Anomaly Detection with Test Time Augmentation and Consistency Evaluation

We use data augmentation techniques without backpropagation at test time, which is similar to TTA, to help enlarge the gap between in-distribution and out-distribution samples. Formally, given test data $X=\{\bm{x}_{1},\bm{x}_{2},\bm{x}_{3},...,\bm{x}_{n}\}$, a transformation function $T$ drawn from function space $\mathcal{T}$, the augmentation process can be described as $\bm{x}_{i}\rightarrow T(\bm{x}_{i})$. In our algorithm, the function space $\mathcal{T}$ contains Fast Fourier Transformation (FFT) and Horizontal Flip (HF) because they satisfy the sensitivity criterion. Specifically, recent studies find that neural networks are less error-prone to low-frequency components [45], and deep neural networks and datasets are sensitive to visual chirality [26]. TTA-AD extends these conclusions by revealing that while the neural networks are known to be sensitive to high frequency components and visual chirality (horizontal flip), the sensitivity is enhanced in out-distribution data.

FFT is a widely used efficient image processing technique [5, 29]. FFT converts an image from the space domain to the frequency domain using a linear operator. Then the frequency representation can be inversely converted into the original image data by IFFT (Inverse Fast Fourier Transformation). In TTA-AD, we propose to cut off partial sensitive high-frequency signals. Our ablation study on the filter radius in Section 4.5 shows that the anomaly detection performance fluctuates little within a wide range of filter radius. In the following text, we will use $\text{FFT}_{100}$ to represent the FFT and IFFT transformation with a 100-pixel filter radius. Since discovering visual chirality [26], there have not been many studies exploring how to exploit the property. We introduce it into anomaly detection, and according to our observations, it indeed enlarges the distribution gap. We verify through extensive experiments (Figure 1 and Appendix A) to show that the sensitivity is more significant in out-distribution data with both transformations. Specifically, the distance of paired in-distribution sample features is statistically shorter than that of paired out-distribution samples. Our analysis in Section 5 further provides the empirical reasons and theoretical analysis.

Unlike previous works that ignore the interaction between augmentations of a sample, our anomaly score evaluates the relations between augmentations of a single sample in a simple but effective form. With a model $f$ trained on the training (in-distribution) data, we denote the softmax output of $\bm{x}$ as $f(\bm{x})$. Suppose we fix a transformation method $T$. We define the consistency score of a given data $\bm{x}$ as the inner product of the model output of $\bm{x}$ and $T(\bm{x})$, which is $\langle f(\bm{x}),f(T(\bm{x}))\rangle$.

To further enlarge the gap of the model output for in- and out-distribution data, we use a fixed temperature scaling technique. Given a sample $\bm{x}$, we denote the softmax output with temperature scaling parameter $t$ as $f(\bm{x};t)$. And, define our final anomaly score for a given sample $\bm{x}$ as

Based on the observation (Figure 1), the model $f$ tends to make more consistent outputs for in-distribution data than out-distribution data. So $S(\bm{x})$ should be close to $0$ for in-distribution data and $S(\bm{x})$ should be approximately $1$ for out-distribution data. Such score assigning process is the basis of our theoretical analysis in Section 5.2.

In anomaly detection, algorithms with different settings often cannot be measured simultaneously. For example, some algorithms focus on the one-class-vs-all setting [32, 11, 46, 12], while others focus on the dataset-vs-dataset setting [25, 50] only. There are also algorithms that cover multiple settings [17, 39]. Since our algorithm relies on the remaining classes, i.e. multiple classes in the training set, those one-vs-all algorithms are not compared. The SOTA algorithm of advanced dataset is CSI [39]. We also cover MSP [16], ODIN [25], Mahalanobis [24] and Rot [17].

Following previous works [17, 24, 39], we use the AUROC (Area Under Receiver Operating Characteristic curve) as our evaluation metric. It summarizes True Positive Rate (TPR) against False Positive Rate (FPR) at various threshold values. The use of the AUROC metric frees us from fixing a threshold and provides an overall comparison metric.

Dataset settings are diverse in anomaly detection. We mainly consider the advanced ImageNet [9] settings, including full set settings and two kinds of subset settings. We also verify on CIFAR [21] settings and put the results in Appendix I due to limited space.

In the full-size ImageNet setting, the whole validation set is treated as the in-distribution test set. Since the ImageNet training set already contains all-embracing natural scenery, the corresponding out-distribution dataset is chosen to be a publicly available artificial image dataset from Kaggle¹¹1https://www.kaggle.com/alamson/safebooru. We use the first 50000 figures since the ImageNet validation dataset is of the same size. Some examples of the dataset are depicted in Figure 7 in Appendix B. We will call this setting ImageNet vs. Artificial.

Additionally, two sources of subset settings are included. The ImageNet-30 subset setting is used in relevant researches [17, 39]. The corresponding out-distribution datasets includes CUB-200 [43], Stanford Dogs [20], Oxford Pets [30], Places-365 [49] with small images (256*256) validation set, Caltech-256 [14], and Describable Textures Dataset (DTD) [8]. Beyond that, we also validate our algorithm on several public ImageNet subset combinations introduced by other works [10, 41] and public sources²²2https://github.com/MadryLab/robustness.These additional three ImageNet subsets are Living 9, Geirhos 16, and Mixed 10. The out-distribution categories are randomly selected from the complement set. The detailed subset hierarchy and configuration are shown in Appendix B. In total, we consider four subset settings.

We notice the performance of anomaly detection is highly affected by the trained classifiers. So we train networks with three random seeds per setting and report the mean and variance. The training details are in Appendix H.

This section covers the main anomaly detection results including the full ImageNet setting (Table 1) and four ImageNet subset settings (Table 2 and 3).

We show computational costs of all considered algorithms in this section since running time is important in practical use. We run all experiments on an RTX3090 graphics card. The post-hoc algorithms, ODIN and TTA-AD, do not include a training phase, while the Mahalanobis needs a little bit of time to train. All implementations are based on official code sources (See Appendix G). Figure 2 shows that TTA-AD only requires $10\%\sim 40\%$ running time of advanced algorithms while maintaining comparable or better detection results (Table 3). The difference in running time is mainly due to the use of different techniques as summarized in Section 2 and Table 4. The number of parameter searching groups comes directly from the original papers and codes. The running time of CSI is missing because introducing contrastive learning is often considered much more time-inefficient than plain training which is the default training methods of the three algorithms in Figure 2. The details, criteria for choosing comparison algorithms and running times on other network architectures are stated in Appendix F.

Performance tables in this paper include several different augmentation methods of TTA-AD. Although the AUROC values fluctuate with different augmentation methods and filter radius, the performance is similar. With linear searching across the FFT filter radius and temperature settings, we demonstrate that they have a small effect on the anomaly detection performance within a wide range.

For the FFT filter radius, we provide ablation studies across a wide range of filter radius settings, ranging from 40 to 160 pixels, in Figure 4. Among all settings, TTA-AD does not degrade much and still outperforms other algorithms as shown in Table 3, which demonstrates that the performance of TTA-AD is not very sensitive to the filter radius. A possible reason is that the energy is highly concentrated in the low frequency space instead of high frequency parts. More ablations of other settings are in Appendix J.

Unlike the previous algorithms [24, 25], which consider large-scale candidates of temperature scaling (e.g., from 1 to 1000) and then do the grid-search with prior out-distribution knowledge, we empirically find that the best temperature for our method is stable around 5 and the performance does not decrease much within the considered wide temperature range. All our experiments set the temperature parameter to 5 if not specified. Ablation studies for temperature parameter are shown in Figure 4, and more results can be found in Appendix K. All curves show that TTA-AD is not sensitive to the temperature parameter, thus we do not have to tune it with out-distribution prior.

Our anomaly score (Eqn (1)) adds up all class probabilities rather than focusing only on the maximum predicted probability [16, 17]. The main difference between consistency evaluation and maximum predicted probability comes from the remaining score $S_{rem}$, defined as

where $j=\arg\max f_{j}(\bm{x})$ is the predicted class with the highest probability of the input $\bm{x}$.

