Generative Ensembles for Robust Anomaly Detection

1 INTRODUCTION . Knowing when a machine learning ( ML ) model is qualified to make predictions on an input is critical to safe deployment of ML technology in the real world . When training and test distributions differ , neural networks may provide – with high confidence – arbitrary predictions on inputs that they are unaccustomed to seeing . To mitigate these Out-of-Distribution ( OoD ) errors , we require methods to determine whether a given input is sampled from a different stochastic generator than the one used to train the model . OoD detection techniques have broad applications beyond safe deployment of ML technology . As datasets for ML grow ever larger and trend towards automated data collection , we require scalable methods for identifying outliers and quantifying noise before we can attempt to train models on that data . Identifying anomalies in data is a crucial feature of many data-driven applications , such as credit fraud detection and monitoring patient data in medical settings . Generative modeling algorithms have improved dramatically in recent years , and are capable of learning probabilistic models over large , high-dimensional datasets such as images , video , and natural language ( Vaswani et al. , 2017 ; Wang et al. , 2018 ) . A generative model pθ ( x ) , parameterized by random variable θ and trained to approximate data distribution p ( x ) , ought to assign low likelihoods to samples from any distribution q ( x ) that differs from p ( x ) . Density estimation does not presuppose a specific “ alternate ” distribution at training time , making it an attractive alternative to classification-based anomaly detection methods . In this work , we apply several classes of generative models to OoD detection problems and demonstrate a significant shortcoming to high-dimensional density estimation models : the anomaly detection model itself may be mispecified . Explicit likelihood models can , in practice , realize high likelihoods to adversarial examples , random noise , and even other natural image datasets . We also illustrate how GAN discriminators presuppose a particular OoD distribution , which makes them particularly fragile at OoD classification . We propose Generative Ensembles , which combine density estimation with uncertainty estimation to detect OoD in a robust manner . Generative Ensembles are model-independent and are trained independently of the task-specific ML model of interest . Our method outperforms task-specific OoD baselines on the majority of evaluated OoD tasks and demonstrate competitive results with discriminative classification approaches on the Kaggle Credit Fraud dataset . 2 GENERATIVE ENSEMBLES . We consider several classes of generative modeling techniques in our experiments . Autoregressive Models and Normalizing Flows ( NF ) are fully-observed likelihood models that construct a tractable log-likelihood approximation to the data-generating density p ( x ) ( Uria et al. , 2016 ; Dinh et al. , 2014 ; Rezende & Mohamed , 2015 ) . Variational Autoencoders ( VAE ) are latent variable models that maximize a variational lower bound on log density ( Kingma & Welling , 2013 ; Rezende et al. , 2014 ) . Finally , Generative Adversarial Networks ( GAN ) are implicit density models that minimize a divergence metric between p ( x ) and generative distribution qθ ( x ) ( Goodfellow et al. , 2014 ) . We refer to a GAN ’ s generative distribution as qθ ( x ) ( in lieu of pθ ( x ) ) because from the GAN discriminator ’ s point of view , the outputs of the generator are OoD and depend on θ . Although log p ( x ) and its lower bounds are proper scoring methods ( Lakshminarayanan et al. , 2017 ) , we approximate them in practice with continuous-valued neural network function approximators log pθ ( x ) . Neural networks have non-smooth predictive distributions , which makes them susceptible to malformed inputs that exploit idiosyncratic computation within the model ( Szegedy et al. , 2013 ) . Likelihood function approximators are no exception . When judging natural images , we assume an OoD input x ∼ q ( x ) should remain OoD within some LP -norm , and yet a Fast Gradient Sign Method ( FGSM ) attack ( Goodfellow et al. , 2015 ) on the predictive distribution can realize extremely high likelihood predictions ( Nguyen et al. , 2015 ) . Conversely , a FGSM attack in the reverse direction on an in-distribution sample x ∼ p ( x ) creates a perceptually identical input with low likelihood predictions ( Kos et al. , 2018 ) . To make matters worse , we show in Figure 1 that likelihood models can be fooled by OoD samples that are not even adversarial by construction , such as SVHN test images on a likelihood model trained on CIFAR-10 . Concurrent work by Nalisnick et al . ( 2018 ) also show this phenomena and present additional analyses on why generative models systematically assign higher likelihoods to SVHN . Generative Ensembles detect OoD examples by combining a density evaluation model with predictive uncertainty estimation on the density model via ensemble variance . Following the results of Lakshminarayanan et al . ( 2017 ) , we elect to use independently trained ensembles instead of a Bayesian Dropout approximation ( Gal & Ghahramani , 2016 ) . For generative models that admit exact likelihoods ( or variational approximations ) , the ensemble can be used to implement the Watanabe-Akaike Information Criterion ( WAIC ) , which consists of a density estimation score with a Bayesian correction term for model bias ( Watanabe , 2010 ) : WAIC ( x ) = Eθ [ log pθ ( x ) ] −Varθ [ log pθ ( x ) ] ( 1 ) 2.1 OOD DETECTION WITH GAN DISCRIMINATORS . We describe how to construct Generative Ensembles based on implicit density models such as GANs , and highlight the importance of OoD detection approaches that do not presuppose a specific OoD distribution . A discriminative model tasked with classifying between p ( x ) and q ( x ) is fragile to inputs that lie in neither distribution . Figure 2b illustrates a simple 2D density modeling task where individual GAN discriminators – when trained to convergence – learn a discriminative boundary that does not adequately capture p ( x ) . However , unlike discriminative anomaly classifiers on a static datasets , which model p ( x ) /q ( x ) , the likelihood ratio p ( x ) /qθ ( x ) implicitly assumed by a GAN discriminator is uniquely randomized by GAN training dynamics on θ . By training an ensemble of GANs we can estimate the posterior distribution over model decision boundaries p ( x ) /qθ ( x ) , or equivalently , the posterior distribution over alternate distributions qθ ( x ) . In other words , we can use uncertainty estimation on randomly sampled discriminators to de-correlate the OoD classification errors made by a single discriminator ( Figure 2c ) . 3 RELATED WORK . We can categorize existing OoD detection techniques in Table 1 using two criteria : ( 1 ) Does it assume a specific anomaly distribution ? ( 2 ) Is the technique specific to the model , or does it only depend on the inputs to the model ? A common approach to OoD detection ( a.k.a . anomaly detection ) is to label a dataset of anomalous data and train a binary classifier on that label . Alternatively , a classification task model may be augmented with a “ None of the above ” class . The classifier then learns a decision boundary ( likelihood ratio ) between p ( x ) and q ( x ) . However , the discriminative approach to anomaly detection requires the anomaly distribution to be specified at training time ; this is a severe flaw when anomalous data is rare ( e.g . medical seizures ) or non-stationary ( e.g . generated by an adversary ) . 3.1 UNCERTAINTY ESTIMATION . OoD detection is closely related to the problem of uncertainty estimation , whose goal is to yield calibrated confidence measures for a model ’ s predictive distribution pθ ( y|x ) . Well-calibrated uncertainty estimation integrates several forms of uncertainty into pθ ( y|x ) : model mispecification un- certainty ( OoD detection of invalid inputs ) , aleatoric uncertainty ( irreducible input noise for valid inputs ) , and epistemic uncertainty ( unknown model parameters for valid inputs ) . In this paper , we study OoD detection in isolation ; instead of considering whether pθ ( y|x ) should be trusted for a given x , we are trying to determine whether x should be fed into pθ ( y|x ) at all . Predictive uncertainty estimation is a model-dependent OoD technique because it depends on taskspecific information ( such as labels and task model architecture ) in order to yield an integrated estimate of uncertainty . ODIN ( Liang et al. , 2017 ) , MC Dropout ( Gal & Ghahramani , 2016 ) and DeepEnsemble ( Lakshminarayanan et al. , 2017 ) model a calibrated predictive distribution for a classification task . Variational information bottleneck ( VIB ) ( Alemi et al. , 2018b ) performs divergence estimation in latent space to detect OoD , but is technically a model-dependent technique because the latent code is trained jointly with the downstream classification task . One limitation of model-dependent OoD techniques is that they may discard information about p ( x ) in learning the task-specific loss function pθ ( y|x ) . Consider a contrived binary classification model on images that learns to solve the task perfectly by discarding all information except the contents of the first pixel ( no other information is preserved in the features ) . Subsequently , the model yields confident predictions on any distribution that happens to preserve identical first-pixel statistics . In contrast , density estimation in data space x considers the structure of the entire input manifold , without bias towards a particular downstream task or task-specific compression . In our work we estimate predictive uncertainty of the scoring model itself . Unlike predictive uncertainty methods applied to the task model ’ s predictions , Generative Ensembles do not require task-specific labels to train . Furthermore , model-independent OoD detection aids interpretation of predictive uncertainty by isolating the uncertainty component arising from OoD inputs . 3.2 ADVERSARIAL DEFENSE . Song et al . ( 2017 ) make the observation that adversarial examples designed to fool a downstream task have low likelihood under an independent generative model . They propose a “ data purification ” pipeline where inputs are first modified via gradient ascent on model likelihood , before passing it to the unmodified classifier . Their evaluations are restricted to Lp-norm attacks on in-distribution inputs to the task model , and do not take into account that the generative model itself may be susceptible to OoD errors . In fact , a preprocessing step with gradient ascent on model likelihood has the exact opposite of the desired effect when the input is OoD to begin with . Our work considers adversarial defense in a broader OoD context . Although adversarial attacks literature typically considers small Lp-norm modifications to input ( demonstrating the alarming sensitivity of neural networks ) , there is no such restriction in practice to the degree with which an input can be perturbed in a test setting . Adversarial defense is nothing more than making ML models robust to OoD inputs ; whether they come from an attacker or not is irrelevant . We evaluate our methods on simple OoD transformations ( flipping images ) , common ML datasets , and the adversaraial setting where a worst-case input is created from a single model in the ensemble . He et al . ( 2017 ) demonstrate that ensembling adversarial defenses does not completely mitigate local sensitivity of neural networks . It is certainly plausible that sufficient search over a Generative Ensemble ’ s predictions can find OoD inputs with both low variance and high likelihood . The focus of our work is to measure the extent to which uncertainty estimation improves robustness to model mispecification error , not to present a provably secure system . Having said that , model-independent OoD detection is easy to obfuscate in a practical ML security setting since the user only has access to the task model . Furthermore , a Generative Ensemble ’ s WAIC estimate can be made more robust by sampling additional models from the posterior over model parameters .

Summary: The authors present an OOD detection scheme with an ensemble of generative models. When the exact likelihood is available from the generative model, the authors approximate the WAIC score. For GAN models, the authors compute the variance over the discriminators for any given input. They show that this method outperforms ODIN and VIB on image datasets and also achieves comparable performance on Kaggle Credit Fraud dataset.