Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Killing it with Zero-Shot: Adversarially Robust Novelty Detection

Hossein Mirzaei, Mohammad Jafari, Hamid Reza Dehbashi, Zeinab Sadat Taghavi, Mohammad Sabokrou, Mohammad Hossein Rohban

TL;DR

This work tackles novelty detection under adversarial perturbations by proposing ZARND, a zero-shot ND framework that employs an adversarially robust pretrained backbone to extract resilient features and a k-NN based anomaly score computed from distances in the feature space. The method discards classifier heads to leverage intermediate representations and uses a simple yet effective scoring rule $S=\sum_{d\in D_{\text{sorted}}} d$ over the $k$-nearest distances with $k=2$. Empirically, ZARND achieves state-of-the-art robustness against adversarial attacks across multiple datasets, while maintaining strong performance in benign settings, and is validated with extensive experiments against PGD and AutoAttack. The work highlights the importance of robust feature representations for ND and provides publicly available code to foster further research and practical deployment in safety-critical domains.

Abstract

Novelty Detection (ND) plays a crucial role in machine learning by identifying new or unseen data during model inference. This capability is especially important for the safe and reliable operation of automated systems. Despite advances in this field, existing techniques often fail to maintain their performance when subject to adversarial attacks. Our research addresses this gap by marrying the merits of nearest-neighbor algorithms with robust features obtained from models pretrained on ImageNet. We focus on enhancing the robustness and performance of ND algorithms. Experimental results demonstrate that our approach significantly outperforms current state-of-the-art methods across various benchmarks, particularly under adversarial conditions. By incorporating robust pretrained features into the k-NN algorithm, we establish a new standard for performance and robustness in the field of robust ND. This work opens up new avenues for research aimed at fortifying machine learning systems against adversarial vulnerabilities. Our implementation is publicly available at https://github.com/rohban-lab/ZARND.

Killing it with Zero-Shot: Adversarially Robust Novelty Detection

TL;DR

This work tackles novelty detection under adversarial perturbations by proposing ZARND, a zero-shot ND framework that employs an adversarially robust pretrained backbone to extract resilient features and a k-NN based anomaly score computed from distances in the feature space. The method discards classifier heads to leverage intermediate representations and uses a simple yet effective scoring rule over the -nearest distances with . Empirically, ZARND achieves state-of-the-art robustness against adversarial attacks across multiple datasets, while maintaining strong performance in benign settings, and is validated with extensive experiments against PGD and AutoAttack. The work highlights the importance of robust feature representations for ND and provides publicly available code to foster further research and practical deployment in safety-critical domains.

Abstract

Novelty Detection (ND) plays a crucial role in machine learning by identifying new or unseen data during model inference. This capability is especially important for the safe and reliable operation of automated systems. Despite advances in this field, existing techniques often fail to maintain their performance when subject to adversarial attacks. Our research addresses this gap by marrying the merits of nearest-neighbor algorithms with robust features obtained from models pretrained on ImageNet. We focus on enhancing the robustness and performance of ND algorithms. Experimental results demonstrate that our approach significantly outperforms current state-of-the-art methods across various benchmarks, particularly under adversarial conditions. By incorporating robust pretrained features into the k-NN algorithm, we establish a new standard for performance and robustness in the field of robust ND. This work opens up new avenues for research aimed at fortifying machine learning systems against adversarial vulnerabilities. Our implementation is publicly available at https://github.com/rohban-lab/ZARND.
Paper Structure (10 sections, 8 equations, 2 figures, 2 tables)

This paper contains 10 sections, 8 equations, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background & Related Work
  3. Problem Statement
  4. Method
  5. Initialization: Feature Extraction
  6. Calculate Distance: Computing Euclidean Distances
  7. Sorting: Ordering Euclidean Distances
  8. Anomaly Score: Calculating k-NN-Based Score
  9. Experimental Results
  10. Conclusion

Figures (2)

  • Figure 1: This plot evaluates ND methods—MSADreiss2021mean, Transformalycohen2021transformaly, PrincipaLSlo2022adversarially, OCSDFbethune2023robust, APAEgoodge2021robustness, and ZARND (Ours)—for their robustness, measured in AUROC (%) on the CIFAR-10 dataset. It highlights ZARND's superior performance and emphasizes the need for more robust ND algorithms.
  • Figure 2: The four key steps of our ND framework are illustrated. (a) Initialization: Extracting features from the normal set. (b) Calculate Distance: Computing the Euclidean difference between the test sample and features from the normal set. (c) Sorting: Ordering the distances from smallest to largest. (d) Anomaly Score: Summing up the first $K$ smallest distances to generate the anomaly score, where $K = 2$.