Deep Active Anomaly Detection With Diverse Queries
Authors: Aodong Li
Chen Qiu
Padhraic Smyth
Marius Kloft
Stephan Mandt
Maja Rudolph
Venue: Submitted to ICLR 2023 (2023)
Keywords: deep anomaly detection
active learning
diversified sampling

Abstract: Selecting informative data points for expert feedback can significantly improve the performance of anomaly detection in various contexts, such as medical diagnostics or fraud detection. In this paper, we determine a set of conditions under which the ranking of anomaly scores generalizes from labeled queries to unlabeled data. Inspired by these conditions, we propose a new querying strategy for active anomaly detection that leads to systematic improvements over current approaches for this problem. It selects a diverse set of data points for labeling, achieving high data coverage with a limited budget. These labeled data points provide weak supervision to the unsupervised anomaly detection problem. However, correctly identifying anomalies requires an estimate of the fraction of anomalies in the data. We show how this anomaly rate can be estimated from the query set by importance-weighting, removing the associated bias due to the non-uniform sampling procedure. Extensive experiments on image, tabular, and video data sets show that our approach results in state-of-the-art active anomaly detection performance.

Under review as a conference paper at ICLR 2023
DEEP BATCH ACTIVE ANOMALY DETECTION WITH DIVERSE QUERIES
Anonymous authors Paper under double-blind review
ABSTRACT
Selecting informative data points for expert feedback can significantly improve the performance of anomaly detection in various contexts, such as medical diagnostics or fraud detection. In this paper, we determine a set of conditions under which the ranking of anomaly scores generalizes from labeled queries to unlabeled data. Inspired by these conditions, we propose a new querying strategy for batch active anomaly detection that leads to systematic improvements over current approaches. It selects a diverse set of data points for labeling, achieving high data coverage with limited budget. These labeled data points provide weak supervision to the unsupervised anomaly detection problem. However, correctly identifying anoma- lies in the contaminated training data requires estimate of the contamination ratio. We show how this anomaly rate can be estimated from the query set by aepportance-eiighingg
removing the associated bias due to the non-uniform sam- pling procedure. Extensive experiments on image, tabular, and video data sets show that our approach results in state-of ofr active anomaly detection performance.
INTRODUCTION
Detecting anomalies in data a fundamental task in machine learning with applications in various domains, from industrial fault detection to medical diagnosis. The main idea is to train model (such as a neural network) on a data set of "normal" samples to minimize the loss of an auxiliary (e.g., self-supervised) task. Using the loss function to score test data, one hopes to obtain low scores for normal data and high scores for anomalies (Ruff et al., 2021). Oftentimes, the training data is contaminated with unlabeled anomalies, and many approaches either hope that training will be dominated by the normal samples (inlier priority, Wang et al. (2019)) or try to detect and exploit anomalies in the training data (e.g., Qiu al. (2022a)).
In some set-ups, expert feedback is available to check if individual samples are normal or should be considered anomalies. These labels are usually expensive to obtain but are very valuable guide an anomaly detector during training. For example, in a medical setting, one may ask a medical doctor to confirm whether given image shows normal abnormal cellular tissue. Other application areas include detecting network intrusions or machine failures. As expert feedback is typically expensive, it is essential to find effective strategies for querying informative data points.
Previous work on active anomaly detection primarily involves domain-specific applications and/or ad hoc architectures, making it hard to disentangle modeling choices from querying strategies (Trittenbach et al., 2021). This paper aims to disentangle different factors that affect detection accurary. We theoretically analyze generalization performance under various querying strategies and find that diversified sampling systematically improve over existing popular querying strategies, such as querying data based on their predicted anomaly score or around the decision boundaries.
Based on these findings, propose active latent outlier exposure (ALOE): state-of-the-ar active learning strategy compatible with many unsupervised and sulf-super losses for anomaly detec- tion (Ruff et al., 2021; Qiu et al., 2022a). ALOE draws information from both queried and unqueried parts of the data based on two squally-wigghte anomaly rate- can be efficiently estimated based on importance sampling estimate. We show multitude of data sets (images, tabular data, and video) that ALOB leads to a new state of the art.
losses. Its sole hyperparameter the assumed
In summary, main contributions follows:

---

Under review as a conference paper at ICLR 2023
1. We prove that the ranking of anomaly scores generalizes from labeled queries to unlabeled data under certain conditions that characterize how well the queries cover the data. Based on this theory, we propose diverse querying strategy for batch active anomaly detection.
We propose ALOE, a new active learning framework compatible with large number of deep anomaly detection losses. It trains on both the labeled queries and the unlabeled data and we characterize in Thm. how the performance on the queried samples generalizes to the unlabeled training data. We also show how all major hyperparameters in ALOE can be eliminated, making the approach easy to use. To this end, we provide an papprtance-sampling-bbe -based estimate for the rate of anomalies in the data.
3. We provide an extensive benchmark for deep active anomaly detection. Our experiments on image, tabular, and video data provide evidence that ALOE with diverse querying, outperforms existing methods significantly. Comprehensive ablations disentangle the benefits of each component.
Our paper is structured as follows. Section 2 discusses related work in deep active anomaly detection. Section 3 introduces our main algorithm. Section discusses experimental result on image, video, and tabular data. Finally, we conclude this work in Section 5.
2 RELATED WORK
Deep Anomaly Detection. Many recent advances in anomaly detection are in the area of deep learning Ruff et al. (2021). One early strategy was to use autoencoder- (Principi et al., 2017; Zhou and Paffenroth, 2017: Chen and Konukoglu, 2018) or density- -based (Schlegl et al., 2017; Deecke et al., 2018) models. Another pioneering stream of research combines one-class classification (Schölkopf et al., 2001) with deep learning for unsupervised (Ruff et al., 2018) and semi-supervised (Ruff' et al., 2019) anomaly detection. Many other approaches to deep anomaly detection are sele-super They employ self supervised loss function to train the detector and score anomalies (Golan and El- Yaniv, 2018; Hendrycks et al., 2019; Bergman and Hoshen, 2020; Qiu et al., 2021; Shenkar and Wolf, 2022; Qiu al., 2022b). Our work resides in the self-supervised anomaly detection category and can be extended to other data modalities an appropriate loss is provided.
While all these methods assume that the training data consists of only normal samples, in many prac- tical applications, the training pool may be contaminated with unidentified anomalies (Vilhjálmsson and Nordborg, 2013; Steinhardt al., 2017). This can be problematic because the detection accuracy typically deteriorates when the contamination ratio increases (Wang et al., 2019). Addressing this, refinement (Zhou and Paffenroth, 2017: Yoon et al., 2021) attempts to cleanse the training pool by removing anomalous samples therein, although they may provide valuable training signals. As remedy, Qiu et al. (2022a) propose to jointly infer binary labels to each datum (normal vs. anomalous) while updating the model parameters of a deep anomaly detector based on outlier exposure. Our work also makes the contaminated data assumption and employs the training signal of abnormal data.
Active Anomaly Detection. Active learning for anomaly detection was pioneered in Pelleg and Moore (2004). Most research in active anomaly detection is on shallow detectors. Many works query samples that are close to the decision boundary of one-class SVM (Görnitz al., 2013; Yin et al., 2018) or a density model (Ghasemi et al., 2011) 1). Siddiqui et al. (2018); Das et al. (2016) propose to query the most anomalous instance, while Das al. (2019) employ a tree-based ensemble to query both anomalous and diverse samples. A recent survey compares various aforementioned query strategies applied to one-class classifiers (Trittenbach et al., 2021).
Recently, deep active anomaly detection has received a lot of attention. Pimentel et al. (2020) query samples with the top anomaly scores for autoeneoder-basse methods, while Ning et al. (2022) improve the querying by taking diversity into consideration. Tang et al. (2020) use an ensemble of deep anomaly detectors and query the most likely anomalies for each detector separately. Russo et al. (2020) query samples where the model is uncertain about the predictions. Pang et al. (2021) and Zha et al. (2020) propose querying strategies based on reinforcement learning, which requires additional labeled datasets. In contrast, our work does not require a labeled dataset to start active learning, Our work is also not comparable to Pelleg and Moore (2004) and Ghasemi et al. (2011), who fit a density model on the raw input data, which is known to be problematic for digheiineniional data (Nalisnick et al., 2018). Other querying strategies from the papers discussed above are fairly general and can be applied in combination with various backbone models. In this paper study these methods in the
2

---

Under review as a conference paper at ICLR 2023
batch active anomaly detection setting. For fair comparison, apply their meta- strategies to the same oftte-of-the-ar backbone model that our proposed method uses in our experiments (see details in Tab. 1 and Sec. 4).
Batch Active Learning. Like Hoi et al. (2006a) our work considers the batch active anomaly detection setting. Here assumed that labeling can be performed only once. Either because interacting with the expert for labeling is too expensive or because retraining the model with each additional query is too inefficient (Hoi et al., 2006a). The batch setting is widely studied in deep active learning (Sener and Savarese, 2018; Ash et al., 2020; Citovsky al., 2021; Pinsler et al., 2019; Hoi et al., 2006b; Guo and Schuurmans, 2007) but is still under-explored in active anomaly detection.
3 METHODS
A successful method for active anomaly detection will involve strategy for selecting informative data points to be labeled these are called the queries - and a training strategy that best exploits the labeled (and unlabeled) data. We first review recent deep learning losses for anomaly detection (Sec. 3.1), before proposing a new approach for batch active anomaly detection in Secs. 3.2 to 3.4.
In Sec. 3.2, we analyze querying strategies for active anomaly detection. We determine set of conditions that guarantee that the ranking in terms of the anomaly score provably generalizes from the labeled queries the unlabeled data. Based our theory, we derive diverse querying strategy. Once the queries are labeled, we can use the union of the queried data and the unlabeled data to train the model. Our proposed loss is presented in Sec. 3.3. This approach has important hyperparameter which corresponds to the expected fraction of anomalies in the data. While previous work has to assume that a is known (Qiu et al., 2022a), active learning presents an opportunity estimate it. The estimate has to account for the fact that the optimal querying strategy derived from our theory in Sec. 3.2 not i.i.d. In See. 3.4, we provide an estimate of for any stochastic querying strategy.
3.1 BACKGROUND
Active Anomaly Detection. We assume a dataset where each sample associated with a feature E Rd and binary anomaly label The label y = O stands for normal and y stands for abnormal data. While most samples are normal, the dataset contaminated with a fraction of a anomalies, The goal is to learn parametric function S(æ) that associates every input æ with real-valued anomaly score. A high anomaly score is predictive of y = 1 and a low anomaly score is predictive of y = 0. To train S, one has access to unlabeled data with index set denoted by U and labeled data with index set denoted by Q. The number of queries corresponds to the labeling budget [Q]. Once S is trained, it can be used rank new samples according to their anomaly score.
Supervised Anomaly Detection. One possibility is use only the labeled data to train S in supervised manner (Gömitz et al., 2013; Hendrycks et al., 2018). It requires two related loss functions with shared parameters 0 parameterizing the function S. The first loss (x) LS(S(x; 8)) only involves normal samples, while (ar) = I, (Sxc; 0)) is the loss for the anomalies. Options for T. (m) include an autoencoder loss, the Deep SVDD loss,
neural transformation learning objective
(Zhou and Paffenroth, 2017; Ruff et al., 2018; Qiu et al., 2021). The loss L((x) for abnormal data, is typically chosen to have complementary effect! 1, With the labeled queries Q. the supervised loss
(o
(1)L)(0)) + (1 ())L
(I)
JEQ
Latent Outlier Exposure. Latent outlier exposure (LOE, (Qiu et al., 2022a)) is an unsupervised anomaly detection framework that uses the same loss Eq. (1) but treats the labels y latent variables. An EM-style algorithm alternates between optimizing the model parameters and inferring the labels y. For this, Qiu et al. (2022a) have assume that the ranking of data anomaly scores is correct and the contamination ratio a is known.
For example, in Deep SVDD (Ruff et al., 2018), (a) is the squared distance between æ and a normality center in feature space, and (z)) 1/Tā(=))
3

