Robustness for Free: Adversarially Robust Anomaly Detection Through Diffusion Model
Authors: Yuanpu Cao
Lu Lin
Jinghui Chen
Venue: Submitted to ICLR 2023 (2023)

Abstract: Deep learning-based anomaly detection models have achieved remarkably high accuracy on commonly used benchmark datasets. However, the robustness of those models may not be satisfactory due to the existence of adversarial examples, which pose significant threats to the practical deployment of deep anomaly detectors. To tackle this issue, we propose an adversarially robust anomaly detector based on the diffusion model. There are two things that make diffusion models a perfect match for our task: 1) the diffusion model itself is a reconstruction-based modeling method whose reconstruction error can serve as a natural indicator of the anomaly score; 2) previous studies have shown that diffusion models can help purify the data for better adversarial robustness. In this work, we highlight that our diffusion model based method gains the adversarial robustness for free: the diffusion model will act both as an anomaly detector and an adversarial defender, thus no extra adversarial training or data purification is needed as in standard robust image classification tasks. We also extend our proposed method for certified robustness to $l_2$ norm bounded perturbations. Through extensive experiments, we show that our proposed method exhibits outstanding (certified) adversarial robustness while also maintaining equally strong anomaly detection performance on par with the state-of-the-art anomaly detectors on benchmark datasets.

Under review as a conference paper at ICLR 2023
ROBUSTNESS FOR FREE: ADVERSARIALLY ROBUST ANOMALY DETECTION THROUGH DIFFUSION MODEL
Anonymous authors Paper under double-blind review
ABSTRACT
Deep learning-basee anomaly detection models have achieved remarkably high accuracy on commonly used benchmark datasets. However, the robustness of those models may not be satisfactory due the existence of adversarial examples, which pose significant threats to the practical deployment of deep anomaly detec- tors. To tackle this issue, we propose adversarially robust anomaly detector based on the diffusion model. There are two things that make diffusion models a perfect match for our task: 1) the diffusion model itself is reconstruction- based modeling method whose reconstruction error can serve as a natural indicator of the anomaly score; 2) previous studies have shown that diffusion models can help purify the data for better adversarial robustness. In this work, we highlight that our diffusion model based method gains the adversarial robustness for free: the diffusion model will act both an anomaly detector and an adversarial defender, thus no extra adversarial training or data purification is needed as in standard ro- bust image classification tasks. We also extend our proposed method for certified robustness to l2 norm bounded perturbations. Through extensive experiments, we show that our proposed method exhibits outstanding (certified) adversarial robust- ness while also maintaining equally strong anomaly detection performance on par with the sate-of-the-ar anomaly detectors on benchmark datasets.
INTRODUCTION
Anomaly detection aims at identifying data instances that are inconsistent with the majority of data, which has been widely applied in various domains such industrial defect detection (Bergmann let al. 2019), IT infrastructure management (Sun et al., (02T), medical diagnostics (Fernando et al. 2021 and cyber security (Feng & Tian 2021). Recently, deep learning (DI.) based anomaly de- tection methods have achieved remarkable improvement over traditional anomaly detection strate- gies (Ruff al., |02 Pang al. 2021). DL-based methods take the advantage of neural networks to estimate the anomaly score of a data instance which reflects how likely it is an anomaly. One com- mon practice defines anomaly score as the reconstruction error between the original data instance and the recovered one decoded by a symmetric neural network model (e.g., autoencoder) (Hawkins) jet al. 2002, Chen et al., 2017). The insight that the reconstruction error can serve as anomaly score is that the model trained on normal data usually cannot reproduce anomalous instances (Bergmann) cet al. 202I). thus a high reconstruction error for a data instance indicates a larger probability of being an anomaly.
Though DL-based anomaly detection methods have achieved remarkably high accuracy on com- monly used benchmark datasets (Yu et al. 202T Lee et al. 2022a), the robustness of the detection models is still unsatisfactory due to the existence of adversarial examples (Goodge et al. 2020 Lo
et al. 2022), which poses significant threats to the practical deployment of deep anomaly detectors. Specifically, an imperceptible perturbation on the input data could cause a well-trained anomaly de-
tector to return incorrect detection results. Figure [ shows simple case of how such an adversarial attack can disrupt OCR-GAN (Liang et al.) 2022)) which is a recent deep image anomaly detector. We observe that an anomalous "hazelnut" in the upper row, when added with an invisible noise, could cheat the detector to output a low anomaly score; while the normal "hazelnut" in the lower row can also be perturbed to make the detector raise a false alarm with a high anomaly score. fact, such a robustness issue is not unique to OCR-GAN but common problem for various state-of-the- deep anomaly detection models (as will be seen in our later experiments Section 3).

---

Under review as a conference paper at ICLR 2023
To tackle this issue, explore the possibility of using the diffusion model to achieve adversarially robust anomaly detection. As powerful class of generative models, dif-
+8
GT: TT-Anomallos
fusion models (Ho et al. 2020 Nichol & Dhariwal (2021)
capable of generating samples with high quality, beat- ing GANs in image synthesis (Dhariwal & Nichol (2021). Specifically, diffusion models first construct diffusion process to convert the data into standard Gaussian noise by gradually adding random noise, and then learn the generative process to reverse the diffusion process and generate samples from the noise by denoising one step at time. There are two aspects about diffusion models that make them a perfect match for building an adversar- ially robust anomaly detector: 1) anomaly detection ca- pability, as the diffusion model itself is a reconstruction- based modeling method whose reconstruction error can serve as natural indicator of the anomaly score. A dif- fusion model trained normal data ideally can recon- struct anomalies as normal ones through the diffusion and reverse generative process, thus bringing high re- construction scores for anomalies compared with normal instances; 2) adversarial robustness, as previous studies have shown that diffusion models can be used data purifier to mitigate adversarial noises for better robustness (Nic et al. 2022) in supervised learning tasks, which suggests its potential in de- fending adversarial examples in the anomaly detection task.
Anomaly Score: 0272
Anomaly Score: 0.008
Predict:Anomaai
Predict: Normal
GT: Normal
Anomaty 0.013 +02 Anomaty 0.953
Predict: Normat
Predict: Anomaions
An adversarial example on OCR-GAN refers to invisible pertur- bations. "GT" denotes "Ground Truth".
Figure
Based on the nice properties diffusion models, we propose novel adversarially robust anomaly detection method, inside which the diffusion model acts both sarial defender. The introduction of the diffusion model enables us to gain adversarial robustness for free, as extra adversarial training or data purification is needed. Note that our design is fundamen- tally different from the purification-bat
anomaly detector and adver-
adversarial robust models in standard image classification tasks (Nie al.) 2022) where extra external purifier (e.g., diffusion model) is needed before the actual classifier for robust classification, which is not needed in our design!
We summarize our contributions follows:
We build unified adversarial attack framework for various kinds of anomaly detectors to facili- tate the adversarial robustness study in the anomaly detection domain, through which we system- atically evaluate the adversarial robustness of state-of-the-an deep anomaly detection models.
We propose an anomaly detection method based on the diffusion model, which gains adversarial robustness for free: the diffusion model acts both as anomaly detector and an adversarial de- fender, without extra need for adversarial training or data purification as in standard robust image classification tasks. We also extend our method for certified robustness l2 norm perturbations through randomized smoothing which provides additional robustness guarantees.
We conduct extensive experiments and show that our method exhibits outstanding (certified) ad adversarial robustness, while also maintaining equally strong anomaly detection performance on par with the state-of-the-aa anomaly detectors on benchmark datasets (Bergmann et al. 2019).
2 RELATED WORK
Anomaly Detection Methods. Existing anomaly detection methods can be roughly categorized into two kinds: reconstruction-basel and feature-based. One commonly used reconstruction-bee -hased approach for anomaly detection is train the autoencoder and use the 1, norm distance between input and its reconstruction as the anomaly score (Hawkins et al.] 2002] Chen et al.] 2017 Zhou & Paffenroth| 2017). Bergmann et al. (2018) replace 4p distance with SSIM (Wang et al. 2004) to
In fact, the strategy of using the diffusion model as purifier before another anomaly detector will not work, as the purifier will break the anomaly signals.
2

