><td>98.3 ˘0.1</td><td>-</td></tr><tr><td>Fashion-MNIST</td><td>Sandal</td><td>99.6 ˘0.2</td><td>92.8 ˘0.5</td><td>99.8 ˘0.1</td><td>-</td></tr><tr><td/><td>Shirt</td><td>89.8 ˘2.4</td><td>92.7 ˘2.3</td><td>95.7 ˘0.2</td><td>-</td></tr><tr><td/><td>Sneaker</td><td>95.4 ˘4.6</td><td>99.7 ˘0.1</td><td>99.8 ˘0.0</td><td>-</td></tr><tr><td/><td>Bag</td><td>87.3 ˘1.5</td><td>99.5 ˘0.2</td><td>99.8 ˘0.1</td><td>-</td></tr><tr><td/><td colspan="2">Ankle boot 94.3 ˘5.8</td><td>99.8 ˘0.0</td><td>99.8 ˘0.0</td><td>-</td></tr><tr><td/><td>avg</td><td>92.5</td><td>97.5</td><td>98.9</td><td>-</td></tr></table>

Peer review (iclr2020):
The paper studies inlier-based outlier detection via density-ratio estimation in a deep learning context. Specifically, they consider the use of KLIEP in conjunction with a deep neural network. One finding is that batch normalisation is harmful for performance of this method. Experiments show consistent gains over a self-supervised baseline. The paper is generally well-written, and provides a nice overview of the density-ratio approach to anomaly detection. Its aims are clearly spelled out, and the careful derivation in Sec 3 of the Bregman perspective of inlier-based anomaly detection serves as a clean introduction to the topic. At the same time, the technical contribution of the paper is modest. As best I could tell, Sec 3 is entirely devoted to a (nice) review of the existing framework of (Sugiyama et al., 2012b), and contains no new material. Sec 4 seems to be the only novel technical contribution of the paper, namely, the observation that batch normalisation affects the KLIEP method adversely. This is certainly an interesting finding, but it is accompanied by no further critical analysis. In particular, there is no deeper explanation for why batch normalisation might affect KLIEP in this way; whether this finding is consistent for different choices of architecture; whether this finding is consistent for different choices of method (e.g., uLSIF); and so on. By itself, I feel there merely observing that batch norm interacts badly with KLIEP is not sufficiently deep as to carry the paper. The experiments compare KLIEP against an unsupervised baseline based on geometric transforms (GTs). This comparison is somehow unfair, since (as I understand) GTs assume one operates in a different problem setting altogether (where there is only a single sample of inliers, and no background contrast sample). Given this, it is surprising that GTs are able to be competitive with the proposed method in several cases; I feel this deserves more comment. It also raises the question of whether one may combine the proposed method with GTs. More such experiments might have made the paper stronger, but in their current form I don*t find them too illuminating or surprising. Another confusion that arose was that the experiments, as best I can tell, focus entirely on KLIEP. This makes the motivation for Sec 3 unclear -- the section introduces an abstract Bregman divergence view of anomaly detection, but then settles on one specific case of this which can be derived rather directly without this (as was done in the original KLIEP paper, to my knowledge). Had there been some study of different instantiations of the power divergence empirically, e.g., that might better justify the discussion in Sec 3. (I would imagine that for example KLIEP is more susceptible to outliers or label noise, which could motivate using intermediate values of ?.) Overall, while I appreciated the paper as an overview of inlier-based anomaly detection, its increment over the current literature appears modest. Minor comments: - *and it is used as an outlier score* -> *and is used as an outlier score* - *neural network ARCHITECTURES for complex image datasets* - *Deep SVDD approach ARE the distance of a data point* - why do you use p^* in Sec 3 rather than just p? - remove italics from Fig 1 labels. - *let us consider using A CNN to ESTIMATE the density* - it seems fairer to use the GT authors* implementation of their own method? - *cleverly impose a non-negativity constraint* -> omit the word *cleverly*.