Perturbation Learning Based Anomaly Detection
Authors: Jinyu Cai
Jicong Fan
Venue: NeurIPS 2022 Accept (2022)
Keywords: Anomaly detection
Machie learning
Deep learning

Abstract: This paper presents a simple yet effective method for anomaly detection. The main idea is to learn small perturbations to perturb normal data and learn a classifier to classify the normal data and the perturbed data into two different classes. The perturbator and classifier are jointly learned using deep neural networks. Importantly, the perturbations should be as small as possible but the classifier is still able to recognize the perturbed data from unperturbed data. Therefore, the perturbed data are regarded as abnormal data and the classifier provides a decision boundary between the normal data and abnormal data, although the training data do not include any abnormal data.
Compared with the state-of-the-art of anomaly detection, our method does not require any assumption about the shape (e.g. hypersphere) of the decision boundary and has fewer hyper-parameters to determine. Empirical studies on benchmark datasets verify the effectiveness and superiority of our method.

Perturbation Learning Based Anomaly Detection
Jinyu Cail?2; Jicong Fan
Fuzhou University. Fuzhou, China Shenzhen Research Institute of Big Data, Shenzhen, China Thee Chinese University of Hong Kong, Shenzhen, China pinyucai1995 ggmaeiiii......mi.m....mmmmm com fanjiconge:uhk, eduu. on
Abstract
This paper presents a simple yet effective method for anomaly detection. The main idea is to learn small perturbations to perturb normal data and Iearn classifier classify the normal data and the perturbed data into two different classes. The per- turbator and classifier jointly learned using deep neural networks. Importantly, the perturbations should be as small as possible but the classifier is still able to recognize the perturbed data from unperturbed data. Therefore, the perturbed data are regarded as abnormal data and the classifier provides a decision boundary be- tween the normal data and abnormal data, although the training data do not include any abnormal data. Compared with the state-of-the-art of anomaly detection, our method does not require any assumption about the shape (e.g. hypersphere) of the decision boundary and has fewer hyper- peermparreeserss to determine. Empirical studies benchmark datasets verify the effectiveness and superiority of our method.
Introduction
Anomaly detection (AD) is important research problem in many areas such computer vision. machine learning, and chemical engineering [Chandola et al.) 20099] Ramachandra et al. 2020; Pang al. 2021 Ruff et al. 2021]. AD aims to identily abnormal data from normal data and usually an unsupervised learning task because the anomaly samples are unknown in the training stage. In the
past decades, numerous AD methods (Schölkopf al. 1999 2001 Breunig al. 22000 Liu al. 2008) have been proposed. For instance, one-class support vector machine (OCS VM) [Schölkopf al. 2001] maps the data into high-dimensional feature space induced by kernels and tries to find a hyperplane giving the possibly maximal distance between the normal data and the origin. Tax and Duin (2004) proposed method called support vector data description (SVDD), which finds the smallest hyper-sphere encasing the normal data in a high-dimensional feature space. SVDD is similar OCSVM with Gaussian kernel function.
Classical anomaly detection methods such as OCSVM and SVDD are generally not suitable for large-scale data due to the high computational costs and not effective deal with more complex data such as those in vision scenarios. To address these issues, few researchers [Erfani et al. 2016)]
Golan and El- Yaniv| 2018 Abati et al. 2019; Wang al. [2019] Qiu et al. 2021 attempted to take advantage of deep learning LeCunn et al. 2013) Goodfellow et al, 2016) to improve the performance of anomaly detection. One typical way to use deep auto-encoder or its variants/Vincent Vincent al.
2008: Kingma and Welling 2013 Pidhorskyi et al.) 2018 Wang el al. 2021 to learn effective data representation or compression models. Auto-encoder and its variants have achieved promising performance in AD. In fact, these methods do not explicitly define an objective for anomaly detection. Instead, they usually use the data reconstruction error metric to detect anomalies.
"The work was done during the visiting at SRIBD and CUHK-Shenzinn Cooresponding author
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

There are a few approaches to building deep anomaly detection objectives or models. Typical
examples include classical one-class learning based approach[Rutt et al. 2018 2019; Perera and
Patel 2019, Bhattacharya ef al. 22221] probability estimation based approach Zong el al. 20188]
Pérez-Cabo et al. [019|]119110 (Su et al. 20191 and adversarial learning based approach [Deecke el al. 2018
Perera et al. 2019: Raghuram ef a [02T]. For example, |Ruff et al. (2018) proposed deep one-class
classification (DSVDD) which applies deep neural network to learn an effective embedding for the normal data such that in the embedding space, the normal data can be encased by hyper-sphere with minimum radius. The deep autoencoding Gaussian mixture model (DAGMM) proposed by Zong al. [2018) is composed of compression network and an estimation network based on the Gaussian mixture model. The anomaly score is defined as the output energy of the estimation network. Perera et al. 2019 proposed one-class GAN (OCGAN) to learn latent space to represent specific class by adversarially training the auto-encoder and discriminator. The properly trained OCGAN network well reconstruct the specific class of data, while failing reconstruct other classes of data. Moreover, some latest works also explore interesting perspectives. Goyal el al. (2020) proposed the method called deep robust one-class classification (DROCC). DROCC assumes that the normal samples generally lie on low-dimensional manifolds, and regards the process of finding the optimal hyper-sphere in the embedding space as an adversarial optimization problem. Yan el al. [202T] claimed that anomalous domains generally exhibit different semantic patterns compared with the peripheral domains, and proposed the semantic context based anomaly detection network
(SCADN) to learn the semantic context from the masked data via ad learning. CCen et al.
[2022] proposed the interpolated Gaussian descriptor (IGD) learn more valid data descriptions from representative normal samples rather than edge samples. [Shenaar and Wolf [2022] utilized contrastive learning to construct the method called generic one-class classification (GOCC) for AD
on tabular data. It is worth noting that classical AD methods such as OCSVM [Schölkopf et al. 2001]
and DSVDD [Ruff er al., 2018) require specific assumptions (e.g. hypersphere) for the distribution or structure of the normal data. The GAN-based approaches [Deecke et al. 2018 Perera et al. 2019
suffer from the instability problem of min-max optimization and have high computational costs.
In this paper, we propose novel AD method called perturbation learning based anomaly detection (PLAD). PLAD aims to learn a perturbator and a classifier from the normal training data. The perturbator uses minimum effort to perturb the normal data to abnormal data while the classifier is able to classify the normal data and perturbed data into two classes correctly. The main contributions of our work are summarized as follows:
We propose novel AD method called PLAD. PLAD does not require any assumption about the shape of the decision boundary between the normal data and abnormal data. In addition, PLAD has much fewer pyrrr-parameters than many state-of-the-art AD methods such as [aan et al.
2019 Goyal et al. 2020 Yan et al. 2021].
We propose to learn perturbations directly from the normal training data. For every training data point, we learn distribution from which any sample can lead to perturbation such that the normal data point is flipped to an abnormal data point.
Besides the conventional empirical studies one-class classification, we investigate the perfor- mance of our PLAD and its competitors in recognizing abnormal data from multi-class normal data. These results show that our PLAD has state-of ofte-offthheart performance.
Although our experiments are mainly on images and tabular data, PLAD is actually a framework of AD and can also be applied to time series, text, and graph data via changing the network components.
2 Proposed method
Suppose we have a distribution D of dimension d and any data drawn from D are deemed as normal data. Now we have some training data X = [x1. X2, xx, randomly drawn from D and we want to leam discriminative function f from X such that f(x > 0 for any D and f(x) < 0 for any x & D. This is an unsupervised learning problem and also known as anomaly detection, where any É D are deemed abnormal data.
In contrast to classical anomaly detection methods such as one-class SVM (Schölkopf et af. 2001], deep SVDD RRff et al. 2018 and DROCC [Goyal et al. 2020), in this paper, we do not make any

