Active Anomaly Detection based on Deep One-class Classification

One-class classification (OCC) identifies objects of a specific class amongst all objects by primarily learning from a training dataset containing only the objects of the target class [13]. It detects whether new instances conform to the training dataset or not. On the other hand, the objective of anomaly detection (AD) is to separate abnormal data from a given dataset, which is a mixture of normal and abnormal data without ground truth annotations. Despite this difference, OCC has been widely applied to AD to learn the normality of a given dataset.

The most widely known shallow methods for OCC-based AD are One-Class SVM (OC-SVM) [20], and Support Vector Data Description (SVDD) [21]. They find a hyperplane and a hypersphere enclosing most of the training data, respectively. They deal with abnormal samples through hyper-parameters that allow some points to be put outside the estimated region. On the other hand, the works [7, 21] incorporate labeled data into SVDD to refine a boundary in a semi-supervised way. Tax et al. [21] enforce labeled abnormal samples to lie outside the hypersphere. Gornitz et al. [7] add one more constraint for labeled normal samples to be inside the hypersphere (See [22] for more details).

The shallow methods have been the solid foundation for OCC-based deep AD (OCC-DAD) [17, 3, 18, 26]. Most of them replace the shallow models with deep neural networks while using the same objective functions as in OC-SVM or SVDD. However, they commonly assume all training data are normal. We consider them as semi-supervised learning methods that exploit only labeled normal data while excluding labeled abnormal data. On the other hand, Ruff et al. [18] propose a method to incorporate labeled anomalies into One-Class Deep SVDD [17], a prevailing method in OCC-DAD. In addition, another line of OCC-DAD utilizes a generative adversarial network to exploit distorted anomalies adversarially [19]. However, it is difficult to identify the generated samples and guarantee that they resemble true anomalies.

According to the survey [22], the existing query strategies (QS) for OCC-based AD can be classified into three categories. First, data-based QSs [6] utilize data statistics such as posterior probabilities of samples; therefore, they require labeled observation even at the initial stage of active learning. The second category is model-based QSs [2, 11, 7], to which the following two QSs belong. High-Confidence [2, 11] selects samples that least match the normal class. It shares the view of common anomaly detection scenarios that identify the top instances from a ranked list of anomaly scores; thereby, it is a common and widely used QS in active learning-based AD. However, a recent study [25] shows that this greedy choice could be sub-optimal since some low-ranked samples could be more informative. The other QS in this category, Decision-Boundary [7], selects samples closest to a decision boundary. However, OCC-based AD models rely on hyper-parameters to learn an explicit boundary. The third category is hybrid QSs combining the former two categories. Since we tackle a dataset without any initial annotations in this work, we only consider the model-based QSs. Queried samples are utilized according to the semi-supervised learning methods described in Section 2.1.

Our query strategy with an adaptive boundary (AB) selects data samples closest to an adaptively searched boundary. It is similar to Decision-Boundary in terms of performing uncertainty sampling. AB is motivated by the contaminated normality of DSVDD. Although DSVDD learns normality in feature space as a compact hypersphere enclosing normal samples, abnormal samples mixed in a dataset easily contaminate the normality (the left side of each figure in Fig. 2). It happens in both versions of DSVDD. However, despite the contamination, we empirically observe that relatively more normal samples are located near the sphere’s center (the right side of each figure in Fig. 2). This phenomenon can be explained by the Effective gradient [24], which measures how much the error is reduced for a single datum, i.e., the projection of the overall gradient $\bar{g}$ on the direction of a single datum’s gradient $g_{i}$:

where $\theta(g_{i},\bar{g})$ is the angle between the two vectors.

Following the observation, we assume that there exists a boundary (concentric spheres) in which the true label ratio of $B$ number of data closest to the boundary becomes half; and we consider those samples close to the boundary have high uncertainty of being judged as normal or abnormal by the model. Our goal is to find the boundary where highly uncertain samples are nearby, which we call AB. For searching AB, we use the ratio of abnormal samples among queried samples at the previous active learning stage. We denote the ratio as $r$. The idea is that when the ratio $r$ is high (low), the AB moves in a direction towards (away from) the center (Fig. 3). For the degree of movement, we utilize the difference between $r$ and its expected ratio of 0.5.

We denote the ratio of data enclosed by AB as $q$. Suppose $q_{t}$ is 0.8 at active learning stage $t$. In that case, AB is the boundary of the hypersphere enclosing 80% of the total data. We denote the ratio of queried abnormal samples in stage $t$ as $r_{t}$, which means $|Q_{A}^{t}|/B$. The AB is updated as follows¹¹1$q_{t+1}=(q_{t}+q_{t-1})/2,\;\textrm{when}\;q_{t}=1$.:

where $\delta(q_{t},r_{t})$ is the degree of movement derived from the proportional equation (Eq. (5)). We let $\delta(q_{t},r_{t})$ decrease as the AB widens, i.e., $q_{t}$ increases, by assuming that the ratio of abnormal samples from the current AB to the maximum boundary, i.e., $q_{t}=1$, increases linearly. We assume $r_{t}$ is 1 when $q_{t}$ is 1.

We propose to use noise contrastive estimation (NCE) as effective semi-supervised learning (SSL) method. In utilizing NCE, we pay attention to a fundamental role of an anomaly score function, which assigns a lower score to normal data than abnormal data. We consider this role analogous to NCE, which estimates a model describing observed data while contrasting them with noise data. Furthermore, an anomaly score function can be regarded as an unnormalized and parameterized statistical model. Therefore, we propose the NCE-based SSL method by setting the anomaly score of labeled normal and abnormal data as the estimation target and noise data. Although noise data leveraged by the original NCE is artificially sampled from a known distribution, we assume labeled abnormal data are sampled from the true distribution of abnormal data while querying. The total loss ${\mathcal{L}}$ for NCE-based SSL is as follows:

where $Q_{A}^{PS}$ denotes pseudo-abnormal samples. $Q_{A}^{PS}$ is defined by labeled abnormal samples as follows:

For brevity, we denote $s(\boldsymbol{x}_{i};{\mathcal{W}})$ as $s_{i}$. The total loss is described using One-Class DSVDD as a base model, but soft-boundary DSVDD can also be applied by replacing the sample loss. We outline the active learning process in Algorithm 1.

Lastly, we compare the combination of OC-NCE and the two QSs, AB (solid red lines) and HC (dashed red lines). AB shows higher performance than HC favorably in the early stages in most cases. However, the performance with both QSs becomes similar while repeating active learning stages. It can be explained by AB gradually moving outward of the hypersphere’s center as the model learns robust normality over the stages.