SlowGuess/NeurIPS_2023_OCR huggingface dataset:
João B. S. Carvalho, Mengtao Zhang, Robin Geyer, Carlos Cotrini, Joachim M. Buhmann  
Institute for Machine Learning  
Department of Computer Science  
ETH Zürich
{jao.carvalho, mengtao.zhang, robin.geyer, ccarlos, jbuhmann}@inf.ethz.ch
Anomaly detection (AD) is the machine learning task of identifying highly discrepant abnormal samples by solely relying on the consistency of the normal training samples. Under the constraints of a distribution shift, the assumption that training samples and test samples are drawn from the same distribution breaks down. In this work, by leveraging tools from causal inference we attempt to increase the resilience of anomaly detection models to different kinds of distribution shifts. We begin by elucidating a simple yet necessary statistical property that ensures invariant representations, which is critical for robust AD under both domain and covariate shifts. From this property, we derive a regularization term which, when minimized, leads to partial distribution invariance across environments. Through extensive experimental evaluation on both synthetic and real-world tasks, covering a range of six different AD methods, we demonstrated significant improvements in out-of-distribution performance. Under both covariate and domain shift, models regularized with our proposed term showed marked increased robustness. Code is available at: https://github.com/JoaoCarv/invariant-anomaly-detection.
Anomaly detectors are the subject of increased interest in fields such as finance (Ahmed et al. [2016], Hilal et al. [2022]), medicine (Schlegl et al. [2019]), and security (Mothukuri et al. [2021], Siddiqui et al. [2019], Hosseinzadeh et al. [2021]). Having been trained on a sample from an unknown distribution, these models are capable of identifying abnormal objects unlikely to come from the original distribution (Bishop and Nasrabadi [2006]). Anomaly detection (AD) stands apart from supervised classification as it does not involve anomalies during training, making it challenging to articulate a model that depicts the class of objects deemed as normal.
AD as a field boasts a plethora of diverse methodologies (Ruff et al. [2021]). Current detectors have demonstrated the advantage of approaches based on representation learning (Reiss and Hoshen [2021], Deng and Li [2022]). In this context, an encoder maps objects to representations which capture the most distinctive features of an object. In addition, it strives to map the class of normal objects onto a subset characterized by a more regular shape, thereby rendering representations from abnormal samples easily identifiable by comparison. Central to this second goal is a notable vulnerability of representation learning-based methods: they hinge on the assumption of independent and identically distributed (i.i.d.) training and test data. This implies that normal samples in the training data are expected to be sampled identically in the test data, thereby being mapped to the same vicinity in the representation space - an assumption that is frequently violated in real-world scenarios (Koh et al. [2021]).
Indeed, distribution shifts in the context of AD present a unique challenge because it involves discerning two types of distribution shifts targeting the distribution of the normal objects,  $p_n$ . Anomalies
can be conceptualized as samples from a different distribution  $p_a$ , which scarcely overlaps with the mass of  $p_n$ . This distribution  $p_a$  can be interpreted as a shifted variant of  $p_n$ , and the task of anomaly detection becomes identifying this shift. Changes in the environment can also produce distribution shifts. When such a distribution shift transpires from the training data to the test data,  $p_n$  is transformed into  $\hat{p}_n$ . If anomalies are naively perceived as merely samples from the original normal samples that are sufficiently different, then all samples from  $\hat{p}_n$  could be wrongly classified as abnormal samples. Therefore, it is crucial to note that anomaly detectors need to identify shifted versions of  $p_n$  that generate anomalies while being resilient to those originating from any other  $\hat{p}_n$ .
Additionally, anomaly detectors are particularly susceptible to changes in features that are incidentally correlated with being normal. This is because the training data consists only of normal objects, which in conjunction with consistent exposure to any recurrent features present in the environment, inherently facilitates the emergence of shortcut learning (Geirhos et al. [2020]). These effects can significantly impact the reliability of crucial anomaly detectors. For example, consider an anomaly detector designed for monitoring bank transactions, predominantly occurring during business hours. Such a detector could mistakenly hinge on the transaction time to determine anomalies. This approach could lead to fraudulent transactions executed at noon going undetected, while regular transactions made by individuals active at night might erroneously be flagged as suspicious. Thus, the effective detection of anomalies requires the model to go beyond such superficial correlations and instead focus on more substantive, causally relevant features.
In this work, we formalize the problem of anomaly detection in the presence of domain and covariate shifts using causality and information theory (Wang and Veitch [2022], Wang et al. [2022], Jiang and Veitch [2022], Liu et al. [2021], Linsker [1988], Stone [2004], Hjelm et al. [2018]). We view the generation of the dataset as a causal graph and distinguish between the environment that generates the dataset, the content features, the style features, and representations that are computed from these features. We note that to mitigate vulnerabilities to distribution shifts, we need to produce representations that are invariant to the environment where the object comes from (Veitch et al. [2021], Wang et al. [2022], Wang and Veitch [2022]). That is, the representation is not causally influenced by the environment. Through this formalization, we derive and formally justify a necessary condition for learning invariant representations within anomaly detection. To impose this condition, we introduce the partial conditional invariant regularization (PCIR) term for learning invariant representations in this setting. This term minimizes discrepancies between representations from different environments by minimizing discrepancies like the maximum mean discrepancy (MMD) (Gretton et al. [2012]). Similar approaches relying on MMD regularization for domain generalization in different tasks have proven to be valuable (Kang et al. [2019], Long et al. [2013]). However, to our knowledge, all methods relying on conditional invariance have been applied under the assumption of access to all classes during training. This is not the case in the AD setting.
Contributions: (1) We conduct a series of experiments to illustrate the limitations of current AD methods in handling various distribution shifts. (2) Through causal inference we propose a novel formalization of the dual requirements of informativeness and invariance for robust AD models, leading to a new insight, as described in Theorem 2. (3) We introduce a regularization term to induce partial conditional distribution invariance, which serves as a strategic measure to ensure robust AD amid distribution shifts. (4) Our empirical findings demonstrate the effectiveness of our regularization term; all tested models exhibited an enhancement in performance under both covariate and domain shifts when augmented with partial conditional invariant regularization (PCIR).
2.1 Distribution Invariant Representation Learning
The relationship between invariance and robustness to shifts in data distribution has been extensively explored, notably within the field of causal inference.
A range of studies has pursued the development of invariant representation learning, achieving notable success (Long et al. [2013], Kang et al. [2019], Mitrovic et al. [2020], Lv et al. [2022], Nguyen et al. [2021]). Moreover, a detailed examination of various forms of invariance-based methods derived from underlying causal graphs has been provided by Veitch et al. [2021] and Wang and Veitch [2022].
Figure 1: Comparative analysis of various mapping strategies from  $\mathcal{X}$  to  $\mathcal{Z}$  in the context of AD under distribution shifts. (a) Anomaly detection setting with multiple environments in  $\mathcal{X}$ . (b) Ideal scenario where the mapping is both invariant and informative; normal samples from different environments converge to the same subset of  $\mathcal{Z}$ , maintaining the distinction between normal and abnormal samples. (c) Mapping is invariant but not informative, resulting in both normal and abnormal representations collapsing to the same subset of  $\mathcal{Z}$ . (d) Mapping is informative but not invariant; although the mappings of all environments remain distinct, this makes the encoder vulnerable to distribution shifts.
(c) invariant but non-informative
(d)
Causal inference has also been shown to foster distributional robustness, as documented in Meinshausen [2018]. Building on this notion, Invariant Risk Minimization (IRM) (Arjovsky et al. [2019]) introduced a novel optimization principle hinged on maintaining invariance across diverse environments. However, Koh et al. [2021] demonstrated that this approach tends to falter when subjected to real-world distribution shifts. Yao et al. [2022] has introduced selective data augmentations to induce distribution shift robustness. However, due to its reliance on class labels, it is not directly applicable to AD.
2.2 Deep Anomaly Detection
A common strategy in AD involves the deployment of autoencoders. These methods operate by learning normal patterns within a dataset and then attempting to reconstruct new samples. The premise is that anomalous samples, due to their distribution differences, will yield higher reconstruction errors. Several studies have adopted this method, demonstrating its efficacy in a range of contexts (Gong et al. [2019], Park et al. [2020], Yan et al. [2021]).
In the wake of recent advancements in self-supervised representation learning (He et al. [2019], Chen et al. [2020]), contrastive learning has emerged as a viable method for AD. Approaches such as PANDA (Reiss et al. [2021]), and the more recent MeanShift (Reiss and Hoshen [2021]) and CFA (Lee et al. [2022]) harness these strategies to finetune pre-trained encoders to the AD setting. Conversely, CSI (Tack et al. [2020]) and DROC (Goyal et al. [2020]) use contrastive learning to learn a representation of the normal data from scratch. Knowledge distillation-based methods also hold a significant place in AD research. A student-teacher framework, which incorporates discriminative latent embeddings, was first introduced in Bergmann et al. [2020]. The most recent iterations, Reverse Distillation (Deng and Li [2022]) and STFPM (Wang et al. [2021]) have attained state-of-the-art performance across numerous AD tasks. Recently, Red Panda (Cohen et al. [2023]), has adapted PANDA by adding an additional disentanglement term to the loss derived from Kahana and Hoshen [2022], with the intent of inducing robustness to previously identified attributes.
Despite the effectiveness of these methods, it is important to note that they primarily focus on AD within datasets where the training and test data distributions are identical. As we will show, its performance tends to degrade when confronted with data that exhibit different kinds of distribution shifts.
One way to improve robustness to distribution shifts entails pretraining the encoder using an invariance-inducing method (for example, IRM or LISA), applied to an unrelated pretext task using the same data (Smeu et al. [2022]). Unfortunately, this requires the existence of additional task labels, which is uncommon for AD tasks. Moreover, as we experimentally demonstrate, this approach achieves limited performance when paired with state-of-the-art AD methods.
3 Formalization
Our formulation operates under the assumption of a given set of environments, denoted as  $\mathcal{E}$ , and a sample space,  $\mathcal{X}$ . We have a sample  $D = \{x_{1},\ldots ,x_{n}\}$  drawn from an unknown distribution  $p_n$ , whose mass is mostly concentrated on a subset  $N\subseteq \mathcal{X}$ . This subset,  $N$ , defines the normal class. Given that  $X\sim p_n$ , we consider  $X$  as a pair of random variables  $X_{a}$  and  $X_{e}$ , such that  $X = (X_{a},X_{e})$ . Here, the environment  $E$  only influences  $X_{e}$ . Conceptually,  $X_{a}$  represents the component of  $X$  that determines whether  $X$  is an anomaly, while  $X_{e}$  comprises style features. These style features, while unaffected by the anomaly status of an object, are influenced by the environment. Note that this assumption implies that  $\mathcal{X} = \mathcal{X}_a\times \mathcal{X}_e$ , for some appropriate sets  $\mathcal{X}_a$  and  $\mathcal{X}_e$ . Fig. 1 (a) illustrates our setting under three different environments.
Our main goal in this section is to elicit the requirements that representations should fulfil in order to lead to effective anomaly detectors. More precisely, we argue that representations must simultaneously (i) maximize the information they contain about the original objects and (ii) they must be invariant to the environment.
3.2 Requirements for Robust Encoders
We illustrate the necessity of invariance and informativeness for effective AD using an example with random variables  $X_{1}, X_{2}, X_{3}$ . We assume that they are distributed over the set  $N$  of all points  $(x_{1}, x_{2}, x_{3}) \in \mathbb{R}^{3}$  such that  $0 \leq x_{1} = x_{2} \leq 1$ . We assume that  $x_{3}$  denotes the environment. Our dataset  $D$  consists of points in  $N$  where  $x_{3} = 0$ .
Consider now the following encoders  $f_{1}, f_{2}$ , and  $f_{3}$ , where  $f_{1}(x_{1}, x_{2}, x_{3}) = x_{1}$ ,  $f_{1}(x_{1}, x_{2}, x_{3}) = (x_{1}, x_{2})$ , and  $f_{1}(x_{1}, x_{2}, x_{3}) = (x_{1}, x_{2}, x_{3})$ . Note that encoder  $f_{1}$  is invariant but lacks the necessary information to detect anomalies, as it can map different points to the same representation. Indeed, the normal point  $(1, 1, 1)$  and the anomaly point  $(1, 2, 1)$  would be mapped to the same representation, the number 1. Hence, any anomaly detector based on this encoder can be easily evaded. Encoder  $f_{3}$  captures all information but is not invariant, which leads to a potential evasion of AD. Encoder  $f_{2}$ , on the other hand, is both invariant and informative, correctly capturing the necessary information to detect anomalies while ignoring the environment variable  $x_{3}$ .
This simplified scenario emphasizes the dual necessity of invariance and informativeness for the development of robust anomaly detectors. Regrettably, as we will demonstrate, contemporary AD methods tend to excel in informativeness while significantly lagging in invariance. For a graphical illustration of this effect, please see Fig. 1 (b-d).
We now formalize the desiderata for representations computed by an encoder for AD.
3.3 Invariant Representations
Let  $f$  be an encoder mapping a  $\mathcal{X}$  to a representation space  $\mathcal{Z}$ . We also let  $Z = f(X)$  denote the representation of  $X$ .
Definition 1. We say that  $Z$  is an invariant representation of  $X$  under domain shifts if
$$
p ^ {d o (E = e)} (Z = \cdot) = p ^ {d o (E = e ^ {\prime})} (Z = \cdot), \quad \text {f o r a n y} e, e ^ {\prime} \in \mathcal {E}. \tag {1}
$$
Definition 2. We say that  $Z$  is an invariant representation of  $X$  under covariate shifts if
$$
p ^ {d o \left(X _ {e} = x\right)} (Z = \cdot) = p ^ {d o \left(X _ {e} = x ^ {\prime}\right)} (Z = \cdot), \quad \text {f o r a n y} x, x ^ {\prime} \in \mathcal {X} _ {e}. \tag {2}
$$
We simply say that  $Z$  is an invariant representation of  $X$  if it remains unaltered under both domain shifts and covariate shifts. Note that domain shifts are stronger than covariate shifts. Specifically, domain shifts entail assessing data from diverse sources with disparate parameters, whereas covariate shifts pertain to subtle alterations in the existing data. Consequently, the broader changes inherent to domain shifts usually exert a more substantial impact on data representation stability and are harder to tackle.
Invariant representations prevent anomaly detectors from incorrectly classifying objects that result from covariate and domain shifts. These representations are, by definition, resistant to changes in  $E$  or  $X_{e}$ . As a result, adversaries cannot expect to alter the detection of an anomaly by merely using a different environment or changing style features of the anomaly.
However, solely enforcing invariant representations can be insufficient, and potentially lead to a collapse of the representations (see Fig. 1 (c)). For this reason, we argue that representations shall store as much information about the original object as possible. This principle is in line with the design of many popular encoders (Linsker [1988], Stone [2004], Hjelm et al. [2018]) and can be formalized using information theory.
3.4 Mutual Information between Representations and Objects
We can use the mutual information between two random variables as our metric to evaluate how much information about  $X$  is captured by the representation  $Z$ .
Definition 3. The mutual information  $I(X;Z)$  between  $X$  and  $Z$  is defined as
$$
I (X; Z) = \int \int \frac {p _ {X , Z} (x , z)}{p _ {X} (x) p _ {Z} (z)} d x d z. \tag {3}
$$
Here,  $p_{X,Z}$  is the joint pdf of  $(X,Z)$  and  $p_X$  and  $p_Z$  are the marginal pdfs of  $X$  and  $Z$ , respectively.
Intuitively,  $I(X;Z)$  indicates how much information learning about one of  $X$  or  $Z$  reveals about the other. We argue then that encoders shall compute representations that keep as much information as possible from the original objects.
4 Learning Invariant and Informative Representations
Having outlined the prerequisites for anomaly detection representations, the next task is to devise strategies that enable encoders to learn both invariant and informative representations. Encouragingly, most contemporary AD methods inherently employ strategies that maximize the mutual information between the observation and the representation (Tishby and Zaslavsky [2015]). This is often achieved either via a reconstruction loss term (Kong et al. [2019]) or a contrastive loss term (Sordoni et al. [2021], Wu et al. [2020], Oord et al. [2018]).
We dedicate the rest of this section to developing a strategy suitable for invariant representation learning under the scope AD.
4.1 Learning Invariant Representations
We start by introducing a causal graph for anomaly detection in Fig. 2. In these graphs,  $E$ ,  $X_{a}$ , and  $X_{s}$  denote the environment, the relevant features, and the style features. We introduce two new random variables  $W$  and  $U$ .  $W$  is a binary variable indicating if the object is normal ( $W = 0$ ) or an anomaly ( $W = 1$ ).  $U$  denotes all confounding factors. That is, factors that produce correlations between  $X_{a}$  and  $X_{e}$  during the sample generation process.
We now recall that an encoder  $f$  that attains invariant representations is  $X_{a}$ -measurable (Veitch et al. [2021]). The following result, which follows from a theorem from Veitch et al. [2021], argues that we can ensure invariant representations by enforcing a possibly conditional statistical independence between  $Z$  and  $E$ .
Figure 2: Causal graphs for anomaly detection. The left figure shows the case of no confounding. The right figure shows the case of confounding. An intervention at the  $E$  variable induces a domain shift (gray hammer), whereas an intervention at the  $X_{e}$  variable induces a covariate shift (black hammer).
Theorem 1. Suppose that  $f$  learns invariant representations. If  $W$  and  $E$  are confounded, then  $Z \perp E \mid W$ . Otherwise,  $Z \perp E$ .
Proof. We sketch a proof here and provide a more rigorous proof in the appendix. Since  $f$  learns invariant representations and is, therefore, measurable, we can say that  $Z$  is  $X_{a}$ -measurable. This means that any probability of an event involving  $Z$  can be rewritten as a probability of an event involving  $X_{a}$ . As a result, it suffices to show that  $X_{a} \perp E \mid W$ , when  $W$  and  $E$  are confounded and  $X_{a} \perp E$ , otherwise. These claims can be shown using d-separation. For example, when  $W$  and  $E$  are not confounded, there are only two paths from  $X_{a}$  to  $E$  and they are blocked. Hence,  $X_{a} \perp E$  by d-separation.
The fundamental question we must address is how to ensure statistical independence between  $Z$  and  $E$ . If such independence holds, we find that for all  $e, e' \in \mathcal{E}$ , it implies that  $p^{do(E = e)}(Z = \cdot) = p^{do(E = e')} (Z = \cdot)$ . In general, we cannot access counterfactual examples, so enforcing counterfactual invariance becomes impossible. However, it is still possible to induce a counterfactual invariance signature by imposing appropriate conditional independence conditions. In practice, this condition can be set as MMD  $(p(Z = \cdot | E = e), p(Z = \cdot | E = e')) = 0$ , where MMD stands for maximum mean discrepancy (Gretton et al. [2006, 2012]), and measures the distance between two distributions using empirical samples by calculating the divergence between the means of these sample sets once they have been projected into a reproducing kernel Hilbert space (RKHS).
4.2 Partial Conditional Invariant Regularization (PCIR)
Based on the previous insights, we propose using the MMD between two distributions as the driver for the invariance-inducing regularization term. Taking into account our previous formulation depicted in Fig. 2, we are now in a position to derive a novel regularization term specifically designed for invariant AD:
$$
\Omega_ {\mathrm {P C I R}} = \sum_ {\substack {e, e ^ {\prime} \in \mathcal {E} \\ e \neq e ^ {\prime}}} \text {M M D} \left(p (Z = \cdot \mid W = 0, E = e), p (Z = \cdot \mid W = 0, E = e ^ {\prime})\right). \tag{4}
$$
We call this approach partial conditional invariant regularization (PCIR), as it induces conditional distribution invariance over only one instantiation of  $W$ .
This partial conditional regularization aligns with other regularization terms proposed in preceding research (Veitch et al. [2021], Li et al. [2018]). It is 'conditional' because, in the event of confounding, we must condition on  $W$  when computing the MMD. It is 'partial' due to the fact that the training dataset only contains samples where  $W = 0$ .
Our solutions are validated under two distinct settings: domain generalization across domain shifts and domain generalization across covariate shifts. All experiments described were the result of 5 repetitions over different seeds. For additional details on the experimental design please refer to the supplementary material.
Real-world domain shift For a realistic anomaly detection scenario, we considered the task of identifying tumorous tissue from images of histological cuts, using the Camelyon17 (Koh et al. [2021], Bandi et al. [2018]) dataset. This dataset consists of five different subsets of images arising from five different hospitals, with domain shifts occurring due to differences in slide staining, image acquisition protocol, and patient cohorts. This presents a challenging anomaly detection task, as the alterations that differentiate normal from abnormal samples are often subtle and may correlate with unknown features that are domain-dependent. In our experimental design, we motivate an environment per domain and set up two sets of experiments: one using three environments for training and another using two environments for training.