---

assumption about the distribution D. Inspired from the generative adversarial learning (GAN) [Good] fellow al. 2014], we propose to learn a discriminator that is able to recognize fake data (abnormal data) and generator that is able to fool the discriminator, but the input of the generator is real data (normal data), which is essentially different from GAN. To be more precise, we propose to learn perturbations for x such that the perturbed X (denoted by X (x1, x2...., are abnormal but quite close to X. To ensure the abnormality of X, we learn a classifier I from {x, X) such that f(x) > for any x E X and [(x) 0 for any & X. To ensure that X is close to X, the perturbations should be small enough. Therefore, we propose to solve the following problem
minimize 0, X
1 T2
Σ
Elv. fo(xx)))
1 E fo
Σ o(x,, x,),
where -(.,)) denotes some loss function such cross-entropy and 3/1
y/ and V1 .... Gr = are the labels for the normal data and perturbed data respectively. 0 denotes the set of parameters of the classifier f and -): is some distance metrie quantifying the difference between two data points. À is a hyperparameter to control the magnitudes of the perturbations. However, directly solving T encounters the following difficulties.
First, the number (10) + dn) of decision variables to optimize can be huge if n is large, where [@] denotes the cardinality of the set O.
Second, it is hard to use mini-batch optimization because some decision variables (i.e. X) are associated with the sample indices.
Lastly, it is not easy to determine ø because & relies on the unknown distribution D. For instance, Φ(x, x) = ||x x||?, namely the squared Euclidean norm, does not work if X enclosed by a hypersphere or hypercube (data points close to the centroid require much larger perturbations than those far away from the centroid, which implies that x has a -an-ssssiann distribution).
To overcome these three difficulties, we propose to solve the following problem instead
minimize
1
Σ E(v,, fo())))
Σ E(i fo():)) + n 1=1
n (Ia: 1/ + 113, - -013)
0,0
12 1=1
(2)
1=1
subject to x; = x, 2 a; Br, (a,, B,) g6 (x:), 1,2 .,.
where 1 1- - I,..,, 1]_ and 0 = [0, ,,.......00. 0] are d-dimensional constant vectors and O denotes the Hadamard product of two vectors. ar and Br are multiplicative and additive perturbations for x; and they are generated from perturbator 9g. where 0 denotes the set of parameters to learn. In (2). we hope that the multiplicative perturbation is close to I and the additive perturbation is close to but they rely the data point Therefore, the perturbation learning is adaptive to the unknown distribution D, which solves the third aforementioned difficulty.
In fact, problem 2 can be reformulated as
minimize 0, 8
(o + (0n fo(x, @ (xx,) + oz (x:)))
n
(xx)
1 11g (x:) 0112)
n
[ (x;) where 99 96 [x:)
= Da (x;), i 1,2, 1,2...., n. We see that we only need to optimize the parameters
and i and the total number of decision variables is |0| 00). which solved the first difficulty we discussed previously. On the other hand, 0 and are not associated with the sample indices, which solved the second difficulty. Once fo and 9ø leamned, we can then use fo to detect whether new data point Xnew is normal (e.g. fo (x(ee))) < 0.5) or abnormal (e.g. fo (Xne) > 0.5). We call the method Perturbation Learning based Anomaly Detection (PLAD).
In PLAD, namely (3), both the classifier so and the perturbator 93 are neural networks. They can be fully connected neural networks, convolutional neural networks (for image data anomaly detection),
3

