[Paper Review] Deep Weakly-supervised Anomaly Detection

Guansong Pang, Chunhua Shen+2 more|arXiv (Cornell University)|Oct 30, 2019

Anomaly Detection Techniques and Applications50 references33 citations

TL;DR

PReNet is a deep weakly-supervised anomaly detector that learns pairwise relations among anomaly-anomaly, anomaly-unlabeled, and unlabeled-unlabeled pairs to detect seen and unseen anomalies, with strong robustness to anomaly contamination in unlabeled data.

ABSTRACT

Recent semi-supervised anomaly detection methods that are trained using small labeled anomaly examples and large unlabeled data (mostly normal data) have shown largely improved performance over unsupervised methods. However, these methods often focus on fitting abnormalities illustrated by the given anomaly examples only (i.e.,, seen anomalies), and consequently they fail to generalize to those that are not, i.e., new types/classes of anomaly unseen during training. To detect both seen and unseen anomalies, we introduce a novel deep weakly-supervised approach, namely Pairwise Relation prediction Network (PReNet), that learns pairwise relation features and anomaly scores by predicting the relation of any two randomly sampled training instances, in which the pairwise relation can be anomaly-anomaly, anomaly-unlabeled, or unlabeled-unlabeled. Since unlabeled instances are mostly normal, the relation prediction enforces a joint learning of anomaly-anomaly, anomaly-normal, and normal-normal pairwise discriminative patterns, respectively. PReNet can then detect any seen/unseen abnormalities that fit the learned pairwise abnormal patterns, or deviate from the normal patterns. Further, this pairwise approach also seamlessly and significantly augments the training anomaly data. Empirical results on 12 real-world datasets show that PReNet significantly outperforms nine competing methods in detecting seen and unseen anomalies. We also theoretically and empirically justify the robustness of our model w.r.t. anomaly contamination in the unlabeled data. The code is available at https://github.com/mala-lab/PReNet.

Motivation & Objective

• Motivate and address the limitations of existing semi-supervised anomaly detectors that overfit to seen anomalies and struggle with unseen ones.
• Propose a pairwise relation learning framework (PReNet) that uses anomaly-anomaly, anomaly-unlabeled, and unlabeled-unlabeled pairs to learn generalized anomaly scores.
• Enable robust detection of both seen and unseen anomalies while leveraging large unlabeled data and limited labeled anomalies.
• Provide theoretical justifications for robustness to anomaly contamination and demonstrate strong empirical performance across real-world datasets.

Proposed method

• Formulate anomaly scoring as a pairwise relation prediction task over three pair types: anomaly-anomaly, anomaly-unlabeled, and unlabeled-unlabeled.
• Construct an instance-pair dataset with ordinal labels where c(a,a) > c(a,u) > c(u,u) to guide learning of anomaly scores.
• Use a two-stream neural network with shared feature extractor to compute pair representations and a linear scoring head to produce anomaly scores.
• Train with a three-class ordinal regression loss that minimizes the gap between predicted scores and ordinal labels, with oversampling of anomaly-related pairs to address class imbalance.
• Infer anomaly scores for a test instance by averaging pairwise scores across multiple random pairings with labeled anomalies and unlabeled data.
• 3.3 Anomaly Detection Using PReNet describes the training and inference procedures, including an ensemble-style scoring s_xk computed from multiple pairings.

Experimental results

Research questions

• RQ1 Can a weakly-supervised framework generalize to unseen anomaly types by learning from pairwise relations rather than specific anomaly examples?
• RQ2 How does pairwise relation learning improve detection performance and sample efficiency compared to existing semi-supervised and unsupervised methods?
• RQ3 Is the PReNet approach robust to anomaly contamination in the unlabeled data, and under what conditions?

Key findings

• PReNet substantially outperforms nine competing methods on 12 real-world datasets for seen and unseen anomaly detection (in terms of AUC-PR and AUC-ROC).
• PReNet achieves higher anomaly detection performance with significantly better sample efficiency, requiring 50%-87.5% less labeled anomaly data in some settings.
• The approach yields robust performance in the presence of anomaly contamination in the unlabeled data, with theoretical guarantees and empirical support.
• Empirical results show substantial improvements over state-of-the-art methods across a range of benchmark datasets.