Paper: Revisiting Non-separable Binary Classification and its Applications in Anomaly Detection (ICLR-2024)

Reviewer comment (Writing):
The sentence "Equality separators use the distance from a learnt hyperplane as the classification metric" is confusing: A distance is measured between two objects, but here the authors only mention one object, i.e., the learnt hyperplane.

Author response:
We thank this reviewer for the feedback on how to improve our paper. We updated the paper to increase its clarity based on the feedback given (e.g. on distance, bullet points, related works section, small typos). We proceed to answer other questions.

Reviewer comment (Theory):
I feel the authors spent too much tutorial-like narration for VC dimension, closing number, and locality, in the main manuscript. In particular, what is the purpose of the over-detailed VC dimension? What useful information can we conclude in this section? Did the authors want to use the VC dimension to give some theoretical bound of generalization errors?

Author response:
# Why VC dimension?

As mentioned in the global response, VC dimension analysis shows that equality separation (ES) is more expressive than halfspace separation (HS), not just a linear solution to XOR. The generalization bound can be directly obtained with VC dimension if desired.

# Tutorial-like narration

We explain what locality is to motivate the need for quantitative metrics (closing numbers). It was our goal to explain to a wider audience who may not be familiar with both learning theory and anomaly detection (AD) literature. If this presentation is problematic, we ask this reviewer to suggest how they think we should edit the presentation.

Reviewer comment (Presentation):
In section 2.2, it is difficult to follow the mixed descriptions. The authors may use bullet points to describe case-by-case and use some plots to support the narration, if necessary.

Author response:
We thank this reviewer for the feedback on how to improve our paper. We updated the paper to increase its clarity based on the feedback given (e.g. on distance, bullet points, related works section, small typos). We proceed to answer other questions.

Reviewer comment (Presentation):
In section 3, the popped sentence "The utility of equality separators becomes evident in AD setting" is confusing since there is no particular interpretation of the utility of the equality separator in Anomaly Detection in the previous section after the introduction. As for the "Anomaly detection" in the introduction, it looks more like related works, maybe the authors could consider moving that part into Section 3.

Author response:
We thank this reviewer for the feedback on how to improve our paper. We updated the paper to increase its clarity based on the feedback given (e.g. on distance, bullet points, related works section, small typos). We proceed to answer other questions.

Reviewer comment (Novelty):
For the equality separator, what is the necessity of this proposed method?

Author response:
# Why ES? Why not kernel SVMs? Can ES work without kernels?

XOR is our starting point: we point out that the widely known “fact" that XOR cannot be classified with linear models is indeed false. No kernels needed.

In general, the motivation of using any classifier depends on the use case. In our work, we observe interesting properties of ES for AD and corroborate this in our experiments. For instance, we observe that kernel ES perform much better than kernel SVMs in our synthetic supervised AD experiment – it is ES that performs well, the kernel merely does feature embedding.

We do not over-claim that (linear) ES works for every task: raw data may not be linear classifiable. We use standard methods to embed raw data into feature space before linear classification: RBF kernels and neural networks in tabular datasets, and a pre-trained computer vision model (DINOv2) for MVTec defect dataset.  What we claim is that the _paradigm_ of ES is better for AD, that we should impose one class (the normal class) to have more structure than the other (the anomaly class). We show this theoretically with closing numbers and empirically with supervised AD experiments.

Reviewer comment (Experiments):
Even though linear SVM fails to solve the XOR classification while equality separator can, why do not use kernel SVMs?

Author response:
# Why ES? Why not kernel SVMs? Can ES work without kernels?

XOR is our starting point: we point out that the widely known “fact" that XOR cannot be classified with linear models is indeed false. No kernels needed.

In general, the motivation of using any classifier depends on the use case. In our work, we observe interesting properties of ES for AD and corroborate this in our experiments. For instance, we observe that kernel ES perform much better than kernel SVMs in our synthetic supervised AD experiment – it is ES that performs well, the kernel merely does feature embedding.

We do not over-claim that (linear) ES works for every task: raw data may not be linear classifiable. We use standard methods to embed raw data into feature space before linear classification: RBF kernels and neural networks in tabular datasets, and a pre-trained computer vision model (DINOv2) for MVTec defect dataset.  What we claim is that the _paradigm_ of ES is better for AD, that we should impose one class (the normal class) to have more structure than the other (the anomaly class). We show this theoretically with closing numbers and empirically with supervised AD experiments.

Reviewer comment (Theory):
In Figure 3(e), what if the unseen classes fall into the purple region but are far away from the brown points? Will they be classified as brown classes when using $\epsilon$-error separator? What if the brown class is surrounded by the blue class which consists of several cohorts? In this case, does $\epsilon$-error separator work?

Author response:
# Failure modes? E.g. Fig 1e.

If unseen anomalies fall in the margin, they will indeed be misclassified. Hence, the need for finite-volumed decision regions is important, and we may not be able to achieve that with just 1 ES. This observation motivates our introduction of closing numbers (especially when paired with neural networks, where neurons in a hidden layer work together), which balances the learnability and the openness of the decision region (Figure 2).
 
Although ES may not classify everything correctly, we observe that it can classify the brown class _better_ than the corresponding HS: the set of misclassified non-brown points from ES is a proper subset of misclassified non-brown points by HS.

Reviewer comment (Theory):
When considering the toy example in Figure 3, the authors also use the kernel to improve the shallow equality separator. Does this imply that the proposed equality separator (even though it is simple and linear) in general is not proper without kernel or activation?

Author response:
# Why ES? Why not kernel SVMs? Can ES work without kernels?

XOR is our starting point: we point out that the widely known “fact" that XOR cannot be classified with linear models is indeed false. No kernels needed.

In general, the motivation of using any classifier depends on the use case. In our work, we observe interesting properties of ES for AD and corroborate this in our experiments. For instance, we observe that kernel ES perform much better than kernel SVMs in our synthetic supervised AD experiment – it is ES that performs well, the kernel merely does feature embedding.

We do not over-claim that (linear) ES works for every task: raw data may not be linear classifiable. We use standard methods to embed raw data into feature space before linear classification: RBF kernels and neural networks in tabular datasets, and a pre-trained computer vision model (DINOv2) for MVTec defect dataset.  What we claim is that the _paradigm_ of ES is better for AD, that we should impose one class (the normal class) to have more structure than the other (the anomaly class). We show this theoretically with closing numbers and empirically with supervised AD experiments.

Reviewer comment (Experiments):
The decision of $\epsilon$-error separator depends on the value of $\epsilon$, but I cannot see any discussion on the choice or computation for the value of $\epsilon$.

Author response:
# Discussion on $\epsilon$?

The margin width is $\frac{2\epsilon}{||\mathbf w||_2}$. In Appendix F1 and F3 (Figure 8), we discuss with respect to the reparameterization of $\epsilon$ to $\sigma$ in the bump function.

Our main goal was to assess the separation of normal data from anomalies – if there is no/little separation, choosing a threshold would be moot. Hence, we use AUPR as our metric. During inference, the (output) threshold depends on the tolerance on the false positive rate. Since the
tolerance is domain-dependent, we do not prescribe a threshold in our general framework.

Reviewer comment (Novelty):
There is no discussion on Deep One-Class Classification [1] or a comparison with it. This related work also targets anomaly detection by forming a circle boundary to the normal classes.

Author response:
# Deep One-Class Classification (Deep SVDD) discussion?

In our paper, we use the improved Deep Semi-supervised Anomaly Detection (SAD) as a SOTA benchmark, which is Deep SVDD that can use labels. This discussion is in section 3.1 and 4.2 e.g. “SAD is … an RBF separator…”.

Reviewer comment (Presentation):
Is that possible to graphically show the closed decision boundaries on other examples formed by the proposed method?

Author response:
# Possible to graphically show other examples?

We are unsure of what this reviewer means and would like to ask for clarification.

Reviewer comment (Writing):
Multiple minor issues — Line 1, Page 3: do you mean $\mathbb{R}^+\cup\{0\}$?

Author response:
We thank this reviewer for the feedback on how to improve our paper. We updated the paper to increase its clarity based on the feedback given (e.g. on distance, bullet points, related works section, small typos). We proceed to answer other questions.

Reviewer comment (Writing):
Multiple minor issues — Theorem 2.3.: separators $\mathcal{H}$ "in" Def.

Author response:
We thank this reviewer for the feedback on how to improve our paper. We updated the paper to increase its clarity based on the feedback given (e.g. on distance, bullet points, related works section, small typos). We proceed to answer other questions.

Reviewer comment (Theory):
"modeling a halfspace separator …. with an equality separator requires non-linearity like ReLU": could the authors explain more about how the ReLU reflects the modeling for a halfspace with an equality separator?

Author response:
# Modeling halfspace with ES and ReLU?

As per section 2.2, ES acts as a HS by splitting the space into the positive and the zero parts of the ReLU.

Reviewer comment (Theory):
"equality separators yield a different optimal hyperplane compared to SVMs in binary classification": could the authors articulate the "optimality" here?

Author response:
# Optimality of 2 ES for HS?

We answer this in the last 2 sentences of section 2.2 from a robust perspective. Support vectors may be outliers far from high density regions, so using them may not be as robust as fitting a hyperplane for each class (which depends more on the center of mass).

Reviewer comment (Writing):
"where equality separation is more conservative in classifying the positive brown class": What do you mean by "more conservative"?

Author response:
# Meaning of “conservative”?

A more conservative classifier is less likely to classify a datum as positive, in line with density level set estimation. Closing numbers is a property of a class of classifiers that quantify conservativeness, motivated by using these classifiers in neural networks.

Reviewer comment (Evaluation):
As mentioned above, the anomaly detection results in this paper are promising. However, the gain on the NSL-KDD dataset is not always positive. This limits the application of the proposed method.

Author response:
We thank this reviewer for affirming the creativity of equality separation, the theoretical analysis provided and the communication of our ideas. We acknowledge this reviewer’s request for more datasets in our global response (adding MVTec and thyroid dataset results), and thank this reviewer for noting the thorough experimentation on NSL-KDD dataset. We address other concerns below. 

# Why don’t equality separators have the best performance for NSL-KDD dataset in all metrics, especially over (unsupervised) baseline methods? Are there intuitions why?

In short, equality separation is an attempt to merge the benefits of unsupervised methods into supervised methods. We observe a _significant_ improvement over supervised methods for unseen anomalies while maintaining supervised-level performance on seen anomalies.

We do not claim that equality separation is or should be the _final_ solution to supervised anomaly detection (AD). We do claim that, among methods that use label information via standard empirical risk minimization, equality separation is more suitable, especially to detect unknown anomalies. The experiments support this claim: for instance, in regular binary classification, equality separation _significantly_ improves AUPR on detecting unseen anomalies (privilege and remote access attacks) by 3-fold compared to halfspace separation.

Comparing equality separation to unsupervised AD baselines, we especially see that OCSVM beats all other methods in detecting unseen anomalies (privilege and remote access attacks). **However**, unsupervised methods like OCSVM cannot capitalize on labels, hence our comment in footnote 5 that unsupervised methods are not our main apples-to-apples comparison. The inability to use labels impacts detection on seen anomalies (DoS attacks). This disadvantage is in addition to the computational load of computing kernels (e.g. for OCSVM) for large datasets like NSL-KDD. Furthermore, equality separation outperforms unsupervised baselines Isolation Forest and Local Outlier Factor on the unseen remote access attacks, while other regular binary classifiers are far from it. We conclude that equality separation is a step in the right direction to use limited anomaly labels to detect **both seen and unseen** anomalies.

Our intuition on why equality separation may not be beating the OCSVM baseline in detecting unseen anomalies relates mainly to implementation details – given that equality separation had excellent performance in our synthetic experiments, we posit that higher dimensional data amplify certain difficulties. We observe that optimization may be more difficult because of more sensitivity in initializations and vanishing gradients. We are currently working on understanding how the activation function, loss function and optimization scheme (including initializations) work together to form closed decision regions, which we posit may be the key to further improvements.

Reviewer comment (Experiments):
The authors performed thorough experiments on the NSL-KDD dataset. However, further datasets should also be included in the experimentation to show the efficacy of the proposed method.

Author response:
We thank this reviewer for affirming the creativity of equality separation, the theoretical analysis provided and the communication of our ideas. We acknowledge this reviewer’s request for more datasets in our global response (adding MVTec and thyroid dataset results), and thank this reviewer for noting the thorough experimentation on NSL-KDD dataset. We address other concerns below.

Reviewer comment (Evaluation):
This is related to concern regarding weakness 1. What are the authors intuition regarding the equality separator not always outperforming the other baseline methods for NSL-KDD.

Author response:
We thank this reviewer for affirming the creativity of equality separation, the theoretical analysis provided and the communication of our ideas. We acknowledge this reviewer’s request for more datasets in our global response (adding MVTec and thyroid dataset results), and thank this reviewer for noting the thorough experimentation on NSL-KDD dataset. We address other concerns below. 

# Why don’t equality separators have the best performance for NSL-KDD dataset in all metrics, especially over (unsupervised) baseline methods? Are there intuitions why?

In short, equality separation is an attempt to merge the benefits of unsupervised methods into supervised methods. We observe a _significant_ improvement over supervised methods for unseen anomalies while maintaining supervised-level performance on seen anomalies.

We do not claim that equality separation is or should be the _final_ solution to supervised anomaly detection (AD). We do claim that, among methods that use label information via standard empirical risk minimization, equality separation is more suitable, especially to detect unknown anomalies. The experiments support this claim: for instance, in regular binary classification, equality separation _significantly_ improves AUPR on detecting unseen anomalies (privilege and remote access attacks) by 3-fold compared to halfspace separation.

Comparing equality separation to unsupervised AD baselines, we especially see that OCSVM beats all other methods in detecting unseen anomalies (privilege and remote access attacks). **However**, unsupervised methods like OCSVM cannot capitalize on labels, hence our comment in footnote 5 that unsupervised methods are not our main apples-to-apples comparison. The inability to use labels impacts detection on seen anomalies (DoS attacks). This disadvantage is in addition to the computational load of computing kernels (e.g. for OCSVM) for large datasets like NSL-KDD. Furthermore, equality separation outperforms unsupervised baselines Isolation Forest and Local Outlier Factor on the unseen remote access attacks, while other regular binary classifiers are far from it. We conclude that equality separation is a step in the right direction to use limited anomaly labels to detect **both seen and unseen** anomalies.

Our intuition on why equality separation may not be beating the OCSVM baseline in detecting unseen anomalies relates mainly to implementation details – given that equality separation had excellent performance in our synthetic experiments, we posit that higher dimensional data amplify certain difficulties. We observe that optimization may be more difficult because of more sensitivity in initializations and vanishing gradients. We are currently working on understanding how the activation function, loss function and optimization scheme (including initializations) work together to form closed decision regions, which we posit may be the key to further improvements.

Reviewer comment (Presentation):
I noticed that in Table 3, for DOS, HS-NS result is in bold. Why is that? I though ES-NS performs the best here?

Author response:
# Bold Results for HS-NS in Table 3?

We consider both the mean and standard deviation when determining which is the best. This is to account for variability in running the optimization that arises from different initializations. To avoid confusion, we account for this consideration in our discussion and appendix instead and remove the double bold text in the table in the main body.

Reviewer comment (Presentation):
In order to enhance the accessibility and comprehensibility of the content, it would be advisable to incorporate critical discussions and analyses that are currently relegated to the appendix into the main body of the manuscript.

Author response:
We thank this reviewer for reading through the details in the appendix. We are willing to move relevant sections of the appendix to the main paper. Which sections does this reviewer think are relevant to move to the main body?

Reviewer comment (Experiments):
Is this network design extensible to more intricate datasets, such as image data?

Author response:
Although we use the toy dataset for enhanced visualizations and understanding (both in the main body and appendix), we use NSL-KDD as a real cyber-attack dataset. NSL-KDD is an (improved) edited version of the KDDCUP99 dataset, which was part of USA DARPA’s Intrusion Detection System evaluation program, with “about 4 gigabytes of compressed raw (binary) tcpdump data of 7 weeks of network traffic, which can be processed into about 5 million connection records, each with about 100 bytes. The two weeks of test data have around 2 million connection records” [1]. Real cyber-attack datasets allow us to test methods against adversaries who are actively trying to circumvent and break the system.

Our method can indeed be generalized to other domains – there is nothing specific to tabular or cyber-attack data. We have included results for MVTec image defect dataset, showing better AUPR in 5/6 objects tested. We also experiment with the thyroid dataset, which focuses on a medical application. Our method once again shows better performance in detecting seen and unseen anomalies.

Reviewer comment (Theory):
Isn't there a gradient vanishing problem with that bump activation design when the layers of the neural network are deep?

Author response:
Gradients will vanish outside the margin (proportional to $\frac{1}{||\mathbf w||_2}$) as plotted in Figure 4 (Appendix E1), similar to vanishing gradients in sigmoid or the dead neuron problem in ReLU. However, like sigmoid, gradients are the greatest in the regions close to the boundary between positive and negative (i.e. regions of aleatoric uncertainty).

There are 2 sides of this coin. The conventional perspective is that gradients that vanish inhibit learning, and we mention in Section 4 and Appendix F1 that we can mitigate this by initializing $\sigma$ to be large (e.g. $\sigma=10$). This decreases the sensitivity in weight initialization. 

On the flip side, there is a self-regularizing effect, where the neuronal activation is very selective. This is indeed what we desire in anomaly detection, where unseen inputs should not activate the network. In Appendix F3 (Figure 8), we show in Figure 8 how the margin width changes across hidden layers (grows across time in earlier layers for more information flow and shrinks in later layers for selectivity of information/features).