---

Nerral maining
Pemurbal (pnorrllcee
Pettulltien
Novtal lesing surple
Anemalors smrin
A
Perturattrr
A
Panurbed Sample
Normal Trinnng Sample
0
0
À
Pettutbation
Chasificr +dll
A
4
4
Figure I: The motivation and network architecture the proposed PLAD method.
or recurrent neural networks (for sequential data anomaly detection). Figure T shows the motivation of our PLAD and the network architecture. Compared with many popular anomaly detection methods, PLAD has the following characteristics.
PLAD does not make any assumption about the distribution or structure of the normal data. In contrast, one-class SVM [Schölkopf er al. [000], deep SVDD [Ruff al. 2018). and DROC- C [Goyal et al. 2020) make specific assumptions about the distribution of the normal data, which may be violated in real applications. For example, deep SVDD assumes that the normal data are encased by hypersphere, which is hard to guarantee in real applications and may require very deep neural network to transform a non-hypersphere structure a hypersphere structure.
In PLAD, besides the network structures, we only need determine one hyperparameter which provides huge convenience in real applications. In contrast, many sfate-of-the-dle AD methods such as [Wang et al.) 22199) Goyal et al.) 22200] Yan er al. [022]] have at least two key hyperparameters. For example, in DROCC Gooyal el al., [2200], one has to determine the radius of the hyper-sphere, the step size of gradient-
and two regularization parameters.
In PLAD, we can use gradient- based optimizer such as Adam to solve the optimization. The time complexity is comparable to that of vanilla deep neural networks (for classification or representation). On the contrary, many recent advances DROCC [Goyal el al., 2020) of anomaly detection especially those GAN based methods [Deecke ef al. 2018 Perera et al. 2019 Yan et al.)
2021 have much higher computational costs.
As shown in the left plot of Figure 1 normal training data can be perturbed abnormal data by different perturbations. Therefore, we propose to learn a distribution from which any perturbations can perturb the normal training data to be abnormal. Specifically, for every x,, there exists a distribution Ωg such that for any z E Q2 the perturbation given by (a, B3) = h(()) can perturb x; to be abnormal, where h is nonlinear function modelled by neural network. We can just assume that Ω is Gaussian distribution with mean μæ and variance o² i.e., Ω = N(H, a because of the universal approximation ability of h. We take the idea of variational autoencoder (VAE) (Kingma and Welling 2013) and minimize
((01,02) = DEL (4ø, (z(x)[[p(z)) - Eas (mix) (ogp;((E|z))
(4)
! lj, (x), (or, (3) hag (z), 0 are the parameters of the encoder
where p(z) = N0, 1),
1, and 02 are the parameters of the decoder h. Combing with we have Ø {01, 02) and solve
minimize 0, 6
Σ
(1., + E(ir fo(x; O (x.) + + (x:)))
T
(5)
DeL (4a, (2)x))l((22 AB (a|x) log Pú, (e (s|z)]
where 93 = hgg o lg. not be detailed here.
The training is similar to that for VAE Kingma and Welling 2013 and will

---

It should be pointed out that the method (5) is just an extension of the method (3) In 5 we want learn a distribution for each normal training data point x; such that any perturbations generated from the distribution can perturb x; to he abnormal. It is expected that (5) can outperform 3 in real
applications. The corresponding experiments are in Appendix [
Connection with previous works
The well-known one-class classification methods such OCSVM [Schölkopf et al.) 2001]. DSVD- D |Ruff et al., [2118] and DROCC [Goyal el al. [020] have specific assumptions for the embedded distribution while our PLAD does require any assumption and is able adaptively learn decision boundary even if it is very complex. It is also noteworthy that the idea of DROCC in identifying anomalies is slightly similar to ours, i.e, training a classifier instead of auto-encoder or embedding
model.
Self-supervised learning based methods, e.g., GOAD [Begmman and Hoshen 2020 NeuTraL AD [Qiu er al.) (02T]. etc., work through designing an appropriate auxiliary task to help the model to learn useful data features. Both our approach and the self-supervised learning based methods aim to learn a binary classifier on the original data and auxiliary data. But they are different in the following two points. First, in self-supprvised learning (e-g. contrastive learning) based methods, the auxiliary data are generated by some pre-defined and manual operations (e.g. image rotation and cropping), In contrast, in our approach, the auxiliary data are adaptively and dynamically learned from the original data. Second, self-supervised learning based methods are often designed for some specific types of data such image data, whereas it may be difficult to generate auxiliary data for other types of data. In contrast, it is easy to apply our approach to any type of data.
Adversarial learning based methods (Malhotra al. 2016 Deecke er al.) 2018 Pidhorskyi al. 2018, Perera et al. 2019] are generally constructed with auto-encoder and GAN Goodfellow er a 2014), and the most widely used measure of them detect anomalies is the reconstruction error. Compared with them, we exploit the idea of VAE when producing perturbations and the detection decision is made by classifier, which should be more suitable than reconstruction error for anomaly detection. On the other hand, in these adversarial learning based AD methods, the min-max optimization leads instabilities in detecting anomalies, while the optimization of PLAD is much easier to solve. Another interesting work SCADN (Yan el al. [02 tries to produce negative samples by multi-scale striped masks to train a GAN, but its anomaly score still relies on reconstruction error and the production of masks has randomness or may be hard to determine in various real scenarios. Our PLAD learns perturbations adaptively from the data itself, which convenient and reliable.
Experiment
In this section, evaluate the proposed method in comparison to several state-of the-art art anomaly detection methods on two image datasets and two tabular datasets. Note that all the compared methods do not utilize any pre-trained feature extractors.
4.1 Datasets and baseline methods
Datasets description
CIFAR-10:
CIFAR-10 image dataset is composed of 60,000 images in total, where 50,000 samples for training and 10,000 samples for test. It includes 10 different balanced classes.
Fashion-MNIST: Fashion MNIST contains 10 different categories of grey-scale fashion style objects. The data is split into 60,000 images for training and 10,000 images for test.
Thyroid: Thyroid is hypothyroid disease dataset that contains 3.772 samples with 3 classes and attributes. We follow the data split settings of [Zong el al. 2018 to preprocess the data for one-class classification task.
Arrhythmial Arrhythmia dataset consists of 452 samples with 274 attributes. Here we also follow the data split settings of Zong et al. 2018 to preprocess the data.
The detailed information of each dataset is illustrated in Table
5

