Characterizing Missing Information in Deep Networks Using Backpropagated Gradients
Authors: Gukyeong Kwon
Mohit Prabhushankar
Dogancan Temel
Ghassan AlRegib
Venue:  (2020)
Keywords: Representation learning
Missing Information in Deep Networks
Gradient-based Representation

Abstract: Deep networks face challenges of ensuring their robustness against inputs that cannot be effectively represented by information learned from training data. We attribute this vulnerability to the limitations inherent to activation-based representation. To complement the learned information from activation-based representation, we propose utilizing a gradient-based representation that explicitly focuses on missing information. In addition, we propose a directional constraint on the gradients as an objective during training to improve the characterization of missing information. To validate the effectiveness of the proposed approach, we compare the anomaly detection performance of gradient-based and activation-based representations. We show that the gradient-based representation outperforms the activation-based representation by 0.093 in CIFAR-10 and 0.361 in CURE-TSR datasets in terms of AUROC averaged over all classes. Also, we propose an anomaly detection algorithm that uses the gradient-based representation, denoted as GradCon, and validate its performance on three benchmarking datasets. The proposed method outperforms the majority of the state-of-the-art algorithms in CIFAR-10, MNIST, and fMNIST datasets with an average AUROC of 0.664, 0.973, and 0.934, respectively.

Under review as a conference paper at ICLR 2020
CHARACTERIZING MISSING INFORMATION IN DEEP NETWORKS USING BACKPROPAGATED GRADIENTS
Anonymous authors Paper under double-blind review
ABSTRACT
Deep networks face challenges of ensuring their robustness against inputs that cannot be effectively represented by information learned from training data. We attribute this vulnerability the limitations inherent activation-based repre- sentation. To complement the learned information from activation- based repre- sentation, we propose utilizing gradient-based representation that explicitly fo- cuses on missing information. In addition, we propose directional constraint on the gradients as an objective during training to improve the characterization of missing information. To validate the effectiveness of the proposed approach, we compare the anomaly detection performance of gradient- based and activation- based representations. We show that the mudientt-bssed representation outper- forms the activation- based representation by 0.093 in CIFAR-10 10 and 0.361 in CURE-TSR datasets in terms of AUROC averaged over all classes. Also, we propose an anomaly detection algorithm that uses the gradient-based representa- tion, denoted GradCon, and validate its performance datasets. The proposed method outperforms the majority of the state-of-the-art algorithms in CIFAR-IO, MNIST, and IMNIST datasets with an average AUROC of 0.664, 0.973, and 0.934, respectively.
three benchmarking
INTRODUCTION
The generalizable representation of data from deep network has largely contributed to the success of deep learning in diverse applications (Bengio et al., 2013). The representation from deep networks is often obtained in the form of activation. The activation is constructed by the weights which contain specific knowledge learned from training samples. Recent studies reveal that deep networks still face robustness issues when input that cannot be properly represented by learned knowledge is given to the networks (Goodfellow et al., 2014; Hendrycks & Dietterich, 2018; Liang al., 2017). One of the reasons for the vulnerability of deep networks is the limitation in the activation- based representation, which inherently focused the learned knowledge. However, the part of the input that causes problems in deep networks is mainly from the information that deep networks were not able to learn from the training data. Therefore, it is more appropriate complement the representation of input data from the perspective of information that has not been learned for enhancing the robustness of machine learning algorithms.
The gradient is another fundamental element in deep networks that is utilized to learn new informa- tion from given inputs by updating model weights (Goodfellow al., 2016). It is generated through backpropagation to train deep networks by minimizing designed loss functions (Rumelhart et al., 1986). During the training of network, the gradient with respect to the weights provides directional information to update the deep network and learn a better representation for the inputs. In other words, gradients guide the network to learn new information that was not learned from data that has seen so far but is presented in the current input. Considering this role during training, gradi- ents can provide a complementary perspective with respect to activation and characterize missing information that the network has not learned for each unseen image.
We demonstrate the role of gradients with an example in Fig. 1. Assume that a deep network has only leamned curved edge features from training images of the digit '0'. During testing, the digit '6' is given to the network. The digit '6' consists of both learned information (curved edges) and missing information (straight edges on top). Since the setivation-based representation is constructed

---

Under review as a conference paper at ICLR 2020
based the information that the network has already learned, the curved part of the digit '6' will be characterized effectively by the activation. However, the network still has to learn the straight edge features perform successfully on the digit '6'. Therefore, the gradients which guide updates in the deep network can characterize straight edge information that has not been learned.
We propose analyzing the representa- tion capability of gradients in charac- terizing missing information for deep networks. Gradients have been uti- lized in diverse applications such as adversarial attack generation and vi- sualization (Zeiler & Fergus, 2014; Goodfellow et al., 2014). How- ever, using gradients with respect to weight as the representation of data has not been actively explored yet. Through the comprehensive analy- sis with activation-bart baseed representa- tions, we show the effectiveness of gradient representation in characterizing the information that has not been learned for deep net- work. Furthermore, we show that gradient representation can achieve statc-of-the-ar performance in detecting potentially invalid data for the network. The main contributions of this paper are three folds:
Gradient
Gradient-based representation
Trained with
Input
Information that has not been learned
6
Existing information
Activation-based representation
Activation
Figure Gradient- representation for characterizing information that has not been learned for the deep network.
We propose utilizing gradients as a representation characterize information that has not been learned from the training data but is currently presented in the input data.
ii We analyze the representation capability of gradient compared to activation for detecting sam- ples which possess features that have not been learned for the network.
ii We propose gradient-based anomaly detection algorithm that outperforms state-of-the-arr al- gorithms based on activation representations.
RELATED WORKS
Existing works have focused on achieving reliable activation-basel representations to properly han- dle inputs that can cause significant performance degradation to deep networks. One of the most intuitive ways is to enhance the representation capability of activation by finetuning trained models and learning more from augmented data. Goodfellow al. (2014); Vasiljevic et al. (2016); Temel et al. (2017) utilize adversarial images, blurred images, and distorted virtual images, respectively, to finetune networks improve the classification performance based on the activation features. Also, several pre-processing techniques have been developed to make the representation of data similar to that of training data to achieve the robustness algorithms. Discrete cosine transform (DCT) has been explored as simple pre-pre pre-prcesssing technique to eliminate the effect of distortion and ad- versarial attacks (Hossain et al., 2018: Das et al., 2018). On the other hand, methods developed for detecting and filtering out problematic samples have focused making the representation of such samples as distinguishable as possible from that of training images in the activation space. Liang et al. (2017) propose a gradient-based pre- preeeroeessigg technique to make the activation-based representation of adversarial images and out-of-distributie
images dissimilar to that of training im- ages. Furthermore, constrained activation representations have been actively utilized to make normal and abnormal images statistically separable in the activation space for abnormal data detection (Pid- horskyi et al., 2018; Perera al., 2019; Abati et al., 2018). Aforementioned works exclusively focus on ectivation-based representations which are based on learned information to handle the informa- tion that has not been learned. We complement these by proposing backpropagated gradients- representation of data which particularly focuses what has not been learned in the trained net- work.
The backpropagated gradients have been utilized in diverse applications including but not limited to visualization, adversarial attacks, and image classification. The backpropagated gradients have been widely used for the visualization of deep networks. In Zeiler & Fergus (2014); Springenberg et al. (2014). information that networks have learned for a specific target class mapped back to the pixel space through the backpropagation and visualized. Selvaraju et al. (2017) utilize the
2

---

Under review as a conference paper at ICLR 2020
Test data distribution
Input
Reconstruction
Backpropagsted Gradients
Missing Knowledge
öj df
Encoder fo(x)
Decoder gg(2)
BelFo
86
0
reconsiructed by learned knowledge
2x 2(x,) + ()
&(x Reconstruction
Rout
Regularization
0
Reconstructed image manilold
(a) General scheme autoencoder.
(b) Geometric interpretation of gradients.
Figure 2: Geometric visualization for weight gradients from test images.
gradient with respect to activation to weight the activation and visualize the reasoning for prediction that deep networks have made. Adversarial attack another application of gradients. Goodfellow et al. (2014); Kurakin et al. (2016) show that adversarial attacks can be generated by adding an imperceptibly small vector which is the signum of input gradients. In Kwon et al. (2019), the backpropagated gradients are utilized to classify and objectively estimate the quality of distorted images. Several works have incorporated gradients with respect to input in the form of regularization during the training of deep networks to improve the robustness (Drucker & Le Cun, 1991; Ross & Doshi-Vert Velez, 2018; Sokolić et al., 2017). Although existing works have shown that gradients with respect input activation can be useful for diverse applications, gradients with respect weight remain almost unexplored aside from its role in training deep networks. In the following section, we demonstrate the interpretation of weight gradients further elaborate the role of weight gradients as data representation.
GEOMETRIC INTERPRETATION OF GRADIENTS
We use autoencoder which is unsupervised representation learning framework to explain the geometric interpretation of gradients. An autoencoder consists of an encoder, fa. and a decoder, Ia shown in Fig. 2 (a). From input image, xr the latent variable, z, is generated the reconstructed image is obtained by feeding the latent variable into the decoder, 9o (fo()))) The training is performed by minimizing the loss function, J (x; 0, Φ). defined as follows:
(x) and
Jz;; () = L(x, 9o (z))) + (2 0)),
where L is a reconstruction error which measures the dissimilarity between the input and the recon- structed image and Q2 is a regularization term for the latent variable.
We visualize the geometric interpretation of backpropagated gradients Fig. 2 (b). The autoencoder is trained to accurately reconstruct training images and the reconstructed training images form manifold. We assume that the structure of the manifold is linear plane which spanned by the weights of the encoder and the decoder as shown in the figure for the simplicity of explanation. Also, we explains the generalization of this concept in the following section. During test time, any given input to the autoencoder is projected onto the reconstructed image manifold through the projection, gs(fe())) The closer test images are to the reconstructed image manifold, the more accurately reconstructed they are. Let us assume that test data distribution is outside of the reconstructed image manifold. When the test image, Tout, sampled from the test data distribution is given to the autoencoder, it will be reconstructed from the test data distribution have not been utilized for training, they will be poorly reconstructed. Given that the reconstructed image manifold contains data reconstructed by learned knowledge, the orthogonal gap between Tout and fout measures the missing knowledge that the autoencoder has not learned and cannot reconstruct. Using the error defined in (1), the gradient of weights, âJ ae 86* can be calculated through the backpropagation. These gradients represent required changes in the reconstructed image manifold to incorporate the test images and reconstruct them accurately. In other words, these gradients characterize orthogonal variations of the test distribution with respect to the reconstructed image manifold, which is missing information in the trained networks.
Nout by the projection, Io (Ioo)))) Since test images
The gradients complement intivation-basedd representation in characterizing missing information. In this setup of the autoencoder, missing information is characterized by the reconstruction error using activation. It provides distance information between test images and reconstructed images and is utilized as a primal loss generate gradients. However, it does not provide any directional informa-
3

---

Under review as a conference paper at ICLR 2020
bayer
2 layer
bayer
Lournicd M ertin
Lourneci Witring
Overlap=793
Over
0:935
-0.15
0.72
0.65
0.223
0.80
E0.333
200
(2.)
3200
Cecane Sandbrity
Docine eiiorty (b) Proposed
Speck
Epeci
(a) Unconstrained
(c) Unconstrained
(d) Proposed
Figure 3: Analysis on the discriminant capability of gradients for learned and missing information.
tion about the deviation of test data distribution. The gradients focus on the directional information to characterize information that has not be learned. Considering that weights contain learned knowl- edge from training samples, the weight gradients indicate the directional changes required to obtain new knowledge with respect to current knowledge of networks. Therefore, the gradients can provide a comprehensive perspective to represent missing knowledge in trained networks by complementing distance information from activation-based representations with the directional information.
GENERALIZATION OF THE GEOMETRIC INTERPRETATION FOR GRADIENTS
The gradients require a discriminant capability in high dimensional space to be an effective repre- sentation for missing information in practical scenarios of deep networks. As a representation for the information that has not been learned, the representation is expected to clearly differentiate in- formation that has been learned and has not been learned from the input. Therefore, gradients from images with learned information should be distinguishable in terms of direction from those gener- ated by images with new information. For instance, the gradient generated from Tout in Fig. 2 is orthogonal to the reconstructed image manifold. However, test images with learned information do not result in high reconstruction errors and do not require significant changes in the reconstructed image manifold. In this case, gradients from these test images will be more tangential to the mani- fold and distinguishable from the gradient of Foot. This separation between gradients from learned and not learned information is required to effectively characterize what is missing and not in deep networks.
In addition, gradients from the learned information should be constrained make the direction of gradients for missing information more distinctive. In Fig. 2, the reconstructed image manifold is a two dimensional plane in three dimensional space. The gradients generated by test images with learned information are tangential to the manifold and constrained to the two dimensional space. These constrained gradients for test images with learned information allow gradients from Fout to be more distinctive and characterize missing information in the network.
We design two experiments to analyze the separation between gradients from learned and miss- ing information in the deep network. We train a convolutional autoencoder (CAF) which consists of 4-layer encoder and decoder, respectively. We use training images from Airplane class in CIFAR-10 10 dataset (Krizhevsky & Hinton, 2009) to train the CAE. A test set contains 1000 im- ages from Ai Airplane class and the same number of images randomly sampled from all other 9 classes in test split. The test Airplane class images contain learned knowledge and images from other classes contain information that has not been learned. In the first experiment, we extract the backpropagated gradients for all test images and measure the average alignment of gradients using cosine similarity (cosSIM). In Fig. 3 (a), we visualize the distribution of the average cosine sim- ilarity calculated between the gradient from each Airplane class image and that from all other remaining Ai rplanne class images (Learned), and between each Airplane class image and test images from all other classes (Missing). We calculate the average cosine similarity over all 4 layers in decoder. Ideally for gradients to be an effective representation, cosine similarity between images with learned information should be clearly separable to that calculated between images with learned and missing information. We also calculated the number of samples in the overlapped region of histograms. A large overlapped region (793 samples out of 1000 samples) between cosine similarity from 'Learned' and 'Missing' indicates that gradients in general cannot be distinguishable in high dimensional space. However, with our proposed method which will be described in the following section, the number of overlapped samples significantly decreases from 793 to 296 as shown in
4

---

Under review as a conference paper at ICLR 2020
Model
Loss
Plane
Car
Bird
Car
Deor
Dog
Frog
Horse
Ship
Truck
Average
CAE
Recon
0.689
0.356
0.639
0,592
0.676
0,621
0.304
0.499
0.716
0,390
0.568
CAE
Recon
0.659
0.356
0.640
0.555
0.695
0.554
0.549
0.478
0.695
0.357
0.554
Grad
Grad
0.752
0.619
0.622
0,580
0.705
0.591
0.685
0.576
0,774
0.709
0.661
Recen
0.553
0:608
0.437
0.546
0.393
0.531
0,489
0.515
0.552
0.631
0.526
VAB
Latent
0.634
0.442
0.640
0.497
0.743
0.315
0.745
0.527
0.674
0.416
0.583
Recon
0.556
0.606
0.438
0.548
0.392
0.543
0.496
0.518
0.552
0.631
0.528
VAB
Grad
Latent
0.586
0.396
0.618
0.476
0.719
0.474
0.098
0.577
0,586
0.413
0.550
Grad
0.736
0.625
0.591
0.596
0.707
0.570
0.740
0.543
0.738
0.029
0.647
Table
Anomaly detection results based on activations and gradients in CIFAR-10. 10.
Fig. (b). In addition, gradients become more aligned for learned information by achieving high cosine similarity and become orthogonal for missing information. This shows that gradients become more separable for learned and missing information with the proposed approach.
In the second experiment, we analyze the constraint on gradients by measuring the alignment of them generated while the training of CAE. We train the same architecture of the CAE described in the first experiment using Ai Airpi rp ane class images. To measure the alignment of training gradients, we calculate the cosine similarity between the gradients of a certain layer i at the & th iteration of
training, #C and the average of training gradients of layer obtained until the k 1 th iteration, Sw,
ac k-1 aW: aug"
defined as follows:
Oc OW aw,
OC k-1
k-1
OC k-1
1
Oc
COSSIM
where
(2)
aw,
(k:
aw;
W is the weight of autoencoder, is the layer index, and superscripts are used to indicate the iteration number. We visualize the progress of the cosine similarity while training over 1000 epochs in Fig. (c). We particularly focus on the cosine similarity in the 4 layers of decoder. To enhance the distinction between gradients from learned information and missing information, training gradients are expected to be constrained and aligned at the end of training by achieving high cosine similarity. However, we observe that the cosine similarity converges to the end of training. This indicates that even when most of information in training images is learned, the gradients is orthogonal to the average training gradients and remain unconstrained. On the other hand, we show our proposed method effectively constrains the gradients while training and obtain around 0.55 0.85 cosine similarity in Fig. (d). This constraint leads to the clear separability observed in Fig. 3 (b). In following section, explain the details of our proposed method.
DIRECTIONAL CONSTRAINT FOR GRADIENTS
We propose a directional constraint that enables gradients to characterize missing information in deep networks. In particular, we use the cosine similarity as a measure of the gradient alignment and constrain the direction of gradients in the form of regularization term in loss function. At & th iteration of training, the entire loss function is defined as follows:
OC k-1 OC K
|]
Ja; ((;W))= L (1;; W) a. COSSIM
aW: ann aw,
where (a; W) is the primal loss for given task and a is the weight for the gradient constraint, which is the average of cosine similarity calculated for each layer. We apply this constraint on a subset of all layers. Also, we set sufficiently small a value to ensure that gradients actively explore the optimal weights until the primal loss becomes small enough. During the training, L (x: W)
ac k is first calculated from the forward propagation. Through the backpropagation, aw. is obtained without updating the weights. Based on the obtained gradient, the entire loss J is calculated and finally the weights are updated using backpropagated gradients from the loss J.
We apply this gradient constraint to the autoencoders to evaluate its performance in characterizing information that has not been learned. We only constrain the gradients from 4 layers in decoder and
5

---

Under review as a conference paper at ICLR 2020
Decolorization
Lons Blur
Deccton
Leno
Dirty
Exposure
STOP
STOP
STOP
Gaunson
Rain
Steww
Hare
Lear Blu
Rain
STOP
STOP
20
Levert
Pote Recan ECO01
Recon (CAF-4Grat) obt Goad (PORtrant)
Figure 4: Anomaly detection results based on activations and gradients in CURE-TSR. encoder layers remain unconstrained. In the setup of autoencoder, the loss can be defined as,
ac k-1
ac
[z; 6) = L(x, go S2(2; 0, 6)
IE
COSSIM
(4)
Edeeoder
D avg 0Φ.
The first and the second terms are the reconstruction error and the latent loss, respectively, and the last term the gradient constraint.
We utilize anomaly detection as validation framework to both qualitatively and quantitatively eval- uate the performance of activation-based and gradient-based representations. In machine learning, the abnormal data is defined as data whose classes or attributes have not been learned during training. In the anomaly detection framework, images from one class of dataset is considered as inliers and used for the training. Images from other classes are considered as outliers and both inliers and out- liers are given to the network during the test time. The anomaly detection algorithms are expected to correctly classify both inliers and outliers by effectively distinguishing learned knowledge and not learned knowledge. Most of existing works for anomaly detection are based on the activation- based representations. In particular, they utilize reconstruction eπror latent loss measures for missing information and train probabilistic models on reconstructed image space or latent space to characterize anomalies (Zong al., 2018; Pidhorskyi et al., 2018; Abati et al., 2018).
We perform two sets of experiments to thoroughly validate the effectiveness of the gradient-basee representation. In the first experiment, analyze the capability of activation-base and gradient- based representations in characterizing missing information. To be specific, we evaluate the anomaly detection performance of the proposed gradient loss defined by the gradient constraint along with the reconstruction егror and the latent loss to show the potential in each representations for characteriz- ing missing information. We use an autoencoder with 4-layer encoder and decoder throughout whole experiments. We train CAEs using mean squared error as the reconstruction error. Also, we train variational autoencoders (VAEs) using binary cross entropy as the reconstruction error and Kullback Leibler (KL) divergence as the latent loss (Kingma& & Welling, 2013). For the gradient loss, we train both CAEs and VAEs with the gradient constraint defined as the last term in (4). Finally, we utilize these losses abnormality scores and report the anomaly detection performance. In the second ex- periment, we develop an anomaly detection algorithm using Gradient Constraint (GradCon) which detects anomalies by using the combination of reconstruction error and gradient loss abnor- mality score. We compare the performance of the proposed method with other benchmarking and state-of-the-arr algorithms and show that GradCon outperforms all compared algorithms at least in one dataset.
We utilize four benchmarking datasets, which are CIFAR-10 (Krizhevsky & Hinton, 2009). CURE- TSR (Temel et al., 2017), MNIST (LeCun et al., 1998), and fashion MNIST (IMNIST) (Xiao et al., 2017), to evaluate the performance of the proposed algorithm. CIFAR-10 dataset consists of 60,000 color images with 10 classes. CURE-TSE dataset has 637, 560 color traffic sign images which consist of 14 traffic sign types under levels of 12 different challenging conditions. MNIST dataset contains 70,000 handwritten digit images from 0 to 9 and fMNIST dataset also has 10 classes of fashion products and there are 7,000 images per class. For CIFAR-IO, CURE-TSR, and MNIST, we follow the protocol described in Perera et al. (2019). We utilize the training and testing split of each dataset to conduct experiments and 10% of training images are held out for validation. For fMNIST, we follow the protocol described in Pidhorskyi et al. (2018). The dataset is split into 5 folds and 60% of each class is used for training. 20% is used for validation, the remaining 20% is used for testing. In experiments with CIFAR-10, MNIST, and FMNIST,
images from

---

Under review as a conference paper at ICLR 2020
Plane
Car
Bird
Car
Deer
Dog
Frog
Horse
Ship
Truck
Average
OCSVM
0.650
0.440
0.649
0.487
0.735
0.500
0.725
0.533
0.649
0.308
0.386
KDE
0.658
0.520
0.687
0.497
0.727
0,496
0.758
0.564
0.680
0.540
0.610
DAE
0.411
0.478
0.616
0.562
0.728
0,513
0.688
0.497
0.487
0.378
0.536
VAB
0.634
0.442
0.640
0.497
0.743
0,515
0,745
0.527
0.674
0.416
0,583
PINeIONN
0,788
0.428
0.617
0.574
0.511
0.571
0,422
0.454
0.715
0.426
0.551
GAN
0.708
0.458
0.664
0.510
0.722
0.505
0.707
0.471
0.713
0.458
0.592
AND
0.735
0.580
0.690
0.542
0.761
0.546
0,751
0.535
0.717
0.548
0.641
ABoGAN
0.671
0.547
0.529
0.545
0.651
0.603
0.585
0.625
0.758
0.665
0.618
DSVDD
0.617
0.659
0.508
0.591
0.609
0.677
0.673
0.759
0.731
0.648
OCGAN
0.757
0.531
0.640
0.620
0.723
0.620
0.723
0.575
0.820
0.554
0.657
GradCon
0.700
0.398
0.648
0,586
0.733
0.003
0.684
0,567
0.784
0.678
0.664
Table 2: Anomaly detection results on CIFAR-10.
D
2
3
4
5
6
Average
OCSVM
0.988
0,999
0.902
0.950
0.955
0.968
0.978
0.965
0.853
0,955
0.951
KDF
0.885
0.996
0.710
0.693
0.844
0.776
0.861
0.884
0.669
0.825
0.814
DAE
0.894
0.999
0.792
0.851
0.888
0.819
0.944
0.922
0.740
0.917
0.677
VAE
0.997
0.999
0.936
0.959
0.973
0.964
0.993
0.976
0.923
0.976
0.970
PINCCNN
0.531
0.995
0.476
0.517
0.739
0.542
0.592
0.789
0.340
0.662
0.618
GAN
0.926
0.995
0.805
0,818
0.823
0.803
0.890
0.898
0.817
0.887
0.806
AND
0.993
0.999
0.959
0.966
0.956
0.964
0.994
0.980
0.953
0.981
0.975
ARoGAN
0.966
0.992
0,850
0.887
0.894
0.883
0.947
0.935
0.849
0.924
0.913
DSVDD
0.980
0.997
0.917
0.919
0.949
0.885
0,983
0.946
0.939
0.965
0.948
OCGAN
0.998
0.999
0.942
0.963
0.975
0.980
0.991
0
0.939
0
0,975
GradCon
0.995
0.999
0.952
0.973
0.909
0.977
0.994
0.979
0.919
0.973
0.973
Table 3: Anomaly detection results on MNIST.
one class as inliers to train the network. During test, inlier images and the same number of oulier images randomly sampled from other classes utilized. For CURE-TSR, challenge-free images are utilized as inliers to train the network. During test, challenge-free images are utilized as inliers and challenging version of these images are utilized as outliers. All the results obtained using area under receiver operation characteristic curve (AUROC) and we also report FI score in IMNIST dataset for the fair comparison with the state-of-the-art method (Pidhorskyi et al., 2018).
6 RESULTS
Comparison between activation- and gradient-based representations We report the anomaly detection performance based on the gradient loss (Grad) along with reconstruction error (Recon) and the latent loss (Latent) using CIFAR- 10 in Table 1. From this table, we can analyze three aspects of activation and gradient representations. First, by comparing the performance of CAE and CAE trained with gradient constraint (CAE + Grad), we analyze the effect of gradient constraint in characterizing missing information. The gradient constraint leads to a comparable av- erage AUROC from reconstruction error and achieves the best performance from the gradient loss with an average AUROC of 0.661. Second, we evaluate the effect of latent constraint by comparing CAE and VAE. The latent loss achieves improved performance compared to the reconstruction error of CAE. However, the latent constraint imposed in the VAE sacrifices the average AUROC of recon- struction error by 0.042. Finally, comparison between VAF and VAE with gradient constraint (VAE + Grad) analyzes the effect of the gradient constraint with the activation constraint. The gradient loss in VAE Grad achieves the second best performance by marginally sacrificing the average AUROC of reconstruction error and latent loss. From this experiment, we observe that imposing constraints on activation can degrade the performance of other activation-based representation in characterizing missing information. However, since gradients are obtained in parallel with activations, gradient constraint enables achieve better performance in anomaly characterization by complementing the activation-based representations.
We perform anomaly detection in CURE-TSR to highlight the discriminant capability of gradient representation for diverse challenging conditions and levels. We compare the performance of CAE and CAE + Grad using the reconstruction error and the gradient loss. The goal of this task is to successfully detect whether given test image is affected by challenge condition not. We report the performance for 8 challenging conditions and 5 levels in Fig. 4. Those challenge conditions are decolorization, lens blur, dirty lens, exposure, Gaussian blur, rain, snow, and haze visualized in Fig. 4. For all challenging conditions and levels, CAE + Grad achieves the best performance. In particular, except for snow level 1~33, the gradient loss achieves the best performance and for snow
7

---

Under review as a conference paper at ICLR 2020
level 1~33, the reconstruction error achieves the best performance. In terms of the average AUROC over challenge levels, the gradient loss of CAE + Grad outperforms the reconstruction error of CAE by the largest margin of 0.612 in rain and the smallest margin of 0.089 in snow. Overall, the gradient representation effectively characterizes challenge information that has not been learned and outperforms the activation-based representation.
Comparison with the state-of-the-art methods GradCon is the combination of the reconstruction error and the gradient loss from CAE trained with the gradi- ent constraint. We train CAEs by setting a 0.03 and (22; 0 Φ)
Reconatructin Erro
Latent
Gradient Loss
MNST
Dvertap-377
Chartape2224
0 in (4). This loss utilized for training is utilized as an anomaly score during testing but with the increased a of 0.12. We compare the proposed method with other algorithms in- cluding OCSVM (Schölkopf et al., 2001), KDE (Bishop. 2006), DAE (Hadsell et al., 2006), VAE (Kingma & Welling, 2013),
Dowdspp0100
2200
Ovirlap- 5464
Diwtapr200n
Figure 5: Histogram analysis on activation losses and gradient loss in MNIST and CIFAR-10.
PixeICNN (Van den Oord et al., 2016),
GAN (Schlegl et al., 2017). AND (Abati et al., 2018), AnoGAN (Schlegl et al., 2017), DSVDD (Ruff al., 2018), OC- GAN (Perera et al., 2019). The AUROC results on CIFAR-10 and MNIST are re- ported in Table 2 and Table 3, respec- tively. GradCon achieves the best average AUROC performance in CIFAR-10 while achieving comparable performance to the best algorithms in MNIST. We note that while other state-of-the-art methods train additional deep networks on top of latent space or reconstructed image space to detect anomalies, GradCon is solely based the gradient loss without training additional networks for anomaly detection. Therefore, the proposed method is computationally efficient compared to other methods. In Fig. 5, we visualize the distribution of reconstruction error, latent loss, and gradient loss for inliers and outliers fur- ther elaborate the reasoning for state-of- tftte-of-the-ar performance of the proposed method. We visualize each loss for all inliers and outliers from 10 classes in MNIST and CIFAR-10. 10. In CIFAR-10, which intivation-basel losses fail to
% outlier
10
20
GPND
0.968
0,945
0.91
0.891
0.864
FI
GradCon
0.967
0.945
0.924
0,905
0.871
AUC
GPND
0.928
0.932
0.933
0.933
0.933
GradCon
0.938
0,933
0.935
0.936
0.934
Table 4: Anomaly detection results fMNIST.
contains color images with more complicated structure than MNIST, effectively separate inliers and outliers. On the the other hand, the gradient loss still maintains the separation in CIFAR-10. The gradient loss achieves the least number of samples overlapped in both MNIST and CIFAR-IO, which explains the state-of-the art performance achieved by GradCon in both datasets. We also evaluate the performance of GradCon in comparison with another state-of- the-art algorithm denoted as GPND (Pidhorskyi et al., 2018) in fMNIST. In this fMNIST experiment, change the ratio of outliers in the test set from 10% to 30% and analyze the performance in terms of AUROC and Fl scores. The results in fMNIST are reported in Table 4. The proposed method outperforms GPND in all outlier ratios in terms of AUROC. Except for the 10% of outlier ratio test set, the proposed method achieves higher Fl scores than GPND.
7 CONCLUSION
We propose a gradient-based representation for characterizing information that deep networks have not learned. We introduce our geometric interpretation of gradients and generalize it high di- mensional scenarios of deep learning through the proposed directional constraint on gradients. We also thoroughly evaluate the representation capability of gradients compared to that of activations. We validate the effectiveness of gradients in the context of anomaly detection and show that pro- posed method based on the gradient representation achieves the state-of-the-art performance in four benchmarking datasets. The experimental results show that the directional information of gradi- ents effectively characterizes diverse missing information by complementing distance information provide a comprehensive perspective
from activations. Also, the madiient-based representation to handle data that cannot be represented by training data in diverse applications aiming to ensure the robustness of deep networks.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Davide Abati, Angelo Porrello, Simone Calderara, and Rita Cucchiara. And: Autoregressive novelty detectors. arXiv preprint arXiv: 1807 006,00663, 2018.
Yoshua Bengio, Aaron Courville, and Pascal Vincent. Representation learning: A review and new perspectives. IEEE transactions on pattern analysis and machine intelligence, 3788)11798-1888, 2013.
Christopher M Bishop. Pattern recognition and machine learning. springer, 2006.
Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Siwei Li, Li Chen, Michael Kounavis, and Duen Horng Chau. Shield: Fast, practical defense and vaccination for deep learn- ing using ipeg compression. In Proceedings of the 24th ACM SIGKDD International Conference Knowledge Discovery & Data Mining, pp. 196-204. ACM, 2018.
Harris Drucker and Yann Le Cun. Double backpropagation increasing generalization performance. In VICNN-9I-Saatin International Joint Conference Neural Networks, volume 2, pp. 145-150. IEEE, 1991.
Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1. MIT Press, 2016
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6577 2014.
Raia Hadsell, Sumit Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. In 2006 IEEE Computer Society Conference on Computer Vision and Pattern Recogni- fion (CVPR'OR) 06), volume 2, pp. 1735-1742. IEEE, 2006.
Dan Hendrycks and Thomas G Dietterich. Benchmarking neural network robustness to common corruptions and surface variations. arXiv preprint 1r07v:180..01999 2018.
Md Tahmid Hossain, Shyh Wei Teng, Dengsheng Zhang, Suryani Lim, and Guojun Lu. Distor- tion robust image classification with deep convolutional neural network based on discrete cosine transform. arXiv preprint arXiv:1811.05819, 2018
Diederik P Kingma and Max Welling. 131.6113 2013.
Auto-encoding variational bayes.
arXiv preprint
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Tech- nical report, Citeseer, 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint wwXiv:1611.01236 2016.
Gukyeong Kwon, Mohit Prabhushankar, Doganean Temel, and Ghassan AlRegib. Distorted repre- sentation space characterization through backpropagated gradients. In 2019 26th IEEE Interna- tional Conference on Image Processing (ICIP). IERE, 2019.
Yann LeCun, Léon Bottou, Yoshua Bengio, Patrick Haffner, et al. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 1):2278-2324, 1998.
Shiyu Liang, Yixuan Li, and R Srikant. Enhancing the reliability of out-of-distribution image detec- 7066
tion in neural networks. arXiv preprint arXiv: 100:::170....
02690. 770.02269. 2017.
Pramuditha Perera, Ramesh Nallapati, and Bing Xiang. Ocgan: One-class novelty detection using gans with constrained latent representations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2898-2906, 2019.
Stanislav Pidhorskyi, Ranya Almohsen, and Gianfranco Doretto. Generative probabilistic novelty detection with adversarial autoencoders. In Advances Neural Information Processing Systems, pp. 6822-6833, 2018.

---

Under review as a conference paper at ICLR 2020
Andrew Slavin Ross and Finale Doshi- Velez. Improving the adversarial robustness and interpretabil- ity of deep neural networks by regularizing their input gradients. In Thirty-second AAAI confer- ence on artificial intelligence, 2018.
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexan- der Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International Conference on Machine Learning, pp. 4393 -4922 2018.
D. E. Rumelhart, G. E. Hinton, and R. Williams. Learning representations by back-propagaan errors. Nature, 323(6088):533, 1986.
Thomas Schlegl, Philipp Seehöck, Sebastian M Waldstein, Ursula Schmidt-Erfurth, and Georg Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In International Conference Information Processing in Medical Imaging, pp. 146- 157. Springer, 2017.
Bernhard Schölkopf, John C Platt, John Shawe-Taylor, Alex J Smola, and Robert C Williamson. Estimating the support of high- high-dimensional distribution. Neural computation, 13(7):1443-1) 2001.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based local- ization. In Proceedings of the IEEE International Conference Computer Vision, pp. 618-626, 2017.
Jure Sokolić, Raja Giryes, Guillermo Sapiro, and Miguel RD Rodrigues. Robust large margin deep neural networks. IEEE Transactions on Signal Processing, 65(16):426544280, 2017.
Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for simplicity: The all convolutional net. arXiv preprint 1/2.6664, 2014.
Dogancan Temel, Gukyeong Kwon, Mohit Prabhushankar, and Ghassan AlRegib. Cure- tsr: Challenging unreal and real environments for traffic sign recognition. arXiv preprint 1712 2017.
Aaron Van den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et al. Con- ditional image generation with pixelcnn decoders. In Advances in neural information processing systems, pp. 4790-4798. 2016.
Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur on 2016.
recognition by convolutional networks. arXiv preprint
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint arXiv: 708.07777 2017.
Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In European conference on computer vision, pp. 818-833, Springer, 2014.
Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. Proceed- ings of the International Conference on Learning Representations, 2018.
10


Reviews:
[{"review_id": "rye0in7IcH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors consider gradients of some loss as a feature representation. The intro starts describing a form of classification loss, but this is switched to a GAE unsupervised loss in Eq. 1. In that section the authors somewhat show that a naive gradient representation does not work well, but at the same time show that it /may/ work with their method, introduced right after, and which consists in an \"orthogonality\" regularizer, introduced with any arbitrary loss later in Eq.3, and back to GAE in Eq.4. The authors evaluate whether this regularizer hurst reconstruction error \n\nI have found this paper interesting, but confusingly presented and still in a development phase (i.e. good idea, but not properly exploited yet). The premise on which the paper builds is that gradient information is more relevant than activations. Yet, this is only shown to be true if that gradient information is \"bent\" to follow a given orthogonality constraint in a fairly heuristic way (Eq. 4). Many choices are going under the hood:\n\n\"We train CAEs by setting α = 0.03 and Ω(z; θ, φ) = 0 in (4). This loss utilized for training is utilized as an anomaly score during testing but with the increased α of 0.12\" \n\nThe sentence above is quite mysterious. The framework is tested with an anomaly detection task, which is a bit underwhelming, and to be frank, the results in Tables 3 or 4 (MNIST / CIFAR10) are not particularly convincing, specially when one factors the fact that α has been strangely changed.\n\nBecause of this, I feel that overall the paper starts with a nice idea but has not reached yet the state in which it deserves being published.\n\nother comments:\n- I think it would help to formalize from the introduction what kind of gradient you are specifically referring to. Is it the gradient of the loss XE of the classifier w.r.t. an arbitrary label? although this is clarified later in the paper, the introduction is not informative enough (Fig. 1 is nice, but a proper statement is needed). In particular, gradients is presented as an alternative to Jacobians, but shouldn't it be some form of Jacobian (or collection of gradients)\n- in Eq. 1, why use *both* z and f_theta(x) in the same line, since they are equal? \n- Around Eq. 1, \"The training is performed by minimizing the loss function, J(x; θ, φ), defined as follows\". This is inacurate, J is not minimized to compute theta and phi: the sum over J(x_i; ...) is minimized. J is just an examplar loss. You minimize the expectation of J.\n- \"can be calculated through the backpropagation\" --> remove \"the\"\n- Your narrative in bottom of p.3 from \"We visualize the\" is a bit flawed: one could imagine an example where x_out ~= \\hat{x}_out, i.e. for which the loss L is small but the regularizer is large, or inversely one in which J is dominated by a small regularizer loss but where the loss L is large. So associating the size of the gradient of J to the departure from the manifold is misleading. It seems however that this is corrected later in p.5, in which you now allude only to d \\mathcal{L}\n- aren't there analogies with these gradients and Fisher score vectors in parametric stats? i.e. d log p_theta(x) / d theta ?\n- add more caption to Fig.3 describing what's going on, or at the very least a direct reference on the section / location in which the experiments are described.\n- \"with our proposed method which will be described in the following section\" : I would avoid this kind of \"movie\" narrative which tries to create a \"cinematic buildup\". Stick to scientific order, i.e. describe first method, test and experiment with it next.\n- \"is the primal loss for a given task\" --> supervised or unsupervised task?", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "HyxIFTiM5S", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors present an interesting idea: creating representations based on gradients\nwith respect to the weights to supplement information missing from the training dataset.\nThe idea if very well motivated and gets the reader excited.\nTheir explanation is clear from a high-level, however, the paper as a whole\nlacks rigorous justification. A lot of space is spent reviewing the role of gradients\nin training, what reconstruction loss is, and the basics of back-propagation --- however,\nmany of their own propositions (e.g. why constrain gradients?) are given without reasoning.\n\nThe paper could be made more clear by giving details and by changing the flow. For instance,\nSection 4 first gives a high-level explanation, then begins discussing specific experiments,\nand then returns to the method and provides some details. Additionally, it isn't until page 6\n(Section 5) that the authors introduce GradCon, one of the more promising ideas shared, this should\nbe a focal point in the paper and introduced early (and given more than two sentences for explanation).\nThe main proposal appears to be a modification of the loss function, but the paper may benefit from\ndiscussing implementation details (for example, during training vs. testing).\nFinally, the Figures (2 and 3 in particular) are not clear and need more explanation given in\nthe captions. Figure 3a and 3b tell an interesting story, but they're not easily digestable, nor is\nthe key take-away clear to the reader just by looking at the figure and caption.\n\nThe experimental results look reasonable and thorough, however the methods are sold on the\nidea of better representations for data missing from the training set, whereas the results\nare focused on anomaly detection. The method looks particularly promising at anomaly detection\ntasks --- the authors may have a more clear paper if they focus on this aspect.\nOverall, the paper presents a promising idea but it needs a more clear and rigorous presentation.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}, {"review_id": "BkxDPxaXcH", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "[Summary]\nThe paper proposed to use gradient-based presentation in deep neural networks to capture missing information unavailable in the activation-based network representation. It is claimed that the missing information that could not be encoded during learning from training set can be revealed by taking the gradient of an example with respect to the model parameters. Based on this idea, a new learning algorithm is proposed to combine both the conventional loss for activation-based presentation and gradient-based regularization. As an illustration, the method is evaluated on anomaly detection benchmarks with gradient-based representation as part of the anomaly inference. \n\n[Comments]\nI’m not sure if I fully understand the claimed contribution and how it is justified either theoretically and empirically. It seems to me that the paper claims the the current activation-based network does not fully encode information from training set during learning, and taking the gradient over a novel example (either training or test) with respect to (w.r.t,) model parameters can encode the missing information. I don't quite follow a few things, and had a difficult time in interpreting the novelty here.\n- What is the missing information (a model should learn but fails to capture from training set) exactly? The example in the introduction uses digit 0 for training and digit 6 for testing and claims the vertical edge in 6 is missing. But isn’t that expected if the model is only trained with digit 0s only? How would one expect the model to learn the vertical edge if there is none in the training data?       \n- More critically, the idea of taking the gradient of a model w.r.t.its parameters over an example to encode geometric relationship of the example in the data manifold is by no means novel at the conceptual level. There have been at least a bunch of similar classical methods derived from the perspective of information geometry. For instance, the Fisher kernel and vector  have been well studied for more than a decade, with both theoretical treatment (e.g., “Exploiting Generative Models in Discriminative Classifiers” in NIPS 1998) and application across multiple areas (e.g., “Fisher Kernels on Visual Vocabularies for Image Categorization” in CVPR 2007). I don’t see any novelty here by doing this to a new model (deep neural networks), and it is frustrating to see classical methods are being “invented” over and over again by decorating them with fashionable wrappers without any reference to the origin in the literature.  \n- Besides, to use gradients to capture missing information, the paper proposes to append a regularization term by enforcing the gradient at particular learning iteration to be close to the mean of those of previous iterations (via cosine similarity) as in (3). This seems not quite different from many existing popular inertia-based strategies like gradients with momentum, Adam, etc. It needs to be elucidated more how the proposed optimizer compares to these benchmark methods.        \n\nIn terms of implementation, I also found some details missing. For instance, the objective function of (4) requires evaluation of second order derivatives (since the second term in the cosSIM involves dL/dPhi(x, Phi)). How to efficiently compute this term is not clear to me yet.   It is also mentioned that only decoder of the AE is used for constraint gradient, The reason for this is also not explained.\n\nFor evaluation, only anomaly detection examples are provided. It would be great if more general tasks like image classification can be studied. After all, the proposed method is claimed to be a fairly general framework (the introduction actually uses image classification as the example), and evaluation on the most popular benchmarks provides the most convincing justification. Even on the anomaly detection tasks, the proposed approach does not seem to have solid advantages over baselines. I’m not sure how significant are the differences of 0.007 between GradCon and OCGAN (table 2 and 3), and those less than 1% in table 4.\n\nOverall the paper does not seem to have a clear and well-defined motivation, contribution is also vague and trivial compared to literature, plus very convincing empirical justification. Thus I do not think it is ready for publication at ICLR.     \n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes the use of gradient of the loss evaluated at the example with respect to the model parameters as the feature representation of that example. The authors performed an empirical analysis on anomaly detection benchmarks to demonstrate the practical benefits of the proposed method. While the reviewers find the idea interesting, the consensus is that the proposed method lacks justification, and that the main claims were not substantiated. While the reviewers proposed several key points of improvement, the raised issues were not addressed in the rebuttal. I will hence recommend rejection of this paper.

Decision: Reject