Understanding the Effect of Bias in Deep Anomaly Detection
Authors: Ziyu Ye
Yuxin Chen
Haitao Zheng
Venue:  (2021)
Keywords: deep anomaly detection
bias
PAC guarantee

Abstract: Anomaly detection presents a unique challenge in machine learning, due to the scarcity of labeled anomaly data. Recent work attempts to mitigate such problems by augmenting training of deep anomaly detection models with additional labeled anomaly samples. However, the labeled data often does not align with the target distribution and introduces harmful bias to the trained model. In this paper, we aim to understand the effect of a biased anomaly set on anomaly detection. We formally state the anomaly detection problem as a supervised learning task, and focus on the anomaly detector’s recall at a given false positive rate as the main performance metric. Given two different anomaly score functions, we formally define their difference in performance as the relative scoring bias of the anomaly detectors. Along this line, our work provides two key contributions. We establish the first finite sample rates for estimating the relative scoring bias for deep anomaly detection, and empirically validate our theoretical results on both synthetic and real-world datasets. We also provide extensive empirical study on how a biased training anomaly set affects the anomaly score function and therefore the detection performance on different anomaly classes. Our study demonstrates scenarios in which the biased anomaly set can be useful or problematic, and provides a solid benchmark for future research. 

Under review as a conference paper at ICLR 2021
UNDERSTANDING THE EFFECT OF BIAS IN DEEP ANOMALY DETECTION
Anonymous authors Paper under double-bling review
ABSTRACT
Anomaly detection presents unique challenge in machine learning, due to the scarcity of labeled anomaly data. Recent work attempts to mitigate such problems by augmenting training of deep anomaly detection models with additional labeled anomaly samples. However, the labeled data often does not align with the target distribution and introduces harmful bias to the trained model. In this paper, we aim to understand the effect of a biased anomaly set on anomaly detection. We formally state the anomaly detection problem as supervised learning task, and focus on the anomaly detector's 's recall at a given false positive rate as the main performance metric. Given two different anomaly score functions, we formally define their difference in performance as the relative scoring bias of the anomaly detectors. Along this line, our work provides two key contributions. We estab- lish the first finite sample rates for estimating the relative scoring bias for deep anomaly detection, and empirically validate our theoretical results on both syn- thetic and real-world datasets. We also provide extensive empirical study on how a biased training anomaly set affects the anomaly score function and therefore the detection performance on different anomaly classes. Our study demonstrates sce- narios in which the biased anomaly set can be useful or problematic, and provides solid benchmark for future research.
INTRODUCTION
Anomaly detection (Chandola al., 2009: Pimentel al. 2014) trains a formal model to identify unexpected or anomalous instances in incoming data, whose behaviors differ from normal instances. is particularly useful for detecting problematic events such as digital fraud, structural defects, and system malfunctions. Building accurate anomaly detection models is a well-known challenge in machine learning, due to the scarcity of labeled anomaly data. The classical and most common approach is to train anomaly detection models using only normal data[] i.e., first train a model using a corpus of normal data to capture normal behaviors, then configure the model to flag instances with large deviations capture the complex structure in the data (Ruff et al. (2018); Wang ot al. (2019a); Zhou & Paffenroth (2017). ) Following the terminology introduced by Chandola al. (2009). refer these models as supi-super anomaly detection.
anomalics. Researchers have also developed deep learning methods to better
Recently, a new line of anomaly detection models proposes to leverage available labeled anomalies during model training, i.e., train an anomaly detection model using both normal data and additional labeled anomaly samples as they become available (Ruff et al. (2020)); Yamanaka al. (2019); Ruff et al. (2020a): Hendryyks et al. (2019))). Existing works show that these new models achieve considerable performance improvements beyond the models trained using only normal data. We hereby refer to these models as deep supervisedJanone anomaly detection (Chandola et al. (200)).
When exploring these models, we found that when the labeled anomalies (used train the model) do not align with the target distribution, they could introduce harmful bias to the trained model. Specif- ically, when comparing the performance of supervised anomaly detector to its semi-supervised
Existtig literature has used different terms to describe this type of models: some using semi-supervised anomaly detection (Chandola al. 2009) and others using unsupervised anomaly detection (Ruf et al. 2018).
2 Some works termed these models as semi- eemi-supervised anomaly detection (Ruff et al. 2020b Yamanaka
2019 Ruff et al. 2020a Hendrycks et al. 2019a) while others termed them supervised anomaly
detection (Chandola
2009

---

Under review as a conference paper at ICLR 2021
version, the performance difference varies significantly across test anomaly data, some better and some worse. That is, using labeled anomalies during model training does not always improve model performance; instead, it may introduce large variance (or bias) in anomaly detection outcomes.
In this paper, we aim to understand the effeet of a biased training set on deep anomaly detection models. We formally state the anomaly detection problem, focusing the anomaly detector's recall at a given false positive rate as the main performance metric. We factor the contribution of the labeled anomalies by the detector's anomaly scoring function, and show that different types of labeled anomalies produce different anomaly scoring functions. Next, given any two different anomaly scoring functions, we formally define their difference in performance as the relative scoring bias of the anomaly detectors. Our novel notion of scoring bias for anomaly detection aligns with the notion of bias in the classical supervised learning setting, with the key difference being the different performance metric we target recall at given false positive rate, the metric used by real-world anomaly detection tasks (Li et al. 2019 Liu al. 2018).
Along this line, establish the first finite sample rates for estimating the relative scoring bias for deep anomaly detection. We empirically validate our assumptions and theoretical results on both synthetic and three real-world datasets (Fashion-MNIST, Statlog (Landsat Satellite), and Cellular Spectrum Misuse Li ct al. 2019)).
Furthermore, we provide empirical study on how biased training anomaly set affects the anomaly score function and therefore the resulting detection performance. We consider the above three real-world datasets and six deep-learning based anomaly detection models. Our study demon- strates scenarios which the biased anomaly set can be useful or problematic, and provides a solid benchmark for future research.
In this paper, we introduce a formal analysis on the effect of a biased training set on deep anomaly detection. Our main contributions are the following:
We discover the issue of large performance variance in deep anomaly detectors, caused by the use of the biased anomaly set as training data.
We model the effect of biased training as relative scoring bias, and establish the first finite sample rates for estimating the relative scoring bias of the trained models.
We conduct empirical experiments to verify and characterize the impact of the relative scoring bias on six popular anomaly detection models, and three real-world datasets.
To the best of our knowledge, our work is the first to formally study the effect of a biased anomaly training set on deep anomaly detection. Our results show both significant positive and negative impacts of these biases. and suggest that model trainers must treat anomalies with additional care. We believe this leads to new opportunities for improving deep anomaly detectors and deserves more attention from the research community.
2 RELATED WORK
Anomaly Detection Models. While the literature on anomaly detection models is extensive, the most relevant to our work are deep learning based models. Following the terminology used by Chandola et al. (2009). we consider two types of models:
Semi-supervised anomaly detection refers to models trained on only normal data, e.g., Ruff et al. :2018) Sakurada & Yairi (2014); /Zhou & Paffenroth (2017);
Supervised anomaly detection refers to models trained normal data and a small set of la-
beled anomalies, Pang et al. (2019) Daniel et al. (019); Yamanaka et al. (2019) Ruff et al. 2020a b).
One can also categorize models by their architecture: hypersphere (Ruff et al. 2018 2020a b) and autoencoder (or reconstruction) based models (Zhou & Paffenroth, 2017 Yamanaka et al. 2019).
Another line of recent work proposes use synthetic or auxiliary anomalies to train anomaly de- tection models (Golan & El- Yaniv (2018; Hendrycks et al. (2019c); Lee et al. (2018) Hendrycks ett al. (2019b)). "forcing" the model to learn more compact representation of the normal data. While the existing work has shown empirically that the choice of abnormal data in training can help detect some unseen abnormal distributions, it does not offer any theoretical explanation for the phe-
2

---

Under review as a conference paper at ICLR 2021
nomenon, nor does it consider the counter-cases when additional abnormal data in training hurt the detection performance.
Bias in Anomaly Detection. To the best of our knowledge, are the first to identify the presence of bias caused by an additional labeled anomaly set in deep anomaly detection models, especially when there exists mismatch between the anomalies present in training and those encountered in testing (as shown in Section 5) Existing work has explored the presence of bias in semi- semi-supervised anomaly detection models when there exists defective normal data in training, like outliers and simple-to-reconstruct examples [Tong et al. 2019), or examples with background noise (Liu & Ma 2019). There is also literature on the biri-nariance tradeoff for ensembles of semi-supervised anomaly detection models (Aggarwal & Sathe, 2015 |Raanaa et al.) (0166). But little or no work has been done on the bias of anomaly detection in the supervised setting (i.e., models trained on both normal data and some labeled anomalies). Finally, another line of work in transfer learning has identified the value of additional labeled data in training (Kpotufe & Martinet (0088] Hanneke & Kpotufe 2019) and the performance bias on target data by transferring knowledge from less related source (Wang et al., 2019bb Wu et al. 2020 classification models.
Yet most work only considered the cases of
Despite significant progress on developing theoret- ical guarantees for classification tasks (Valiant (1984); Kearns al. (9944), little has been done for anomaly detection tasks. Siddiqui et a (2016) first establishes a PAC framework for anomaly detection models using the notion of pattern space; however, it is hard to apply such pattern spaces to deep learning models with complex latent spaces. Liu et al. (2018) proposes a model-agnostic approach provide the PAC guarantee for anomaly detection performance, by analyzing the con- vergence for the cumulative distribution of anomaly scores. We follow the basic setting from this line of work address the convergence of the relative scoring bias. In contrast to prior work, our proof relies on a novel adaption of the key theoretical tool from Massart (1990), which allows us to extend our theory to characterize the notion of scoring bias as defined in Section 3.2
PAC guarantees for Anomaly Detection.
PROBLEM FORMULATION
We now formally state the anomaly detection problem. Consider a model class θ for anomaly detection, and a (labeled) training set D sampled from mixture distribution D over the normal and anomalous instances. In the context of anomaly detection, a model I maps each input instance æ to a continuous output, which corresponds to anomaly score so().. The model further uses a threshold To on the score function to produce a binary label for input x.
For a given threshold value Tg. we can define the False Positive Rate (FPR) of the model f on the input data distribution as FPR (0, TO) = P (>) > TB y/ ===00 0). and the True Positive Rate (TPR, a.k.a. Recall) as TPR (sp, Tp) TP (>)(x) To ==y11 1]. The FPR and TPR are competing objectives- key challenge for anomaly detection algorithms is to identify a configuration of the score, threshold pair (se, -8) that strikes a balance between the two performance metries. g.L.o.g in this paper we focus on the following scenario, where the objective is to maximize TPR subject to achieving target FPR. Formally, let q be the target FPR: define the optimal anomaly detector a
(s T/)
arg max TPR(sa, 78) (aa.te):0g6
s.t. FPR T8) 5
(3.1)
3.1 A GENERAL ANOMALY DETECTION FRAMEWORK
Note that the performance metric (namely TPR) in Problem is statistics that depends on the entire predictive distribution, and can not be easily evaluated on any single data point. Therefore, rather than directly solving Problem 3.1, practical anomaly detection algorithms (such as OCSVM
Schölkopf et al. 1999), Deep SAD (Ruff et al. 2020b), etc) often rely on a two-stage process: (1)
Our results can be easily extended to the setting where the goal is minimize FPR subject a given TPR. "This formulation aligns with many contemporary works in deep anomaly detection. For example, Li et al. 2019) show that in real-world anomaly detection problems, it is desirable to detect anomalies with prefixed low false alarm rate; [iu al. (2018) formulate the anomaly detection in similar way, where the goal is to
minimize FPR for fixed TPR.
3

---

Under review as a conference paper at ICLR 2021
learning the score function se from training data via surrogate loss, and (2) given so from the previous step, computing the threshold function To on the training data. Formally, given a model class θ, training set D, loss function L, and a target FPR q, two-staged anomaly detection algorithm outputs
8o E arg 69:60 (50, D)
(3.2)
tg arg T.:00 TPR($p, TO) s.t. FPR($o: TO) 5
Note that the first part of Equation 3.2 amounts to solving supervised learning problem. Here, the loss function É could be instantiated into latent-space-based losses (e.g.. Deep SAD), margin- based losses (e.g.. OCSVM), or reconstruction-asse losses (c.g.. ABC (Yamanaka et al.] 2019)); therefore, many contemporary anomaly detection models fall into this framework. To set the thresh- old fo. we consider using the distribution of the anomaly scores $g(+) from a labeled validation set D ~ D. Let Dval= = D U Daal where Doal and D denote the subset of normal data and the subset of abnormal data of D Denote the empirical CDFs for anomaly scores assigned to x in Dial and D as Fo and Fa, respectively. Then, given a target FPR value q, following similar argument as Liu et al. (2018), one can compute the threshold as f. = max {u E R Fo(u) S q)-
The steps for solving the second part of Equation 3.2 is summarized in Algorithm I
Algorithm 1: Computing the anomaly detection threshold for Problem 3.2
Data: A validation dataset D and a scoring function s(-). Result:
A score threshold achieving a target FPR and the corresponding recall on D
Get anomaly score s(z) for each x in D
Compute empirical CDF (z) and Fa (z)) for anomaly scores of in Dia and D
Output detection threshold f = max u E IR Po(u)= S 4).
Output TPR (recall) Daa as i (f).
3.2 SCORING BIAS
Given a model class θ and training set D, we define the scoring bias of detector (Sg, fo) to be the difference in TPR between (8o, fo) and (sø, T
bias(Sa, fa) = arg max TPR(sa, (9, Te) - TTTTPPRS fi) (s0.70):0E@
(3.3)
We call (So, fo) a biased detector bias( So: fo) > 0. In practice, due to biased training distri- bution, and the fact that the two-stage process in Equation 3.2 is not directly optimizing TPR, the resulting anomaly detectors are often biased by construction. Therefore, one practically significant performance measure is the relative bias, defined as the difference in TPR between two anomaly de- tectors, subject to the constraints in Equation 3.2 It captures the relative strength of two algorithms in detecting anomalies, and therefore is an important indicator for model evaluation and model lection. Formally, given two arbitrary anomaly score functions 8, s' and the corresponding threshold function T, r' obtained from Algorithm [ we define the relative scoring bias between and s' as:
5'), bi bias(s',
TPR(s's r') (s,(s
(3.4)
Note that when s' = s/, the relative scoring bias (equation 3.4 reduces to the scoring bias (equa- tion 3.3 We further define the empirical relative scoring bias between s and s' as
{(8, = TPR ((),,'') TPR(s,
(3.5)
where TPR(s, 7) = = Σ 1,(,))>r,)) denotes the TPR (recall) estimated on a finite validation set size n. In the following sections, we will investigate both the theoretical properties and the empirical behavior of the empirical relative scoring bias for contemporary anomaly detectors.
4 FINITE SAMPLE ANALYSIS FOR EMPIRICAL RELATIVE SCORING BIAS
In this section, we show how one can estimate the relative scoring bias (Equation 3.4) given any two scoring functions 8, s' learned in Section 3.1 As example, 8 could be scoring function induced
4

---

Under review as a conference paper at ICLR 2021
by semi- unsupersuee anomaly detector trained on normal data only, and s' could be scoring function induced by a supervised anomaly detector trained on biased anomaly set. In the following, provide finite sample analysis of the convergence rate of the empirical relative scoring bias, and validate our theoretical analysis via a case study.
4.1 FINITE SAMPLE GUARANTEE
Notations. Concretely, assume that when determining the threshold in Line 3 of Algo- rithm 1 both scoring functions 8, 8' are evaluated on the unbiased (marginal) empirical distribu- tion of the normal data. Furthermore, the empirical TPR in Line are estimated on the unbiased empirical distribution of the abnormal data. Let {s; == s(x;) 24, Vi = 0 denote a set of anomaly scores evaluated by s(.) on ng i..d. random normal data points. Following the nota- tion in Section 3.1 we use Fo(t) == P (s(x)) S t y = 0) to denote the CDF of s(z), and use (t() == 1 -i= Stic to denote the corresponding empirical CDF. For nı i.idd. samples 1=0= with CDF (t): == IP [sxx) S t y 1], the corresponding empri- cal CDF is (() = E== 1 Ststty11 Similarly, we denote the CDF and emiprical CDF for {<) = 20 as (() and (t), and for {s's Bj 1ー as as (1) and (1), respectively.
no
{sg == s(x;)) [zj. 21
Infinite sample case. In the limit of infinite data (both normal and abnormal), Fo, Fer Fo Fy will converge to the true CDFs (cf. Skorokhod's representation theorem and Theorem 2A of Parzen 19800) and hence the empirical relative scoring bias will also converge. The following Proposition establishes a connection between the CDFs and the scoring bias.
Proposition 1. Given two scoring functions 8,8' and target FPR q the relative scoring bias is 8(s,8') = FFFFFFFF (4)) FFF (4)).
Here, (.) is the quantile function. The proof of Proposition follows from the fact that for corresponding choice of T, in Algorithm TPR(s.T) = 1 (F (g)) and TPR(s',
1 - FFF (g)).
Next, a direct corollary of the above result shows that, for the special cases where both the scores for normal and abnormal data are Gaussian distributed, one can directly compute the relative scoring bias. The proof is listed in Appendix [A]
Corollary 2. Let q be a fixed target FPR. Given two scoring functions s, s, assume that s(x) (y- 0) N N(p. oo), s(x) (y 1y=11 1) ~ [Nua, Ta), s((x) (y = 0) ~ N((pa oo). s'xx) (g = 1) ~ Np d.). Then, the relative scoring bias
(000~1(0)
(d'00-1(a) 0'a +
S(s,8')=00 = x
No
Oa
Oa
0'a
where &e denotes the CDF of the standard Gaussian.
Finite sample case. In practical scenarios, when comparing the performance of two scoring functions s and s', we would only have access to finite samples from the validation set, and hence is crucial to bound the estimation error due to insufficient samples. We now establish finite sample guarantee for the estimating the relative scoring bias. Our result extends the analysis of Liu et al. (2188), where we follow the convention to assume that the anomaly data amounts to an a fraction of the mixture distribution. The validation set contains a mixture of n = no + ni i..d. samples, with no normal samples and n abnormal samples where 21
The following result shows that under mild assumptions of the continuity of the CDFs and quantile functions Far F², Fo- Fb- the sample complexity for achieving (6 < Theorem 3. Assume that Fay F2, F. 1 Fi-1 are Lipschitz continuous with Lipschitz constant lay la f,, S. respectively. Let be the fraction of abnormal data among n i.i.d. samples from the mixture distribution. Then, w.p. at least 1 8, with
8 T n
-1 10188-1111
log
(2 (2-0)
2
+ log
2
1
2
+
2)
1
1
C
the empirical relative scoring bias satisfies 3 El S.
5