---

Table 1: Details of the datasets used in our experiments.
Dataset name
Type
# Total samples
# Dimension
CIFAR-10 10 Fashion- MNNIST
Image
60,000
32x32x3
Image
70,000
28x28
Thyroid
Tabular
3,772
6
Arrhythmia
Tabular
452
274
Baselines and state-of-the-arts. We compare our method with the following classical baseline
methods and state-of-the-ard methods: OCSVM (Schölkopt al. 2001], isolation forest (IF) [Liu el
al. 2008)] local outlier factor (LOF) [Breunig et 2000) denoising auto-encoder (DAE) [iicent
al. 2008), E2E-AE and DAGMM [Zong al. [018]]0088, DCN [Caron et al. 2018). ADGAN ADGAN [Deckke
et al. 2018), DSVDD [Ruff et al. 2018). OCGAN [Perera et al. 20191, TQM [Wang et al.
2019]]
GOAD Bergman and Hoshen 2020 DROCC [Goyal al.) [d.[20200 HRN-L2 and HRN [Hu al
2020].
SCADN Yan et al. 2022 12 IGD (Scratch) [Chen et al. 2022
NeuTraL AD [Qiu et al. 2021
and GOCC [Shenkar and Wolf 2022
4.2
Implementation details and evaluation metries
In this section, we first describe the implementation details of the proposed PLAD method. The settings for image and tabular datasets are illustrated as follows:
Image datasets. For image datasets (CIFAR-10 and -NNIST, we utilize the LeNet-based CNN to construct the classifier, which is same as [Ruff et al. 2018) and [Goyal et al. 2020 to provide fair comparison. And we apply the MLP-based VAE learn the noise for data. Since both image datasets contain 10 different classes, it can be regarded as 10 independent one-class classification tasks, and each task on CIFAR-10 has 5,000 training samples (6,000 for Fashion- MNIST) and 10,000 testing samples for both of them. Consequently, the choice of optimizer (from Adam [Kingma and Ba 2015) and SGD), learning rate and hyper-parameter for different classes. The suggested settings of them on each experiment in this paper refer to Appendix A
could be varies
Tabular datasets. For tabular datasets (Thyroid and Arrhythmia), we both use the MLP-based classifier and VAE practice, and we train them by Adam optimizer with learning rate 0.001. Besides, À is set to 3 for Thyroid and 2 for Arrhythmia.
For the compared methods in the experiment, we report their performance directly from the following paper [Hu el al. 2020) Goyal et al.) 2020 Yan al.) 202T, Qiu et al.) 2021 Chen et al.) 2022
Shenkar and Wolf [022] except for DROCC, which we run the official released code to obtain the
results, Due to the limitation of paper length, the details of the our network settings are provided in Appendix
Regarding the evaluation metries, we follow the previous works such as [Ruff et al. 2018 and Zong er to use AUC (Area Under the ROC curve) for image datasets and FI FI-score for tabular datasets because the anomaly detection for image and tabular datasets has different evaluation criteria. Moreover, our method does not need pre-training like (Ruff et al. 2018) and others did, so we train the proposed method 5 times with 100 epochs obtain average performance and standard deviation. Note that we run all experiments on NVIDIA RTX3080 GPU with 32GB RAM, CUDA 11.0 and cuDNN 8.0.
4.3 Experimental results image datasets
Table 2 and Table summariiz the average AUCs performance of the one-class classification tasks on CIFAR-I0 and Fashion-MNIST, where we have the following observations:
Compared with some classical shallow model-based approaches such OCSVM and IF, the proposed PLAD method significantly outperforms them on each one-class classification task with large margin. This is mainly due the powerful feature learning capability of deep neural network.

---

Table 2: Average AUCs (%) in one-class anomaly detection on CIFAR-10, Note that for the compared methods we only report their mean performance, while we further report the standard deviation for the proposed method. denotes we run the officially released code to obtain the results, In each case, the best two results are marked in bold.
Auto mobile
Normal Class
Airplane
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
OCSVM SSchölkoff ef al. 2001
61.6
63.8
50.0
55.9
66.0
62.4
74.7
62.6
74,9
75.9
IF [Läu al.
66.
43.7
64.3
50.5
74.3
52.3
70.7
53.0
69.1
53.2
DAE Vineent al.
2008
41.1
47.8
61.6
56.2
72.8
51.3
68.8
49.7
48.7
37.8
DAGRM
Zong el al 2018
41.4
57.1
53.8
51.2
52.2
49.3
64.9
55.3
51.9
54.2
ADGAN
Deecke
2018
63.2
52.9
58.0
60.6
60.7
65.9
61.1
63.0
74.4
64.2
DSVDD
Ruff el al. 20
61.7
65.9
50.8
59.1
60.9
65.7
67.7
67.3
75.9
73.1
OCGAN
Perera al.
2019
75.7
53.1
64.0
62.0
72.3
62.0
72.3
57.5
82.0
55.4
TQM
Wang et at. 2019 2019
40.7
53.1
41.7
58.2
39.2
62.6
55.1
63.1
48.6
58.7
DROC
Goyal cl at 2020
79.2
74.9
68.3
62.3
70.3
66.1
68.1
71.3
62.3
76,6
HRN-1.2
Hu el ol. 2020
80.6
48.2
64.9
57.4
73.3
61.0
74.1
55.5
79.9
71.6
HRN
Hu el ol. 2020
77.3
69.9
60.6
64,4
71.5
67.4
77.4
64.9
82.5
77.3
82.5
80.8
68.8
65.2
71.6
71,2
76.4
73.5
80.6
80.5
PLAD
(0.4)
(0.9)
(1.2)
(1.2)
(1.1)
(1.6)
(1.9)
(1.0)
(1.8)
(1.3)
Table 3: Average AUCs (%) and in one-class anomaly detection on Fashion-MNIST. Note that for the compared methods we only report their mean performance, while we further report the standard deviation for the proposed method. denotes run the officially released code to obtain the results. In each case, the best two results are marked in bold.
Ankle boot
Normal Class
T-shirt Trouser Pullover Dress Coat Sandal Shirt Sneaker Bag
OCSVM Schölkopf et al. 2001
86.1
93.9
85.6
85.9
84.6
81.3
78.6
97.6
79.5
97.8
IF [Liu et al 2008
91.0
97.8
87.2
93.2
90.5
93.0
80.2
98.2
88.7
95.4
DAEIVincem
at 2008
86.7
97.8
80.8
91.4
86.5
92.1
73.8
97.7
78.2
96.3
DAGMM
Zong ei at. 2018
42.1
55.1
50.4
57.0 26.9
70.5
48.3
83.5
49.9
34.0
ADGAN Deecke el di 12018
89.9
81.9
87.6
91.2 86.5
89.6
74.3
97.2
89.0
97.1
DSVDD
Ruff
2018
79.1
94.0
83.0
82.9 87.0
80.3
74.9
94.2
79.1 93,2
OCGAN
Perera di. 2019
85.5
93.4
85.0
88.1 85.8
88.5
77.5
93.9
82.7 97.8
TQM Waang at. 2019
92.2
95.8
89.9
93.0
92.2
89.4
84.4
98.0
94.5 98.3
DROCC
Goyal él 2020
88.1
97.7
87.6
87.7 87.2
91.0
77.1
95.3
82.7 95.9
HRN--22
Flu et al. 2020
91.5
97.6
88.2
92.7
91.0
71.9
79.4
98.9
90.8
98.9
HRN
(Hu eT at. 2020
92.7
98.5
88.5
93.1
92.1
91.3
79.8
99.0
94.6 98.8
93.1
98.6
90.2
93.7
92.8
96.0
82.0
98.6
90.9 99.1
PLAD
(0.5)
(0.2)
(0.7)
(0.6)
(0.8)
(0.4)
(0.6)
(0.3)
(1.0)
(0.1)
PLAD also explicitly outperforms several well-known deep anomaly detection methods such as DAGMM and DSVDD, and consistently obtains the top two AUC scores on most classes of CIFAR-10 and Fashion-MNIST compared to some latest methods such as TQM, DROCC and HRN. Specifically, on the class "Automobile" of CIFAR-I0 and class "Sandal" of Fashion-MNIST, the AUC improvements of the proposed method exceed 5.9% and 4.7% respectively compared to the runner-up. We also conduct statistical analysis for our method against other competitors, the detailed analysis refers to Section 4.6
is noteworthy that some deep anomaly detection methods such DSVDD and DROCC, are mainly based on the assumption that the normal data in the embedding space are situated in hyper-sphere, while anomalies are outside the sphere. Therefore the edge of the hyper-sphere is then the decision boundary learned by the model to identify anomalies. In contrast, PLAD does not require any assumption about the shape of the decision boundary. attempts learn the perturbation from data itself by neural network and construct the anomalies by enforcing the perturbation to original data, then train the network to distinguish the normal samples and anomalies. This is natural to relate PLAD with some adversarial learning based methods such as ADGAN and OCGAN, etc. contrast to them, the optimization of PLAD is non-adversary problem and hence is casier to solve.
7

