SlowGuess/NeurIPS_2023_OCR huggingface dataset:
i	Chosen factor in ei
0	None
1	Hue
2	Texture
3	Lightness
4	Position
Table 1: Environments  ${e}_{0},\ldots ,{e}_{4}$  used in our synthetic benchmark. For  $0 < i \leq  4$  ,the environment  ${e}_{i}$  modifies the new factor indicated in the table in addition to the factors modified by  ${e}_{0},\ldots ,{e}_{i - 1}$  .
C Invariantly pretrained encoders
We also extend our experimental evaluation by adding a comparison to Smeu et al. [2022], an environment-aware framework for AD that pretrains the encoder of the AD model using an invariance-inducing method (LISA or IRM). We evaluate this method in MNIST and F-MNIST subject to targeted covariate shifts (the exact same setup as seen in our original experiments). The method was incorporated into all baselines and compared to the same baselines while regularized through partial conditional invariance.
We show the results of these experiments in Fig. 8. Across all methods tested, and in both datasets, we observe a sharp decrease in performance when compared to a baseline non-invariant method and that it provides less robustness to covariate shifts than our proposed methodology.
(a)  $e_1$  :MNIST s.t. one covariate shift
(b)  $e_2$  :MNIST s.t. two covariate shifts
(c)  $e_3$  :MNIST s.t three covariate shifts
(d)  $e_4$  :MNIST s.t. four covariate shifts
(e)  $e_2$ :F-MNIST s.t. one covariate shift
(f)  $e_2$ :F-MNIST s.t. two covariate shift
Figure 8: Experimental results MNIST and Fashion-MNIST with additional invariant pretraining following. (background transparent bar-plots: in-distribution evaluation; foreground opaque bar-plots: out-of-distribution evaluation). (a-d) Results in MNIST. (e-h) Results in Fashion-MNIST.
D Visualization of Invariance vs Informativeness
In Fig. 9 we plot the two-dimensional representation of the final layer of a model trained through MeanShift(Reiss and Hoshen [2021]) at different levels of PCIR regularization. The embeddings are obtained through t-SNE. From the progressive increase in the weight of the PCIR term, we see the increased superimposition of the different environments leading to more invariance at the loss of informativeness in the representation.
(a) Invariant and informative
(b) Invariant but non-informative
Figure 9: TSNE embeddings of MNIST with three background colors for the digits 4 and 9. The model used was MeanShift subject to different degrees of partial conditional invariant regularization. (a) PCIR term set to 5 (b) PCIR term set to 150. (c) PCIR term set to 0.
(c) Informative but non-invariant
E Tables of Results
In dist.	Out of dist.
e1(↑) AUROC	e2(↑) AUROC	e3(↑) AUROC	e4(↑) AUROC	e5(↑) AUROC
STFPM	0.850 ± 0.005	0.883 ± 0.014	0.815 ± 0.024	0.753 ± 0.007	0.745 ± 0.005
STFPM (PCIR)	0.868 ± 0.007	0.873 ± 0.008	0.814 ± 0.014	0.798 ± 0.011	0.774 ± 0.010
ReverseDistil	0.853 ± 0.009	0.884 ± 0.014	0.797 ± 0.015	0.716 ± 0.009	0.723 ± 0.004
ReverseDistil (PCIR)	0.866 ± 0.007	0.903 ± 0.007	0.857 ± 0.010	0.744 ± 0.021	0.718 ± 0.010
CFA	0.625 ± 0.002	0.689 ± 0.008	0.566 ± 0.014	0.454 ± 0.005	0.590 ± 0.017
CFA (PCIR)	0.625 ± 0.003	0.700 ± 0.007	0.597 ± 0.011	0.473 ± 0.009	0.595 ± 0.027
MeanShift	0.751 ± 0.012	0.761 ± 0.014	0.731 ± 0.015	0.703 ± 0.009	0.701 ± 0.010
MeanShift (PCIR)	0.781 ± 0.014	0.791 ± 0.014	0.778 ± 0.012	0.772 ± 0.013	0.770 ± 0.011
CSI	0.601 ± 0.021	0.600 ± 0.017	0.582 ± 0.014	0.491 ± 0.015	0.531 ± 0.014
CSI (PCIR)	0.648 ± 0.022	0.652 ± 0.021	0.621 ± 0.020	0.581 ± 0.018	0.600 ± 0.023
Red PANDA	0.761 ± 0.017	0.764 ± 0.015	0.671 ± 0.015	0.641 ± 0.015	0.651 ± 0.012
Red PANDA (PCIR)	0.761 ± 0.017	0.769 ± 0.015	0.742 ± 0.019	0.731 ± 0.015	0.740 ± 0.015
Table 2: Experimental results on realist domain shift in the Camelyon17 dataset, for both regularized and unregularized models trained on two environments. Results are presented over in-distribution evaluation (environments  $e_1$  and  $e_2$ ) and over out-of-distribution (environments  $e_3$ ,  $e_4$ , and  $e_5$ ).
In dist.	Out of dist.
e1(↑) AUROC	e2(↑) AUROC	e3(↑) AUROC	e4(↑) AUROC	e5(↑) AUROC
STFPM	0.854 ± 0.011	0.873 ± 0.004	0.782 ± 0.013	0.771 ± 0.013	0.735 ± 0.008
STFPM (PCIR)	0.865 ± 0.006	0.873 ± 0.005	0.796 ± 0.014	0.782 ± 0.012	0.759 ± 0.009
ReverseDistil	0.830 ± 0.028	0.866 ± 0.007	0.781 ± 0.004	0.707 ± 0.023	0.710 ± 0.033
ReverseDistil (PCIR)	0.843 ± 0.009	0.880 ± 0.015	0.799 ± 0.004	0.714 ± 0.010	0.715 ± 0.009
CFA	0.667 ± 0.004	0.708 ± 0.011	0.628 ± 0.019	0.559 ± 0.005	0.643 ± 0.006
CFA (PCIR)	0.667 ± 0.014	0.705 ± 0.019	0.623 ± 0.004	0.561 ± 0.003	0.644 ± 0.003
MeanShift	0.742 ± 0.014	0.741 ± 0.013	0.681 ± 0.014	0.739 ± 0.012	0.690 ± 0.013
MeanShift (PCIR)	0.772 ± 0.013	0.784 ± 0.012	0.739 ± 0.018	0.747 ± 0.013	0.731 ± 0.013
CSI	0.620 ± 0.015	0.636 ± 0.014	0.548 ± 0.013	0.571 ± 0.012	0.541 ± 0.015
CSI (PCIR)	0.650 ± 0.019	0.650 ± 0.010	0.613 ± 0.015	0.624 ± 0.014	0.611 ± 0.010
Red PANDA	0.751 ± 0.012	0.742 ± 0.013	0.651 ± 0.010	0.751 ± 0.010	0.641 ± 0.011
Red PANDA (PCIR)	0.767 ± 0.016	0.781 ± 0.014	0.761 ± 0.013	0.770 ± 0.012	0.751 ± 0.009
Table 3: Experimental results on realist domain shift in the Camelyon17 dataset, for both regularized and unregularized models trained on three environments. Results are presented over in-distribution evaluation (environments  $e_1$ ,  $e_2$ ,  $e_3$ ) and over out-of-distribution (environments  $e_4$ , and  $e_5$ ).
In dist. (↑) AUROC	Out of dist. (↑) AUROC
STFPM	0.699 ± 0.025	0.630 ± 0.025
STFPM (PCIR)	0.724 ± 0.020	0.698 ± 0.023
ReverseDistil	0.673 ± 0.057	0.617 ± 0.032
ReverseDistil (PCIR)	0.734 ± 0.013	0.723 ± 0.013
CFA	0.752 ± 0.003	0.705 ± 0.018
CFA (PCIR)	0.785 ± 0.003	0.759 ± 0.005
MeanShift	0.683 ± 0.041	0.629 ± 0.043
MeanShift (PCIR)	0.731 ± 0.022	0.726 ± 0.052
CSI	0.671 ± 0.026	0.626 ± 0.024
CSI (PCIR)	0.692 ± 0.017	0.674 ± 0.019
Red PANDA	0.732 ± 0.026	0.691 ± 0.031
Red PANDA (PCIR)	0.742 ± 0.029	0.721 ± 0.012
Table 4: Experimental results on realist shortcut learning in the Waterbirds dataset, for both regularized and unregularized. Results are presented over in-distribution evaluation and over out-of-distribution.
In dist. (↑) AUROC	1 cov. shift (↑) AUROC	2 cov. shifts (↑) AUROC	3 cov. shifts (↑) AUROC	4 cov. shifts (↑) AUROC
STFPM	0.850 ± 0.005	0.883 ± 0.014	0.815 ± 0.024	0.753 ± 0.007	0.745 ± 0.005
STFPM (PCIR)	0.868 ± 0.007	0.873 ± 0.008	0.814 ± 0.014	0.798 ± 0.011	0.774 ± 0.010
ReverseDistil	0.853 ± 0.009	0.884 ± 0.014	0.797 ± 0.015	0.716 ± 0.009	0.723 ± 0.004
ReverseDistil (PCIR)	0.866 ± 0.007	0.903 ± 0.007	0.857 ± 0.010	0.744 ± 0.021	0.718 ± 0.010
CFA	0.625 ± 0.002	0.689 ± 0.008	0.566 ± 0.014	0.454 ± 0.005	0.590 ± 0.017
CFA (PCIR)	0.625 ± 0.003	0.700 ± 0.007	0.597 ± 0.011	0.473 ± 0.009	0.595 ± 0.027
MeanShift	0.751 ± 0.012	0.761 ± 0.014	0.731 ± 0.015	0.703 ± 0.009	0.701 ± 0.010
MeanShift (PCIR)	0.781 ± 0.014	0.791 ± 0.014	0.778 ± 0.012	0.772 ± 0.013	0.770 ± 0.011
CSI	0.601 ± 0.021	0.600 ± 0.017	0.582 ± 0.014	0.491 ± 0.015	0.531 ± 0.014
CSI (PCIR)	0.648 ± 0.022	0.652 ± 0.021	0.621 ± 0.020	0.581 ± 0.018	0.600 ± 0.023
Red PANDA	0.761 ± 0.017	0.764 ± 0.015	0.671 ± 0.015	0.641 ± 0.015	0.651 ± 0.012
Red PANDA (PCIR)	0.761 ± 0.017	0.769 ± 0.015	0.742 ± 0.019	0.731 ± 0.015	0.740 ± 0.015
Table 5: Experimental results on synthetic covariate shift over the MNIST dataset, for both regularized and unregularized models. Results are presented over in-distribution evaluation, and test sets subject to one to four different covariate shifts, as portrayed in Fig. 7
In dist. (↑) AUROC	1 cov. shift (↑) AUROC	2 cov. shifts (↑) AUROC	3 cov. shifts (↑) AUROC	4 cov. shifts (↑) AUROC
STFPM	0.752 ± 0.010	0.530 ± 0.002	0.526 ± 0.004	0.526 ± 0.004	0.516 ± 0.007
STFPM (PCIR)	0.733 ± 0.014	0.601 ± 0.034	0.566 ± 0.004	0.562 ± 0.008	0.546 ± 0.006
ReverseDistil	0.737 ± 0.008	0.660 ± 0.013	0.655 ± 0.014	0.582 ± 0.011	0.543 ± 0.014
ReverseDistil (PCIR)	0.740 ± 0.007	0.689 ± 0.009	0.683 ± 0.008	0.615 ± 0.007	0.564 ± 0.004
MeanShift	0.751 ± 0.010	0.701 ± 0.009	0.692 ± 0.012	0.670 ± 0.010	0.643 ± 0.010
MeanShift (PCIR)	0.764 ± 0.010	0.742 ± 0.010	0.739 ± 0.009	0.720 ± 0.010	0.703 ± 0.008
CSI	0.691 ± 0.016	0.629 ± 0.011	0.571 ± 0.014	0.550 ± 0.012	0.542 ± 0.014
CSI (PCIR)	0.681 ± 0.014	0.661 ± 0.016	0.639 ± 0.014	0.611 ± 0.015	0.599 ± 0.011
Red PANDA	0.729 ± 0.013	0.693 ± 0.013	0.672 ± 0.015	0.637 ± 0.014	0.614 ± 0.010
Red PANDA (PCIR)	0.715 ± 0.016	0.690 ± 0.013	0.681 ± 0.010	0.661 ± 0.012	0.642 ± 0.009
Table 6: Experimental results on synthetic covariate shift over the Fashion-MNIST dataset, for both regularized and unregularized models. Results are presented over in-distribution evaluation, and test sets subject to one to four different covariate shifts, as portrayed in Fig. 7
F Performance Gained Compared to Baseline
Our investigation of the influence of partially conditional regularization on model performance is further expanded in Fig.10. This figure presents the percentile difference in mean-AUROC (Area Under the Receiver Operating Characteristic) between partially conditionally regularized and unregularized models.
By comparing each regularized model to its unregularized equivalent across all the tested environments, we have been able to observe a consistent improvement in performance when regularization is applied. This observation holds true across all models and out-of-distribution environments studied.
The increase in performance due to regularization varies from  $2.5\%$  to as substantial as  $20\%$  in some models. This variability implies a model-specific dependency on the degree of invariance that can be induced. Crucially, however, regularization substantially bolsters out-of-distribution performance without any additional training cost, reinforcing its merit as an effective strategy for developing robust anomaly detectors.
To further highlight this point and for the sack of completeness, we also present in Fig. 11, Fig. 12 and Fig. 13 each regularized model compared to its baseline.
(a) Camelyon17: two in-distribution
(c) MNIST
Figure 10: Percentual performance gain over each regularized model when compared to unregularized baseline.
(b) Camelyon17: three distribution
(d) Fashion-MNIST
As part of our comprehensive examination of how covariate shifts influence individual regularization weights, we have plotted the performance trajectories of all evaluated models, traversing environments from  $e_0$  to  $e_4$ . These are captured in Fig.14 and Fig.15.
As expected, and already observed in both our main findings and previous work (Ming et al. [2022]), a review of these plots unveils a trend that permeates across all examined models: the performance of models appears to inversely correlate with the number of induced covariate shifts. As the complexity introduced by these shifts mounts, the models' performance experiences a proportionate and systematic decline. This observable trend is essentially monotonic, signifying a erosion in model performance with each incremental rise in the quantity of covariate shifts.
However, it is important to note that this trend is not without exceptions. In particular, when scrutinizing the data pertaining to environment  $e_4$ , we can observe anomalies to this downward trend. In these exceptional instances, despite the increase in the number of covariate shifts, the performance of certain models appears to resist the general declining pattern.
(a) Camelyon17: STFPM
(d) Camelyon17: MeanShift
(b) Camelyon17: ReverseDistil
(e) Camelyon17: CSI
(c) Camelyon17: CFA
(f) Camelyon17: Red PANDA
Figure 11: Mean-AUROC curve of each anomaly detector and its regularized version in the Cam-lyon17 dataset.
(a) MNIST: STFPM
(d) MNIST: CSI
Figure 12: Mean-AUROC curve of each anomaly detector and its regularized version in the MNIST dataset.
(b) MNIST: ReverseDistil
(c) MNIST: MeanShift
(e) MNIST: Red PANDA
Thus, our overall conclusion, while acknowledging these exceptions, is that the prevalence of covariate shifts largely contributes to a degradation in model performance.
It is however important to note that the unregularized methods still underperform when compared to the same method under a even small amount (0.001) of partially conditional regularization added.
H.1 Shortcut Learning in Anomaly Detection
To expand on the experiment tackling real-world shortcut learning, and to better understand how a distribution shift affects different kinds of shortcut features (Geirhos et al. [2020]) captured by the model, we now will look at how inducing distinct changes to the anomaly detection causal graph may lead to malfunctions in the model.
(a) Fashion-MNIST: STFPM
(d) Fashion-MNIST: CSI
(b) Fashion-MNIST: ReverseDistil
(c) Fashion-MNIST: MeanShift
(e) Fashion-MNIST: Red PANDA
Figure 13: Mean-AUROC curve of each anomaly detector and its regularized version in the Fashion-MNIST dataset.
(a) MNIST: STFPM
(d) MNIST: CSI
Figure 14: Ablation study over the weight of the regularization term for MNIST under distribution shift, with separate plots for each model.
(b) MNIST: ReverseDistil
(c) MNIST: MeanShift
(e) MNIST:Red PANDA
Suppose we recover our formulation of the partition of an object  $X$  into the semantic features that distinguish normal and abnormal samples,  $X_{a}$ , and into the style features induced by the environment,  $X_{e}$ . In that case, it is possible to distinguish between settings that may lead to a model failure when a shortcut feature is captured.
Let us simplify our analysis by considering the setting where the training data is sampled under the intervention  $p^{do(E = e')} (X)$ , that is the style features are fixed into a specific setting,  $X_{e}'$ . This is a prevalent setting in real-world applications as spurious correlations between style and semantic features may occur when sampling the training data. Remember that in the training set,  $X_{a}$  only produces features of normal objects. Under this constraint, it was already previously noted that anomaly detection methods are particularly susceptible to capturing the style features as a prominent factor for the representation of  $X$  (Ming et al. [2022]).
Moving to the evaluation stage of the anomaly detector, we can then consider two settings.
(a) Fashion-MNIST: STFPM
(c) Fashion-MNIST: MeanShift
(b) Fashion-MNIST: Reverse Distil
(d) Fashion-MNIST: CSI
(e) Fashion-MNIST: Red PANDA
Figure 15: Ablation study over the weight of the regularization term for Fashion-MNIST under distribution shift, with separate plots for each model.
The first setting consists of no changes to the intervention  $p^{do(E = e')} (X)$ , that is, there was no distribution shift in the sampling of the data. In this setting, the main surrogate for a model failure is derived from anomalies that are characterized by small changes in  $X_{a}$  from normal to abnormal samples. That is, the style features would be considered the main source of information to characterize new samples, and under these constraints, it is only natural that all test instances would be highly likely to be set as normal. This setting was introduced by both Ming et al. [2022] and Cohen et al. [2023], and the underlying features can be referred to as nuisance features.
The second setting consists of a different intervention,  $p^{do(E = e^{\prime \prime})}(X)$  such that it differs from the training density  $p^{do(E = e^{\prime})}(X)$ . In particular, we can consider an intervention that only changes stylistic features,  $X_{e}$ , captured by the model. We are essentially operating under a highly targeted covariate shift that focuses on the shortcut features. Therefore, depending on the extent of the changes in  $X_{a}$  from normal to abnormal samples and how well they are captured by the model, this distribution shift would lead to an anomaly detector that classifies all new samples as anomalies.
Note that in both settings, as shown in our main presentation of the method, by inducing a partially conditional invariance to different environments, our regularization method also inherently introduces an invariance to the style features  $X_{e}$ . As supported by our results in the synthetic covariate shift experiments, we believe this also produces models that are not only robust to covariate shifts, as in the second scenario, but also to shortcut learning, as described in the first scenario.
H.2 Data Augmentation
Although data augmentation is a well-established technique to tackle model robustness to distribution shifts, there are two main problems with solely relying on data augmentation to solve a problem of distribution shift. First, data augmentation relies on both knowing of the existence of a distribution shift, and a way to simulate it. This could be achievable when the distribution shift is characterized by transformations in easily identifiable attributes (e.g. the color of a digit), and which are also easy to simulate through data transformations. However, in real-world settings, this is rarely the case: distribution shifts are complex transformations that are almost impossible to identify, and in many cases impossible to programmatically simulate. For example, in the case of the Camelyon17 dataset that considers histological cuts from different hospitals, the changes between environments that are derived from the change in histological staining are easy to visually inspect, and could even be simulated. But, by changing the hospital, the patient population also changes, and with it several cofounders, such as group age or patient comorbidities. These are both impossible to know without further annotation and unfeasible to simulate. Furthermore, data augmentation does not induce an invariance to a particular distribution shift, giving no additional "guarantees". It only increases the
pool of examples of the data in hopes that the model implicitly captures the additional simulated variance in the images.
Yet, data augmentation could still be beneficial in the context of penalized invariant regularization, by producing meaningful augmentations in the context of a multi-environment setting. It could be used to generate additional data for a single intervention, thus increasing the pool of available samples of a specific environment, or be used to generate new data for a new intervention, leading to an increased number of environments available, and the overall pool of samples in the dataset. This would effectively alleviate the second drawback of solely using data augmentations.
H.3 Choice of Distance Metric
We considered other options aside from MMD, like the Wasserstein distance. MMD is known to be computationally easier than Wasserstein's distance. This is because MMD can be easily computed using Gaussian kernels, whereas the Wasserstein distance requires computing a supremum over a set of probability measures, which is computationally intractable in general.
Another option we considered was the KL-divergence. However, previous works have demonstrated that this divergence is very unstable for probability distributions supported on low-dimensional manifolds (Arjovsky et al. [2017]). Note that many of the methods used for anomaly detection and machine learning are trained on samples from such distributions. A similar argument applies for variations of this divergence like Shannon-Jensen divergence and total variation.
Finally, we remark that MMD has a strong theoretical foundation. In spite of its simplicity, it is derived from a supremum of differences of expected values of functions from a reproducible-kernel Hilbert space (Gretton et al. [2012]). It has been shown that when this metric is 0 then the two distributions must match, which is precisely what we aim to achieve when learning representations that are invariant to the environments.
I.1 Baselines
STFPM The STFPM (Wang et al. [2021]) algorithm incorporates a pretrained teacher network and a student network that share the same structure. The student network assimilates the distribution of images devoid of anomalies by aligning the features with corresponding features in the teacher network. To boost robustness, the algorithm uses multi-scale feature matching. This multi-tiered feature alignment lets the student network absorb a blend of multi-level insights from the feature pyramid, thereby permitting the detection of anomalies of varying magnitudes.
During the inference stage, the feature pyramids of both teacher and student networks are put into comparison. A larger discrepancy between these pyramids implies a heightened likelihood of the presence of anomalies.
Reverse distillation The reverse distillation method (Deng and Li [2022]) is assembled from three networks: an initial pretrained feature extractor,  $f$ , a bottleneck embedding,  $\phi$ , and the student decoder network,  $\nu$ . The primary layer, or the backbone, of  $f$  is derived from a ResNet model that was pretrained on the ImageNet dataset.
During the execution of a forward pass, the model extracts features from three separate ResNet blocks. These features are encoded by amalgamating the three feature maps using the multi-scale feature fusion block of  $\phi$ , and then transferred to the decoder,  $\nu$ , which is constructed to mirror the feature extractor, albeit with operations reversed.
Throughout the training process, the output of these mirrored blocks is made to match the outputs from the respective layers of the feature extractor. This is ensured by adopting the cosine distance as the loss metric.
CFA Feature Adaptation based on CFA (Lee et al. [2022]) identifies anomalies utilizing features that are specifically tailored to the target dataset. The CFA model comprises two main elements: firstly, a learnable patch descriptor that learns and assimilates features oriented towards the target,
and secondly, a scalable memory bank that remains unimpacted by the size of the target dataset. In conjunction with a pre-trained encoder, CFA applies a patch descriptor and memory bank. By doing so, it makes use of transfer learning to bolster the density of normal features. Consequently, this facilitates an easier distinction between normal and abnormal features.
Mean-shifted The mean-shifted contrastive learning method (Reiss and Hoshen [2021]) introduces a novel loss function that calculates angular distances using the mean of all feature vectors as a reference point. This is done in contrast to using the origin as a reference and the Euclidean distance. It also combines two loss functions, one involving contrastive terms akin to Chen et al. [2020], but these terms are positioned around a hypersphere centred on the mean of all feature vectors. To deter positive samples from repelling themselves, it also incorporates an angular centre loss that encourages samples to gravitate towards the mean of normal samples.
CSI CSI (Tack et al. [2020]) is a direct extension of Chen et al. [2020], introducing a unique form of data augmentations known as distribution-shifting augmentations. In this setup, distribution-shifted augmentations are treated as negative samples instead of positive ones and are consequently pushed away from all positive samples. These augmentations include manipulations such as rotations and permutations. The augmentation's potential to shift the distribution is assessed through the AUROC, where samples altered by the said augmentation are considered out-of-distribution samples. The underlying notion here is that distinguishability is directly proportional to the shift in distribution.
Red PANDA The Red PANDA method for anomaly detection Cohen et al. [2023] tackles the particular problem of anomaly detection under nuisance or distracting features. Relying on labels from the nuisance factors, it employs a contrastive disentanglement loss following Kahana and Hoshen [2022], in conjunction with a perceptual loss to train a generator function end-to-end with a pretrained encoder.
I.2 Anomaly Scoring