---

Under review as a conference paper at ICLR 2023
have a better measure for perceptual similarity. Another more advanced branch of reconstruction- based models combines autoencoder with GAN, where the generator of the GAN is implemented using autoencoder (Hou et al., 2021 Liang et al.] 2022 Akçay al. 2019). These methods addi- tionally incorporate the anomaly score with the similarity between the features of the input and the reconstructed images extracted from the discriminator to boost performance on categories that difficult to reconstruct accurately. Feature-based methods use pre-trained Resnet and vision trans- former (Yu al. 2021), pre-trained neural networks with feature adaptation (Lee et al. 2022a) to extract discriminative features for normal images, and estimate distribution of these normal features by Flow-based model (Gudovskiy et al. 2022; Rudolph et al., (022). KNN (Reiss al., 202I), or Gaussian distribution modeling (Li et al. 2021). These methods calculate the anomaly score using
the distance from the features of test images to the established distribution for features of normal
images.
Adversarial Attacks and Defenses for Anomaly Detectors. To the best of our knowledge, exist- ing attack and defense strategies for anomaly detectors only focus autoencoder-bascl models. Goodge et al. (020) consider perturbations to anomalous data that make the model to categorize them as the normal class by reducing reconstruction error. For defense, they propose APAE using approximate projection and feature weighting to improve adversarial robustness. Lo et al. (2022) extend the similar attack strategy both normal and anomalous data and propose Principal Latent Space as a defense strategy to perform adversarially robust novelty detection (i.e., only semantic shift anomalies are considered). While they achieve a certain level of robustness, their performances on clean anomaly detection tasks are yet far from satisfactory.
Diffusion Models. As a class of powerful generative models, diffusion models have attracted the most recent attention due to their high sample quality and strong mode coverage (Sohl-Dickstein al. 2015; Ho et al., 2020 Nichol & Dhariwal 2021). Recently, Nie al. (2022) used diffusion models to purify adversarial perturbations for downstream robust classification. and present empir-
ically strong robustness. Woollb et al.] (2022) adopt deterministic DDIM (Song et al.) 2020 for
supervised anomaly localization. Wyatt et al. (2022) solve the same task under an unsupervised sce- nario using DDPM (Ho et al. 2020) with partial diffusion strategy and simplex noise. Note that they are pixel-level anomaly detection methods which are not directly comparable to our image-level anomaly detection. Moreover, diffusion models have not been studied to improve the adversarial robustness of anomaly detectors.
3. BUILDING ADVERSARIAL ATTACKS FOR ANOMALY DETECTORS THROUGH A UNIFIED FRAMEWORK
To facilitate the adversarial robustness study on various kinds of anomaly detectors, we first build a unified adversarial attack framework in the context of anomaly detection. We consider the adver- sarial perturbations to be imperceptible, i.c, their existence will not flip the ground truth class of the image -aase--pessrviing.. The general goal of the unified attack framework is to make detectors return incorrect detection results by reducing anomaly scores for anomalous samples and increas- ing anomaly scores for normal samples, In particular, we take commonly used Projected Gradient Descent (PGD) attack (Madry et al. 2018) as an example illustrate our attack formulation.
PGD Attack on Anomaly Detector. Consider a sample x E IR from the test dataset with label E (-1,1) (where "-1" denotes the anomalous class and "1" indicates the normal class), and a well- trained anomaly detector Ag : IRd + R that computes an anomaly score for each data sample. We define the optimization objective of PGD attack on the anomaly detector as: arg max Lx(x,y) y (x),,,, where guides the direction of perturbing x to increase or decrease its anomaly score. Depending on the perturbation constraint, adversarial examples can be generated by -orm or nn-norm bounded PGD, respectively as:
Xa+1 = -Pleo (xn + a ww..sgn(( sVn, Lo(xx.))
(3.1)
Vx, (x,, y) Xn+1 = pla x.c (xn + a |[vx, Lo (xx,
(3.2)
where a is the step size, n E [0 1]] is the current step of in total N iterations, and x = x. Pke (.) denotes the projection on X,+1 such that ||x+1 x||p S c. The final adversarial example
3

---

Under review as a conference paper at ICLR 2023
is generated by Xade Xx. This attacking strategy encapsulates previous works adversarial examples for anomaly detectors, where only autoencoder- models were considered (Lo et al, 2022 Goodge et al. 2020). The anomaly score can be specified Ao(x) = [E x to accommodate to their scenarios, where D denotes the decoder and E corresponds to the encoder.
Robustness Evaluation on Existing Anomaly Detectors. Based on the unified PGD attack, we sys- tematically evaluate the adversarial robustness of the state-of-the thte-of-theeartt detectors with various model architectures. T demonstrates the efficacy of the attack in disclosing the vulnerability of exist- ing anomaly detectors: the AUC scores of these advanced anomaly detectors drop to as low as 0% under adversarial perturbations with Too norm less than 2/255 on Toothbrush dataset from bench- mark MeTec AD (Bergmann et al. (219)). This suggests that current anomaly detectors suffer from fragile robustness on adversarial data, which urges us to build adversarially robust anomaly detectors that can achieve excellent detection performance and strong adversarial robustness simultaneously.
Table Standard AUC and robust AUC against le- (c = 2/255) attacks on Toothbrush dataset from benchmark MVTec AD, obtained by various anomaly detection SOTAs.
Method
Standard AUC
Robust AUC
OCR-GAN GAR Liang et al. 2022
96.7
0
SPADE CChhen Hoshen
2020
88.9
CFlow Gudovvkiy et al. 2022)
85.3
0
FastFlow Yu al. 2021
94.7
CFA (Lee et al. 2022a)
100
0
4 ADVERSARIALLY ROBUST ANOMALY DETECTION
Before introduce our diffusion-based robust anomaly detection method, we first give brief review on diffusion models (Sohl-Dickstein et af. 2015) Ho et al., 2020; Nichol & Dhariwal 2021)
4.1 PRELIMINARIES ON DIFFUSION MODELS
DDPM (H et al. 2020) defines a T steps diffusion process q(x (xo) == Ie q(x, (x)-)
parameterized by well behaved variance schedule $1.-.., Br g(x, xx-1)
V(x;:1-1V1 Fr. 3)T, which iteratively transforms an unknown data distribution ((xo) to
standard Gaussian q(xT)= /N I). The generative process po == p(xT) I Po (x
learned to approximate each gxx (x,) using neural networks as follows:
P )x) = (x He (x,, t), Eg (Xx, t))
(4.1)
noticeable property of the diffusion process that it allows directly sampling x, at an arbitrary timestep & given Xu- Using the notation 0g 1 Bg and or : II Ogg, have
X = 0i + VI C.E, 6 EEN(1,
(4.2)
This property makes it possible to quickly sample xt. For training the diffusion model, motivated by the connection generative score matching (Song & Ermon| 2019 2020), Ho al. (2020) show that directly predicting the noise term results in higher sample quality, especially when combined with simplified objective without learning signals for Eg Ex(x,, t):
Tsimple
E [||e (x,, I)]
(4.3)
In this paper, we follow Nichol & Dhariwal (2021) and train the diffusion model using hybrid loss for better sample quality with fewer generation steps. More details can be found in Appendix
4.2 FREERAD: ADVERSARIALL ROBUST ANOMALY DETECTION FOR FREE
Based on the diffusion model, we now introduce our proposed Robust Anomaly Detection for Free method, termed FreeRAD. FreeRAD consists of two parts: robust reconstruction, which aims to reconstruct the normal input in a robust manner, and anomaly score calculation, which aims to calculate the final anomaly score based on the robust reconstruction error.
4