---

(a) training v.s. perturbed
(b) training v.s. test
(c) training v.s. perturbed v.s. test
The learned embedding space visualized by t-SNE. Note the points marked in blue, orange, green, and red training samples, perturbed samples, normal test samples, and anomalous test samples, respectively. We select the class of "Sneaker" in Mushion-MNNST to provide the visualization. More results for the other categories can be found in Appendix B
Figure 2:
Table 4 shows the average performance on CIFAR-10 and Fashion-MNIn over all 10 classes to provide an overall comparison. Note that two more latest methods SCADN and IGD (Scratch) are also compared in the table, though their performance on each single class were not reported in their papers. From the table we observe that PLAD achieves the best average AUCs on both datasets among all compared methods.
Table 4: Average AUCs (%) over all 10 classes CIFAR-10 and Fashion-MNISS Note that the best two results are marked in bold.
Data set
CIFAR-10
Fashion-MNIST
OCSVM Schhölkopf al.
2001
64.7
87.0
IF [Lu 2008
59.7
91.5
DAE Vincent ef 2008
53.5
88.1
DAGMM
Zong al 2018
53.1
51.7
ADGAN Deecke at
62.4
88.4
DSVDD Kuff el at. 2018
64.8
84.7
OCGAN Perera el at 2019
65.6
87.8
TQM Wang el aL 2019
52.1
92.7
DROCC* Goval al 2020
69.9
89.0
HRN-L2 Hu al 12200
66.6
90.0
HRN [Hu et ah 2020
71.3
92.8
SCADN Yan et al 2021
66.9
IGD (Scratch) Chen el al 2022
74.3
92.0
PLAD
75.1
93.5
We use t-SNE Van der Maaten and Hinton 2008] to visualize the learned embedding features of PLAD. Specifically, we visualize the training samples of specific category, perturbed data for training samples, well as all test samples. They are divided into three sub-figures for ease of understanding. Figure[2]shone figure we have the following observations. First, PL.DD obviously learns good decision boundary for distinguishing normal data and perturbed data from Figure 2(a) Second, Figures 2(b) and 2(c) show that the normal test samples lie in the same manifold as the training samples, while the abnormal samples (abnormal test samples and perturbed samples) are relatively separated. In other words, PLAD explicitly learns a diseriminative embedding space to distinguish normal samples and anomalies. More results can be found in Appendix B
the visualization of the class "Sneaker" in Fashion-MNIST. From this
4.4 Experimental results non-image datasets
Table 5 summarizes the Fl-scores of each compared method on the Thyroid and Arrhythmia datasets. can be observed that PLAD significantly outperforms several baseline methods such as OCSVM, DAGMM, DSVDD and DROCC with large margin. Although NeuTral. AD and GOCC achieve encouraging 76.8% F1-score on Thyroid, worth mentioning that they are both methods designed for non-image data. The Arrhythmia dataset seems to be more difficult anomaly detection task

---

because of its small sample size, which is not conducive to deep learning. Surprisingly. the proposed PLAD method shows remarkable performance on Arrhythmia, which surpasses 9.2% compared to the runner-up. Moreover, the performance of PLAD is also comparable to NeuTraal. AD and GOCC on Thyroid, which fully demonstrates its applicability to the anomaly detection task for non-image data.
Table 5: Average Fl-scores (%) with the standard deviation of each method on the two tabular datasets (Thyroid and Arrhythmia). * denotes we run the official released code to obtain the results, and the best two results marked in bold.
Data set
Thyroid
Arrhythmia
OCSVM [Schölkopf et al.
2001
39,0 + 1.0
46,0 + 0.0
LOF Breunig el 2000
54.0 + 1.0
51.0 1.0
E2E-AE Zong al. 2018
13.0 + 4.0
45.0 3.0
DCN
Caron al. 2018
33.0
380
DAGMM Zong el at. 2018
49.0
49.0
DSVDD Ruff el al 2018
73.0 + 0.0
54.0
DROCC Goyal et dl
2020
68.7 + 2.3
32.3 1.311 1.8
GOAD
Bergman and Hoshen
2020
74.5 1.1
52.0 1 2.3
NeuTraL AD Quu et al. 2021
2022
76.8 + 1.9
60.3 - 1.1
GOCC Shenkar and Wolf
2022
76.8 1.2
61.8 1.8
PLAD
76.6 + 0.6
71.0 + 1.7
4.5
Experiment of separating anomaly from multi-class normal data
It should be pointed out that in real applications, the normal data may contain multiple classes without labels. We need to separate anomalies from these multi-class normal data. In this study, we randomly select 10,000 samples among the training split of CIFAR-10 Fashion-MNIIT construct new normal training set, namely, the normal data in multiple classes. Subsequently, we randomly select two samples from the test split of CIFAR- 10 Rashion-MNIST to construct 10,000 anomalous samples using the means of pair-wise samples at the pixel level. The produced anomalous samples are merged with the original test split form new test set. Compared with the previous two tasks (Sections 4.3 and 4.4), this one is much more difficult because the decision boundary between the anomalous samples and the normal samples very complicated. We run the experiment to compare our method with four baselines including OCSVM, DAGMM, DSVDD, DROCC and report the results in Tā We see that the proposed PLAD method outperforms the baselines significantly. For example, the improvement over the runner-up DSVDD are 9.1 % and 4.4% CIFAR- 10 and Fashion MNIST respectively. The success of PLAD mainly stems from the ability of learning a decision boundary adaptively without any assumption.
Table 6: AUCs (%) of the experiment of separating anomaly from multi-class normal data.
Data set
CIFAR 10
Fashion-MNIS.
OCSVM DAGMM
Schölkooff et al.
2001
54.9 + 0.0
64.8 = 0.0
Zong at. 2018
44.3 + 0.6
49.2 2.6
DSVDD
Kull et al. al. (2018
63.6 + 1.1
70.9 + 2.0
DROCC
Gooal et al. 2020
60.9 + 5.8
68.1 + 3.1
PLAD
72.7 1.9
75.3 2.8
4.6 Statistical analysis of the proposed method
To assess whether the results obtained of our method are statistically significantly different compared to others, we further conduct statistical analysis for them. Student's t-test common scheme for assessing the significance of differences between two groups of data. Usually, the difference is said to be significant the p-value obtained in the 1-test is less than 0.05. We compare with three baseline methods including DSVDD Ruff er al. 2018). DROCC [Goyal et al. 2020), and HRN (uu et al. 2020) on Fashion-MNIST. Note that we perform t-test experimental by using the results obtained from running their official released codes. Table 7 summarizes the reproduced results and the p-value

---

(t-test) of our method against other baseline methods. We can see that the reproduced results are close to that reported in the related papers [Hu er al. 2020, Goyal et al. 2020). and the t-test results of our methods are statistically significantly different (p < (1.1) from other comparative methods in most cases except for the comparison with HRN on the "Trouser" and "Dress" classes.
Table 7: The reproduced results (with *), reported results, and t-test results of the one-class anomaly detection task on Fashion-MNIST.
Reprosucee
T-shirt
Troeser
Pullover
Dross
Coal
Sandal
Shirt
Snetker
Bag
Ankle boot
DSVDD
Ruffer ol.
2015
79.1
94.0
83.0
82.9
87.0
80.3
74.9
94.2
79.1
93.2
DSVDD* Rulleral
201
78.4
936
808 1:
4:
85.9 24
750 388
94.3
80.6
94.1 1.5
2020
88.1
87.7.11
87.2
77.1 91.01.6
82.7
95.9 12
HRN
Hu
20.00
92.7 + 0.0
9.15
88.5+001
23.1+011
9-.1
913-004
7,8+0.1
990-00
946++0.1
988 0.0
HRN
Mueeral
2020
88.8 0.1
9.
0.1
0.
8.
896:0001
0.14
98.9
0,0
872
97.7 0.1
PLAD (Ouns
93.1 0.5
98.61.0.
90.2 0.
93.7
0.6
0.
96.0 0.1
820
10.100
0.6
98.6
066100 0.3
90.9 1
99.1 0.1
p-value (t-iet)
T-shirt
Trewser
Pollover
Sandal
Sneoker
Bog
Ankle
DSVDD
1. x 10-7
12x 10-4
2. 10-1 1.0 10-7
2.1 x 10-h 8.2 10-1 87 10
4.7 10-3
0.003
29 10-5
vol. DROCC
94 10-1
0.001
3.3 x 10-1
5.4 x 10-1
3.0 x 10-3 5.1 x 10-3
4.4 10-4
3.4 10-7
9.0 10-1
5.1 10-4
v.A. HRN
x 10-2 0.614
122x
0.013
x 10 3.0 x 10-10
x 5.4 10
22x 10- 1.7 10-10
4.7 Extension of PLAD to time-series anomaly detection
We further conduct experiment to demonstrate the effectiveness of PLAD on the time-series anomaly detection task, the details refer to Table 8 in Appendix G due to the limitation of the paper length.
5
Conclusion
We have presented novel method PLAD for anomaly detection. Compared with its competitors, PLAD does not require any assumption about the distribution or structure of the normal data. This is the major reason that PLAD outperforms its competitors. In addition, PLAD has fewer hyperparame- ters to determine and has a lower computation cost than many strong baselines such as (Wang el al.) 2019: Goyal et al.) [2020] Yan et al.) 2021]. J. Actually, PLAD provides us a framework for anomaly detection. Different neural networks such as CNN (Krizhevsky er al. 2012), RNN [Mikolov et al. 2010), GNN [Scarselli et al. 2008), and even transformer Vaswani et al. [017 can be embedded
into PLAD to accomplish various anomaly detection tasks such as time series anomaly detection. One limitation of our work is that we haven't 't included enough these experiments currently.
Note that in this study, we only considered the additive and multiplicative perturbations, i.e., x = x O of (x) + 93 (x). while more general perturbation can be formulated as x = d/z (xx. When we need a very sophisticated perturbator, we may not well approximate d3 (x) by x C oă (x) + og (x). because we have to made some restriction for og and of- Therefore, future study may also focus on determining the & for (1), to learn d (x) more effectively.
Acknowledgments
The work was supported by the Youth program 62106211 of the National Natural Science Foundation of China and the research funding 20012020000 of Shenzhen Research Institute of Big Data.
References
Davide Abati, Angelo Porrello, Simone Calderara, and Rita Cucchiara. Latent space autoregression for novelty detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 48 1881-990,4 2019.
Liron Bergman and Yedid Hoshen. Classification-basee anomaly detection for general data, In Proceedings of the International Conference on Learning Representations, 2020.
10

---

Arindam Bhattacharya, Sumanth Varambally, Amitabha Bagchi, and Srikanta Bedathur. Fast one- class classification using class coundary-preserven random projections. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 66-74, 2021.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density- based local outliers. In Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, pages 93-104, 2000.
Mathilde Caron, Piotr Bojanowski, Armand Joulin, and Matthijs Douze. Deep clustering for unsuper- vised learning of visual features. Proceedings of the European Conference on Computer Vision, pages 132-149, 2018.
Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey, ACM Computing Surveys (CSUR), 41(3):1-58, 2009.
Yuanhong Chen, Tian, Guansong Pang, and Gustavo Carneiro. Deep one-class classification via interpolated gaussian descriptor. In Proceedings of the AAAI Conference Artificial Intelligence, 2022.
Lucas Deecke, Robert Vandermeulen, Lukas Ruff, Stephan Mandt, and Marius Kloft. Image anomaly detection with generative adversarial networks. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 3-17. Springer, 2018.
Sarah M Erfani, Sutharshan Rajasegarar, Shanika Karunasekera, and Christopher Leckie. High- dimensional and large-scale anomaly detection using linear one-class svm with deep learning. Puttern Recognition, 58:121-134, 2016
Izhak Golan and Ran El-Yaniv, Deep anomaly detection using geometric transformations. Advances in Neural Information Processing Systems, 31, 2018.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farles Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in Neurul Information Processing Systems, 27, 2014.
Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep learning. MIT press, 2016.
Sachin Goyal, Aditi Raghunathan, Moksh Jain, Harsha Vardhan Simhadri, and Prateek Jain. Droce: Deep robust one-class classification. In Proceedings of the International Conference on Machine Learning, pages 3711-3721 PMLR, 2020.
Wenpeng Hu, Mengyu Wang, Qi Qin, Jinwen Ma, and Bing Liu. Hrn: A holistic approach to one class learning. Advances in Neural Information Processing Systems, 33:19111-19124, 2020.
Diederik Kingma and Jimmy Ba. Adam: method for stochastic optimization. In Proceedings of the International Conference on Learning Representations, 2015.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arX- iv:1312.6114 2013.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convolu- tional neural networks. Advances in Neural Information Processing Systems, 25, 2012.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. Nature, 521(7553):436 2015.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In Proceedings of the IEEE International Conference Data Mining, pages 413-422. IEEE, 2008.
Pankaj Malhotra, Anusha Ranakrishnan, Gaurangi Anand, Lovekesh Vig, Puneet Agarwal, and Gautam Shroff. Lstm-based encoder-decoder for multi-sensor anomaly detection. arXiv preprint 1XXY:16677.0048. 2016.
Tomas Mikolov, Martin Karafiát, Lukas Burget, Jan Cernocký, and Sanjeev Khudanpur. Recurrent neural network based language model. In Interspeech, volume 2, pages 1045-1048. Makuhari, 2010.

---

Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: review. ACM Computing Surveys (CSUR), 54(2):1-38, 2021.
Pramuditha Perera and Vishal M Patel. Learning deep features for one-class classification. IEEE
Transactions on Image Processing, 28(1 1):5450-5555 0-03,,44334-00000 2019.
Pramuditha Perera, Ramesh Nallapati, and Bing Xiang. Oegan: One-class novelty detection using gans with constrained latent representations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2898-2906, 2019.
Daniel Pérez-Cabo, David Jiménez-Cabello, Artur Costa-Pazo, and Roberto J López-Sastre. Deep anomaly detection for generalized face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 0-0, 2019.
Stanislav Pidhorskyi, Ranya Almohsen, and Gianfranco Doretto. Generative probabilistic novelty detection with adversarial autoencoders. Advances in Neural Information Processing Systems, 31,
2018.
Chen Qiu, Timo Pfrommer, Marius Kloft, Stephan Mandt, and Maja Rudolph. Neural transformation learning for deep anomaly detection beyond images. In Proceedings of the International Conference on Machine Learning, pages 7703-8714, PMLR, 2021.
Jayaram Raghuram, Varun Chandrasckaran, Somesh Jha, and Suman Banerjee. A general framework for detecting anomalous inputs to dnn classifiers. In Proceedings of the International Conference on Machine Learning, pages 8764-8775. PMLR, 2021.
Bharathkumar Ramachandra, Michael Jones, and Ranga Raju Vatsavai. A survey of single-scene video anomaly detection. IEEE Transactions Pattern Analysis and Machine Intelligence, 2020.
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. Proceedings of the International Conference Machine Learning, pages 4393-4402, PMLR, 2018.
Lukas Ruff, Robert A Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Klaus- Robert Müller, and Marius Kloft. Deep semi supersspe anomaly detection. Proceedings of the International Conference on Learning Representations, 2019.
Lukas Ruff. Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dietterich, and Glaus-RRbbrr Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 2021.
Franco Scarselli, Marco Gori, Ah Chung Tsoi, Markus Hagenbuchner, and Gabriele Monfardini. The graph neural network model. JEEE Transactions on Neural Networks, 20(1):61-80, 2008
Bernhard Schölkopf, Robert C Williamson, Alex Smola, John Shawe-Taylor, and John Platt. Support vector method for novelty detection. Advances in Neural Information Processing Systems, 12, 1999.
Bernhard Schölkopf, John C Platr, John Shawe-Taylor, Alex J Smola, and Robert C Williamson. Estimating the support of a high-dimensional distribution. Neural Ccomputation, 13(7):1443-1471, 2001.
Tom Shenkar and Lior Wolf. Anomaly detection for tabular data with internal contrastive learning. In Proceedings of the International Conference on Learning Representations, 2022.
Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. Robust anomaly detection for multivariate time series through stochastie recurrent neural network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2828 2837, 2019.
David MJ Tax and Robert PW Duin. Support vector data description. Machine Learning, 54(1):45-66. 2004.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research, 9(11), 2008.
12

---

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems, 30, 2017.
Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoing Manzagol. Extracting and composing robust features with denoising autoencoders. In Proceedings of the 25th International Conference Machine Learning, pages 1096-1103, 2008.
Jingjing Wang, Sun Sun, and Yaoliang Yu. Multivariate triangular quantile maps for novelty detection. Advances in Neural Information Processing Systems, 32:5060-5071, 2019.
Shaoyu Wang, Xinyu Wang, Liangpei Zhang, and Yanfei Zhong. Auto-ad: Autonomous hyperspectral anomaly detection network based on fully convolutional autoencoder. IEEE Transactions on Geoscience and Remote Sensing, 60: 60:1-14, 2021.
Xudong Yan, Huaidong Zhang, Xuemiao Xu, Xiaowei Hu, and Pheng-Ann Heng. Learning semantic context from normal samples for unsupervised anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 31 10-31118, 2021.
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dacki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In Proceedings of the International Conference on Learning Representations, 2018.
Checklist
The checklist follows the references. Please read the checklist guidelines carefully for information on how to answer these questions. For each question, change the default [TODO] to [Yes], [No] or [N/A]. You are strongly encouraged to include justification to your answer, either by referencing the appropriate section of your paper or providing a brief inline description. For example:
Did you include the license the code and datasets? [Yes] See Section.
Did you include the license to the code and datasets? [No] The code and the data are proprietary.
Did you include the license the code and datasets? [N/A]
Please do not modify the questions and only use the provided macros for your answers. Note that the
Checklist section does not count towards the page limit. your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Section 5
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as URL)? [Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e-g., with respect the random seed after running experi- ments multiple times)? [Yes]
13

---

(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes]
4. If you using existing assets (e.g., code, data, models) curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any new assets either in the supplemental material as a URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you'le 're using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information offensive content? [N/A]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "xq9myggJgS9", "reviewer": "Reviewer_ZTAh", "summary": "The authors propose an approach to semi-supervised anomaly detection. The core idea is to generate anomalous data using an adaptive perturbator, which modifies the normal data and hence, solve the problem of anomaly detection as a supervised binary classification task.  ", "questions": "What impact does the perturbation operation have on the inferred normal data distribution boundaries? \nHow is the approach related and how does it compare to self-supervision based anomaly detection methods?", "limitations": "It is not clear how the learned class of the perturbed samples can capture samples which can't be obtained by a small perturbation of the normal data class. \nThe approach hasn't been tested on time-series anomaly detection as also stated by the authors.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The idea is original and the results are promising. It would have been helpful to have the presented approach compared to self-supervised approaches to anomaly detection as these seem well related to the perturbation idea. \nThe perturbation to the original data has been chosen to be either additive or multiplicative, it is not discussed what are the limitations on the inferred boundaries of the normal data distribution given only these 2 perturbations. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "n84J0px7NY", "reviewer": "Reviewer_dTj9", "summary": "The paper presents PLAD, an anomaly detection methodology that relies on perturbations of the original data with the goal of learning to separate the perturbed data from the original, which helps in the detection of anomalies. An evaluation across multiple datasets and against multiple baseline methodologies provide evidence on the promise of PLAD.", "questions": "The idea of constructing perturbations and then learning models to separate them from the original data is interesting with good potential for the AD problem. Unfortunately, there are several concerns with this work:\n\nW1. Lack of technical novelty and depth\n\nThere is no proper introduction of relevant concepts in preliminaries. The approach reads as if it's the first work using perturbations and goes ahead and presents how the problem is solved with Equations 2/3.  No motivation, nor how these loss functions were obtained is provided. \n\nIn addition, there is a lack of technical depth. What's used in the loss function is more or less existing knowledge. Likely combined together for the first time, but unclear how this advances the area of perturbation-based learning (i.e., the paper reads as an application of such solutions to AD - heavy re-writing is needed in that direction to introduce concepts and prior work that led to PLAD).\n\nW2. Experiments used \"as is\" from other papers\n\nThe experimentation is weak. Even though many baselines are used, results are taken \"as is\" from previous papers, without detailed evaluation and tuning as the presented approach. \n\nIt's not clear if the results are statistically significantly different. A rigorous statistical analysis is desirable.\n\n", "limitations": "N/A", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\nS1. Perturbation-base learning for AD is a timely and important topic\n\nS2. Experimentation with many baselines and open datasets\n\nS3. Code is provided\n\nWeaknesses:\n\nW1. Lack of technical novelty and depth\n\nW2. Experiments used \"as is\" from other papers\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "Gmj985Zrpj", "reviewer": "Reviewer_hfVr", "summary": "This paper proposes PLAD, i.e., Perturbation Learning-based Anomaly Detection, that learns to inject noise into the normal samples to produce abnormal samples for anomaly detection. The approach has been evaluated on image data as well as tabular data, achieving promising anomaly detection (AD) results.", "questions": "It would be interesting to see how PLAD will perform on sequential data (e.g. multivariate time series anomaly detection), as also recognized by the authors. Including one or two experiments in the aspect will greatly improve the generality and application potentials of the proposed method. Even adding some discussions will help a lot.", "limitations": "The authors have properly discussed the limitations of the work in the conclusion.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n\n1. The presentation is clear. The paper offers a clear presentation with a good explanation of the methodology.\n2. Comprehensive comparisons and discussions with related works (e.g., Sec. 3).\n3. Good empirical evaluations. PLAD is evaluated on both tabular and image datasets and achieves competitive results.\n\n## Weaknesses\n1. The structure of the paper could be more compact. From my perspective, the illustrations of the learned patterns of the injected perturbation are particularly insightful and interesting, and it would be better if they (or some of them, if considering the space limit) can appear in the main text.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept