A Survey on GANs for Anomaly Detection
Federico Di Mattia Paolo Galeone Michele De Simoni Emanuele Ghelfi


[
	A Survey on GANs for Anomaly Detection

	
	
	
	

	
	
	
	

	
	
	
	equal*

	
		Federico Di Mattiato,equal
		Paolo Galeoneto,equal
		Michele De Simonito,equal
		Emanuele Ghelfito,equal
	

	toZuru Tech, Modena, Italy

    Federico Di Mattiafederico.d@zuru.tech
	
	
	

	
	
	
	Machine Learning, ICML, Deep Learning, Anomaly Detection, GANs

	0.3in
]










 


	Anomaly detection is a significant problem faced in several research areas. Detecting and correctly classifying something unseen as anomalous is a challenging problem that has been tackled in many different manners over the years.
	Generative Adversarial Networks (GANs) and the adversarial training process have been recently employed to face this task yielding remarkable results. In this paper we survey the principal GAN-based anomaly detection methods, highlighting their pros and cons. Our contributions are the empirical validation of the main GAN models for anomaly detection, the increase of the experimental results on different datasets and the public release of a complete Open Source toolbox for Anomaly Detection using GANs.





§ INTRODUCTION



Anomalies are patterns in data that do not conform to a well-defined notion of normal behavior <cit.>.
Generative Adversarial Networks (GANs) and the adversarial training framework <cit.> have been successfully applied to model complex and high dimensional distribution of real-world data. This GAN characteristic suggests they can be used successfully for anomaly detection, although their application has been only recently explored.
Anomaly detection using GANs is the task of modeling the normal behavior using the adversarial training process and detecting the anomalies measuring an anomaly score <cit.>.
To the best of our knowledge, all the GAN-based approaches to anomaly detection build upon on the Adversarial Feature Learning idea <cit.> in which the BiGAN architecture has been proposed.
In their original formulation, the GAN framework learns a generator that maps samples from an arbitrary latent distribution (noise prior) to data as well as a discriminator which tries to distinguish between real and generated samples.
The BiGAN architecture extended the original formulation, adding the learning of the inverse mapping which maps the data back to the latent representation.
A learned function that maps input data to its latent representation together with a function that does the opposite (the generator) is the basis of the anomaly detection using GANs.

The paper is organized as follows. In <ref> we introduce the GANs framework and, briefly, its most innovative extensions, namely conditional GANs and BiGAN, respectively in <ref> and <ref>. <ref> contains the state of the art architectures for anomaly detection with GANs. In <ref> we empirically evaluate all the analyzed architectures. Finally, <ref> contains the conclusions and future research directions.



 §.§ GANs



GANs are a framework for the estimation of generative models via an adversarial process in which two models, a discriminator D and a generator G, are trained simultaneously.
The generator G aim is to capture the data distribution, while the discriminator D estimates the probability that a sample came from the training data rather than G.
To learn a generative distribution p_g over the data 𝐱 the generator builds a mapping from a prior noise distribution p_z to a data space as G(𝐳;θ_G), where θ_G are the generator parameters.
The discriminator outputs a single scalar representing the probability that 𝐱 came from real data rather than from p_g. The generator function is denoted with D(𝐱; θ_D), where θ_D are discriminator parameters.

The original GAN framework <cit.> poses this problem as a min-max game in which the two players (G and D) compete against each other, playing the following zero-sum min-max game:




    min_G max_D      V(D,G) = 𝔼 _𝐱∼ p_data(𝐱)[log D(𝐱)] +                 
       𝔼_𝐳∼ p_z(𝐳)[ log( 1 - D(G(𝐳)) ) ].




 §.§ Conditional GANs



GANs can be extended to a conditional model <cit.> conditioning either G or D on some extra information y. The y condition could be any auxiliary information, such as class labels or data from other modalities. We can perform the conditioning by feeding y into both the discriminator and generator as an additional input layer.
The generator combines the noise prior p_z(𝐳) and y in a joint hidden representation, the adversarial training framework allows for considerable flexibility in how this hidden representation is composed.
In the discriminator, 𝐱 and y are presented as inputs to a discriminative function.
The objective function considering the condition becomes:


    min_G max_D      V(D,G) = 𝔼 _𝐱∼ p_data(𝐱|y)[log D(𝐱)] + 
       𝔼_𝐳∼ p_z(𝐳)[log(1 - D(G(𝐳|y)))].




