Adversarially Robust Anomaly Detection through Spurious Negative Pair Mitigation
Authors: Hossein Mirzaei
Mojtaba Nafez
Jafar Habibi
Mohammad Sabokrou
Mohammad Hossein Rohban
Venue: ICLR 2025 Poster (2025)
Keywords: Anomaly Detection
Adversarially Robust Anomaly Detection
Mitigating Spurious Negative Pairs
Anomaly Aware Contrastive Learning
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning

Abstract: Despite significant progress in Anomaly Detection (AD), the robustness of existing detection methods against adversarial attacks remains a challenge, compromising their reliability in critical real-world applications such as autonomous driving. This issue primarily arises from the AD setup, which assumes that training data is limited to a group of unlabeled normal samples, making the detectors vulnerable to adversarial anomaly samples during testing. Additionally, implementing adversarial training as a safeguard encounters difficulties, such as formulating an effective objective function without access to labels. An ideal objective function for adversarial training in AD should promote strong perturbations both within and between the normal and anomaly groups to maximize margin between normal and anomaly distribution. To address these issues, we first propose crafting a pseudo-anomaly group derived from normal group samples. Then, we demonstrate that adversarial training with contrastive loss could serve as an ideal objective function, as it creates both inter- and intra-group perturbations. However, we notice that spurious negative pairs compromise the conventional contrastive loss for achieving robust AD. Spurious negative pairs are those that should be mapped closely but are erroneously separated. These pairs introduce noise and misguide the direction of inter-group adversarial perturbations. To overcome the effect of spurious negative pairs, we define opposite pairs and adversarially pull them apart to strengthen inter-group perturbations. Experimental results demonstrate our superior performance in both clean and adversarial scenarios, with a 26.1% improvement in robust detection across various challenging benchmark datasets.

Published as a conference paper at ICLR 2025
MITIGATING SPURIOUS NEGATIVE PAIRS FOR ROBUST INDUSTRIAL ANOMALY DETECTION
Hossein Mirzaei', Mojtaba Nafez", Jafar Habibi Mohammad Sabokrou', and Mohammad Hossein Rohban
icole Polytechnique Fédérale de Lausanne (EPFL.), Switzerland
Sharif University of Technology, Iran
Okinawa Institute of Science and Technology, Japan
rohban cohban@sharif.eer
hossein. how.eai..mmrrreiiaadaaaaaal.use.
ABSTRACT
Despite significant progress in Anomaly Detection (AD), the robustness of existing detection methods against adversarial attacks remains a challenge, compromising their reliability in critical real-world applications such as autonomous driving. This issue primarily arises from the AD setup, which assumes that training data is limited to group of unlabeled normal samples, making the detectors vulnerable adversarial anomaly samples during testing. Additionally, implementing adversar- ial training as a safeguard encounters difficulties, such as formulating an effective objective function without access to labels. An ideal objective function for adver- sarial training AD should promote strong perturbations both within and between the normal and anomaly groups maximize margin between normal and anomaly distribution. To address these issues, we first propose crafting a group derived from normal group samples. Then, demonstrate that adversarial training with contrastive loss could serve as an ideal objective function, as cre- ates both inter- and intra-group perturbations. However, notice that spurious negative pairs compromise the conventional contrastive loss to achieve robust AD. Spurious negative pairs are those that should be closely mapped but erroneously separated. These pairs introduce noise and misguide the direction of inter- group adversarial perturbations. To overcome the effect of spurious negative pairs, we define opposite pairs and adversarially pull them apart to strengthen inter-group perturbations. Experimental results demonstrate our superior performance in both clean and adversarial scenarios, with 26.1 % improvement in robust detection across various challenging benchmark datasets. The implementation our work is available at: https: /ttp://giittta http:/hww..ccmm/rbbaaaaaa/bb///a
INTRODUCTION
Anomaly detection (AD), also referred to one-class classification, aims identify whether input sample at the time of inference belongs to the normal In AD setup, the training data consists only of normal samples, and any additional information, such labels, is unavailable (Bndale and Boult ; Perera et al. (202T). Recently, a plethora of literature has emerged to address the problem of AD on images, demonstrating near-perfect performance on standard AD benchmarks Ruff et al. (2018); Tack et al. (2020); Bergman et al. (2020); Reiss et al.] Bergmann et al. (2019); Krizhevsky et al. (2009). Nevertheless, these methods demonstrate a lack of robustness, especially when faced with adversarial attacks, they encounter substantial performance deterioration when faced with such scenarios Azizmalayeri et al. (002)); Lo et al. (002)) Chen et al. (2020a); Shao et al. (2020) 2022); Béthune et al. (2023); Goodge et al. (2021) Chen et al. (202 This is due to the absence of anomaly samples in the training data, which results in insufficient exposure to adversarial perturbations anomalous patterns during training. This shortcoming would make the model vulnerable to adversarial attacks on anomaly samples during inference Chen et al. (2020a)
202

---

Published as a conference paper at ICLR 2025
Numerous defense strategies have been developed to enhance the robustness of deep neural networks, with adversarial training emerging as a potential solution Bai et al. (202I:: Madry et al. (201)). However, its application to AD is not straightforward, as it is primarily developed for multi-class and labeled setups. Motivated by this, we propose generating pseudo-anomaly group samples by applying hard augmentations facilitate practical adversarial training in an anomaly detection (AD) setup. This process involves shifting normal training data to ensure that the shifted samples do not belong to the normal group, measured by their likelihood using a novel thresholding approach (2013). We refer to the relationship between a normal sample and its transformed version as opposite pairs.
CrrroachhGloeee Glodek et al.
Given the availability of two groups groups-craftedd crafted anomaly and normal samples pumplee-during training, defining a loss function to incorporate them into the adversarial training presents a new challenge. Since the objective of test-time adversarial attacks is to manipulate normal samples to be confused with anomalies and vice versa, the optimal objective function should maximize the margin between the distributions of normal and anomaly samples in the learned embedding space while also achieving compact representations for each group. This can be adversarially accomplished by crafting strong
intra- and group perturbations Chen et al. (2021b); Cheng et al. 2023) Guo and Zhang 2021)
has been demonstrated that Contrastive Learning (CL) Chen et al. 2020bb; He et al. (2020) is more effective for AD compared to existing objective functions Guo al. (2024) Reiss and Hoshen
(2021): Tack et al.] 2020). One can propose adversarial training with CL to develop a robust AD) method. However, we noticed that adversarial training with the CL loss function falls short of achieving robust AD (see Table 6). The CL objective aims to bring positive pairs closer together and push negative pairs further apart. Positive pairs are constructed by applying light transformations to each instance, while any two instances in the training data are treated as negative pairs. We refer to negative pairs within the same group noormal-normin or anomaly-anomaly as spurious negative pairs. These spurious negative pairs weaken the effectiveness of adversarial CL by misdirecting inter-group perturbations, thereby reduces the margin between groups [hen et al. (022b))
To address this, we propose COBRA (anomaly-awar COntrastive-Bann approach for Robust AD), a new method that mitigates the effect of spurious negative pairs to learn effective perturbations. COBRA strategically utilizes opposite pairs, exclusively formed between normal and anomaly groups, ensuring they do not intersect with spurious negatives. This approach strengthens inter- group perturbations by emphasizing these opposite pairs in the loss function, thereby increasing the margin between groups. During training, the model adversarially targets positive pairs to push them together and opposite pairs pull them apart. This simulates a wide range of adversarial perturbations covering inter- and intra-set variations, resulting in a robust anomaly detector.
Contribution. COBRA introduces simple yet effective approach to generate anomaly samples and novel loss function to establish a robust detection boundary. We evaluate COBRA in both adversarial and clean settings, where test samples are benign. In the adversarial scenario, we employ numerous strong attacks for robustness evaluation, including RGD-1000 and Hein (2020). and Adaptive AutoAttack Liu al. (2022). The results show that COBRA, without using any additional datasets or pretrained models, sigmificantly outperforms existing methods in adversarial settings, achieving 26. 1% improvement in AUROC and competitive results in standard settings. Our experiments span various datasets, including large and real-world datasets such as Autonomous Driving Cordts et al. (2016), ImageNet(Dent et al. (2009), MVTecAD Bergmann et al. (2019), and Codella et al. (2019), demonstrating COBRA's practical applicability. Additionally, we conducted ablation studies to examine the impact of various COBRA components, specifically our pseudo-an -seudo-anomaly generation strategy and the introduced adversarial training method.
et al. (2017), Auto (Crcce
2 PRELIMINARIES
Anomaly Detection. Outlier detection is categorized into different areas, such as AD and Out-of- Distribution (OOD) detection, depending the availability of normal set samples' labels. An AD method decides whether x belongs to the normal or anomaly set by assigning an anomaly score f(z;f) using model f. Samples with anomaly score higher than a pre-assumed threshold predicted as anomalies, and vice versa Yang et al. (202T); Ruff et al. (202T). It is important to note that extending OOD detection methods to AD setup is not feasible, they rely labeled
2

---

Published as a conference paper at ICLR 2025
normal data for feature extraction. This highlights the need for robust AD methods Azizmallyyiiii et al. (2022); Chen et al. (2021a); KKng and Ramanan (202T); Han et al. (2022).
Adversarial Robustness of Anomaly Detectors. An adversarial attack is a malicious attempt to perturb a data sample x with an associated label y into a new sample x¹ that maximizes the loss function f(="; y). Additionally,
upper limit of confines the 1p norm of the adversarial noise to prevent semantic alterations. Specifically, an adversarial example x² must satisfy the following equations: x² arg maxg':lle=='1l St ((z';y) A prevalent and effective attack method is the Projected Gradient Descent (PGD) technique Madry et al. (0177). which entails iteratively maximizing the loss function by advancing towards the gradient sign of ((>;; y), employing a designated step size a. To adapt adversarial attacks for AD, instead of maximizing the loss value, we aim to increase A(x, f) if belongs to normal group and decrease it otherwise. The formulation of the attack would be: z = I, Fi+1 zt + sign (V A(rt; fo)), xx = zg. Here & is the number of attack steps, y = +1 for normal samples and y = -1 for anomaly samples. The same setting is applied to other attacks in our study.
Auxiliary Anomaly Sample Crafting. Cack et al. (2020) and CPAD Li et al. (021) propose using fixed hard augmentation to create auxiliary samples. Specifically, CSI relies on Rotation, while CPAD considers CutPaste as a
The GOE Kirchheim and Ortmeier (2022)
method employs a pretrained GAN on ImageNet-IK IK to craft anomalies by targeting low-density areas. FITYM Mirzaei FITYM[Mirzaei et al. (2022) employed an underdeveloped diffusion as a generator. Dream-OOD Du
et al. 2023) uses both image and text domains to learn visual representations of normal instances in
an embedding space of a pretrained stable diffusion Rombach et al. (2022) model trained on billion
data (e.g. LAION Schhhmaan et al. (2022)) On the other hand, VOS Du et al. (2022) generates anomaly embeddings instead of image data. Details about each mentioned method can be found in C
3 METHOD
Motivation. Adversarial training is one of the most promising approaches to enhance the robustness of deep neural networks. However, applying this technique to AD poses a significant challenge, as only a single concept class the normal distribution is available during training. A common approach to address this limitation is to incorporate an auxiliary anomaly dataset to improve robustness Azizmalayeri et al. (2022); CCen et (2021a) 2020a); Mirzaei et al. (2024a). However, leveraging such datasets is both costly and challenging, primarily due the need for preprocessing and filtering out normal samples, which could otherwise provide misleading information to the detector. Moreover, the use of additional anomaly data can bias the model towards specific anomaly samples, reducing its generalizability to unseen anomalies Ming et al. (2022).
To overcome these limitations, we propose simple yet effective method to craft anomaly samples directly from the normal data, thus eliminating the need for external anomaly datasets. Our approach involves applying hard augmentations (e.g., severe distortions) to normal samples, effectively pushing them towards the anomaly distribution. Importantly, prior work has demonstrated that the most effective anomalies for training are those that are closely related to the normal distribution, often referred to as "near anomaly samples" MMig et al. (2022): ; Mirzaei al. (2022); y Chen et al. (202 Ta). Our method satisfies this proximity, as the crafted anomalies maintain sty listicc similarities with the normal samples due to their generation through augmentations. To ensure that the crafted anomalies are sufficiently distinct from the normal distribution, we introduce a thresholding mechanism to filter out false anomalies. Implementing this mechanism requires a model that accurately captures the distribution of normal data. However, in the AD setup. the training data is limited to a single semantic class (e.g., images of cars) without any supplementary information, posing a challenge for building such a model. To overcome this, we employ a self-supervised approach to extract meaningful representations from the normal data. Inspired by representative studies in AD Golan and El- Yaniv 2018); Hendrycks et al. (2019a); Tack et al. (2020), which demonstrate that using clclass classifier to predict data transformations is an effective method for representation learning in one-class classification, we adopt this approach. We leverage the embeddings learned by the classifier to compute the likelihood of test samples and define a threshold for filtering out false anomalies.
Subsequently, we explore potential objective functions for adversarial training, focusing on CL given its recent success in AD tasks/Guo et al. (2024). However, we observe that employing standard CL in adversarial training may not yield optimal results. This stems from the fact that, when training
3

---

Published as a conference paper at ICLR 2025
dataset containing both normal and crafted anomaly samples, CL forms positive and negative pairs in a way that may compromise the margin between the normal and anomaly distributions. Specifically, CL seeks to uniformly repel negative pairs from each other, defined all pairs except those that are augmentations of each other Chen et al. (2020c). Consequently, the negative pairs include normal-normal, anomaly-anomaly, and normal pormal-anomaly pairs. Increasing the distance between normal-normal and -anomayy pairs may inadvertently reduce the separation between normal and anomaly sets, thus undermining robust detection performance. In other words, standard CL does not effectively enhance the inter-set margin needed to improve robustness. To address this, we design a novel objective function that explicitly maximizes the margin between the normal and anomaly groups to improve inter-group perturbation.
Outline. Existing AD methods experience dramatic performance decrease under adversarial attack. To address this, we propose COBRA, a novel method that integrates a distribution-awan transformation for generating psudo-anomaly samples, coupled with a novel objective function for adversarial training. In the subsequent sections, we will delve into each component in detail, outlining the mechanisms and advantages of our approach.
3.1 DISTRIBUTION AWARE HARD TRANSFORMATION
Anomaly Crafting Strategy. Previous works have demonstrated the effectiveness of leveraging an auxiliary random dataset as an additional source of anomaly data during the training phase for AD Hendrycks et al. (2018) 8); ; Tao et al. (2023 Du et al. (2022) 2023); Zhang et al. 2017); Mirzaci ct al. (2022); Kirchheim and Ortmeier (2022). However, this technique significantly depends on the diversity and distribution distance of the auxiliary dataset used for training. This limitation significantly hinders the use of this technique in areas like medical imaging. where real anomalies scarce and difficult to obtain. Moreover, they lack any threshold for dropping incorrectly crafted anomalies (those that still belong to the normal group). Addressing this limitation, our approach introduces a novel method that employs series of hard transformations T {Ti) to generate anomaly samples from normal data. We strategically distort normal images and by using a predetermined threshold ensures that the synthetically created samples significantly diverge from the normal distribution. We used a set of hard transformations including Jigsaw Noroozi and Favaro (2016). Random Erasing /Zhong et al.) (2020), CutPaste Ghiasi et al. (2020), Rotation, Extreme Blurring, Intense Random Cropping, Noise Injection /Akbiyik (2019). and Extreme Cropping, Mixup Hongyi Zhang 20188, Cutout GutoutDeeViice Vries and Taylor (2017), CutMix Yun et al. (2019), Elastic transform and etc. Each one has been shown to be harmful for preserving semantics in previous studies Tack cet al. (2000): Sohn et al. (2020): Park and Darrell (2020); de Haan and Löwe (2021): Kalantidis et al.
(2020a) Li et al. (2021); ); Sinha et al. (2021); Kalantidis et al. (2020b); Miyai al. (2023): Zhang
ct al. (2024); Chen et al. (021c).. For more details, please see Appendix D.
Threshold Computing. First, we train a transformation predictor model that captures the distribution of normal samples through the classification of various augmentations. To achieve this, we create a synthetic dataset with classes, denoted as {D 1 1 by applying & different hard transformations urgin
T, each of the n samples in the normal training set D Then, we train a k-class classifier on this synthetic dataset to leverage its knowledge for threshold computation. Using the classifier as a feature extractor, denoted as C. we extract embeddings of the normal training samples to create an embedding set: Etrinn = =(((Dirnm) i=1 Next,, we fit Gaussian Mixture Model (GMM) the training data embeddings Crrain. as this 1S a well-established approach in the literature Cohen and Avidan (2021): Du et al. (2022). The likelihood for each sample computed, and the p-value for test samples is calculated based on the empirical distribution of likelihoods from the normal training samples. The threshold is set at a default significance level of 0.05, such that samples with p-values below this threshold are considered anomalies. An ablation study on the significance level, as well as an analysis of C, are provided in Appendix and Appendix respectively.
Opposite Pairs with Pseudo-Anomaly Samples. For each normal sample, we randomly select a subset of transformations T, containing at least two transformation. These transformations are applied in randomized sequence to the sample, producing x' = =T; (... Ti, (z:) where m < k. We then get its embedding and calculate the likelihood pr(C(x')) Finally, this likelihood is compared against the computed threshold X. Samples exceeding this threshold iteratively repeat this process until deemed an anomaly. We represent our proposed strategy for anomaly crafting with the notation T (x:). Before each step of training, given a batch of normal samples denoted by Baornat (x')) )9=1.
4

---

Published as a conference paper at ICLR 2025
Training
2
COORRA
A;
6:'
8
Ai
8
A
.6
A2
T1
4
8
Lraea
RGDD
42
72
A2
85
Ause
2
A₂
Auke
B
Tmining Sample
3
Conceptual visualization of CCOBRA
Pscudo-A Anomely Sample
Perturbed Sample
Posilive Pairs
12
Negative Pairs
Sady
Opposite
Sputious us Negalive Pair
Enooder Networks
B
B
B
G
Projection Head
Linear Classifier
Pscudo Anomaly Generalor
(1) Standard Training with COORRA
(2) A Adversaria Training with COOBRA
Positive Augmentation
Figure 1: ①: Given a training batch that includes normal group samples A and B, we create anomaly group using our proposed transformation Yx, These samples are paired as opposite pairs (e.g., A and A and subjected to and 72 to form batches of positive pairs. Adversarial training performed with a loss function combining LCLS and LCOBRA, where LCOBRA treats adversarial examples positive pairs for the corresponding sample. ④, 3: The illustrations demonstrate how LCOBRA enhances adversarial training by explicitly increasing similarities within positive pairs and decreasing similarity for opposite pairs, thus creating strong inter- and intra-group perturbations. Targeting opposite pairs instead of all negatives diminishes the effect spurious negative pairs (e.g., (A1, B))), leading to stronger inter-group perturbations and enlarging the margin between distributions for normal and anomaly groups. A detailed algorithmic of COBRA is provided in A
we create batch of anomaly samples Bp-anonaly = { f==b+1' Where b+i = T(x') signifies an anomaly sample derived from applying a transformation Y normal sample xt, and (xf (+b) are considered as symmetrically opposite pairs. During training, the notation (xx) has some minor differences, where ((x++)) is considered as x!.
3.2 ADVERSARIAL TRAINING WITH ANOMALY-AWARE CL
Conventional Contrastive Loss. the conventional CL paradigm, each instance within a batch transforms into positive views, (I1, via random selection of positive augmentations T1, 72 from predefined set T. The set of positive pairs corresponding to a sample x is denoted P(æ1) {x2) and P(xz) {.1}. CL then defines negative pairs N(xx) for sample as the other samples' augmented views. By denoting the current batch as B, we achieve: N(x)) = (π
B {.)). These views processed through target network to obtain projected features, symbolized as 2 = G(F(x)), where F signifies the feature encoder and G the projection head. For simplification, f(.) substitutes G(F()). The conventional Ne-X Chen et al. (2020b) loss is articulated as:
B (x)) U (r²(x')
exp(sim( f(x)))
Ca(x)= -
log
(I)
exp(sim (xx), f(x)))/()
i=l My EP(z.)
Ty (UN(()))N(())
5

---

Published as a conference paper at ICLR 2025
where sim(..-) denotes the cosine similarity function, t is the temperature parameter, P(x;)) is the set of positive pairs for IG, and ((x)) is the set of negative pairs for 24-
Addressing Spurious Negative Pairs with LCOBRA. CL aims to pull positive pairs closer each other and push negative pairs away from each other. Consider defining the current batch of samples for CL as the concatenation of two groups: normal and anomaly samples, B = { (aaomul U pppmmmllly )- Due to the definition of negative pairs in CL. each sample in B includes both inter-group and intra-group relations as negative pairs. Intra-group negative pairs, i.e., normal-normal and anomaly-anoma pairs, are considered spurious negative pairs. Distancing spurious negative pairs is counterproductive to our objective, which is to maximize the discriminative margin between normal and anomaly groups. Specifically, in the scenario of adversarial training for robust AD with LCL. spurious negative pairs misdirect inter-group adversarial perturbation. As a result, we aim to precisely target those negative pairs that definitively belong to separate groups -hht we refer to as opposite pairs. By focusing on these pairs, we aim to induce stronger perturbations that significantly enhance the discriminative margin between the normal and anomaly groups by proposing LCOBRA.
exp(sim(f(za)
[(x (())sim(((a),, Σ 24 ((EEP(,)UN(())
(ttp::/eeaaaoooooo/aaaaaaaaaaaaa -xpmm///m/////)))))(()))))) (2)
LCOnRA(s) -- Σ
Σ
log
exp(sim(f((=))/(()))))
EP(x))
Note that (x) could also be replaced by (x;;), as both x and x; are positive pairs and share similar semantics. Applying a hard transformation to either would result in comparable hard transformation. The intuition behind LCOBRA is that the representations of the corresponding positive views #1 and 22 should be similar (analogous to the LCL loss function), leading to compact representations for each group. Mcanwhile, the representation of æ should be distinctly different from its counterpart representation (xr), resulting in a high margin between the groups. A conceptual visualization of CCOBRA provided in Figure [ is important to highlight that the limitations CL in AD are apparent in adversarial scenarios. This stems from the fact that adversarial training requires higher degree of data complexity (Schmidt et al. (2018); |Stutz et al. (2019) compared to clean settings, necessitating broad range of strong perturbations achieve robust anomaly detection. One can say CCOBRa consists of two terms, LCL and Lopposite, where
(sp)sim([((s),
Coppusite (x) =
Σ
log
(3)
E
exp(sim( ((x))//))
i=1 EPP((.)
To enhance our model's 's ability to distinguish between normal and anomaly groups, we employ a fully connected layer followed by softmax activation for binary classification, denoted as H. following the F. For the classification loss, (xLs(x), we define label y corresponding to the batch B, where "0" is assigned as the label for normal samples and 'I' for pseudo anomaly samples. Our final loss function,
LCORRA, is thus formulated as: L L= 2b (FOBRA(F, 9+ + LaIs(FF H:; B',y")
-
Adversarial Training Step. For LCOBRA, given input sample from the batch B, an adversarial example Tadv is generated by introducing a perturbation 8", optimized to maximize our final loss:
8* argmax L(x 6, y), Fado + 8*, Then, adversarial examples are used in the training [e
process alongside the original examples. Specifically, for LCOBRA, we consider them as another positive view of each sample and aim to align each sample with its perturbed version, i.c., P(z.) + P(xz) U }. The adversarial training objective as a min-max problem, optimizing the model parameters 0 to minimize the expected loss over both clean and adversarial examples:
min E (O.)ee
max L(x + -5,
[|6|| Se
Morever, the stability of the LCORRA be observed in both clean and adversarial training scenarios, as illustrated in the Appendix
Anomaly Score for Evaluation. For evaluating anomalies, we leverage the representation learned by F to compute the anomaly score, based on the similarity between test samples and normal training samples in the embedding space. The anomaly score A(X) for a test sample x is defined as: m (x)m(((x), [xx)) This scoring mechanism takes advantage of the contrastive

---

Published as a conference paper at ICLR 2025
Table 1: Performance of AD methods on MVTecAD dataset under clean evaluation and PGD-1000 2
adversarial attack with 255 measured by AUROC (%). The best results are emphasized in bold format in each row. The table cells denote results in the 'Clean PGD-1000' format.
"These works incorporated adversarial training into their proposed AD methods.
Caiegory
Method
CSI
Transoommly
PatchCore
ReContrast
DRÆM
Principal_S
OCSDF
ZARND"
COBRA
(Ours)
Carpet
50.2/ 11.1
9,05/00
98.7/184
99.8/9.4
97,070.0
53.6
56.1/12.6
66.9
60.7/ 84,9
Grid
71.2/8.3
84.2/78
98.2/11.7
100.0/ 19.8
99.9/2.7
/30.4
61.7/173
73.7/31.1
100.0/ 99.5
Leather
70.9/0.
99.9/4.1
100.0/ 10.5
100.0/34
100.0/0.0
73.2//265
61.4/13.7
65.07 14.1
97.4/
Tile
67.8/72
97.1/20
/4.6
99.8 2.4
99.6/0.0
28.7/
54.3/ 10.1
$3.6/3.9
98.8 78.2
Wood
71.3/60
98.5/00
99.2
99.0/16
99.1/1.8
67.3/31.2
63.9/3.7
58.4/775
73.7
Bonte
6..4/1.
99475.1
100.0/944
100.0/68 6.8
99.2/2.1
72.17 29.4
$9.8/9.1
79,9/
100.0/ 88.8
Cable
66.5/79
81,5/03
99.5 74.
998/33
91,8/19
63.9 26.2
61.6/633
/305
92. 74.8
Capsule
51.67688
76.0/0.0
98.1
97.7 2.7
98.570.0
56.8 18.4
51.9719
69.3/22.2
75.9/ 55.8
HazelNut
66.7/0.0
89.8/0.4
100.0/7.8
100.0/4. 4.1
100.0/0.8
64.8/2133
54.2/47
73.2 /24.0
96.3/ 74.7
MetalNot
65.8/0.7
90.9/6.2
100.0/4. 4.8
100.0/ 3.7
98.7/006
61.67 19.4
59.5/3.5
4..1/113
96.8/ / 78.1
Pil
4.1
83.7/20
96.6 2.0
98.6
98.9700
52.5/9.4
5..//07
84.0/42.9
57.7 53.2
Screw
51.7/0.
73.3/04
98.1 70.0
798.0/3.
93.9/00
57.6/3.7
55.0/06
84.7
74.2/ 36.4
Toothhrush
3,.3/1.3
90.8/09
100.0/6.9
100.0/0 6.7
100.0/0.0
70.8//28.2
60.1/6.4
65.9//2.3
100.0/ 75.5
Transister
61.7/98
76.4/2.5
100.0/7.8
9..7/8.1
93.1/5.3
60.1/26.3
58.7/4.5
86.5
91.07
Zipper
68.2/5.4
90.7/08
93.6/13.6
99.5/13.7
100.0
67.9/35.7/
65.6/98
82.2 /8.6
99.2/ /9.2/92.5
Average
63.874.6
88.5/2.2
99.1/7.2
99.5/6.1
98.0713 1.3
63.6 24.4
58.7/700
71.6/ 30.1
89.1/75.1 /75.1
training framework, ensuring that normal test samples exhibit higher similarity scores in comparison to anomaly test samples. Consequently, the anomaly score for anomaly test samples will be notably higher than for normal test samples, enabling robust AD. Alternative anomaly scores have been explored in the appendix
Table 2:
Performance of AD methods on various datasets under clean evaluation and PGD-1000. For the experiments across all tables, adversarial attacks were considered, using c 4 for low- resolution images and 255
255
2 for high-resolution images, measured by AUROC (%). The table cells
denote results in the 'Clean PGD' format. Experiments performed in the one-class AD setup.
'These works incurporated udversarial training into their proposed AD methods.
DeeDVVDD
CSI
MSAD
Traasoomalyy
PatckClore
Principal.S
OCSDFF
APAE"
ZARND'
COBRA
(Oun)
CIBAR1O
648/87
94.37 10.6
97.2/448
98.3/3.7
683/33
583/3332
587/3133
563/22
89.7/560
83.7
CIFAR1O0
67.0366
896/119
06.478
97,3/9.4
668/43
$1.9/26.2
50.3/23.5
53.1/4.1
884/47.6
76.051.
Ros
MNIST
94.818
93.833
06.073. 3.2
94.8799
83.2/26
97.8/8311
96.1768.9
93.4/34.7
99.0/912
92.8 96.4
FMrist
945579
92.7/58
94.2/66
94.4/7.4
774/5.5
92.5 69.2
91.8/649
58.3/19.5
95.0/82.
03.1 89.6
SVHN
60.3/15
96.873.
5..3/0.2
36.9/0.9
52.1/21
63.0/ 11,2
58.1
52.6/14
53.5/966
39.3758.2
ImageNNtt
564740
97.6756
98.9/2.6
99.0/2.
67.773
56.3/ 56.3/28.3
55.3725.8
58.3/2.1
96.4/274
85.2/57.0
VisA
535618
62.5/0.
84.1/4.6
8..
95.1/27
57.3 / 16.1
53.07 13.9
67.2 9.1
71.8/2499
75.2/7388 73.8
CityScapes
397/22
68.9/0.1
86.5/29
87.4/4.5
76.2/6.1
60.3 24.2
39.6/20.1
63.0/3.6
/5.9/22.6
81.7 56,2
DAGM
57.3/27
7.65
7..8/0.0
81.470.5
9366719
39.2 24.8
5766/203
13.8/13.8
19.2
82.4
ISIC2018
64.1/03
71.2/00
76.7/3.
86.6/39
789700
61.7/26.
26.5
64.07 18.6
01.2 8.5
70.2/ 14.6
81.3 56.1
67.3/41
83.674.2
86.27
88.1/4.1
759/331
65.8/34.
64.5/290
63.4/9.9
N0.4 /39.7
/6.8
4 EXPERIMENTS
In this section, we verify the effectiveness of COBRA in robust AD with several benchmark datasets, encompassing those that are aarge-scale and real-world. Evaluation is conducted to assess existing AD methods, including both clean and adversarially trained methods, as well as own method, under both clean and various adversarial attack scenarios. Table providess a comparative analysis in one-class setting on the MVD dataset, challenging real-world benchmark in AD. Additional
7

---

Published as a conference paper at ICLR 2025
Table Performance of AD methods under clean evaluation and PGD-1000, measured by AUROC (%) Experiments performed in the unlabeled multi-class AD setup.
"These works incerporated adversarial training their proposed AD methods.
In
Out
Method
MSAD
Transfomaly
PrincipaL.S
OCSDE
APAE"
ZARND"
COBRA (Curs)
CIFAR100
76.9/04
88.7:0.0
56.87 14.6
51.07 12.8
53.67 12
76.67 34.1
76.07 63.3
SVEIN
94.6/0.0
98.2
72.1/23.6
67.71 18.8
60.8/2.1
42.7
98.5 78.6
CIFARIO
MNIST
99.3/16
99.4/36
82.57 42.7
74.27 57.4
71.3/153
99.4/ 62.2
80.8/ K5.8
FMalit
99.2/38
59,4/94
75.7
ImageNet
CIFARIO
614/00
82.5/0.3
47.6/81
51.1/633
50.5/077
64.67 21.2
48.77 27.5
SVHN
86.6/2.77
94.7/26
66.3/ 13.2
58.7/9.2
58.1/1.1
70.00 26.8
93.27 49.4
CIFAR1O0
MNIST
974/3.5
904
14.7/118
90.4
ImageNet
71.571.6
80.4/2.0 2.0
51.5763 6.3
48.97544
52.7/0.1
71.67 21.8
69.17
Table 4: Performance of COBRA on various datasets under clean evaluation and several adversarial attack, measured by AUROC (%). Experiments performed in the one-class AD setup.
Dataset
Attack
Clean
BlackBox
CAA
A*
AutoAttack
PGD-1000
CIFARIO
83.7
81.8
70.2
64.5
60.7
65.9
62.3
CIFARI00
76.9
74.6
64.5
53.0
50.1
54.8
51.7
FMnist
93.1
92.9
90.7
91.6
90.8
87.4
89.6
ImageNet
82.0
53.6
$7.0
MVTocDD
89.1
83.4
79.8
76.3
74.8
77.0
75.1
VisA
75.2
74.6
74.0
73.5
71.6
74.9
73.8
comparisons in one-class settings across other benchmarks detailed in Table 2 while Table showcases our method's superiority unlabeled multi-class setting. Moreover, we demonstrate our method's robustness by evaluating against several attacks presented in Table Additional details on the adaptation of attacks and supplementary evaluation metrics can be found in K and N
Experimental Setup. Our experiments were conducted in categories: one-class and unlabeled multi-class anomaly detection (AD). In the one-class setup, considering dataset D with M classes, experiments were conducted by treating each class turn as the normal set and the other M classes the anomaly set. This process was repeated for each class, and performance was averaged across all classes to report the overall detection performance. the unlabeled multi-class setup, this setting incorporates another dataset D', considering one dataset as the normal set and another as the anomaly set. We compared COBRA with PANDA Reiss et al. (202I). Transformaly Cohen and Avidan ()021), Patchcore Roth et al. (202I), CSI Tack et al. (2020). MSAD Reiss and Hoshen (2021),
ReContrast Guo et al. (2024), and Draem Zavrtanik et al. (202)). as well as methods specifically
proposed for robust AD, including ZARND Mirzaei al. (2024b). PrincipaLS Lo et al. (2022).
OCSDF Béthune et al. (2023), and APAE Goodge et al. (2021 Details about each mentioned method be found in Appendix
Evaluation Details. To evaluate the methods' adversarial robustmess, both normal and anomalous test samples will be subjected to end-to-end adversarial attacks targeting the methods' anomaly scores. We set the value of e to 255 for low-resolution datasets and to 2 for high-resolution datasets. For the PGD attack, we the number of steps N 1000, initializing the attack from 10 different random starting points for each trial to enhance the attack's 's effectiveness and coverage. Furthermore, to highlight COBRA's robust performance, we considered additional strong attacks, including Attack (AA), Adaptive AutoAttack (A²), and black-box attacks. Furthermore, to highlight COBRA's robust performance, we considered an additional range simple to strong attacks, including black-box attacks Guo et al. (2019), FGSM attacks Goodfellow al. (2014), CAA Mao ctt al. (2020), AutoAttack (AA), and Adaptive AutoAttack (A9). Other methods' performance under AutoAttack be found in Appendix G Additionally, details the model's 's evaluation under both loo and & PGD attacks across varying epsilon values are presented in Appendix
255
Implementation Details & Datasets For obtaining the threshold X, utilized a from-scrater ResNet-18 as C' and trained on the created dataset for 100 epochs. For adversarial training, we use PGD-10 step and 255 We employ ResNet- 18 the foundational encoder network, accompanied
8

---

Published as a conference paper at ICLR 2025
MV
ISIC
ImageNet
HIPH
HINA
Normal Data
Real Anomaly
CPAD
CSI
Dream-DOD
FITYMI
COBRA (Ours)
Figure 2: The figure highlights the challenges CPAD and CSI face in generating inncorrect anomalies due the absence of threshold. Techniques such FITYMI and Dream-OOD. which generate anomalies from the embedding space of a pretrained model, typically lead to loss of pixel-level detail and show biases towards the dataset used for pre-training (e.g., ImageNet). Such biases decrease their effectiveness on datasets not seen during pre- training, such as medical imaging datasets like ISIC. contrast, COBRA efficiently crafts informative anomalies in the pixel space and utilizes thresholding method to filter out incorrect anomalies, all without the need for any additional datasets.
Table 5: Comparison of COBRA with replacing alternative anomaly synthesis methods. None corresponds to a scenario where we neglect any pseudo-anomaly and adapt COBRA for that setting.
Dataset
Anamaly Craft Strntegy
None
CPAD
CSI
GOB
VOS
FITYMI
Dream 0OD
Ours
MV ReeDD
57.61 10.8
86.27 70.8
61.4/ 12.9
/8.1/25.3
53.4715.8
65.0/385
68.6/ 36.4
89.1
ImageNet
72.5/225
67.57434
82.77 58.2
81.9760. 60.4
72.4756.5
08.9747.2
87.3/64. 64.1
85.27
CIFARIO
70.6
69.47 53.8
82.97 60.7
94.2/58..
79.3/53.1
76.9% 50.6
75.2/57.
83.7 62.3
93.1
Average
72.8/41.
77.3/6166
73.0/53.1
24.5/52.1
68.3747.3
7067.503
76.97 56.7
N7.8/71.0
by an auxiliary head comprising a 2-layer multi-layer perceptron with 228-dimensional embedding dimension. More details about the implementation can be found in Appendix [ COBRA is evaluated
using challenging datasetss that includes both high- and low-resolution images. The high-resolution
dataset comprises MVTecAD Bergmann et al. (2019). VisA Zou et al. (2022), CityScapes Cordts
ct al. (2016), ImageNet Deng et al. (2009), ISIC2018 Codella et al. (2019), and DAGM Wieler et al. (2007), ), while the low-resolution dataset includes SVHN Goodfellow al. (2013), FMNIST Xiao et al. 2017), CIFAR1O, CIFAR100 100 and MNIST. Further details can be found Appendix
robust AD method. Remarkably, COBRA enhances the average robust detection performance across various datasets by up 26.1%. %. without relying on pre-trained models or extra datasets. This demonstrates COBRA's real-world applicability by enhancing robust performance on the MVTecAD dataset from 30.1 % 75.1 %. COBRA's versatility is further highlighted by its general applicability different AD scenarios, including one-class and unlabeled multi-class setups. Notably, in open- world applications where robustness is vital, a slight drop in clean performance is considered a worthwhile trade-off for enhanced robustness. Our results align with this perspective, achieving average of 84.1 % in clean and 65.8% % in adversarial settings across various datasets. This performance surpasses methods like Transformaly Cohen and Avidan (2021). which, while achieving 88.2% in clean settings, significantly falls to 4. in adversarial scenarios. Furthermore, we replaced our adversarial training with clean training in the COBRA Pipeline. As expected, and in line with findings reported in the literature Tsipras et al. (018), this resulted decreased robust detection performance. However, improved clean detection performance from AUROC of 84.1 % 90.7% %.
Analyzing Results. The results presented underscore COBRA's effectiveness

---

Published as a conference paper at ICLR 2025
Table Comparison of the performance of COBRA with alternative loss functions versus CCOBRA. in terms of effectiveness for the robust AD task.
Function
Ceus
Cxpee
Coppodu
CeooRa
MV TecAD
62.67 40.4
76.4/ 58.7
80.4/605
(3.0/53.6
83.7/68.2
89.1/75. 75.1
ImageNet
59.5745.1
68.3
74.6/46.3
57.4/45.8
82,9/51.3
85.2/
CIFARIO
62.6/449.6
67.9 54.3
74.2/53.8
65.9/52.4
78.57
83.7 62.3
FMnist
82.07 78.4
88.3 82.5
91.3/83.2
80.4/73.5
92.8
93.1 89.6
Average
66.7/53.3
75.2 60.8
80.4/609 60.9
66.9/ 66.9/56.3 56.3
84.5 67.77
87.7 0177/111 77.0
Normal Training Samples
Preufo-Anomaly T'mining Samples
Parturhed Normal Samples
Purturhed Anamaly Samples
(a) CL
(b) CLS
(c) SupCLR
(d) COBRA
Figure UMAP visualization of features extracted by the encoder f. trained with various loss functions on the CIFAR-10 dataset, is presented in a one-class setup with the 'Automobile' class designated as the normal set. For this particular experiment, all elements except the loss function remain constant to ensure a fair comparison.
ABLATION STUDY
Pseudo-anomaly Generating Strategy. In order to demonstrate the superiority of our strategy for pseudl-anomaly sample crafting, with other modules fixed, we replaced ours with alternative methods. We provided brief description of alternative methods in Section [.]] The results, which are presented in Table along with visualization comparison of samples in Figure 2 show the superiority of our effective synthesizer method. Notably, our strategy, without using any extra data, outperforms Dream-OOD with billions of sample complexity by margin of 15%. In Appendix D.I we further evaluate the quality of our generated data.
Adversarial Training Objective Function. We replaced our proposed loss function with various alternatives, such as classification (CLS), CL and Supervised CL. The results, detailed in Table 6 reveal that the COBRA loss function, by generating challenging intra- and inter-group adversarial examples during training, surpasses other alternatives significantly. LCOBRA outperforms CLS by increasing normal distribution compactness provided by intra-group perturbations, and outperforms CL and SupCL by considering opposite pairs for increasing margins, as illustrated in Figure Our performance outperforms other loss functions by 11%. Additional ablation studies, experimental results including error bars, limitations, and qualitative visualizations are provided in the Appendix.
6 CONCLUSION
In conclusion, our work introduces COBRA, novel and effective approach for enhancing AD methods' robustness against adversarial attacks. By leveraging a novel loss function inspired by contrastive learning and strategically crafting informative anomaly samples, COBRA achieves superior detection performance under both clean and adversarial evaluation conditions. We verify COBRA through comprehensive ablation experiments on its different components. Moreover, our extensive experiments across multiple challenging datasets, as well as under various strong attacks, confirm method's 's effectiveness, setting new benchmark for future research in reliable AD.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Abhijit Bendale and Terrance Boult. Towards open world recognition. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition (CVPR), pages 1893-1902, 2015.
Pramuditha Perera, Poojan Oza, and Vishal M Patel. One-class classification: A survey, arXiv preprint 1xXiv:200103004 2021.
Lukas Ruff. Robert Vandermeulen, Nico Goemnitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International conference on machine learning, pages 4393-4402. PMLR, 2018.
Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. Advances in neural information processing systems, 33:1 33:11889-11885 2020.
Liron Bergman, Cohen, and Yedid Hoshen. Deep nearest neighbor anomaly detection. arXiv preprint arXiv:2002. 10445, 2020.
Tal Reiss, Niv Cohen, Liron Bergman, and Yedid Hoshen. Panda: Adapting pretrained features for anomaly detection and segmentation. In Pruceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2806-2814, 2021.
Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger. Mytec ad-a comprehensive real-world dataset for unsupervised anomaly detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9592-9600, 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Mohammad Azizmalayeri, Arshia Soltani Moakhar, Arman Zarei, Reihanch Zohrabi, Mohammad Manzuri, and Mohammad Hossein Rohban. Your out-of-distribution detection method is robust! Advances Neural Information Processing Systems, 35:4887-4901, 2022.
Shao- Yuan Lo, Poojan Oza, and Vishal M Patel. Adversarially robust one-class novelty detection. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Robust out-of-distribuiis detection for neural networks. arXiv preprint a0Xiv:2003.097 0070100100771... 2020a.
Rui Shao, Pramuditha Perera, Pong C Yuen, and Vishal M Patel. Open-set adversarial defense. Computer Vision-ECCV ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XVII 16, pages 682-698. Springer, 2020.
Rui Shao, Pramuditha Perera, Pong C Yuen, and Vishal M Patel. Open-set adversarial defense with clean- adversarial mutual learning. International Journal of Computer Vision, 13004)11070-1087, 2022.
Louis Béthune, Paul Novello, Thibaut Boissin, Guillaume Coiffier, Mathieu Serrurier, Quentin Vincenot, and Andres Trova-Galvis. Robust one-class classification with signed distance function using 1-lipschitz neural networks. arXiv preprint arX3v: 2023.
Adam Goodge, Bryan Hooi, See Kiong Ng. and Wee Siong Ng. Robustness of autoencoders for anomaly detec- tion under adversarial impact. In Proceedings of the Twenty-Ninth International Conference on International Joint Conferences Artificial Intelligence, pages -2500, 2021.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying out-of-distribution detection using outlier mining. In Machine Learning and Knowledge Discovery in Databases. Research Track: European Conference, ECML PKDD 2021, Bilbuo, Spain, September 13-17, 2021, Proceedings, Port III 21, pages 430 445. Springer, 2021a.
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. arXiv preprint arXiv:2102.013 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv: 06083, 2017.
Michael Glodek, Martin Schels, and Friedhelm Sehwenker. Ensemble gaussian mixture models for probability density estimation. Computational statistics, 28:1 28:127-138, 2013.
11

---

Published as a conference paper at ICLR 2025
Shuo Chen, Gang Niu, Chen Gong, Jun Li, Jian Yang, and Masashi Sugiyama. Large-marghn contrastive learning with distance polarization regularizer. International Conference on Machine Learning, pages 1673-1683. PMLR, 2021b.
Xuxin Cheng. Bowen Cao, Qichen Ye, Zhihong Zhu, Hongxiang Li, and Yuexian Zou. MI-Imel: Mutual learning and sarge-marghn contrastive learning for improving asr robustness in spoken language understanding. arXiv preprint arXiv: 2023.
Yiwen Guo and Changshui Zhang. Recent advances in large margin learning. IEEE Transactions Puttern Analysis and Machine Intelligence, 41(10):167-7117 2021.
Ting Chen, Simon Komblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations, In Proceedings of the 37th International Conference on Machine Learning (ICML), pages 1597-1607. PMLR, 2020b.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9729-9738, 2020.
Jia Guo, Lize Jia, Weihang Zhang, Huiqi Li, et al. Recontrast: Domain-specific anomaly detection via contrastive reconstruction. Advances in Neural Information Processing Systems, 36, 2024.
Tal Reiss and Yedid Hoshen. 034444 2021.
Mcan-shifted contrastive loss for anomaly detection.
arXiv preprint
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with ensemble of diverse parameter-fie attacks. International conference on machine learning, pages 2206 2216. PMLR, 2020.
Ye Liu, Yaya Cheng. Lianli Gao. Xianglong Liu, Qilong Zhang, and Jingkuan Song. Practical evaluation of adversarial robustness via adaptive auto attack. 2022.
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248-255.
IEEE, 2009.
Noel Codella, Veronica Rotemberg, Philipp Tschandl, M Emre Celebi, Stephen Dusza, David Gutman, Brian Helba, Aadi Kalloo, Konstantinos Liopyris, Michael Marchetti, al. Skin lesion analysis toward melanoma detection 2018: A challenge hosted by the international skin imaging collaboration (isic). arXiv preprint 2019.
arXiv:/902.00
Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-diittibuution detection: A survey. arXiv preprint arXiv:21 10. 1334, 2021.
Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojciech Samek, Marius Kloft, Thomas G Dietterich, and Klaus- Robert Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 10565)77567795 2021.
Shu Kong and Deva Ramanan. Opengan: Open-set recognition open data generation. In Proceedings of the JEEE/CVF International Conference on Computer Vision, pages 813-822, 2021.
Songqiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao. Adbench: Anomaly detection benchmark. Advances in Neural Information Processing Systems, 35:32142-32159, 2022.
Chun-Liang Li, Kihyuk Sohn, Jinsung Yoon, and Tomas Pfister. Culpaste: Self-supervieed learning for anomaly detection and localization. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, pages 9664-9674, 2021.
Konstantin Kirchheim and Frank Ortmeier. On outlier exposure with generative models. In NeurIPS ML Safety Workshop, 2022.
Hossein Mirzaei, Mohammadreza Salehi, Sajjad Shahabi, Efstratios Gavves, Cees GM Snoek, Mohammad Sabokrou, and Mohammad Hossein Rohban. Fake it till you make it: Near-distribution novelty detection by score-hased generative models. arXiv preprint 2205 14297, 2022.
12

---

Published as a conference paper at ICLR 2025
Xuefeng Du, Yiyou Sun, Xiaojin Zhu, and Yixuan Li. Dream the impossible: Outlier imagination with diffusion models. arXiv preprint arXiv:2309. 13415, 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceddings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, al. Laion-5b: An open large-scale dataset for training next generation image-text models. arXiv preprint arXiv:2210.084000 2022.
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. arXiv preprint arXiv:2202.011 197, 2022.
Hossein Mirzaci, Mohammad Jafari, Hamid Reza Dehbashi, Ali Ansari, Sepehr Ghobadi, Masoud Hadi, Arshia Soltani Moakhar, Mohammad Azizmalayeri, Mahdieh Soleymani Baghshah, and Mohammad Hossein Rohban. Rodeo: Robust outlier detection via exposing adaptive out-of-distribution samples. In Forty-first International Conference on Machine Learning, 2024a.
Yifei Ming, Ying Fan. and Yixuan Li. Poem:
Out-of-distribun detection with posterior sampling. In International Conference on Machine Learning, pages 15600-16655. PMLR, 2022.
Izhak Golan and Ran Yaniv. Deep anomaly detection using geometric transformations. Advances in neural information processing systems, 31, 2018
Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances in Nearal Information Processing Syxtems, 32, 2019a.
Kejiang Chen, Yuefeng Chen, Hang Zhou, Xiaofeng Mao, Yuhong Li, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. supervuue adversarial training. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2218-2222. IEEE, 2020c.
Dan Hendrycks, Mantas Mazcika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 1rXiv:1812.04460 2018.
Leitian Tao, Xuefeng Du, Xiaojin Zhu, and Yixuan Li. Non-parametric outlier synthesis, 2023.
Hongyi Zhang, Moustapha Cisse. Yann N Dauphin. and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint 17Xiv:1710.09412, 2017.
Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. In Bastian Leibe, Matas, Nieu Sebe, and Max Welling, editors, Computer Vision Eision-ECCV ECCV 2016, pages 69-86 84, Cham, 2016. Springer International Publishing. ISBN 978-3-38 3194-666-44446-44
Zhun Zhong, Liang Zheng, Guoliang Kang, Shaozi Li, and Yi Yang. Random crasing data augmentation. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2020.
Golnaz Ghiasi, Yin Cui, Aravind Srinivas, Rui Qian, Tsung- Yi Lin, Ekin D Cubuk, Quoc V Le, and Barret Zoph. Simple copy-paste is strong data augmentation method for instance segmentation. arXiv preprint arXiv:2012.07117..22 2020.
M. Eren Akbiyik. Data augmentation in training cnns: Injecting noise to images. ArXiv, abs/2307.06855 2019. URL http::ttp/:/ppptt www.stteassttiioeoo wtt.ccco......oooooooooooaaaooe:
Yann N. Dauphin Hongyi Zhang, Moustapha Cisse. mixup: Beyond empirical risk minimization. Interna-
tional Conference on Learning Representations, 2018. URL httttttsss//opeeeeeee wttpriiwweee..ooooee wwt.:frrrrrffttttmm
ddp1 Rb
Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout.
arXiv preprint arXiv: 70w..7088000 04552, 2017.
Sangdoo Yun, Dongyoon Han, Seong Joon Oh. Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features, 2019.
Kihyuk Sohn, Chun-Liang Liang Li. Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluating representa- tions for deep one-class classification. arXiv preprint a/Xiv:2011.02578 2020.
Dong Huk Park and Trevor Darrell. Novelty detection with rotated contrastive predictive coding. 2020.
13

---

Published as a conference paper at ICLR 2025
Puck de Haan and Sindy Löwe. Contrastive predictive coding for anomaly detection. arXiv preprint arXiv:2107.07820, 2021.
Yannis Kalantidis, Mert Bulent Sariyildiz, Noe Pion, Philippe Weinzaepfel, and Diane Larlus. Hard negative mixing for contrastive learning. Advances in Neural Information Processing Systems, 33:21798-21809, 2020a.
Abhishek Sinha, Kumar Ayush, Jiaming Song, Burak Uzkent, Hongxia Jin, and Stefano Ermon. Negative data augmentation. In International Conference on Learning Representations, 2021. URL /nttps/:/ openreview net wttp://eeee//eotm///eeeeee S0-
Yannis Kalantidis, Mert Bulent Sariyildiz, Noe Pion, Philippe Weinzaepfel, and Diane Larlus. Hard neg- ative mixing for contrastive learning. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages Curran Associates, Inc., 2020b. URL 4d2
E7cadee807ccc22b999 000006660770000000000000033303 20 wew.eeeiiinnnnnunis...... nwwrips.......... wttpp/ppppe////////22222
Atsuyuki Miyai, Qing Yu, Daiki Ikami, Go Irie, and Kiyoharu Aizawa. Rethinking rotation in self- supervised contrastive learning: Adaptive positive or negative data augmentation. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 2809 2818, January 2023.
Zhaoyu Zhang, Yang Hua, Guanxiong Sun, Hui Wang. and Seán Mcl oone. Improving the leaking of augmenta- tions in data-efficient gans via adaptive negative data augmentation. In Proceedings of the IEFE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 1412-5421, January 2024.
Chengwei Chen, Yuan Xie, Shaohui Lin, Ruizhi Qiao, Jian Zhou, Xin Tan, Yi Zhang, and Lizhuang Ma. Novelty detection via contrastive learning with negative data augmentation. In Zhi-Hua Zhou, editor. Proceedings of the Thirtieth International Joint Conference Event / Montreal, Canada, 19-27 August 2021, pages 606 06-664444 614. ijeai.org, 2021c. doi: 20.24963/ URL crg. 10. 24963/1jca..222///11
Artificial Intelligence, IJCAI 2021, Virtual
Matan Jacob Cohen and Shai Avidan. Transformaly-two (feature spaces) are better than one, arXiv preprint 1rX1v:211..04185,, 2021.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. Advances in neural information processing systems, 31, 2018.
David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6976-6987, 2019.
Karsten Roth, Latha Pemula, Joaquin Zepeda, Bernhard Schölkopf, Thomas Brox, and Peter Gehler. Towards total recall in industrial anomaly detection, 2021.
Vitjan Zavrtanik, Matej Kristan, and Danijel Skočaj. Draem a discriminatively trained reconstruction embedding for surface anomaly detection. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 8330-8339, 2021.
Hossein Mirzaei, Mohammad Jafari, Hamid Dehhashi, Zeinab Taghavi, Mohammad Sabokrou, and Moham- mad Hossein Rohban. Killing it with zero-shot: Adversarially robust novelty detection. pages 7415-7419, 04 2024b. doi: 10.1L09/CASSP4444.... 0020444888.222...... 104.4441555....55
Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adversarial attacks. In International Conference on Machine Learning, pages 2484-2493 PMLR, 2019.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572,, 2014.
Xiaofeng Mao, Yuefeng Chen, Shuhui Wang. Hang Su, Yuan He, and Hui Xue. Composite adversarial attacks, ArXiv, abs/2012.05434, 2020. URL
228083968
Yang Zou, Jongheon Jeong. Latha Pemula, Dongqing Zhang, and Onkar Dabeer. Spot-the-difference supervised pre-training for anomaly detection and segmentation. In European Conference on Computer Vision, pages 392-408. Springer, 2022.
difference self-
14

---

Published as a conference paper at ICLR 2025
Matthias Wieler, Tobias Hahn, and Fred A. Hamprecht. Weakly Supervised Learning for Industrial Optical Inspection, September 2007. htttp:t//////t /ttp::://oo..ogg/1..oooo... 10.
8086136 Acknowledge- ments The data was created by Matthias Wieler and Tobias Hahn. This work was conducted at the Robert Bosch Corporate Research department, Schwieberdingen. Germany, We also thank the participants in the contest, the participants of the symposium who helped finance the competition with their registration fees and the GNNS (German Chapter of the European Neural Network Society) for sponsoring the competition.
Ian J Goodfellow, Yaroslav Bulatov, Julian Ibarz, Sacha Arnoud, and Vinay Shet. Multi-digit number recognition from street view imagery using deep convolutional neural networks, arXiv preprint arXiv: 6082, 2013,
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-miist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv: 2017.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robustness may be at odds with accuracy. arXiv preprint arXiv: 1805. /2/52, 2018.
Jiawei Yu, Ye Zheng, Xiang Wang, Wei Li. Yushuang Wu, Rui Zhao, and Liwei Wu, Fastflow: Unsupervised anomaly detection and localization via 2d normalizing flows, arxiv preprint arXiv:21 2021.
Hossein Mirzaci, Mojtaha Nafez, Mohammad Jafari, Mohammad Bagher Soltani, Mohammad A Arizmalayeri, Jafar Habibi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Universal novelty detection through adaptive contrastive learning. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 22914 14-22923, 2024c.
Mohammadreza Salehi, Hossein Mirzaei, Dan Hendrycks, Yixuan Li, Mohammad Hossein Rohban, and Mohammad Sabokrou. A unified survey on anomaly, novelty, open-set, and out-of-distribution detection: Solutions and future challenges. arXiv preprint arXiv:2110.1405,, 2021.
Hossein Mirzaci and Mackenzie W Mathis. Adversarially rohust mutot--distribution detection using lyapunov- stabilized emheddings. arXiv preprint arXiv:2410. 240,:4040..0 2024.
Hossein Mirzaei, Ali Ansari, Bahar Dibaei Nia, Mojtaba Nafez, Moein Madadi, Sepehr Rezace, Zeinab Sadat Taghavi, Arad Maleki, Kian Shamsaie, Mahdi Hajialilue, et al. Scanning trojaned models using out-of- distribution samples. In The Thirty-eighth Annual Conference on Neural Information Processing Systems.
Arshia Soltani Moakhar, Mohammad Azizmalayeri, Hossein Mirzaei, Mohammad Taghi Manzuri, and Mo- hammad Hossein Rohban. Seeking next layer neurons' attention for conoonaackkrppattioniiiiii like training in a multi-agent network framework. arXiv preprint arXiv:2310.09955 2023.
Hossein Mirzaei, Mohammad Jafari, Hamid Reza Dehbashi, Zeinab Sadat Taghavi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Killing it with zero-shot: Adversarially robust novelty detection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7415-7419 7419. IEEE, 2024d.
Mohammad Jafari, Yimeng Zhang, Yihua Zhang, and Sijia Liu. The power of few: Accelerating and enhancing data reweighting with coreset selection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7100-7104. IEEE, 2024.
Zeinab Sadat Taghavi, Ali Satvaty, and Hossein Sameti. A change of heart: Improving speech emotion recognition through speech-to-ted text modality conversion. arXiv preprint arXi::2377.1 11584, 2023a.
Zahra Rahimi, Hamidreza Amirzadeh, Alireza Sohrabi, Zeinab Taghavi, and Hossein Sameti. HalluSafe at SemEval-2024 task 6: An NaLe-ased approach to make LLMs safer by better detecting hallucinations and overgeneration mistakes. In Atul Kr. Ojha, A. Seza Dogruöz, Harish Tayyar Madabushi, Giovanni Da San Martino, Sara Rosenthal, and Aiala Rosá, editors, Proceedings of the 18th International Workshop on Semantic Evaluation (SemEval- 22024). pages 139 147, Mcxico City, Mexico, June 2024a. Association for Computational Linguistics. doi: 10.18653/1122224.smms org/2024. semeval .22.7
1.22. URL httpss:::t://///m // acl ant ogy
Zeinab Sadat Taghavi. Soroush Gooran, Seyed Arshan Dalili, Hamidreza Amirzadeh, Mohammad Jalal Nemat- bakhsh, and Hossein Sameti. Imaginations wall-e: Reconstructing experiences with an imagination-inspee module for advanced ai systems. arXiv preprint arXiv:2308. 10354, 2023b.
Zeinab Taghavi, Parsa Haghighi Naeini, Mohammad Ali Sadraei Javaheri, Soroush Gooran, Ehsaneddin Asgari, Hamid Reza Rabiee, and Hossein Sameti. Ebhaam SemEval-2023 task 1: CLIP-based approach for comparing cross moss-tto and unimodality in visual word sense disambiguation. In Atul Kr. Ojha, A. Seza Dogruöz. Giovanni Da San Martino, Harish Tayyar Madabushi, Ritesh Kumar, and Elisa Sartori, editors, Proceedings of the 17th International Workshop on Semantic Evaluation HomeEval-2023) pages 19600-1664 Toronto, Canada, July 2023c. Association for Computational I Linguistics. doi: 10. 10.1866 1111116/122223.smm/l 1. 269. URL htl.hhttss:///t //tppss://cca hotho hothooloyy..oo..ooooooooooooo wgg..org/....... 2003. http://0.......eaaaaaaeema www.sseeeelllee 1.2697
15

---

Published as a conference paper at ICLR 2025
ZeinabSadat Taghavi and Hossein Mirzaei. Backdooring outlier detection methods: A novel attack approach. arXiv preprint arXiv:2412.05010, 2024.
Seyedeh Fatemeh Ebrahimi, Karim Akhavan Azari, Amirmasoud Iravani, Hadi Alizadeh, Zeinab Sadat Taghavi. and Hossein Sameti. Sharif-str semeval-2024 task 1: Transformer a regression model for une-grained scoring of textual semantic relations. arXiv preprint arXiv:2407. 12426, 2024a.
Seyedeh Fatemeh Ebrahimi, Karim Akhavan Azari, Amirmasoud Iravani, Arian Qazvini, Pouya Sadeghi, Zeinab Sadat Taghavi, and Hossein Sameti. Sharif Sharif-mgtd at Saneval-2024 task 8: A transformer-basse approach to detect machine generated text. arXiv preprint arXiv22407.17774 2024b.
Zahra Rahimi, Mohammad Mocin Shirzady, Zeinab Taghavi, and Hossein Sameti. NIMZ at SemEval-2024 task 9: Evaluating methods in solving braintcasers defying commonsense. In Atul Kr. Ojha, A. Scza Dogruöz, Harish Tayyar Madabushi, Giovanni Da San Martino, Sara Rosenthal, and Aiala Rosá, editors, Proceedings of the 18th International Workshop Semantic Evaluation (SemEval-2024), pages 148-154, Mexico City, Mexico, June 2024b. Association for Computational Linguistics. doi: 12044seeal 1.23. URL httpss:/ach pttps:://aclanttan http://ccaanoooooyooooooo
Muhammad Ferjad Nacem, Scong Joon Oh, Youngjung Uh, Yunjey Choi, and Jacjun Yoo. Reliable fidelity and diversity metrics for generative models. 2020.
Dan Hendrycks, Mantas Mazeika, Thomas Dietterich. Deep anomaly detection with outlier exposure. Proceedings of the International Conference on Learning Representations, 2019b.
Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Erie Xing, Laurent Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472-7482. PMLR, 2019.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang. John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint 2rXi::2002.10716, 2020. 2020.
16

---

Published as a conference paper at ICLR 2025
A
ALGORITHM BLOCK
Algorithm 1 Adversarially Robust Anomaly Detection through Spurious Negative Pair Mitigation
T (Color Jitter, Horizontal Flip, Grayscale.... [Rotation, Elastic, Distortion.
D. Set of k light augmentations Set of k hard augmentations
function CLASSIFEER_GMI
TRAINER(tainnnng data,
synthetic dattiiiddtttaa (traniig data), i) 7 range(T))
Train k-class classifier C on eynthetic_dota. Perain C(training_dat)
Obtain embeddings from the classifier
GMM on Cirain
À 0.05
C, GGMM
end function
function T(Xnormat: T. C, GMM, A)
while P- p_value > do
pransforms_cc
+ Sample a random sequence of transforms from T
2p- op-anomaiy trans oormemseeeeeee oorma_eeg(/oonon seq(#normat)
Apply hard transformations pseudo-anomaly p Obuin emheddings from the classifier p Compute P- P-Valuc of embeddings
ep-apomaiy 4- C(2 p=oommmt))))
p_velue GMMP Value tep- (ep-anomaiy)
Valuee
return anomaly function
function PSEUDO ANOMALY GENNRATTOR Nurmats T, C, GMM,
Xp-onomaty =
for Snormal normal do
iterate batch of normal data
T(X T(Xnovmat: T. C. GMM, A)
Sp-anomoly. Addom anamalyy)
end for return X Xp-anonaly
Return the generated souud--noomaly sample
function
function PGD(x. y. G, H. pgd_stepss a, c)
x z_adv + for step pteps
grad Compute Gradient( GFGzaa))) + Ccus(F, H; a se__dd,,,, y/] a a__de)
Compute the gradient of the loss with respect to the input s_ade
# x adv sign(grad)
a ado clip(=_ade -c,
Gradient ascent and projection to valid c-ball
clip(x ado, 0,
end for return s_adv function
function ADVERSARIAL TRAINING, COBRA((ranning..e J. G. H, C, GMM, X. pgd_steps, a, c)
for B Baormal in training data do
B. Ba-agomaly +- Pseudo_ Aacolannnooayyyaaaaieaaa Generutor(Bnorraa T. GMM, X)
B 3- Concitenate(Baavea
E Bp-nnomaly)
Y
||Bnormazl]
118p-anomaty!
71 Sample tow rundom requence of transforms from T
Bade
z. (18, Y)
21.42 4- Ti (z), (2))
P(r;). P(zz)) (ang {a:]
N(x) (m (w')
(x)) (ma(t')) E (2))
Noo))N(
z_adv PGD(x, F. g. H. pgd a.e)
Addl:.dd(
end for
for 2, M in (8, Badvi Y)
21.03 P(Raad) +- faz, Rode h. anash (2).02)
(2))
P(rr). P(za).
N(2) (ni('') E B (x)) (1a(x') 6 (x))
(alao rla E Budo \ (aute))
LcoBRs (F, 9:x)+ ) + Las (F, endd
end for
Update Networks(,FFFo G. using
end for end function
function MArN(epochs, training J. G. pgd steps, a, C. GMM, - Classifier TraMMM_Tainettrriiii data, T)
for epoch in epochs do Adversarial_ Training.COBRAAA COBRA(uriining data, F. G.7 H, C. GMM, A, pgd_steps, a. c)
end for function
MAINcepochs, training data, F, 10, c.,
17

---

Published as a conference paper at ICLR 2025
B RELATED WORK
Previous AD Methods. Recent standard AD methods can be categorized into two types: transfer learning based and CL based methods. Transfer learning-based methods utilize a trained model large dataset as a backbone and leverage its rich features for the AD task. This approach is evident in methods including PANDA Reiss et al. (2021), Transformaly Cohen and Avidan (202I), Patchcore Roth et al. (202T). and Fastflow Yu et al. (2021). On the other hand, CL framework has demonstrated its superiority by extracting discriminative features, as showcased by CSI Tack et al. (2020), MSAD Reiss and Hoshen (021), Recontrast Guo et al. (2024), and Draem Zavrtanik et al. (2021). Extending transfer learning based methods to an adversarial setting not feasible because pre-trained features, which act as key, are not robust, necessitating new training paradigm. This limitation inspired us to adopt CL for adversarial training, which also aligns with the unlabeled nature of AD, There have been few efforts to propose robust AD methods, including PrincipaLS Lo et al. 2022), OCSDF Béthune et al. (202)) and APAE Goodge et al. (202T). However, their results on even tiny datasets less than random detection. Details about each mentioned method can be found in Appendix
C DETAILS OF RELATED WORK
C.I PREVIOUS AD METHODS
There has been some efforts to develope a robust AD method. PrincipaLS employs a novel latent space manipulation technique to adjust the representations of data point with optimizing robustness criterion designed to minimize the model's sensitivity to adversarial perturbations. OCSDF leverages the Signed Distance Function delineate the boundary of data distribution. Through the em- ployment of I l-Lipschitz neural networks, it adeptly approximates normality scores, thus enhancing robustness adversarial perturbations. APAE introduces the approximate projection autoencoder as defense mechanism, integrating gradient descent on latent embeddings and feature-weightin normalization to enhance detection robustness. it worth noting we exclude robust OOD detection from our experiments, where their method have been develpoed by relying on labels and could not extend to AD setup. ZARND a introduces a robust method enhancing anomaly detection by integrating
robust features from pretrained models with nearest-neighhor algorithms. The approach significantly
improves robustness against adversarial attacks, which traditionally degrade ND performance. By leveraging features from adversarially robust models and employing k-Nearest Neighbors (k-NN)
for anomaly scoring Mirzaei et al. (2022 ): Salehi et al. (2021) Mirzaei and Mathis (2024);
Mirzaei et al.) Moakhar et al. (2023) Mirzaei et al. (024d)]Jaaaa et al. (2024) TTghavi et al. 2023a
Rahimi et al. 2024a): Taghavi et al. 2023b c): Taghavi and Mirzaei (2024): Ebrahimi et al. (2024a
Rahimi et al. [2024b)
C.2 AUXILIARY ANOMALY SAMPLE CRAFTING
Previous studies anomaly generation often struggle with producing samples that are either too similar to normal instances (distant anomalies) or inadvertently create samples that still belong to the normal category. Conversely, many studies have underscored the benefit of using related auxiliary anomaly samples to enhance detector performance. In light of this, we have proposed COBRA, which, unlike its counterparts such as Dream- -OD, does not require extra dataset and performs well in an unsupervised setting where labels for normal samples are not available.
COBRA aligns with the distribution of the normal dataset, effectively generating informative pseudo- anomalies within the pixel space. It employs a thresholding technique to sift out inaccuracies, all while obviating the need for supplementary datasets.
D DISTRIBUTION AWARE HARD TRANSFORMATION
In this section, we elaborate on the practical implementation details of our proposed pseudo-anomaly crafting strategy. As discussed in the main text of the paper, we set the hyperparameter 3 to 0.05. To assess the robustness of our model with respect this parameter, over a broader range, specifically [0.02, 0.20]. The stability of our model's performance across this range is demonstrated in the experimental results (refer to Table 7). These findings underscore
conducted extensive experiments
18

---

Published as a conference paper at ICLR 2025
the robustness of our approach in handling varying hyperparameter settings without significant performance degradation.
Table 7: Performance of the model for different values of the hyperparameter / used in pseudo- anomaly crafting. Results are shown in each table cell 'Clean/PGD-1000" (Evaluations are done on CIFAR-10 and CIFAR-100 datasets under PGD-1000 attack with e 255 high-resolution datasets with é 233
4 and on other
Datasets
cifar10
cifar100
MVTecAD
CityScapes
VisA
ISIC2018
DAGM
0.02
62.7/618
75.4 52.3
88.0 74.1
79.9 57.5
73.7 70.1
55,3
80.4 55.1
0.05
83.7/62.3
76.9/ 51.7
89.1
81.7/ 56.2
73.8
81.3/ 56.1
82.4/ 56.8
82.3/ 62.1
74.27 50.8
87.3/739
81.3/ 55.9
73.00
81.0/570
82.1 55.7
61.9/613
74.8/510
88.1/74.4
80.8 55.1
74.2/72.7
80.6/ 55.2
81.3/570
80.8/60.9
77.2/518
39.0/74.5
56.2
75.8/72.6
79.8/66.4
79.5 /4.6
59.3
50.4
86.9/75.0
79.67 56.7
74.2/72.9
79.3/54.1
79.0/
80.1/58.9
76.3/49.9
89.2/74.2
73.9/72.1
80.3/55.3
54.7
D.1 HARD TRANSFORMATION
We employed series of hard transformations create the T set. The transformations and their respective hyperparameters are as follows:
Jigsaw: Images were divided into 2x2 grid, and the tiles were randomly permuted. This transformation disrupts the spatial continuity of image features.
Random Erasing: A random rectangular region in the image was erased, with size proportional to the image area and an aspect ratio randomly chosen between 10% and 50%.
CutPaste: A square region, with side length varying from 10% to 50% of the image width, was cut and pasted into different location within the same image.
Rotation: Images
rotated by random angle within -90 degrees to introduce moderate level of distortion.
Extreme Blurring: Applied a Gaussian blur with a kernel size of up to 5% of the image width and high variance (a = 2.5), resulting in significant blurring.
Intense Random Cropping: Random sections, sized between 50% and 80% of the original image size, were cropped to challenge the model with incomplete patterns.
Noise Injection: Gaussian noise with a mean and a standard deviation 0.1 was added to the images.
Cropped the image to retain only 40% to 60% of its original size, focusing on the center ensure significant deviation from the original distribution.
Extreme Cropping:
Mixup: create composite images that merge features from both source images challenging manner, we combined pairs of images using a blending coefficient a, drawn from Beta distribution Beta(a, a) with a set to 0.1. This lower value of results in a higher variance of the mixing coefficients, producing images that are significantly more blended than with higher a value. This aggressive mixing ensures the crafting of pseudo-anomaly samples.
more
Cutout: Square regions with a side length of 25% of the image width were filled with constant value simulate occlusion.
CutMix: Portions from one image were cut and pasted onto another, with the cut region's size approximately 20% of the image area.
Quality of Generated Abnormal Data. In 5 of paper, we evaluated our crafting strategy by comparing it with alternative methods. Additionally, Figure 2 presents samples that visually compare our results with others. To address any concerns further, which measures the distance from a normal distribution, as well as the DC metric Naeem et al. (2020) to assess diversity. A lower FID indicates that the crafted anomalies more similar to normal
employed the FID metric,
19

---

Published as a conference paper at ICLR 2025
instances, while higher DC suggests greater diversity among the samples. Table & compares the quality anomalies generated by our method with those from other alternatives, using the FID and DC metrics.
Table 8: Assessment of Generated Anomaly Data Quality Compared Altemnttiv Methods
Dataset
Metric
GOE
FITYMI
Dream-OOD
Dream-OOD
Ours
FID L
245
163
227
227
129
MVTecAD
DC 1
0.53
0.29
0.75
0.75
0.84
FID L
118
145
98
98
107
ImageNet
DC 1
0.64
0.38
0.87
0.87
0.58
FID L
76
86
72
72
54
CIFARIO
DC 1
0.45
0.36
0.56
0.56
0.72
FID L
42
37
64
64
32
FMNIST
DC 1
0.31
0.17
0.45
0.45
0.63
FID 1
120.3
107.8
115.3
115.3
80.3
Average
DC 1
0.48
0.3
0.65
0.65
0.69
D.2 POSITIVE TRANSFORMATION
Consistent with the self self-super learning literature Chen et al. (202bb) : He et al. (2020), employ mild transformations that generate samples with minimal visual differences while fully preserving semantics. These include color jütter, random grayscale conversion, and random cropping (cropping the image to retain 80% to 100% of its original size). These transformations are designed subtly alter the appearance of images without changing their underlying content, thereby enabling the model to learn robust features that are invariant to minor perturbations.
E ADDITIONAL ABLATION STUDY
Here, we conduct further experiments to thoroughly evaluate COBRA across diverse settings, highlighting its key components and their substantial impact.
Clean Training this scenario, we skipped adversarial training and instead trained COBRA with standard training, keeping all other components fixed. The results indicate that clean performance increased from 84.1 to 90.7, demonstrating COBRA's superiority in various scenarios of training and evaluating. The results presented in Table
Anomaly Score Instead of utilizing our proposed Anomaly Score, we explored alternative approaches while keeping other components unchanged. Specifically, our default anomaly score based on the similarity between a test sample and normal training samples. We substituted this anomaly score with logits provided by our binary classifier head. Specifically, the COBRA results reported in the main paper are based on the A(x) anomaly score, which is defined as:
A(x) max ((((F()))
E
Instead, we replaced that with A'(x) -)((()))) 1). which denotes the probability of belonging the aeeudo-anoomly class assigned by the binary classifier head. Additionally, considered A(x) A(xx) as another alternative. As the results presented Table 10 demonstrate, all strategies achieve significant performance with minor differences.
Ablation Study on Distribution-Aware Hard Transformation
In this section, utilize the feature extractor C as anomaly detector to demonstrate that its
20

---

Published as a conference paper at ICLR 2025
Table 9: Performance of COBRA trained with standard training (without adversarial training) across various datasets.
setting
Closs
94.3
90.7
95.1
93.4
96.0
92.7
95.2
78.1
90.8
83.4
Adversatial
1.7
38
2.3
Table 10: Ablation study on different score functions. Results are AUROC (%)
Dataset
Anomaly Score
A(x) + ('x))
A'(x)
A(x) (default)
MVTecAD
88,4/7466
83.1 / 72.8
8
CIFARIO
81.9/60.2
76. / 55.7
83.7 62.3
FMNIST
89.6 87.4
88.5 84.8
93.1 19.6
CIFARIO0
72,6/51.2
70.4
76.9 /1.77
Table 11: C's performance in the AD task across various datasets.
Imagetictt
CODRA
77.1
72.4
$6.0
83.6
74.3
80.3
73.2
64.9
78.5
73.2
learned features from the normal training set meaningful and significantly surpass random detec- tion, highlighting its role crafting effective pseudo-anomaly samples. Results presented in Table II
Ablation Study on Thresholding
Here, while keeping all components of COBRA constant, skip the thresholding strategy and instead use a random subset of hard transformations for crafting aeeuooannomaly samples. The results, indicated in Table 12, suggest that this approach leads decreased performance due the failure to filter incorrect pseudo-anomaly samples (those that still belong to the normal set).
Table 12: Impact of Skipping Thresholding on Iseudo-Anomal Generation in COBRA
Methods
Ditauets
CITARIO
CIPAR100
MINSTT
DMass
SVIIN
MVTechAD
VisA
DAGM
ISIC2018
COBRA
58.1
94.3/9155
90.1/86.5
84.5
760/682
78.4147.9
74.6/520
F ANALYZING COBRA'S STABILITY AND EFFECTIVENESS
Figure 4 represents COBRA's loss values and its detection performance at each epoch of training for both clean data and data subjected to PGD attack, demonstrating the stability of COBRA's loss function. The experiment
conducted in one-class setup using the MVETEC-AD and FMNIST datasets. Note that the loss values have been normalized between 0 and 1, and the loss values for the PGD data are higher than those for the clean data. Despite this, the figure underscores the stability of our loss function, which remains consistent across different training conditions.
G 3 TO ALL METHODS
Here, present more detailed results of previous anomaly detection (AD) works and their perfor- mance under A (See Table 13). Their respective performance against PGD-1000 attacks has been provided in the main paper.
21

---

Published as a conference paper at ICLR 2025
serhal (iee Pocrr (CB)
02-
50ViaA (446
Kyck
(a) Loss
AUC
This figure depicts COBRA's loss values and detection performance for each epoch of training on both clean data and data under PGD attack, demonstrating the stability of COBRA's loss function. The experiment was carried out in one-class setup using the MVETEC-AD and FMNIST datasets.
Figure 4:
Table 13: AUROC (%) various methods for One Class AD methods under Auto
'These models are trained to be adversarially robust.
Iosset
Mahhal
DerpyVLI
MSAD
Iaaadverrly
Paachiire
PricipalS"
MNIST
141
862
MNIST
48.1
85
22
97
33
28
566
123
SVIIN
43
08
02
04
81
11
89
6.1
03
SregeNes30
124
27
12
05
14
23
25.8
206
H EVALUATING OUR MODEL UNDER VARIOUS ATTACKS WITH DIVERSE EPSILON VALUES
In this section, we evaluate our model's performance under adversarial attacks, specifically focusing on fo and fz PGD attacks across various epsilon values. Table presents results for the foe PGD-1000 attacks, indicating that the model maintains strong accuracy for lower epsilon values, with some decline in performance observed as epsilon increases. Similarly, Table [5] illustrates the model's robustness under l PGD attacks, demonstrating consistent accuracy across lower epsilon values, with gradual trend observed at higher epsilon values. These results highlight the model's resilience adversarial attacks while also indicating areas for potential improvement.
Table 14: Evaluation of our model under various foe PGD-1000 attacks across different values. Although the model was trained using loo PGD-10 with 2/255 for high-resolution images and 4/255 for now-resolution images, the evaluation settings were modified to test its robustness against stronger attacks.
Epsilon
MVTec
VisA
ImageNet
CityScapes
ISIC2018
CIFAR10
FMNIST
Avg.
0
89.1
75.2
85.2
81.7
81.3
83.7
93.1
84.2
1/255
81.6
74.6
68.1
65.7
77.0
91.1
74.4
2/255
75.1
73.8
57.0
56.2
56.1
72.9
90.2
68.7
3/255
64.7
67.2
54.1
50.9
51.8
69.3
89.9
64.0
4/255
56.1
52.9
45.2
47.1
49.3
62.3
89.6
$7.5
5/255
49.5
46.3
43.7
40.9
45.5
60.8
89.2
53.7
6/255
42.8
40.7
39.4
38.6
42.1
56.3
89.2
49.9
7/255
38.1
33,9
34.5
35.2
39.6
51.8
89.1
46.0
8/255
34.2
30.7
28.6
32.8
35.5
47.4
89.1
42.6
22

---

Published as a conference paper at ICLR 2025
Table 15: Evaluation of model under various PGD attacks across different values. Although the model was trained using L PGD-10 with 2/255 for high-resolution images and 4/255 for low-resolution images, the evaluation settings were modified test its robustness under stronger (2-norm adversarial attacks.
Epsilon
TVe
VisA
ImageNet
CityScapes
ISIC2018
CIFARIO
FMNIST
Avg.
0
89.1
75.2
85.2
81.7
81.3
83.7
93.1
84.2
16/255
87.1
74.9
77.8
77.9
76.8
73.8
91.0
79.9
32/255
85.4
74.8
75.1
77.8
74.2
64.1
89.9
77.3
64/255
83.8
74.2
71.0
72.6
71.3
55.4
88.9
73.9
128/256
79.6
73.1
65.0
66.7
60.5
48.9
87.6
68.8
I IMPLEMENTATION DETAILS
We employ ResNet-18 as the foundational encoder network (fo), accompanied by an auxiliary head (9+) consisting of 2-layer multi-layer perceptron with 128-dimensional embedding. For optimization, COBRA trained for 100 epochs using the LARS optimizer, with a weight decay of 1 10-6 and momentum of 0.9. To schedule the learning rate, we adopt linear warmup for the initial 10 epochs, gradually increasing the learning rate to 1.0. Subsequently, we use cosine decay schedule without restarts. The batch size for COBRA set 128. Our experiments were conducted using NVIDIA GeForce RTX 3090 GPUs (24GB).
Training Computational Cost. COBRA comprises two main steps: (i) generating pseudo-anomaly samples from the normal training set, and (ii) adversarially training a model using both normal and crafted pseudo-ands anommleess In this section, we analyze the complexity of these steps. Figure 5 Tillustrates that COBRA achieves significant performance with low complexity in terms of time. Please note that training time shown in the figure is calculated for a single class the dataset. In T66 we compare the time efficiency of our method, both with and without adversarial training, against other state-of of-the-art methods across multiple datasets.
1000
Pscudo Anemaly Cralling
COBRA Training
800
Training Time (minutes)
600
400
200
1i
cifar100
svin
Imaynet30
MVTecAD
VisA
ISIC-2018
DAGM
Figure 5: Computation cost
Table 16: Training Time Comparison (in hours) Across Different Methods and Datasets
Method
MVTecAD
VisA
CityScape
ImageNet
Transformaly
30h
70h
6h
200h
ReContrast
25h
60h
5h
180h
Ours (with adv. training)
95h
250h
20h
500h
Ours (without adv. training)
9h
23h
2h
70h
23

---

Published as a conference paper at ICLR 2025
Evaluation of Computational Cost. After training, we freeze model and extract features from the training samples to create an embedding bank, which maps images from high-dimensional spaces (e.g., (1000, 224, 224)) lower-dimensional space (e.g., (1000, 256)). During inference, for each test sample, we compute its features using the frozen model and compare its similarity to the precomputed embedding bank. This process computationally efficient since it operates with frozen model and in a low-dimensional space. To the best of our knowledge, using similarity-based methods, such k-NN in embedding spaces for detection tasks, is common and well-established in the literature (e.g., MSAD). Furthermore, we provide detailed computational time information, excluding the time required for feature bank creation as it can be precomputed. The anomaly score computation times results averaged over 100,000 inferences. For our model, embedding extraction takes 1-3 ms, matrix multiplication 1-2 ms, and finding the maximum value takes less than ms.
3090 GPU, in comparison to other methods, are presented in Table with
Table 17: Per-Image Evaluation Time Comparison (in milliscconds) Across Different Methods
Metric
CSI
MSAD
Transformaly
ReContrast
OCSDF
COBRA (Ours)
Per-Image Eval Time
4
4
5
mss
4
PER-CLASS RESULTS
Anomaly detection evaluation scenarios can be categorized into one-class anomaly detection and unlabeled multi-class setups, mentioned in the experiments section. In this section, we provide details of the one-class classification setup for COBRA on the reported dataset, as presented in Tables
18 19
24

---

Published as a conference paper at ICLR 2025
Table 18: The detailed AUROC scores of the class-wise experiments for One-Clas: Anomaly Detection setting with PGI-1000 e 203 CIFARIO, CIFAR100, MNIST, Fashion-MNIST, SVHN datasets.
(a) MNIST
Methed
Class
Average
2
5
6
7
8
9
Clean
97.6
39.9
99.6
99.2
98.9
98.3
99.6
95.6
99.7
99.6
92.8
Ours
PGD-100 100
92.4
99.3
98.3
95.1
97.5
96.9
94.4
98.7
96.7
96.9
96
96.6
96.4
(b) Fashion Fashion-MNISS MNIST
Avenge
2
3
6
Clean
89,5
99.6
92.7
91.4
86.7
97.1
82.5
97
96.2
98.4
93.1
COBRA
BlackBox
PGD-100 100
85.4
99
85.1
84.6
83
95.3
80.9
95.1
90.7
97.4
89.6
4
83.7
96.5
85
83.9
81.7
93.5
77.2
87.4
(c) CIFARIO
Method
Average
0
2
3
4
5
6
7
8
Clean
79.4
96.3
75.4
71.3
76
84.3
76.1
94.5
92.8
91.1
83.7
BlackBox
75.2
73.4
74.2
92
Ours
PGD-100
64.7
80.4
47.9
39.9
49.5
60.7
$2.9
74.8
80.3
71.7
62.3
(d) SVHN
Method
Attack
Average
Clean
793.7
88.8
79.3
88.3
$8.9
89.3
BlackBox
75.2
83.7
84.1
86.4
Ours
PGD-100
61.2
61.8
51.5
45.4
59.4
55.2
61
67.7
$1.4
61.4
58.2
(e) CIFARI00
Matial
Alakk
ClN
Class
11.1
11.
154
123
53.34
91
194
12.4
555
Wa
614
131
311
187
71
191
75.6
16.
554
607
915
871
55.
42.
48.1
47.4
312
566
439
120
35.8
a11
69.5
124
463
47.3
11.3
483
174
324
12.5
635
56
017
25

---

Published as a conference paper at ICLR 2025
Table 19: The detailed AUROC scores of the glass-specific experiments for One-Class Anomaly Detection setting with PGD-1000 in Imagenet30 dataset.
253
(a) ImageNet30
Methed
Average
2
3
4
5
6
7
8
9
Clean
74.9
98.]
99.7
73.5
83.4
96.7
93.2
83.3
82.7
74
85.2
Ours
PGD-100
35.8
90.9
96.7
46.4
36.3
86.3
60.9
53.7
38.5
24.4
57
(b) ImageNet30
Class
Average
10
11
12
13
14
15
16
17
18
19
Cleun
96.9
90.1
93.3
82.1
94.6
62.8
98.2
58.5
89.4
54.7
85.2
Ours
BlackBox
PGD- 100
71.3
96
62.8
87.1
91.8
75.5
78.3
36.6
76.6
90.3
62.5
16.4
88.1
95.4
55.5
17
58.5
88.7
51.9
24
82.4
57
70.9
35.7
72.6
13.8
87.1
55.7
22.2
(c) ImageNet30
Method
Attack
Class
Average
20
23
24
25
26
27
28
29
Clean
96.5
80.2
69.2
83.5
92.9
78.3
85.2
BlackBox
92.3
83.9
91.5
96.3
75.1
65.3
82.4
89.9
76.7
90.8
82.4
Ours
PGD-100 100
77.9
44.8
90.8
79.1
39.2
40.6
32.2
78.1
41.3
86.5
57
74.7
44.9
89.8
75.2
35.7
38.4
31.8
77.3
38.8
84.4
54.7
26

---

Published as a conference paper at ICLR 2025
K ADVERSARIAL ATTACKS ADAPTATION
We evaluated COBRA'S robustness against a varicty of powerful attacks, including BlackBox, FGSM, CAA, AutoAttack, A and PGD-1000. These attacks, originally designed to compromise classification tasks by exploiting the cross-entropy loss, were adapted for anomaly detection (AD) tasks, focusing the anomaly scores of detector models. The aim to generate perturbations that increase the anomaly score for normal test samples and decrease for anomalous ones. As discussed in the preliminaries section, adapting Auto (AA) Croce and Hein (2020) for AD tasks was particularly challenging. AutoAttack is an ensemble of different attack methods, such as FAB, multi-targeted FAB, Square Attack, APGDT, APGD with cross-entropy loss, and APGD with DLR loss. The main challenge in adaptation arises because attacks based on DLR loss assume the model's output includes least three elements, an assumption valid for classification tasks on datasets with three more classes but not applicable to AD tasks. Consequently, we replaced the DLR loss component AutoAttack with a PGD attack. However, for the other attacks under consideration, no adjustments were necessary.
L DATASETS DETAILS
The MVTecAD an industrial defect detection dataset used to evaluate AD methods. It consists of 4,096 normal and 1, 1,258 anomaly samples, encompassing various types of texture defects. MVTecAD is under the CC-B Y-NC-SA 4.0 license. VisA is another challenging dataset for industrial defect detection, comprising 9,621 normal and 1,200 anomaly samples. VisA under the CC-BY 4.0 license. DAGM is synthetic dataset created for defect detection on textured surfaces. To broaden the scope beyond traditional industrial scenarios, the Cityscapes dataset offers stereo videos from 50 cities, each meticulously annotated for 30 classes such as roads and buildings. We leverage this dataset by extracting 256x256 patches from its images to construct an anomaly detection dataset, focusing on the presence of anomaly objects within these patches. Anomaly classes encompass motorcycles, persons, riders, traffic signs, traffic lights, and bicycles, while other classes from Cityscapes are considered normal. Their code is released under the MIT license. Additionally, ISIC2018 is skin disease dataset, available as task 3 of the ISIC2018 challenge. It contains seven classes. NV (nevus) is taken the normal class. and the rest of the classes are taken anomalies, following. The training set contains 6,705 normal images. The ISIC dataset is available under CC-BY-NC license. Furthermore, utilize ImageNet30 Hendrycks al. 2019a), anomaly detection benchmark that selects 30 classes from ImageNet and employs a one-versus-rest setup for anomaly detection. This dataset is freely available researchers for non-commercial use.
M DETAILED RESULTS
The figure presents the standard deviation and mean of COBRA (a specific algorithm or method) calculated over separate runs for each experiment. This comprehensive data collection and analysis underscore the reliability and consistency of our experimental results. By reporting both the mean and standard deviation, we provide a clear depiction of the average performance and the variability, ensuring that the performance of COBRA is not only robust but also consistently reproducible across multiple trials.
Table 20: The standard deviation and mean of COBRA across 5 runs of each experiment are reported, demonstrating the consistency of our results.
Statistics
Eval Type
Dasasets
CIFARIO
CIFARIOI
MNIST
FMNIST
SVHN
ImunsNa
Visk
CiySigge
DAGM
ISIC2018
Mean STD
Clean
Adv
83.7 1 0.52
62.5 0.75
51.7 0.91
76,9 1
92.8 2. 0.47
96.11 0.86
95.1 = 0.56
$9. = 0.91
89.3 0.39
58.2 2 0.82
$1.0 LA1
83.2 1.2:1:1:11
75.2 =: 1.03
733 = 1.17
$ 1.31
81.7 0.97
$2.4 0.4.0.877 0.87
56.8.1
81.3 4 0.24 36.1 4: 1.42
N SUPPLEMENTARY METRICS FOR COBRA ASSESSMENT
We found the Area Under the Receiver Operating Characteristic curve (AUROC) to be the most widely accepted and utilized metric. To further exploration, we have provided additional results
27

---

Published as a conference paper at ICLR 2025
using supplementary metrics- AUPR and FPR95% have been utilized in previous works Heeddrycss et al. (2019b). In the table we compare COBRA against TRANSFORMALY and ZARND, recent detection method, using these metrics. FPR95% represents the false positive rate when 95% of the outliers are correctly detected; a lower FPR95% signifies better performance. Both AUROC and AUPR summarize detection method's s performance over various thresholds. Specifically, AUROC indicates the likelihood that an outlier is ranked higher in anomaly score compared an in-distribution sample. Hence, higher AUROC and AUPR values denote superior performance, with an uninformative detector scoring an AUROC of 50%. To address the reviewer's s concerns, we will consider including AUPR and FPR95% along with AUROC in our final manuscript.
Table 21: Methods and Metrics Comparison Across Different Datasets
Methods
Metric
MVTec
VisA
ImageNet
CityScapes
ISIC2018
CIFARIO
FMNIST
AUROCT
88.5/2.2
85.5/0.0
99.0/2.9
87.4/4,5
86.6/3.9
98. 18.3/377
94,4/7.4
Transformaly
AUPR
85.6/3.9
83.7/4.1
94. 1/2.3
86.0/2.6
83.5/2.8
99.6/1.4
98. 98.2/0.0
FPR95%
41.6/99.7
26.7/98.9
2.6/99.1
35.7/97.9
28.4/98.0
8.4/99.6
9.5/95.4
AUROC
71.6/30.1
71.8/24.9
96.4/27.4
75.9/28.6
70.2/14.6
89.7/56.0
95.0/82.5
ZARND
AUPR
73.5/28.7
69.8/20.1
90.1/29.8
72. 72.1/26.5
73.6/16.4
85.5/52.3
92.5/80.0
FPR95%
41.2/69.2
44.1/73.9
7.3/4.8
1/66.4
26.8/75.3
26.4/55.9
9.6/23.3
AUROC
89.1/75.1
75.2/73.8
85.2/57.0
81.7/56.2
81.3/56.1
83.7/62.3
93.1/89.6
COBRA (Ours)
AUPR
91.7/71.9
78.6/70.3
88.9/61.2
85.6/62.1
87.6/59.8
84.7/65.7
95.1/89.8
FPR95%
18.5/36.8
35.8/38.7
24.9/54.7
29.3/55.0
30.1/52.7
26.4/43.9
6.7/17.3
O
SOCIAL IMPACTS
Robust anomaly detection is crucial across many safety-critical domains like security, healtheare, finance, and manufacturing to identify potential threats, diseases, fraud or system faults before they cause harm. However, existing machine learning- based anomaly detectors are vulnerable to adversarial attacks that can make them miss anomalies or falsely flag normal data. Our work on COBRA presents significant step towards developing reliable and robust anomaly detection systems resilient to adversarial conditions. By learning representations inherently robust to input perturbations and distribution shifts, COBRA enables safer anomaly detection deployment in security-sensitvy areas where an adversary may attempt evasion. Notably, COBRA achieves high robustness without requiring anomaly data during training. valuable when such data limited due to privacy/safety concerns. Overall, we believe COBRA importantly enhances the safety and reliability of anomaly detection systems. However, this powerful technology must responsibly developed and deployed with technical safeguards, policy measures and institutional controls to maximize societal benefit while mitigating potential misuse risks. We advocate future work exploring robust machine learning trustworthy real-world deployment.
P LIMITATIONS
Scope of Application In this study, we primarily focus on anomaly detection for texture-based defects, which are common in real-world applications such as industrial defect detection and medical image diagnosis. Specifically, while our experiments include one-class classification (semantic anomaly detection), our performance is more pronounced in texture-based anomaly detection. In semantic anomaly detection, normal samples and anomalous samples are semantically different.
Clean Performance This study aims to improve the adversarial detection performance of anomaly detection tasks. Despite significant improvements in adversarial detection, our clean performance lags behind existing state-of-the-art detection methods. The trade-off between clean and adversarial test performance is well-documented in the literature Tsipras et al. (2018); Zhang al. (2019) Madry et al. (2017); Schmidt et al. (2018); |Raghnnthann et al. (2020). Our work is also subject to such trade-offs. However, we have also provided results for scenarios where adversarial training is not performed.
28


Reviews:
[{"review_id": "P980ReNb2X", "reviewer": "Reviewer_YXiZ", "summary": "The paper addresses adversarial robustness in anomaly detection settings, where conventional models are vulnerable due to training limitations that exclude labeled data and anomaly samples. The authors propose a framework that generates pseudo-anomalies (synthetic outliers) through data augmentations and employs a contrastive loss function. They claim a modifications to the contrastive objective mitigates the effect of spurious negative pairs by maximizing the margin between normal and anomaly samples, although, it seems class collision still occurs despite their modification. The authors experiment with well-known benchmark datasets, demonstrating significant improvement in robust detection performance across real-world scenarios under adversarial conditions.", "questions": "-\tDoes the source of performance improvements primarily come from the redefinition of the loss function (e.g., the inclusion of opposite pairs) or from the way anomalies are crafted? Ablation studies with a detailed breakdown of each part of the framework, including replacements with other contrastive objectives, could clarify this.\n-\tHave the authors considered techniques from recent or ongoing research that expand the set of positives for normal samples to include all other normals in the batch? This approach could potentially enhance robustness by promoting compact in-distribution representations at the same time increasing the margin between normal and anomalous samples.\n-\tOn page 1 (line 051), the authors refer to a “novel thresholding approach (19).” It’s unclear why this is considered novel, especially since the cited work is from 2013. The authors should clarify already in the introduction what aspect of their thresholding method is novel or provide more context to justify the claim.\n-\tThe introduction could be improved by breaking down and summarizing the key components of the methodology. Currently, it requires readers to navigate back and forth to piece together the details. The authors should use the introduction to outline their approach comprehensively, giving readers a clear understanding of what will be discussed in detail later in the methodology section.\n-\tOn page 1 (line 57), the authors state that the \"optimal objective function should maximize the margin between the distributions of normal and anomaly samples.\" The rationale behind how maximizing this margin, while also promoting compactness of in-distribution samples, contributes to adversarial robustness is not clearly explained. The authors should provide additional insights on why this separation is relevant and how it enhances the model's robustness against adversarial attacks. \n-\tIn Section 3.1, the explanation regarding the generation of anomalies and the definition of opposite pairs needs to be clearer. Authors should easily introduce the definitions, for any given normal sample, what is being considered positives, which are negatives, and where/how the opposite pairs come within this settings. A more direct and clearer explanation would greatly enhance the reader's comprehension of the framework.\n-\tThe paper refers to InfoNCE but cite SimCLR paper. Moreover, the implementation details and mathematical definitions follows more NT-Xent. Could the authors clarify whether the loss formulation adheres strictly to InfoNCE or NT-Xent? Additionally, in the context of defining negative pairs, the explanation on Page 4, Line 214, seems to align with NT-Xent, particularly since you describe the negative samples as \"the other samples’ augmented view.\" This typically implies $2(N-1)$ negative samples per anchor, following NT-Xent. Is this interpretation correct, or does your formulation differ in the way negatives are constructed within the batch?\n-\tWould the authors consider reformulating Equations (1) and (2) to follow the standard mathematical notation used in InfoNCE or NT-Xent? The current two-summation format may be confusing, especially since $P(x_i)$ is a singleton. Using a more familiar notation could improve clarity and make it easier for readers to understand the loss function.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "-\tThe paper addresses the topic of adversarial robustness in anomaly detection, which is a known limitation in semantic and defect-based anomaly detection, and unlabeled OOD detection.\n-\tThe authors provide an extensive set of experiments, comparing their method with well-known approaches in a comprehensive manner.\n-\tThe literature review includes relevant works.\n-\tThe modifications proposed are straightforward and appear to yield strong results, though their simplicity raises some questions about the underlying mechanisms driving the reported improvements.", "weaknesses": "-\tThe approach to mitigating spurious negative pairs through opposite pairs is not clearly effective in addressing class collision. The use of a single-pairing strategy for forming the positives, inherited from InfoNCE/NT-Xent suggests unresolved issues. \n-\tThe source of performance gains is unclear. It is not evident whether improvements stem from the redefinition of the loss function, thresholding, opposite pairs, the anomaly crafting strategy, etc. A clearer breakdown of these contributions would clarify the method’s impact.\n-\tThe term \"spurious pairs\" seems misapplied, as it should be referred to as \"class collision\" in the context of contrastive learning. Using standard terminology would align the paper with accepted practices in the field. Refer to  Arora et al. (2019, \"A Theoretical Analysis of Contrastive Unsupervised Representation Learning\").\n-\tIt is difficult for the reader to rapidly identify what is being considered as positive and negative samples within the formulation. A clear understanding of this within the framework is critical for the reader's comprehension.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NJCvLdK31O", "reviewer": "Reviewer_1DsR", "summary": "This paper proposes a novel method for adversarially robust anomaly detection. The proposed method enhances robustness in anomaly detection by generating pseudo-anomalies through hard transformations and mitigating the effect of spurious negative samples with a tailored contrastive loss. Experiments on various datasets demonstrate that the proposed method achieves superior performance in both clean and adversarial scenarios.", "questions": "1. Could the authors address the first and second weaknesses to improve the clarity of the paper?\n  - Update the citation format to follow the ICLR style and fix the typos.\n  - Define $k$ and resolve the inconsistency regarding the opposite sample in Figure 1 and equation (2).\n  - If possible, include pseudocode for generating the adversarial example.\n2. In the EXPERIMENTS section, could the authors first present the experimental setup and evaluation details, and implementation details, followed by an analysis of the results? Additionally, could the authors provide a more detailed analysis for each experimental result and include an analysis of Figure 3?\n3. On page 7, lines 375-377, it states that replacing adversarial training with clean training improved clean detection performance to 90.7%. Could the authors also report how robust accuracy was affected?\n4. For the PGD attack, the number of iterations was set to 1000. Does this actually increase the effectiveness of the adversarial attack? Could the authors compare the robust accuracy with fewer iterations, such as 20 or 100?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper identifies limitations in existing anomaly detection methods and challenges in using  contrastive learning for adversarial training, offering solutions to improve robustness in anomaly detection.\n2. Through extensive experiments, this paper provides a comprehensive understanding of the strengths and limitations of the proposed method.", "weaknesses": "1. This paper does not follow the ICLR citation format and contains several typos affecting clarity. \n  - Page 4, line 207: In the phrase \"where $\\Upsilon(x^{b+i})$ is considered as $x^{b}$\", it seems that $x^{b}$ should be replaced with $x^{i}$.\n  - Page 6, line 291: $x+\\delta$ should be used as an input to $\\mathcal{L}(\\cdot, \\cdot)$ instead of $x+\\delta^{\\ast}$.\n  - Page 6, lines 317 and 319: There are typos involving \"setting 4\".\n2. The paper includes unclear or inconsistent content that hinders understanding of the proposed method. \n  - Page 2, line 107: The formulation $x^{\\ast}=x_{k}^{\\ast}$ includes the undefined symbol $k$.\n  - In Figure 1, an augmented sample and its corresponding opposite sample (e.g., $\\text{A}\\_1$ and $\\text{A}\\_1^{\\Upsilon}$) are used in $\\mathcal{L}\\_{\\text{COBRA}}$. However, in equation (2), the opposite sample of the original sample (e.g., $\\text{A}^{\\Upsilon}$) is used instead.\n  - In Figure 1 and the “Adversarial Training Step” paragraph on page 6, a single adversarial example $x_{adv}$ is generated for the augmented samples $x_i$ and $x_j$. However, the generation process is unclear and needs a step-by-step explanation, especially on how the perturbation is optimized in $\\mathcal{L}\\_{\\text{COBRA}}$.\n3. In the EXPERIMENTS section, the analysis of experimental results appears before the experimental setup, evaluation details, and implementation details, which limits understanding. Additionally, the analysis is too brief to fully convey the implications of the experimental results, and no analysis is provided for Figure 3.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gMk35eC6B9", "reviewer": "Reviewer_qBmY", "summary": "The goal of this paper is to enhance the robustness of anomaly detection systems against adversarial attacks. It introduces a new method called COBRA, which addresses the issue of spurious negative pairs and strengthens the distinction between normal and anomalous samples through contrastive learning.", "questions": "1.  Could you please provide experimental evidence to support the claim that spurious negative pairs weaken inter-group perturbations in adversarial contrastive learning? (Introduction, lines 66-69)\n\n2. Could you explain why ResNet-18 was chosen as the sole architecture for your experiments? It would be helpful to understand whether your proposed method generalizes well to other architectures or feature extractors, and why this aspect was not explored.\n\n3. What is the rationale behind using a k-class classifier for anomaly crafting? It would be beneficial to know how this approach specifically improves the anomaly crafting process compared to alternative methods.\n\n4. Could you elaborate on why different epsilon values were not explored during adversarial training? Wouldn’t varying the epsilon values offer further insights into the robustness of your method?\n\n5. What criteria did you use to define hard and mild augmentations? It would be helpful if you could provide more details on how these augmentations impact the model’s performance.\n\n6. How do you distinguish the effects of adversarial training from those of augmentations (Hard/Mild) ? Additional experiments clarifying the contributions of each would be greatly appreciated.\n\n7. Could you clarify the terms used in Table 6, such as \"L_{Opposite}\" ? It would be valuable to understand how these terms were applied in the experiments and their significance.\n\nAdditionally, I would appreciate responses to the above weaknesses points.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The paper presents an approach to enhance the robustness of anomaly detection methods, specifically addressing spurious negative pairs—an issue that traditional contrastive learning methods have not adequately tackled.\n2. Figure 1 is well-crafted, providing a clear visualization of the COBRA method.\n3. The paper demonstrates extensive experimentation across a variety of datasets, covering both high-resolution and low-resolution data.", "weaknesses": "1. The claim that spurious negative pairs weaken inter-group perturbation in adversarial contrastive learning (Introduction, lines 66-69) requires supporting experimental evidence. The paper lacks clear results or a detailed explanation to substantiate this point.\n\n2. The experiments rely solely on ResNet-18. Evaluating the method with different architectures or feature extractors would provide better insight into the generalizability of the approach.\n\n3. The rationale behind using a k-class classifier for anomaly crafting is unclear. The paper does not sufficiently explain how training with k-class classifiers improves anomaly crafting or what the specific benefits are.\n\n4. There is a lack of experimentation with different epsilon values during adversarial training (in the paper, a fixed epsilon of 2/255 is used for high-resolution data, and 4/255 for low-resolution data). Testing across a range of epsilon values would offer a more comprehensive evaluation of robustness.\n\n5. The balance between clean accuracy and robust accuracy is not well-addressed. For example, in Table 2, the ZARND method shows both high clean accuracy and robust accuracy in the Low Res experiment, but the balance between these is not analyzed in depth.\n\n6. The criteria for hard/mild augmentations are unclear. The paper does not provide a clear definition or justification for the augmentation types used.\n\n7. The distinction between adversarial effects and augmentation effects is insufficiently explained. It’s unclear whether performance improvements are due to adversarial training or augmentations alone. This could be clarified through additional analysis.\n\n8. Table 6 lacks sufficient explanation. Terms such as \"L opposite\" are not clearly defined, and the application of these terms within the experiments is not fully explained.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JuEpYIGAwJ", "reviewer": "Reviewer_mZoT", "summary": "This paper introduces a novel approach for robust Anomaly Detection (AD) under adversarial attacks by generating pseudo-anomaly groups from normal group samples. It demonstrates that adversarial training with contrastive loss could serve as an ideal objective function, as it creates both inter- and intra-group perturbations. It defines opposite pairs and adversarially pulls them apart to strengthen inter-group perturbations to overcome the effect of spurious negative pairs. Experimental results demonstrate superior performance of the proposed method in both clean and adversarial scenarios, with a 26.1% improvement in robust detection across various challenging benchmark datasets.", "questions": "1. Could you analyze the computational complexity of the proposed anomaly score? Will different $D_{train}$ affect the performance? \n\n2. Could you evaluate adaptive attacks that are specially designed for the proposed anomaly score?\n\n3. Could you explain why $A^3$ is weaker than PGD-1000 in Table 4?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. It proposes COBRA (anomaly-aware COntrastive-Based approach for Robust AD), a novel method that mitigates the effect of spurious negative pairs to learn effective perturbations.\n\n2. It employs numerous strong adversarial attacks for robustness evaluation, including PGD-1000, AutoAttack, and Adaptive AutoAttack.\n\n3. The experiments span various datasets, including large and real-world datasets such as Autonomous Driving, ImageNet, MVTecAD, and ISIC, demonstrating COBRA’s practical applicability. Additionally, It conducts ablation studies to examine the impact of various COBRA components.", "weaknesses": "1. It might be too expensive to compute the anomaly score since it needs to compute the similarity score over the entire training dataset $D_{train}$. Also, it is unclear how $D_{train}$ will affect the performance. It can provide an empirical analysis of how the size of $D_{train}$ affects both performance and inference time.\n\n2. Although it evaluates several strong attacks including AutoAttack, Adaptive AutoAttack and black-box attacks, it doesn’t evaluate adaptive attacks that are specially designed for the proposed anomaly score. It should follow the guidelines in [1] to design such adaptive attacks. \n\n3. From Table 4, it seems $A^3$ is weaker than PGD-1000, which is not expected. Some explanations are needed here. For example, it can provide a detailed analysis of why this result occurs, including potential hypotheses about the interaction between $A^3$ and the proposed method.\n\n[1] Tramer, Florian, et al. \"On adaptive attacks to adversarial example defenses.\" Advances in neural information processing systems 33 (2020): 1633-1645.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)