---

Under review as a conference paper at ICLR 2021
Type
Semi-supervised (trained on normal data)
Supervised (trained normal some ahnormal data)
Deep SAD
Hypensphere-bused
Deep SVDD
Hypersphere Classifier (HSC)
Semi-supervised (SAE)
Reconstraction-based
Autoencoder (AE)
Autoencoding Binary Classifier (ABC)
Table 1: The anomaly detection models considered in case study. Deep SAD and HSC are the supervised versions of Deep SVDD (the semi-supervised baseline model); SAE and ABC are the supervised versions of AE (the semi-supervised baseline model).
We defer the proof of Theorem 3 to Appendix B Similarly with the open category alien detection setting as discussed in Liu et (2018). the sample complexity for estimating the relative scoring bias grows as O -ي log )). Note the analysis of our bound involves a novel two-step process which first bounds the estimation of the threshold for the given FPR, and then leverages the Lipschitz
continuity condition to derive the final bound.
4.2 CASE STUDY
We conduct case study to validate our main results above, by training anomaly detection models using a synthetic dataset (Liu et al. 2018) and three real-world datasets. We consider six anomaly detection models listed in Table I and they lead to similar results. For brevity, we show results when using Deep SVDD (Ruff et al. 2018) as the baseline model (i.e. trained on normal data only) and Deep SAD (Ruff et al. (020b) as the semi-supervised model trained on normal and some abnormal data. Later in Appendix DJ we include results other model pairs, including Deep SVDD Hypersphere Classifier (HSC) (Ruff et al. 2020a). Autoencoder (AE) Semi-supervised
Autoencoder (SAE and AE vs. ABC (Yamanaka et al. 2019).
generate synthetic dataset by sam- pling data from a mixture data distribution S. w.p. 1 a generating the normal data distribution So and w.p. a generating the abnormal data distribution Sa. Data points in Su sampled randomly from a 9-dimensional Gaussian distribution, where each dimension is independently distributed as (0, 1). Data points in S., sampled from another 9-dimensional distribution, which w.p. 0.4 have 3 dimensions (uniformly chosen at random) distributed as (116, 0.8). w.p. 0.6 have 4 dimen- sions (uniformly chosen at random) distributed as (1.6, 0.8). and have the remaining dimensions distributed as (0, 1). This ensures meaningful feature relevance, point difficulty and variation for the abnormal data distribution as discussed in Emmott et al. (015)).
Our synthetic dataset. Similar to Liu et al. 2018).
We obtain two score functions s and s' by training Deep SVDD and Deep SAD respectively on samples from the synthetic dataset (10K data from S.. IK data from S.). We configure the training, validation and test set so there is no data overlap in them. Thus the training procedure will not affect the sample complexity for estimating the relative scoring bias. To set the anomaly threshold, we fix the target FPR to be 0.05, and vary the number of normal data in the validation set from {100, IK, 10K]. We then test the score function and threshold on a fixed test dataset with a large number (20K) of normal data and x 20K of abnormal data. We vary a from (0.01, 0.05, 0.1, 0.2).
Real-world datasets. We consider three real-world datasets targeting disjoint subjects: Fashion- MNIST (Xiao al.) 2017) is collection of images of fashion objects, where choose some objects as normal and the rest as abnormal: StatLog (Srinivasan) 1993) is a collection of satellite images on various soil types; and Cellular Spectrum Misuse (Li al. 2019) is real-world anomaly dataset on cellular spectrum usage, including normal usage and those under four types of attacks. Detailed descriptions of these datasets and training configurations are listed in Appendix C Like the above, we obtain s, s', and anomaly threshold (at a target FPR of 0.05) from these datasets, and test the score function and threshold on their corresponding test datasets and different a values.
Distribution of anomaly scores. We first study the distribution of anomaly scores. Figure iis sample plot of score distributions on the test set with 0.1. We plot the scores for normal and abnormal test data separately, for both scoring functions (derived from Deep SVDD and Deep SAD models respectively). We make two key observations. First, all the distribution curves follow rough bell shape. Second and more importantly, while the abnormal score distribution closely mimics the normal score distribution under the unsupervised model, it deviates largely from the normal
'e design SAE by forcing the reconstruction emorr to be maximized for additional labeled anomalies encountered in training the autoeneoder.

---

Under review as a conference paper at ICLR 2021
score distribution after semi-supervised learning (i.e., similar mean but much higher variance). This confirms that semi-supervised learning does introduce additional bias in anomaly scores.
Exiieos 3000
nermal cata
nernet essa
EX0066
335022
093310 Anomelly Score
Ancomaly Score
Figure 1: Anomaly score distributions for Deep SVDD (left) and Deep SAD (right) trained and tested using the synthetic dataset, estimated by Kernel Density Estimation.
We also examine the anomaly score distributions for models trained on real-world anomaly detection data sets, including Fashion-MNIST and Cellular Spectrum Misuse. While the score distributions are less close to Gaussian, we do observe the same trend where normal and abnormal score distribu- tions become significantly different after applying semi-supervised learning. The results are shown in Figure 7 and 8 in Appendix [
Convergence of relative scoring bias ( and FPR. Next we examine the convergence of the empirical FPR obtained from s' (seni-supervised model) and the empirical relative scoring bias ? (computed as the difference of the empirical TPR according to Equation 3.5) obtained from s bemmi-uperrvsedd model with normal only) and s' (supervised model with biased anomaly). Here we present the convergence results in Figure 2 for the synthetic dataset in terms of the quantile distribution of & between Deep SVDD (semi-supervised) and Deep SAD (supervised) and the quan- tile distribution of Deep SAD's FPR. Results for other models and three real-world datasets are in Appendix D. and show consistent trends.
0.05
0.
0.
30000 0.0
1000
.2000
102
1000
10030
1920
10003
0
0.30
0.000
100
1850
1003
100
1030
10003
30000
13000
Figure 2: Models (Deep SVDD v.s. Deep SAD) trained on the synthetic dataset: the quantile distribution of relative scoring bias & (top 4 figures) and FPR (bottom 4 figures), computed on the test set over 1500 runs. n =100, 1000 or 10000; a =001, 0.05, 0.1, 0.2. The triangle in each boxplot is the mean. For FPR, the red dotted line marks the target FPR of 0.05.
Similar to our theoretical results, we observe a consistent trend of convergence in FPR and É as the sample complexity goes up. More specifically, for FPR, as n goes up, it converges to the prefixed value of 0.05; for Ç, it also converges to a certain level.
We also examine the rate of convergence w.r.t to n. Section 4.1 shows that n required for estimating ? grows in the same order as 1 a² log }. That is, the estimation error e decreases at the rate of Vn furthermore, as a increases, n required for estimating & decreases. This can be seen from Figure (top figure) where at n = 10000, the variation of & at a = 0.2 is 50% less than that at a = 0.01.
IMPACT OF SCORING BIAS ON ANOMALY DETECTION PERFORMANCE
We perform empirical experiments to study the end-to-end impact of relative scoring bias deep anomaly detection models. Our goal is to understand the type and severity of performance variations introduced by different anomaly training sets.
7

---

Under review as a conference paper at ICLR 2021
Experiment setup. We consider six deep anomaly detection models previously listed in Table I and three weal-world datasets: Mathion-MNIST. Statlog (Landsat Satellite) and Cellular Spectrum Misuse. For each dataset, we build normal data by choosing single class (e.g., top in Fashion- MNIST, normal 1 in Cellular Spectrum Misuse), and treat the other classes as the abnormal classes. Note that Cellular Spectrum Misuse is real-world anomaly dataset where the abnormal classes attacks against today's 's cellular networks (Li et al. 2019).
From those abnormal classes, we pick a single class as the abnormal training data, and the rest as the abnormal test data on which we test separately. Given the data, we train 0g- := (86,- Tha), a semi- supervised anomaly detector using normal training data, and 92 := (sg,. : T8, ) a supervised anomaly detector using both normal and abnormal training data (with a 10:1 normal vs. anomaly ratio). We follow the original paper of each model to implement the model and its training. For each trained model, we configure the anomaly score threshold to reach target false positive rate (FPR) of 0.05. We then test these trained models against various abnormal test classes, and record the recall (TPR) value for each abnormal test class. We repeat the above by selecting different abnormal training data. Detailed descriptions of these datasets and training configurations are listed in Appendix C
We evaluate the potential bias introduced by different abnormal training data by comparing the model recall (TPR) value of both fg and 0g against different abnormal test data. We define the bias to be upward (1) if (P)( > TPR( and downward (1) if TPR(0s) < TPR(0)).
when abnormal training data is visually similar to normal training data; (2) when abnormal training data is visually dissimilar to normal training data; and (3) when abnormal training data is a weighted combination of (1) and (2). Here we compute visual similarity as the 2 distance. The similarity results are listed in Appendix
We group our experiments into three scenarios: (1)
We observe similar trends across all three datasets and all six anomaly detection models. For brevity, summarize our observations below, and further illustrate them using examples that consider two models (Deep SVDD as 0g and Deep SAD as 0g), and two datasets (Fashion-MNIST, Cellular Spectrum Misuse). We list full results (mean/std) on all the models and datasets in Appendix B
Scenario I: Abnormal training data visually similar to normal training data. In this sce- nario, the use of abnormal data in model training (or supervised model) does improve detection of abnormal data in the training class, but also creates considerable performance changes, both upward and downward, for other classes of abnormal test data. The direction of change depends heavily on the similarity of the abnormal test data to the training abnormal data. The model performance on test data similar to the training abnormal data moves upward significantly while that on test data dissimilar to the training abnormal moves dowmward significantly.
We illustrate this observation using examples of Fashion-MNIS" and Cellular Spectrum Misuse, For Fashion- the normal and abnormal training classes are top and shirt, respectively, which are similar to each other. Figure B] a) plots the recalls of model 6y and 02 for all abnormal test classes, arranged by a decreasing similarity to the training abnormal class (shirt) )).. We see that (P.( on classes similar to shi rt (including itself) is significantly higher than TPR (fo) (e.g. increased from <0.2 to 0.9 for pull lover. But for classes dissimilar from shi rt, TPR (0,) is either similar or significantly lower (e.g., reduced from 0.9 to 0.4 for boot). For Cellular Spectrum Misuse, the normal and abnormal training classes are normal and NB- 0ms, respectively. The effect of training bias is highly visible in Figure 3 c), where TPR(0,) on NE 1 Oms and NB 5ms rises from almost zero to >93 while TPR(6.) on WB-nlos and WB-los drops by 50% or more.
Scenario 2:
Abnormal training data visually dissimilar to normal training data. Like Sce- nario 1, the use of abnormal training does improve the detection of abnormal data belonging to the training class and those similar to the training class. But different from Scenario 1, we observe very little downward changes at abnormal classes dissimilar to the training abnormal.
This is illustrated using another Fashion-MNIST example in B While the normal training class is still top, we use a new abnormal training class of sneaker that is quite dissimilar from top. We see that (PR(O.) on sneaker: sandal, boot and bag are largely elevated to 0.8 and higher, while (0,( on other classes are relatively stable (except for trouser which more than doubles). Finally, the same applies to another example of Cellular Spectrum Misuse in Figure 3 d) where the abnormal training class is WB-los. which is quite different from the normal data. In this case, observe little change to the model recall.
8

---

Under review as a conference paper at ICLR 2021
1.0
Sy SVDD
0.8
8. Duup BAD
TPR
0.8
0.9
0.4
0.4
02
0.2
0.0
6801
Pullover
drats
bag
ambakey
0.0
pallver
mad
Class Label
Class Label
(a) Pashion-MNIST Scenario I
(b) Fashion-MNIST Scenario 2
1.0
1,0
0.8
0.5
TPR
0.8
0.5
0.4
0.4
0.2
0.2
NR-
10-10mm
Nit-5mm
Vilt-iix
Wi--ixx
0.0
ViR-lox
Vill-niox
NF-1flmm
NR--mm
Class Label
Class Label
(c) Spectrum Misuse: Scenario
(d) Spectrum Misuse: Scenario
Figure 3: Model TPR under Scenario and 2, trained two real-world datasets: Fashion-MNIST and Cellular Spectrum Misuse. In each figure, we compare the performance of fu = Deep SVDD (semi-supervised) and 0,- Deep SAD (supervised) when tested on abnormal data. We arrange abnormal test data (by their class label) in decreasing similarity with training abnormal data. The leftmost entry in each figure is the class used for abnormal training. For Fashion-MNIST, the normal data is opp for Cellular Spectrum Misuse, the normal data is normal.
Scenario 3: Mixed abnormal training data. on Fashion-MNIST (normal: top; abnormal: shirt & sneaker) by varying the weights of the two abnormal classes in training (0.5/0.5, 0.9/0.1, 0.1/0.9). The detailed results for each weight configuration are listed in Appendix E Overall, the use of group training does improve the model performance. However, under all three weight configurations, we observe a consistent pattern of downward bias for an abnormal test class (trouser) and upward bias for most other abnormal classes. Note that rouser is relatively more dissimilar to both training abnormal classes.
We run three configurations of group training
Summary of observations. Our empirical study shows that biased (anomaly) training set can introduce significant impact on deep anomaly detection, especially on whether the use of labeled anomalies in training would help detect unseen anomalies. When the labeled anomalies are sim- ilar to the normal instances, the trained model will likely face large performance degradation on unseen anomalies different from the labeled anomalies, but improvement labeled anomalies. Yet when the labeled anomalies are dissimilar to the normal instances, the su- pervised model is more useful than its semi-supervised version. Such difference in model behavior is likely because different types of abnormal training data affect the training distribution (thus the scoring function) differently. In particular, when the labeled anomalies data, they lead to large changes to the scoring function and affect the detection of unseen anomalies "unevenly". Overall, our results suggest that model trainers must treat labeled anomalies with care.
those similar to the
similar to the normal
6 CONCLUSIONS AND FUTURE WORK
To the best of our knowledge, our work provides the first formal analysis on how a biased anomaly training affects deep anomaly detection. We define and formulate its impact on anomaly de- tector's recall (or TPR) as the relative scoring bias of the detector when comparing to its semi- supervised baseline trained on only normal data. We then establish the first finite sample rates for estimating the relative scoring bias for supervised anomaly detection, and empirically validate our theoretical results on both synthetic and real-world datasets. We also empirically study how such relative scoring bias translates into variance in detector performance against different unseen anoma- lies, and demonstrate scenarios in which the biased anomaly set can be useful or harmful. Our work exposes a new challenge in training deep anomaly detection models, especially when labeled abnor- mal data becomes available. An open question is how to construct an unbiased anomaly detector, when having access to the true anomaly distribution. As future work, we plan to develop new training procedures that can leverage labeled anomalies to exploit upward scoring bias while avoiding downward scoring bias.

---

Under review as a conference paper at ICLR 2021
REFERENCES
Charu C Aggarwal and Saket Sathe. Theoretical foundations and algorithms for outlier ensembles.
Acm Sigkdd Explorations Newsletter, 17(1):24-47, 2015.
Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey, ACM Comput. Surv., 41(3). July 2009.
Tal Daniel, Thanard Kurutach, and Aviv Tamar. Deep variational semi-supervised novelty detection. arXiv preprint arXiv:1911.0499) 2019.
Andrew Emmott, Shubhomoy Das, Thomas Dietterich, Alan Fern, and Weng- Keen Wong. A meta- analysis of the anomaly detection problem. arXiv preprint arXiv: 1503.00 158, 2015.
Izhak Golan and Ran El-Yaniv. Deep anomaly detection using geometric transformations. In Ad- vances Neural Information Processing Systems, pp. 9758-9769 2018.
Steve Hanneke and Samory Kpotufe. On the value of target data in transfer learning. In Advances in Neural Information Processing Systems, pp. 987 1-9811, 2019.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. Proceedings of the International Conference on Machine Learning, 2019 9a.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. Proceedings of the International Conference on Learning Representations, 2019b.
Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In Advances in Neural Information Processing Systems, pp. 15663-15674, 2019c.
Yoshinao Ishii, Satoshi Koide, and Keiichiro Hayakawa. L0-norm constrained autoencoders for unsupervised outlier detection. In Proceedings of the Pacific-Asia Conference on Knowledge Discovery and Data Mining, pp. 674-687, 2020.
Michael J Kearns, Umesh Virkumar Vazirani, and Umesh Vazirani. An introduction to computational learning theory. MIT press, 1994.
Samory Kpotufe and Guillaume Martinet. Marginal singularity, and the benefits of labels in covariate-shift. arXiv preprint arXiv:1803.01833 2018.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibratee classifiers for samples. Proceedings of the International Conference on Learning Representations, 2018
detecting
Zhijing Li, Zhujun Xiao, Bolun Wang, Ben Y. Zhao, and Haitao Zheng. Scaling deep learning models for spectrum anomaly detection. In Proceedings of the Twentieth ACM International Symposium on Mobile Ad Hoc Networking and Computing, pp. 291-300, 2019.
Kun Liu and Huadong Ma. Exploring background-bias for anomaly detection in surveillance videos. In Proceedings of the 27th ACM International Conference on Multimedia, pp. 1490-1499, 2019.
Si Liu, Risheek Garrepalli, Thomas Dietterich, Alan Fern, and Dan Hendrycks. Open category detection with PAC guarantees. In Proceedings of the 35th International Conference on Machine Learning. pp.
2018.
Massart. The tight constant the dvoretzky-kiefer-wolfooo inequality. Ann. Probab., 18(3):
1269-1283, 07 1990. doi: 10. 111211///011176697744 URL aop/1176990746
Guansong Pang, Chunhua Shen, and Anton van den Hengel. Deep anomaly detection with deviation networks. In Proceedings of the 25th ACM SIGKDD International Conference Knowledge Discovery & Data Mining, pp. 353-362, 2019.
Emanuel Parzen. Quantile functions, convergence in quantile, and extreme value distribution theory. Technical report, Texas A & M University, 1980.
10

---

Under review as a conference paper at ICLR 2021
Marco AF Pimentel, David A Clifton, Lei Clifton, and Lionel Tarassenko. A review of novelty detection. Signal Processing, 99:215-249, 2014.
Shebuti Rayana, Wen Zhong, and Leman Akoglu. Sequential ensemble learning for outlier detec- tion: A bias-variance perspective. In Proceedings of the IEEE 16th International Conference on Data Mining (ICDM), pp. 167-1117. IEEE, 2016.
Lukas Ruff, Robert A. Vandermeulen, Nico Görnitz, Lucas Deecke, Shoaib A. Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. Proceedings of the 35th International Conference on Machine Learning, volume 80, pp. 4393-4402, 2018.
Lukas Ruff, Robert A. Vandermeulen, Billy Joe Franks, Klaus- NlaurtRobert Müller, and Marius Kloft. Rethinking assumptions in deep anomaly detection. arXiv preprint arXiv:2006.00339, 2020a.
Lukas Ruff, Robert A. Vandermeulen, Nico Görmitz, Alexander Binder, Emmanuel Müllrr, Klaus- Robert Müller, and Marius Kloft. Deep semi-supervised anomaly detection. In Proc. of ICLR, 2020b.
Mayu Sakurada and Takehisa Yairi. Anomaly detection using autoencoders with nonlinear dimen- sionality reduction. In Proceedings of the 2nd Workshop on Machine Learning for Sensory Data Analysis, pp. 4-11,2014
Bernhard Schölkopf, Robert Williamson, Alex Smola, John Shawe-Taylor, and John Platt. Support vector method for novelty detection. In Proceedings of the 12th International Conference on Neural Information Processing Systems, pp. 582-588, 1999.
Md Amran Siddiqui, Alan Fern, Thomas Dietterich, and Shubhomoy Das. Finite sample com- plexity of rare pattern anomaly detection. In UAI, 2016.
Ashwin Srinivasan. StatLog (Landsat Satellite) Data Set. httpps://rrciive.ttt uci edd. ml//attasts/Statt... (Landsat 1993.
Alexander Tong, Roozbah Yousefzadeh, Guy Wolf, and Smita Krishnaswamy. Fixing bias in iiconstruction-based anomaly detection with lipschitz discriminators. arXiv preprint arXiv:1905.10710, 2019.
Leslic G Valiant. A theory of the learnable. Communications of the ACM, 27(11::13441144 1984.
Siqi Wang, Yijie Zeng, Xinwang Liu, En Zhu, Jianping Yin, Chuanfu Xu, and Marius Kloft. Ef- fective end-to-end unsupervised outlier detection via inlier priority of discriminative network. In Advances in Neural Information Processing Systems, volume 32, pp. 5962-5975, 2019a.
Zirui Wang, Zihang Dai, Barnabás Póczos, and Jaime Carbonell. Characterizing and avoiding nega- tive transfer. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 11293-11302, 2019b.
Sen Wu, Hongyang Zhang, and Christopher Ré. Understanding and improving information trans- fer in multi-task learning, arXiv preprint arXiv:2005. 2020.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: novel image dataset for bench- marking machine learning algorithms. arXiv preprint arXiv: 2017.
Yuki Yamanaka, Tomoharu Iwata, Hiroshi Takahashi, Masanori Yamada, and Sekitoshi Kanai. Au- toencoding binary classifiers for supervised anomaly detection. arXiv preprint arXiv: 10709, 2019.
Chong Zhou and Randy C. Paffenroth. Anomaly detection with robust deep autoencoders. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2017.
11

---

Under review as a conference paper at ICLR 2021
A PROOF OF COROLLARY 2
Proof of Corollary
2
Assuming the score functions are Gaussian distributed, we can denoted (o
as 1 (s(s) as
(s()) as + (f-="==) ) and Fa(s) as D a-
da
Therefore, have Do ((000~1(0) no) ( [o0)l-
(g)
Thus,
EN
FP (4)) Fa Fa (1)
(g) (g)
1o Pe
50 Φ (4)
n0 Pa
+
+
0a
0a
B PROOF OF THEOREM 3
Proof of Theorem 3
Our proof builds upon and extends the analysis framework of Liu et al. 2018
which relies on one key result from Massart (1990).
sup F(x) - F(x) > S 2cxp(-22 -2x²).
(B.1)
Here, F(x) is the empirical CDF calculated from n samples. Given a fixed threshold function. al. (2018) showed that it required
Liu
2
2 - a
log
(B.2)
26
1 /1
examples, in order guarantee (x) Fa(x)] S with probability at least - 8 (recall that denotes the fraction of abnormal data among the n samples).
Here we note that our proof relies on novel adaption of Equation B.1 which allows us to extend our analysis to the convergence of quantile functions.
To achieve this goal, we further assume the Lipschitz continuity for the CDFs/quantile functions:
(x) Fa(x') < la x z' (x) F2(2') < f,2 x z'
(B.3)
(B.4)
Fo (x) (x" s 6 x'|
(B.5)
|F (x) F (x') s l |x x'
(B.6)
Combining the above inequalities equation B.5
with equation B.I
we obtain
PP
sup F (4)
Fo
2
A
P
sup q
Fo (x) Fo (FF 2 VToko
/no
(B.7)
Let q Fo(x), then equation
B.7 becomes
Fo f (Po(o)))) Po (Fo (f(x)((
p
Vmnlo
=P
Fo (x) - fo(z)) 2 vTolo
<2c
(B.8)
12

---

Under review as a conference paper at ICLR 2021
Therefore, in order for supy Fo (q) - Fa (q) 2 c2
S ó to hold, it suffices to set
11
2 8
no n(1 a)
log
(B.9)
2 2 6
Furthermore, combining equation
equation B.2 and equation B.3
we get
Fa (Ta) S (T) + (r Ta (a 6
(B.10)
Subtitute Tn = -F (g), and T= Fo (q) in the above inequality, and set E1 = f. 62 = 48.
we get
Pa (g) Fa (F) 6/2.
(B.11)
Similary, we repeat the same procedure for 8', and can get
Fra Fo (1)) Fa F6 (1)
$ 6/22.
(B.12)
with probability at least 1- 8.
((
))) Fy
Therefore, with n 2 -/2
1-VI-3
(2-0)
log 2 1
I-a
La
+
examples
we can get -2 El S e with probability at least 6. 6.
C THREE REAL- WORLD DATASETS AND TRAINING CONFIGURATIONS
Fashion-MNIST. This dataset (iaao et al. 2017) is collection of 70K grayscale images fashion objects (a training set 60K examples and a test set 10K examples), evenly divided into 10 classes (7000 images per class). Each image is of 28 pixels in height and 28 pixels in width, and each pixel-value is an integer between O and 255. The 10 classes are denoted as top, trouser, pullover, dress, coat, sandal, shirt, sneaker, bag, boot.
To train the anomaly detection models, we pick one class as the normal training class, another class the abnormal training class, and the rest as the abnormal testing class. We use the full training set of the normal class (6K), and random 10% of the training set of the abnormal training class (600) train the deep anomaly detection models. We use the test data of the normal class (IK) to configure the anomaly scoring thresholds to meet 5% false positive rate (FPR). We then test the models on the full data of each abnormal testing class, as well as on the untrained fraction of the abnormal training class.
StatLog (Landsat Satellite). This dataset (Srinivasan (1993) is a collection of 6,435 NASA satellite images, each of 82 x 100 pixels, valued between 0 and 255. The six labeled classes are denoted as red soil, cotton crop, grey soil, damp grey soil, soil with vegetation stubble, and very damp grey soil. Unless specified otherwise, we fol- low the same procedure to train the models. The normal training data includes 80% data of the designated class, and the abnormal training data is 10% of the normal training data in size. Due to the limited amount of the data, we use the full data of the normal data to configure the anomaly scoring thresholds meet a 5% FPR. We then test the models on the full data of each abnormal testing class, as well as the untrained fraction of the abnormal training class.
Cellular Spectrum Misuse. This real-world anomaly dataset measures cellular spectrum usage under both normal scenarios and in the presence of misuses (or attacks) (Li al. 2019). We obtained the dataset from the authors Li et al. (2019). The dataset includes large (IOOK instances) of real cellular spectrum measurements in the form of spectrogram (or üime-frequency pattern of matrix, representing the signal
the received signal). Each spectrogram (instance) measured over 125 time steps and 128 frequency subcarriers. The dataset includes five classes: normal (normal usage in the absence misuse) and four misuse classes: WB-los (wideband attack w/o blockage), mlsnlos (wideband attack w/ blockage), NB-10ms (narrowband attack) and NB-5ma (narrowband attack with a different signal). The sample size is 60K for normal and 10K for each abnormal class. To train the models, we randomly sample 20K instances from no normal, 2K instances from one abnormal class, and configure the anomaly score thresholds to meet 5% FPR.
125 128
13

---

Under review as a conference paper at ICLR 2021
D ADDITIONAL EXPERIMENT RESULTS OF SECTION 4.2
Anomaly score distributions for models trained on the synthetic dataset. Figure plot the anomaly score distributions for semi-supervised (left figure) and supervised (right figure) models, trained on the synthetic dataset (a 0.1, n = 10000), estimated by Kernel Density Estimation.
8 2 x
Edtinatin PDF
aonoma cola
Estimatod PDF
aanornal casa
2003
18:0
Anomalyy Score
Anomally Score
Figure 4: Anomaly score distributions for Deep SVDD (left) and HSC (right), trained on the syn- thetic dataset.
1.2
3.09
23noma
2.00
denernd
10.55
0:93
210
Anomally
Figure 5: Anomaly score distributions for AE (left) and SAE (right), trained on the synthetic dataset.
rernel data
nornal cata
Extimatted mun
Eylimated
1.3
0.5
0.4
155
155
3.0
0.5
3.00
1.25
0.50
6.75
Anomaly Score
Anomaly Score
Figure 6: Anomaly score distributions for AE (left) and ABC (riiht) on the synthetic dataset.
Anomaly score distributions for models trained on real-world datasets. Figure and plot the anomaly score distributions for semi-supervised and supervised models, when trained on Fashion- MNIST and Cellular Spectrum Misuse, respectively.
nemeal
Eeiimated NOF
0.35
000000
5,0000
0:3
30
100)
Anummaly
Anomaly
Figure 7: Anomaly score distributions for Deep SVDD (left) and Deep SAD (right), trained on Fashion-MNIST (using top as the normal class and shi rt as the abnormal class).
Extenabidt PGF
Estemated
38030
0,3000
0.001
0,0000
0,0000
00200
0.0055
100
Aromey
Anomely
Figure 8: Anomaly score distributions for Deep SVDD (left) and Deep SAD (right), trained on Cellular Spectrum Misuse (using normal as the normal class and NB- Oms as the abnormal class).
14

---

Under review as a conference paper at ICLR 2021
Convergence of relative scoring bias { and FRP on the synthetic dataset. We plot in Figure 9 11 the additional results on (Deep SVDD vs. HSC), (AE vs. SAB), and (AE vs. ABC). Experiment settings are described in Section 4.2 Overall, they show consistent trend convergence.
0.1
10
0.8
0.2
0.0
130
10000
0.15
0.30
0.05
0.00
10000
1.000
Figure 9: (bottom) FPR, computed on the test set over 1500 runs, for Deep SVDD and HSC.
The quantile distribution on the synthetic dataset of (top) relative scoring bias é and
a 0.01
IX 0.05
a 0.1
a = 0.2
1.0
0.8
0.6
0.4
1000
10000
1000
13000
100
1000
10000
100
1000
10000
0
A
0.15
0.10
10000
1000
10000
Figure 10: The quantile distribution of (top) relative scoring bias & and (bottom) FPR, computed on the test set over 1500 runs, for AE and SAE trained on the synthetic dataset.
0.01
0.05
0.1
0.8
0.6-
0.6
0.2
0.0
10000
1000
19000
100
1000
1000
0.05
0.00
100
1000
10000
300
1000
13000
100
1000
10000
150
1002
10000
Figure 11: The quantile distribution of (top) relative scoring bias É and (bottom) FPR, computed on the test set over 1500 runs, for AE and ABC trained on the synthetic dataset.
15

---

Under review as a conference paper at ICLR 2021
Convergence of relative scoring bias and FRP Cellular Spectrum Misuse. We plot in Figure 12 13 the additional results of (Deep SVDD vs. Deep SAD), (Deep SVDD vs. HSC), (AE SAE), and (AE vs. ABC), when trained on the Cellular Spectrum Misuse dataset. Here we set the normal class as normal and the abnormal class as NB-1 Oms, and configure the sample size for the training set 16K and for the test
6K, and vary the sample size for the validation from 100, 200, 500, IK, 2K, 5K. Overall, the plots show a consistent trend on convergence.
0.05
0.2
a 0.2
100
0.94
0.42
300
1000
2000
3000
130
200
300
1000
2000
2000
300
200
500
1009
2000
5000
7
130
200
500
1000
2000
5000
100
200
500
1000
2000
5000
100
200
500
1000
2000
5000
Figure 12: The quantile distribution of relative scoring bias & (top) and FPR (bottom), computed on the test set over 1000 runs, for Deep SVDD and Deep SAD trained on Cellular Spectrum Misuse.
10
0.05
a
0.2
D.8
0.6
200
1000
2000
5000
100
26m
500
1000
2006
0.20
0.15
0.10
100
200
5.0
1000
2000
5000
100
200
500
1000
2000
5000
300
260
500
1000
2000
5000
Figure 13: The quantile distribution of (top) relative scoring bias & and (bottom) FPR, computed on test set over 1000 runs, for Deep SVDD and HSC trained on Cellular Spectrum Misuse.
1.00
0.05
0.1
C 0.2
0.58
0.56
200
300
0.20
0.00
Figure 14: The quantile distribution of (top) relative scoring bias É and (bottom) FPR, computed on the test set over 1000 runs, for AE and SAE trained on Cellular Spectrum Misuse.
16

---

Under review as a conference paper at ICLR 2021
0.50
100
200
500
1000
7000
5000
100
200
505
1000
7006
5000
100
200
500
1200
2000
5000
0.20
0.15
Figure 15: The quantile distribution of (top) relative scoring bias & and (bottom) FPR, computed on the test set over 1000 runs, for AE and ABC trained on Cellular Spectrum Misuse.
Convergence of relative scoring bias & and FRP on FaSHionMNIST. Figure 16 the conver- gence of & and FRP on Deep SVDD vs. Deep SAD models trained on FashionMNIST. The results other model combinations are consistent and thus omitted. Here we the normal class oo and the abnormal class as shirt, and configure the sample size for the training set as 3K and for the test set as 2K, and vary the sample size for the validation set from 100, 200, 500, 1K. Overall, the plots show consistent trend on convergence.
0.05
0.8-
06-
0.0
1000
503
0.20
0.15
0.10
Figure 16: The quantile distribution of (top) relative scoring bias & and (bottom) FPR, computed on the test 100 runs, for Deep SVDD and SAD trained Fashion-MNIST.
17

---

Under review as a conference paper at ICLR 2021
Convergence of relative scoring bias { and FRP StatLog. Figure 17 plots & and FRP of Deep SVDD vs. Deep SAD trained on the StatLog dataset. The results for other model combinations consistent and thus omitted. To maintain reasonable sample size, we set the normal class to be a combination of grey soil, damp grey soil and very damp grey soil, and the abnormal class to be combination of red soil and cotton crop. The sample size for the training is 1.2K and the test set is IK. We vary the sample size for the validation set from 100, 200, 500, 1K. Overall, the plots show a consistent trend on convergence.
0.05
0.8-
0.-
0.2
0.0
0.20
0.15
0.10
0.05
Figure 17: The quantile distribution of (top) relative scoring bias é and (bottom) FPR, computed on the test over 100 runs, for Deep SVDD and SAD trained on StatLog.
18

---

Under review as a conference paper at ICLR 2021
E ADDITIONAL RESULTS OF SECTION 5
Here the training normal set is visually similar to the training abnormal set. We include the detailed recall result (mean/std over 100 runs) of all six models, and three real-life datasets in Table 2-4 Across the six models, the two semi-supervised models (trained on normal data) are Deep SVDD and AE; and the rest are supervised models trained on both normal data and the specified abnormal training data.
Scenario 1.
In each table, we report the model recall on all abnormal test classes. These abnormal test classes are sorted by decreasing similarity to the abnormal training class (measured by L2, small value visually similar). Also, 1 indicates that the supervised model has a higher recall than the semi- supervised model; + indicates the other direction. Overall we observe both upward and downward bias across the test abnormal classes, and the direction depends on the test abnormal class' similarity to the train abnormal class.
We also observe that when using the reconstruction based models (AE, SAE, ABC), the performance for StatLog is much worse than the hypersphere based models. This result is in fact consistent with what has been reported in the literature Ishii et al. (2020) reports a similar low performance of reconstruction based model on StatLog, which was trained normal data (cf Table 4 of Ishi et al. (2220). We consider this as a result potentially arising from specific latent spaces of data on the reconstruction based models, and leave improvement of these reconstruction models to future work.
is worth highlighting that although these reconstruction based models demonstrate inferior perfor- mance StatLog when training only normal data, adding training abnormal set under Scenario does demonstrate a similar behavior to that of the hypersphere based models. When training the SAE model with (biased) anomaly data, we handle the exploding loss issue in similar way as Ruff et al. (2020b): For the anomaly class, we consider a loss function which takes the form of We found that this design of loss function easily converges in practice with few loss explosion issues on reconstruction based models.
reconerrictoon error*
training normal top, training abnormal shirt
Test data
Deep SVDD
Deep SAD
HSC
AE
SAE
ABC
1 to shirt
shi rt
0.09- + 0.01
0.71 + 0.01
0.70 + 0.01
0.12 + 0.01
0.72 - 0.01 f 0.72 + 0.01 f
0
pullovez
0.13 : 0.02
0.90 1 0.01
0.89 1 0.01
0.19 1 0.02
0.84 = 0.02 [ 0,85 1 0.01 1
0.01
coat
0.14 a 0.03
0.92 + 0.02
0.92 4 0.01
0.15 +: 0.02
0.92
0.02 f 0.92 # 0.01 f
0.01
dress
0,17 + 0.03
0.24 + 0.03 1
0.24 + 0.03
0.11 + 0.01
0.20 = 0.03 f 0.21 + 0.03 f
0.04
bag
0.49 0.07
0.38
0.36
0.70
J.
J
0.04
truser
0.32 + 0.10
0.07 + 0.04
0.06 +.03
0.59 + 0.04
0.07 0.04 J
0.16 + 0.07 J
0.06
boot
0.92 = 0.03
0,29 0.15
0.27 0.16
0.98 + 0.02
0.90 0.09 1
0.90 - 0.08
0.08
sanda:
0.30 : 0.04
0,26
: 0.08
0.26 1 0.12
0.82 1 0.02
0.46 = 0.10
0.56 = 0.09
0.09
sneaker
0.55 = 0.09
0.12 0.10
0.14 0.12
0.74 + 0.09
0.47 = 0.19 1
0.46 = 0.18 L
0.10
Table 2: The model TPR under scenario 1, Fashion-MNIST. The normal class top is similar to the
abnormal training class shirt. Their 2 distance 0.02.
training normal very damp grey soil, training abnormal damp grey soll
Test data
Deep SVDD
SAD
SAD
USC
AE
SAE
ABC
L' damp groy soll
damp grey s0l1
0.12 0.05
0.02
000 0.00
0.02
red s011
0.67 = 0.16
0.92 1 0.08
0.1 1 0.08
0.00 4 0.00
0.00 2 0.00
0.00 4 0.00
4,39
grey soil
0.45 + 0.17
092 0
0.9 + 0.02
001 + 0.00
D04 + 0.22
BAZ + 0.02
4.42
vegetable soil
0.10 0.10
0.04
0.18
0.35
0.00
cotton crop
0.96 4: 0.06
0.80 4 0.06
0.70 4 0.08
0.89 4 0.02
0.90 à 0.01
0.90 4: 0.01
11.46
Table 3: The model TPR under scenario 1, StatLog, The normal class very damp grey soil is similar to the abnormal training class damp grey soil. Their 2 distance = 3.63.
training normal norma
training abnormal = NB-10me
Test data
Deep SVDD
Deep SAD
HSC
AE
SAE
ABC
L to NB 10ms
N5-10ms
0.03 1 0.01
0.99 1 0.02
0.99 0.01
0.02 1 0.01
0.00
092 0.03
0
N3 5ms
0.02 0.00
0.93 = 0.05
0.2 = 0.07
0.00
0.00
0.96
0.02
009000001
6,22
KB-nlos
0.99 0.00
0.38
: 0.08
0.43 1 0.10
0.89
= 0.03
0.54
1 0.02
0.47 0.02
32.40
W3-1cs
0.99 0.00
0.50 1 0.10
0.53 1 0.15
0.92 1 0.03
0.51 0.07
0.50 0.03 1
43.01
Table 4: The model TPR under scenario 1, Cellular Spectrum Misuse. The normal class is similar to the abnormal training class NB-1 1 Oms, and the L distance between the two is 6.17.
19

---

Under review as a conference paper at ICLR 2021
Scenario 2.
We consider scenario 2 where the training normal set is visually dissimilar to the training abnormal set. The detailed TPR result all six models, and three real-life datasets are in Table - 7 Like the above, in each table, the abnormal test classes sorted by decreasing similarity to the abnormal training class. Like the above, 1 indicates that the supervised model has higher recall than the semi-supervised model; + indicates the other direction.
Different from Scenario 1, here we observe mostly upward changes. Again we observe poorer performance of AE, SAE, ABC StatLog compared to the hypersphere-basee models.
training normal = top, training abnormal sneaker
Test data
Deep SVDD
Deep SAD
HSC
AE
SAE
ABC
L to sneaker
sneaker
= 0.09
100 + 0.00
= 0.00
0.74 = 0.09
1.00 = 0.00
sandal
0.30 + 0.04
0.99 + 0.01
09% + 0.02
0.2 0.22+0.22
1.00 + 0.00
1.00
0.02
bout
0,92 + 0.03
1.00 +: 1.00 f
0.97 0.02 7
0.98 0.02
1.00 0.00
1.00 T
0.07
bag
0.49 + 0.07
0.80 0.05
0.11
0.70
0.03 f
0.82 0.03 1
0.07
shirt
0.09 +
0.11
0.12
0.12
0.13+0001
0.15
0.10
trouser
0,32 = 0.09
0.31 0.10
0.11
0.04
0.58 0.03
0.58 0.05
0.12
dress
0.16
0.04
0.11
pullaver
0.13 0.02
0.13 0.03
0.14 = 0.05
0.19 0.02
0.21 + 0.03
0.19 0.02
0.13
coat
0,14 = 0.03
0.13 0.03
0.13 = 0.06
0,15 = 0.02
0.16 + 0.02
0.15 = 0.02
0.14
Table 5: The model TPR under scenario 2, Fashion-MNIST. The normal class top is dissimilar to the abnormal training class sneaker, and the I.2 distance between the two is 0.13.
training normal
very damp grey
soil, training abnormal red soil
Test data
Deep SVDD
Deep SAD
HSC
AE
SAE
ABC
L to red soil
0.69 0.12
1.00 0:00
1.00
0.00 0.00
0.01
0.20 0.00
dazp grey soil
0.12 = 0.05
0.5 0.04
0.22 0.02
0.00 0.00
0.00
0.00 0.00
4.39
grey soil
0.43 0.16
0.68 0.12
0.59
0.01
0.00
5.48
vegetable soil
0.40 0.10
0.76 + 0.07
0.76+
1
0.35 + 0.00
0.42 2: 0.02
0.42 + 0.02 1
6.63
cotton grop
0.96 0.06
1.00 0.001
1.00 4 0.00
0.89 0.00
0.93 0.01
0.93 1 0.01
8.97
Table 6: The model TPR under scenario 2, StatLog. The normal class very damp grey soil 1
dissimilar to the abnormal training class red soil, and the 2 distance between the two is 8.48.
training normal normal, training abnormal = WB -los
Test data
Deep SVDD
Deep SAD
HSC
AI
SAF
ABC
I.¹
WH-los
0.99 +: 0.00
1.00 0.01
1.00 + 0.01
0.92 0.03
0.95 0.04
1.00 + 0.02
WB WB-nlos
0.99 4 0.00
1.00 = 0.01
1.00 = 0.00
0.89 1 0.03
0.94
0.03
0.96 4 0.02
14.39
NB-1 0ms
0.03 + 0.01
0.06 0.01 f
0.05 + 0.02
0.02 + 0.01
0.03
0.00 1
0.04
+ 0.01
43.01
0.00
0.03 0.01
0.02 0.00
0.00 0.00
0.02 + 0.00
0.02 : 0.01
44.37
Table The model TPR under scenario Cellular Spectrum Misuse, The normal class is dissimilar to the abnormal training class WB- WB-los, and the 2 distance between the two is 43.84.
20

---

Under review as a conference paper at ICLR 2021
Scenario 3. We run three configurations of grouped abnormal training on Fashion-MNis (train- ing normal: top; training abnormal: shirt & sneaker) by varying the weights of the two abnormal classes in training (0.5/0.5, 0.9/0.1, 0.1/0.9). Again f indicates that the supervised model has a higher recall than the semi-supervised model; + indicates the other direction. Under these settings, we observe downward bias (4) for abnormal test class trouser and upward bias for most other classes.
training normal = top, training abnormal = 50% shi and 50% sneaker
data
Deep
Deep SAD
HSC
SAE
L L'istttt
sneaker
shiF:
0.09 0.01
0:69 0:00
0.89 = 0.02
0.02
0.67 2000
0.66 0.01
U
0.30
aneaker
0.55
0.00
1,00
0.74
114++060 0.09
+.000
1,00 +0000
0.10
pul lovev
0.13 = 0.02
0.50 = 0.01
0.00 = 0.01
0.19 4 0.02
0.82 + 0.0
7
0.83 0.02
0.01
0.13
Loal
0.14 = 0.03
0.91 0.02
0,90 + 0.01
0.15 + 0.02
0.86 + 0.02 T
0.87 +.02
0.01
0.14
dresa
0.17
0.34
0.18
bag
0.49 = 0.07
0.63 0.06 T
0.62 = 0.07
0.70 2.00
0.76 0:05
1
0.78 2 0.03
0.04
0.07
0.32 0.10
0.05 0.04
0.04 0.02
0.59 0.04
0.22 0.08
0.34 0,06
0.06
0.12
boot
0.92 = 0.03
0.95 = 0.03
0,95 = 0.03
0.98 + 0.02
1.00 0.00
1,00 0.00
0.08
0.07
sandal
0.30 1: 0.04
0.92 1 0.04
0,92 1 0.04
0.82 1 0.02
0.96 & 0.01
0.97 1 0.01
0.09
0.02
Table 8: The model TPR under configuration of weighted mixture training on Fashion-MNIST
training normal = top, training abnormal 90% shi rt and 10% aneaker
Test data
Deep SVDD
Deep SAD
HSC
AE
SAE
ABC
I. shirt
1 to aneaker
shirt
0.09 0.00
0.70 0:01 1
0.70 1 0.0]
0.12 0.01
0.72 0.00 1
0.71
0.01
0.30
aneaker
0.55 + 0.09
1,00 0.00
1,00 + 0.00
0.74 + 0.09
1,00 + +0000
1.00
0.00
0.10
0
pullover
0.13
0.90
0.89
0.19
coat
0.14 = 0.03
0.91 0.02
0.91 = 0.02
0.15 0.02
0.91 1 0.02
1
0.90 1 0.02
0.01
0.14
dresa
0.17 0.03
0.23 :: 0.03
0,24 0.03
0:00
0.19 0.03
0,20 1 0,03
0.04
0.13
bag
0.49 1 0.07
0.56 0.08
0.57 0.07
0.70 0.03
0.67
1: 0.06
0.68 0.05
0.04
0.07
crouser
0.32 + 0.10
0.06 :: 0.04 J.
0.06 :: 0,03
0.59 4 0.04
0.10
:: 0.06 4
0.20 0.08
0.06
0.12
boot
0,92
0,87 0.08
0,88 0.05
0.99 0.00
0.07
sandal
0.30 + 0.04
0.84 0.06 1
0.83 + 0.05
0.82 + 0.02
0.90 0.02 1
0.94 0.02
0.09
0.02
Table 9: The model TPR under configuration of weighted mixture training on Fashion-MNIST
training normal top, training abnormal 10% shi rt and 90% sneaker
Test data
Deep SVDD
Deep SAD
USC
AE
SAE
ABC
L? to shict
L sneaker
shire
0.N
0.61 0.02
0.60
03.01
0.02
0.54
snesket
0.55 = 0.09
1.00 0:00
7
1.00 = 0.00 7
0.74 :: 0.09
1.00
0.00 1
1.00 2 0.00
0.10
0
pct lover
0,13 0.02
0,85 0.02
0.84 + 0.02
0.19 0.19-:0.02
0.74 +00.3
0.74 0.03
0.01
0.13
coat
0.14 0.03
0.79 1 0.03
0.77 0.03
0.15 1
0.67 0.04 1
0.68 0.003
0.01
0.14
dress
0.17 + 0.03
0.13+00:1
0,11 + 0,03 |
0.11 0:01
0.12+00.01
0.11 0.01
0.04
0.13
bag
0.49 0:07
0.85 0.00
0.86
0.07
Crouser
0.32 + 0.10
0.10 =
0.05 = 0.05
0.59 : 0.04
0.45
:: 0.07 ]
0.50 0.05
0.06
0.12
boot
0.92 0.03
1.00 0.00
0,99 0.01
0.98 1 0.02
0.98
0.00
1,00 0,00
0.08
0.07
sandal
0.30
0.01
0,83
0.02
0.00
0.99 0.00
Table 10: The model TPR under configuration 3 of weighted mixture training Fashion-MNIST
21


Reviews:
[{"review_id": "hB9ddk2zcXB", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "======================\nAdditional reviews\n======================\nThe authors have resolved some concerns, especially the explanation/justification of the experimental results in section 5.\nAs I have commented in the initial review, this paper provides suggestive experimental results (the effects of training anomaly dataset) for future anomaly detection research.\nTherefore, I have decided to raise my rating from 5 to 6.\n======================\n\nSummary:\n- This paper investigates the effects of biased training anomaly datasets on anomaly detection problems.\nSpecifically, this paper proposes the relative scoring bias, which is the difference of TPRs of two anomaly detectors when the FPR is below a certain value, to model the effects of a biased training anomaly dataset.\nIn addition, this paper also presents the finite sample rates for estimating the relative scoring bias.\nThis paper empirically analyzes the effect of a biased training anomaly dataset on the detection performance.\n\nPros:\n- Investigating the effect of training anomaly datasets on anomaly detection is important and useful in anomaly detection studies.\n- This paper establishes the finite sample rates for estimating the relative scoring bias for semi-supervised anomaly detection.\n- Empirical evaluation results (especially, the results in Section 5) are interesting.\n\nCons:\n- Evaluation for the convergence of the relative scoring bias/FPRs was not conducted with the real-world datasets.\n\nDetailed comments and questions:\n- As the paper mentioned, semi-supervised anomaly detection, which uses labeled anomaly data as well as normal/unlabeled data for training, has become a promising approach to improve the performance of anomaly detectors. \nSince all types of anomaly data are difficult to collect due to the rarity of anomalies, it is typical to use biased anomaly datasets for learning the semi-supervised anomaly detectors. \nTherefore, analyzing how/when the biased training anomaly dataset affects performance is important/useful in this research area. \n\n- Although the results in Section 5 are really interesting/useful, can the authors explain why the phenomenon of results 5 occurs? That is, why performance on test data dissimilar to the training anomaly data (do not) becomes worse when anomaly and normal training data are similar (dissimilar)?  \n\n- The paper only evaluated the convergence of the relative scoring bias/FPRs on the simple synthetic dataset. Can the authors investigate it using the real-world datasets to empirically validate the Theorem 3?\n\n- Figure 2 is a bit difficult to see. In particular, it is difficult to compare the variation of $\\xi$ at $\\alpha=0.2$ between $\\alpha=0.01$ when $n=10000$.\n\nReasons for Score:\n- To validate the theoretical results empirically, I would like to see the experimental results about the convergence of the relative scoring bias/FPRs with real-world datasets.\nAlthough my current rating is 5, I would like to raise my score when the above questions are resolved.\nSince I'm not familiar with the PAC framework, I cannot judge the novelty of theoretical results (Theorem 3) well. Therefore, my confidence is 2.\n\nMinor commetns:\n- There are some typos:\n - p4. Algorithm 1: FPR (recall) -> TPR (recall)\n - below Eq. (3.5) in p4. $s(x_j) \\leq \\tau $ ->  $s(x_j) \\geq \\tau $\n - p8. Fashion-MNISST -> Fashion-MNIST\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "e6ZKkHPOKHV", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "#### Problem Statement\n\nThis paper considers the effect of bias in anomaly detection. The anomaly detection setup is this: A model is trained on a $1- \\alpha, \\alpha$ mixture of normal and anomalous examples . The model returns an anomaly score $s(x)$ for each point $x$. We then chose a threshold $\\tau$ which ensures a bound on the false  positive rate, while maximizing the number of true anomalies that are labelled $1$. \n\nThere are two different sources of bias that the paper considers:\n\n1. Bias coming from not having sufficient samples. Here the paper proves theoretical results quantifying the convergence in terms of the quantile functions and experiments confirming these bounds.\n\n2. Bias from the data, where the set of anomalies available at training is not representative of the test distribution of anomalies. This is more of a domain adaptation problem. Here they present experimental results showing that the behavior of algorithms can in some settings be worse than if there were no anomalies at all.\n\n\n ### Pros\n\n1. The paper is easy to read and scholarly. The definitions are precise, the literature survey is thorough. The process of choosing a scoring threshold that they describe is folklore, but it is nice that they formalize it and prove guarantees about it. \n\n2. The experiments related to bias in scoring resulting from bias in the training data are interesting. They have a class of normal points(\"Tops\" in FashionMNIST), and experiment with different choices of anomalies, those are are visually  similar (eg. shirts) and those that are dissimilar (eg. shoes). They find that having only \"similar\" anomalies while training can detract from the ability  to find \"dissimilar\" anomalies at test, while improving on the ability to find \"similar\" anomalies. But having \"dissimilar\" anomalies even at training does not seem to affect other classes adversely.\n\n### Cons\n\n\n1. The sample complexity bounds are what you would expect given known bounds on the convergence rate of empirical quantiles to the true quantiles. \n\n2. In the experiments, I found the setup to be a little artificial. In particular, in the \"similar\" setting, when the model is only given \"tops\" as normal and \"shirts\" as abnormal, it is not too surprising that the model is good at distinguishing \"top\"-like things,  but not so good as distinguishing boots from tops. This is an extreme case of data bias where you only have several distinct kids of anomalies but only one kind is available for training.  A more convincing experiment might be to use different mixture weights for the anomaly groups (like boots, shirts, dresses) at train and test time. It would also be nice to use more \"real-world\" datasets, say from the [ODDS dataset.](http://odds.cs.stonybrook.edu/)\n\n3. The terminology of unsupervised and semi-supervised that this paper uses is not standard (although this lakc of standardization might be the fault of the area in general, rather than this paper in particular). The [survey by Chandola and Banerjee](http://cucis.ece.northwestern.edu/projects/DMS/publications/AnomalyDetection.pdf) uses semi-supervised for what this paper calls unsupervised (where we only have normal examples at training time). Unsupervised there refers to the setting where one has no labels at all. This class would not a have a name under this paper's current taxonomy. Given that the survey has over 8000 citations by now, I strongly suggest the authors adopt that terminology. \n\n\n### Summary \n\nAs I see it, the paper has two distinct contributions: studying the biasing effect of limited samples and skewed data.  While I liked both aspects of the paper, I can't say either by itself is a particularly strong or surprising result. But they fit well together, and bring rigor to an area which could use more of it. I lean towards accepting the paper. \n", "extra_scores": {}, "extra_text": {}}, {"review_id": "5Ltv7Oj3GSa", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\n**UPDATE**\n\nI acknowledge that I have read the author responses as well as the other reviews. I appreciate the clarifications and improvements made during the rebuttal phase, which I think have further strengthened this work.\n\nI find the key contributions of this work to be (i) demonstrating that recent methods that include labeled anomalies into training can suffer from unfavorable biases, and (ii) providing a framework for a theoretical analysis of this setting.\n\nThough I see that the presented results are somewhat what one would expect, to my knowledge such an analysis hasn't been carried out in the existing literature.\n\nSince weak forms of supervision (here few labeled anomalies) appears to be a promising research direction for anomaly detection, I find this critical and rigorous analysis to be worth circulating the community.\n\nFor these reasons, I would keep my recommendation to accept this work (score: 7)\n\n#####\n\n\n**Summary**\n\nThis paper studies biases in semi-supervised anomaly detection which is the setting where in addition to mostly nominal data a few labeled anomalies are also available for training. A theoretical framework for the semi-supervised setting is introduced that is based on binary classification which formulates the objective of a scorer as seeking to maximize the detection recall (true positive rate (TPR)) at a given target false positive rate (FPR). Using this framework, a relative scoring bias is derived that enables to assess the relative performance difference between unsupervised and semi-supervised detectors. Furthermore, finite sample rates are derived for this relative scoring bias, which subsequently are also validated empirically via synthetic simulations. Finally, an empirical evaluation that includes six recent state-of-the-art deep anomaly detection methods (Deep SVDD, Deep SAD, HSC, AE, SAE, and ABC) is presented on Fashion-MNIST, Statlog (Landsat Satellite), and ImageNet that demonstrates and highlights scenarios where the bias of a labeled (unrepresentative) anomaly set can be useful, but also harmful for anomaly detection performance.\n\n\n**Pros**\n+ The paper presents a novel theoretical PAC framework for analyzing and understanding bias in semi-supervised anomaly detection. The framework extends a previous classification-based view on anomaly detection [4] to the semi-supervised setting.\n+ Deep semi-supervised anomaly detection methods [2, 5, 7] that aim to include and learn from labeled anomalies is a timely topic of high practical relevance.\n+ The experimental evaluation demonstrates that including labeled anomalies might introduce an unfavorable bias that can decrease detection performance, which is an important insight.\n+ The paper has a clear structure and is easy to follow.\n\n**Cons**\n- Some related work is missing, especially previous classification-based views on anomaly detection [8].\n- There are some questions left open (see below).\n- The current manuscript includes some (minor) typos that should be fixed.\n\n\n**Recommendation**\n\nI recommend to accept this paper.\n\nThe paper presents a well-motivated and useful theoretical framework for the timely and relevant semi-supervised anomaly detection setting. The arguments and derivations are technically correct. To my knowledge, this is also the first instance of a finite sample complexity bound on the scoring bias for this setting. The theoretical claims are validated through simulations and tested on real-world datasets in a scientifically rigorous manner. An important message of the analysis is that including labeled anomalies can introduce a bias that can be harmful for anomaly detection performance. In this regard, I think the paper also covers important ground for future analysis and towards building semi-supervised models that are unbiased.\n\n\n**Questions**\n\n(1) How does the presented view compare to well-known previous classification-based views [8]?\n\n(2) ‘for $\\xi$, it also converges to a certain level.’ Specifically the level predicted by the bound of Theorem 3? \n\n(3) How did you stabilize maximizing the reconstruction error for labeled anomalies in SAE? I suspect optimizing this objective is \nunstable and prone to blow up.\n\n(4) Scenario 2 would make a compelling case for using Outlier Exposure [1]. Did you conduct such experiments similar to [6]?\n\n(5) At the end of Section 3, the empirical TPR estimate should have $s(x_j) > \\tau$ in the indicator function, correct?\n\n(6) In the infinite sample case in Section 4.1, do you refer to the Glivenko–Cantelli theorem when citing Parzen (1980)?\n\n\n**Additional feedback and ideas for improvement**\n- Include Outlier Exposure [1] in the experimental analysis.\n- There exists further recent related work on biases in anomaly detection that observes that detectors may correctly detect anomalies, but based on wrong (spurious) features [3]. This should be added to the list of works studying biases in anomaly detection.\n\n\n**Minor Comments**\n1. The last paragraph in the Introduction, in which the contributions are listed, is a bit repetitive after the preceding paragraphs.\n2. In Section 4.1, $F_0(t)$ and $F_a(t)$ should have $s(x) \\leq t$ in their definition to be consistent, right?\n3. The notation for the number of anomalous training samples mixes $m$ and $n_1$.\n4. Proposition 1: ‘[...], the relative scoring bias *is* [...]’\n5. In Section 4.1, after Proposition 1, the $\\text{TPR}(s', \\tau')$ function is missing parentheses.\n6. Corollary 2: ‘Let $q$ be a fixed target FPR. [...] Then, the relative scoring bias is [...]’\n7. Note that $\\Phi$ denotes the cdf of the standard Gaussian.\n8. Finite sample case: ‘[...], where we follow the convention to assume *that the anomaly data* amounts to [...]’\n9. Theorem 3: The ‘-’ in the cdf superscripts should be ‘-1’. 10. There are spaces missing after ‘i.i.d.’ in the text.\n\n\n#####\n\n**References**\n\n[1] D. Hendrycks, M. Mazeika, and T. G. Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019.\n\n[2] D. Hendrycks, M. Mazeika, S. Kadavath, and D. Song. Using self-supervised learning can improve model robustness and uncertainty. In NeurIPS, pages 15637–15648, 2019.\n\n[3] J. Kauffmann, L. Ruff, G. Montavon, and K.-R. Müller. The Clever Hans effect in anomaly detection. arXiv preprint arXiv:2006.10609, 2020.\n\n[4] S. Liu, R. Garrepalli, T. Dietterich, A. Fern, and D. Hendrycks. Open category detection with PAC guarantees. In ICML, volume 80, pages 3169–3178, 2018.\n\n[5] G. Pang, C. Shen, and A. van den Hengel. Deep anomaly detection with deviation networks. In KDD, pages 353–362, 2019.\n\n[6] L. Ruff, R. A. Vandermeulen, B. J. Franks, K.-R. Müller, and M. Kloft. Rethinking assumptions in deep anomaly detection. arXiv preprint arXiv:2006.00339, 2020.\n\n[7] L. Ruff, R. A. Vandermeulen, N. Görnitz, A. Binder, E. Müller, K.-R. Müller, and M. Kloft. Deep semi-supervised anomaly detection. In ICLR, 2020.\n\n[8] I. Steinwart, D. Hush, and C. Scovel. A classification framework for anomaly detection. Journal of Machine Learning Research, 6(Feb):211–232, 2005.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "4qeVoQH5GUv", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies the potential bias in deep semi-supervised anomaly detection. The bias is evaluated in terms of TPR rate given a fixed FPR rate. It uses the anomaly scores output by unsupervised anomaly detectors as a benchmark to examine the relative scoring bias in deep semi-supervised anomaly detectors. It further studies the finite sample rate for this type of scoring bias. This type of bias is verified using some synthetic and real-world datasets. The empirical results also show the potential impact of this bias on several anomaly detectors.\n\nOverall, the paper is well written and studies an important problem in anomaly detection. A number of theoretical and empirical results are presented to justify the arguments.\n\nHowever, there are some major issues. Particularly, the three claimed contributions are weak and/or built upon some inappropriate foundations. The first contribution is something partially or fully demonstrated in several exiting work  (Pang et al. (2019); Daniel et al. (2019); Yamanaka et al. (2019); Ruff et al. (2020b;a)). It is a quite straightforward phenomenon. Using the labeled anomaly data to train and validate the trained model of course results in some sort of inductive bias. This is a fundamental assumption in supervised learning like classification. In anomaly detection, such bias is often desired in the sense that we want our detectors to identify anomalies similar to those labeled anomaly data. By contrast, there can be novel types of anomalies that can be very different from the known anomalies. Those novel anomalies cannot be detected if fitting only to the known anomalies. Therefore, this conclusion is straightforward. Further, as anomaly detection has this type of crucial difference compared to classification, the idea of maximizing the TPR rate given a fixed FPR rate using a small labeled anomaly data, or the formulation of semi-supervised anomaly detection as a general supervised learning problem,  is ill-posed. This lets me doubt the importance of this work.\n\nI also have major concerns over the definition of relative scoring bias. Why is it reasonable to use a unsupervised anomaly detector to serve as an approximator of the optimal anomaly detector? It does not make much sense to me. However, this is the fundamental assumption of the whole work. \n\nSome other issues. (1) The title is also inappropriate. It should explicitly limit the scope to deep anomaly detection. This is what this work is about. (2) There are inconsistent  results in terms of the trending in tables 2-4 and tables 5-7, such as Deep SAD. Why would this happen? Also, the performance of each detector on individual datasets varies significantly. This should also be a key factor to be carefully considered before drawing any conclusions. Additionally, what is the standard deviation of these results? if it is large, we may also need to consider the contribution of this factor in the 'bias'.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper studies the effect of anomaly detection using supervised learning with non-representative abnormal examples on the TPR of the anomaly detection model. Experiments demonstrate that when the abnormal examples presented in the training set are not representative of the abnormal examples in the target distribution, this can lead to bias in estimating the TPR. 

Pros: 
- This paper considers an important issue of tuning anomaly detection models in the absence of representative anomalies.
- The paper is well written and easy to read.
Cons:
- The analysis and experiments provided in the paper are not surprising, and repeat, although perhaps in more detail, known effects of learning with a non-representative training sample. 
Decision: Reject