---

Under review as a conference paper at ICLR 2023
In this work, we propose active latent outlier exposure (ALOE). We next present the querying strategy and when the querying strategy leads to correct ranking of anomaly scores (Sec. 3.2), the ALOE loss (Sec. 3.3), and how the hyperparameter a can be eliminated (Sec. 3.4).
3.2 ACTIVE QUERYING FOR ANOMALY DETECTION
The first ingredient of an active anomaly detection method is a querying strategy for selecting informative data points to be labeled. Several strategies have been proposed in the literature. As simple baseline, data points can be queried at random (Ruff et al.. 2019); however, this oftentimes results in very few queried true anomalies. Görnitz et al. (2013) propose to query at the boundary of the normal region, which is the learned hypersphere surface in the feature space. A more general approach is to query data in the a-quantile of an anomaly detector, but the problem that one typically does not know which value of a defines the decision boundary.
An important property of the querying strategy is how well it covers unlabeled data. The quality of a querying strategy is determined by the smallest radius 5 such that all unlabeled points are within distance ó of one queried sample of the same type. this paper, we prove that if the queries cover both the normal data and the anomalies well (i.e., if ó is small), learned anomaly detector that satisfies certain conditions is guaranteed to generalize correctly to the unlabeled data (The exact statement and its conditions will be provided in Thm. 1). Based on this insight, we propose to use querying strategy that is better suited for active anomaly detection than previous work.
Theorem 1. Let Qo be the index set of datapoints labeled normal and Q1 the index set of datapoints labeled abnormal. Let ò E IR+ be the smallest radius, such that for each unlabeled anomaly ua and each unlabeled normal datum un there exist labeled data points Fas a E Q1 and Dn, n E Qo, such that u. is within the 8-ball of aa and un is within the 8-ball around In. Ifa -x-Lipschitz continuous function S ranks the labeled data correctly, with a large enough margin, i.e. S(xa) - S(xm) 2 28 then S ranks the unlabeled points correctly too and S(u,) 2 S(un)-
Proof. Since S is X continuous and un and un, are assumed to be closer than 5 to To and v, respectively, we have S(xa) - σλ.= S 5(u,) and (ax,) - dā, S -S(,)). Adding the inequalities and using the condition S(xa) - S(w,) 2 28d., yields 0 S S(xx) S(x,) 28 S
S(u,) - S(u,), which proves S(ua) 2 S(nn).
An implication of this theorem is that a smaller 5 corresponding to a tighter cover of the data leads to better generalization performance. Given a fixed query budget [Q), random querying puts too much weight on high-density areas of the data space, while other strategies only query locally, e.g., close to the possible decision boundary between normal and abnormal data. Instead, we propose querying strategy that encourages diversity: k-means++, the seeding algorithm that initializes diverse cluster centers. It iteratively samples another data point to be added the query set Q until the labeling budget is reached. Given the existing queried samples, the probability of drawing a sample from the unlabeled set l is proportional to its distance to the closest sample in the query set:
Pquery (x:) = softmax((((x.)/7
Vi E U,
where r is a temperature parameter controlling the strength of diversity, h(x;) = mina EQ d(æ; xz) is the distance a sample x; to the query set Q. For a more meaningful notion of distance, we define the latter in an embedding space as d(æ x²) [](((z)) "(x')ll,, where ø is a neural feature map. We stress that all deep methods considered this paper have an associated feature map that we can use. In Supp. D.5, we report the time complexity. In Supp. A, we empirically validate that diverse querying leads to smaller than others and is therefore advantagcous for active anomaly detection.
3.3 ACTIVE LATENT OUTLIER EXPOSURE (ALOE) Loss
We next consider how to use both labeled and unlabeled samples in training. We propose active latent outlier exposure (ALOE). Its loss combines the unsupervised anomaly detection loss of LOE (Qiu et al., 2022a) for the unlabeled data with the supervised loss (Eq. (1)) for the labeled samples. For all queried data (with index set Q). we assume that ground truth labels ys are available, while for unqueried data (with index set U), the labels i; are unknown. Adding both losses together yields
C(0, 0)
Σ (u + (1 9j) Tg)z5) + 4 JEQ
(ax.)(a)))))) + (1 (i:) (.) (z:)). (3)
4

---

Under review as a conference paper at ICLR 2023
Similar to Qiu et al. (2022a), optimizing this loss involves a block coordinate ascent scheme that alternates between inferring the unknown labels and taking gradient steps to minimize Eq. (3) with the inferred labels. In each iteration, the pseudo labels y/ for i E U are obtained by minimizing Eq. (3) subject to a constraint of Eieg Y/ + Eieu D: aN. The constraint ensures that the inferred anomaly labels respect certain contamination ratio a. In practice, this constrained optimization problem is solved by using the current anomaly score function S to rank the unlabeled samples and assign the top a-quantile of the associated labels yi to the value 1, and the remaining to the value O. Thm. I applies in ranking the unlabeled samples by the anomaly score function S.
In theory, a could be treated as hyperparameter, but eliminating hyperparameters important in anomaly detection. In many practical applications of anomaly detection, there is no labeled data that can be used for validation. While Qiu et al. (2022a) have to assume that the contamination ratio is given, active learning provides an opportunity to estimate a. In Sec. 3.4, we develop an importance- sampling based approach to estimate the contamination ratio from the labeled data. Estimating this ratio can be beneficial for many anomaly detection algorithms, including OC-SVM (Schölkopf et al., 2001), KNN (Ramaswamy et al., 2000), Robust PCA/Auto-encoder (Zhou and Paffenroth, 2017), and Soft- noft-boundary deep SVDD (Ruff et al., 2018). When working with contaminated data, these algorithms require a decent estimate of the contamination ratio for good performance.
Another noteworthy aspect of the ALOE loss is that it weighs the averaged losses equally to each other. While equal weighting can not be justified from the first principles, we expect our queried samples be informative, and yet we do not want either loss component dominate the learning task (assuming that we always query only a small percentage of the data). In Supp. E.5, we empirically show that equal weighting yields the best results among large range of various weights. This provides more weight to every queried data point than to an unqueried one, assuring these goals. Our equal weighting scheme also practical because it avoids hyperparameter.
3.4 CONTAMINATION RATIO ESTIMATION.
To eliminate a critical hyperparameter in our approach, we estimate the contamination ratio a, i.e., the fraction anomalies in the dataset. Under a few assumptions, we show that this parameter can be estimated despite of the result of Thm. 1, which requires us to use biased querying strategy.
We consider the contamination ratio a = ( [la (z))]. where p(z) the data distribution and (x())= = 1 (y(z)== 1) indicates whether or not the sample is abnormal. Estimating this quantity would be trivial given an unlimited budget of queries. However, since active learning setups involve limited budgets, we aim to estimate this quantity only based on the queried samples Q used to train the model.
Since the queried data points are not independently sampled, we cannot straightforwardly estimate based on the empirical frequency of anomalies in Q. More precisely, our querying procedure results in chain of indices Q = {i1, i2, (g. J. where i ~ Unif(1 N). and each conditional distribution ix lick is defined by Eq. (2). We will show as follows that this sampling bias can be compensated using importance sampling.
As follows, we will state two assumptions about our querying strategy, followed by theorem for calculating a. Justifications for the two assumptions will be provided below.
Assumption 1. The anomaly scores (S(a::) i E Q} in a query set Q are approximately indepen- dently distributed, i.e., their off dia-diagonal correlations are negligible.
Assumption 2. Let g(x;)) denote the marginal distribution of queried sample under the querying scheme Q, and let p(æ) denote the data distribution. Then, the anomaly scores S(x) are a sufficient statistic of both p(æ)) and q(x:). That is, there exist functions f()) and 9(.) such that p(z) ((S())) and (xx)) = g(S(zz)) (x))) for all æ and I;, with negligible eiror.
Both Assumptions and 2 are only approximations to reality. We will provide strong evidence below that they are well-justified working hypotheses. The following theorem is a consequence of them:
Theorem 2. Given Assumptions I and 2, the following statement applies: for random query Q, the following importance sampling estimator provides an unbiased estimate of the contamination ratio:
1
[4]
f(S(z:)) La(x.))
à
O
g(S(z,))
5

---

Under review as a conference paper at ICLR 2023
The proof is in Supp. B. In practice, we learn f and g using kernel density estimate in the one- dimensional space of anomaly scores. We set the bandwidth to the average spacing of scores. In conclusion, Thm. allows to estimate the importance ratio based on non-iid query set Q.
Discussion. We empirically verified the fact that Thm. 2 results reliable estimates for varying contamination ratios in Supp. B.4. Since Assumptions 1 and 2 seem strong, discuss their justifications and empirical validity next.
We tested Assumption empirically and found negligible off-diagonal correlations among the anomaly scores in the query set. In Supp. B.2, we show that the absolute off-diagonal coefficient values dimensionality
significantly smaller than one on CIFAR-10. We can understand this based argument. Since we sample repulsively in high-dimensional space but project the data onto the one-dimensional space of scores, the resulting correlations will vanish upon the projection step.
We tested Assumption 2 empirically in Supp. B.3. We show that there is monotonic relationship between (xx) and log poz)( ) (or log (())). We validated both on 2D synthetic data from Gaussian distribution and on CIFAR-10. 10. Scatter plots in Supp. B show that S(x) is predictive of both p(æ) and (3r) and thus S(x) is a sufficient statistic of p(æ) and g(2r).
EXPERIMENTS
We study batch active anomaly detection on standard image benchmarks, medical images, tabular data, and surveillance videos. Our extensive empirical study establishes how our proposed method compares to eight recent active anomaly detection methods we implemented as baselines. We first describe the baselines and their implementations (Tab. 1) and then the experiments on images (Sec. 4. 1), tabular data (Sec. 4.2), videos (Sec. 4.3) and finally additional experiments (Sec. 4.4).
Baselines. Most existing baselines apply their proposed querying and training strategies to shallow anomaly detection methods or sub-optimal deep models (c.g.. autoencoders (Zhou and Paffennoth, 2017)). In recent years, these approaches have consistently been outperformed by self-supervised anomaly detection methods (Hendrycks et al., 2019). For fair comparison of active anomaly detection frameworks, we endow all baselines with the same self-supervised backbone models also used in our method. By default we use neural transformation learning (NTL) (Qiu et al., 2021) as the backbone model, which was identified state-of-the-art in recent independent comparison of 13 models (Alvarez et al., 2022). Results with other backbone models are shown in Supp. E.
The baselines are summarized Tab. and detailed in Supp. C. They differ in their querying strategies (col. 3) and training strategies (col. 4 & 5): the unlabeled data is either ignored or modeled with one-class objective. Most baselines incorporate the labeled data by supervised loss (Eq. (1)). As an exception, Ning et al. (2022) remove all queried anomalies and then train weighted one-class objective on the remaining data. All baselines weigh the unsupervised and supervised losses equally.
The baselines also differ in their querying strategies, summarized below:
margin query selects samples deterministically that the closest to the boundary of the normality region. We provide the method with the true contamination ratio to help it choose an ideal boundary. margin diverse query combines margin query with biighborhood-basee diversification. It tends to select samples that are not in the k-nearest neighbors of the queried set. Thus samples are ensured to sit at different positions of the normality boundary.
most positive query always selects the top-ranked samples ordered by their anomaly scores.
positive diverse query combines querying according to anomaly scores with distance-based diversification. The selection criterion is an equally weighted combination of the two aspects: anomaly score and the minimum Euclidean distance to all previously queried samples.
random query draws samples uniformly among the training set.
positive random query samples uniformly among the top 50% data ranked by anomaly scores.
Implementation Details. In experiments, we use a NTL (Qiu et al., 2021) backbone model for all methods. Experiments with other backbone models shown in Supp. E. On images and videos, NTL is built upon the penultimate layer output of a frozen ResNet- 152 pre-trained on ImageNet. NTL is trained for epoch, after which all queries are labeled. The number of queries [ depends

---

Under review as a conference paper at ICLR 2023
Table 1: A summary of all compared experimental methods' query strategy and training strategy irrespective of their backhone models.
Name
Reference
Querying Strategy
Loss (labeled)
Loss (unlabeled)
Mar
Göriiz et al. (2013)
margin query
superv. (Eq. (1)
one class one class
Hybrl
Gömitz et al. (2013)
margin diverse query
superv: (Eq. (I)
Post
Pimentel et al. (2020)
most positive query
superv. (Eq. (1))
none one class one class one class
Pos2
Bamabé-Lortic et al. (2015)
most positive query
superv. (Eq. (1))
Rand1
Ruff et al. (2019)
random query
superv. (Eq. (1))
Rand2
Trittenbach et al. (2021)
positive random query positive diverse query positive diverse query
superv. (Eq. (1))
Hybr2
Das et al. (2019)
supery, (Eq. (1))
none weighted one class
Hybr3
Ning et al. (2022)
refinement
ALOE
[ours]
diverse (Fq. (2))
active latent outlier exposure loss (Eq. (3))
on the experiment and all [Q] queries are collected at once. The contamination ratio in ALOE is estimated immediately after the querying step and then fixed for the remaining training process. We follow Qiu et al. (2022a) and set = 0.5 for inferred anomalies. This accounts for the uncertainty of whether the sample truly is an anomaly. More details are provided in Supp. D.
4.1 EXPERIMENTS ON IMAGE DATA
In this section, we study ALOE on standard image benchmarks to establish how it compares to eight well-known active anomaly detection baselines. Active learning plays an important role in medical domains where expert labeling is expensive. Hence, we also study nine medical datasets from Yang et al. (2021). We describe the datasets, the evaluation protocol, and finally the results of our study.
Image Benchmarks. We experiment with two popular image benchmarks: CIFAR-10 and Fashion- MNIST. These have been widely used in previous papers on deep anomaly detection (Ruff al., 2018; Golan and El- Yaniv, 2018; Hendrycks et al., 2019; Bergman and Hoshen, 2020).
Medical Images. Since medical imaging is an important practical application of active anomaly detection, we also study ALOE on medical images. The datasets we consider cover different data modalities (e.g., X-ray, CT, electron microscope) and their characteristic image features can be very different from natural images. Our empirical study includes all 2D image datasets presented in Yang al. (2021) that have more than 500 samples in each class, including Blood, OrganA, OrganC, OrganS, OCT, Pathology, Pneumonia, and Tissue. We also include Dermatoscope but restricted to the classes with more than 500 training samples.
Evaluation Protocol. We follow the community standard known as the "one-vs.-rest" protocol to turn these classification datasets into a test-bed for anomaly detection (Ruff et al., 2018; Golan and El-Yaniv, 2018; Hendrycks et al., 2019; Bergman and Hoshen, 2020). While respecting the original train and test split of these datasets, the protocol iterates over the classes and treats each class in turn as normal. Random samples from the other classes are used to contaminate the data. The training set is then a mixture of unlabeled normal and abnormal samples with contamination ratio of 10% (Wang et al., 2019; Qiu et al., 2022a). This protocol can simulate a "human expert" to provide labels for the queried samples because the datasets provide ground-truth class labels. The models are trained on the training data and evaluated on the test data. The reported results (in terms of AUC %) for each dataset are averaged over the number of experiments (i.e., classes) and over five independent runs.
Results. We report the evaluation results of our method (ALOE) and the eight baselines on all eleven image datasets in Tab. 2. All methods have query budget of 20 samples. On all datasets, our proposed method ALOE achieves the best performance and significantly outperforms all baselines by 6 percentage points on average, reaching the state-of-the-ar art results in active anomaly detection.
In addition, we also study detection performance as the query budget increases from 20 to 160. The results are plotted in Fig. 1. The results show that, with small budget of 20 samples, ALOE (by querying diverse and informative samples) makes better usage of the labeling information than the other baselines and thus leads to better performance by large margin. As more samples are allowed
7

---

Under review as a conference paper at ICLR 2023
Table 2: AUC (%) with standard deviation for anomaly detection on 11 image datasets when the query budget Q 20. ALOE outperforms all baselines by a large margin by querying diverse and informative samples. For all experiments, we set the contamination ratio as 10%.
Mar
Hybrl
Pos1
Pos2
Rand1
Rand2
Hybr2
Hybr3
ALOE
CIEAR10
92,4+0.77
92.0+0.7
93,4+0.5
92.1+007
8922+3.2
91,4++1.0
X5.1++2.2
71.8+7.4
9.,3--03
FMNIST
93.14004
92.6=0.4
92.24:.6
19.
84.0=3.8
90.6+111
88.7::1.4
82.644.3
94,8=0.6
Blood
68.61188
69.1=13
69.6118
72.244.9
70.6=1.6
69.2+1.7
72.2422.7
58.3=5.2
80.5=0.5
OrganA
1..4
87.4=0.7
81.742.9
81842.11
82.9=0.6
86.5+0077
1..6
68.8:3.1
90.7=0.7
OrganC
86,5+00.9
87.0=0.7
84.6+119
79.6:22.0
85.5=099
86,4:0.88
84.8:11.2
68.943.0
89.7
OrganS
83.5+1.1
84.1+0.4
83,2+1.3
78.++100
82.2-1.4
83,8+00.4
82.3++07
66.9+443
87.4-0.8
OCT
64.4+33.7
63.3#1.8
63.8+4.44
63.0:+4.0
59.7=119
62.14-4.3
63.0:47.66
56.2#4.55
3.4
Path
82.742.4
86.0=1.1
77.542.0
80.2433.5
83.2=1.6
83.942.9
86.1+:2.0
75.1=4422
18
Pneumonia
72.147.0
75.1+5.3
75.5+888
83.6+6.1
68.1+5599
76.0+8.00
88.44-3.
63,4+17.7
91,2-1144
Tissue
60.2+115
61.3+177
65.8+1.7
63.5+2..0
19.9=117
19.5+113
6..1+1177
1..8+116
66.4=114
Derma
62.6.3.8
63.1
66.642.3
66.4:1433
64.5=4.88
68.342.1
17.2
18.0
73,5
Average
77.5
78.3
77.3
77.6
75.4
78.0
78.0
64.6
84.3
CIFAR-10
FMNIST
Blood
Path
90
AUCROC 1961
90
100
80
85
85
85
70
80
OrganA
Organs
OrganC
Pnoumonia
95
95
AUCHOCCO
-0-
90
185
85
70-
80
80
OCT
Tissue
Derma
20
40
80
160
75
75
80
#Queried samples
AUrSOOC (80)
ALOE (ours)
Rand2
70
Marl
Rand1
65
60
Hybrl
Hybr2
60
50
Pos2
Hybr3
55
160
80
@Queried samples
samples
@Gueried samples
Figure I: Running AUCs (%) with different query budgets. Models are evaluated at 20, 40, 80, 160 queries. ALOE performs the best among the compared methods on all query budgets.
to be queried, the performance of almost all methods increases but even for ||] = 160 queries when the added benefit from adding more queries starts to saturate, ALOE still outperforms the baselines.
4.2 EXPERIMENTS ON TABULAR DATA
Many practical use cases of anomaly detection (e.g., in health care or cyber security) are concerned with tabular data. For this reason, we study ALOE on several tabular datasets from various domains. We find that outperforms existing baselines, even with as few as 10 queries. We also confirmed the fact that our deep models are competitive with classical methods for tabular data in Supp. E.7.
Tabular Datasets. Our study includes the four multi--dimensionl tabular datasets from the ODDS repository which have outlier ratio of least 30%. This is necessary to ensure that there enough anomalies available to remove from the test set and add to the clean training set (which randomly sub-sampled to half its size) to achieve a contamination ratio of 10%. The datasets are BreastW, lonosphere, Pima, and Satellite. As in the image experiments, there is one round of querying, in which 10 samples are labeled. For each dataset, we report the averaged Fi-score (%) with standard deviations over five runs with random train-test splits and random initialization.
Results. Our proposed method ALOE performs best on 3 of datasets and outperforms all baselines by 3.2 percentage points average, reaching state-of-the-art results in active anomaly detection.
8

---

Under review as a conference paper at ICLR 2023
Table 3: Fl-score (%) with standard deviation for anomaly detection on tabular data when the query
budget Q ALOE performs the best on 3 of 4 datasets. We set the contamination ratio as 10%.
Mar
Hybr1
Posl
Pos2
Rand1
Rand2
Hybr2
Hybr3
ALOE
BreastW
81.6+0.7
83.3+2.0
58.6+7.7
81.3++0.8
87.1-1.1 1.0
82,9+111
55.0++600
79.6+4.9
93.9++0.5
lonosphere
91.9+0.3
92.3=0.5
56.126.2
91.1=:088
91.1=0.3
9199:0.
64.0214.6
88.2=0.9
91.81111
Pima
50.1+1.3
49.2+11.9
48.5+004
52.4+00.8
53.6=1.1
51,9+2.0
53.8+-4.0
48.4=0.7
55.5++1.2
Satellite
64,2+1,2
6..2+1.77
57.0+3.0
56,7+3.2
67.7-1.2
66.6+0.8
48.6++699
56.9+7.0
71.1++177
Average 72.0
72.8
55.1
70.4
74.9
73.3
55.4
68.3
78.1
Diverse querying best utilizes the limited query budget to label the diverse and informative data points, yielding consistent improvement over existing baselines also tabular data.
4.3 EXPERIMENTS ON VIDEO DATA
ALDE (ours)
75.0
Mart
Detecting unusual objects in surveillance videos is an important application area for anomaly detection. Due to the large variability in abnormal objects and suspicious behavior in surveillance videos, expert feedback is very valuable to train anomaly de- tector (we use NTL as the backbone model) in an active manner. We study ALOE public surveil- lance video dataset (UCSD Pedsl). The goal is to accurately detect abnormal video frames that contain non-pedestrian objects with limited query budget.
70.0
Hybrt
Pos2
Rand]
60.0
Rands
Hybr2
55.0
Hybr3
20
40
80
160
&Queried samples
Figure 2: Results video anomaly detection under varying query budgets. ALOE results in the most accurate active anomaly detector.
We make the same independent frames assumption as Pang al. (2020) and mix the original training and testing video frames together. As in Pang et al. (2020), we sub-sample 6800 normal frames and 2914 abnormal frames for training such that the anomaly ratio is 0.3, which corresponds to the original ratio in this dataset. The other samples are used for testing. Before running any of the methods, a ResNet pretrained on ImageNet is used obtain a fixed feature vector for each frame. We vary the query budget from [ 20 to Q 160 and compare ALOE to all basclines. All experiments are repeated five times with different random initializations. Results in terms of average AUC and standard error over the five runs are reported in Fig. 2. ALOE consistently outperforms all baselines, especially for smaller querying budgets.
4.4 ADDITIONAL EXPERIMENTS
In Supp. E, provide several additional experiments and ablations demonstrating ALOE's strong performance and justifying modeling choices. In summary, we address the following aspects:
Backbone Models. Tab. 6 shows that ALOE is the best performing active learning framework also for the backbone models MHRot (Hendrycks et al., 2019) and Deep SVDD (Ruff et al., 2018).
ALOE Loss Components. Tab. 7 shows how different loss components affect performance. Performance under å. Fig. shows that ALOE with either true estimated ratio performs similar given all query budgets.
Querying Strategies. Fig. 8 further confirms the theory of Thm. 1: diverse querying significantly outperforms the other querying strategies in the supervised setting.
CONCLUSION
We introduced Active Latent Outlier Exposure: batch active learning approach for deep anomaly detection. Inspired by set of conditions that guarantee the generalization of anomaly score rankings from queried data to unqueried data, we proposed to use a diversified querying strategy and combination of two losses for queried and unqueried samples. Based on simple heuristic for weighting the losses relative to each other and by estimating the unknown contamination rate from queried samples, showed on variety of data sets from different domains that the approach results in a new state the art in batch active anomaly detection.
were able make approach free of its most important hyperparameters. We

---

Under review as a conference paper at ICLR 2023
REFERENCES
Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dietterich, and Alaus-Robert Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 2021.
Siqi Wang, Yijie Zeng. Xinwang Liu, En Zhu, Jianping Yin, Chuanfu Xu, and Marius Kloft. Effective end-to-end unsupervised outlier detection via inlier priority of discriminative network. In Advances in Neural Information Processing Systems, pages 5962-5975, 2019.
Chen Qiu, Aodong Li, Marius Kloft, Maja Rudolph, and Stephan Mandt. Latent outlier exposure for anomaly detection with contaminated data. In Proceedings of the 39th International Conference on Machine Learning, volume 162, pages 18153-18167. PMLR, 2022a.
Holger Trittenbach, Adrian Englhardt, and Klemens Böhm. An overview and a benchmark of active learning for outlier detection with one-class classifiers. Expert Systems with Applications, 168: 114372, 2021.
Emanuele Principi. Fabio Vesperini, Stefano Squartini, and Francesco Piazza. Acoustic novelty detection with adversarial autoencoders. In 2017 International Joint Conference on Neural Networks (IJCNV), pages 3324-3330. IEEE, 2017.
Chong Zhou and Randy Paffenroth. Anomaly detection with robust deep autoencoders. In Proceedings of the 23rd ACM SIGKDD international conference knowledge discovery and data mining, pages 665-674, 2017.
Xiaoran Chen and Ender Konukoglu. Unsupervised detection of lesions in brain mri using constrained adversarial auto-cncoders. In MIDL Conference book. MIDL, 2018.
Thomas Schlegl. Philipp Seeböck, Sebastian M Waldstein, Ursula Schmidt-Erfurth and Georg Langs. Unsupervised anomaly detection with generative adversarial networks to guide marker discovery. In International conference information processing in medical imaging, pages 146-157. Springer, 2017.
Lucas Deecke, Robert Vandermeulen, Lukas Ruff, Stephan Mandt, and Marius Kloft. Image anomaly detection with generative adversarial networks. In Joint european conference machine learning and knowledge discovery in databases, pages 3-17. Springer, 2018.
Bernhard Schölkopf, John C Platt, John Shawe- Taylor. Alex J Smola, and Robert C Williamson. Estimating the support of high-dimensional distribution. Neural computation, 13(7):1443-1411, 2001.
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International conference on machine learning, pages 4393-4402. PMLR, 2018
Lukas Ruff, Robert A Vandermeulen, Nico Gömitz,, Alexander Binder, Emmanuel Müller, Klaus- Robert Müller, and Marius Kloft. Deep semi-super anomaly detection. In International Conference on Learning Representations, 2019.
Izhak Golan and Ran El-ia..v. Deep anomaly detection using geometric transformations. In Advances in Neural Information Processing Systems, pages 9758-9769 2018.
Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning
can improve model robustness and uncertainty. Advances Neural Information Processing Systems, 32:15663-15674, 2019.
Liron Bergman and Yedid Hoshen. Classification-busee anomaly detection for general data. In International Conference on Learning Representations, 2020.
Chen Qiu, Timo Pfrommer, Marius Kloft. Stephan Mandt, and Maja Rudolph. Neural transformation learning for deep anomaly detection beyond images. In International Conference on Machine Learning, pages 8703-8714, PMLR, 2021.
10

---

Under review as a conference paper at ICLR 2023
Tom Shenkar and Lior Wolf. Anomaly detection for tabular data with internal contrastive learning. In International Conference on Learning Representations, 2022.
Chen Qiu, Marius Kloft, Stephan Mandt, and Maja Rudolph. Raising the bar in graph-level anomaly detection. In Proceedings of the Thirty- First International Joint Conference on Artificial Intelli- gence, IJCAI-22, pages 2196-2203, 2022b.
Bjarni J Vilhjälmsson and Magnus Nordborg. The nature of confounding in genome wide association studies. Nature Reviews Genetics, 14(1):1-2, 2013.
Jacob Steinhardt, Pang Wei Koh, and Percy Liang. Certified defenses for data poisoning attacks. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS' 17, page 3520-3532, 2017.
Jinsung Yoon, Kihyuk Sohn, Chun-Liang Li, Sercan Arik, Chen-Yu Lee, and Tomas Pfis- ter. Self-trained one-class classification for unsupervised anomaly detection. arXiv preprint 1xiv:22006.06155 2021.
Dan Pelleg and Andrew Moore. Active learning for anomaly and rare-category detection. Advances in neural information processing systems, 17, 2004.
Nico Görnitz, Marius Kloft, Konrad Rieck, and Ulf Brefeld. Toward supervised anomaly detection. Journal of Artificial Inielligence Research, 46:235-262, 2013.
Lili Yin, Huangang Wang, and Wenhui Fan. Active learning based support vector data description method for robust novelty detection. Knowledge- -Baeed Systems, 153:40-52, 2018.
Alireza Ghasemi, Hamid R Rabiee, Mohsen Fadaee, Mohammad T Manzuri, and Mohammad H Rohban. Active learning from positive and unlabeled data. In 201 IEEE 11th International Conference Data Mining Workshops, pages 244-250. IEEE, 2011.
Md Amran Siddiqui, Alan Fern, Thomas Dietterich, Ryan Wright, Alec Theriault, and David W Archer. Feedback-guide anomaly discovery via online optimization. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2200-2209, 2018.
Shubhomoy Das, Weng- Wong, Thomas Dietterich, Alan Fern, and Andrew Emmott. Incorpo- rating expert feedback into active anomaly discovery. In 2016 IEEE 16th International Conference on Data Mining (ICDM), pages 853-855 IEEE, 2016.
Shubhomoy Das, Md Rakibul Islam, Nitthilan Kannappan Jayakodi, and Janardhan Rao Doppa. Active anomaly detection via ensembles: Insights, algorithms, and interpretability. arXiv preprint 11X1v:1901.08930, 2019.
Tiago Pimentel, Marianne Monteiro, Adriano Veloso, and Nivio Ziviani. Deep active learning for anomaly detection. In 2020 International Joint Conference on Neural Networks (IJCN), pages 1-8. IEEE, 2020.
Jin Ning, Leiting Chen, Chuan Zhou, and Yang Wen. Deep active autoencoders for outlier detection. Neural Processing Letters, pages 1-13, 2022.
Xuning Tang, Yihua Shi Astle, and Craig Freeman. Deep anomaly detection with ensemble- based active learning. In 2020 IEEE International Conference on Big Data (Big Data), pages 1663-1670. IEEE, 2020.
Stefania Russo, Moritz Lürig, Wenjin Hao, Blake Matthews, and Kris Villez. Active learning for anomaly detection in environmental data. Environmental Modelling & Software, 134:104869, 2020.
Guansong Pang, Anton van den Hengel, Chunhua Shen, and Longbing Cao. Toward deep supervised anomaly detection: Reinforcement learning from partially labeled anomaly data. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 1298-1308, 2021.
11

---

Under review as a conference paper at ICLR 2023
Daochen Zha, Kwei- Herng Lai, Mingyang Wan, and Xia Hu. Meta-aad: Active anomaly detection with deep reinforcement learning. In 2020 JEEE International Conference on Data Mining (ICDM), pages 771-780 IEEE, 2020.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don't know? In International Conference on Learning Representations, 2018.
Steven CH Hoi, Rong Jin, Jianke Zhu, and Michael R Lyu. Batch mode active learning and its application to medical image classification. In Proceedings of the 23rd international conference Machine learning, pages 417-424, 2006a.
Ozan Sener and Silvio Savarese. Active learning for convolutional neural networks: A core-set approach. In International Conference Learning Representations, 2018.
Jordan T Ash, Chicheng Zhang, Akshay Krishnamurthy, John Langford, and Alekh Agarwal. Deep batch active learning by diverse, uncertain gradient lower bounds. In International Conference on Learning Representations, 2020.
Gui Citovsky, Giulia DeSalvo, Claudio Gentile, Lazaros Karydas, Anand Rajagopalan, Afshin Rostamizadeh, and Sanjiv Kumar. Batch active learning at scale. Advances in Neural Information Processing Systems, 34:1 1933-11944 2021.
Robert Pinsler, Jonathan Gordon, Eric Nalisnick, and José Miguel Hernández-Lobato. Bayesian batch active learning as sparse subset approximation. Advances in neural information processing systems, 32, 2019.
Steven CH Hoi, Rong Jin, and Michael R Lyu. Large-scale text categorization by batch mode active learning. In Proceedings of the 15th international conference on World Wide Web, pages 633-642, 2006b.
Yuhong Guo and Dale Schuurmans. Discriminative batch mode active learning. Advances in neural information processing systems, 20, 2007.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. International Conference on Learning Representations, 2018.
Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pages 427-438, 2000.
Maxime Alvarez, Jean-Charles Verdier, D'Jeff Nkashama, Marc Frappier, Pierre-Martin Tardif, and Froduald Kabanza. A revealing large-scale evaluation of unsupervised anomaly detection algorithms. arXiv preprini arXiv:2204.09825, 2022.
Vincent Barnabé-Lortie, Colin Bellinger, and Nathalie Japkowicz. Active learning for one-class classification. 2015 IEEE 14th international conference on machine learning and applications (ICMLA), pages 390-395, IEEE, 2015.
Jiancheng Yang, Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, Bilian Ke, Hanspeter Pfister, and Bingbing Ni. Medmnist v2: A large-scale lightweight benchmark for 2d and 3d biomedical image classification. arXiv preprint 1tt::2110.147999 2021.
Guansong Pang, Cheng Yan, Chunhua Shen, Anton den Hengel, and Xiao Bai. Self-trained deep ordinal regression for end-to-end video anomaly detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 12173-12182, 2020.
Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of machine learning. MIT press, 2018.
Corinna Cortes and Mehryar Mohri. Auc optimization vs. error rate minimization. Advances in neural information processing systems, 16, 2003.
12

---

Under review as a conference paper at ICLR 2023
George Papamakarios, Theo Pavlakou, and lain Murray. Masked autoregressive flow for density estimation. Advances in neural information processing systems, 30, 2017.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms, 2017.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
Bahman Bahmani, Benjamin Moseley, Andrea Vattani, Ravi Kumar, and Sergei Vassilvitskii. Scalable k-means+. Proceedings of the VLDB Endowment, 5(7), 2012.
Kihyuk Sohn, David Berthelot, Nicholas Carlini, Zizhao Zhang, Han Zhang, Colin A Raffel, Ekin Do- gus Cubuk, Alexey Kurakin, and Chun-Liang Li. Fixmatch: Simplifying sun--vupee learning with consistency and confidence. Advances in neural information processing systems, 33:596-608, 2020a.
Ahmet Iscen, Giorgos Tolias, Yannis Avrithis, and Ondrej Chum. Label propagation for deep semi- supervised learning. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5070-5079, 2019.
Zhun Li, ByungSoo Ko, and HoJin Choi. Pseudo-labeling using gaussian process for semi-supervised deep learning. In 2018 IEEE International Conference on Big Data and Smart Computing (BigComp). pages 263 269. IEEE, 2018.
Terrance Vries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv: 04552, 2017.
David M. J. Tax and Robert W. Duin. Support vector data description. Mach. Learn., 54(1))45-66, 2004.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. 2008 eighth ieee international conference on data mining, pages 413-422. IEEE, 2008.
Max Welling Diederik P. Kingma. Auto-encoding variational bayes. In International Conference on Learning Representations, 2014.
Alireza Makhzani and Brendan J Frey. Winner-take-all autoencoders. Advances in neural information processing systems, 28, 2015.
Kihyuk Sohn, Chun-Liang Li, Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluating representations for deep one-class classification. arXiv preprint arXiv:2011.02578, 2020b.
A THEOREM 1
In Thm. I, we considered using the fixed-radius neighborhood (ō-ball) of the queried data as the cover of the whole dataset, and mentioned diverse querying has smaller radius than other querying strategies. In this section, we will empirically verify this fact and further illustrate diverse querying leads to good ranking of un-queried data (see also Fig. 8 test data).
As defined in Thm. 1, the radius is the smallest distance that required for any un-queried sample to be covered by the neighborhood of queried sample of the same type. Mathematically, we compute the radius as
6 = max min d(x,, x;)) seu jER.
(5)
where we adopt the euclidean distance in the feature space for a meaningful metric d. We apply NTL on the first class of CIFAR-10 and F-MNIST dataset. We make queries with different budgets, after which we compute 8 by Eq. (5). We repeat this procedure for 100 times and report the mean and standard deviation in Fig. 3. We compared four querying strategies: diverse queries (k-means+++ )
13

---

Under review as a conference paper at ICLR 2023
F-MNIST
CIFAR- 10
Diverse Query
Diverse Query
Uncertain Query
Radius (6)
3.5
Uncertainn Query
Random Query
Positive Query
Radius (6)
Positive Query
Random Query
3.0
2.5
3-
2.0
20
40
80
160
20
40
80
160
# #Queried samples
# +uueried samples
Figure 3: Cover radius (Eq. (5)) resulted from different querying strategies on the first class of CIFAR-10 and F-MNIST. Diverse queries systematically have smaller cover radius than other querying strategies.
CIFAR-10 10
F-MNIST
98
0.96
AUCROC (96
AUCROC (%)
0.94
Diverse Query
0.92
Query
Random Query
Random Query
92
Positive Query
0.90
Query
Uncertain Query
Uncertain Query
0.88
20
40
80
160
20
80
160
# Querried samples
# #Queried samples
Figure 4: Ranking performance of unlabeled data. AUC of unqueried data is evaluated using the fitted anomaly detector on the queried data. Our proposed diverse querying (k-means++) ) provides better ranking of the unlabeled data.
uncertain queries (Mar), positive queries (Posl), and random queries (Rand1). It shows that diverse queries significantly lead the smallest radius among the compared strategies on all querying budgets.
Next, we provide an empirical, overall justification of Thm. (see also Fig. on test data). An implication of Thm. is that, assuming anomaly scores are fixed, smaller ò will satisfy the large anomaly score margin (S(x,)) - S(x,)) more easily, hence it easier for S to correctly rank the remaining unlabeled points. To justify this implication, we need a metric of ranking. AUC satisfies this requirement as is alternatively defined as (Mohri et al., 2018, 10.5.2) and Mohri, 2003)
AUC
Σ nEU,
((S(u)) S(u,)) Rs PEE (S(u,) > S(u)))
[ool + 14
which measures the probability of ranking unlabeled samples u, higher than u. terms of their scores. 24 = U4 Ut,, is the un-queried data indices and U4 and U4 are disjoint un-queried normal and abnormal data sets respectively. u, and un are instances of each kind. We conducted experiments on CIFAR-10 10 and F-MNIST, where we trained an anomaly detector (NTL) on the queried data for 30 epochs and then compute the AUC on the remaining un-queried data. The results four querying straties are reported in Fig. 4, which shows that our proposed diverse querying strategy generalizes the anomaly score ranking the best to the unqueried data among the compared strategies, testifying our analysis in the main paper. A consequence is that diverse querying can provide accurate assignments of the latent anomaly labels, which will further help learn a high-quality of anomaly detector through the unsupervised loss term in Eq. (3).
14

---

Under review as a conference paper at ICLR 2023
B THEOREM 2
In this section, we will empirically justify the assumptions we made in Sec. 3.4 that are used to build unbiased estimator of the anomaly ratio (Eq. (4)). We will also demonstrate the robustness of the estimation under varying
B.1 PROOF
Proof. Let Al and A2 denote Assumptions and 2, respectively. Furthermore, let (()) .... fio)) denote the query distribution, g(x;) its marginals, and [Q] the number of queried samples. Then,
Q1 1(5(z:))
f(S(x))) 11 (2(2)))
[[a] -B mlo
g(S(xx)) D1 (x4))
A1 E (
Q
Q
g(S(xx))
121
IQ
((5((x)))1L g(S(x:))
p(a;))la(222)
By(x.)
B By(()))
q(2;))
B.2
ASSUMPTION 1
CIFAR-10 Class as Normal
CIFAR-10 Class as Normal
08
002
F-MNIST Class Normal
F-MNIST Class 2 Normal
1.0
0.8
0.8
0.0
0.6
0.4
0.2
02
Figure 5: Anomaly score correlation matrix (S(x;), S(x,)), where æ; and æy are jointly sampled in the same query set. The result indicates that anomaly scores can be considered as approximately independent random variables.
We verify Assumption by showing the correlation matrix in Fig. 5, where we jointly queried 20 points with diversified querying strategy and repeated 1000 times on two classes CIFAR-10 and MNIST. Then the correlation between each pair of points computed and placed in the off-diagonal entries. For each matrix, we show the average, maximum, and minimum of the off-diagonal terms
CIFAR-10 Class -0.001, 0.103, -0.086
CIFAR-10 Class 2: -0.001, 0.085, -0.094
15

---

Under review as a conference paper at ICLR 2023
F-MNIST Class 1: -0.001, 0.081, -0.075
F-MNIST Class 2: -0.005, 0.087, -0.067
Which shows the correlations (S( S(æ,)) are negligible, and the anomaly scores can be consid- ered approximately independent random variables.
B.3
ASSUMPTION 2
log p(x) vs. S(x)
log q(x) vs. 5(x)
log p(*)
log a(x)
5(x)
5(x)
Figure 6: The scatter plot on the left shows perfect linear relationship between the anomaly score S(x) and log p(x), and the scatter plot the right shows monotonic relationship between S(x) and log (xx) The results indicate that (zx) is predictive of both p(z) and g(x).
p(x) vs. S(x)
log q(x) S(x)
R-squared=0.41
R-squared=0.32
log p(x)
(xib Bai
S(x)
S(x)
Figure 7: The scatter plot the left shows monotonic relationship between the anomaly score S(x) and log p()) with a R-squared value of 0.41, and the scatter plot on the right shows a monotonic relationship between S(x) and log q(x:) with R-squared value of 0.32. The results indicate that ((x) is predictive of both p(x) and ((x).
We verify Assumption by checking the correlation between the anomaly score S(x) and the data density on one 2D denote the marginal data distribution by p(æ).. and denote the marginal distribution a queried sample by qzx). For synthetic data, the density p(æ) is known, and we model g(x) with kernel density estimator. For CIFAR- 10, both data densities p(æ) and (x) are modeled by Masked Autoregressive Flow (Papamakarios et al., 2017). For the choice of the anomaly score function S, we learn deep SVDD (Ruff et al., 2018) for the synthetic data and a NTL for CIFAR-10 10 with protocols discussed in Sec. 4.1.
synthetic dataset and one real-world dataset CIFAR-10. We
Fig. and Fig. plot S(x) against log p(x) and log ((x) respectively. In Fig. 7, we observe that there is monotonic relationship between S(xr) and log p(x)) or log g(x) with R2 value of 0.41 and
16

---

Under review as a conference paper at ICLR 2023
0.32 respectively. In Fig. 6, we observe a perfect linear relationship between S(x) and p(z), and a monotonic relationship between ((x) and log (2x). These plots empirically show that the anomaly score S(x) is predictive and sufficient statistic of both p( ((z) and q(x).
B.4 CONTAMINATION RATIO ESTIMATION
Table 4: Estimated contamination ratios on CIFAR-I0 and F-MNIST when |인| = 40 and the backbone model is NTL. The first row shows the true contamination ratio ranging from 1% to 15%. The estimations are repeated 50 times.
1%
5%
10%
15%
CIFAR-I0
0.5% + 1.2%
6.0% + 3.3%
12.0%
4.4%
15.3%
= 4.5%
F-MNIST 1.0% + 1.5%
3.8% + 2.3%
8.7% + 4.1%
12.8% = 5.3%
We estimate the contamination ratio by Eq. (4) under varying true ratios. This part shows the estimated contamination ratio when the query budget is |2] 40. The estimations from the backbone model NTL is shown in Tab. 4. The first row contains the ground truth contamination rate, and the second and third row indicate the inferred values for two datasets, using our approach. Most estimates are withing the error bars and hence accurate. The estimation error is acceptable as confirmed by the sensitivity study in (Qiu et al., 2022a) which concludes that the LOE approach still works well if the anomaly ratio is mis-specified within 5 percentage points.
C BASELINES DETAILS
In this section, describe the details of the baselines in Tab. in the main paper. For each baseline method, we explain their query strategies and post-query training strategies we implement in our experiment. Please also refer our codebase for practical implementation details.
Rand1. This strategy used by Ruff et al. (2019) selects queries by sampling uniformly without re- placeeent across the training set, resulting in the queried index set Q = {ig ~ Unif(1, | < q S [2). After the querying, models are trained with a supervised loss function based on outlier exposure on the labeled data and with one-class classification loss function on the unlabeled data,
LRandI (0) =
Σ (1)L)(z;)) + (1 vو) JEQ
+
Σ L((x)).
(6)
Q
[
iEN
As in ALOE both loss contributions weighted equally. TRanndl (0) is minimized with respect the backbone model parameters 0.
Rand2. The querying strategy of Trittenbach et al. (2021) samples uniformly among the top 30% data ranked by anomaly scores without replacement. This leades to random set of "positive" queries. After the queries are labeled, the training loss function is the same as RRaadl (0) (Eq. (6)).
Mar. After training the backbone model for one epoch, this querying strategy by Görnitz et al. (2013) uses the a-quantile (s.) of the training data anomaly scores to define "normality region". Then the |Q] samples closest to the margin 8a are selected to be queried. After the queries are labeled, the training loss function is the same L (0) (Eq. (6)). Note that in practice we don't 't know the true anomaly ratio for the a-quantile. In all experiment, we provide this querying strategy with the true contamination ratio of the dataset. Even with the true ratio, the "Mar" strategy is still outperformed by ALOE.
Hybr1. This hybrid strategy, also used by (Görnitz et al., 2013) combines the "Mar" query with neighborhood-band diversification. The neighborhood-basee strategy selects samples with fewer neighbors covered by the queried set to ensure the samples' diversity in the feature space. We start by selecting the data index arg min <iss N ||s; sequentially without replacement by the criterion
sall into Q. Then the samples are selected
arg min 0.5 + Kj E (N+()(2:)) :j 2H + + ISi5N
|| - sa min; ||
sa
2k
max; ||8; 8al min; ||s: 8
17

---

Under review as a conference paper at ICLR 2023
where the inter-sample distance is measured in the feature space and the number of nearest neighbors is k = [N/] We set 3 = 1 for equal contribution of both terms. After the queries are labeled, the training loss function is the same LRandl (0) (Eq. (6)).
Pos1. This querying strategy by Pimentel et al. (2020) always selects the top-ranked samples ordered by their anomaly scores, arg maxigiia 8i. After the queries are labeled, the training loss only involves the labeled data
1 Σ (y)L)(0z) + (x;
Lost (0)
Pimentel et al. (2020) use the logistic loss but we use the supervised outlier exposure loss. The supervised outlier exposure loss is shown to be better than the logistic loss in learning anomaly detection models (Ruff et al., 2019; Hendrycks et al., 2018).
Pos2. This approach of (Barnabé-Lortie et al., 2015) uses the same querying strategy as Posl, I but the training is different. Pos2 also the unlabeled data during training. After the queries labeled, the training loss function is the same as LRand1 (0) (Eq. (6)).
Hybr2. This hybrid strategy by Das et al. (2019) makes positive diverse queries. It combines querying according to anomaly scores with distance-bres -ased diversification. Hybr2 selects the initial query arg maxigisA 8, into Q. Then the samples are selected sequentially without replacement by the criterion
arg max 8; min; 8:
d(,,, 2z) min dl Fa. Lbb)
+ 3 min ISISN max; min, 8 JEQ mäXagb d( vT,) min d(æa. 2%))
where d(<;, œ2) = | (x,)) - 6(x,) 1l2- We set queries are labeled, Das et al. (2019) use the labeled set to learn set of weights for the components an ensemble of detectors. For a fair comparison of active learning strategies, we use the labeled set to update individual anomaly detector with parameters 0 by optimizing the loss
for equal contribution of both terms. After the
L (0)
Σ
(,,L)(z)) + (1- y,){)(x,))
JEQ
Hybr3. This baseline by (Ning et al., 2022) uses the same query strategy as Hybr2, but differs in the training loss function,
Lityhr 2
-
Σ
v (xx)))
[2
Q 2
jEQ
where wy (d,)) and wZ 10ca (Ilob())))) co - || (x.) ei (ll)) where co is the center of the queried normal samples and ei is the center of the queried abnormal samples in the feature space, and ca is the min-max normalization factor.
(d,) where a(-) the Sigmoid function and
We make three observations for the loss function. First, Luybes (0) filters out all labeled anomalies the supervised learning part and puts a large weight (but only large as 2 at most) to the true normal data that has a high anomaly score. Second, in the unlabeled data, LHyyea(0) (0) puts smaller weight (less than 1) to the seemingly abnormal data. Third, overall, the weight of the labeled data is similar to the weight of the unlabeled data. This is unlike ALOE, which weighs labeled data [ times higher than unlabeled data.
D IMPLEMENTATION DETAILS
In this section, we present the implementation details in the experiments. They include an overall description of the experimental procedure for all datasets, model architecture, data split, and details about the optimization algorithm.
D. EXPERIMENTAL PROCEDURE
We apply the same experimental procedure for each dataset and each compared method. The experiment starts with unlabeled, contaminated training dataset with index set Ur We first train the
18

---

Under review as a conference paper at ICLR 2023
anomaly detector on U for epoch if all data were normal. Then conduct the diverse active queries at once and estimate the contamination ratio a by the importance sampling estimator Eq. (4). Lastly, optimize the qust- training losses until convergence. The obtained anomaly detectors are evaluated on a held-out test set.
D.2 DATA SPLIT
Image Data. For the image data including both natural (CIFAR-10 (Krizhevsky et al., 2009) and F-MNIST (Xiao et al., 2017)) and medical (MedMNIST (Yang al., 2021)) images. use the original training, validation (if any), and test split. When contaminating the training data of one class, randomly sample images from other classes' training data and leave the validation and test set untouched. Specifically for DermaMNIST in MedMNIST, we only consider the classes that have more than 500 images in the training data as normal data candidates, which include benign keratosis-like lesions, melanoma, and melanocytic nevi. We view all other classes as abnormal data. Different experiment runs have different randomness.
Tabular Data. Our study includes the four multi-diimensionll tabular datasets from the ODDS repository which have an outlier ratio of at least 30%. To form the training and test set for tabular data, we first split the data into normal and abnormal categories. We randomly sub-sample half the normal data as the training data and treat the other half as the test data. To contaminate training data, randomly sub-sample the abnormal data into the training set to reach the desired 10% contamination ratio; the remaining abnormal data goes into the test set. Different experiment runs have different randomness.
Video Data. We use UCSD Peds1 a benchmark dataset for video anomaly detection. UCSD Peds contains 70 surveillance video clips - 34 training clips and 36 testing clips. Each frame is labeled to be abnormal if it has non-pedestrian objects and labeled normal otherwise. Making the same assumption as (Pang al., 2020), we treat each frame independent and mix the original training and testing clips together. This results in a dataset of 9955 normal frames and 4045 abnormal frames. We then randomly sub-sample 6800 frames out of the normal frames and 2914 frames out of the abnormal frames without replacement to form contaminated training dataset with 30% anomaly ratio. A same ratio is also used in the literature (Pang et al., 2020) that uses this dataset. The remaining data after sampling is used for the testing set, whose about 30% data is anomalous. Like the other data types, different experiment runs have different randomness for the training dataset construction.
D.3 MODEL ARCHITECTURE
The experiments involve two anomaly detectors, NTL and multi-head RotNet (MHRot), and three data types.
NTL on Image Data and Video Data. For all images (either natural or medical) and video frames, extract their features by feeding them into ResNet152 pre-trained on ImageNet and taking the penultimate layer output for our usage. The features are kept fixed during training. We then train an NTL on those features. We apply the same number of transformations, network components, and anomaly loss function L (z), as when Qiu et al. (2022a) apply NTL on the image data.
NTL on Tabular Data. number of transformations, network components, and anomaly loss function (zx,, as when Qiu al. (2022a) apply NTL on the tabular data.
We directly use the tabular data as the input of NTL. We apply the same
MHRot on Image Data. tions, MHRot architecture, and anomaly loss function when Qiu al. (2022a) apply MHRot on the image data.
We use the raw images as input for MHRot. We set the same transforma-
hhttp://ddds cs. http:///dd..cssstttoooooooooo
www.d
19

---

Under review as a conference paper at ICLR 2023
DSVDD Image Data. For all images (either natural medical), we build DSVDD the features from the penultimate layer of a ResNet152 pre-trained on ImageNet. The features are kept fixed during training. The neural network of DSVDD is three-layer MLP with intermediate batch normalization layers and ReLU activation. The hidden sizes are [1024, 512, 128].
D.4 OPTIMIZATION ALGORITHM
Model
Dataset
Learning Rate
Epoch
Minibatch Size
CIFAR-I0 10 F-MNIST
le-4
30
512
le-2
Tc-4
30
512
le-2
NTL
MedMNIST
1c-4
30
le-2
ODDS
Ic-3
100
[N/5]
1e-2
UCSD Peds1
le-4
3"
192
le-2
CIFAR-10
le-3
15
10
N/A
MHRot
F-MNIST
lc-4
15*
10
N/A
MedMNIST
lc-4
15
N/A
CIFAR-10
le-4
30
512
le-2
Deep SVDD
F-MNIST MedMNIST
le-4
30
512
le-2
lc-4
30
512
le-2
HHyb22, Hybr3, Posl, and Pos2 train 30 epochs. All other methods train 3 epochs.
ALOE train 3 epochs.
Table 5: summary optimization parameters for all methods.
In the experiments, the local optimal anomaly scorer parameters For Adam, we set ,1 = 0.9, B2 = 0.999 and no weight decay for all experiments.
Adam (Kingma and Ba, 2014) to optimize the objective function to find
To set the learning rate, training epochs, minibatch size for MedMNIST, we find the best performing hyperparameters by evaluating the method on the validation dataset. We use the same hyperparameters on other image data. For video data and tabular data, the optimization hyperparameters are set as recommended by Qiu et al. (2022a). We summarize all optimization hyperparameters in Tab. 5.
When training models with ALOE, we resort to the block coordinate descent scheme that update the model parameters 0 and the pseudo labels ý of unlabeled data in turn. In particular, take the following two update steps iteratively:
update 0 by optimizing Eq. (3) given ÿ fixed;
update ý by sovling the constrained optimization in Sec. 3.3 given 0 fixed;
Upon updating ÿ. use the LOEs variant (Qiu et al., 2022a) for the unlabeled data. We set the pseudo labels ý by performing the optimization below
E Σ 1=1
1 U
Σ J. (.L)(x)) + (11 s.t.
a
min (R.0.
J
iell
where ā is the updated contamination ratio of 24 after the querying round, à (a.
Ejeo 1l (x;))) and is computed by Eq. (4) given Q. The solution is to rank the data by (x) (x) and label the top ā data abnormal (cquivalently setting ğ = 0.5) and all the other data normal (equivalently ÿ 0).
When we compute the Euclidean distance in the feature space, we construct the feature vector of a sample by concatenating all its encoder representations of different transformations, For example, if the encoder representation has 500 dimensions and the model has transformations, then the final feature representation has 10 500 5000 dimensions.
20

---

Under review as a conference paper at ICLR 2023
D.5 TIME COMPLEXITY
Regarding the time complexity, the optimization uses stochastic gradient descent. The complexity of our querying strategy N(KN) where is the number queries and is the size of the training data. This complexity can be further reduced to O(K log N) with scalable extension of k-means++ (Bahmani et al., 2012).
E ADDITIONAL. EXPERIMENTS AND ABLATION STUDY
The goal of this ablation study is to show the generality of ALOE, to better understand the success of ALOE, and to disentangle the benefits of the training objective and the querying strategy. To this end, we applied ALOOE to different backbone models and different data forms (raw input and embedding input), performed specialized experiments to compare the querying strategies, demonstrate the optimality of the proposed weighting scheme Eq. (3), and to validate the detection performance of the estimated ratio by Eq. (4). We also compared ALOE against additional baselines including semi-supervised learning frameworks and shallow anomaly detectors.
E.I RESULTS WITH OTHER BACKBONE MODELS
Table 6: |2] = 20. AUC (%) with standard deviation for anomaly detection on six datasets (CIFAR- 10, F-MNIST, Blood, OrganA, OrganC, OrganS). The backbone models are MHRot (Hendrycks et al., 2019) and Deep SVDD (Ruff et al., 2018). For all experiments, we set the contamination ratio as 10%. ALOE consistently outperforms two best pest-performing baselines on all six datasets.
MIlRot
Deep SVDD
ALOE
Hybrl
Hybr2
ALOE
Hybrl
Hybr2
CIFAR-10
86.9+0.7
83.9+0.11
49.1=2.0
93.1++0.2
89.0=0.6
91.3+1.0
F-MNIST
92.6=t0.1
87.1
58.9=5.7
91.4+00.5
90.9=0.4
82.5+2.9
Blood
83.3
81.14:2.5
61.8-12.1
80.2.11.1
79.7=11.2
77.2+:3.0
OrganA
96.5+10.3
94.1++0.3
61.111488
89.5+-0.3
87.1+0.77
71.3433.8
OrganC
92.1+-02
91.6+10.1
70.9
87.5++0.7
85.3-10.8
84.24-0.9
OrganS 89.311022
88.310.3
68.2=1011
85.5110.7
83.410.3
81.211..
We are interested whether ALOE works for different backbone models. To that end, we repeat part of the experiments in Tab. 2 but using self-supervised learning model MHRot (Hendrycks et al., 2019) and one class classification model Deep SVDD (Ruff et al., 2018) as the backbone model. We compare ALOE to two best performing baselines Hybr1 and Hybr2. In this experiment, MHRot and Deep SVDD take different input types: while MHRot takes raw images as input, Deep SVDD uses pre-trained image features. We also set the query budget be Q 20.
We report the results in Tab. 6. showcases the superiority of ALOE compared to the baselines. On all datasets, ALOE significantly outperforms the two best performing baselines, Hybrl and Hybr2, thus demonstrating the wide applicability of ALOE across anomaly detection model types.
E.2 DISENTANGLEMENNT OF ALOE
Table 7: |Q| 20. AUC (%) with standard deviation for anomaly detection CIFAR-10 and F- MNIST. For all experiments, we set the contamination ratio as 10%. ALOE mitigates the performance drop when NTL and MHRot trained on the contaminated datasets. Results of the unsupervised method LOE are borrowed from Qiu et al. (2022a).
NTL
MHRot
LOE
k-means++
ALOE
LOE
k-meanst+
ALOE
CIFAR-10
94.9+H0.1
95.6+H0.3
96.3+-0.3
86.3+0.2
64.0++0.2
86.9+10.7
F-MNIST
92.511.11
94.310.2
94.8-10.4
91.2-10.4
91.510.1
92.611.1
21

---

Under review as a conference paper at ICLR 2023
We disentangle the benefits of each component of ALOE and compare it to unsupervised anomaly detection with latent outlier exposure (LOE) (Qiu et al., 2022a), and to supervised active anomaly detection with k-means++ querying strategy. Both active approaches (k-means++ and ALOE) are evaluated with [ = 20 labeled samples. The unsupervised approach LOE requires an hyper- parameter of the assumed data contamination ratio, which Comparing ALOE to LOE reveals the benefits of the k-means++ active approach": comparing ALOE k-means++ reveals the benefits of the unsupervised loss function in ALOE. Results in Tab. show that ALOE leads to improvements for both ablation models.
the ground truth value 10%.
E.3 COMPARISONS OF QUERYING STRATEGIES
CIFAR-10
FMNIST
Blood
Path
175
90
OrganA
Organs
OrganC
Preumonis
55
40.
06.0
900
35.0
80.5
33.5
225
684
OCT
Tiesue
Derma
#Quereed samples
ALDE coust
Rant2
03.
Hyorl
Hyor2
28
166
340
samples
Duerric 3am
samples
Figure 8: Ablation study on the query strategy. K-Means++ significantly outperforms other strategies for active anomaly detection on most of the datasets.
To understand the benefit of sampling diverse queries with k-means++ and examine the general- ization ability (stated in Thm. 1) of different querying strategies, we run the following experiment: We use a supervised loss on labeled samples to train various anomaly detectors. The only difference between them is the querying strategy used to select the samples. We evaluate them on all image data sets we study for varying number of queries [ between 20 and 160.
Results are in Fig. 8. On all datasets except OCT, k-means++ consistently outperforms all other querying strategies from previous work on active anomaly detection. The difference particularly large when only few samples are queried. This also confirms that diverse querying generalizes better on the test data than other querying strategies (see additional results Supp. A).
E.4 ABLATION ON ESTIMATED CONTAMINATION RATIO
To see how the estimated ratio affects the detection performance, we compare ALOE to the counterpart with the true anomaly ratio. We experiment on all 11 image datasets. In Fig. 9, we report the average results for all datasets when querying |Q] = 20, 40, 80, 160 samples. shows that ALOE with either true ratio estimated ratio performs similar given all query budgets. Therefore, the estimated ratio can be applied safely. This is very important in practice, since in many applications the true anomaly ratio is not known.
22

---

Under review as a conference paper at ICLR 2023
82.5
AUCROC (%)
80.0
77.5
75.0
ALOE (True Ratio)
72.5
ALOE (Estimated Ratio)
20
40
80
160
# #Queried samples
Figure 9: Model using the estimated ratio indistinguishable from the one using the true ratio.
CIFAR-10
F-MNIST
97
98
AUCROC (%)
AUCROC (%)
96
97
95
96
94
95
K-20
K- 80
K- 20
K-80
94
K-40
K-160
K-40
K-160
0.01
0.10
1.00
10.00
0.01
0.10
1.00
10.00
Weights of queried samples
Weights of queried samples
Figure 10: Ablation study on the weighting scheme in Eq. (3). With different query budgets |Q] the performance on image datasets degrades both upon down-weighting (0.01, 0.1) or up-weighting (10.0) the queried samples. contrast, equal weighting yields optimal results.
E.5 ABLATIONS ON WEIGHTING SCHEME
We make the implicit assumption that the averaged losses over queried and unqueried data should be equally weighted (Eq. (3)). That means, if fraction of the data is queried, every queried data point weights 1/c as much as an unqueried datum. As consequence, neither the queried nor the unqueried data points can dominate the result.
To test whether this heuristic is indeed optimal, we added scalar prefactor to the supervised loss in Eq. (3) (the first term) and reported the results on the CIFAR-10 and F-MNIST datasets with different query budgets (Fig. 10). A weight<1 corresponds to downweighting the queried term, while a weight>1 corresponds upweighting it. We use the same experimental setup and backbone (NTL) as in the paper. The results are shown in Fig. 10. We see that the performance degrades both upon down-weighting (0.01, 0.1) or up-weighting (10.0) the queried samples. In contrast, equal weighting yields optimal results.
E.6 COMPARISONS WITH SUPE-VUPE LEARNING FRAMEWORKS
ALOE exploits the unlabeled data to improve the model performance. This shares the same spirit of semi-supervised learning. We are curious about how a semi-sume remi-supervised learning method performs in active anomaly detection setup. To this end, adapted existing semi-supervised learning framework FixMatch (Sohn et al., 2020a) to our setup and compared with our method in Fig. 11. As follows, we will first describe the experiment results and then state the adaptation of FixMatch to anomaly detection we made.
FixMatch, semi-supervised learning algorithm, regularizes the image classifier on large amount of unlabeled data. The regularization, usually referred to consistency regularization, requires the classifier have consistent predictions on different views of unlabeled data, thus improves the
'Notice that while L.OF uses the true contamination ratio (an oracle information). ALOE only uses the estimated contamination ratio by the 20 queries.
23

---

Under review as a conference paper at ICLR 2023
CIFAR-10
F-MNIST
AUCROC (%)
AUCROC (%)
90-
FixMatch k-means
FixMatch k--maass-
FixMatch w/ random
FixMatch w/ random
95-
KNN (k=10)
KNN (k=10)
Goussion Process
Gaussian Process
Goussian Process with Anomaly Ratio
Gaussian Process with Anomaly Ratio
ALOE (ours)
ALOE (ours)
80
20
160
#Queried samples
#Queried samples
Figure 11: Comparison with semi-supervised learning fraemworks, FixMatch (Sohn et al., 2020a), k-nearest neighbors (Iscen et al., 2019), and Gaussian process (Li al., 2018). On E-MNIST, ALOE outperforms all baselines, while on CIFAR-10, 10, ALOE has a comparable performance with FixMatch with k-means++ querying.
classifier's performance. FixMatch generates various data views through image augmentations followed by Cutout (DeVries and Taylor, 2017). We noticed that, although FixMatch focuses on making use of the unlabeled data, its performance is highly affected by the quality of the labeled data subset. We investigated two variants depending on how we acquire the labeled data. One the original semi-supervised learning setting, i.c.. assuming the labeled data is random subset of the whole dataset. The other one utilizes the same diversified data querying strategy k-means+ as ALOE to acquire the labeled part. In Fig. 11, we compared the performance of the two variants with ALOE, shows that, on natural images CIFAR10 for which FixMatch is developped, while the original FixMatch with random labeled data is still outperformed by ALOE, FixMatch with our proposed querying strategy k-means++ has a comparable performance with ALOE. However, such advantage of FixMatch diminishes for the gray image dataset F-MNIST, where both variants are beat by ALOE on all querying budgets. In addition, the FixMatch framework is restrictive and may not be applicable for tabular data and medical data, the augmentations are specially designed for natural images.
FixMatcc is designed for classification. To make it suit for anomaly detection, we adapted the original algorithm² and adopted the following procedure and loss function.
1. Label all training data as normal and train the anomaly detector for one epoch;
2. Actively query a subset of data with size [Q], resulting in Q and the remaining data 14;
3. Finetune the detector in supervised manner on con-augmeteed Q for 5 epochs;
4. Train the detector with the FixMatch loss Eq. (7) on augmented {Ut Q} until convergence.
We denote weak augmentation of input æ by (xx) and the strong augmentation by A(x)) The training objective function we used is
CiixMatch (0) =
Σ JEQ
(1-
1 M
Σ (S(a(z))) < 20.7 or S(a(xx)) > go.os) (ū+ ((((a))) + (1 (.))) (7)
IEU
where pseudo labels {5(a(zz)) In the loss function, we only use the unlabeled samples with confidently predicted pseudo labels. This is controlled by the indicator function ((((((x))) %0.7 or S(a(x;)) qo.os)
((S(a();)) > (o.ss) and on is the n-quantile of the anomaly scores
We apply this loss function for mini-batches on a stochastic optimization basis.
We also extend the semi-supervised learning methods using non-parametrics algorithms our active anomaly detection framework. We applied k-nearest neighbors and Gaussian process for inferring
'e adapted the FixMatch
implementation
https://gi com/ com/kekmodel)
Fi xyytchh-ytorch
24

---

Under review as a conference paper at ICLR 2023
the latent anomaly labels (Iscen al., 2019; Li et al., 2018) because these algorithms unbiased in the sense that the queried sample size is large enough, the inferred latent anomaly labels approach to the true anomaly labels. For these baselines, we also queried a few labeled data with k-means++ -based diverse querying strategy and then annotate the unqueried samples with k-nearest neighbor classifier or Gaussian process classifer trained on the queried data.
Both methods become ablations ALOE. We compare ALOE with them on CIFAR-10 10 and F-MNIST under various query budgets and report their results in Fig. 11. On both datasets, ALOE improves over the variant of using only queried samples for training. On F-MNIST, ALOE outperforms all ablations clearly under all query budgets, while on CIFAR-10, ALOE outperforms all ablations except for FixMatch when query budget is low. In conclusion, ALOE boosts the performance by utilizing the unlabeled samples properly, while other labeling strategies are less effective.
E.7 MORE COMPARISONS
Table 8: Comparisons with KNN method. We reported the F1-score (%) with standard error for anomaly detection on tabular datasets when the query budget K 10. ALOE outperforms the kNN baseline.
NN
ALOE
BreastW
9..
93,910.55
Ionosphere
8..1
91.8.11.1
Pima
40.5=4.7
1.,
Satellite
61.1=2.2
71.1
Average
70.6
78.1
CIFAR-10
F-MNIST
98
96
AUCROC (%)
AUCROC (%)
96
94
94
92-
Representation Diversity
Representation Diversity
92
Gradient Diversity
90
Gradient Diversity
40
160
20
80 # #Queried samples
160
Quueried samples
Figure 12: Comparison with gradient diversity querying strategy (BADGE) (Ash et al., 2020). The gradients wrt. the penultimate layer representation don't provide as informative queries the representation itself, thus outperformed by our querying strategy ALOE. The true contamination ratio 10%.
Comparisons to kNN (Ramaswamy al., 2000) We compared against kNN in two ways. First we confirmed that our baseline backbone model NTL is competitive with kNN, which is shown to have a strong performance on tabular data (Shenkar and Wolf, 2022). To this end, NTL has been shown to yield 95.7% AUC on clean CIFAR-10 10 data, see Shenkar and Wolf, 2022, Table column 1. In contrast, Qiu al. (2022a) reported 96.2% AUC Table 2, which very close.
Second, we tested the performance of the kNN method on our corrupted training data set. We gave kNN the advantage of using the ground truth contamination ratio (otherwise when under-estimating this value,
the method degrade severely in performance).
KNN has two key hyperparameters: the number of nearest neighbors and the assumed contamination ratio of the training set. The method uses this assumed contamination ratio when fitting to define the threshold on the decision function. In our experiments, we tried multiple values of & and reported the best testing results. Although the ground truth anomaly rate is unknown and our proposed methods don't it have access to it, we gave kNN the competitive advantage of knowing the ground truth contamination ratio.
25

---

Under review as a conference paper at ICLR 2023
We studied the same tabular data sets in our paper: BreastW, Ionosphere, Pima, and Satellite. We used the same procedure for constructing contaminated data outlined in our paper, where the contamination ratio was set to 10%. The results summarized in Tab. 8.
We adopted PyOD's s implementation of KNN and set all the other hyperparameters to their default values ("method, radius, algorithm, leaf size, metric, p. and metric_ satrric_prams"..... We repeated the experiments 10 times and reported the mean and standard deviation of the F1 scores in Tab. 8. We find that our active learning framework outperforms the KNN baseline.
In more detail, the Fl scores for different values of & are listed below, where k = 1,2, 5, 10, 15, 20, respectively:
BreastW: 84.3#7.6, 86.5 89.9 90.7 92.4
lonosphere: 18.3, 87.6 84.5+ 75.244,,,55.2224 75.242.5, 70.4+3.6, 67.443.4
Pima: 34,4#3.6, 1,,423,,,32333344.....990 36.9 0000996644.40544333333333333,,,3 35.5
Satellite: 51.0+t1.1, 53.5. 54.7 3, 57.44188, 1.3 61.1
Comparisons to Gradient Diversity Querying Strategy (BADGE) (Ash al., 2020) We com- pared against popular active learning method, BADGE (Ash et al., 2020), which is a diversity-driven active learning method that exploits sample-wise gradient diversity. We start with observing that BADGE doesn't it work well for anomaly detection in Fig. 12, where we only replaced the objects that k-means++ works on in ALOE with gradients demanded in BADGE (Ash et al., 2020) while keeping all other settings fixed. This variant is referred to "Gradient Diversity" while ours is denoted by "Representation Diversity". Fig. 12 shows the performance of Gradient Diversity is outperformed by large margin, failing in querying informative samples our Representation Diversity.
To understand which part of BADGE breaks for anomaly detection tasks, we check the gradients used by BADGE in anomaly detection model. Before that, we start with describing how BADGE works. BADGE is developed for active learning in classification tasks. Given pre-trained classifier, it first predicts the most likely label ý (pseudo labels) for the unlabeled training data æ. These pseudo labels are then used to formulate cross entropy loss (xE( 9). BADGE computes every data point's 's loss function's 's gradient to the final layer's weights as the data's 's representation. Upon active querying, subset of data are selected such that their representations are diverse. In particular, the gradient to each dass-specific weight We is Ww, w, (xx 9) = (P& (ū ()))(z))))))))))))))))))))))kk) where pk is the predicted probability of being class k and d(xx is the output of the penultimate layer. Proposition I of Ash et al. (2020) shows the norm of the gradient with pseudo labels a lower bound of the one with true labels. In addition, note that the gradient is scaling of the penultimate layer output. The scaling factor describes the predictive uncertainty and is upper bounded by 1. Therefore, the gradients are informative surrogates of the penultimate layer output of the network, shown by the inequality
NVw,loE(2 I)1 < loWw, r) < [|0(z)]1?
(8)
However, these properties are associated with the softmax activation function usage. In anomaly detection, models and losses are diverse and are beyond the usage of softmax activation outputs. Hence the gradients are no longer good ways to construct active queries. For example, the supervised deep SVDD (Ruff et al., 2019) uses the contrasting loss 1(x, y) = y/(W ((x) - c) + (1-y) ((x) -c)² to compact the normal sample representations around center However, the gradient V Vwl(x, y) = (2(1 ( d(x) c) 2y(W (xx)- - c) c)- ((x))) (x) is not a bounded scaling of ((x) any more, thus not an informative surrogate of point æ.
E.8 NTL AS A UNIFIED BACKBONE MODEL
In Section of the main paper, we have empirically compared ALOE active-learning strategies known from various existing papers, where these strategies originally were proposed using different backbone architectures (either shallow methods or simple neural architectures, such as autoencoders). However, several recent benchmarks have revealed that these backbones are no longer competitive with modern reff-supervised ones (Alvarez et al., 2022). For fair empirical comparison of ALOE to modern baselines, we upgraded the previously proposed active-learnin methods by replacing their
httpp::/ wwigtttub.... htttts////gtthbb..co///aaaaa00/ httpbb.ccomyyhhcoo2//yyyyy
26

---

Under review as a conference paper at ICLR 2023
simple respective backbones with modern self-supervised backbone: NTL (Qiu et al., 2021) the same backbone that is also used ALOE.
We motivate our choice of NTL unified backbone in experiments follows. Fig. 13 shows the results of ten shallow and deep anomaly detection methods (Qiu et al., 2022a; Deecke et al., 2018; Ruff et al., 2018: Golan and EI- Yaniv, 2018; Hendrycks al., 2019; Tax and Duin, 2004; Liu et al., 2008; Diederik P. Kingma, 2014; Makhzani and Frey, 2015; Sohn et al., 2020b) on the CIFARIO one-vs.-rest anomaly detection task. NTL performs best (by large margin) among the compared methods, including many classic backbone models known from the active anomaly detection literature (Trittenbach al., 2021; Ruff et al., 2019; Görmitz et al., 2013; Das al., 2019; Pimentel et al., 2020; Ning et al., 2022; Barnabé- Lortie et al., 2015).
Test Error on CIIAR-10.AD
45
IF
40
5VDD
DCAE
ADGAN
DSVDD
Erai.
10
MHHol Contrastive
NTL
2004
2008
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
Year
Figure 13: Error (in % of I-AUCROC) of ten methods on CIFARIO: two shallow methods (SVDD (Tax and Duin, 2004) and IF (Liu et al., 2008)) and eight deep methods (VAE (Diederik P. Kingma, 2014), DCAE (Makhzani and Frey. 2015), ADGAN (Deecke et al., 2018), DSVDD (Ruff et al., 2018), GT (Golan and Ylniv, 2018), MHRot (Hendrycks et al., 2019), Contrastive (Sohn et al., 2020b), and NTL (Qiu et al., 2022a)). NTL. achieves the best anomaly detection performance on CIFAR10.
Table Fl-scores (in %) and their standard deviations of 13 anomaly detection methods on tabular data. Results taken from Alvarez et al. (2022). The results indicate that NTL is the state-of-the-a ara for tabular anomaly detection.
KDDCUP10
NSL-KDD
IDS2018
Arthythmia
Thyroid
Avg.
ALAD
95.9++0.7
92.1
59.0+F..0
57.4+004
68.6+0.5
74.6
DAE
93.2+:2.0
96.1+t0.1
71.5+00.5
61.5+22.5
1..0+
76.3
DAGMM
95.911.44
85.317.4
55.8155.3
50.6114.7
48.6.18.0
67.2
DeepSVDD
89.11220
89.3120
20.81111
55.5113.0
13.11:13
53.6
DROCC
91.1-1.00
90.4.10.00
45.6.10.0
35.8.1..6
62.1-110
65.0
DSEBM-c
96.6#0.1
94.6+0.11
43.911..8
19.9=1.0
23.8+t0.7
63.8
DSEBM-r
98.0.1.11
95.5+0.11
40.740.1
60.1
23.6+t0.4
63.6
DUAD
96.5#1.0
94.5+0.2
7188:2.7
6088104
14.945.5
67.7
MemAE
95.0++1.7
95.6++0.0
59.9+0.1
62.6+
56.1+0.9
73.8
SOM-DAGMM
97.7+0.3
95.6++0.3
44.1+1111
51.9+5.9
52.7+-12
68.4
LOF
95.1+0.00
91.1+00.0
63.8+000
61.5+000
68.6+10.0
76.0
OC-SVM
96.710.00
93.0110.0
45,4110.0
63,510.00
68.1-10.0
73.3
NTL
96.410.2
96.0110.1
59.518.9
60.7133.7
73.4:10.6
77.2
An independent benchmark comparison of 13 methods (including nine deep methods proposed in 2018-12 (018-2022) (Alvarez et al., 2022) recently identified NTL as the leading anomaly-detection method tabular data. In their summary, the authors write: 'NeuTraLAD, the transformation-base approach, offers consistently above-average performance across all datasets. The data aatt--aammmmtatinnn strategy is particularly efficient small-scale datasets where samples scarce.'. Note that the
27

---

Under review as a conference paper at ICLR 2023
latter is also the scenario where active learning is thought to be the most promising. We show the results from Alvarez et al. (2022) in Tab. 9.
28


Reviews:
[{"review_id": "UgxXbbOaFF", "reviewer": "Reviewer_7TvR", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed an active learning approach for deep anomaly detection where a k-means++ based diversified querying strategy is adopted to ensure that the queries cover both the normal data and the anomalies well and two losses for queried and unqueried samples are designed to prevent neither the queried nor the unqueried data points from dominating the learning task. This paper also provides a method to estimate the unknown contamination rate from queried samples thus avoiding the assignment of the most important hyperparameters. This paper also provides a detailed theoretical derivation and experimental verification of the assumptions and theories used in the method. The experimental results show that the proposed method outperforms the compared methods significantly. The ablation study also shows the effectiveness of the proposed method.\n", "summary_of_the_review": "This paper proposed an active learning approach for deep anomaly detection which is composed of unsupervised anomaly detection with latent outlier exposure (LOE) and supervised active anomaly detection with k-means++ querying strategy. It fully exploits the supervised and unsupervised information into anomaly detection, which ensures the diversity of the selected samples and the generalization of the scoring function to unlabeled and labeled sets. The theoretical derivations and experiments in the article are very detailed. Overall the article is novel enough and well-written.", "strength_and_weaknesses": "Strength:\n1.\tThe proposed method can fully exploits the supervised and unsupervised information in anomaly detection.\n2.\tThe important hyperparameters in the proposed method are designed adaptively. \n3.\tThe theorems and assumptions used in the paper are theoretically derived and experimentally verified in detail and the experimental results of the proposed method are promising.\n\nWeakness:\n1)\tThe time complexity of the proposed method is not clearly. In the experiment, why the proposed method is not verified on large-scale dataset.\n2)\tIn the proposed method, a querying strategy that encourages diversity with k-means++ is proposed method. However, the main contributions of this strategy are not clearly presented.\n3)\tIn the proposed method, the equation(3) mainly deals with binary classification. How does the proposed method deal with the multiple classification setting.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "DMCJFADvFOA", "reviewer": "Reviewer_uxaT", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a diversified query strategy for an anomaly detector that can be applied in an active learning setup. The querying strategy is based on querying diverse cluster centers seeded by k-means++.", "summary_of_the_review": "The theory and assumptions are not well grounded. The claim that this is in an active learning setting does not match the experiment setup where instead of multiple rounds of feedback, all query instances are selected at one shot.", "strength_and_weaknesses": "1. Abstract: \"However, correctly identifying anomalies requires an estimate of the fraction of anomalies in the data.\" -- This has never been proven (to my knowledge). While specific algorithms might make assumptions, this is not true in general. Anomalies are by nature unknown unknowns. Even their fraction is not knowable. The paper probably makes this statement w.r.t the specific LOE algorithm discussed and should clarify that or remove this statement.\n\n\n2. Section 2: \"... not comparable to Pelleg and Moore (2004), Siddiqui et al. (2018), and Ghasemi et al. (2011), who fit a density model on the raw input data ...\" -- Siddiqui et al. is tree-based. They do not fit a density model.\n\n\n3. Section 3.2: \"... determined by the smallest radius \\delta such that ...\" -- Is the radius \\delta here an absolute distance measure, or in normalized units? It does not make sense if the distance is unnormalized and if it (distance between data points) could vary from zero to infinity.\n\n\n4. Section 3.2: \"... all unlabeled points are within distance \\delta of one queried sample of the same type.\" -- This makes strong and oversimplifying assumption about the data. It basically means assuming that data from various classes are tightly clustered together.\n\n\n5. Section 3.2: \"... we propose a querying strategy that encourages diversity: k-means++ ...\" -- Querying cluster centers is a classic active query strategy and not novel. For example, [r1] proposes an approach to query the centroids of clusters of instances that lie closest to the decision boundary.\n\n\n6. Assumption 2: I suspect Assumption 2 has fallen for a statistical fallacy.\n\nAs an analogy to the Assumption 2 made here, suppose we consider undergrad students at a top ranked US university. The average (say) SAT scores will be very high and the distribution of the scores around that (high) average will be statistical noise -- just like the off-diagonal correlation mentioned here. However, that does not mean that the distribution of SAT scores among the general population will be the same as at the university.\n\n\n7. Section 4: \"... and all |Q| queries are collected at once.\" -- This is not really an active learning setup. For comparing with active learning algorithms on a fair basis, the algorithm should iterate over multiple label feedbacks from a (simulated) human-in-the-loop.\n\n\n8. Table 2: \"For all experiments, we set the contamination ratio as 10%.\" -- Experiments should be run with actual contamination factor in the datasets, not the artificial 10%.\n\n\n9. Section 4.2: \"... which have an outlier ratio of at least 30%.\" -- This amount of anomalies does not really make it an anomaly detection problem. The set of experiments are missing some harder real-world datasets where the anomaly fraction is really small ~1-2%.\n\n\n10. Appendix C: \"Hybr2. This hybrid strategy by Das et al. (2019) makes positive diverse queries.\" -- The main query strategy for diversity in Das et al. (2019) is based on compact description. The strategy explained here is likely one of the alternatives proposed on the related github repo (https://github.com/shubhomoydas/ad_examples). This needs to be clarified. It should be noted that the compact description based approach in Das et al. is basically a clustering-based approach.\n\n\nReferences:\n\n[r1] Xu, Z., Akella, R., & Zhang, Y. (2007). Incorporating Diversity and Density in Active Learning for Relevance Feedback. ECIR.\n\n\n>>>>>>>>>>> Update after author response\n\nI thank the authors for responding to my comments. At this time I do not have sufficient reason to change my scores. Mainly, I do not see this as a true 'active learning' anomaly detection algorithm and it comes across as mostly a class-imbalanced classification problem. The paper started off with an unproven and unjustified premise that correctly identifying anomalies requires estimating the anomaly fraction. It appears that the premise might have some bearing under a few strong assumptions for a specific anomaly detection algorithm, but that is not generalizable. Some more comments:\n\n\n1. Clarification on Assumption 2 (and also Assumption 1) comment: The paper assumes that if off-diagonal elements of the score matrix constructed from a subset of data are zero, then you can deduce some properties of the general population from that. But, that is wrong as I pointed out with an example. You can have query schemes where the off diagonal correlations can be zero, but the general population's score distribution cannot be deduced from that. That is why the theory is not well-grounded.\n\n\n2. \"Different application areas require a different active learning setup.... The experimental comparison is fair because all methods are evaluated in the same setting...\" -- This is where we have a contradiction. Most (all?) of the competitor/benchmark active learning algorithms used in this paper were designed for continuous active learning. So then why compare a one-shot feedback algorithm with the continuous feedback algorithms?\n\n\n3. \"This video dataset is a benchmark dataset for anomaly detection and has the original outlier ratio of around 30%.\" -- In that case let's use more / other datasets where the anomaly ratios are very small.\n\n\n4. \"We refer to their strategy based on the description in the paragraph 'Diversity-based Query Selection Strategy' on page 12\" -- The method described in the current work is not the same as Das et al. (2019) and should be made clear.\n\n\n5. \"..reviewer i6D3 found our theoretical study novel and reviewer 7TvR said..\" -- My review not being in agreement with other reviewers is (among other things) a sign of having an independent opinion -- which I last checked is highly valued among reviewers at ICLR.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "0rN5dTw2V6M", "reviewer": "Reviewer_i6D3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper is a combination of Latent Outlier Exposure (Qiu 2022) and an active learning strategy from the same group. The idea is to exploit knowledge about the outlier rate to control active learning sample selection during training. The assumption is that finding anomalies in the (unlabeled) training set will improve the quality of anomaly detection in the test phase. A lot of experiments on different ML tasks (images, medical images, videos, etc.) demonstrate improvement over existing techniques. The authors also support their claims with some theorems. ", "summary_of_the_review": "The paper tackles a (from my perspective) very special (and not such common) case in anomaly detection. For me, it is not clear whether the detection of real anomalies and outliers can be improved. Real anomalies are those who have never been seen before, for example, novel classes in a continual learning scenario. It is quite natural that one can improve on anomaly detection if one can optimize the model during training on that already. Then, anomaly detection (even with only 10% outlier rate) boils down to a supervised setting (of course, an unbalanced one). Since the author missed to take this perspective as well and as a consequence to study and compare with literature in areas like normal active learning and continual learning, I am not that happy about the paper. Finally, I am missing experiments on image data beyond X-MNIST, like one can find results for normal active learning. ", "strength_and_weaknesses": "I like the rigorous analysis from a theoretical perspective and the extraordinary evaluation of their method on real data. The paper is well-written and builds upon existing publications. I do not agree with the assumption or application case. In my opinion, anomaly detection is no longer such a task if you are able to identify such anomalies from the training data. It then becomes a supervised task with the anomalous events being an additional class. This statement might sound philosophical. However, if you do active learning in an supervised setting, the authors ignore methods from active learning. One example is EMOC, see Freytag et al.: Selecting Influential Examples: Active Learning with Expected Model Output Changes. European Conference on Computer Vision (ECCV). If we know that there are novel classes in our training set (the known one is the inlier data, the novel one the outlier), we shall also study methods that combine active learning in a continuous learning scenario, for example, Kaeding et al.: Active and Continuous Exploration with Deep Neural Networks and Expected Model Output Changes. NIPS Workshop on Continual Learning and Deep Networks. 2016. I find that the authors should consider such work as well and include it in the comparison. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject