Novelty Detection Via Blurring

1 INTRODUCTION . Out-of distribution ( OOD ) or novelty detection aims to distinguish samples in unseen distribution from the training distribution . A majority of novelty detection methods focus on noise filtering or representation learning . For example , we train an autoencoder to learn a mapping from the data to the bottleneck layer and use the bottleneck representation or reconstruction error to detect the OOD ( Sakruada et al. , 2014 ; Pidhorskyi et al. , 2018 ) . Recently , deep generative models ( Kingma et al. , 2014 ; Dinh et al. , 2017 ; Goodfellow et al. , 2014 ; Kingma et al. , 2018 ; Schlegl et al. , 2017 ) are widely used for novelty detection due to their ability to model high dimensional data . However , OOD detection performance of deep generative models has been called into question since they have been observed to assign a higher likelihood to the OOD data than the training data ( Nalisnick et al. , 2019 ; Choi et al. , 2018 ) . On the other hand , adversarial examples are widely employed to fool the classifier , and training classifiers against adversarial attacks has shown effectiveness in detecting unknown adversarial attacks ( Tramer et al. , 2018 ) . In this work , we propose blurred data as adversarial examples . When we test novelty detection schemes on the blurred data generated by Singular Value Decomposition ( SVD ) , we found that the novelty detection schemes assign higher confidence to the blurred data than the original data . Motivated by this observation , we employ blurring to prevent the OOD detector from overfitting to low resolution . We propose a new OOD detection model , SVD-RND , which is trained using the idea of Random Network Distillation ( RND ) ( Burda et al. , 2019 ) to discriminate the training data from their blurred versions . SVD-RND is evaluated in some challenging scenarios where vanilla generative models show nearly 50 % detection accuracy , such as CIFAR-10 vs. SVHN and ImageNet vs. CIFAR-10 ( Nalisnick et al. , 2019 ) . Compared to conventional baselines , SVD-RND shows a significant performance gain from 50 % to over 90 % in these domains . Moreover , SVD-RND shows improvements over baselines on domains where conventional OOD detection schemes show moderate results , such as CIFAR-10 vs. LSUN . 2 PROBLEM FORMULATION AND RELATED WORK . The goal of OOD detection is to determine whether the data is sampled from the target distribution D. Therefore , based on the training data Dtrain Ă D , we train a scalar function that expresses the confidence , or uncertainty of the data . The performance of the OOD detector is tested on the Dtest Ă D against the OOD dataset DOOD . We denote an in-distribution data and OOD pair as In : Out in this paper , e.g. , CIFAR-10 : SVHN . In this section , we mention only closely related work to our research . For a broader survey on deep OOD detection , we recommend the paper from Chalapathy et al . ( 2019 ) . OOD Detection : Majority of OOD detection methods rely on a reconstruction error and representation learning . ( Ruff et al. , 2018 ) trained a deep neural network to map data into a minimum volume hypersphere . Generative probabilistic novelty detection ( GPND ) ( Pidhorskyi et al. , 2018 ) employed the distance to the latent data manifold as the confidence measure and trained the adversarial autoencoder ( AAE ) to model the manifold . Deep generative models are widely employed for latent space modeling in OOD detection ( Zenati et al. , 2018 ; Sabokrou et al. , 2018 ) . However , a recent paper by Nalisnick et al . ( 2019 ) discovered that popular deep generative models , such as variational autoencoder ( VAE ) ( Kingma et al. , 2014 ) or GLOW ( Kingma et al. , 2018 ) , fail to detect simple OOD . While adversarially trained generative models , such as generative adversarial networks ( GAN ) ( Goodfellow et al. , 2014 ) or AAE , are not discussed in Nalisnick et al . ( 2019 ) , our experiments with GPND show that such models can also struggle to detect such simple OODs . OOD Detection with Additional Data : Some methods try to solve OOD detection by appending additional data or labels for training . Hendrycks et al . ( 2019 ) trained the detector with additional outlier data independent of the test OOD data . Ruff et al . ( 2019 ) employed semi-supervised learning for anomaly detection in the scenario where we have ground truth information on few training data . Golan et al . ( 2018 ) designed geometrically transformed data and trained the classifier to distinguish geometric transforms , such as translation , flipping , and rotation . Shalev et al . ( 2018 ) fine-tuned the image classifier to predict word embedding . However , the intuition behind these methods is to benefit from potential side information , while our self-generated blurred image focuses on compensating for the deep model ’ s vulnerability to OOD data with a lower effective rank . Adversarial Examples and Labeled Data : Some methods combine OOD detection with classification , resulting in OOD detection utilizing labeled data . Adversarial examples can be viewed as generated OOD data that attacks the confidence of a pretrained classifier . Therefore , they share some similarities . For example , Hendrycks et al . ( 2017 ) set the confidence as the maximum value of the probability output , which is vulnerable against the adversarial examples generated by the Fast Sign Gradient Method ( FSGM ) ( Goodfellow et al. , 2014 ) . On the other hand , Liang et al . ( 2018 ) employed FSGM counterintuitively to shift the OOD data from the target further , therefore improving OOD detection . Lee et al . ( 2018 ) employed Mahalanobis distance to measure uncertainty in the hidden features of the network , which also proved efficient in adversarial defense . Bayesian Uncertainty Calibration : Bayesian formulation is widely applied for better calibration of the model uncertainty . Recent works employed Bayesian neural networks ( Sun et al. , 2017 ) or interpreted a neural network ’ s architecture in the Bayesian formulation , such as dropout ( Gal et al. , 2016 ) , and Adam optimizer ( Khan et al. , 2018 ) . Our baseline , RND ( Burda et al. , 2019 ) , can be viewed as the Bayesian uncertainty of the model weight under randomly initialized prior ( Osband et al. , 2018 ) . 3 METHODOLOGY . In this section , we motivate our use of blurred data as adversarial examples to conventional deep OOD detection methods . Motivatied by the observation , we present our proposed algorithm , SVD-RND , and provide intuitions why SVD-RND help OOD detection . 3.1 GENERATING BLURRED DATA . In this work , blurred images function as adversarial examples . We directly employ the SVD on the data matrix of each image in the training data and force the bottom non-zero singular values to zero to construct a blurred image . Suppose that data image d P D consists of multiple channels , where the j-th channel has Nj nonzero singular values σj1 ě σj2 ě . . . σjNj ą 0 . Then , the j-th channel can be represented as the weighted sum of orthonormal vectors . dj “ Σ Nj t “ 1σjtujtv T jt ( 1 ) We discard the bottom K non-zero singular values of each channel to construct the blurred image . We test conventional novelty detection methods on blurred images . We first train the VQ-VAE ( Oord et al. , 2017 ) in the CIFAR-10 ( Krizhevsky et al. , 2009 ) dataset . Figure 1 shows the loss of VQ-VAE on the test data and blurred test data ( K “ 28 ) . We follow the settings of the original paper . VQ-VAE assigns higher likelihood to the blurred data than the original data . We note that this phenomenon is not constrained to the generative models . We trained the RND on the CIFAR-10 dataset and plot the L2 loss in the test data and blurred test data in Figure 1 . We refer to Appendix B for detailed explanation and employed architecture for the RND in the experiment . Furthermore , we plot the average loss on the blurred test data and original test data during the training procedure . Throughout the training phase , the model assigns lower uncertainty to the blurred data . This trend is similar to the CIFAR-10 : SVHN case observed by Nalisnick et al . ( 2019 ) , where the generative model assigns more confidence to the OOD data throughout the training process . While we employ SVD for our main blurring technique , conventional techniques in image processing can be applied for blurring , such as Discrete Cosine Transform ( DCT ) or Gaussian Blurring . However , DCT is quadratic in the size of the hyperparameter search space , therefore much harder to optimize than SVD . We further compare the performance between SVD and other blurring techniques in Section 4 . 3.2 OOD DETECTION VIA SVD-RND . We now present our proposed algorithm , SVD-RND . SVD-RND trains the predictor network f to discriminate between the original and blurred datasets . We first generate blurred datasets Di from Dtrain by zeroing the bottom Ki non-zero singular values of each data channel ( i “ 1 , . . . , btrain , where btrain is the number of generated blurred datasets used for training ) . We then construct btrain ` 1 target networks , i.e. , g0 , g1 , . . . , gbtrain . The target networks are independently randomly initialized and their parameters are unchanged during training . Predictor network f is trained to minimize the l2 loss against the corresponding target network on each dataset . f˚ “ arg min f ” ΣxPDtrain } fpxq ´ g0pxq } 2 2 ` Σ btrain i “ 1 ΣxPDi } fpxq ´ gipxq } 2 2 ı ( 2 ) SVD-RND optimizes the predictor network f as shown in p2q . When a new test sample x is given , SVD-RND outputs } fpxq ´ g0pxq } 22 as the uncertainty of the sample . Figure 2 shows the training process of SVD-RND . While the original RND paper employs a single target network to train the predictor network , SVD-RND employs multiple target networks to discriminate the original data from the blurred images . While SVD-RND directly regularizes only on the blurred images , OODs can be generated in alternative directions . For completeness , we investigate the performance of conventional models in OODs generated in orthogonal direction to blurring . We refer to Appendix D for the detailed experiment . 4 EXPERIMENTAL RESULTS . 4.1 EXPERIMENT SETTING . SVD-RND is examined in the cases in Table 1 . CIFAR-10 : SVHN , CelebA ( Liu et al. , 2015 ) : SVHN ( Netzer et al. , 2011 ) , and TinyImageNet ( Deng et al. , 2009 ) : ( SVHN , CIFAR-10 , CIFAR-100 ) are the cases studied by Nalisnick et al . ( 2019 ) . We also studied CIFAR-10 : ( LSUN ( Yu et al. , 2015 ) , TinyImageNet ) , LSUN : ( SVHN , CIFAR-10 , CIFAR-100 ) and CelebA : ( CIFAR-10 , CIFAR-100 ) pairs . We implement the baselines and SVD-RND in the PyTorch framework.1 For a unified treatment , we resized all images in all datasets to 32ˆ32 . We refer to Appendix C for the detailed setting . For SVD-RND , we optimize the number of discarded singular values over different datasets . We choose the detector with the best performance across the validation data . We refer to Appendix C for the parameter setting . We also examine the case where each image is blurred by DCT and Gaussian blurring . For DCT , we apply the DCT to the image , discard low magnitude signals , and generate the blurred image by inverse DCT . In DCT-RND , we optimize the number of discarded components in the frequency domain . For Gaussian blurring , we optimize the shape of the Gaussian kernel . We denote this method as GB-RND . We compare the performance of SVD-RND , DCT-RND , and GB-RND to the following baselines . Generative Probabilistic Novelty Detector : GPND ( Pidhorskyi et al. , 2018 ) is the conventional generative-model-based novelty detection method that models uncertainty as a deviation from the latent representation , which is modeled by the adversarial autoencoder . We trained GPND with further parameter optimization . Geometric Transforms : Golan et al . ( 2018 ) trained a classifier to discriminate in-distribution data against geometrically transformed data to achieve better OOD detection performance . The authors used four types of geometric transforms : flip , rotation , vertical translation , and horizontal translation . We test each transformation by setting them as OOD proxies in the RND framework . Moreover , we also investigate the effect of pixel inversion , contrast reduction , and shearing . We refer to Cubuk et al . ( 2019 ) for detailed explanation of the augmentation strategies . RND : We test the original RND ( Burda et al. , 2019 ) baseline . 1Our code is based on https : //github.com/kuangliu/pytorch-cifar Typicality Test : Nalisnick et al . ( 2019 ) set the OOD metric of the generative model as the distance between the mean log likelihood of the model on the training data and the log likelihood of the model on the test data . We experiment typicality test on the RND framework by employing the test loss of RND instead of log likelihood in the generative models . Five metrics on binary hypothesis testing are used to evaluate the OOD detectors : area under the Receiver Operating Characteristic curve ( AUROC ) , area of the region under the Precision-Recall curve ( AUPR ) , detection accuracy , and TNR ( True negative rate ) at 95 % TPR ( True positive rate ) . All criteria are bounded between 0 and 1 , and the results close to 1 imply better OOD detection .

Summary: They tackle the problem of out-of-data distribution by leveraging RND applied to data augmentations. They train a model f(x) to match the outputs of g_i(aug_i(x)), where g_i is a random network and aug_i is a particular type of augmentation. An example with high error in this task is treated as an out-of-distribution example. This work focuses on exploring blurring through SVD, where the smallest K singular values are set to 0, and K varies between different aug_i calls. They find that their method of consistently can achieve strong detection rates across multiple target-dataset pairs.