---

Under review as a conference paper at ICLR 2023
Robust Reconstruction: Robust reconstruction is the first step for our FreeRAD method and is the key to achieving adversarially robust anomaly detection. Since the diffusion model training proce- dure is essentially predicting noise added in the diffusion process and then denoising, its reconstruc- tion error can serve as a natural indicator of the anomaly score. Specifically, as shown Figure [ for normal data, the reconstruction is nearly identical to the input. For anomaly data, the diffusion model (after adding noise and denoising) could "repair" the anomaly regions, thus obtaining high reconstruction error, which could be easily detected as anomalies. Now let's consider adversarial robustness in anomaly detection. Note that one basic assumption of adversarial examples is that the perturbation is usually imperceivable, e.g., with small Lp norms. In the diffusion process, we add sufficiently large Gaussian noise to the input data, such adversarial perturbations would be domi- nated by the added Gaussian and thus be invalid. After the reverse diffusion (denoising) process, the reconstruction could still recover it to normal and thus obtain high reconstruction error as shown in Figure This suggests that FreeRAD is indeed robust to adversarial data perturbations.
Algorithm summarizes the main steps for robust re- construction. Specifically, to perform adversarially robust reconstruction,
Robust Reconstratton
first choose the diffusion steps and apply Eq. 4.2 on x to obtain diffused im- ages Xg. Unlike the diffusion model training process, here we do not need to diffuse the data into complete Gaussian noise (a large k). Instead, we pick a moder- ate number of k for noise injection and start denois- ing thereafter, similar Nie al. (2022) Note that k should be chosen such that the amount of Gaussian noise is dominating the adversarial perturbations and anomaly signals while the high-level features of the input data are still preserved for reconstruction.
Input
Diffused
Recon
Error map
Normal
Adventanal Anomaly
45
terms of the denoising process, typical full-shot set- ting uses the full & denoising steps: in each step t, iteratively predict the true input given the cur- rent diffused data Xt, termed Xn, then sampling the new iterate x according the current prediction Xo and the current diffused data X,.
Figure 2: Reconstruction results of normal data, anomalous data, and adversarially per- turbed data using our model. The observed reconstruction is robust to adversarial noise.
Algorithm Full-shot Robust Reconstruction in FreeRAI)
Input: Test images: x, diffusion steps: k(k < T') Output: Reconstructions of x
1: Xo =x
2: I
3: X
V VoxX0 + II 0g6
4: for 1- ky...: :....: do
full-shot denoising
5:
80 Va.
(XL vI (x,6(())
6: ift 1 then
7:
2 ~ I0,I
8:
X;-1
01-18e
1-4, Xo
vāll
1-88
x; + Eo(x
9: end if
10:
end for
11: X Xn
Anomaly Score Calculation: To calculate the final anomaly score in robust and stable manner, we first calculate the Multiscale Reconstruction Error Map (denoted as Errms), which considers both pixel-wise and patch-wise reconstruction errors. Specifically, for each scale in I. {1, 1 we first calculate the error map Err(x, x), between the downsampled input x' and the downsampled x))
reconstruction X with 1 >C (x' x [e.... where the square operator is abused here for element- wise square operation, then unsampled to the original resolution. The final Err,s is obtained by averaging each scale's eтror map and applying a mean filter for better stability similar to Zavrtanik
al. 2021b; y Errms (x, x) (N= Eier Err(x, x))) faxs where ssxs is the mean filter of size 8,
5

---

Under review as a conference paper at ICLR 2023
is the convolution operation. Similar to Pirmay & Chai (2022), take the pixel-wise maximum of the absolute deviation of the Errms (x, x) on normal training data as the scalar anomaly score. Due to space limits, we leave the complete anomaly score calculation algorithm in Appendix [.2
One major problem with full-shot denoising (Algorithm T is that the denois- ing procedure is time consuming, making it unacceptable for real-time anomaly detection in critical situations (Sun et al. (021). Moreover, extra reconstruction error can also be introduced due to the multiple sampling steps in the full-shot denoising process. To overcome these challenges, we inves- tigate the arbitrary-shot denoising process allowing fewer denoising steps, with the details shown in Appendix B.I Based on our results (see Appendix [.2) we observe that one-shot denoising (re- ducing the for loop in Line 4 of Algorithm into one iteration) is sufficient to produce an accurate reconstruction result with ((1) inference-tind efficiency. Under such cases, the robust reconstruc- tion in FreeRAD reduces to the simple 3-step version shown in Algorithm 2 Such one-shot idea has also been adopted in Carlini et al. (2022) for robust image classification. By default, we use
One-shot Denoising:
one-shot robust reconstruction for all experiments in Section S
Algorithm 2 One-shot Robust Reconstruction in FreeRAD
Input: Test images: x, diffusion step: k(k < T) Output: Reconstructions of x: X
1: 6
(O. I)
2: X2=
a x
C&C (XLE k:)
3: X
Vack (kk
> one-shot denoising process
5 EXPERIMENTS
We compare proposed FreeRAD with five state-of-the-art anomaly detectors both clean input and adversarially perturbed input. FreeRAD shows a competitive robustness performance compared with
anomaly detector baselines, and maintains robust even under stronger adaptive attacks. Finally, we further extend FreeRAD for certified robustness to la norm perturbations.
5.1 EXPERIMENTAL SETTINGS
Dataset and Model Implementation. We perform experiments on widely used MVTec Anomaly Detection benchmark (Bergmann et al. 2019). MVTec AD comprises 15 sub-datasets with a total of 5354 high-resolution images from the real world. Among these sub-datasets, the category for of them are about specific objects (e.g., toothbrush, transistor, hazelnut), and the other 5 sub-datasets are about specific textures (c.g., leather, wood). We resize all images to 256 x 256 resolution in our experiments. We implement the diffusion model based on Nichol & Dhariwal (202l) using U-Net backbone (Ronneberger et al. 2015). We set the total iteration step as T 1000 for all experiments. During inference stage, we choose the diffusion step (50, 100, 200, 300} for different categories (see Appendix [.I for sensitivity test). More hyperparameters are described in Appendix [C.] [C.]]
Advesariaal Attacks. We adopt commonly used PGD attack (Madry et al. 2018 to compare with the state-of-the-art anomaly detection models and defense-enabled anomaly detectors. Additionally, also consider the BPDA and EOT attack (Athalye al.. (018a) for better robustness evaluations on defense-enabled anomaly detectors. We set the attack strength = 2/255 for Lo0 -nom attacks and 0.2 for norm attacks to ensure imperceptible attack perturbations.
Evaluation Metric. We use the widely-adopted AUC (area under the receiver operating character- istic curve) to evaluate the performance of anomaly detection. Specifically, we consider standard AUC and robust AUC. The standard AUC evaluates the performance on the clean test data, while the robust AUC evaluates the performance on the adversarially perturbed test examples.
5.2 COMPARISON WITH THE STATE-OF-THE-ARY ANOMALY DETECTORS
We compare method FreeRAD with five ofate-of-the-art methods for image anomaly detection: SPADE (Cohen & Hoshen| 2020), OCR-GAN (Liang et al.) 2022). CFlow (Gudovskiy et al. (022). FastFlow YYu et al. 2021), 1), and CFA (Lee et al. 2022a), against the PPGD and PGD attacks.