Figure 5 shows the beneficial effect of the remaining classes. First, Figure 5(a) presents the distribution of maximum probability. Then, we calculate the mean and variance of the remaining scores $S_{rem}$ in each evenly divided interval, as Figure 5(b) shows. To draw the Figure 5(b), we first evenly divide the interval $(0,1)$ in Figure 5(a) into 50 parts. Then we pick one interval $(P_{max}-\epsilon,P_{max}+\epsilon)$, select all the samples whose maximum predicted probability is between $(P_{max}-\epsilon,P_{max}+\epsilon)$, and compute the mean and variance of those selected samples’ remaining scores $S_{rem}$. For every interval, we process the in- and out-distribution data separately indicated by the red and blue lines.

Intuitively, samples from both in- and out-distributions with similar $P_{max}$ values are mixed within one same interval (Figure 5(a)). Figure 5(b) shows that for samples within the same interval, the remaining scores of the in-distribution samples are statistically larger than that of out-distribution samples. Therefore, adding the remaining scores to the data within the same interval in Figure 5(a) makes the in- and out-distribution samples distinguishable. When this process happens in each interval, we obtain our inner product scores ($1-S(x)$) as depicted in Figure 5(c), which improves the maximum probability method from Figure 5(a).

Comparing the maximum probability (Figure 5(a)) and consistency evaluation methods (Figure 5(c)), our method is more discriminative. Generally, a larger gap in Figure 5(b) indicates a higher performance improvement. This empirical analysis is consistent with our numerical results in Section 4. Similar observations across network architectures and datasets can be found in Appendix C.

The most fundamental and common part of anomaly detection is attaching a real-valued score calculated by the algorithm to each sample. We then obtain a sequence by sorting all samples according to their scores from small to large. If we label the out- and in-distribution samples as 0 and 1, respectively, we will finally get a mixing binary sequence. Intuitively, a sequence with good sorting (like $00\dots 011\dots 1$) is preferred, but how to quantitatively describe the mixing degree? Empirically, we use AUROC but its discontinuity hinders the development of anomaly detection theory. To analyze our algorithm, we propose to use expected runs [44, 4] as a continuous surrogate to approximately measure the confusion degree of a binary sequence:

For example, the sequence $\underline{00}$ $\underline{111}$ $\underline{000}$ $\underline{11}$ $\underline{000}$ has 5 runs. Ideally, the in-distribution and out-distribution samples are completely separable ($\underline{00...0}$ $\underline{11...1}$), so the runs number is 2. On the contrary, the runs number of the worst case, when the two kinds of samples alternate in the sequence, equals the sequence length.

Assume the in-distribution and out-distribution sample scores are drawn from two distributions. Then the expected runs number evaluates the similarity of the two distributions. The above two examples suggest that more separable distributions lead to a smaller expected runs number. Now we show how to calculate the expected runs number for any given two distributions in Lemma 5.2.

In the rest of the paper, we only consider the integral term while ignoring the little $o$ term.

We will derive a sufficient condition based on the expected runs number to identify our algorithm’s effectiveness. The supports of $f(x)$ and $g(x)$ are $[0,1]$. Considering the two distributions in real datasets (see Figure 10 in Appendix D.3), we model the two distributions as Beta distributions and denote the runs number as $R(\alpha_{1},\beta_{1},\alpha_{2},\beta_{2})$. Lemma 5.3 investigates how the Beta distribution parameters $\alpha_{1},\beta_{1},\alpha_{2},\beta_{2}$ increases/decreases the expected runs number.

For example, when $\alpha_{1}>\alpha_{2}$, we see $\mathbb{E}R(\alpha_{1},\beta_{1},\alpha_{2},\beta_{2})\geq\mathbb{E}R(\alpha_{1}+1,\beta_{1},\alpha_{2},\beta_{2})$. We leave the necessary and sufficient conditions for future work. Limited to space, we put the detailed proof and statements in Appendix D.

More generally, the expected runs provides a general theoretical surrogate for anomaly detection. In order to analyze the pros and cons of the algorithm performance, we can model the distribution of anomaly scores of in- and out-distribution, compute the runs, and derive runs with respect to distribution parameters. This will let us know how the distributions affect the runs number, which may guide designing and tuning the algorithms.