AR-Pro: Counterfactual Explanations for Anomaly Repair with Formal Properties
Authors: Xiayan Ji
Anton Xue
Eric Wong
Oleg Sokolsky
Insup Lee
Venue: NeurIPS 2024 poster (2024)
Keywords: anomaly detection
anomaly explanation
anomaly repair
diffusion model
Primary area: interpretability_and_explainability

Abstract: Anomaly detection is widely used for identifying critical errors and suspicious behaviors, but current methods lack interpretability.
We leverage common properties of existing methods and recent advances in generative models to introduce counterfactual explanations for anomaly detection.
Given an input, we generate its counterfactual as a diffusion-based repair that shows what a non-anomalous version $\textit{should have looked like}$.
A key advantage of this approach is that it enables a domain-independent formal specification of explainability desiderata, offering a unified framework for generating and evaluating explanations.
We demonstrate the effectiveness of our anomaly explainability framework, AR-Pro, on vision (MVTec, VisA) and time-series (SWaT, WADI, HAI) anomaly datasets. The code used for the experiments is accessible at: https://github.com/xjiae/arpro.

AR-Pro: Counterfactual Explanations for Anomaly Repair with Formal Properties
Xiayan Ji
Anton Xue
Eric Wong
Oleg Sokolsky Insup Lee
Department of Computer and Information Science
University of Pennsylvania Philadelphia, PA 19104
{xjiae, antonxue, wxwon,, sokolsky, sokolsk,,, leee) wtw.eeeeseeu.eenn.n..e.. edu
Abstract
Anomaly detection widely used for identifying critical errors and suspicious behaviors, but current methods lack interpretability. We leverage common prop- erties of existing methods and recent advances generative models to introduce counterfactual explanations for anomaly detection. Given an input, we generate counterfactual as a diffusion- based repair that shows what a non-anomalous version should have looked like. A key advantage of this approach is that it enables a domain- indeinndedeeede formal specification of explainability desiderata, offering a unified framework for generating and evaluating explanations. We demonstrate the effectiveness our anomaly explainability framework, AR-Pro, on vision (MVTee, VisA) and time-series (SWaT, WADI, HAD) anomaly datasets. The code used for the experiments is accessible at: https://gitii com/ xjiae/ea iijae/arpro
Introduction
Anomaly detectors measure how much their inputs deviate from an established norm, where too much deviation implies an instance that warrants closer inspection [15 52). For example, unusual network
traffic may indicate potential malicious attacks that necessitate review of security logs [6 30),
irregular sensor readings in civil engineering may suggest structural weaknesses [40, [4 [33] and
atypical financial transactions point to potential fraud [3] 47). As benign occurrence, unexpected anomalies scientific data can also lead to new insights and discoveries [25 45).
Although state-of-the-ar anomaly detectors are good at catching anomalies, they often rely on black-box models. This opacity undermines reliability: inexperienced users might over-rely on the model without understanding its rationale, while experts may not trust model predictions that are not backed by well-founded explanations. This limitation of common machine learning techniques has led growing interest in model explainability (12), particularly in domains such as medicine (50) and law 14. We refer to
and the references therein recent surveys on explainability.
While many anomaly detection methods can localize which parts of the input are anomalous, this may not be satisfactory explanation, especially when the data is complex. In medicine [20], heart sound recordings [17] and EEG brain data [5] can differ greatly between individuals: in industrial manufacturing, it can be hard to understand subtle defects PCB for inexperienced workers 773 Thus, even when the location of the anomaly is known, it may be hard to articulate why it is anomalous. In such cases, it can helpful to ask the counterfactual question: "What should a non-anomalous version look like?" For example, doctor might ask what changes in patient's chest X-ray might improve diagnostic outcomes (58). while quality assurance engineer may ask what changes would fix the defect (
Equal contribution.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Feature-wise Anomaly Score
Properties For Anomaly Repair
Input
Overall Improvement
Anomaly Detector
Similarity
Localized Improvement
Anomaly
Time-series
Detector
Non-degradation
Figure I: Overview of the AR-Pro framework. We first identify an input's 's anomalous region and then use property-guice diffusion repair it. This repair is the counterfactual anomaly explanation, where the following properties are defined with respect to a linearly decomposable anomaly detector (AD). (Overall Improvement) The repair has lower anomaly score. (Similarity) The repair should resemble the original. (Localized Improvement) The score over the repaired region should improve. (Non-degradation) The score over the non-amon con-aoomalous region should not significantly worsen.
To answer such counterfactual questions, we begin with two observations. First, anomalies are commonly localized to small regions of the input [I3 38 731. Second, recent generative models, e.g., diffusion [24] models, can be trained to produce high-quality, non-anomalous examples. These observations motivate
repair anomalies generating a repair is not sufficient; we must also ensure its quality. For example, it may be undesirable for repair significantly improve the anomaly score but barely resemble the original input. T'herefore, it is important to measure the quality of repairs using formal properties.
counterfactual explanation. However, simply
However, formalizing broadly applicable properties is challenging, different domains (e.g.. vision, time series) and tasks (e.g., manufacturing, security) have unique considerations. To overcome this, we further observe that many anomaly detectors in practice 4 satisfy condition that we call linear decomposability: the overall anomaly score is an aggregation of feature-wise anomaly scores. Importantly, this is strong but common condition with which may formalize the desiderata of counterfactual explanations. Conveniently, many of these desiderata are, in fact, domain- independent. We leverage these conditions to formalize general, domain-independent framework for counterfactual anomaly explanation: we use generative model to produce a repair and then evaluate this repair with respect to the detector model.
We present an overview of our anomaly explainability framework, AR-Pro, in Figure [ While anomaly repair (21 31 70) and counterfactual explanations (56) have been explored in the literature, we are the first to study this in a unified context. summarize our contributions as follows:
We observe that many anomaly detectors satisfy linear decomposability and use this condition to define general, Nomain-indepenae lets measure explanation quality with respect to the anomaly detector, as shown in Figure
properties for counterfactual explanations. This approach
We use these properties guide diffusion models towards a high-quality repair of the anomalous input. Such a repair serves as the counterfactual explanation of the anomaly.
Our framework, AR-Pro, can produce semantically meaningful repairs that outperform ohf-the- shelf diffusion models with respect to our explainability criteria. Our vision anomaly benchmarks include MVTec [13 and VisA (73). Our time-series anomaly benchmarks include SWaT (38) HAI [54], and WADI 2
2 Overview and Formal Properties
we first observe that many anomaly detector paradigms are linearly decomposable. In- tuitively, this condition means that the overall anomaly score an aggregation feature-wist wise anomaly scores. Next, we use linear decomposability in Section 2.2 to formalize general, domain-indeependen properties of counterfactual explanations. We will use the terms counterfuctual, explanation, and repair interchangeably throughout this paper.
In Section 2.1

---

I7 Anomaly
(aa 22
Encoder
Latent
Decoder
Reconstruction
Figure 2: Reconstruction-based anomaly detection exemplifies linear decomposition. The anomalous input x E R is first reconstructed into & E R", and the ceature-wise anomaly scores are given by (1(2) [ z,12 R" for i 1...., Then, the standard l reconstruction-be based anomaly score is a linear combination the feature scores: s(x) = a1(z) + .... an (z).
2.1 Common Anomaly Detectors are Linearly Decomposable
Many anomaly detection techniques use a scoring function 8 IR" - to measure the anomalousness imput z E R" where s(x) is called the anomaly score of z. This is commonly done in two- stage process: the feature-wise anomaly scores 01 (z)..... 0₂ (z) E R are first computed and then aggregated [T5). We observe that this aggregation often satisfies the following form:
R - R and regularizer 3 IR" + R linearly decomposes the anomaly score 8 IR" + R if for all x ER:
Definition 2.1 (Linear Decomposition). The feature-wise anomaly scores
<xx) = =1(2)) +... on (x)
+ B(x).
While linear decomposabilityy appears to be strong assumption, it common in practice. We show number examples below, where we also flcxibly refer to a R" - IR" as the feature scores.
Example 2.2. reconstruction based anomaly detection 8 29 the input æ is passed through an encoder-decoder architecture to generate reconstruction T. The motivation is that it should be harder to reconstruct -itt----istriuttionn (anomalous) inputs. Empirically, it observed that if is anomalous, then å will have large reconstruction error when feature is in the anomalous region, e.g., a pixel the defect area of a manufacturing artifact image. A typical example of such an anomaly score is:
sxx = |21 x1
f&n - xn
which is also known as the e² reconstruction error. This lets define the feature- wist anomaly scores by a; (z(x) = [ 2212, and we illustrate this example in Figure
Example 2.3. maximum likelihood based anomaly detection [5], one measures the likelihood of test input with respect distribution (anomalous) x should be unlikely with respect to the non-anomalous training examples and will thus have lower likelihood. In variants such normalizing flow-based anomaly detection for images [66]. it is common to define a joint probability distribution over all the features:
of non-anomalous training examples. Intuitively, out-of-
sz) - log P1 (1 + log p.. (z) + log/det J=))]]
where pı (r),.... (x) are the probabilities of each feature that lets us define (; = log (x)), while the change-of -o-rraabl- Jacobian det. J(x)] may be viewed regularization term.
Example 2.4. In language modeling [61], it common measure the anomaly of token sequence based on the likelihood of each token (7). Although similar to the vision case, the standard formulation for language models different: given token sequence Fi,...,fI, {1..... vocab_size) its measure of unlikeliness (anomalousness) may be defined as:
1 (log + log.p(z22am) (m)) + log p(xx 21, x2)
(x) = -
log plg ,,. 1)],
where p is a probabilistic generative model, and so a (w) = - (1/n) log p(1; /z....., T;-1) 1). This is also known preplexity measure, which has been used to detect jailbreaks against LLMs [64].
Beyond the above examples, anomaly detectors for time-series data 29 60
63
and text 35 also
commonly use this convention. We further remark that the feature-wise anomaly scores a are related to feature attribution scores in explainability literature 33 55).

---

2.2 Formal Properties for Counterfactual Explanations
We now present the formal properties of counterfactual explanations. We will assume given anomaly score function that is linearly decomposed by the feature- score function a and regularizer B. Given some imput z, it is common to convert a(x)) R" into a binary-valued vector w(x) E {0. 1)"
to classify which input feature is anomalous, and this is commonly done by a threshold:
(xx) = (a) 2 7,....,a,(2 2 Tn); for some feature-wise threshold R
A binarization of the feature- scores suggests the need for region-specific anomaly scores, which we implement with the following indexing scheme on s(x):
$2 (x) = (xx) + Σ (x(x), for all E [0,
Then, the anomalous and non-anomalous regions have scores (2) and Sa(z) (z), respectively, where (z) 1---- (xx denotes non-anomalous region. We next enumerate some common desiderata of counterfactual explanations, where we will refer to the anomalous input as Zbad and the repaired version as 2fix.
Property (Overall Improvement): The anomaly score should improve. Because a "repaired" version should fix the anomaly by definition, one would reasonably expect that:
s s(xix) s(Dbad).
(P1)
Property 2 (Similarity): The repair should resemble the original. When s is generated by complex machine-learning model, may be the case that it has value Ifi where s(fff)) & ((haad). but Tix and Tbad bear little resemblance. In the case of vision models, Tfx may even resemble static noise, Such extreme dissimilarities between Zfix and Tbad are desirable because user cannot be expected to feasibly interpret this information. Thus, we desire a similarity condition as:
33 (Tbad) @ Tbad R ((badd) @ Tfox
(P2)
where @ denotes element-wiss vector multiplication. This similarity condition states that the non- anomalous regions of the original and the repair, as given by (F should remain similar.
Property 3 (Localized Improvement): The anomalous region should improve. However, PI and P2 are not sufficient. For example, one might have s(xnx) < s(xbad), but have higher score the anomalous region (Tbad). This is not desirable because it means that Uix has not actually fixed the anomalous region of Tbad- To ensure progress, would like:
(w( (IFxx) (u(()ma)) (Tbad)
(P3)
Property 4 (Non-degradation): The non-anomalous region should not significantly worsen. Even when the above properties are satisfied, it is possible that the proposed repair could inadvertently increase the anomaly score the con-anomalous region T7 ((bbad). This would mean repairing the anomalous region at the cost of corrupting the non-anomalous parts. We thus state the property against this as follows, where 84 > 0 is given tolerance threshold:
(Ifxx S Sw())))) (Ibad) 54-
(P4)
The benefit of our above formulation is that it encapsulates general, domain-independer desiderata of anomaly repairs. Importantly, this achieved under the mild assumption linearly decomposable anomaly detector. We comment that some overlap among our proposed formal properties may arise in certain scenarios, and alternative sets could be more tailored for specific applications. Our goal, however, is to provide foundational set of properties that ensures broad applicability, allowing further customization to suit individual application needs.
Property-guides Generation of Counterfactual Explanations
We now outline the process of conducting a property-guided repair for an anomalous input. In Section 3.1 we first introduce the generalized setup, where we define the four previously outlined properties as objective functions and frame the problem using risk-constrained optimization. Although this formulation clarifies the objectives, it is generally intractable. Therefore, Section 3.2 we propose ieffuusion-based algorithm to approximate the solution and achieve high-quality repairs.

---

Denoising Property-taeal Guidance Maaked In-filling
X
X
X
Xass
Figure 3: We run soppert-gguided diffusion with masked in-filling.
3.1 A Generalized Formulation with Properties Loss Functions
We first present a generalized setup for generating repairs. We conceptualize this in terms of repair model Ra parametrized by anomaly score function 8 IR R with known linear decompositions a, 3 and a feature-wise binarization w. To generate a repair, we sample the model:
Ffix ~ (Tbad):
where probabilistic formulation is relevant in the context of variational auto-encoders 27 or diffusion models (44). However, it is important that Zii obeys the formal properties as outlined in Section 2.2
To do this, we cast these properties as loss functions listed below:
L1 s (Iiik)
P
loss)
L2 = (Ibad @ (Jifix - Wbad)lla
P2
loss)
L3 = max 0, (w)mma) (DIk) - s (w( (Ibad)
P3 Loss)
L = max {0, (w) (fik)) (tond) (Fbad) - 5g
P4 loss)
Our rationale is as follows. First, because the primary objective of anomaly repair to reduce the anomaly score, we set Lı simply the score of Zfix. Second, we would like to ensure that Tfi and Thad are similar in the non-anomalous region, and so formulate L2 as the E² distance between Ifx and Tbad over (Kbad). Third, we formulate L3 to apply penalty when the anomalous region degrades in performance. Fourth, we allow for degradation of score in the non-anomalous region w (bad)) ) up to some tolerance threshold d1. We cast these constrontt optimization problem follows:
minimize 0
E Tis R. (Mruudi)))
s(xfxx
subject to Aie R.... (1
IP
L2 5 82, La 5 0, L4 50 2 -
where 0 is a parameter of the repair model, &g > 0 is a given threshold for L2 and 5 > 0 is given failure probability for the violation of at least one of (P2). P3). or (P4). We acknowledge that multiple formulations for property-based losses are valid; however, the chosen approach is optimally suited to our context.
3.2 Formal Property-guides Diffusion
We adopt techniques from guided diffusion 19 to generate repairs Tix. We first give a brief overview of a standard diffusion process and then adapt to perform property-guides generation. We refer to 622 for a comprehensive guide on diffusion but attempt to make the exposition self-contained.
Background. A basic variant of diffusion models takes the form:
p(x=-1laz) N (No 1, for 1 = T 1,
where μ4 is the denoising model with parameters 6, and by < < by the variance schedule. When H4 is trained on non-anomalous data (see [62] for training details), one can generate con-anomalous samples of the training distribution by running the following iterative process:
FT (O, T), It-1 = po( f) + byzt,
2, ~ ~ T), for t ,,
where Fy is the initial noise and Zo is the output sample. The idea is to repeatedly remove noise from a Gaussian IT using (ág until the final in resembles a high-resolution image without defects, for instance. The iterations (3) is also known backward process.
Property-guided Diffusion. We next show how to adapt the denoising iterations 33) to produce repairs. We use two main ideas: first, we guidance [19] to slightly nudge the iterates 2;-1 of
5

---

at every step using a property- based loss, to encourage that the final iterate 2g. which we take to be Tfxx more amenable to our properties. Second. we used masked-infiliing [39] to ensure that the non-anomalous region (TTaad) is generally preserved by the iterates. We implement this modified
iteration as follows: beginning from the initial noise Tix,T (O, I), let:
Tfx,t-1 po (.fiii 1) + 212t
~ NOO, I),
(4)
Denoising step
Guidance term
bbad, /atebad + vI aett ~0 (0,
(5)
-fx = (Tbad) @ Tbad, + ((bbad) O ffi
(6)
for t = ......... 1, where a₁ = -ITi=a bb) and 171 < ... < or is the guidance schedule. The property- based loss is given by:
L(z(ixt) = XLL1 + A2L2 + Az43 + M4hs,
with L1. L2, L3, Lu as in Section 3.1 and weights A2, Ag. X4 > 0. In the above, 4 first generates ffx,t-1 from 7fix,t by combining standard denoising step with guidance term. Then, 6 combines ffx,t-1 with tb from (5), in masked-infilling operation (39] to yield I- This masked in-filling ensures similarity between Whad and Tfi (i.e., (fxx,o) over the non-anomalous region (aaad))
We emphasize that the diffusion iterations given by (5) 66 and do not guarantee the satisfaction of our formal properties. Rather, these iterations tend toward an output that better respects these properties as we later shown in our experiments. In particular, our property- -based losses define way to evaluate the quality to which each property is satisfied or violated.
4 Experiments
Our experiments evaluate the performance of AR-Pro across vision and time-series datasets. In particular, we aim to address the following research questions:
(RQ1) Empirical Validation: How well does AR-Pro repair anomalies for different domains? In particular, we investigate how well the four properties are satisfied when the diffusion process is guided unguided, in the baseline.
(RQ2) Ablation Study: How do the different lypee--arameters affect the repair quality? We focus on the weights X1, >2, As X4 for the four property- losses.
Vision Anomaly Models and Datasets. For anomaly detectors, we used the anomalib 4 implemen- tation of Fastflow (66) (with ResNet-50-2 backbone (68) and Efficient-AD [T]. For datasets, we
used the VisA 773 and MVTec-AD (13] datasets. VisA and MVTec-AD involve anomaly detection in the context of industrial manufacturing, where VisA consists of 12 image classes, and MVTec-AD
consists of 15 image classes. Both FastFlow and Efficient-AD were trained with AdamW and
learning rate of 10 until convergence.
Time-series Anomaly Datasets and Models. For anomaly detectors, used the GPT-2 48 and Llama2 [59] architectures for time-series anomaly detection. In particular, we use only the first 6 layers of GPT-2 and the first 4 layers of Llama-2 (with embedding dimension of 1024) to accelerate training. For datasets, we used the SWaT (51 features) [38), HAI (86 features) [54], and WADI (127
features) 2 datasets, split into sliding windows of size 100. Both our versions of GPT-2 and Ilama-2 were trained with Adam and a learning rate of 10-5 until convergence.
Diffusion-based Repair Models. We used the HuggingFace implementation of DDPM 24 for vision data and Diffusion-TS (67 for time-series data. Both models were trained on the mon-anomalous instances of their respective datasets using AdamW and learning rate of 10- until convergence.
Evaluation Metries. We use the four property-banee based loss functions defined in Section 3.1 as our evaluation metrics. In particular, we measure the improvement of property -guided diffusion over un-guided diffusion. We adapt these metrics below, where we write w to mean ((baad) for brevity:
Property (Overall Improvement); M, = s(xfx).
Property (Similarity): Ma = || O (œfx - xbadd 1|2
Property (Localized Improvement): M.. = sw (IRx) sw (Xbad)
Property 4 (Non-degradattion): M,,- = (x(xx) S (xbad)

---

Class
M,(1)
M,N0
My(ll
Baseline
Guided
Boselino
Guided
Baseline
Guided
Baseline
Guided
cundle
25.39 = 1.23
-2,43
2 0.14
336.06
+ 44.41
8.34 4: 0.06
-ail 0.000
-0.007 = 0.000
0.55 0.00
-0.02 +: 0,004
ViAA
coshew
cupsules
12.45 = 50012
-1508 + 0.85
-17.33
-17.56
0:31
0.20
426.09
907
50
4 45.30
63.73
8.43 2 0.01
8.40 0.001
-0002 0.004
0,009 0,003
-0.00 - 00001
.0.00 =: [1.00]
0.15 = 0.02
0.66 0.04
-0.00
-0.01
+ +.0000
4: 0,002
shewinggum
-14.56 + 0.59
-15.70
+ 0.14
258.33
53.66
8.41 +00.01
-0007 + 0.001
-0.00
= 0.063
0.2 m 0.02
-0.01
+ +00000
6yym
-13.54 = 3.02
-18.93
0.42
549.18
+ 12.39
1.36+00.01
0.003 0.005
-0.007 = 0.000
0.12 0.04
-0.01
+ +00003
macucoiil
19995 = 145,07
-2563
0.25
158.18
6 81.65
3.41 2:0.0
0.012 0.002
-0.005 = 0.000
0.18 = 0.02
.0.01
4 +-0004
maceroni2
-1561 11.75
22.38
0.37
530.91
4: 55.19
3.41 2:001
0,004 0,003
40.00 = 0.000
0.11 = 0.02
.0.01
4 4-0002
pohi
-23.49 0.44
-2504
1:08
525
54
+ 50.80
8.38 8.38++0.01
20005 0.006
-0.00 - 0.06%
0.6 - 0.00
40.01 +00004
pek2
-1820 + 0.67
-19.15
0.12
280
54
+ 48.3
8.41 +.001
20005 0.001
-0.005 - 0.001
0.3 0.02
-0.01 +0000
peld
-1887 4.29
-24.19
+ 0.15
201
16
+ 50.72
3.41 +.0.1
2000 0.004
-0.005
= 0.002
0,5 0.04
-0.01
+0000
pel4
251 23.68
-21.24
0.00
537.13
+ 75.48
3.43 0:0.01
0,000
0.004
-0.005
= 0.000
0.12 = 0.25
40.01
4: +-003
Pipefryuu
-1508 3.83
-19.50
0.22
252.68
78.99
8:4 0.01
40000
0.006
-0,008
0.001
0.09
0.05
-0,00
0.006
A(1]
+26.54%
497.46% S
+146.42%
+114.16%
bottle
-15.77 = 0.08
-13.16
1.42
252.11
+ 41.14
8,70 1.76
20016
0.001
-0.012 = 0.001
-1.05 + 0.01
+0.05
+ 0.033
MVRe--D
cuble
copsale
-1.73 s 1.35
-12.56 = 0.33
-13.18
-15.21
0.31
0.17
206.06
105
1 48.30
$0.64
5,03 + 1.94
5,07 2 2.23
-00006 0.003
.000 0
-0.007 = 0.063
.1.00 = 0.002
0.22 0.01
0.04 = 0.01
-2.01
.1.01
4 0.006
4 0.005
1893 4 0.35
-19447
0.70
201.02
1 $2.18
4,98 1 2,04
.0014 0.005
0,014 = 0.005
0.00 = 0.02
0.01 1 0,010
gid
40.78 1: 115.98
13.75
1 0.11
556.52
1 05.32
10.01 1 1.835
0,010 0,002
0,010 = 0.002
0.17 0.02
0,00 1 0.004
lazcint
-10.34 = 0.23
-12.84
0.21
127.33
+ $2.05
5,07 + 1.98
2000 0.004
.0.11 = 0.004
0.09 = 0.01
48.02 + 0.005
kutties
-1281 = 0.34
-13.55
0.08
254.22
+ 75.46
10.01 + 1.30
20013 0
-0.014 = 0.002
0.2 = 0.01
+8.02 + 0.005
metal mit
8854 21 1134
-11.05
0.33
214.22 à 104.32
5.71 2:774
40III 0.004
-0.007 = 0.002
0.7 = 0102
40.02 1 0.033
pill
10.90 4: 0.08
-11.11
2 0.17
242.05
4: 20.04
10.38 0.7.9
-0006 0.001
000007 = 0.00]
0.11 = 0.01
02,02 1: 0.001
-11.28 + 0.78
-13.10
0.00
432
16 + 10
10.16 + 1.49
20001 0.001
-0.00 - 0.001
0,8 - 0.01
-8.00 + 0.000
iic
-1125 0:44
-12.18
+ 0.57
425.23 + 44.34
9.91
+ 1.03
20012 0
-0.05= = 0.004
0.04 0.01
-0.03 + 0.006
bothboudh
0.30
-8.33
+ 0.05
151 + 25.94
9.27
+ 1.77
200122 0
-0.009 = 0.002
0,5 = 0.00
-8.03 +: 0.003
Imasisttrr
-1215 0055::000
-12.64
2 5.51
278.70
2 69.53
7.27
1.83
-00I 0
-1.007 = 0.00]
0,2 0.01
40.01
4: 0.002
uned
-965 + 2.20
-13.54
0.36
$44.9
+ 67 58
10.17
+ 1.75
20013
0.001
-0,019 - 0.001
0.3 0.00
-0.00
+ 0.005
ripper
-1262- + 0.19
-13.24
0.05
514.35
34.11
10.10
1.27
20009
0.001
-0.009
0.001
+0.00 0:00
-0.03
0.002
+8.35%
+97.4%%
25.15%
+154.66%
Table 1: PR-Pro outperforms non-guided diffusion baseline across four metrics. We show the results for all VisA and MVTec-AD categories, where A is the median percentage improvement.
Each experiment employs a representative anomaly detector and dataset with predefined train-test splits. The performance of the anomaly detectors is detailed in Appendix [ For w, each feature-wise threshold T3 is taken to be the 90% quantile of the training set's feature-wise wise anomaly scores.
4.1 (RQ1) Empirical Validation
We now evaluate the performance of AR-Pro for generating anomaly repairs with respect to the four evaluation metrics. We report the mean and standard deviation values. Because there may be large range of values across classes, we report the median improvement (A) of the guided generation over the baseline. We present results for the FastFlow anomaly detector on the VisA and MV'Tec dataset in Table and refer to Appendix([foo for additional results with Efficient-AD.
Quantitative Results. For all the categories, the guided results show significant improvement over the baseline on the formal criteria, with an average improvement of 84.27%. There is wide range of M, values for baseline models in certain classes, possibly due to deviations in the color scheme of the generated images from their training distribution. Hence, we report the median improvement across the classes in the last row to mitigate the impact of outliers.
We show results for time-series data in Table 2 AR-Pro achieves lower error Ma, Ma. and My. with an overall improvement of 60.03% over the baseline. Specifically, Llama-2 achieves an average improvement of 67.17% in formal metrics, while GPT-2 increases by 53.90% on average. Compared to image data, the performance on Ma is not as competitive and exhibits considerable variability, likely due to the broader range of adjustments required for repairs to ensure smooth signals.
In addition, we evaluate whether the guided repairs generate non-anomalous samples by comparing them against a conformity threshold with 95% confidence derived from the training set [9] Treating the non-anomalous class as the negative, we report the True Negative Rate (TNR) in Table 3 The TNR of most VisA and MVTec-AD categories reaches 100%, surpassing the majority of baseline values. As a result, the guided repair achieves a median TNR of 100% for both VisA and MVTec, representing an average improvement of 2.50% over the baseline. Across the three time-series datasets (SWaT, HAI, and WADI), the guided repair obtains an average TNR of 95.33%, which is 92.66% higher than the baseline average of 2.67%. Overall, 99.26% of guided repairs across both domains are classified as non- con-anomalous with 95% confidence, statistically confirming the effectiveness of AR-Pro.
Qualitative Results.
We present qualitative examples here to illustrate that our method can generate semantically meaningful repairs, shown in Figure 4 for VisA and Figure 5 for MVTec-AD, For
7

---

Model
(.((1)
Ma(4)
Ma(()
M
Baseline
Guided
Baseline
Guided
Baseline
Guided
Baseline
Guided
SWaT
0.83 0.05
0.59 2: 0.04
3.05 0.61
7.25 4 2.50
0.084 0.026
-0.026 :: 0.008
0.19 0.02
0.05 0.012
Llama2
0.01
0.00
0.005
0.000
0.01
HAI
0.92 0.00
0.58 + 0.01
0.75 0.00
0.00
0.00
0.166 0.008
0.000
0.000
0.18 0.01
0.00 + 0.000
A(1)
+66.36%
+20.77%
+110.32%
+91.33%
SWaT
0.05
12.81
0.09
GPT-2
WADI
0.71
0.04
0.52 +: 0.00
34.45
+: 0.60
42.15
= 0.94
0.018 + 0.003
-0.019
+ 0.002
0.43
0.04
0.07 + 0.002
HAI
0.92 0.02
0.61 4: 0.11
3.69
9.72
5,67 18.80
0.136 0.050
-0,005 4 0.018
0.03
0.04 0.127
A(1)
-34.37%
+177.79%
+3.24%
Table 2: Comparison of baseline and guided performance across four metrics for SWaT, WADI, and
HAT dataset categories with Llama2 and GPT2 model. A is the median improvement percentage of the guided result from baseline.
Dataset
Category
Bascline TNR (1)
Guided TNR (1)
Category
Baseline TNR (1)
Guided TNR (1)
Candle
1,00
1,00
Fryum
0.66
1.00
Capsules
0.00
1.00
Pipe Fryum
1.00
1.00
Cashew
1.00
1.00
PCB
1.00
0.96
VisA
Chewinggum
1.00
1.00
PCB
1.00
1.00
Macaruni
0.11
1.00
PCB
0.90
1.00
Macaroni 2
0.52
1.00
PCB
0.18
1.00
Bottle
1,00
1.00
Grid
0.00
1.00
Cable
1,00
1.00
Hazelout
1.00
1.00
Capsule
1.00
1.00
Leather
1.00
1.00
Carpet
1.00
1.00
Metal Nut
1.00
1.00
MVTec-AD
Pill
1.00
1.00
Screw
1.00
1.00
Tile
1.00
1.00
Toothbrush
1.00
0.96
Transistor
0.56
1.00
Wood
1.00
1.00
Zipper
1.00
1.00
VisA
0.95
1.00
MVT
1.00
1.00
Overvall
SWaT
0.08
0.86
HAI
0.00
1.00
Median
WADI
0.00
1.00
Table 3: True Negative Rate (TNR) for categories in the vision (VisA, MVTec) and time-series (SWaT, HAI, and WADI) anomaly detection datasets.
example in Figure 4 we observe that for categories PCB 1, PCB 2, PCB 3, and PCB 4, the baseline fails to rigorously repair the anomaly: the orientation of the board is reversed for PCB I; unintended white marks appear on the lower left of PCB 2: the dark lines in the potentiometer change for PCB 3; and the "FC-75" label missing for PCB 4. However, by integrating formal property guidance, our approach accurately reconstructs all these details while effectively removing the anomalies. For the MVTec-AD examples, AR-Pro produces repairs that more closely resemble the original inputs compared to those generated by the baseline. This demonstrates that our method's generated repairs adhere more rigorously the formal properties.
In Figure 6 we present examples from our time-series repair, where the anomalous time segment is shaded in red. Our results demonstrate that AR-Pro generates signal that resembles the original signal better, as shown in the first two plots of Figure In addition, we recover the sensor time series non-anomalous values when the baseline fails to repair the anomaly, shown in the last two plots of Figure 6
More repair examples are available in Appendix D However, although the quality of the generated repairs has improved, we notice that this enhancement comes with a trade-off increased inference time. Further details can be found in Appendix
4.2 (RQ2) Ablation Study
We randomly sampled 100 instances to compute the mean each metric in order to evaluate the
effect of hyper-parameters \1, A2, X3, Ås associated with each property-based loss. Each line in the plots represents results obtained while keeping the other hyper-parameter at 1.0. The ablation results for the time series presented in Figure with additional plots in Appendix F
8

---

Inpus
Anomaly mask
Baseline
Guided
PCR
PCB 2
PCB
PCB
Figure 4: The original input and ground truth anomaly mask are displayed in the first two columns. The baseline method fails to preserve close similarity to the input PCB boards, as highlighted the third column. Guided vision repair examples in the fourth column address these deficiencies.
Input
Anomaly mask
Baseline
Guided
Transistor
Wood
Cable
Figure 5: MVTec repairs with AR-Pro; better resemble the original compared to the baseline.
Our observations indicate that variations in the scale of property hyperparameters do not significantly impact the formal metrics, as the range of change remains relatively small. addition, no consistent trends were observed when varying the Åι, A2, A3, X4 iyper-parameters. This suggests that our framework demonstrates robust performance, and extensive tuning may be unnecessary.
5 Related Work
Numerous techniques have been developed for anomaly detection across various domains Traditional approaches to anomaly detection include clustering 43 57 and statistical methods
34
such as ARIMA [41] and Gaussian models [52]. However, these methods often struggle with high-dimensional data. More recently, deep learning-basee anomaly detection 220 28 including au- toencoders (27] and GANs 18, can detect high-dimensional anomalies via reconstruction error. For have shown exceptional
time-series data, LSTMs 32 and transformer- performance. Additionally, diffusion models are emerging as promising tools for visual anomaly detection 42 71.. While these methods vary in strengths and are continually improving, explaining
models (60
63
69 72

---

1455
100
0000
43
Figure 6: Original input is the blue line, property guided fix is the green line, and the baseline the red line. The first image shows that the baseline generates spurious signal when there is no anomaly. The second image shows that the baseline repairs the anomaly, but not as effectively as with guidance. The last two images show instances where the baseline fails repair the anomaly.
A:
A
0.05
0.00 0.25 0.50 0.75
1.00
2.00 0.25 0.50
0.5
1000
0.00000
0.25 0.50
0.75
100
0.00 0.25 0.50
0.75 1.00
(a) Ms
(b) Ma
(c) Ma
(d) Mg
Figure 7: Varying the haper-paramettrs does significantly change M,, Ma, Ma. and Ma.
anomalies remains a challenge 10
Most current methods rely on feature importance scores or
visualizations 44 such as gradients or reconstructions [46], which often fail to provide actionable
insights. The lack of formal frameworks 665 and consistent evaluation metrics [ complicates this issue. For example, the absence formal metries leads to inconsistencies in evaluation (26), underscoring the need for more rigorous approaches and reliable criteria (37). Most similar to work is (56]. which also performs time series-specific generation of counterfactual explanations in the form of anomaly repairs but considers different set of properties and does not diffusion. Our work also focuses on generative modeling to produce counterfactual explanations in the form of anomaly repairs. For vision, the current leading paradigms diffusion models (24) and generative [33] Diffusion models are also applicable to time-series data [67], and we refer to [22 for survey other techniques.
adversarial networks
6
Discussion
The main theoretical contribution of our work is the identification of common counterfactual ex- planation desiderata for linearly decomposable anomaly detectors. While we have identified four formal properties, we acknowledge that other valid ones may also exist. Moreover, we recommend that practitioners evaluate and choose the properties necessary for the particular problem, and this is made possible by the form of our diffusion guidance function in (7). The quality of anomaly repairs depends on the performance of the anomaly detector and the generative model. While there may have been limitations in our efforts, we found it challenging to use variational auto-encoders [27] for generating high-quality repairs. Furthermore, our implementation is focused on diffusion models, but the ideas presented can also be extended to other generative techniques.
7 Conclusion
We present AR-Pro, a framework for generating and evaluating counterfactual explanations in anomaly detection. We use the fact that common anomaly detectors are linearly decomposable, which lets us define formal, general, domainnindependent properties for explainability. Using these properties, show how generate high-quality counterfactuals using property-guidee diffusion setup. We demonstrate the effectiveness of AR-Pro on vision and time-series datasets and showcase our improvement over off-the-shelf diffusion models.
ckknoweedeement This work was supported in part by ARO MURI W91 1F200000000 NSF- 21 2125561, and NSF-2143274.
10

---

References
[1] C. Agarwal, S. Krishna, E. Saxena, M. Pawelezyk, N. Johnson, I. Puri, M. Zitnik, and H. Lakkaraju. Openxai: Towards transparent evaluation of model explanations. Advances in Neural Information Processing Systems, 35:15784-15799, 2022.
[2] C. M. Ahmed, V. R. Palleti, and A. Mathur. Wadi: a water distribution testbed for research in the design of secure cyber physical systems. In Proceedings of the 3rd international workshop on cyber-physical systems for smart water networks, pages 25-28, 2017.
[3] M. Ahmed, A. N. Mahmood, and M. R. Islam. A survey of anomaly detection techniques in financial domain. Future Generation Computer Systems, 55:278-2883 2016.
[4] S. Akcay, D. Ameln, A. Vaidya, B. Lakshmanan, N. Ahuja, and U. Genc. Anomalib: A deep learning library for anomaly detection. In 2022 IEEE International Conference on Image Processing (ICIP), pages 17100 IEEE, 2022.
[5] N. Alahmadi, S. A. Evdokimov, Y. Kropotov, A. M. Müller, and Jäncke. Different resting state eeg features in children from switzerland and saudi arabia. Frontiers in human neuroscience, 10:559, 2016.
[6] A. L. Alfeo and M. G. Cimino. Counterfactual--ased feature importance for explainable regression of manufacturing production quality measure. In ICPRAM, pages 48-56, 2024.
[7] G. Alon and M. Kamfonas. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308. 14132, 2023.
[8] J. An and S. Cho. Variational autoencoder based anomaly detection using reconstruction probability. Special lecture on IE, 2(1):1-18, 2015.
[9] A. N. Angelopoulos and S. Bates. A gentle introduction to conformal prediction and distribution- free uncertainty quantification. arXiv preprint arXiv:2107.07511, 2021.
[10] L. Antwarg, R. M. Miller, B. Shapira, and L. Rokach. Explaining anomalies detected by autoencoders using shapley additive explanations. Expert systems with applications, 186:115733 2021.
[11] K. Batzner, L. Heckler, and König. Efficientad: Accurate visual anomaly detection millseccod-levell latencies. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 128-138, 2024.
[12] V. Belle and I. Papantonis. Principles and practice of explainable machine learning. Frontiers in big Data, 4:688969, 2021.
[13] P. Bergmann, M. Fauser, D. Sattlegger, and C. Steger. Mvtec ad-a comprehensive real-worke dataset for unsupervised anomaly detection. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9592-96000 2019.
[14] A. Bibal, M. Lognoul, A. De Streel, and B. Frénay. Legal requirements on explainability in machine learning. Artificial Intelligence and Law, 29:149-169, 2021.
[15] V. Chandola, A. Banerjee, and Kumar. Anomaly detection: survey. ACM computing surveys (CSUR), 41(3:11-58 2009.
[16] Z. Chen, G. Xu, V. Mahalingam, L. Ge, J. Nguyen, W. Yu, and C. Lu. A cloud computing based network monitoring and threat detection system for critical infrastructures. Big Data Research, 3:10-23, 2016.
[17] G. D. Clifford, C. Liu, B. Moody, D. Springer, Silva, Q. Li, and R. G. Mark. Classification of normal/abnormal heart sound recordings: The physionet/computing in cardiology challenge 2016. In 2016 Computing in cardiology conference (CinC), pages 612. IEEE, 2016.
[18] A. Creswell, T. White, V. Dumoulin, K. Arulkumaran, B. Sengupta, and A. A. Bharath. Gen- erative adversarial networks: An overview. IEEE signal processing magazine, 35(1):33-65, 2018.
11

---

[19] P. Dhariwal and A. Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 1188780-8794 2021.
[20] T. Fernando, H. Gammulle, S. Denman, S. Sridharan, and C. Fookes. Deep learning for medical anomaly detection-4 survey. ACM Computing Surveys (CSUR), 54(7):1-37 37, 2021.
[21] A. Filos, P. Tigkas, R. McAllister, N. Rhinchart, S. Levine, and Y. Gal. Can autonomous vehicles identify, recover from, and adapt to distribution shifts? In International Conference on Machine Learning, pages 3145-3153. PMLR, 2020.
[22] Gatta, F. Giampaolo, E. Prezioso, G. Mei, S. Cuomo, and Piccialli. Neural networks generative models for time series. Journal of King Saud Snnveesitt--omppute and Information Sciences, 34(10):920-7733) 2022.
[23] I. Goodfellow, J. Pouget-Abadic M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial networks. Communications of the ACM, 63(1 63(11):1391144 2020.
[24] J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840 33:6840-6851, 2020.
[25] A. Høst-Madsen, E. Sabeti, and C. Walton. Data discovery and anomaly detection using atypicality: Theory. IEEE Transactions Information Theory, 550)):530- 2019.
[26] Jiang, F. Leofante, A. Rago, and Toni. Formalising the robustness of counterfactual expla- nations for neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, 2023.
[27] D. P. Kingma and M. Welling. Auto-encoding variational bayes. arXiv preprint arXiv: 131.61131 2013.
[28] D. Kwon, H. Kim, J. Kim, S. C. Suh, I. Kim, and K. J. Kim. A survey of deep learning-base bbasdd network anomaly detection. Cluster Computing, 22:949-9661 96199996,12200 2019.
[29] C.-Y. Lai, F.K. Sun, Z. Gao, H. Lang, and D. S. Boning. Nominality score conditioned time series anomaly detection by point/sequential reconstruction. arXiv preprint arXiv:2310. 15416, 2023.
[30] X. A. Larviva-Novo, M. cybersecurity data set characteristics for their applicability to neural networks algorithms detecting cybersecurity anomalies. IEEE Access, 8:9005-9014 2020.
V. A. Villagrá, and M. S. Rodrigo. Evaluation of
[31] V. Lin, K. Jang, Dutta, M. Caprio. O. Sokolsky, and I. Lee. De4l: Distribution shift recovery via data-driven control for deep learning models. In 6th Annual Learning for Dynamics & Control Conference, pages 1526-1538. PMLR, 2024.
[32] B. Lindemann, B. Maschler, N. Sahlab, and M. Weyrich. A survey on anomaly detection for technical systems using 1stm networks. Computers in Industry, 131:103498, 2021.
[33] S. M. Lundberg and S.-I. Lee. A unified approach interpreting model predictions. Advances in neural information processing systems, 30, 2017.
[34] C. Manikopoulos and S. Papavassiliou. Network intrusion and fault detection: statistical anomaly approach. IEEE Communications Magazine, 40(10):76-88 82766-82277 2002.
[35] A. Manolache, F. Brad, and E. Burceanu. Date: Detecting anomalies in text via self-supervision of transformers. arXiv preprint 21X 2021.
[36] R. Mareinkevičs and E. Vogt. Interpretable and explainable machine learning: a methods- centric overview with concrete examples. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 1493,, 2023.
[37] Marques-Silva and Ignatiev. Delivering trustworthy through formal xai. In Proceedings of the AAAI Conference Artificial Intelligence, 2022.
12

---

[38] A. P. Mathur and N. O. Tippenhauer. Swat: A water treatment testbed for research and training on ics security. In 2016 international workshop on cyber-physical systems for smart water networks (CySWater), pages 31-36. IEEE, 2016.
[39] C. Meng. Y. He, Y. Song, J. Song, J. Wu, J.-Y. Zhu, and S. Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint arXiv22108.01073 2021.
[40] A. Moallemi, A. Burrello, D. Brunelli, and L. Benini. Exploring scalable, distributed real-time anomaly detection for bridge health monitoring. IEEE Internet of Things Journal, 9(1)): 7660- 17674, 2022.
[41] H. Moayedi and M. Masnadi Shirrzii Arima model for network traffic prediction and anomaly detection. In 2008 international symposium on information technology, volume 4, pages 1 1-6. IEEE, 2008
[42] A. Mousakhan, T. Brox, and J. Tayyub. Anomaly detection with conditioned denoising diffusion models. arXiv preprint urXiv:2305.15956 2023.
[43] G. Münz, S. Li, and G. Carle. Traffic anomaly detection using k-means clustering. In Gifitg workshop mmmnnet, volume 7, 2007.
[44] M. Nauta, J. Trienes, S. Pathak, E. Nguyen, M. Peters, Y. Schmitt, J. Schlötterer, M. van Keulen, and C. Seifert. From anecdotal evidence to quantitative evaluation methods: A systematic review on evaluating explainable ai. ACM Computing Surveys, 55(13s): 2023.
[45] G. Pallotta, M. Vespe, and K. Bryan. Vessel pattern knowledge discovery from ais data: A framework for anomaly detection and route prediction. Entropy, 15(6):2218-2244 2013.
[46] G. Pang and C. Aggarwal. Toward explainable deep anomaly detection. In Proceedings of the 27th ACM SIGKDD Conference Knowledge Discovery & Data Mining, pages 4056-4055 2021.
[47] T. Pourhabibi, K.-L. Ong, B. H. Kam, and Y. L. Boo. Fraud detection: A systematic literature review of graph-based anomaly detection approaches. Decision Support Systems, 133: 13303, 2020.
[48] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 188):9 2019.
[49] D. Ramotsoela, A. Abu-Mahfouz, and G. Hancke. A survey of anomaly detection in industrial wireless sensor networks with critical water system infrastructure a case study. Sensors, 18(8):2491, 2018.
[50] M. Reyes, R. Meier, S. Pereira, C. A. Silva, F.M. Dahlweid, H. v. Tengg- R. M. Summers, and R. Wiest. On the interpretability of artificial intelligence in radiology: challenges and opportunities. Radiology: artificial intelligence, 190044 2020.
[51] M. T. Ribeiro, S. Singh, and C. Guestrin. why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pages 1135-11444 1144, 2016.
[52] P. J. Rousseeuw and M. Hubert. Anomaly detection by robust statistics. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 8(2)se 1236, 2018.
[53] K. K. Santhosh, D. P. Dogra, and P. P. Roy. Anomaly detection in road traffic using visual surveillance: A survey. ACM Computing Surveys (CSUR), 53(6):1-26, 2020.
[54] H.-K. Shin, W. Lee, J.-H. Yun, and Kim. (HAI) bas:H))lbaased) augmented (ICS) security dataset. In 13Th USENIX workshop on cyber security experimentation and test (CSET 20), 2020.
[55] K. Simonyan. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.600 2013.
13

---

[56] D. Sulem, M. Donini, M. B. Zafar, F.-X. Aubet, J. Gasthaus, T. Januschowski, S. Das, K. Ken- thapadi, and C. Archambeau. Diverse counterfactual explanations for anomaly detection in time series. arXiv preprint arXiv:2203. /1 103, 2022.
[57] I. Syarif, A. Prugel-Bennett, and G. Wills. Unsupervised clustering approach for network anomaly detection. In Networked Digital Technologies: 4th International Conference, NDT 2012, Dubai, UAE, April 24-26. 2012. Proceedings, Part I 4, pages 135-145. Springer, 2012.
[58] J. Thiagarajan, K. Thopalli, D. Rajan, and P. Turaga. Training calibration based counterfactual explainers for deep learning models in medical image analysis. Scientific reports, 12(1):597, 2022.
[59] H. Touvron, L. Martin, K. Stone, P.-E. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, A. Bhargava, S. Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.00288 2023.
[60] S. Tuli, G. Casale, and N. Jennings. Tranad: Deep transformer networks for anomaly detection in multivariate time series data. arXiv preprint arXiv:2201.07286 2022.
[61] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
[62] L.. Weng. What are diffusion models? Illaanvengggilhub.i,, Jul 2021.
[63] Xu, H. Wu, J. Wang, and M. Long. Anomaly transformer: Time series anomaly detection with association discrepancy. arXiv preprint arXiv:22110006622, 2021.
[64] Z. Xu, Y. Liu, G. Deng, Y. Li, and S. Picek. A comprehensive study of jailbreak attack versus defense for large language models. In Findings of the Association for Computational Linguistics ACL 2024, pages 7432-7449, 2024.
[65] J. Yu. A. Ignatiev, P. J. Stuckey, N. Narodytska, and J. Marques-Silva. Eliminating the im- possible, whatever remains must be true: On extracting and applying background knowledge in the context of formal explanations. In Proceedings of the AAAI Conference on Artificial Intelligence 2023.
[66] J. Yu, Y. Zheng, X. Wang, W. Li, Y. Wu, R. Zhao, and L. Wu. Fastflow Unsupervised anomaly detection and localization via 2d normalizing flows. arXiv preprint arXiv:2111.0760 2021.
[67] X. Yuan and Y. Qiao. Diffusion-ts: Interpretable diffusion for general time series generation. arXiv preprini 20X
[68] S. Zagoruyko and N. Komodakis. Wide residual networks. arXiv preprint 2016.
[69] G. Zerveas, S. Jayaraman, D. Patel, A. Bhamidipaty, and C. Eickhoff. A transformer-base framework for multivariate time series representation learning. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pages 21 14-2124, 2021.
[70] A. Zhang, S. Song. J. Wang, and P. S. Yu. Time series data cleaning: From anomaly detection to anomaly repairing. Proceedings of the VLDB Endowment, 10(10):1046-057, 2017.
[71] H. Zhang, Z. Wang, Z. Wu, and Y.-G. Jiang. Diffusionad: Denoising diffusion for anomaly detection. arXiv preprint arXiv: 2003::2333.0080 08730, 2023.
[72] T. Zhou, P. Niu, L. Sun, R. Jin, et al. One fits all: Power general time series analysis by pretrained Im. Advances in neural information processing systems, 36, 2024.
[73] Y. Zou, J. Jeong, L. Pemula, D. Zhang, and O. Dabeer. Spot-the-difference self-supervised pre-training for anomaly detection and segmentation. In European Conference on Computer Vision, pages 392-408. Springer, 2022.
14

---

A Computational Resources
All experiments were done on server with three NVIDIA GeForce RTX 4090 GPUs.
B
Anomaly Detector Performance
In this section, report the performance of anomaly detectors. The results for FastFlow [66 are presented in Table 4 and the results for GPT-2 4 are shown in Table [ We did not perform extensive parameter tuning, as the performance of anomaly detectors is not the primary focus of our work. addition, is recommended that users adhere to usage guidelines of using GPT-2 or implementing safety filters.
C Additional Experiments
We include additional model EfficientAD I1 and dataset MVTec 13 Table EfficientAD achieved 88.24% average improvement across the four metrics on MVTec-AD and 74.85% improvement on VisA.
The results are shown in
D More Qualitative Examples
Additional VisA examples can be found in Figure while additional MVTec-AD examples can be found in Figure and Figure TO Additional time-series examples can be found in Figure [1
E Inference Time
We randomly sampled 50 instances from the testing set to compare inference times, as shown in Table 7 We observed that although property guidance generates higher-qualin repairs, it results in slightly longer inference times for time series data and significantly longer times for image data, possibly due to the higher dimensionality of the inputs. In total, it took about 40 hours to finish RQ1 VisA and 25 hours to finish SWaT. For RQ2, it took 5 hours for SWaT. Improving computation time will be focus of our future work.
F More Ablation Plots
In addition to A1 to Ay. we also perform ablation on the overall guidance scale, which we denote using A& The The ablation study for X on time series be found in Figure 12 The ablation for image data, using cashew class as an example can be found in Figure 13 and Fi Figure
Category
Image AUROC
Pixel AUROC
Candle
0,6501
0.5617
Capsules
0,5352
0.8188
Cashew
0,3816
0.7558
Chewing Gum
0.3754
0,9362
Fryum
0.761
0.4244
Macaronil
0.2607
0,9127
Macaroni2
0.504
0.7729
PCB1
0.7173
0,9163
PCB2
0.7398
0.7945
PCB3
0,5361
0,8073
PCB4
0.6331
0.6183
Pipe Fryum
0.4696
0.2799
Average
0.5470
0.7166
Table 4: AUROC Scores of Fastflow for Various Categories in VisA
15

---

Metric
GPT-2 on SWaT
Accuracy
0.9784
Precision
0.8831
Recall
0,9472
Fl-score
0,9140
Table 5: Performance of GPT-2 anomaly detectors on SWaT Datasets
Modd
Class
Mall)
MUN
Merl3
Baseline
Guiced
Baseline
Guided
Buseline
Guided
Baseline
Guided
bottle
9.00
0.463
.0.333
0.21
EBficienAAD (MV
cabl--
0.052
0.07
capoute
carpet
-0.349
0.083
-0.025
0.11
0.179 0.025
0.014
0.04
0.088
0.20
0.98
0.34
376
00:00 0.004
0.006
0.004
0.10 0.00
0.01
0.000
tiee
6.67 1,98
0.52
0.27
432
62.29
1.47
0.94 0.308
-0.31%
0.336
2.75 1.08
-0.02
0.022
sottheueh
50
5.44
35.76
9.41
142 75.12
9.21
1.60
-0.15 0.365
-0.03
0.056
1.13 0.6
-0.02
0.011
manider
37.40 3.66
46.56
10.74
270
72.84
26.60
100.96
-1 353 0.622
-0.311
0.885
-1.78 + 1.96
-0.35
1.506
weed
91 54.07
22.06
= 2.72
55%
12 47.06
10.34 + 1.34
1829 + 0.560
-0.480
0.487
14.30 + 3.79
-0.15
0.066
1.37 0.20
0.52 =222::00 0.12
305 86
32.46
9.91
+ 1.01
0U630 = 0.000
-0.055
0.005
1.22
0.02
-0.00
0.002
((
+47.85%
-97.10%
107..84%
+100.16%
candle
280.37
48.14
387.79
= 60.55
166.18
27.27
5.71 1.27
7.219 4 3,677
.1212
0.379
66998
7:25
.8.22 0.265
ElBicennAD
capoales
28.98
10.27
31.01
5.50
371.05
52.72
5.41 0.01
0.570 11 0.227
IU036 1 0,042
2,00
0.74
0.01 =: 0.012
(VKA)
cashew
364.06
25.11
365.13
31,62
235.69
54,96
5.76
1,55
2965 4.098
2.778
3AST
0:32
2.55
0.06 +: 1.055
chewinggum
81.47
3,01
15.57
11.40
199.1
15:37
5 0.01
0:315 1 0.498
0.176
0,485
0.76
0.51
0.02 0.000
fryum:
267.90
130.0-
18.19
222.72
12.43
0.01
5.006 2.300
.0.39
1.02
9.62
2.04
000 0.48
macarniil
33.80 881.24
16:24
13.91
16:00 3118
-1.113
0:735
25.01
10: 0195
macemmn)
0.01
30000
.0.523
0.99
366
161
0.17 0,875
pobl
0.068
0.001
pdb2
496.76
0008
pob3
0007
0.110
ripe fryum
A(1)
+4.1%%
498.5%
+100.309
Table 6: Comparison of baseline and guided performance across four metries for MVTec dataset categories with EfficientAD and FastFlow, A is the median improvement percentage of the guided result from baseline.
Vision
Time-serie
Baseline
Guided
Baseline
Guided
1 126.50
236.37
10.86
12.49
Table 7: Comparison of baseline and guided generation median runtimes (seconds).
16

---

Inpat
Anomaly mask
Raseline
Guided
Fryum
Pipe Fryum
Macaroni
Macaroni
Input
Anomaly mask
Baseline
Gaided
Chewing gum
Cashow
Capsules
Candles
Figure 8: More VisA examples. With AR-Pro, we have anomaly repairs resemble inputs better, compared with baseline.
17

---

Input
Anorualy maak
Buseline
Guided
Bottle
Zipper
Capsules
Carpet
Input
Anomaly mask
Baseline
Gaided
Pill
Screw
Tile
Toothbrush
Figure 9: More MVTec examples (Part 1). With AR-Pro, anomaly repairs resemble inputs better compared with the baseline.
18

---

Inpul
Anomualy mask
Baseline
Grid
Hazelnut
Leather
Metal Not
Figure 10: More MVTTc examples (Part 2). With AR-Pro, anomaly repairs resemble inputs better compared with the baseline.
0.7
Saroxr Resakig
Sensor Resdin
0.4
0.3
<ergged
x krii proportyquke
ReWhh procert-gulze
Bx tascline
Br Nicasoline
0.0
0.0
40
60
100
40
60
100
Timestamps
Timestamps
(a) Both repair anomaly.
(b) Baseline fails to repair anomaly.
0.8
Senser fleatig.
0.5
Seneon Realing
Q.4
0.4
0.2
<erginal
oegane
01
bc with property guide Bc bosedine
0.
100
Timestamps
(c) Baseline fails to repair anomaly.
(d) Bascline fails repair anomaly.
Figure 11: The first image shows an instance where the baseline repairs the anomaly, but not as effectively as with property guidance. The last three images show instances where the baseline fails to repair the anomaly.
19

---

400
0.09
W
0.58
10.51
4 0.08
0.08
0.90
10
10.30
0.08
0.06
10
(a) M
Ma
(c) M..
(d) M
Figure 12: Effects of hyperparameter X on M,. Ma. Mw and Ma on SWaT; the effect of X varies across metrics, but the range remain relatively small.
15.230
8:308
0.011
0.053
0.50
0.25
0.00
0.50
0.25
(a) M.
(b) Ma
(c) M.
(d) M
Figure 13: Effects of hyperparrmette on Ms. Ma, M,, and Mp on VisA cashew class; the effect of A varies across metrics, but the range remain relatively small.
M
-35.000
4 0.100
0051
30.990
4 9
B374 2 3 6 8
0.08
2 4 5 7
0047
2 8
(a) M.
(b) Ma
(c) M
(d) M
Figure 14: Effects of hyperparameter A M., Ma. M., and M, VisA cashew class; the effect of A varies across metrics, but the range remain relatively small.
20

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope, as they clearly outline the development of domain- independent framework for anomaly repair based on formal properties and the demonstration of its effectiveness through empirical results on VisA and SWaT datasets. This alignment ensures that the reader's expectations are met and that the paper delivers on its proposed objectives.
Guidelines:
The answer NA means that the abstract and introduction not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include uspirational goals motivation long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitation in Section 6
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
21

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Although did not have proofs, listed the assumptions in Section 2 and Section 3
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We attach the code for reproducing the result to the zip file.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results way to reproduce the model (c.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but should be possible for other researchers have some path to reproducing or verifying the results.
22

---

The authors should provide scripts to reproduce all experimental results for the new reproducible, they 5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification:
Please find the appendix for the implementation details.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm cc/
http://uddeee/eeeubiiiieeeeeeeee ssionpolicyyyyycyoc for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips.cc/publa. htt///gudddiseeeeeeee /ooiee///mmdddmmimcc ss onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
We include the experiment details in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We reported the mean and standard deviation for our main results in Table [ We also report TNR with 95% statistical significance in Table 3
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing some parameter, or overall run with given experimental conditions).
23

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out of range (e.g. negative enror rates).
error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We indicate GPU details Appendix and the amount of compute required for each of the individual experimental runs well as estimate the total compute in Appendix E
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification:
We conducted in the paper conform, in every respect, with the NeurIPS Code
Ethics
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there is a special consider- ation due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: There is noticeable negative societal impact of the work performed.
Guidelines:
The answer NA means that there is societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.

---

Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: We call for users adhere to usage guidelines of GPT2 in Appendix or implementing safety filters.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse dual-use should be released with necessary safeguards to allow for controlled use the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cited the original paper that produced the code packages and datasets. We also state which version of the model is used.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
25

---

If assets are released, the license, copyright information, and terms of use in the pack- age should be provided. For popular datasets. cuttases.ppperswiii wwwpeswwtthooeeeooocc.. wwwde.. com/ datasets has
curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged reach the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We communicate the details of the code as part of our submissions in the zip file. This includes details about training, license, limitations, etc.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. you obtained IRB approval, you should clearly state this in the paper.
26

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
27


Reviews:
[{"review_id": "FJertu0XIg", "reviewer": "Reviewer_DUtN", "summary": "Paper proposes a method for anomaly repair that goes one step beyond an anomaly detection and/or an anomaly localization method. While anomaly detection focuses on identifying which objects (images, time series, etc.) are anomalous, and anomaly localization focuses on identifying regions within the object (image or time series) which is anomalous, anomaly repair focuses on producing the normal object that the anomalous object is derived from. Authors identify properties for the repair, and develop a generative model that can take an anomalous object and produces the corresponding normal (and repaired) object.\n\nPaper describes experimental results to demonstrate the effectiveness of the proposed approach on different data sets. Evaluation is done both quantitatively and qualitatively.", "questions": "- In Section 2, the definition of anomaly map has a term $\\hat{x}$, which has not been defined. From the figure 2 it appears that $\\hat{x}$ is the reconstructed version of the original data point. Does that mean that this analysis framework is applicable only to the class of anomaly detection methods that involve reconstruction. While those methods are certainly capable, there is a large class of anomaly detection methods that do not necessarily have a reconstruction step involved. In fact, does the whole approach rely on availability of a base anomaly detector?\n- Can this method be applied of multivariate instances (no spatial or temporal relationships). It is unclear how a single threshold ($\\tau$) in line 106 be applied to a case where each feature could have a different scale.\n- What is $\\alpha_i(x)$ in Definition 2.1? Is it the absolute difference between the actual value and the reconstructed value for the $i^{th}$ feature?\n- In Section 3.1, what does a \"normal input\" mean? Does it refer to an entire observation (an image) that does not have any anomalous features or does it refer to the non-anomalous parts of an image?\n- In Figure 5(a), why do the authors infer that the proposed method is not adding a spurious signal, when the plot shows that it is different from the normal signal", "limitations": "I think the paper does not quite scope the method - identify what kind of problems will it work on and what it won't.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "Paper is well written except for some minor notational inconsistencies (see my questions). The idea is interesting and novel and targets an important and practical issue of anomaly repair. Experimental evaluation is robust and provides evidence regarding the effectiveness of the proposed method.", "weaknesses": "A primary weakness of this paper is that it does not state the assumptions regarding the scope of the methods upfront. The analysis holds for methods that follow the reconstruction-based anomaly detection recipe, i.e., each input is reconstructed, and the anomaly score is calculated using the difference between the input and reconstruction. While that is true for many methods, there is still a vast majority of methods for which this is not applicable. In fact, even in the reconstruction based methods, the analysis holds for those in which the scoring function can be decomposed over the individual features. Again, this is not true for all reconstruction-based methods. It would be good if the authors can make this clear in the beginning to avoid confusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their positive review. Their feedback will help us greatly improve the clarity throughout the manuscript. We address the reviewer's comments and questions below.\n\n* **Scope of the assumptions.**\nAlthough we use reconstruction-based anomaly detection as a motivating example, we are not restricted to such methods. Rather, our framework focuses on anomaly detectors with a linearly decomposable score (Definition 2.1). Linear decomposability includes many reconstruction-based methods (e.g., VAEs) as well as maximum likelihood-based ones (e.g., FastFlow). Despite this, it does not cover all anomaly detectors, such as clustering-based methods. We will improve our manuscript to better discuss the scope and limitations of our work to avoid confusion.\n\n* **Definition of $\\hat{x}$ in Section 2.**\n$\\hat{x}$ denotes the reconstructed input obtained from reconstruction-based methods. We will update our manuscript to clarify this.\n\n* **Availability of base anomaly detector.**\nWe assume that the base anomaly detector is available. This is because we take the anomaly score into consideration when performing repairs. We will update our manuscript to clarify this.\n\n* **Extension to multivariate instances.**\nOur framework can generalize to the multivariate case. For an input $x \\in \\mathbb{R}^n$, we use the $n$-dimensional thresholding vector $\\tau \\in \\mathbb{R}^n$ to allow for fine-grained control of the anomaly region selector $\\omega(x) \\in \\\\{0,1\\\\}^n$ at each feature. \n\n* **$\\alpha_i (x)$ in Definition 2.1.**\n$\\alpha_i (x)$ is the $i$th coordinate value of the anomaly map. In the given example, it is the absolute value between the reconstruction and original image on the $i$th feature. We will update our exposition to clarify this.\n\n\n* **Definition of “normal input”.**\nWe will update Section 3.1 of our manuscript to clarify that “normal input” means that the entire input (e.g., whole image) is considered non-anomalous.\n\n* **Spurious/normal signal in Figure 5(a).**\nThis figure compares our method (green) with the baseline (red) and shows that we generate qualitatively better (less “spurious”) signals. We will improve the wording in the experiments section to avoid confusion for future readers.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3I0YIWOxlB", "reviewer": "Reviewer_F7R5", "summary": "The paper proposes an anomaly repair technique. Based on proposed four\nproperties, it trains a generative model that can fix anomaly data to a benign\none. The proposed properties include similar to the data, etc., which are\nglobally applicable to any dataset. The evaluation is performed on VisA dataset\nand the GPT2 on SWat Dataset. The results show that the proposed method can\neffectively repair the anomaly data.", "questions": "What is the motivation of fixing the anomaly data?", "limitations": "The paper does not explicitly discuss the limitations and potential negative. As\nfor me, my concern is this can be used as a tool to evade anomaly detection\nmodels. The authors should discuss this in the paper.", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 1, "strengths": "The paper can properly formulate the proposed properties and mix them into the\ntraining of the generative model. The proposed method can effectively repair the\nanomaly data. The paper is well-written and easy to follow.", "weaknesses": "* I do not get the motivation of fixing anomaly data. If it is detected and\n  considered as anomaly, our typical action is to determine if it is a false\n  positive and then improve the detection model and following downstream models.\n  What is the rationale of fixing the anomaly data?\n\n* Properties 3 and 4 seem to be generalized version of 1 and 2. Typically, this\n  should be solved in the training of models, either a vision model or\n  time-series. Why not directly embedding these properties into the training of\n  final model instead of training a separate model?\n\n* The method assumes the availability of anomaly map, which seems to be\n  impractical in real-world scenarios. How can the method be applied to\n  real-world scenarios where anomaly maps are not available? In the real world,\n  we tend to only have individual anomaly data points, not a map. Similarly, it\n  would be great if you can extend the discussion to the region selector.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their feedback on problem motivation and potential risks. We will revise our manuscript to address these concerns. Below are our responses to the comments and questions.\n* **Motivation for Fixing Anomalous Inputs.**\nAnomaly repair is useful when the input data is noisy and needs to be cleaned [1]. This is studied in the context of image data [2, 10], time-series signals [3,4], graph data [5], and also heterogeneous data [6]. A common application is to improve the quality of the training data, while another is to recover from distribution shifts and allow downstream tasks to operate on data that is more in-distribution, i.e. rainy conditions in autonomous driving [7], geolocation data [8]. There are different ways to perform the repair, for example, [9] repairs anomalies through semantic-preserving transformations on images, while our work uses diffusion models for images and time-series, guided by formal specifications.  In addition, we see a good opportunity to use repairs as an explainability method to improve the interpretability of black-box machine-learning models. Our proposed framework for counterfactual explanations is a step towards helping users better diagnose whether anomaly \"hits\" are indeed false positives by revealing what a non-anomalous input should have been like. Counterfactual explanations are especially relevant if the user is inexperienced or the data is complex [11].\n* **Properties 3 and 4 vs. Properties 1 and 2.**\nAlthough Properties 3 and 4 are similar to Properties 1 and 2, their respective loss function encodings (Section 3.2) are different. Namely, the loss for Property 1 may be negative, while those for Property 2, 3, and 4 may not be. Moreover, Property 2 concerns similarity, while Property 4 concerns the anomaly score. We will clarify the exposition around this part.\n* **Embedding Properties into Training.**\nWe apologize for not fully understanding the reviewer's question, and we would appreciate some clarification. In the meantime, we hope the following can serve as a partial answer. We have previously tried to encode these properties into a repair model's training objective. In particular, we attempted to perform anomaly repair on image data with VAEs. Despite our best efforts, the repair models often produced blurry or incorrect outputs. It was only when we switched to iterative diffusion-style methods that we could attain high-quality repairs. We will expand our discussions on this.\n* **Availability of the Anomaly Map.**\nThe availability of the anomaly map is indeed a concern, especially if the detector were proprietary or closed-source. For open-sourced models implemented with libraries like PyTorch, we found that the anomaly map was usually available. For instance, the anomaly map was available for many detectors in Anomalib [12]. Nevertheless, the reviewer raises a valid point that the availability of the anomaly map is dependent on software implementation and should not be assumed. We will update our manuscript to address this limitation.\n* **Region Selector**.\nOur anomalous region selector is the same as the commonly used thresholding methods. The user specifies a threshold vector $\\tau \\in \\mathbb{R}^{n}$ to specify the anomaly threshold of each feature.\n* **Evasion of Anomaly Detectors.**\nSince our work uses the detector's anomaly score in an optimization objective, attackers could potentially misuse our techniques. We will update our manuscript to discuss these risks. However, if attacks on anomaly detectors become common, it would likely spur interest in developing robust detectors, similar to the advancements in adversarial image classification and LLM jailbreaking defenses that followed extensive study of defensing against attacks.\n\n[1] Yang, J., Zhou, K., Li, Y., & Liu, Z. (2024). Generalized out-of-distribution detection: A survey. International Journal of Computer Vision.\n\n[2] Eduardo, S. F. L. M. (2023). Data cleaning with variational autoencoders.\n\n[3] Wang, X., & Wang, C. (2019). Time series data cleaning: A survey. Ieee Access, 8, 1866-1881.\n\n[4] Zhang, A., Song, S., Wang, J., & Yu, P. S. (2017). Time series data cleaning: From anomaly detection to anomaly repairing. Proceedings of the VLDB Endowment, 10(10), 1046-1057.\n\n[5] Akoglu, L., Tong, H., & Koutra, D. (2015). Graph based anomaly detection and description: a survey. Data mining and knowledge discovery, 29, 626-688.\n\n[6] Eduardo, S., Nazábal, A., Williams, C. K., & Sutton, C. (2020, June). Robust variational autoencoders for outlier detection and repair of mixed-type data. In International Conference on Artificial Intelligence and Statistics. PMLR.\n\n[7] Filos, A., Tigkas, P., McAllister, R., Rhinehart, N., Levine, S., & Gal, Y. (2020, November). Can autonomous vehicles identify, recover from, and adapt to distribution shifts?. In International Conference on Machine Learning. PMLR.\n\n[8] Corizzo, R., Ceci, M., & Japkowicz, N. (2019). Anomaly detection and repair for accurate predictions in geo-distributed big data. Big Data Research.\n\n[9] Lin, V., Jang, K. J., Dutta, S., Caprio, M., Sokolsky, O., & Lee, I. (2024, June). DC4L: Distribution shift recovery via data-driven control for deep learning models. In 6th Annual Learning for Dynamics & Control Conference. PMLR.\n\n[10] Pirnay, Jonathan, and Keng Chai. \"Inpainting transformer for anomaly detection.\" In International Conference on Image Analysis and Processing. Cham: Springer International Publishing, 2022.\n\n[11] Verma, Sahil, John Dickerson, and Keegan Hines. \"Counterfactual explanations for machine learning: A review.\" arXiv preprint arXiv:2010.10596 2 (2020)\n\n[12] Akcay, Samet, Dick Ameln, Ashwin Vaidya, Barath Lakshmanan, Nilesh Ahuja, and Utku Genc. \"Anomalib: A deep learning library for anomaly detection.\" In 2022 IEEE International Conference on Image Processing (ICIP). IEEE, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "k8RaduXUKw", "reviewer": "Reviewer_k8Af", "summary": "The paper addresses the anomaly explanation task by repairing the normal appearances of input inputs. Specifically, this paper designs four properties to guide the repair process that works in both image and time series domains. To demonstrate the effectiveness of the proposed method, this paper conducts experiments on the VisA and SWaT datasets.", "questions": "See the Weaknesses.", "limitations": "See the Weaknesses.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The motivation is clear, thus, repairing the normal appearances for better anomaly explanation. \n\nThe designed four properties to guide the repair process are reasonable. \n\nThe proposed metrics are reasonable and the proposed method achieves significant improvements versus the utilized baseline.", "weaknesses": "This paper exploits fixed anomaly detection methods, i.e., Fastflow and GPT2, to guide the anomaly repair process. The two selected methods are out-of-date, and the influence of the utilized anomaly detection methods should also be investigated. \n\nMore datasets should be included but not only VisA and SWaT. For example, for industrial image anomaly detection, MVTec AD should also be included. \n\nFor me, Property 1 is a combination of Property 3 and 4, and maybe only Property 2, 3, and 4 are enough. \n\nThe figure quality should be improved, especially for Figure 3.\n\nFor the fourth metric M_{1-w}, should it be the absolute value? Or it will encourage lower anomaly scores for normal regions in the fixed results. \n\nSec 3.3 is quite important but is not clear. The author may condense Sec. 2 a lot and then extend Sec 3.3, at least elaborating on the details of the generation process and adding proper references.\n\n\n------------post rebuttal response--------\nthe authors have addressed all my concerns, so I raise my rate from 5 to 6.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their useful suggestions on how to improve our experiments and presentation. We will incorporate these changes into our manuscript, and we believe that they will help us greatly improve the quality of our work. We have included some results of our work-in-progress experiments in the supplemental material, namely the addition of new models (EfficientAD [1] for vision, Llama-2-7b [2] for time-series) and datasets (MVTec [3] for vision, WADI [4] and HAI [5] for time-series). Below, we respond to the reviewer's comments and questions.\n\n* **Additional Models and Datasets.**\nWe are in the process of incorporating more recent models (EfficientAD, Llama-2-7b) and datasets (MVTec, WADI, HAI) to strengthen our experiments. In particular, WADI [4] is a time-series dataset that focuses on water distribution systems and contains anomalies related to sensor malfunctions and system faults. HAI [5] is another time-series dataset used for industrial control systems and includes anomalies such as cyber-attacks and operational failures. Like SWaT, both WADI and HAI have ground-truth feature-level annotations of anomalies. Due to limits in computing resources, we only include a sample of the ongoing experiments in the supplemental PDF. Importantly, we observe similar trends as our other experiments.\n\n\n* **Relation Between Property 1 and Properties 3 and 4.**\nThe reviewer is correct in noting the relation between Property 1 and Properties 3 and 4. After some deliberation, we felt that it was simpler for the exposition to keep them separate, particularly in their loss function encodings of Section 3.2. We tried some other formulations but could not reach a satisfactory balance of a smooth exposition and notational compactness. We are open to suggestions on how to rework the presentation, and we would be glad to hear if the reviewer might have some ideas.\n\n* **Figure 3 Quality.**\nWe have provided an updated Figure 3 in our supplementary PDF.\n\n* **Metric of $M_{1-w}$.**\nWe intended for this to be without the absolute value. Intuitively, the repair can have a lower anomaly score in the normal region since fixing the anomalous region may reduce the overall score of nearby features.\n\n* **Clarity of Section 3.3.**\nWe thank the reviewer for identifying this weakness. We will revise this section for greater clarity and detail.\n\n[1] Batzner, Kilian, Lars Heckler, and Rebecca König. \"Efficientad: Accurate visual anomaly detection at millisecond-level latencies.\" Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2024.\n\n[2] Touvron, Hugo, et al. \"Llama 2: Open foundation and fine-tuned chat models.\" arXiv preprint arXiv:2307.09288 (2023).\n\n[3] Bergmann, Paul, et al. \"MVTec AD--A comprehensive real-world dataset for unsupervised anomaly detection.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2019.\n\n[4] Ahmed, Chuadhry Mujeeb, Venkata Reddy Palleti, and Aditya P. Mathur. \"WADI: a water distribution testbed for research in the design of secure cyber physical systems.\" Proceedings of the 3rd international workshop on cyber-physical systems for smart water networks. 2017.\n\n[5] Shin, Hyeok-Ki, et al. \"{HAI} 1.0:{HIL-based} Augmented {ICS} Security Dataset.\" 13Th USENIX workshop on cyber security experimentation and test (CSET 20). 2020.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their time and feedback. Their comments and suggestions will allow us to greatly improve our manuscript in exposition narrative, technical details, and experiment results. We are in the process of running additional experiments involving newer models like EfficientAD [1] and Llama-2 [2], as well as datasets like MVTec [3], WADI [4], and HAI [5]. We have attached some preliminary results in our supplemental PDF.


[1] Batzner, Kilian, Lars Heckler, and Rebecca König. "Efficientad: Accurate visual anomaly detection at millisecond-level latencies." Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2024.

[2] Touvron, Hugo, et al. "Llama 2: Open foundation and fine-tuned chat models." arXiv preprint arXiv:2307.09288 (2023).

[3] Bergmann, Paul, et al. "MVTec AD--A comprehensive real-world dataset for unsupervised anomaly detection." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2019.

[4] Ahmed, Chuadhry Mujeeb, Venkata Reddy Palleti, and Aditya P. Mathur. "WADI: a water distribution testbed for research in the design of secure cyber physical systems." Proceedings of the 3rd international workshop on cyber-physical systems for smart water networks. 2017.

[5] Shin, Hyeok-Ki, et al. "{HAI} 1.0:{HIL-based} Augmented {ICS} Security Dataset." 13Th USENIX workshop on cyber security experimentation and test (CSET 20). 2020.

Meta-review: This paper proposed a method to convert anomalous to normal images under a set of properties such as making minimal changes to normal regions and actually reducing anomalous scores. The method uses diffusion methods for image AD, and also applies to time series anomalies. Overall, the method addressed an interesting problems and shows promising results. While there were some concerns, they were addressed in the rebuttal.

Reviewer DUtN was concerned the paper does not detail which AD segmentation approaches this method will work for. The authors explained this will not work for clustering based AD. The AC suggests also mentioning retrieval based AD e.g. SPADE or PatchCore. In either case the AC believes this can be fixed in one or two sentences in the final manuscript.

Reviewers k8Af and F7R5 pointed out there is some redundancy between the 4 formal conditions. The authors admitted that it is possible to remove condition 1, but it makes the exposition more natural. This satisfied reviewer k8Af. The AC believes this is reasonable but requests adding a clarification to the final version. Reviewers k8Af wanted additional experiments, the reviewers supplied a few experiments and promised further experiments, this addressed the concern.

Reviewer F7R5 initially had several additional concerns about i) the motivation for anomaly repair ii) that anomalous images do not come with anomaly maps. AC believes the concerns should not prevent acceptance as: i) fixing anomalies is interesting both as a way of obtaining pristine images and as a tool for explaining model decisions, which is very important for anomaly detector as they are essentially unsupervised  ii) there are many anomaly segmentation methods available and it is not essential to introduce another one. The reviewer also indicated post-rebuttal that they do not object to accepting this paper.

Overall, given the interesting research direction that this paper offers, the promising initial results and that rebuttal addressed the concerns of the reviewers, the AC recommends acceptance.
Decision: Accept (poster)