---

Under review as a conference paper at ICLR 2023
Table 2: Standard AUC (in parenthesis) and robust AUC against 4x attacks (c = 2/255) on
MVTec AD dataset, obtained by different state-of-the-an the anomaly detectors and ours.
Category
OCR-GAN
SPADE
CFlow
FastFlow
CFA
FreeRAD
Carpet
((76.6)
(92.88
(198.6)
((99.7)
(999.4)
70.5 (82.7)
Texture
Grid
((97)
((47.8)
(196.6)
((100)
(99.66)
99.8 99.8(100)
Leather
(300.7)
((96.4)
(3000)
(.6
2.0 (100)
97.8 (300)
Tile
(05.6)
(196.5)
(00.6))
(.3(100)
0.1 (99.3)
93.9 (99.2)
Wood
((95.4)
(95-88)
(190.7)
(199.9)
(09.7)
95.2 (98.3)
Bottle
(97.77
(19.22)
(0000)
((100)
0.1 (100)
88. 1 (100)
Cable
(71.3)
84.85
(98.77
((67.4)
0.8 (99.8)
38.9 (79.5)
Capsule
((80.4)
(89.77)
((9377)
8.9(99.2)
((97)
53.5 (93.0)
Object
Hazelnut
(99.77)
(88.1)
(19.99)
((99.6)
0.1 (200)
91.5 (97.6)
Metal Nut
(62.6)
((71)
0 1000
((98.2)
0 1000
85.9 (93.5)
Pill
((80.8)
(80.1)
0 (93.2)
((97.8)
((98)
(g7.2))
Screw
(99.44)
0 (66.7)
(79)
(91(91
(95.5)
87 6 (99.3)
Toothbrush
(96.7)
0 (88.9)
0 (86.3)
((9477)
(100)
95.8 (100)
Transistor
((73)
(99.3)
(18.3))
(199.4)
((300)
74.5 (98.7)
Zipper
0 (80.4)
(96.6)
(97.5)
(7.5
(99.7)
96. 2 (100)
Average
0 (67.8)
(85.4)
(996.0)
(.3(98.5)
(.9
(9.7()))7)
Table 3: Standard AUC (in parenthesis) and Robust AUC against P2DPGD attacks (e 0.2) on MVTec AD dataset, obtained by different state-of-the-art anomaly detectors and ours.
Category
OCR-GAN
SPADE
CFlow
FastFlow
CFA
FreeRAD
Carpet
18.5(76.6)
(92.8)2.8)
13.5(98.6)
18(99
(9.1
76. (62.7)))7)
Texture
Grid
(197)
4.1
(196.6)
((100)
(99.6)
99,9 (100)
Leather
((90.7)
(9.5)
(100)
(5.0
77.6(100)
99.9 (100)
(100(
Tile
(.4(96.6)
45.9(96.6)
(98.))
(0.5(100)
(9.4))
93. 1 (90.2)
Wood
0195.4)
11 (95.6)
18, (90.7)
(99.9)
(997)
95. (98.3)
Bottle
0.7
((07
(1.5(100)
2,2(100)
74.6
95.5 (100)
Cable
3.2(71.5)
0.984.8
19.2(98.7)
0.3(67.4)
69.5 (99.8)
65.7(79.5)
Capsule
((80.4)
((9.7))
(.6
(9.8(
1.7(97)
68. (93.9)
Object
Hazelnut
18.5(97.7)
(18..1)
4.9 (99.9)
(99.))
47.2 (7.2(100)
94.3
Metal Nut
2.8 (82.6)
((71)
4. (100)
(98.2)
14.3(100)
87.9
(9.9 (93.6)
Pill
2.7(80.8)
064
((93.2)
(19.88)
(.3
80.3 (97.2)
Screw
(99.4)
(60.7)
((79)
(.6
(95.5)
91.8 91.8 (v9.3)
Toothbrush
(96.7)
(88.99
(8.3(85.3)
(.6774.7)
38.3(100)
99. (100)
Transistor
(.7(7))
(.0.)))3)
(.8
0.4(99.4)
53.7(100)
84.3 (9..7 (93.7)
Zipper
(88.4)
(,2696.))
(19.55)
(9.66
(9.7
99.2 (100)
Average
3. (87.8)
(.59(86.4)
(9.3(96.0)
9.9
43.9(99.2)
88.6 88.8
Table 2 presents the robustness performance against 4c0 PPG attacks (e = 2/255) on MVTec AD shows the robustness performance against P2D attacks (e 0.2).
dataset. Table
From Table 2 we observe that our method largely outperforms previous methods regarding robust AUC against -PG attacks = 2/255). Specifically, our method improves robust AUC on all 15 categories of MVTec AD and obtains the average robust AUC 80.5% with the improvement of at least 78.2%. In Table 3 we can see that our method improves average robust AUC against PPDD attacks (c 0.2) by 44.9% and achieves 88.8% robust AUC. In the meantime, we can observe that in terms of anomaly detection performance on clean data, the average standard AUC obtained by our method is on par with the state-of-the-ant methods such as CFlow (Gudovskiy et al.) 2022) FastFlow (Yu et al. 2021). and CFA (Lee et al. 2022a). while beating OCR-GAN (Liang et al. 2022) and SPADE Cohen & Hoshen (2020). These results clearly demonstrate the effectiveness of our proposed method in defending against -PGD and P2D attacks, while also maintaining strong anomaly detection performance benchmark datasets.
7

---

Under review as a conference paper at ICLR 2023
5.3 COMPARISON WITH DEFENSE-ENABLED ANOMALY DETECTORS
In this section, We compare our method FreeRAD with APAE (Goodge et al. 2020 and PLS (Lo jet al., 2022), two defense-enabled anomaly detection methods. We perform the same PGD attacks as in Section 5.2 Additionally, since APAE has optimization loop in their defense process which is hard to backpropagate, we further adopt the BPDA attack (Athalye et al., (01 designed specif- ically for obfuscated gradient defenses evaluate both our FreeRAD and APAE for a fair compar- ison. Table 4 shows the comparison between our FreeRAD method and defense-enabled baselines against PGD and BPDA attacks. We clearly observe that FreeRAD outperforms them under all attacks, with a substantial improvement of 27.6 27.6% 58.3% regarding the average robust AUC over all categories of MVTec AD. Furthermore, our method even largely improves the average standard AUC by 31.00 31.0% on clean data compared with APAE and PLS.
Table 4: Average standard AUC and robust AUC against 1 PGDD/PDAA (c 2/255), 12- PGD/BPDA (e 0.2) attacks on MVTec AD, obtained by PLS, APAE and ours.
Robust AUC
Method
Standard AUC
10 PPG
12-PGD
Ic Bc-BPDA
12-BPDA
PLS
46.4
16.0
40.8
APAE
64.7
29.9
61.2
61.2
FreeRAD
95.7
80.5
88.8
88.3
89.6
5.4
DEFENDING AGAINST STRONGER ADAPTIVE ATTACKS
So far we have shown that FreeRAD is indeed robust to PGD and BPDA attacks in Section 5.2 and
5.3 To further verify its robustness in more challenging settings, we test FreeRAD against adaptive attacks where the attacker is assumed already know about our diffusion model-based anomaly detection method and design attacks against our defense adaptively. Since the diffusion process in our method introduces extra stochasticity, which plays an important role in defending against adversarial perturbations, we consider applying EOT to PGD, which is designed for circumventing randomized defenses. In particular, HOT calculates the expected gradients over the randomization as proxy for the true gradients of the inference model using Monte Carlo estimation (Athalye et al.) 2018h a: Lee al. 2022b). We set the number of samples n 20 for the EOT attacks following Nic et al. (2022).
Table 5: Robust AUC against L PGD, loc -BOT--G (c 2/ 2/255, EOT=20), and 12-PGD, EOT PGD attacks (c = 0.2, EOT=20) on Bottle, Grid, Toothbrush, Wood from MVTee AD. We also show the difference between the results of PGD and BOT-PGD attacks.
Robust AUC
Robust AUC
Categoty
diff
diff
-PG
L
EOT-PGD
12DPGD
1--EOT-PG
Bottle
88.0
87.0
-1.
95.5
94.3
-1.2
Grid
99.8
99.8
-0.0
99.9
100
+0.1
Toothbrush
95.8
92.5
-3.3
99.4
98.1
-13
Wood
95.2
86
-9.2
95.5
94.4
-1.1
Average 95.8
91.3
-1.5
97.6
96.7
-0.9
Table shows the robust AUC against EOT-PGD attacks and the difference between the results of standard PGD attacks and EOT-PGD attacks on Bottle, Grid, Toothbrush, Wood categories of MVTec AD. We observe that the adversarial robustness is not affected much by FOT. Specifi- cally, the average robust AUC slightly drops 4.5% and 0.9% compared against standard -PGD and PGD attacks, respectively. These results suggest that our method has empirically strong robust- ness against adaptive attacks with EOT. Since other baselines use deterministic inference models, it unnecessary to apply EOT evaluate their adversarial robustness.
5.5 EXTENSION: CERTIFIED ADVERSARIAL ROBUSTNESS
In this section, apply randomized smoothing Cohen et al. 2019) to our diffusion-based anomaly detector and construct a new "smoothed" detector for certified robustness. Given a rell-trained FreeRAD detector Ao(-) that outputs the anomaly score, construct binary anomaly classi-
8

---

Under review as a conference paper at ICLR 2023
fier with any defined threshold h:
f(x) normal, if Aa(x) S h
(5.1)
anomaly, otherwise
Then we can make predictions by constructing Gaussian smoothed FreeRAD and compare with h. The smoothed FreeRAD enjoys provable robustness, which is summarized in the following thcorem:
Theorem 5.1. [Smoothed FreeRAD] Given well-trained FreeRAD detector Ax(x), for any given threshold and
(N I2 D........ if it satisfies P[Aa(x + 6) > h1] 2 Punamaly (h) > 1/2, then
Es [Aooox + 5)] h for all || |/ < R(h) where R(h) = o 1-5-1pp (Punomally (h)). On the other hand,
it satisfies P| Ao + 5) < h 2 (h) 1/2, then Es Ao (x + 8)] < h for all ||8|2 < R(h)
where (1h) σ (Pnormal (h)).
Theorem 1. can be used to certify the robustness of a sample x given any threshold h. The es- timation of (formal(fi) and Panomaly (h) can be done using Monte Carlo sampling similar Cohen et al. (2019). However, the obtained certified radius is highly related to the threshold h. Thus the certified accuracy metric cannot fully represent the quality of the anomaly detection if the inappro- priate threshold is selected. To solve this issue, we also propose the new certified AUC metric for measuring the certified robustness performance at multiple distinct thresholds. Specifically, for each threshold candidate, we can make predictions by E& (Ag( +x++xx+))) +5) and compute certified TPR and FPR according to prediction results and their certified radius. After iterating all possible thresholds, we calculate final AUC scores based on the collection of certified TPRs and FPRs on various thresholds.
Table 6 shows the certified robustness achieved by FreeRAD. For example, we achieve 98 98.2% cer- tified AUC at l2 radius 0.2 gird sub-dataset, which indicates that there does not exist any adver- sarial perturbations 8 (|0'| S 0.2) that can make the AUC lower than 98. 28.2 One major limitation of randomized smoothing anomaly detection tasks is that the noise level otherwise the anomalous features might be covered by the Gaussian noise such that the detector can not distinguish anomalous samples from normal samples. For instance, there is only 12.4% certi- fied AUC on Bottle sub-dataset under the noise level a = 0.25. The performance gap on different datasets (e.g.. 98.2% vs. 12.4%) under the same noise level (o 0.25) indicates that the selection of the noise level might depend on specific anomaly features.
not be much high,
Table 6: Certified AUC on Bottle, Grid, Toothbrush, Wood datasets from MVTec AD benchmark at varying levels of Gaussion noise
Certified AUC la radius
Certified AUC at la radius
Noise
Noise
0
0.05
0.1
0.2
0
0.05
0.1
0.2
σ = 0.0625
99.9
95.7
0
0
0.0625
100
99.9
0
0
0.125
99.9
97.8
92.0
0
0.125
100
100
99.9
0
a 0.25
66.5
47.3
28.8
12.4
0.25
99.6
99.2
98.2
98.2
(a) Bottle
(b) Grid
Certified AUC at la radius
Certified AUC at la radius e
Noise
Noise
0.05
0.2
0.05
0.1
0.2
0.0625
100
98.2
0.0625
98.5
87.9
0
0.125
100
99.4
97.2
σ 0.125
98.3
84.8
a 0.25
100
99.4
98.1
91.7
σ 0.25
96
88.6
79.2
66.7
(c) Toothbrush
(d) Wood
CONCLUSION
Adversarial robustness is a critical factor for the practical deployment of deep anomaly detection models. In this work, we propose an adversarially robust anomaly detector based on the diffu- sion model that leverages reconstruction error to detect anomalies and utilizes the diffusion pro- cess to gradually remove adversarial perturbations for better robustness. We empirically show that our method provides outstanding adversarial robustness while also maintaining strong anomaly de- tection performance on benchmark datasets. One major advantage of our method that it gains adversarial robustness for free: the diffusion model functions both as anomaly detector and an adversarial defender, thus no extra adversarial training or data purification needed as in standard robust image classification tasks.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Samet Akçay, Amir Aaaouu-bbagghuuii.. and Toby P Breckon. Skip-ganomaly Skip connected and adversarially trained encoder-decoder anomaly detection. 2019 International Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2019.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense curity: Circumventing defenses to adversarial examples. In International conference on machine learning, pp. 274-283, PMLR, 2018a.
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference machine learning, pp.
PMLR, 2b.
Paul Bergmann, Sindy Löwe, Michael Fauser, David Sattlegger, and Carsten Steger. Improving un- supervised defect segmentation by applying structural similarity to autoencoders. arXiv preprint 1 20118.
Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger. Mvtec ad-a comprehen- sive real-world dataset for unsupervised anomaly detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9592-9600, 2019.
Paul Bergmann, Kilian Batzner, Michael Fauser, David Sattlegger, and Carsten Steger. The mvtec anomaly detection dataset: a comprehensive real-world dataset for unsupervised anomaly detec- tion. International Journal of Computer Vision, (9944):033-1003) 2021.
Nicholas Carlini, Florian Tramer, Zico Kolter, et al. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206. I0550, 2022.
Jinghui Chen, Saket Sathe, Charu Aggarwal, and Deepak Turaga. Outlier detection with autoencoder ensembles. In Proceedings of the 2017 SIAM international conference data mining, pp. 90-98.
SIAM, 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Niv Cohen and Yedid Hoshen. Sub-image anomaly detection with deep pyramid correspondences. arXiv preprint arXiv:2005.0m 023577, 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International conference on machine learning, pp. 2206- 2216. PMLR, 2020.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794 2021.
Cheng Feng and Pengwei Tian. Time series anomaly detection for cyber-physical systems via neural system identification and bayesian filtering. In Proceedings of the 27th SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 2858-28611 2021.
Tharindu Fernando, Harshala Gammulle, Simon Denman, Sridha Sridharan, and Clinton Fookes. Deep learning for medical anomaly detection-a survey, ACM Computing Surveys (CSUR), 54(7): 1-37, 2021.
Adam Goodge, Bryan Hooi, See-Kiong Ng, and Wee Siong Ng. Robustness of autoencoders for anomaly detection under adversarial impact. In IJCAI, pp. 1244-1250. 2020.
Denis Gudovskiy, Shun Ishizaka, and Kazuki Kozuka. Cflow-ad: Real-time unsupervised anomaly detection with localization via conditional normalizing flows. In Proceedings of the IEEF/CVF Winter Conference on Applications of Computer Vision, pp. 98-107, 2022.
Simon Hawkins, Hongxing He, Graham Williams, and Rohan Baxter. Outlier detection using repli- cator neural networks. In International Conference on Data Warehousing and Knowledge Dis- covery, pp. 170-180. Springer, 2002.
10

---

Under review as a conference paper at ICLR 2023
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, $3:6840-68571 2020.
Jinlei Hou, Yingying Zhang, Qiaoyong Zhong, Di Xie, Shiliang Pu, and Hong Zhou. Divide-and- assemble: Learning block-wise memory for unsupervised anomaly detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 8791-8800, 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Sungwook Lee, Seunghyun Lee, and Byung Cheol Song. Cfa: adaptation for target-oriented anomaly localization. arXiv preprint 2XIi:2206600322.3 2022a.
feature
Sungyoon Lee, Hoki Kim, and Jaewook Lee. Graddiv: Adversarial robustness of randomized neu- ral networks via gradient diversity regularization. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022b.
Chun-Liang Li, Kihyuk Sohn, Jinsung Yoon, and Tomas Pfister. Cutpaste: Self-supervised learning for anomaly detection and localization. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9664-96777 2021.
Yufei Liang, Jiangning Zhang, Shiwei Zhao, Runze Wu, Yong Liu, and Shuwen Pan. Omni- frequency channel-selection representations for unsupervised anomaly detection. arXiv preprint arXiv:2203.00255 2022.
Shao- Yuan Lo, Poojan Oza, and Vishal M Patel. Adversarially robust one-class novelty detection. IEEE Transactions Pattern Analysis and Machine Intelligence, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning, pp. 8162-8171. PMLR, 2021.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML). 2022.
Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM Computing Surveys (CSUR), 54(2):1-38, 2021.
Jonathan Pirnay and Keng Chai. Inpainting transformer for anomaly detection. In International Conference on Image Analysis and Processing. pp. 394 406. Springer, 2022.
Tal Reiss, Niv Cohen, Liron Bergman, and Yedid Hoshen. Panda: Adapting pretrained features for anomaly detection and segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2806-2814 14, 2021.
Olaf Ronneberger, Philipp
Fischer, and Thomas Brox. U-net: Convolutional networks for biomedi- cal image segmentation. In International Conference Medical image computing and computer- assisted intervention, pp. 234-241. Springer, 2015.
Marco Rudolph, Tom Wehrbein, Bodo Rosenhahn, and Bastian Wandt. Fully convolutional cross- scale-flows for image-based defect detection. In Proceedings of IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 1088-1097, 2022.
Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dietterich, and KlbustRobert Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 10965):756-795 2021.
Jascha Sohl-Dickstein. Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learn ing, pp. 2256-2265. PMLR, 2015.
11

---

Under review as a conference paper at ICLR 2023
Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in Neural Information Processing Systems, 32, 2019.
Yang Song and Stefano Ermon. Improved techniques for training acore-based generative models. Advances in neural information processing systems, 13:12438-122 12448, 2020.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- fional Conference on Learning Representations, 2021.
Ming Sun, Ya Su, Shenglin Zhang, Yuanpu Cao, Yuqing Liu, Dan Pei, Wenfei Wu, Yongsu Zhang, Xiaozhou Liu, and Junliang Tang. Ctf: Anomaly detection in high-dimensional time series with coarse-to-fine model transfer. In IEEE INFOCOM 2021-IEEE Conference on Computer Commu- nications, pp. 1-10. IEEE, 2021.
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility structural similarity. IEEE transactions on image processing, 13(4):600- 612, 2004.
Julia Wolleb, Florentin Bieder, Robin Sandkühler, and Philippe C Cattin. Diffusion models for medical anomaly detection. arXiv preprint urXiv:2203.04000 2022.
Julian Wyatt, Adam Leach, Sebastian M Schmon, and Chris G Willcocks. Anoddpm: Anomaly detection with denoising diffusion probabilistic models using simplex noise. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 650-656, 2022.
Jingkang Yang. Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey, arXiv preprint arXiv:2110.11334 2021.
Jiawei Yu, Ye Zheng, Xiang Wang. Wei Li, Yushuang Wu, Rui Zhao and Liwei Wu. Fast- flow: Unsupervised anomaly detection and localization via 2d normalizing flows. arXiv preprint arXiv:2111.07677, 2021.
Vitjan Zavrtanik, Matej Kristan, and Danijel Skočaj. Reconstruction by inpainting for visual anomaly detection. Pattern Recognition, 112:107706 2021.
Chong Zhou and Randy C Paffenroth. Anomaly detection with robust deep autoencoders. In Pro- ceedings of the 23rd ACM SIGKDD international conference knowledge discovery and data mining, pp. 665 665-674,70 2017.
12

---

Under review as a conference paper at ICLR 2023
A TRAINING OBJECTIVE OF THE DIFFUSION MODEL
In this section, we introduce the hybrid training objective proposed by (Nichol & Dhariwal 2021 Specifically, training diffusion models can be performed by optimizing the commonly used varia- tional bound on negative log-likelihood as follows (Ho et al. 2020):
Lvb = Lo + L1 .... + LT-1 + LT
(A.1)
Lu log po (xo|xx)
(A.2)
-1 = D ( X2, Xo) po) (xt
(A.3)
LT DKL (x (p))))((xr
(A.4)
Ho et al. (2200) suggest that directly optimizing this variational bound Leb would produce much more gradient noise during training and propose a reweighted simplified objective siimlle:
siimle
Et, .[le co(x,, t)]]-
(A.5)
However, this Lsimple model suffers from sample quality loss when using reduced number of denoising steps (Nichol Dhariwal 2021). Nichol Dhariwal (02T) find that training diffusion models via a hybrid objective:
Laybrid = simple + AL
(A.6)
greatly improves practical applicability by generating high-quality samples with fewer denoising steps, which is helpful for using diffusion models on applications with high-efficiency requirements such as real-time anomaly detection (Sun et al., 202T). In particular, we parameterize the variance
term (x, t) in 4. as an interpolation between 3, and 33 in the log domain following (Nichol
X,,
& Dhariwal 2021)
Σx(x,, t) exp(v log 3:
v) log 3:)
(A.7)
where is the model output. Following Nichol & Dhariwal (202)). set 0.001 and apply stop-gradient to the (x,, t) output for Lub to prevent Lub from overwhelming Limple
B ADDITIONAL ALGORIHTM
B.1 ARBITRARY-SHOT ROBUST RECONSTRUCTION IN FREERAD
In this section, we attach the complete algorithm for arbitrary-shot robust reconstruction motivated by NNihool & Dhariwal 2021). Given an arbitrary denoising steps S = {Sm, Sm-1 Si {m < k, Sm Sm > S1 >= 1), in each step E [1, m]. we iteratively predict the true point given the current diffused data Xs., termed Xo. them sampling new iterate xs.., according to the current prediction Ng and current diffused data x
Algorithm Arbitrary-shot Robust Reconstruction in FreeRAD
Input: Test images: x. diffusion steps: k, arbitrary generation steps: {S m. Sm-1. S1 (m S k, k S., > Sm-1 ... > S 1) Output: Reconstructions of x: X
S
1: =x
2: E I
3: VaxXD v1 ag6
4: for m,...., do
arbitrary-shot denoising
5: Xo Vas,
(xs.
VI ūss E0 (x,s
6: ift then
7: Z 10
xs. / (x( St)Jz V u.s As X0
V agg (1 (1- )
8:
Xs:
1-as,
--,
9:
end
end for
11: X X0
13

---

Under review as a conference paper at ICLR 2023
B.2 ANOMALY SCORE CALCULATION
In this section, we attach the complete algorithm for anomaly score calculation. Given test image RC* and its reconstruction x RCxH obtained by FreeRAD, we first calculate the Multiscale Reconstruction Error Map. In particular, we choose a scale schedule L = {1, 2' 4 8 For each scale I, we compute the emror map Err(x, X), between the downsampled input x and the downsampled reconstruction X with č E (x' - x))ec..l where the square operator here refers to element-wise square operation, then unsampled to the original resolution. The final Errms is obtained by averaging each scale's s error map and applying mean filter for better stability similar to Zavrtanik et al. 22021: ExTms(x,3) = -N. EIEL ErT(x, x)²) faxs where fexe is the mean filter of SIZe x s, * IS the convolution operation. Similar to Pirnay & Chai (2022). we take the pixel-wise maximum of the absolute deviation of the Errms (x, x) the normal training data as the
scalar anomaly score.
Algorithm Anomaly Score Calculation in FreeRAD
Input: Test image: x RCXHxW Reconstructed image: x RCxHxW Output: Anomaly score: A(x)
1: for in L {1, 8 do
L is downsampling scale schedule
2: x = downsample( (4, x) E I2X((XH)XXXX)
3: X = downsample(4.. x) E (RC
4:
Err(x, x); = upsample( 1, De (x' x (ang) E #xw
element-wise square
5: end for
6: EI (x, x) = NNZ Elel ExT(x, x)1) faxa E lxw
> fsxs is mean filter of size (s x s)
7: A(x) max ma (x Nu Σxez En (z, 2))
> Z is the of normal training images
C MORE DETAILS OF EXPERIMENTAL SETTINGS
C.I HYPERPARAMETERS OF THE DIFFUSION MODEL
The diffusion model in our experiments uses the linear noise schedule (Ho et al. 2020). The number of channels in the first layer is 128, and the number of heads is 1. The attention resolution is 16 x 16. We adopt PyTorch as the deep learning framework for implementations. We train the model using Adam optimizer with the learning rate of 10-1 and the batch size of 2. The model is trained for 30000 iterations for all categories of data. We set diffusion steps T = 1000 for training. We list the choice of & for each category as follows:
Table 7: The choices of k for each category of MVTec AD dataset
categories
50
Capsule, Pill, Bottle, Leather, Tile, Zipper
100
Grid, Screw, Toothbrush, Wood Transistor, Hazelnut, Carpet, Cable
200
300
Metal Nut
D MORE EXPERIMENTAL RESULTS
D.1 IMPACT OF DIFFUSION STEP
Here first provide anomaly detection performance of proposed FreeRAD on clean data at varying diffusion steps at inference time. We test with t E (25, 50, 100, 200, 300}. As shown in Table different datasets may not have the same optimal k. A principle for anomaly detection on clean
14

---

Under review as a conference paper at ICLR 2023
data is that k should be chosen such that the amount of Gaussian noise is dominating the anomaly signals while the high-level features of the input data are still preserved for reconstruction. In terms of the adversarial data, & should also be large enough to add sufficient Gaussian noise to dominate adversarial perturbation. As Table 9 we can see that our method obtains the best performance on clean data at ko 25. However, the robust AUC is not satisfying, since the noise added in the diffusion process cannot dominate the adversarial perturbations. Therefore, we can choose larger k (e.g., 50) to obtain better robust performance with slight performance loss on clean data.
Table 8: AUC results on 15 categories from MVTec AD at varying diffusion steps k at inference time
Category
k = 25
k: = 50
k = 100
h: = 200
h: = 300
Carpet
71.8
64.9
73.8
82.7
80.9
Texture
Grid
100
100
100
100
100
Leather
100
100
100
99.3
98.4
Tile
100
99.2
95.4
81.4
74.0
Wood
95.4
98.2
98.3
97.9
97.1
Bottle
98.9
100
99.6
99.1
97.9
Cable
78.9
78.8
79.2
79.5
77.7
Capsule
96.3
93.9
90.5
84.6
80.7
Hazelnut
95.8
96.2
97.3
97.5
96.2
Object
Metal Nut
79.5
83.8
91.0
91.3
93.5
Pill
98
97.2
94.4
86.6
68.6
Screw
97.3
95.0
99.3
80.8
66
Toothbrush
100
100
100
99.7
99.7
Transistor 87.5
87.8
90.6
93.7
93.2
Zipper
100
100
99.7
96.4
95.0
Table 9: Standard AUC and robust AUC against L2-PGD attacks (e = 0.2) at varying diffusion step k Capsule and Pill from MVTec AD.
k 25
k 50
Category
Standard AUC
Robust AUC
Standard AUC
Robust AUC
Capsule Pill
96.3
49.5
68.1 93.9 97.2
53.9
80.3
D.2 REDUCING DENOISING STEPS
In this section, provide the anomaly detection performance of FreeRAD clean data vary- ing denoising steps in Table [0]b by rumning Algorithm 3 for reconstruction and using Algorithm to compute anomaly score. Specifically, shot denoising (1-step) to full-shot denoising (k-step) and intermediate settings such as 0.05k, 0.1 0.25k, and 0.5k. We datasets. Moreover, we report the inference time (in seconds) at varying denoising steps in Table []] on an NVIDIA TESLA K80 GPU, where the inference time increases linearly with denoising steps. We show that the inference with one-shot denoising could process single image in 0.5 seconds, which demonstrates the applicability of our method FreeRAD on real-time tasks. These experimen- tal results clearly indicate that FreeRAD with reconstruction by one-shot denoising achieves both best detection effectiveness and time efficiency.
test with several denoising steps schedules from
that one-shot denoising obtains the highest AUC scores all four
D.3 COMPARISON WITH ROBUST ANOMALY DETECTION METHODS
In this section, compare method FreeRAD with robust anomaly detection methods such as Robust Autoencoder (Zhou Paffenroth 2017). which was proposed to handle noise and outlier data points, although the adversarial perturbation not explicitly considered in their work. Table clearly shows that our method still largely outperforms RAE no both clean data and adversarial data.
15

---

Under review as a conference paper at ICLR 2023
Table 10: AUC results on Screw, Toothbrush, Wood, Transistor at varying denoising steps. The choice of k for each category follows Table 7
Category
1-step
0.05
0.1k-sttep
0.25k-step
0.5k-step
k-step
Screw
99.3
97.3
96.8
97.2
95.1
96.4
Toothbrush
100
99.7
100
99.4
100
100
Transistor
93.7
92.3
87.2
89.5
82.1
86.2
Wood
98.3
97.1
98.2
95.9
98.2
96
Table 11: Inference time (in seconds) for a single image on Toothbrush and Transistor by varying denoising steps, where the inference time increases over one-shot denoising given in parenthe- sis.The The choice of k for each category follows Table
Category
1-step
0.05k-step
0.1k-step
0.25k-step
0.5k-step
k-step
Toothbrush
0.5
2x28(x4.6)
4. (x9.3)
(x23.6)
(x.03(x46.1)
(x92.)
Transistor
0.5
4.98 10)
10.01 (x20)
(x
50 (x100)
99.78 (x 199.6)
Table 12: Average standard AUC and robust AUC against 1.0 -PGD(E 2/255), 12-PGD = 0.2))
attacks MVTTe AD, obtained by RAE and ours.
Robust AUC
Method
Standard AUC
1.0 -PG
1-PPGD
RAE
57.1 95.7
16.8
49.8
FredAD
80.5
88.8
D.4 DEFENDING AGAINST AUTOATTACK
We have shown that FreeRAD is robust to adaptive attacks EOT-PGD in Section 5.4 In this section, incorporate additional strong attack haselines, AutoAttack (Croce & Hein 2020) which ensem- ble multiple white-box and black-box attacks such as APGD attacks and Square attacks. Specif- ically, we used versions of AutoAttack: (i) standard AutoAttack and (ii) random AutoAttack (UOTtAutAttaack) which is used for evaluating stochastic defense methods. We summarize the standard AUC and robust AUC of our proposed FreeRAD in the following Table T3 The robust AUC scores of FreeRAD against AutoAttack are still largely higher than other SOTAs against rel- atively weaker PGD attacks as shown Table 2 and thus there is no need evaluate other methods' robustness against stronger AutoAttack.
Table 13: Standard AUC and robust AUC against Los AutoAAttackee 2/255), l2 AuttoAAAtee 0.2)) on Bottle, Grid, Toothbrush, Wood from MVTec AD
Robust AUC
Category
Standard AUC
1.0 -taaddadd AA
12-standard AA
loc le--radom AA
12-random AA
Bottle
100
76.5
87.8
73.4
87.6
Grid
100
98.2
99.2
98.2
98.8
Toothbrush
100
73.6
84.2
65.8
86.1
wood
99.8
72.3
75.2
64.8
75.3
Average
100
80.1
86.6
75.6
87.0
16

---

Under review as a conference paper at ICLR 2023
D.5 EXPERIMENTS ON NOVELTY DETECTION DATASET
Novelty Detection (i.e., semantic anomaly detection) refers to the problem of determining if test data is from the known class (normal) or novel class (anomalous) (Yang et al. (02T). We perform experiments with novelty detection on the CIFAR-10 dataset (Krizhevsky et al. 2009) which has 10 categories with 60000 natural images. Under the setting of novelty detection, one category is regarded as known class, and other categories are considered novel classes. Hence we train the corresponding model for each category respectively. We evaluate and compare our proposed FreeRAD with several SOTA methods that include FastFlow (Yu et al. 2021). and CFA (Lee al.) 2022ah. We summarize the standard AUC and robust AUC against (20 PGD and P2DP attacks in Table 14 The results show that our method still largely outperforms the baselines method regarding robust AUC while maintaining a strong novelty detection performance on clean data.
Table 14: Standard AUC (in parenthesis) and robust AUC against 4x PGD attacks and 12-PGD attacks (c = 0.2) on CIFAR-10 dataset, obtained by different Mate-of-the-ar anomaly detectors and ours.
2/255)
Attacks
1no -PD
12-PGD
Category
FastFlow
CFA
FreeRAD(OUrr)
FastFlow
CFA
FreeRAD(OUrs)
Bird
(63(63.0)
(.3(68.1)
57.9(71.9)
(.30)))0)
(.7(1).1)
(
Plane
(.4.2)
1,2(71.8)
54.9
10.3(74.2)
3.5(71.8)
64.8
Car
1.9(81.7)
(70(7).3)
50.6 50.6(70.4) (70.4)
(.9(81.7)
3.9(76.3)
(7..)
Cat
(42(6)))
(.3(68.7)
28.7 28.7(56.17 (56.7)
0.8(45.6)
1.3(58.7)
38.9 (5.7
Deer
(36.1)
1.0(74.6)
60.5 (71.5)
1.6(56.1)
5.4(71.6)
63. (3.2(71.5)
Dog
1.0(72.7)
1.0(64.5)
39.1 (56.4)
3.7(72.7)
3.0(64.5)
(5..4
Frog
((79.7)
0.9(81.7)
(9.6 (71.3)
1.5(79.7)
5.2(81.7)
(71.3
Horse
1.2(7).4)
1.6(74.9)
47.1 (00.4)
4.6(76.4)
5.0(74.9)
51.7
Ship
(81(2).2)
(.3(01.0)
65. 65.2
(.0())
5.6(81.0)
68.9 68.9(77.5)
Truck
(87(8).7)
0.4(74.8)
23.2
13.1
3.9(74.8)
28.5
Average
1.5(71.4)
(.8(72.6)
48.7 (66.0)
(.3(41.4)
3.9(72.6)
54.8(06.0)
E MORE ANALYSIS OF THE ADVERSARIAL ROBUSTNESS OF DDPMs
In this section, we provide more thcoretical analysis on the defense mechanism of DDPMs. Since the adversarial perturbations would be dominated by the added noise from the diffusion process, such that the clean data distribution and adversarially perturbed data distribution get closer. Intuitively, after performing the full diffusion process, any data would converge to pure standard Gaussian as mentioned in Section 4.1 This suggests that the tiny adversarial perturbations will be gradually washed out and have little effect the final output after denoising. Moreover, the stochasticity in- troduced from the sampling in the diffusion process (.q makes it well-suited for combining with randomized smoothing strategies and building certified robustness without much loss on anomaly detection performances. The following theorem confirms that the diffusion process in DDPMs could make the Kll-divereence of diffused clean data distribution and diffused adversarially perturbed data distribution decreases gradually.
Theorem E. Given any clean data distribution p(x) and adversarially perturbed data distribution (x)), we denote by Pt the distribution of x, derived from the t-step diffusion process Eq. 4.2 when Xo p(x). Accordingly, we denote by di the distribution of derived from the t-step diffusion process when Xo ~ qxx). If E [J and + oc, the diffusion process DDPM converges to continuous process and
@D (p:lle) 0
0t
ie., the KL-divergenne of Pt and gt monotonically decreases during the diffusion process.
17

---

Under review as a conference paper at ICLR 2023
Proof: The proof mainly follow from Song et al. (2021): Nie al. (2022).
Following derivations from Song et al. 2021), the discrete Markov chain used in DDPM x;
vI - - + VB T.
can be re-written
3 T
B T E-1 i= T
(E.1)
where 3; = =. When - 0a, B, becomes function ((t) indexed by t E [0, 1]. Denote Br, X and E; as B ()), x (),, and + respectively, we can rewrite Eq. E.1 as below:
x(t + At) V1 8(t (t)Atx(t) v B(t At)Ate(t)
1
x() 7 3(1 A() + v BBLL+ At)AVE(()
2 x(1) ((1)AIx(1) + ((t)
(E.2)
where At 7. t {0,
T-11 and the approximate equality holds when At < 1. Hence in converges continuous time SDE:
N.
T
the limit of and
0, Eq.
dx 2 3()xxll + BB(Jjdw.
Let denote [(, () == 3())x and g(() = V3(1). Following the same proof as in Theorem 3.1 in Nie et al. 2022), we have
(PKllPill::)
Ot - (F)
where Dr(pellg == ʃ [x)) log (x)) have
log (x))(())12d)) 2 0 and (p(pil) = 0ff p. = thus
0D 11
S 0.
0t
18


Reviews:
[{"review_id": "Tp-VW-qS_Gl", "reviewer": "Reviewer_sKar", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper develops an adversarially robust anomaly detection through the diffusion model, called FreeRAD. This paper makes an interesting finding that leveraging the diffusion model for anomaly detection can achieve adversarial robustness for free. Experimental results show that the model can still achieve good performance on adversarial samples assembled by PGD and BPDA.", "summary_of_the_review": "I like the interesting finding in this paper but believe more experimental results could make this paper stronger.", "strength_and_weaknesses": "Strength\n\n- The paper has an interesting finding.\n- The proposed implementation trick can achieve real-time anomaly detection.\n\nWeakness\n- On the clean data, FreeRAD cannot beat the baseline CFA.\n-  I think more attacking approaches can be incorporated for evaluation. \n- Currently, a few diffusion model-based anomaly detection approaches have been developed. I am curious whether the existing diffusion model-based anomaly detection models are also robust to adversarial attacks.  By further examining the following approaches, we may know whether the adversarial robustness is from the diffusion model or the implementation ideas developed in this paper.\n\n   - Wyatt, Julian, et al. \"AnoDDPM: Anomaly Detection With Denoising Diffusion Probabilistic Models Using Simplex Noise.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. 2022.\n   - Wolleb, J., Bieder, F., Sandkühler, R., Cattin, P.C. (2022). Diffusion Models for Medical Anomaly Detection. In Medical Image Computing and Computer Assisted Intervention – MICCAI 2022. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "DfXBUuCgt-", "reviewer": "Reviewer_u5qy", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes an anomaly detection (AD) method based on the diffusion model. Training a diffusion model on unlabeled data (mostly assumed to be normal), the reconstruction error is proposed as an anomaly score (similar to using autoencoders for AD). In addition, using the diffusion model to \"diffuse\" an input (i.e. adding noise by partially applying the concatenated diffusion model maps) and afterwards reconstructing it, the model is also used for mitigating adversarial perturbations. An experimental evaluation on MVTec-AD is presented showing that the proposed method achieves a similar anomaly detection performance as existing state-of-the-art methods while demonstrating an improved adversarial robustness.", "summary_of_the_review": "I enjoyed reading this paper and think the presented contributions w.r.t. adversarially robust anomaly detection are interesting and relevant, but the paper is strongly limited in only evaluating on a single dataset which is rather specific. Claims such as in the Conclusion (\"We empirically show that our method provides outstanding adversarial robustness while also maintaining strong anomaly detection performance on benchmark datasets.\") are simply too far-fetched in my opinion for the provided evidence, which should be corrected for (either by adding more datasets or limiting claims to MVTec-AD).", "strength_and_weaknesses": "*Strengths*\n+ The paper presents a coherent framework for adversarial attacks on anomaly detectors (targeting both anomalies to appear normal and normal data points to appear anomalous) and evaluates several existing methods w.r.t. their adversarial robustness, finding that many existing methods suffer from not being adversarially robust.\n+ The experiments show that the proposed method achieves strong adversarial robustness while maintaining a comparable state-of-the-art detection performance on MVTec-AD.\n\n*Weaknesses*\n- I find the main weakness of the paper to lie in the experimental evaluation, which only considers *one* dataset (MVTec-AD). This strongly limits evidence for some of the (fairly general) made claims in the paper. Defect detection on MVTec-AD, where anomalies are rather subtle and low-level, is quite distinct from other visual anomaly detection tasks (e.g. detecting novel classes).\nThis is (implicitly) acknowledged in the paper: \"Note that $k$ should be chosen such that the amount of Gaussian noise is dominating the adversarial perturbations and anomaly signals while the high-level features of the input data are still preserved for reconstruction.\"\nYet, there is no broader discussion on this point, which I think would be critical.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "BJ3DLI-msR", "reviewer": "Reviewer_4wM3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper tries to construct an adversarially robust anomaly detector (note that this is different from constructing an classifier because we only need to do a binary classification of anomaly or not) directly using the diffusion models. The idea is to directly use the reconstruction score in diffusion model to indicate whether this is an anomaly or not -- and since reconstruction is resilient to adversarial perturbations, we don't need extra work", "summary_of_the_review": "This paper seems a solid work, but at this point it reads to me more like ``nice properties of diffusion models -- it can be directly applied as an anomaly detector that also achieves robustness''. If so, please clarify this in the paper. If not -- please clearly discuss what are the revisions to the existing diffusion models.", "strength_and_weaknesses": "1. The use of diffusion models directly as an anomaly detector (and achieves adversarial robustness) seems novel\n2. The paper is clearly written, and easy to follow\n3. There seems to have systematic experiments to validate the claim\n\nOn the other hand, my main objection at this point is that it seems to be a direct application of diffusion models without any modification (so it is like -- ``surprise, diffusion models also have these nice properties!''). For example, Algorithm 1 seems to be just the reverse process in diffusion models (inlining the sampling algorithm?)\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "-WLJriGmkI", "reviewer": "Reviewer_BFFe", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper focuses on anomaly detection models and proposes an adversarially robust anomaly detector based on the diffusion model. In detail, they first add gaussian to the image through the forward process, and then reconstruct it through the reverse process;  the Multiscale Reconstruction Error Map is computed as the anomaly score. In the experimental part, they compare the proposed method with SOTAs to show the advantage and combine with randomized smoothing to reach some certified robustness. \n", "summary_of_the_review": "This paper leverages the diffusion model to create a robust anomaly detector and provides experimental results to support their claim. It is well-written and the illustration of the methodology is clear. The novelty is not obvious, and the experimental results need a better explanation otherwise it will confuse the reader.", "strength_and_weaknesses": "Strength: \nThis paper is well-written and easy to follow. The proposed method takes advantage of the smoothing property of the diffusion model and reaches robust anomaly detection. Experiments on widely-used anomaly detection benchmarks are conducted, and the performance is compared with SOTAs to better illustrate the performance of the proposed method. \n\nWeakness: \n- Some experimental results are not very convincing, especially in table 1, where most of the SOTAs fail under PGD attack, but not sure if this is due to the lack of parameter tuning. \n- The idea of applying the diffusion model is not very novel and is similar to the idea in the paper Diffusion Models for Adversarial Purification which also uses the diffusion model to remove adversarial perturbations. \n- The comparison with defense-enabled anomaly detectors is not very convincing, and the comparison with more methods should be added. \n- This paper does not involve other robust anomaly detection methods in the experiment.\n- The experiment of defending against the adaptive attack needs more clarification. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject