Framing Algorithmic Recourse for Anomaly Detection

Given a record or data instance with categorical features, the tuple of entities is anomalous when one or more of the entities are out-of-context with respect to the remaining entities (Das and Schneider, 2007) with unexpected co-occurrence patterns. We use a Transformer (Vaswani et al., 2017) based architecture to jointly model the context of the entities of records. Transformers have been extensively utilized in other applications on text, image and tabular data (Huang et al., 2020). A record can be considered as a sequence of entities, without a predefined ordering of domains or any semantic interpretation of the relative ordering. Transformer based architectures are appropriate for tabular data with categorical features since (i) they can handle large cardinality values for each category and are scalable (ii) can provide contextual representations of entities (iii) can model context with a prespecified ordering of domains and do not consider any relative ordering among the domains (categories). We adopt an encoder-decoder architecture, similar to language models (Devlin et al., 2019) with the objective to predict the likelihood of each entity in a given record with possible corruptions. The predicted likelihood for each entity is conditioned on the context—implicitly capturing the pair-wise and higher order co-occurrence patterns among entities.

Records in tabular data with categorical features can be considered as tuple of entities, with data specific inherent relationships between the domains (attributes). For instance in the case of shipment records, products being shipped are closely related to the company trading them and their origin. Many real-life applications involve tabular data which can be represented as a heterogeneous graph or Heterogeneous Information Network (HIN). A HIN (Sun et al., 2011) is formally defined as a graph $\mathrm{G}=(V,E)$ with a object type mapping function $\phi:V\rightarrow\mathcal{A}$ and edge type mapping function $\psi:E\rightarrow\mathcal{R}$. Here $v\in V$ are the nodes representing entities, $\phi(v)\in\mathcal{A}$ are the domains, $e\in E$ are the edges representing co-occurrence between entities and $\psi(e)\in\mathcal{R}$. A metapath (Sun et al., 2011) or metapath schema is an abstract path defined on the graph network schema of a heterogeneous network that describes a composite relation $\mathbf{R}=R_{1}oR_{2}\ldots R_{l}$ between nodes of type $A_{1},A_{2}\ldots A_{l+1}$, capturing relationships between entities of different domains. There can exist multiple metapaths, and we consider $\mathcal{R}$ and thus the metapaths to be symmetric in our problem setting. Metapaths have been utilized in similarity search in complex data, and to find patterns through capturing relevant entity relationships (Cao et al., 2018). Recent approaches on knowledge graph embeddings (KGE) (Wang et al., 2017) have demonstrated their effectiveness in capturing the semantic relationships between objects of different types in knowledge graphs which are HINs. Many approaches for KGE consider symmetric relationships as in our case, and is more generally applicable. We choose one such model DistMult (Yang et al., 2014) to obtain KGE for the entities in our data. DistMult uses both node and edge embeddings to predict semantically similar nodes, since it models relationships between entities in form of $<e_{a},R,e_{b}>$.

In generating counterfactuals for an anomalous record, we intend to replace the entity $e_{j}$(or entities) which is predicted to have low likelihood by the explainer model, given the context comprising of the other entities in the record. The intuition is to replace such entities with other entities (of the corresponding domain) which are semantically similar to the other entities in the record. Let $\textbf{x}_{a}$ be the anomalous record and let entity $e_{j}^{p}$ in domain $d_{j}$ be selected for replacement. In this task, we utilize the associated HIN constructed from the data, along with the set of metapaths $MP=\{mp_{1},mp_{2}\ldots mp_{q}\}$ that are defined using domain knowledge. Here metapath $mp_{i}$ is of the form $\{d_{a},d_{b}\ldots d_{i}\}$. Thus, candidates to replace $e_{j}^{p}$ are selected using the metapaths that contain $d_{j}$. Let us consider one such metapath $mp_{p}$ such that $d_{j}\in mp_{p}$, with relations of $(d_{i},d_{j})$ and $(d_{j},d_{k})$. Let the respective entities in $\textbf{x}_{a}$ for $d_{i}$ and $d_{k}$ be $e_{i}^{a}$ and $e_{k}^{a}$. In a generated counterfactual $\textbf{x}_{cf}$, the entity $e_{j}^{cf}$ that replaces $e_{j}^{a}$ should ideally be semantically similar to $e_{i}^{a}$ and $e_{k}^{a}$. KGE can be effectively used for this task. This idea is described in Figure 2. We find $K$ nearest entities to $e_{i}^{a}$ and $e_{k}^{a}$, belonging to domain $d_{j}$. Note that it is possible that $d_{i}$ or $d_{k}$ is null based on the schema of $mp_{p}$. We replace the entities in the domains with low likelihood with all combinations of the candidate replacements for the respective domains to obtain the set of candidate counterfactuals, of which $K$ least anomalous are chosen. The steps are summarized in Algorithm 1.

Recourse Correctness or validity (Mothilal et al., 2020) captures the ratio of counterfactuals that are accurate in terms obtaining the desired outcome from the blackbox prediction model. For unsupervised anomaly detection since $\mathcal{M}_{AD}$ provides a real valued likelihood (or anomaly score), a direct prediction (decision value) is unavailable. Recourse Coverage (Rawal and Lakkaraju, 2020) refers to quantification of the criterion that the algorithmic recourse provided covers as many instances as possible. Distance (Crupi et al., 2021; Karimi et al., 2020b) or proximity measures the mean feature-wise distance between the original data instance and the set of recourse candidates. Distance is often calculated separately for categorical and continuous attributes. For continuous attributes $l_{p}$ norms (Dhurandhar et al., 2018) or their combinations are used whereas for categorical(discrete) variables overlap measure (Chandola et al., 2007) $\mathbbm{1}(x_{i}=x_{j})$ has been used. With purely categorical attributes, this measure however fails to convey any information other than merely how many of the attributes are different in the counterfactual.

Cost (Crupi et al., 2021; Karimi et al., 2020a) refers to the cost incurred in changing a particular feature value in a recourse candidate. Prior works have utilized $l_{p}$ norms to quantify this criteria, for real-valued features. In our problem scenario, this metric is directly not applicable without any external real-world constraints which can help quantify the difference in cost in changing $x_{i}$ to $x_{j}$ vs. $x_{k}$. Diversity (Mothilal et al., 2020) refers to the feature-wise distances between the set of recourse candidates. Diversity encourages sufficient variation among the set of recourse candidates so that it increases the chance of finding a feasible solution. However, it has been noted that in certain cases diversity as an objective correlates poorly with user cost (Yadav et al., 2021). Sparsity (Mothilal et al., 2020) refers to the number of features that are different in the recourse candidates, with respect to the original data instance.

We propose a new set of metrics based on previously defined metrics, which are more suited to our problem setting.

Sparsity-Index: Sparsity is an important objective along with diversity that encourages minimal change is made to a data instance in terms of features. To capture this notion, we define Sparsity Index for tabular data with categorical features. Let $\textbf{x}_{a}$ be the anomalous record, and $d_{j}$ be the $j^{th}$ domain or feature.

The values of Sparsity Index $\in[0.5,1)$, with the low value corresponding to modification of all feature values and the maximum value corresponding to none.

Coherence: We define coherence as measure to quantify the consistency of the counterfactuals similar to density consistency (Karimi et al., 2020b). Let $\mathcal{D}_{p}$ be the set of domains which are modified in $\textbf{x}_{a}$ to obtain a counterfactual $\textbf{x}_{cf}$, $\mathcal{D}_{r}$ be the remaining domains. Let $e_{j}$ be the entity in $\textbf{x}_{cf}$ for domain $j$. Coherence measures the mean probability of co-occurrence of the entities $e_{i}\in D_{p}$ with $e_{j}\in D_{r}$. Maximizing coherence implies $e_{j}^{r}$ in $\textbf{x}_{a}$ is replaced with a candidate entity $e_{j}^{cf}$ in $\textbf{x}_{cf}$ which has a high probability of co-occurrence given the context of other entities of $D_{r}$ in $\textbf{x}_{a}$, and leads to plausible counterfactuals.

Conditional Correctness: This metric quantifies the validity of the counterfactuals, conditional upon the underlying anomaly detection model $\mathcal{M}_{AD}$ which has a scoring function $score_{\mathcal{M}}()$. Let $\mathcal{D}_{k}$ be a set of randomly chosen data instances from the training and testing set. Let $\textbf{x}_{a}$ be the anomalous record and let the rank of $\textbf{x}_{a}$ in $\textbf{x}_{a}\cap\mathcal{D}_{k}$ be $r$, sorted by $score_{\mathcal{M}}()$ with appropriate order. Without loss of generalization, we can assume a higher score indicates a more normal or nominal data instance and a low score indicates anomalousness. For $x\in Y$, where Y is the set of counterfactuals, conditional correctness can be defined as

This implies that $x$ is ranked lower in terms of being an anomaly, since higher ranked data instances are more anomalous. Ranking is a more suitable approach to designing a metric than utilizing thresholds which are data and application dependant an is difficult to determine. The relative ordering of records are important in this setting, since test instances are sorted based on $score_{\mathcal{M}}()$.

Feature Accuracy: The concept of anomaly in tabular data with categorical variables has been described as one or more attributes being out of context with respect to the others, as discussed in Section 2. Therefore, it is important to accurately measure how well can a model identify which of the domain values should be modified in $\textbf{x}_{a}$, and relates to the explanation aspect of algorithmic recourse. This requires having a Gold Standard (ground truth) knowledge where we know which domain values (features) have been corrupted and the entities for those domains are out of context. Let $dom$ be the set of domains (features) with $m$ domains. Let $\mathbbm{q()}$ be a binary valued function that has value $1$ if the domain value is changed in counterfactual $\textbf{x}_{cf}$ from $\textbf{x}_{a}$ $(r_{j}\in\textbf{x}_{a}\rightarrow x_{j}\in\textbf{x}_{cf})$ is an actual cause of the anomaly or if a domain value remains unchanged if it was not a cause of the anomaly.

Heterogeneity: Although diversity is an important objective for recourse candidates, existing diversity metrics like Count Diversity (Mothilal et al., 2020) are inadequate. A trivial random modification of all feature values will maximize such metrics for our setting with strictly categorical features, where distance between discrete feature values is computed using overlap measure. Two factors are important here: (i) the variation among the entities that are proposed to replace original entity in $\textbf{x}_{a}$ and (ii) the correct domain’s value is modified or not. We require the Gold Standard (ground truth) to determine whether the counterfactual modifies the a correct domain’s value. In our experiments, use of synthetic anomalies enables calculation of this metric. Between any two pair of recourse candidates, heterogeneity encourages dissimilarity while taking into account if both the pair of counterfactuals modify the correct domain’s value. Let $m$ be the number of domains, $K$ be the size of the set of counterfactuals $Y$, and $\mathbbm{1}(\mathbbm{q})$ be 1 if the correct domain has been modified.

The datasets used in for the experimental and evaluation setup are real world proprietary datasets of shipping records obtained from Panjiva Inc (Panjiva, 2019). Specifically we use 5 datasets with no overlap, constructed from a larger corpus of records. We consider records of a time period as the training set and subsequent time as the test set. We fix the test set size to 5000. The dataset details are described in Table 1. The training set of each dataset is used to train the AD model as well as the KGE model. Since we do not have ground truth data of anomalies, we use synthetic anomalies generated from the test set of each dataset following prior work (Chen et al., 2016), and allows us to analyze the results using the ground truth knowledge of what caused the record to be an anomaly.

The area of algorithmic recourse specifically for anomaly detection is unexplored, and to the best of our knowledge only one prior work RCEAA (Haldar et al., 2021) exists on this. Prior work on algorithmic recourse deals with classification scenarios and they are not directly applicable to our setting. Moreover, as previously noted, most prior work deals with real valued or mixed valued data where the cardinality of categorical variables are significantly lower. Also, most prior approaches convert discrete variables to binary vectors through one-hot encoding and treat them as real valued vectors. We choose the following baselines for comparison:

Replace-m: This approach generates an initial candidate set of all possible records by replacing the entity values in $m$ domains simultaneously, using all possible combinations. The records in this candidate set are scored by the given anomaly detection model, and $K$ top scored (least anomalous) records are considered as set of counterfactuals. We set $m=1$ due to computational limitations.

FIMAP (Chapman-Rounds et al., 2021): FIMAP is a model based approach for generating counterfactuals through adverserial perturbations using a perturbation network, for a classification setting with known labels. To train the proxy classifier, a set of synthetic anomalies (assigned label $y=0$) and normal instances (assigned label $y=1$). The perturbation network, which generates counterfactuals, is trained by providing synthetic anomalies and passing the perturbed data instance to the pretrained proxy classifier, to obtain the desired label ($y=1$).

RCEAA (Haldar et al., 2021): RCEAA uses an optimization based objective to exactly calculate a set of $K$ counterfactuals. Since the optimization requires real valued inputs, we adopt real-value relaxation on the one-hot encoded discrete representation of $\textbf{x}_{a}$ and use soft-threshold approach to obtain discrete outputs.

Xformer-R: This method utilizes the explainer model to identify entities in an anomaly with low likelihood. Counterfactuals are generated by replacing the entity in the identified domains $\textbf{x}_{a}$ with entity values that are sampled uniformly from the domain.

We present the results for the metrics discussed in Section 5.2. For conditional correctness, we sample a set of records containing both known synthetic anomalies and normal data instances. It is important to note that no single metric quantifies the different desiderata of the generated counterfactuals. Beginning with feature accuracy, which is reported in Table 2(a) we see the approaches based on Transformer based explainer (Xformer-R and CARAT) have significantly better performance compared to the others. This demonstrates that the explainer can effectively identify entities in records which do not conform to expected co-occurrence patterns. For heterogeneity, the results are presented in Table 2(b), while CARAT performs well, but FIMAP has somewhat better performance. This can be explained by the fact that counterfactuals generated by FIMAP modify most of the entity values—which violates the sparsity objective. Next we consider  coherence, which that captures how semantically similar the replaced entities are to the remaining ones in the counterfactuals generated. As reported in Table 2(c), we find CARAT performs significantly better. This implies the generated counterfactuals are consistent with the underlying data distribution. Considering sparsity, FIMAP and RECEAA have significantly lower values as shown in Table 2(d), since the counterfactuals have multiple feature values modified from the given anomaly. Replace-m has a high sparsity since a single entity is modified (m=1). Xformer-R and CARAT have similar performance in terms of sparsity. Lastly, for conditional correctness reported in Table 2(e) we find Replace-m has perfect score due to performing exhaustive search for least anomalous records. CARAT shows competitive performance here, better than other baselines. Since no single metric comprehensively captures the requisite objectives that we are trying to maximize in generating counterfactuals—we summarize the model performances across all the metrics. For each approach, we first obtain the average of the values across all datasets and then normalize them. Then we perform an unweighted average across all of these normalized metrics values to find a single performance value. The results are reported in Table 2(f), which shows CARAT has a significant overall advantage.

The process of algorithmic recourse is inherently dependant on the underlying anomaly detection model which finds the anomalous data instances. Thus it is important to understand the variation in performance of our proposed approach in the context of the underlying AD model $\mathcal{M}_{AD}$. Here $\mathcal{M}_{AD}$ is a black-box model, and assumed to perfectly capture the underlying data distribution to find data instances that are true anomalies. We choose two embedding based algorithms for tabular data with strictly categorical features as $\mathcal{M}_{AD}$, APE (Chen et al., 2016) and MEAD (Datta et al., 2020). We apply APE and MEAD on test sets of each of the datasets, consider $1\%$ of the lowest scored records as anomalies, and apply CARAT with the respective AD models on the corresponding anomalies. Comparison of the applicable metrics defined in Section  5.2 for the generated counterfactuals across multiple metrics are reported in Table 3. We observe that similar performance is obtained in both cases, demonstrating the stability of our proposed approach.

One of the major challenges of generating recourse is the computational complexity. We consider the computational cost in the execution phase, after all applicable pretraining and set up has been completed. An approach with with exponential computational complexity would be simply infeasible in most practical scenarios. For instance the Replace-m approach outlined in Section 6.2, the complexity is $O(\Sigma_{1}^{l}\prod d_{i},d_{i+1}..d_{i+m})$, where $m$ domains are chosen to be modified at most, $d_{i},d_{i+1}\dots d_{i+m}$ are the cardinalities of the $m$ domains, and $l={|d|\choose m}$. RCEAA (Haldar et al., 2021) also suffers from high computational cost, as shown in Figure 3. The major bottlenecks in such an optimization based approach are: (i) expensive loss function (ii) grid search for hyperparameters (iii) operations on a very high dimensional vector due to one-hot encoding. Our proposed approach is computationally efficient, since the explanation phase uses only a pretrained model with linear time complexity and the counterfactual generation phase that requires finding nearest neighbors is sped up using an indexing library (Johnson et al., 2019).

We perform a short case study based on one of the anomalies detected from test set of Dataset-1. The detected anomaly and a set of counterfactuals are shown in Figure 4. Our explainer model finds that the entity in domain HS Code in the anomalous record $\textbf{x}_{a}$ has low likelihood of occurrence in its context. This is supported by the empirical data, as we find goods represented by the entity $<$HS Code:7211$>$ was previously traded by the neither the consignee (buyer) nor the shipper. Additionally, $<$HS Code:7211$>$ was not previously transported through the ports of lading and unlading in the record. Our explainer only presents a low score for this entity, and not the others in the record although their context, which contains $<$HS Code:7211$>$, is altered. This demonstrates that the model can accurately predict likelihood from partially correct contextual information—which is the case for anomalous records. Let us look at the counterfactuals, where $<$HS Code:7211$>$ is modified to alternate values. $<$HS Code:7211$>$ refers to products of iron or non-alloy steel. Firstly $<$HS Code:7210$>$, $<$HS Code:7225$>$ and $<$HS Code:7219$>$ refer to products very similar to $<$HS Code:7211$>$, specifically rolled or non-rolled steel or alloy products. $<$HS Code: 2818$>$ and $<$HS Code:7304$>$ are metal products as well. So the counterfactuals are essentially suggesting the buyer to obtain alternate products from the supplier (shipper). This can be explained based on the data, the particular type of goods $<$HS Code:7211$>$ are generally not sourced from the given origin and the shipper evidenced by any similar prior occurrences. A practical explanation might relate to industrial production and proficiency patterns, since certain regions specialize in specific products. From prior records it is further observed that the consignee buys metal and alloy goods, such as with HS Codes 7210, 7323, 7304, 7225 and 7310. Thus CARAT provides meaningful counterfactuals for detected anomalies.