Source-linked AI summary
Robust Anomaly Detection in Images using Adversarial Autoencoders
Laura Beggel, Michael Pfeiffer, Bernd Bischl
TL;DR
Autoencoder anomaly detection can be compromised when a small fraction of the training data consists of anomalies, since training may teach the model to reconstruct them. This paper combines reconstruction error with latent-space likelihood and rejects potential anomalies during training; iterative refinement improves balanced accuracy across the investigated contaminated-training scenarios.
Problem
Autoencoder anomaly detection commonly assumes a normal-only training set, but clean data may be unavailable and even slight contamination can compromise detection.
Source: §1 · p. 1Method
Results
For all investigated scenarios with 5% training anomalies, ITSR yields better balanced accuracy than standard autoencoders and adversarial autoencoders; it improves over the conventional AE by more than 30% on MNIST and over the AAE by more than 20% in general.
Source: §5 · pp. 7–8Takeaways & Limitations
Iterative refinement improves detection particularly for observed anomalies, while performance on unobserved anomalies is at par or slightly better than other methods.
Source: §5 · p. 8The imposed latent prior must be a distribution from which samples can be drawn.
Source: §3 · p. 4
Abstract
from arXiv · showhide
Reliably detecting anomalies in a given set of images is a task of high practical relevance for visual quality inspection, surveillance, or medical image analysis. Autoencoder neural networks learn to reconstruct normal images, and hence can classify those images as anomalies, where the reconstruction error exceeds some threshold. Here we analyze a fundamental problem of this approach when the training set is contaminated with a small fraction of outliers. We find that continued training of autoencoders inevitably reduces the reconstruction error of outliers, and hence degrades the anomaly detection performance. In order to counteract this effect, an adversarial autoencoder architecture is adapted, which imposes a prior distribution on the latent representation, typically placing anomalies into low likelihood-regions. Utilizing the likelihood model, potential anomalies can be identified and rejected already during training, which results in an anomaly detector that is significantly more robust to the presence of outliers during training.
1. Introduction
The introduction identifies contamination of supposedly normal training data as a vulnerability for autoencoder anomaly detection. It proposes adversarial autoencoders, latent-space sample rejection, and retraining to improve robustness.
1. Introduction
- Autoencoders use reconstruction error as an anomaly score because images unlike those seen in training are expected to reconstruct poorly.The encoder maps images to lower-dimensional representations, and the decoder reconstructs them.Source: §1 · p. 1
- Even slight training-set contamination can make autoencoders reconstruct anomalies as well as normal images, undermining anomaly detection.Clean datasets may be unavailable because of annotation errors or the cost and time of expert inspection.Source: §1 · p. 1
- Adversarial autoencoders impose a prior on latent representations; combining likelihood with reconstruction error is proposed to improve anomaly scoring.The contribution builds on adversarial autoencoders (Makhzani et al., 2015).Source: §1 · pp. 1–2
- The proposed approach combines reconstruction error with latent-space likelihood, rejects potential training anomalies using a 1-class SVM variation, and retrains to increase separation.The authors report significantly increased robustness to anomalies present during training compared with Hinton & Salakhutdinov (2006) and Makhzani et al. (2015).Source: §1 · pp. 1–2
2. Related work
Related work spans reconstruction-based, probabilistic, and adversarial autoencoder approaches to anomaly detection. Prior methods address aspects of contaminated training data, but some do not use anomaly information to refine the training set.
2. Related work
- Denoising and regularized autoencoders connect reconstruction to data structure or density, while structured energy-based models use an energy score for anomaly detection (Zhai et al., 2016).Denoising autoencoders learn to reconstruct noise-corrupted images; regularized autoencoders were linked to data-generating density (Bengio et al., 2013).Source: §2 · p. 2
- Earlier AAE anomaly detection used a Gaussian-mixture prior, but a purely unsupervised version did not separate anomalies from normal images into distinct clusters.That work proposed conditioning on class labels or training an explicit rejection class with random images.Source: §2 · p. 2
- Robust deep autoencoders combine denoising with robust PCA, while a deep-belief-network and 1-class-SVM method handles training anomalies without using them to refine the training set.The robust deep autoencoder showed significantly better MNIST results in the presence of training anomalies.Source: §2 · p. 2
3. Autoencoders and their Limitations
Conventional autoencoders detect anomalies through reconstruction error, but this approach assumes a clean training set. With contaminated data, continued training can make anomalies easier to reconstruct and weaken detection; an adversarial autoencoder adds a latent prior that provides another anomaly signal.
3. Autoencoders and their Limitations
- An autoencoder encodes an image into a lower-dimensional latent representation, decodes it into a reconstruction, and flags images whose reconstruction error exceeds a threshold.The threshold is selected from training reconstruction errors, typically using their maximum or a large percentile; this procedure assumes the training set contains only normal observations.Source: §3 · p. 2
- Because training minimizes reconstruction error over all examples, anomalies in a contaminated set are also rewarded with increasingly accurate reconstructions.Early stopping may limit this effect, but can also prevent precise reconstruction of normal training observations and lead to false detections.Source: §3 · pp. 3–4
- Continued training makes normal and anomalous reconstruction errors overlap, reducing TNR and Balanced Accuracy on the contaminated MNIST example.After 10,000 epochs the autoencoder reconstructs both classes with very similar error, while early stopping also leaves normal images less accurately reconstructed.Source: §3 · p. 3, Figure 1 · p. 3
- Reducing model capacity or stopping early can preserve reconstruction differences, but may impair normal-image reconstruction and raise the threshold, risking false negatives.The paper reports that early stopping can prevent the model from precisely reconstructing most normal training observations.Source: §3 · pp. 3–4
- Adversarial autoencoders impose a prior distribution on latent codes, so likelihood in latent space can complement reconstruction error as an anomaly signal.For the Fashion-MNIST example, test Pullovers have lower likelihood and higher reconstruction error than the T-shirt training class.Source: §3 · p. 4, Figure 3 · p. 4
- The proposed training strategy identifies likely anomalies during training and rejects them so subsequent autoencoder training focuses on the normal class.The strategy is motivated by preventing training anomalies from further improving their reconstruction quality.Source: §3 · p. 4
4. Robust Anomaly Detection
Adversarial autoencoders use latent-space likelihood alongside reconstruction error to detect anomalies, and iterative training-set refinement reduces the influence of likely outliers. On a Fashion-MNIST test, combining likelihood and reconstruction error improves balanced accuracy over either measure alone.
4.1. Likelihood-based Anomaly Detection
- Prior likelihood is an imperfect anomaly score, but performs similarly to reconstruction error alone and can complement it in a combined criterion.Anomalies in small local clusters may receive higher likelihood than normal examples near distribution boundaries, and the encoder may not reproduce the prior exactly.Source: §4.1 · p. 5
- On Fashion-MNIST T-shirt/Pullover, reconstruction and likelihood reached BAcc 0.72 and 0.73, while their combination reached 0.80.The test used a clean T-shirt training set and previously unseen Pullover anomalies.Source: §4.1 · p. 5
4. Robust Anomaly Detection
- With a unimodal prior, likely anomalies can occupy low-likelihood latent regions, where a 1-class SVM identifies candidates for exclusion or reduced training weight.When the true anomaly rate is known, the SVM boundary can be set to contain a fraction 1 − α of the dataset.Source: §4 · p. 4, §4.2 · p. 5
4.2. Iterative Training Set Refinement (ITSR)
- The SVM’s candidate points can be removed or downweighted before retraining, yielding representations that better capture the normal data manifold with less incentive to reconstruct outliers.Sample weights apply to both reconstruction and adversarial training losses.Source: §4.2 · p. 5
- ITSR pretrains on all samples, repeatedly detects latent-space candidates and refines the model on retained samples, then re-trains with selected candidates weighted negatively.Detection and refinement repeats d times, progressively increasing the number of excluded candidates.Source: §4.2 · pp. 5–6
- Re-training increases separation between normal and anomalous observations, while making high-likelihood anomalies more clearly poorly reconstructed.False positives are not all penalized: candidates are weighted negatively only when their reconstruction error exceeds the re-training threshold.Source: §4.2 · p. 6
5. Experimental Setup and Discussion of Results
Across the tested scenarios with 5% training anomalies, ITSR achieves higher balanced accuracy than standard and adversarial autoencoders. Its strongest gains are for anomaly types seen during training, while detection of novel types remains at par or slightly better than the comparison methods.
Experimental Setup
- Experiments use MNIST and Fashion-MNIST with α=5%, 1%, or 0.1%, and a 2D Gaussian-prior AAE; detection uses the 90th reconstruction-error and 10th likelihood percentiles.MNIST uses digit 0 as normal and 2 as anomalous; Fashion-MNIST uses T-shirt against Boot or Pullover.Source: §5 · pp. 6–7
Test set split
- Tests separate anomalies whose classes appeared during training from unseen classes, using an independent test set and different normal-to-anomaly ratios for the two splits.For MNIST, the observed split has a 1:1 normal-to-anomalous ratio, while the unobserved split has a 1:8 ratio.Source: §5 · p. 7
Results and discussion
- Across all α=5% scenarios ITSR had higher BAcc than AE and AAE; it exceeded AAE by more than 20% overall, reaching 30% on T-shirt/Pullover.The 30% improvement over AAE was for the most difficult Fashion-MNIST case.Source: §5 · pp. 7–8, Figure 5 · p. 8
- Observed-anomaly accuracy improves even when training contamination is 0.1%; for unobserved anomalies, ITSR performs at par or slightly better than the other methods.Standard AEs and AAEs perform similarly on observed and unobserved anomaly types.Source: §5 · p. 8
- After ITSR, anomaly reconstruction errors rise strongly while normal errors change little, increasing class separation despite some remaining overlap.The error comparison is shown for 5% training contamination, with similar observations at lower anomaly rates.Source: §5 · p. 8
6. Conclusion
ITSR uses adversarial autoencoders to address conventional autoencoders’ shortcomings with anomalous training instances. The conclusion highlights reduced reliance on clean training data and expert screening.
6. Conclusion
- Additional tests evaluate training anomaly rates α = {1%, 0.1%}, separating test examples with anomaly types observed during training from those with unobserved types.The passage describes these as results on an independent test set but does not provide cell values.Source: Table 1 · p. 9
- The authors report that ITSR compares favorably to state-of-the-art methods.The conclusion also describes increased robustness to anomalies in the training set.Source: §6 · pp. 8–9
- In scenarios with a known very low anomaly rate, ITSR can use an unprocessed dataset instead of expert-selected normal instances.The authors cite quality inspection as an example and say increased robustness reduces the need for a clean training dataset and expert information.Source: §6 · p. 9
- Although presented on image data, the authors say the approach translates to other high-dimensional data, including spectrograms and time series.They also note that the method requires no labels and could be extended to semi-supervised or active-learning settings.Source: §6 · p. 9