Explainable Deep One-Class Classification
Authors: Philipp Liznerski
Lukas Ruff
Robert A. Vandermeulen
Billy Joe Franks
Marius Kloft
Klaus Robert Muller
Venue: ICLR 2021 Poster (2021)
Keywords: anomaly-detection
deep-learning
explanations
interpretability
xai
one-class-classification
deep-anomaly-detection
novelty-detection
outlier-detection

Abstract: Deep one-class classification variants for anomaly detection learn a mapping that concentrates nominal samples in feature space causing anomalies to be mapped away. Because this transformation is highly non-linear, finding interpretations poses a significant challenge. In this paper we present an explainable deep one-class classification method, Fully Convolutional Data Description (FCDD), where the mapped samples are themselves also an explanation heatmap. FCDD yields competitive detection performance and provides reasonable explanations on common anomaly detection benchmarks with CIFAR-10 and ImageNet. On MVTec-AD, a recent manufacturing dataset offering ground-truth anomaly maps, FCDD sets a new state of the art in the unsupervised setting. Our method can incorporate ground-truth anomaly maps during training and using even a few of these (~5) improves performance significantly. Finally, using FCDD's explanations we demonstrate the vulnerability of deep one-class classification models to spurious image features such as image watermarks.

Published as a conference paper at ICLR 2021
EXPLAINABLE DEEP ONE-CLASS CLASSIFICATION
Philipp Liznerski Lukas Ruff
Robert A. Vandermeulen
Billy Joe Franks' Marius Kloft!
Klaus-Robert Müller
'LL group, Technical University of Kaiserslautern, Germany
ML group, Technical University of Berlin, Germany
GGoogle Research, Brain Team, Berlin, Germany
"Department of Artificial Intelligence, Korea University, Scoul, Republic of Korea
'Max Planck Institute for Informatics, Saarbrücken, Germany
{1 fliznerski, franks, kloft) www.unnikk....
[lukas. ruff, vandermeulen, mlaus-rbbrrt
ABSTRACT
Deep one-class classification variants for anomaly detection learn mapping that concentrates nominal samples feature space causing anomalies to be mapped away. Because this transformation is highly non-linear, finding interpretations poses a significant challenge. this paper we present an explainable deep one-class classification method, Fully Convolutional Data Description (FCDD), where the mapped samples are themselves also an explanation heatmap. FCDD yields com- petitive detection performance and provides reasonable explanations on common anomaly detection benchmarks with CIFAR-10 10 and ImageNet. On MVTec-AD, recent manufacturing dataset offering ground-truth anomaly maps, FCDD sets a new state of the art in the unsupervised setting. Our method can incorporate ground-truth anomaly explanations during training and using even few of these (~~ 5) improves performance significantly. Finally, using FCDD's 's explanations, we demonstrate the vulnerability of deep one-class classification models spurious image features such as image watermarks
INTRODUCTION
Anomaly detection (AD) the task of identifying anomalies in a corpus of data (Edgeworth) 1887
Barnett and Lewis 1994 Chandola et al. 2009 Ruff al. 2021). Powerful anomaly detectors based on deep learning have made AD more effective and scalable to large, complex datasets such as high-resolution images (Ruff al. 2018 Bergmann al., 2019). While there exists much recent work on deep AD, there is limited work on making such techniques explainable. Explanations are needed industrial applications to meet safety and security requirements (Berkenkamp al.) 2017] Katz et al. 2017, Samek et al.) 2020). avoid unfair social biases (Gupta et 2018)) and support human experts decision making (Jarrahi 2018. Montavon et al.) |018]] [Samek et al. 2020). One typically makes anomaly detection explainable by annotating pixels with an anomaly score and, in some applications, such as finding tumors in cancer detection (Quellec et al. 2016)), these annotations are the primary goal of the detector.
One approach to deep AD, known as Deep Support Vector Data Description (DSVDD) (Ruff et al. 2018), is based finding neural network that transforms data such that nominal data is concentrated to a predetermined center and anomalous data lies elsewhere. In this paper we present Fully Convolutional Data Description (FCDD), a modification of DSVDD so that the transformed samples are themselves ves an image corresponding to a downsampled anomaly heatmap. The pixels in this heatmap that are far from the center correspond anomalous regions in the input image. FCDD does this by only using convolutional and pooling layers, thereby limiting the receptive field of each output pixel. Our method is based on the one-class classification paradigm (Moya al. 1993 Tax
2001 Tax and Duin 2004 Ruff et al. 2018). which is able to naturally incorporate known anomalies Ruff et al. (2021), but is also effective when simply using synthetic anomalies.
"cqual contribution
Our code is available https://github..ttt httmm/iineerki/feeee.

---

Published as a conference paper at ICLR 2021
We show that FCDD's anomaly detection performance is close to the state of the the standard AD benchmarks with CIFAR-10 and ImageNet while providing transparent explanations. On MVTec- AD, an AD dataset containing ground-truth anomaly maps, demonstrate the accuracy of FCDD's explanations (see Figure T.. where FCDD sets a new state of the art. In further experiments we find that deep one-class classification models (e.g. DSVDD) are prone the "Clever Hans" effect (Lapuschkin et al.) 2019) where detector fixates on spurious features such as image watermarks, In general, we find that the generated anomaly heatmaps are less noisy and provide more structure than the baselines, including gradient- gradient-based methods (Simonyan et al. 2013 Sundararajan et al. 2017 and autoencoders (Sakurada and Yairi 2014 Bergmann al. 2019).
Figure 1: FCDD explanation heatmaps for MVTec-AD (Bergmann et al. 2019). Rows from top
to bottom show: (1) nominal samples (2) anomalous samples (3) FCDD anomaly heatmaps (4) ground-truth anomaly maps.
2 RELATED WORK
Here we outline related works on deep AD focusing on explanation approaches. Classically deep AD used autoencoders (Hawkins al. 2002 Sakurada and Yairi 2014 Zhou and Paffenroth] [017]] Zhao et al. 2017). Trained on a nominal dataset autoencoders are assumed to reconstruct anomalous be used
and the pixel-wise difference as an explanation (Bergmann et al. 2019), thereby naturally providing an anomaly heatmap. Recent works have incorporated attention into reconstruction models that can be used explanations Vennaatarmaanan et al. 2019 Liu et al. 2020). In the domain of videos, Sabokrou et al. (2018) used a pre-trained fully convolutional architecture combination with sparse autoencoder to extract 2D features and provide bounding boxes for anomaly localization. One drawback of reconstruction methods that they offer no natural way to incorporate known anomalies during training.
samples poorly Thus, the reconstruction
anomaly
More recently, one-class classification methods for deep AD have been proposed. These methods attempt to separate nominal samples from anomalies an unsupervised manner by concentrating nominal data in feature space while mapping anomalies to distant locations (Ruff al.) 2018
Chalapathy et al. 2018: Goyal et al. 2020). In the domain of NLP, DSVDD has been successfully applied to text, which yields form of interpretation using attention mechanisms (Ruff et al. 2019
For images, Kautimann et al. (2020) have used a deep Taylor decomposition (Montavon et al. to derive relevance scores.
2017
Some the best performing deep AD methods are based on self-supervision. These methods transform nominal samples, train network predict which transformation was used on the input, and
2

---

Published as a conference paper at ICLR 2021
provide anomaly via the confidence of the prediction (Golan and El- Yaniv, 2018 Hendrycks et al. 2019b). Hendrycks et al. (2019a) have extended this to incorporate known anomalies as well. No explanation approaches have been considered for these methods so far.
Finally, there exists a great variety of explanation methods general, for example model-agnosee methods (e.g. LIME (Ribeiro al. 2016)) gradient-based techniques (Simonyan et al. 2013 Sundararajan an et al. 2017). Relating to our work, we note that fully convolutional architectures have been used for supervised segmentation tasks where target segmentation maps are required during
training (Long et al. 2015 Noh et al. 2015).
3 EXPLAINING DEEP ONE-CLAS CLASSIFICATION
We review one-class classification and fully convolutional architectures before presenting our method.
Deep One-Class Classification Deep one-class classification (Rfff et al. 2018 2020b) performs anomaly detection by learning a neural network to map nominal samples near a center с in output space, causing anomalies be mapped away. For our method (HSC) (Ruff et al. 2020a), recently proposed modification of Deep SAD (Ruff et al.) 2020b). semi-supervised version of DSVDD (Ruff al., 2018). Let XI...., Xn, denote a collection of samples and y1..... Y/ sample. Then the HSC objective is
Hypersphere Classifier
be labels where = 1 denotes an anomaly and y: = 0 denotes a nominal
..........
min W.c
n E
yı log (1 exp exp(-h(d(XxW) c))),
(1)
where E Rdd is the center, and & Rexxxw + Rdd neural network with weights W. Here h is 1, which robust loss that interpolates from quadratic to linear penalization. The HSC loss encourages á to map nominal samples and anomalous samples away from the center In our implementation, the center corresponds to the bias term in the last layer of our networks, i.e. included in the network ø, which why we omit с in the FCDD objective below.
the pseudo-Huber loss (Huber al. 1964), h(a) = / |a||
Fully Convolutional Architecture Our method uses a fully convolutional network (FCN) (Long et al., 22155] NNh et al., (2155) that maps an image to a matrix of features, i.e. & Rexxx + TR. Lxuxx by using al- ternating convolutional and pooling layers only, and does not contain any fully con- nected layers. In this context, pooling can be as special kind of convolution with fixed parameters.
Figure 2: Visualization of a 3x3 convolution followed by 3x3 transposed convolution with Gaussian kernel, both using a stride of 2.
A core property of convolutional layer that each pixel of its output only depends small region of its input, known as the output pixel's receptive field. Since the output of convolution is produced by moving filter over the input image, each output pixel has the same relative position its associated receptive field in the input. For instance, the lower-left corner of the output representation has corresponding receptive field in the lower-left corner of the input image, etc. (see Figure left side). The outcome of several stacked convolutions also has receptive fields of limited size and consistent relative position, though their size grows with the amount of layers. Because of this an FCN preserves spatial information.
Fully Convolutional Data Description Here we introduce our novel explainable AD method Fully Convolutional Data Description (FCDD). By taking advantage of FCNs along with the HSC above, we propose a deep one-class method where the output features preserve spatial information and also serve downsampled anomaly heatmap. For situations where would like have full-resolution heatmap, we include a methodology for upsampling the low-resolution heatmap based on properties of receptive fields.

---

Published as a conference paper at ICLR 2021
X
A'
A
FCDD
Upsampling
Figure 3:
Visualization of the overall procedure produce full-resolution anomaly heatmaps with FCDD. X denotes the imput, é the network, A the produced anomaly heatmap and the upsampled version of A using transposed Gaussian convolution.
FCDD is trained using samples that labeled nominal or anomalous. As before, let X X, denote a collection of samples with labels ....... Vn. where y/: denotes an anomaly and yi 0 denotes nominal sample. Anomalous samples can simply are not from the nominal collection, e.g. one of the many large collections of images which are freely available like 80 Million Tiny Images (Torralba al, 2008) or ImageNet (Deng et al. 2009). The use of such an auxiliary corpus has been recommended in recent works on deep AD, where it is termed Outlier Exposure (OE) (Hendrycks et al. 2019a b). When one has access to "true" examples of the anomalous dataset, i.e. something that is likely to be representative of what will be seen at test time, we find that even using a few examples as the corpus of labeled anomalies performs exceptionally well. Furthermore, in the absence of any sort of known anomalies, synthetic anomalies, which we find is also very effective.
collection of random images which
generate
With an FCN Φ Rexhxx Ruxe the FCDD objective utilizes pseudo-Huber loss the FCN output matrix A(X) (Volx: +1-1) where all operations are applied element-wise. The FCDD objective then defined as (cf.,
Σ Vi) u.v
|A(X))) - y4 log 1I-epp (-u-o (u.u uuv
IA(())I.))
min W
(2)
Here ||A(X)]] ||, is the sum of all entries in A(X), which all positive. FCDD is the utilization of an FCN in conjunction with the novel adaptation of the HSC loss we propose in (2). The objective maximizes || | for anomalies and minimizes it for nominal samples, thus
||A(X)]] as the anomaly score. Entries of A(X) that contribute to || |[X()]] correspond to regions of the input image that add the anomaly score. The shape of these regions depends on the receptive field of the FCN. We include a sensitivity analysis on the size of the receptive field in Appendix A where we find that performance is not strongly affected by the receptive field size. Note that A(X) has spatial dimensions u x v and is smaller than the original image dimensions h X One could use A(X) directly as a low-resolution lution heatmap of the image, however is often desirable have full-resolution heatmaps. Because we generally lack ground-truth anomaly maps in an AD setting during training, it not possible to train an FCN a supervised way to upsample the low-resolution heatmap A(X) (e.g. in (Noh et al. 2015)). For this reason we introduce an upsampling scheme based on the properties receptive fields.
4

---

Published as a conference paper at ICLR 2021
Heatmap Upsampling Since we gener- ally do not have access to ground truth pixel annotations in anomaly detection dur- ing training, we cannot learn how to upsam- ple using deconvolutional type of struc- ture. We derive principled way to upsam- ple our lower resolution anomaly heatmap instead. For every output pixel in A(X) there is a unique input pixel which lies at the center of its receptive field. It has been observed before that the effect of the recep- tive field for an output pixel decays in a Gaussian manner as one moves away from the center of the receptive field (Luo et al. 2016). We use this fact to upsample A(X) by using a strided transposed convolution with a fixed Gaussian kernel (see Figure right side). We describe this operation and procedure in Algorithm [ which simply corresponds to a strided transposed convolution. The kernel size is set to the receptive field range of FCDD and the stride the cumulative stride of FCDD. The variance of the distribution can be picked empirically (see Appendix B for details). Figure 3 shows a complete overview of our FCDD method and the process of generating full-resolution anomaly heatmaps.
Algorithm 1 Receptive Field Upsampling
Input: A E CB (low-res anomaly heatmap)
Output: A' E RRxx (full--ee anomaly heatmap)
Define: [G2(H, _ 1 exp (a-wa)) (V-22)
A' for all output pixels in A do
f + receptive field of
C + center of field f A' < A' + a. (c
end for return A'
4 EXPERIMENTS
In this section, we experimentally evaluate the performance of FCDD both quantitatively and qualitatively. For quantitative evaluation, we use the Area Under the ROC Curve (AUC) (Spackman 1989) which is the commonly used measure in AD. For a qualitative evaluation, we compare the heatmaps produced by FCDD to existing deep AD explanation methods. As baselines, consider gradient-based methods (Simonyan et al. 2013) applied to hypersphere classifier (HSC) models (Ruff) al. 2020a) with unrestricted network architectures (i.e. networks that also have fully connected layers) and autoencoders (Bergmann et al. 2019) where we directly use the pixel-wise reconstruction error as an explanation heatmap. We slightly blur the heatmaps of the baselines with the same Gaussian kernel we use for FCDD, which we found results in less noisy, more interpretable heatmaps. We include heatmaps without blurring in Appendix G We adjust the contrast of the heatmaps per method to highlight interesting features; see Appendix consider model-agnostic explanations, such as LIME (Ribeiro et al., (2016) or anchors (Ribeiro et al.. 2018), because they are not tailored to the AD task and performed poorly.
details. For our experiments we don't t
4.1 STANDARD ANOMALY DETECTION BENCIMARKS
We first evaluate FCDD on the Aishion-MNIST CIFAR- 10, and ImageNet datasets. The common AD benchmark utilize these classification datasets in one-vs-rest setup where the "one" class is used as the nominal class and the rest of the classes are used as anomalies at test time. For training, we only use nominal samples as well random samples from some auxiliary Outlier Exposure (OE) (Hendrycks et al. (019a) dataset, which is separate from the ground-truth anomaly classes following Hendrycks al.
2019a We report the mean AUC over all classes for each dataset.
Fashion-MNIST We consider each of the ten one-vs-rest setup. We train Fashion-MNIST using EMNIST (Cohen et al. 2017) or grayscaled CIFAR-100 (Krizhevsky et al. 2009)) as OF We found that the latter slightly outperforms the former (~3 AUC percent points). On Fashion-MNIST. we use network that consists of three convolutional layers with batch normalization, separated by two downsampling pooling layers.
(Xiao et al. 2017) classes in a
We consider each of the ten CIFAR-10 KKrizhessy et al. 2009) classes in a one-vs on-sst-rest setup. As OE we use CIFAR- 100, which does not share any classes with 100 We model similar to LeNet-5 (LeCun et al. (998). but decrease the kernel size to three, add batch normalization, and replace the fully connected layers and last max-pool layer with two further convolutions.
CIFAR-10
5

---

Published as a conference paper at ICLR 2021
ImageNet We consider 30 classes from ImageNetlk (Deng et al. 2009) for the one-vs ve-sstt setup following Hendryeks et al. (2019a). For OE we use ImageNet22k with ImageNet classes removed
(Hendrycks et al. (019a). We use an adaptation of VGG11 (Simonyan and Zisserman (0155) with
batch normalization, suitable for inputs resized to x 224 (see Appendix D for model details).
State-of-the-art Methods We report results from state-of-the-art deep anomaly detection methods. Methods that do not incorporate known anomalies are the autoencoder (AE), DSVDD (Ruff et al.
2018), Geometric Transformation based AD (GEO) (Golan and Yaniv 2018). and a variant of GEO by Hendrycks et al. (2019b) (GEO+). Methods that use OE are a Focal loss classifier (Hendrycks) al. 2019b), also GEO+, Deep SAD (Ruff et al., 2020b), and HSC (Ruff al. 2020a).
Table 1: Mean AUC (over all classes and 5 seeds per class) for Fashion-MNISTT, CIFAR-10. and ImageNet. Results from existing literature are marked with an asterisk (Bergman and Hoshen 2020 Golan and El- Ylniv 2018 Hendrycks al. 2019b Ruif et al. 2020a).
without OE
with OE Deep SAD*
Dataset
AE
DSVDD*
GEO*
Geo+*
Focal
Geo+
HSC*
FCDD
Fashion-MNIST
0.82
0,93
0.94
X
0.89
CIFAR-10
0,59*
0.65
0.86
0,90
0.87
0.96
0.95
0.96
0.95
ImageNet
0.56
X
0.56
0.86
0.97
0.97
0.94
The mean AUC detection performance on the three AD benchmarks are reported in Table We can see that FCDD, despite using restricted FCN architecture improve explainability, achieves a performance that is close to state-of-the-ar methods and outperforms autoencoders, which yield detection performance close to random more complex datasets. We provide detailed results for all individual classes in Appendix F
Quantitative Results
Input
Grad
AB
(a)
(
(c)
Figure 4: Anomaly heatmaps for anomalous test samples of MaSHi model trained on nominal class "trousers" (nominal samples are shown in (a)). In (b) CIFAR- 100 was used for OE and in (c) EMNIST. Columns ordered by increasing anomaly score from left to right, i.e. what FCDD finds the most nominal looking anomaly on the left to the most anomalous looking anomaly on the right.
Qualitative Results Figures 4 and 5 show the heatmaps for Fashion-MNIST and ImageNet respec- tively. For Fashion-MNISS model trained on the nominal class "trousers," the heatmaps show that FCDD correctly highlights horizontal elements as being anomalous, which makes sense since trousers are vertically aligned. For an ImageNet model trained on the nominal class "acorns," we observe that colors seem to be fairly relevant features with green and brown areas tending to be as more nominal, and other colors being deemed anomalous, for example the red barn or the white snow. Nonetheless, the method also seems capable of using more semantic features, for example it recognizes the green caterpillar as being anomalous and it distinguishes the acom to be nominal despite being against a red background.
heatmaps for CIFAR-10 10 models with varying amount of OE, all trained on the nominal class "airplane." We can see that, the number of OE samples increases, FCDD tends concentrate

---

Published as a conference paper at ICLR 2021
Input
Outs
Grad
AE
(a)
(b)
Figure 5: Anomaly heatmaps of an ImageNet model trained on nominal class "acorns." Here (a) are nominal samples and (b) anomalous samples. Columns ordered by increasing anomaly score from left to right, i.e. what FCDD finds the most nominal looking on the left to the most anomalous looking on the right for (a) nominal samples and (b) anomalies.
the explanations more on the primary object in the image, i.e. the bird, ship, and truck. We provide further heatmaps for additional classes from all datasets in Appendix G
Input
Ours
Grad
AE
Figure 6: Anomaly heatmaps for three anomalous test samples on CIFAR- model trained on nominal class "airplane." The second, third, and fourth blocks show the heatmaps of FCDD, gradient- based heatmaps of HSC, and AE heatmaps respectively. For Ours and Grad, we grow the number of OE samples from 2, 8, 128, 2048 to full OE. AE is not able to incorporate OE.
Baseline Explanations We found the gradient- based heatmaps mostly produce centered blobs which lack spatial context (see Figure 6 and thus are not useful for explaining. The AE heatmaps, being directly tied to the reconstruction error anomaly score, look reasonable. We again note, however, that it is not straightforward how to include auxiliary OE samples or labeled anomalies into an AE approach, which leaves them with poorer detection performance (see Table Overall we find that the proposed FCDD anomaly heatmaps yield a good and consistent visual interpretation.
EXPLAINING DEFECTS MANUFACTURING
Here we compare the performance of FCDD on the MVTec-AD dataset of defects in manufacturing (Bergmann et al., 2019). This datasets offers annotated ground-trute anomaly segmentation maps for testing, thus allowing quantitative evaluation of model explanations. MVTec-AD contains 15 object classes of nigh-resolution RGB images with up 1024x 1024 pixels, where anomalous test samples are further categorized in up 8 defect types, depending on the class. We follow [Bermmann ct al. (2019) and compute an AUC from the heatmap pixel scores, using the given (binary) anomaly segmentation maps as ground-truth truth pixel labels. We then report the mean over all samples of this "cxplanation" AUC for a guantitative evaluation. For FCDD, we use a network that is based on a VGG11 network pre-trained ImageNet, where we freeze the first ten layers, followed by additional fully convolutional layers that we train.
7

---

Published as a conference paper at ICLR 2021
Synthetic Anomalies OE with natural image dataset like ImageNet is not informative for MVTec-AD since anomalies here are subtle defects of the nominal class, rather than being out of class (see Figure IT. For this reason, we generate synthetic anomalies using a sort of "confetti noise," " simple noise model that inserts colored blobs into images and reflects the local nature of anomalies. See Figure 7 for an example.
Figure 7: Confetti noise.
Semi-Supervised FCDD A major advantage of FCDD in comparison reconstruction- based methods is that it can be readily used in a semi-supervised AD setting (Ruff et al.) 2020b). To see the effect of having even only a few labeled anomalies and their corresponding ground-truth anomaly maps available for training, we pick for each MVTec-AD class just one true anomalous sample per defect type at random and add it to the training set. This results in only 3-8 anomalous training samples. To also take advantage of the ground-truth heatmaps, train model pixel level. Let X1...., Nx, again denote a batch of inputs with corresponding ground truth heatmaps .I...., Yn, each having anomaly heatmap of X. Then, we can formulate a pixel-wise objective by the following:
h number of pixels. Let A(X) also again denote the corresponding output
)) (3)
min W
1 n
m Σ (1 (x.)) m j=1
loog 1 1- exp
Σ m
m2
(Y),,
j=1
Results Figure inn the introduction shows heatmaps of FCDD trained on MVTec-AD, The results of the quantitative explanation are shown in Table [ We can see that FCDD outperforms its competitors in the unsupervised setting and sets a new state of the art of 0.92 pixel-wise mean AUC. In the semi-supervised map per defect class-the the explanation performance improves further to 0.96 pixel-wise mean AUC. FCDD also has the most consistent performance across classes.
-using only one anomalous sample with corresponding anomaly
Table 2: Pixel-wise mean AUC scores for all classes of the MVTec-AD dataset (Bergmann et al. 2019). For competitors we include the baselines presented in the original MVTec-AD paper and previously published works from peer-reviewed venues that include the MVTec-AA benchmark. The competitors are Self-Similarity and L2 Autoencoder (Bergmann al. 2019). AnoGAN (Schlegl
ce al. al. 2019). Visually Explained Variational Autoencoder (Liu et al. (020). Superpixel Masking and
2017 [errmmann et al. 2019), CNN Feature Dictionaries (Napoletano et al. 2018 Bergmann
Inpainting (Li et al., 2020), Gradient Descent Reconstruction with VATSs (Dehaene et al.
2020). and
Encoding Structure- Crruttue-Texturee Texture Relation with P-Net for AD (Zhou al. 2020).
unsupervised
semi-sipervised FCDD
AE-SS
AE-L2*
ARoGAN
CNNFD*
VEVAE"
SMAI"
GDR
P-NET
FCDD
Bottle
0.93
0.86
0.86
0.78
0.87
0.86
0.92
0.99
0.97
0.96
Cable
0.79
0.90
Capsule
0.94
0.88
0.84
0.84
0.74
0.93
0.92
0.84
0.93
0.95
Carpet
0.87
0.59
0.54
0.72
0.78
0.88
0.74
0.57
0.96
0.99
Grid
0.94
0.90
0.58
0.59
0.73
0.97
0.96
0.98
0.91
0.95
Huzelnut
0.97
0.95
0.87
0.72
0.98
0.97
0.98
0.97
0.95
0.97
Leather
0.78
0.75
0,87
0.95
0.86
0.89
0.98
0.99
Metal Nut
0.89
0.86
0.76
0.82
0.94
0.92
0.91
0.79
0.94
0.98
0.91
0.83
0.92
0.91
0.81
0.97
Screw
0.96
0.96
0.80
0.87
0.97
0.96
0.95
1,00
0.86
0.93
Tile
0.59
0.51
0.50
0.93
0.80
0.62
0.65
0.97
0.91
0.98
Tuothbrush
0.92
0.93
0.90
0.77
0.94
0.96
0.99
0.99
0.94
0.95
Transistor
0.90
0.86
0.80
0.66
0.93
0.85
0.92
0.82
0.88
0.90
Wood
0.73
0.73
0.62
0.91
0.77
0.80
0.98
0.88
0.94
Zipper
0.88
0.77
0.78
0.76
0.78
0.90
0.87
0.90
0.92
0.98
Meun
0.86
0.82
0.74
0.78
0.86
0.89
0.89
0.89
0.92
0.96
0.10
0.13
0.13
0.10
0.09
0.09
0.09
0.12
0.04
0.02
4.3
THE CLEVER HANS EFFECT
Lapuschkin al. (016 2019) revealed that roughly one fifth of all horse images in PASCAL VOC
[Everingham et al. 2010) contain a watermark in the lower left corner. They showed that classifier
recognizes this the relevant class pattern and fails if the watermark is removed. They call this the
8

---

Published as a conference paper at ICLR 2021
"Clever Hans" effect in memory of the horse Hans, who could correctly math problems by reading its master" We adapt this experiment to one-class classification by swapping our standard setup and train FCDD so that the "horse" class is anomalous and ImageNet nominal samples. We choose this setup so that one would expect FCDD to highlight horses in its heatmaps and so that any other highlighting makes FCDD reveal Clever Hans effect.
www. polerr www.deeoooostcccocoooooooo
(a)
(b)
Figure 8: Heatmaps for horses on PASCAL VOC. Here (a) shows anomalous samples ordered from nominal most anomalous from left to right, and (b) shows examples that indicate that the model is a "Clever Hans," i.e. has learned a characterization based on spurious features (watermarks).
Figure 8 (b) shows that a one-class model indeed also vulnerable to learning a characterization based spurious features: the watermarks in the lower left corner which have high scores whereas other regions have low scores. We also observe that the model yields high scores for bars, grids, and fences in Figure (a). This is due to many images in the dataset containing horses jumping bars or being in fenced areas. In both cases, the horse features themselves do not attain the highest scores because the model has way of knowing that the spurious features, while providing good discriminative power at training time, would not be desirable upon deployment/test time. In contrast traditional black-box models, however, transparent detectors like FCDD enable practitioner to recognize and remedy (e.g. by cleaning extending the training data) such behavior or other undesirable phenomena (e.g. avoid unfair social bias).
CONCLUSION
In conclusion we find that FCDD, in comparison to previous methods, performs well and adaptable to both semantic detection tasks (Section 4.1) and more subtle defect detection tasks (Section 4.2) Finally, directly tying an explanation to the anomaly score should make FCDD less vulnerable to attacks (Anders et al. (020) in contrast to posteriori explanation methods. We leave analysis of this phenomenon for future work.
ACKNOWLEDGEMENT
MK, PL, and BJF acknowledge support by the German Research Foundation (DFG) award KL 2698/2- 1 and by the German Federal Ministry of Science and Education (BMBF) awards 011S 1 1A05 031B0770F, and 010K20014U. LR acknowledges support by the German Federal Ministry of Education and Research (BMBF) in the project ALICE III (01IS1 by the Berlin Institute for the Foundations of Learning and Data (BIFOLD) sponsored by the German Federal Ministry of Education and Research (BMBF), KRM was supported in part by the Institute of Information & Communications Technology Planning & Evaluation (ITTP) grants funded by the Korea Government (No. 2017-0-00451 and 2019-0-00079) and was partly supported by the German Federal Ministry of Education and Research (BMBF) for the Berlin Center for Machine Learning (0 A-3 and under the Grants 011S 401$1403A-FE, 01GQ1115, O1GQ0850, 01 011S18025A and 0311 03110027.A0 A-D; the German Research Foundation (DFG) under Grant Math+, EXC 2046/1, Project ID 390685689. Finally, we thank all reviewers for their constructive feedback, which helped to improve this work.
(01IS18049B). 8049B). RV acknowledges support

---

Published as a conference paper at ICLR 2021
REFERENCES
C. J. Anders, Pasliov, A.-K. Dombrowski, K.-R. Müller, and P. Kessel. Fairwashing explanations with off-manifold detergent. In ICML, pages 6757-6766, 2020.
Barnett and T. Lewis. Outliers in Statistical Data. Wiley, 3rd edition, 1994.
Bergman and Y. Hoshen. Classification- anomaly detection general data. In ICLR, 2020.
Bergmann, M. Fauser, D. Sattlegger, and C. Steger. MVTec AD comprehensive real-world dataset for unsupervised anomaly detection. In CVPR, pages 9592-9600, 2019.
Berkenkamp. M. Turchetta, A. Schoellig. and A. Krause. Safe model-based reinforcement learning with stability guarantees. In NeurlPS. pages 908-918, 2017.
L. Bottou. Lerge-scale machine learning with stochastic gradient descent. In Proceedings of COMPSTAT pages 177-186. Springer, 2010.
R. Chalapathy, A. K. Menon, and S. Chawla. Anomaly detection using one-class neural networks. arXiv preprint arXiv:1802.06360 2018.
V. Chandola, A. Banerjee, and V. Kumar. Anomaly detection: A survey. ACM Computing Surveys, 41(3):1-58, 2009.
G. Cohen, S. Afshar, J. Tapson, and A. Van Schaik. EMNIST: Extending MNIST to handwritten letters. In IJCNN, pages 2921-2926, 2017.
D. Dehaene, O. Frigo, S. Combrexelle, and P. Eline. Iterative energy-based projection normal data manifold for anomaly localization. In ICI.R, 2020.
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: large-scale hierarchical image database. CVPR, pages 248-255, 2009.
Edgeworth. On discordant observations. London, Edinburgh. and Dublin Philosophical Magazine and Journal of Science, 23(5):364-37)
1887.
M. Everingham, L. Van Gool, C. K. Williams, Winn, A. Zisserman. The pascal visual object classes (VOC) challenge. International Journal of Computer Vision, 88(2):303-338, 2010.
I. Golan and R. El-iv..v. Deep anomaly detection using geometric transformations. In NewrIPS, pages 9758-9769, 2018.
Goyal, A. Raghunathan, M. Jain, H. V. Simhadri, and P. Jain. DROCC: Deep robust one-class classification. In ICML, pages 11335-11345, 2020.
A. Gupta, J. Johnson, L. Fei-Fei, S. Savarese, and A. Alahi, Social GAN: Socially acceptable trajectories with generative adversarial networks. In CVPR, pages 2255-2264, 2018.
S. Hawkins, H. He, G. Williams, and R. Baxter. Outlier Detection Using Replicator Neural Networks. In DaWaK, volume 2454, pages 170-180, 2002.
D. Hendrycks, M. Mazeika, and T. G. Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019a.
D. Hendrycks, M. Mazeika, S. Kadavath, and D. Song. Using self-supervised learning improve model robustness uncertainty. NeurlPS, pages 15637-15648, 2019b.
Huber al. Robust estimation location parameter. Annals of Mathematical Statistics, 35(1): 73-101, 1964.
M. H. Jarrahi. Artificial intelligence and future of work: Human-AI symbiosis in organizational decision making. Business Horizons, 61(4):577-586, 2018.
G. Katz, C. Barrett, D. L. Dill, K. Julian, and M. J. Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In International Conference Computer Aided Verification, pages 97-117. Springer, 2017.
J. Kauffmann, K.-R. Müller, and G. Montavon. Towards Explaining Anomalies: A Deep Taylor Decomposition of One-Class Models. Pattern Recognition, 101:107198, 2020.
10

---

Published as a conference paper at ICLR 2021
D. P. Kingma and Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
A. Krizhevsky, G. Hinton, al. Learning multiple layers of features from tiny images. Technical report, 2009.
S. Lapuschkin. Binder, G. Montavon, K.-R. Muller, and W. Samek. Analyzing classifiers: Fisher vectors and deep neural networks. In CVPR, pages 2912-2920, 2016.
Lapuschkin, S. Wäldchen, A. Binder, Montavon, W. Samek, and K.-R. Müller. Unmasking clever hans predictors and assessing what machines really learn. Nature Communications, 10:1090 10:1096, 2019.
LeCun, L.. Bottou, Y. Bengio, Proceedings of the IEEE, 86(1 1:2278-22222 1998.
Haffner. Gradient-based learning applied to document recognition.
Z. Li, N. Li, K. Jiang, Z. Ma. X. Wei, X. Hong, and Y. Gong. Superpixel masking and inpainting for self- supervised anomaly detection. In BMVC, 2020.
W. Liu, R. Li, M. Zheng. S. Karanam, Z. Wu, B. Bhanu, R. Radke, and O. Camps. Towards visually explaining variational autocncoders. In CVPR, pages 8642-8651, 2020.
J. Long, Shelhamer, and T. Darrell. Fully convolutional networks for semantic segmentation. In CVPR, pages 3431-3440, 2015.
W. Luo, Y. Li, R. Urtasun, and Zemel. Understanding effective receptive field in deep convolutional neural networks. In NearlPS, pages 4898-4906, 2016.
G. Montavon, S. Lapuschkin, A. Binder, W. Samek, and K.-R. Müller. Explaining nonlinear classification decisions with deep Taylor decomposition. Pattern Recognition, 65:211-222, 2017.
G. Montavon, W. Samek. and K.-R. Müller. Methods for interpreting and understanding deep neural networks. Digital Signal Processing, 13:1-15,20 2018.
M. M. Moya, M. W. Koch, and L. D. Hostetler. One-class classifier networks for target recognition applications. In World Congress Neural Nenworks, pages 197-801, 1993.
Napoletano, Piccoli, and Schettini. Anomaly detection nanofibrous materials by CNN-based self- similarity. Sensors, 18(1):209, 2018.
H. Noh, S. Hong, and B. Han. Learning deconvolution network for semantic segmentation. In ICCV, pages 1520-1588, 2015.
G. Quellec, M. Lamard, M. Cozic, G. Coatrieux, and G. Cazuguel. Multiple-instance learning for anomaly detection in digital mammography. IEEF Transactions on Medical Imaging, 15(7):1604-6614 2016.
T. Ribeiro, S. Singh, and C, Guestrin. "Why should trust you?" Explaining the predictions of any classifier. In KDD, pages 1135-1144, 2016.
M. T. Ribeiro, Singh, and C. Guestrin. Anchors: High-precision model-agnostic explanations. In AAAI, volume 18, pages 1527-1535, 2018.
Ruff, A. Vandermeulen, N. Görnizz, Deecke, A. Siddiqui, A. Binder, E. Müller, and M. Kloft. Deep one-class classification. In ICML, volume 80, pages 4390-4399, 2018
L. Ruff, Y. Zemlyanskiy, R. Vandermeulen, T. Schnake, and M. Kloft. Self-attentive, multi-context one-class classification for unsupervised anomaly detection on text. In ACL, pages 4061-4071, 2019,
L. Ruff, R. A. Vandermeulen, B. J. Franks, K.-R. Müller, and M. Kloft. Rethinking assumptions in deep anomaly detection. arXiv preprint arXiv:2006.003: 2020a.
L. Ruff, R. A. Vandermeulen. N. Gömitz, A. Binder, E. Müller, K.- Müller, and M. Kloft. Deep semi- supervisd anomaly detection. In ICLR, 2020b.
Ruff, J. R. Kauffmann, R. A. Vandermeulen, Montavon, Samek, M. Kloft, T. G. Dietterich, K.-R. Müller. A unifying review deep and shallow anomaly detection. Proceedings of the IEEE, 2021. doi: 10. 00.1109/PROC..221.33322.2.
M. Sabokrou, M. Fayyaz, M. Fathy, Z. Moayed, and R. Klette. Deep-anomaly: Fully convolutional neural network for fast anomaly detection in crowded scenes. Computer Vision and Image Understanding, 172: 88-97, 2018.
11

---

Published as a conference paper at ICLR 2021
M. Sakurada and T. Yairi. Anomaly detection using autoencoders with nonlinear dimensionality reduction. In Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, pages 4-11, 2014.
W. Samek, Montavon, S. Lapuschkin. Anders, and K.-R. Müller. Toward interpretable machine learning: Transparent deep neural networks and beyond. arXiv preprint arXiv:2003.06311 2020.
Schlegl, Seeböck, S. Waldstein, Schmidt Erfurth, and Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In International conference on information processing in medical imaging, pages
Springer, 2017.
K. Simonyan and A. Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
K. Simonyan, A. Vedaldi, and A. Zisserman. Deep inside convolutional networks: Visualising image classifica- tion models and saliency maps. arXiv preprint wrXiv:1312.6034 2013.
K. A. Spackman. Signal detection theory: Valuable tools for evaluating inductive learning. In Proceedings of the Sixth International Workshop on Machine Learning, pages 160-163, 1989.
M. Sundararajan, A. Taly, and Q Yan. Axiomatic attribution for deep networks. In ICML, pages 3319-3328, 2017.
L. Sutskever, J. Martens, G. Dahl, and G. Hinton. On the importance of initialization and momentum in deep learning. In ICML, pages 1139-111 1147, 2013.
D. J. Tax. One-class classification. PhD thesis, Delft University of Technology. 2001.
D. Tax and R. P. W. Duin. Support Vector Data Description. Machine Learning, 54(1):45-66, 2004.
A. Torralba, R. Fergus, and W. T. Freeman. 80 million tiny images: large data set for nomparametric object scene recognition, IEEE Transactions on Puttern Analysis and Machine Intelligence, 30(11):1958-1970 2008.
Venkataramanan, K.-C. Peng, R. Singh, and A. Mahalanobis. Attention guided anomaly detection and localization in images. arXiv preprint 1rXiv:191..08616, 2019.
Vollgraf. Fashion-MNIS" novel image dataset benchmarking machine learning algorithms. arXiv preprint arXiv: 770.0077777 2017.
Xiao, K. Rasul,
Zhao, B. Deng, C. Shen, Liu, H. Lu, and X.-S. Hua. Spatio-temporal autoencoder for vidco anomaly detection. In Proceedingy of the 25th ACM International Conference on Multimedia, pages 1933-1941, 2017.
C. Zhou and R. C. Paffenroth. Anomaly detection with robust deep autoencoders. KDD, pages 665-674, 2017.
K. Zhou, Y. Xiao, J. Yang. Cheng, W. Liu, W. Luo, Z. Gu, J. Liu, and S, Gao. Encoding structure-tcxture relation with p-net for anomaly detection in retinal images. In ECCV, 2020.
12

---

Published as a conference paper at ICLR 2021
A RECEPTIVE FIELD SENSITIVITY ANALYSIS
The receptive field has an impact on both detection performance and explanation quality. Here we provide some heatmaps and AUC scores for networks with different receptive field sizes. We observe that the detection performance is only minimally affected, but larger receptive fields cause the explanation heatmap to become less concentrated and more "blobby." For MVTec-AD we see that this can also negatively affect pixel-wise AUC scores, see Table
CIFAR-10 For CIFAR- 10 create eight different network architectures to study the impact of the receptive field size. Each architecture has four convolutional layers and two max-po max-pool layers. To change the receptive field vary the kernel size of the first convolutional layer between and 17. When this kernel size is 3 then the receptive field contains approximately one quarter of the image; for kernel size of 17 the receptive field is the entire image. TableBssows shows the detection performance of the networks. Figure 9 contains example heatmaps.
Table Mean AUC (over all classes and seeds per class) for CIFAR-10 and neural networks with varying receptive field size.
Receptive field size
18
20
22
24
26
28
30
32
AUC
0,9328
0.9349
0.9344
0.9320
0.9303
0.9283
0.9257
0.9235
Figure Anomaly heatmaps for three anomalous samples on CIFAR-10 models trained on nominal class "airplane." We grow the receptive field size from 18 (left) to 32 (right).
Figure 10: Anomaly heatmaps for seven anomalous test samples of MVTec-AD. We grow the receptive field size from 53 (left) to 243 (right).
13

---

Published as a conference paper at ICLR 2021
Table 4: Pixel-wise mean AUC (over all classes and seeds per class) for MVTec-AD and neural networks with varying receptive field size.
Receptive field size
53
91
129
167
205
243
AUC
0.88
0.85
0.79
0.76
0.75
0.75
MVTec-AD We create six different network architectures for MVTec-AD, They have six convolu- tional layers and three max-pool layers. We vary the kernel size for all of the convolutional layers between 3 and 13, which corresponds to a receptive field containing 1 1/16 the image to the full image respectively. Table the explanation performance of the networks in terms of pixel-wise mean AUC. Figure [0] contains some example heatmaps. We observe that a smaller receptive field yields better explanation performance.
B IMPACT OF THE GAUSSIAN VARIANCE
Using the proposed heatmap upsampling in Section FCDD provides full-resolution anomaly heatmaps. However, this upsampling involves the choice of for the Gaussian kernel. In this section, we demonstrate the effect this hyperparameter on the explanation performance of FCDD on MVTec-AD. Table 5 shows the pixel-wise mean AUC, Figure IT corresponding heatmaps.
8
0
Figure 11: Anomaly heatmaps for seven anomalous test samples MVTec-AD. We grow a from
(left) to 16 (right).
Table 5: Pixel-wise mean AUC (over all classes and 5 seeds per class) for MVTec-AD and different g.
12
14
AUC 0.8567 0.8836
0.9030
0.9124
0.9164
0.9217
0.9208
C ANOMALY HEATMAP VISUALIZATION
For anomaly heatmap visualization, the FCDD anomaly scores A' need to be rescaled to values in [0. 1]. Instead of applying standard min-max scaling that would divide all heatmap entries by max ('X). we use anomaly score quantiles to adjust the contrast in the heatmaps. For collection of inputs X (X1,...,X,, X,) with corresponding full-resolution anomaly heatmaps
14

---

Published as a conference paper at ICLR 2021
A= A'(,)))).,,,())) the normalized heatmap I (X) for some A' is computed I(X); min 9, min(A) A' A})
A'(X); min(AA
where j denotes the j-th pixel and On the 77-th percentile over all pixels and examples in A. The subtraction and min operation are applied on a pixel level, i.e. the minimum extracted over all pixels and all samples of A and subtraction is then applied elementwise. Using the 17-th percentile might leave some of the values above 1, which is why we finally clamp the pixels at
The specific choice of 1) and set of samples X differs per figure. We select them highlight different properties of the heatmaps. In general, the lower 1 the more red (anomalous) regions we have the (hefore clamping 1) and vice
heatmaps because more values left above of ranges from just one sample X, such that A' (X) is normalized only w.r.t. to its own scores (highlighting the most anomalous regions within the image), the complete dataset (highlighting which regions look anomalous compared to the whole dataset). For the latter visualization we rebalance the dataset so that A' contains an equal amount of nominal and anomalous images to maintain consistent scaling. The choice of and N' is consistent per figure. In the following we list choices made for the individual figures.
The choice
MVTec-AD
10 and |1 17 0.97 and set X' to X for each heatmap ((X) show relative anomalies. So each image is normalized with respect to itself only.
Figures
Fashion-MNIST
Figure 4 uses 1/ 0.85 and X' the complete balanced test set.
use = 0.85 and set X' to X for each heatmap I(X) to show relative anomalies. So each image is normalized with respect to itself only.
CIFAR-10 Figures 6 and 9
ImageNet
Figure 5 uses 17 0.97 and sets X' to the complete balanced test set.
Pascal VOC
Figure 8 uses Y) = 0.99 and sets A' to the complete balanced test set.
Heatmap Upsampling For the Gaussian kernel heatmap upsampling described Algorithm we set a to 1.2 for CIFAR-10 and Fashion-MNIST, to 8 for ImageNet and Pascal VOC, and to 12 for MVTec-AD.
D DETAILS ON THE NETWORK ARCHITECTURES
Here we provide the complete FCDD network architectures we used on the different datasets.
Fashion-MNIST
Layer (type)
Output Shape
Conv2d
1, 128, 28, 28]
3,
Satchhorr22d2
[-1, 128, 28, 26]
256
LeakyRelt-]]
[-1, 128, 28, 28]
0
MaxPoo 12d-4
[-1, 128,
Conv2d-5
[-1, 128, 14, 14]
409, 728
MaxFoo 22-6
[-1, 128,
Conv2d-7
[-1, 7]
129
Total params: 413,441
Trainable params: 413, 441
Non-trainaple parama:
Raceptive field (pixels): 16
15

---

Published as a conference paper at ICLR 2021
CIFAR-10
Layer (type)
Output Shape
Param
Conv2d-1
[-1, 128, 32, 32]
3, 584
BatchKorm2d
[1, 128, 32, 32]
LeakyseLU-3
[-1, 128, 32, 32]
YaxPoo12d
[ [,, 128, 16, 16]
0
Conv2d-5
[-1, 236,
satchhorm22d66
[-1, 256, 16, 16]
512
1eakyRe14-7
[-1, 256, 16, 16)
Conv2d-8
[-1, 256, 16, 16]
590, 080
Betchhoorm2d-9
[-1, 256, 16, 16]
512
LeskykeLU-10
[-1, 256, 16, 161
MexPoo12d 11
1 256, 8, 8]
128,
Conv2d-13
[-1 1, 8)
129
Total params: 1,185,281
Irsinable perams: 2,1
Non-trainable params:
Receptive field (pixels): 22 x 22
ImageNet, MVTec-AD, and Pascal VOC
Tayer (type)
Output Shape
Param
Conv2d-1
[-1, E4, 224, 224]
1, 792
Batchkorm2é-2
[-1, 64, 224,
224]
128
Ret4t-3
64, 224,
224]
D
MaxPoo12d-4
[-1, 64, 112, 112]
0
Conv2d-5
[-1, 128, 112, 112]
BatchKorm22-6
[-1, 128, 112, :12]
256
Rel0-7
[-1, 128, 112, 112]
XaxFoc12d-9
[-1, 128, 56, 56]
Conv2d-9
[-1, 256, 56, 56)
295, 168
BatchNorm2d-10
[-1, 236,
RetU 11
1, 256, 56, 56]
0
5onv2d-12
[-1, 256, 56, 86]
590,
BatchNerm2d 13
256, 56, 56]
512
ReLU-14
[-1, 256, 56, 56]
MoxFcol2d-15
256, 28, 28]
6onv2d-16
[-1, 512, 28, 28)
1, 180, 160
BatchNorm22-11
512,
1,024
ReLU-18
[-1, 512, 28, 281
2onv2d-19
[-1, 28,
3,359,60
DatchNerm22 20
512, 28, 26]
1,024
ReLU-21
[-1, 512, 28, 28]
Conv2d-22
[-1, 28, 28)
513
ToLal pacams: 4,504,
Trainable params: 4,504,
Son-troinable params:
3eceptive field (pixels): 62
E TRAINING AND OPTIMIZATION
Here we provide the training and optimization details for the individual experiments from Section
We apply common pre-pre preprroesssig (e.g. data normalization) and data augmentation steps in our data loading pipeline. To sample auxiliary anomalies in an online manner during training, each nominal sample batch has a 50% chance being replaced by randomly picked auxiliary anomaly. This leads to balanced training batches for sufficiently large batch sizes. One epoch in our implementation still refers to the original nominal data training set size, so that approximately 50% of the nominal samples have been seen per training epoch. Below, list further details for the specific datasets.
Fashion-MNIST We train for 400 epochs using batch size of 128 samples. We optimize the network parameters using SGD (Bottoul 2010) with Nesterov momentum (μ = 0.9) (Sutskever al. 2013). weight decay of 10-6 and an initial learning rate of 0.01, which decreases the previous
16

---

Published as a conference paper at ICLR 2021
learning rate per epoch by factor of 0.98. The pre-processing pipeline is: (1) Random crop size 28 with beforehand pard-ng of 2 pixels on all sides (2) random horizontal flipping with a chance of 50% (3) data normalization.
CIFAR-10 We train for 600 epochs using a batch size of 200 samples, We optimize the network using Adam (Kingma and Ba. 2015 (3 (0.9, 0.999)) with weight decay 10 and an initial learning rate of 0.001 which is decreased by a factor of 10 at epoch 400 and 500. The pre- pre-pccessing pipeline is: (1) Random color jitter with all parameterg set to 0.01 (2) random crop to size 32 with beforehand zero- zero-padding of 4 pixels on all sides (3) random horizontal flipping with chance of 50% (4) additive Gaussian noise with = 0.001 (5) data normalization.
ImageNet We use the same setup as in CIFAR- 10, but resize all images to size 256 256 before forwarding them through the pipeline and change the random crop to size 224 with no padding. Test samples are center cropped size of 224 before being normalized.
Pascal VOC
We use the same setup as in CIFAR-10 10, but resize all images to size 224x224 before forwarding them through the pipeline and remove the Random Crop step.
MVTec-AD For MVTec-AD redefine an epoch to be ten times iteration of the full dataset because this improves the computational performance of the data pipeline. We train for 200 epochs using SGD with Nesterov momentum (μ 0.9), weight decay 10-4, and an initial learning rate of 0.001, which decreases per epoch by a factor of 0.985. The pre-processing pipeline is: (1) Resize to 240x240 pixels (2) random crop to size 224 with no padding (3) random color jitter with either all parameters set to 0.04 or 0.0005, randomly chosen (4) 50% chance to apply additive Gaussian noise (5) data normalization.
F QUANTITATIVE DETECTION RESULTS FOR INDIVIDUAL CLASSES
Table shows the class-wise results on Pashion-MNIST for AE, Deep Support Vector Data Descrip- tion (DSVDD) (Ruff et al. 2018 Bergman and Hoshen 2020) and Geometric Transformation based AD (GEO) GGoan and El- Yaniv 2018).
Table 6: AUC scores for all classes of Fashion-MNIST Xiao et al. 2017).
without OE DSVDD*
with OE
AE
Geos
FCDD
T-Shit/Topp
0.85
0.98
0.99
0.82
Trouser
0.90
0.98
Pullover
0.78
0.91
0.91
0.84
Dress
0.88
0.94
0.90
0.92
Cont
0.88
0.89
0.92
0.87
Sandal
0.45
0.92
0.93
0.90
Shirt
0.83
0.75
Sneaker
0.96
0.99
0.99
0.99
Bag
0.92
0.91
Ankle Boot
0.96
0.99
0.99
0.94
Mean
0.82
0.93
0.94
0.89
In Table 7 the wise results for CIFAR- 10 are reported. Competitors without OE are AE (Ruf et al. 2018). DSVDD (Ruff et al. 2018), GEO (Golan and EI- Yaniv 2018) and an adaptation of GEO (GEO+) (Hendrycks et al. 2019b). Competitors with OE are the focal loss classifier (Hendrycks) et al. 2019b), again GEO+ (Hendrycks et al. 2019b). Deep Semi-supervised Anomaly Detection (Deep SAD) (Ruff et al. 2020b a and the hypersphere Classifier (Ruff et al. 2020a)).
In T the class- results for Imagenet are shown, where competitors are the AE, the focal loss classifier (Hendrycks et al. 2019b), Geo+ (Hendrycks et al. (2019)), Deep SAD (Ruff et al. 2020b) and HSC (Ruff et al. 2020a). Results from the literature are marked with an asterisk.
ht ttpp:///pptorchhor//oomm http://www.....oooooooooooie/e/e
worchiiaiionnn.. tana Co ttreitter
17

---

Published as a conference paper at ICLR 2021
Table 7: AUC scores for all classes of CIFAR-10 Krizhevsky al.
2009)
without OE
with OE Deep SAD*
AEP
DSVDD
GEO
Geo++
Focal*
Geos
HSC*
FCDD
Airplanc
0,59
0.62
0.75
0.78
0.88
0.90
0.94
0.97
0.95
Automohile
0.99
Bird
0.49
0.51
0.78
0.87
0.79
0,94
0.90
0,93
0.91
Cat
0,58
0.59
0.72
0.81
0.80
0.88
0,87
0.90
0.90
Deer
0.54
0.61
0,88
0,93
0.82
0,97
0.95
0.97
0.94
Dog
0.66
0.88
0.90
0.86
0,94
0.93
0.94
0.93
0.51
0.68
0.91
0.93
0.98
0.97
Horse
0,59
0.67
0.96
0.97
0.88
0.99
0.97
0.98
0.96
Ship
0.76
0.95
0,98
Truck
0.67
0.73
0.91
0.93
0.92
0.99
0.96
0.97
0.96
Mean
0.59
0.65
0.86
0.90
0.87
0.96
0.95
0.96
0.95
Table AUC scores for 30 classes of ImageNet (Deng et al.
2009
without AE
Focal
Geos
Deep SAD*
HSC*
FCDD
Acom
0.45
0.99
0.99
0.97
Airliner
0.80
0.97
1.00
0.98
Ambulance
0.25
0.99
1,00
0.99
American alligator
0.61
X 0.93
0.98
0.97
Banjo
Barn
0.59
X 0.99
1,00
0.97
Bikini
0.46
X
0.99
0.94
Digital clock
0.63
0.99
0.97
0.92
Dragonily
0.62
0.99
0.98
0.98
Dumbhell
0.42
0.93
0.92
0.88
Forklint
0.28
X 0.1
0.99
0.94
0.94
Grand piano
0.45
1.00
0.97
0.95
Hotdog
0.48
X 0.96
0.99
0.97
Hourglass
0.58
0.96
0.97
0.92
Manhole cover
0.70
0.99
1.00
1.00
Mosque
0.72
0.99
0.99
0.97
Nail
0.57
X 0.93
0.94
0.92
Parking meter
0,93
Pillow
0.40
0.99
0.94
0.94
Revolver
0.60
X 0.98
0.98
0.93
Rotary dial telephone
0.58
0.90
0.98
0.91
Schooner
0.65
0.99
0.99
0.96
Snowmobile
0.54
0.98
0.99
0.97
Soccer ball
0.46
X 0.97
0.93
0.86
Stingmy
X
0.99
0.97
Strawberry
0.44
0.98
0.99
0.97
Tank
0.57
X
0.97
0.99
0.96
Toaster
0.59
0.98
0.92
0.79
Volcano
0.90
0.90
1.00
0.97
Meun
0.56
0.56
0.86
0.97
0.97
0.94
18

---

Published as a conference paper at ICLR 2021
G FURTHER QUALITATIVE ANOMALY HEATMAP RESULTS
In this section we report some further anomaly heatmaps, unblurred baseline heatmaps, as well as class-wise heatmaps for all datasets.
Unblurred Anomaly Heatmap Baselines Here we show unblurred baseline heatmaps for the figures Section [4.1] Figures 12 13 and show the unblurred heatmaps for Fashion-MNIST, ImageNet, and CIFAR-10 respectively.
Input
Ons
Grad
(a)
(b)
Figure 12: Anomaly heatmaps for anomalous test samples of a Fashion-MNIS model trained on nominal class "trousers." In (a) CIFAR-100 was used for OF and in (b) EMNIST.
Ours Inpur
AB
(a)
Figure 13: Anomaly heatmaps of an ImageNet model trained on nominal class "acorns." (a) are nominal and (b) anomalous samples.
Input
Ours
Grad
Figure 14: Anomaly heatmaps for three anomalous test samples (Input left) on a CIFAR- 10 model trained on nominal class "airplane." The second, third, and fourth blocks show the heatmaps of FCDD (Ours), prrudeent-bseed heatmaps of HSC. and AE heatmaps respectively. For Ours and Grad, grow the number of OE samples from 2, 8, 128, 2048 to full OE. AE is not able to incorporate OE.
19

---

Published as a conference paper at ICLR 2021
Class-wise Anomaly Heatmaps Due space restrictions have only shown heatmaps for some of the classes in the main paper. Here we also report a collection of heatmaps for all classes.
We show heatmaps with adjusted contrast curves by setting X' to the balanced set of all samples for all datasets in this section. Further, we set 7 = 0.85 for Fashion-MN for MVTec-AD, and 7 0.97 for ImageNet. Note that, keep the heatmaps for different classes comparable, we use unified normalization for all heatmaps one figure. However, since for each class separate anomaly detector trained, this yields suboptimal visualizations for some of the classes (for example, the "toothbrush" images for MVTec-AD in Figure 18 where the heatmaps just show huge red blob). Tweaking the normalization for such classes reveals that the heatmaps actually tend to mark the correct anomalous regions, which in the case of "toothbrushes" can be seen in the explanation performance evaluation Table
and CIFAR-I0, = 0.99
The rows in all heatmaps show the following: (1) Input samples (2) FCDD heatmaps (3) gradient heatmaps with HSC (4) autoencoder reconstruction heatmaps. Heatmaps for MVTec-AD add fifth row containing the ground-truth anomaly map.
Heatmaps for Fashion-MNIST using auxiliary anomalies from CIFAR-100 are in Figure 15 using EMNIST for OE instead are in Figure T6 CIFAR-10 heatmaps are in Figure 17 and heatmaps for all
classes of MVTec-AD are Figure 18 Finally, we present ImageNet heatmaps Figures T9 and
HnRi
"t-shirt/top"
"trouser"
"pullover"
"dress"
"coat"
"sandal"
"shirt"
"sncaker"
"bag"
"ankle boot"
Figure 15: Anomaly heatmaps for anomalous test samples in Fashion-MNIST using CIFAR-100 OE Columns are ordered by increasing anomaly score from left to right. The subcaptions refer to the nominal class that each model is trained for which some examples are also displayed as separate column on the left.
20

---

Published as a conference paper at ICLR 2021
PAR
"t-shirt/top"
"trouser"
"pullover"
"dress"
"coat"
"sandal"
"shirt"
"sneaker"
"bag"
"ankle boot"
Figure 16: Anomaly heatmaps for anomalous test samples in Fashion-MNIS" using EMNIST OE. Columns are ordered by increasing anomaly score from left to right. The subcaptions refer to the nominal class that each model is trained on, for which some examples are also displayed as separate column on the left.
21

---

Published as a conference paper at ICLR 2021
"airplanc"
"automobile"
"bird"
"cat"
"deer"
"dog"
"frog"
"horse"
"ship"
"truck"
Figure 17: Anomaly heatmaps for anomalous test samples in CIFAR-10. 10. Columns are ordered by increasing anomaly score from left to right. The subcaptions refer the nominal class that each model is trained on, for which some examples are also displayed as separate column the left.
22

---

Published as a conference paper at ICLR 2021
"bottle"
"cable"
"capsulc"
"carpet"
"grid"
"hazelnut"
"leather"
"metal nut"
"pill"
8
"SCTeW"
"tile"
"toothbrush"
"transistor"
"wood"
"zipper"
Figure 18: Anomaly heatmaps for anomalous test samples in MVTec-AD, Columns are ordered by increasing anomaly score from left to right. The subcaptions refer the nominal class that each model is trained on.
23

---

Published as a conference paper at ICLR 2021
"acorn"
"airliner"
"ambulance"
"American alligator"
"banjo"
"barn"
"bikini"
"digital clock"
"dragonfly" "
"dumbbell"
"forklift"
"goblct"
"grand piano"
"hotdog"
"hourglass"
"manhole cover"
"mosque"
"nail"
"parking meter"
"pillow"
"revolver"
Anomaly heatmaps for anomalous test samples in ImageNet, where classes 1-21 are shown. Columns are ordered by increasing anomaly score from left to right. The subcaptions refer to the nominal class that each model is trained on, for which some examples are also displayed as separate column on the left.
Figure 19:
24

---

Published as a conference paper at ICLR 2021
"dial telephone"
"schooner"
"snowmobile"
"soccer ball"
"stingray"
"strawberry"
"tank"
"toaster"
"volcano"
Figure 20: Anomaly heatmaps for anomalous test samples in ImageNet, where classes 22-30 are shown. Columns ordered by increasing anomaly score from left to right. The subcaptions refer the nominal class that each model is trained on, for which some examples are also displayed as separate column the left.
25


Reviews:
[{"review_id": "qtMgzBrYPUB", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "### **Evaluation**\n- The paper is tackling the topic of explainable Deep One-Class-Classification. In contrast to comparable methods, like for example gradient-based heatmaps, FCDD has a spatial context. This fact facilitates the interpretability. \n- The approach is well-motivated and compares well to the state of the art AD-methods.\n- The paper provides sophisticated theoretical as well as empirical insights. \n\n\n### **Detailed Comments for Authors**\n- The visualisations given in the paper are well suited for the addressed problem. The Appendix gives a good insight into the functioning of the FCDD as well as the decision process of the networks. However, in figure 18. the output for \"toothbrush\" is shown a huge anomaly blob for all samples, while the ground truth shows just minimal areas. Why is that the case? \nIn contrast to this, the mean AUC in table 2 is 0.94 (and 0.95 for semi-supervised FCDD), which is quite good comparing to the visual impression. \n- The section addressing the \"Clever Hans\" effect was a good addition, since it shows another perspective of the usage of the methods while clearly showing the learned characteristics. It might be beneficial to explain in more detail, why using the \"horse\" class as anomaly class, since it is kind of in inverse logic (it makes sense, but while reading one had to think twice about it). \n- For the heatmap-overviews given, it might be valuable to have a comparison of one sample of the nominal class and multiple of the anomaly one. In this way, the trained class is shown and directly comparable to the anomalies.  \n\n#### **Strong points of the submission.** \n- Very well written paper, which is easy to follow, based is based not least on good visualisation.\n- The paper provides a good and detailed description of the theoretical concepts.\n- It is positive that the examples also pointing some weaknesses of FCDD, like not recognising the anomaly, while simultaneously comparing to other methods. The method shows its strength in the spacial context. Given the extended appendix, the authors deliver a critical view on the possibilities as well as the potential limitations.    \n\n#### **Weak points of the submission.** \n- the conclusion is quite sparse, and even missing an own section.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "ngPoMXYW4mP", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "########################################################################## \nSummary:\n\nThis paper presents a modified approach, on top of an existing method (DSVDD), for anomaly detection with a state of the art achievement in the unsupervised setting. In my opinion, the model itself is not a novel innovation. However, it fails when sprious image features exist. \n\n\n##########################################################################\nReasons for score: \n\nThis paper has evidence to show better performance comparing to other, in terms of explanation.  But, however, to me personally, it doesn't meet a high standard, as the method is just a modification of what's already existing. And the heatmap as an explanation, demonstrated that model did pick up some superficial features for detection, such as color.  Lastly, as the authors also called out in the last session, it's not robust enough to overcome spurious features, which can be big problem for real applications. \n\n\n\n##########################################################################\nQuestions during rebuttal period: \n \nPlease address and clarify the cons above \n \n\n ", "extra_scores": {}, "extra_text": {}}, {"review_id": "KL-9fT-IhEE", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents a one-class classification method using a fully convolutional model and directly using the output map as an explanation map. The method is dubbed FCDD for fully convolutional data descriptor. FCDD uses a hypersphere classifier combined with a pseudo-Huber loss. FCDD is trained using outliers exposure (OE) from a different but related dataset. The empirical study consists of 3 parts:\n * a quantitative comparison of anomaly detection (AD) with SOT methods on three datasets: Fashion-MNIST, CIFAR-10 and ImageNET. The proposed method is shown to be competitive with SOT.\n * a qualitative study showing that the explanation provided by FCDD is more useful compared to other methods.\n * a quantitative comparison of the explanation performance on the MVTec-AD dataset. This shows that FCDD beats other SOT approaches and can also be easily adapted to accept actual anomalies examples, which results in even improved numbers.\n\nPROS:\n\n * The paper is very well written (excellent grammar!) and easy to follow, with clear, complete and concise explanations. \n \n * The method is simple and elegant. It should be easy to reproduce it.\n \n * The results are competitive with SOT for AD and beats it for the quality explanation (with the caveat below).\n\nCONS:\n\n * The novelty is incremental: Combining fully-convolutional CNN with a hypersphere classifier.\n\n * The comparison with other methods for MVTEC is only with published results. FCDD uses a confetti noise to create OE examples. However, it is not clear which OE methods (if any) were used in the published results. Therefore it is not clear if the improved SOT comes from a better OE method or from the FCDD itself.\n\n *  The paper also describes a fixed-kernel (Gaussian) upsampling method using strided transposed convolutions, which I find unnecessary to be added to the paper.\n\n * the qualitative examples on figure 1 should be compared with other methods. \n \n * fig 5 should show the nominal class for visual reference.\n \n \n Overall this is a well written paper, presenting a simple and reproducible approach to explainable AD that beats the SOT. \n \n ", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper touches upon explainable anomaly detection. To that extend, it modified hypersphere classifier towards fully convolutional data description (FCDD). This is, as also pointed out by two of the reviewers a direct application of a fully convolutional network within the hyperspherical classifier. However, the paper  also shows how to then upsample the receptive field using a strided transposed convolution with a fixed Gaussian kernel. Both together with tackling explainable anomaly detection is important. Moreover, the empirical evaluation is quite exhaustive and shows several benefits compared to state-of-the-art. So, yes, incremental, but incremental for a very interesting an important case. 
Decision: Accept (Poster)