 §.§ BiGAN



Bidirectional GAN <cit.> extends the GAN framework including an encoder E(x; θ_E) that learns the inverse of the generator E = G^-1. The BiGAN training process allows learning a mapping simultaneously from latent space to data and vice versa. The encoder E is a non-linear parametric function in the same way as G and D, and it can be trained using gradient descent.
As in the conditional GANs scenario, the discriminator must learn to classify not only real and fake samples, but pairs in the form (G(𝐳), 𝐳) or (𝐱, E(𝐱)). The BiGAN training objective is:


    min_G,Emax_D      V(D,G,E) =                                                                                                                                    
       𝔼_𝐱∼ p_data(𝐱)[𝔼_𝐳∼ p_E(𝐳|𝐱) [log D(𝐱, 𝐳)]] + 
       𝔼_𝐳∼ p_z(𝐳)[𝔼_𝐱∼ p_G(𝐱|𝐳)[log(1 - D(𝐱,𝐳)))]].


<ref> depicts a visual structure of the BiGAN architecture.



§ GANS FOR ANOMALY DETECTION



Anomaly detection using GANs is an emerging research field. <cit.>, here referred to as AnoGAN, were the first to propose such a concept. In order to face the performance issues of AnoGAN a BiGAN-based approach has been proposed in <cit.>, here referred as EGBAD (Efficient GAN Based Anomaly Detection), that outperformed AnoGAN execution time.
Recently, <cit.> advanced a GAN + autoencoder based approach that exceeded EGBAD performance from both evaluation metrics and execution speed.

In the following sections, we present an analysis of the considered architecture. The term sample and image are used interchangeably since GANs can be used to detect anomalies on a wide range of domains, but all the analyzed architectures focused mostly on images.



 §.§ AnoGAN



AnoGAN aim is to use a standard GAN, trained only on positive samples, to learn a mapping from the latent space representation 𝐳 to the realistic sample 𝐱̂ = G(𝐳) and use this learned representation to map new, unseen, samples back to the latent space.
Training a GAN on normal samples only, makes the generator learn the manifold 𝒳 of normal samples. Given that the generator learns how to generate normal samples, when an anomalous image is encoded its reconstruction will be non-anomalous; hence the difference between the input and the reconstructed image will highlight the anomalies. The two steps of training and detecting anomalies are summarized in <ref>.


The authors have defined the mapping of input samples to the latent space as an iterative process. The aim is to find a point 𝐳 in the latent space that corresponds to a generated value G(𝐳) that is similar to the query value 𝐱 located on the manifold 𝒳 of the positive samples.
The research process is defined as the minimization trough γ = 1,2, …, Γ backpropagation steps of the loss function defined as the weighted sum of the residual loss ℒ_R and discriminator loss ℒ_D, in the spirit of <cit.>.

The residual loss measures the dissimilarity between the query sample and the generated sample in the input domain space:





    ℒ_R(𝐳_γ) = ||𝐱 - G(𝐳_γ)||_1.


The discriminator loss takes into account the discriminator response. It can be formalized in two different ways. Following the original idea of <cit.>, hence feeding the generated image G(𝐳_γ) into the discriminator and calculating the sigmoid cross-entropy as in the adversarial training phase: this takes into account the discriminator confidence that the input sample is derived by the real data distribution. Alternatively, using the idea introduced by <cit.>, and used by the AnoGAN <cit.> authors, to compute the feature matching loss, extracting features from a discriminator layer 𝐟 in order to take into account if the generated sample has similar features of the input one, by computing:




    ℒ_D(𝐳_γ) = ||𝐟(𝐱) - 𝐟(G(𝐳_γ))||_1,


hence the proposed loss function is:




    ℒ(𝐳_γ) = (1 - λ) ·ℒ_R(𝐳_γ) + γ·ℒ_D(𝐳_γ).


Its value at the Γ-th step coincides with the anomaly score formulation:

    A(𝐱) = ℒ(𝐳_Γ).


A(𝐱) has no upper bound; to high values correspond an high probability of 𝐱 to be anomalous.

It should be noted that the minimization process is required for every single input sample 𝐱.



  §.§.§ Pros and cons

Pros

	
  * Showed that GANs can be used for anomaly detection.
	
  * Introduced a new mapping scheme from latent space to input data space.
	
  * Used the same mapping scheme to define an anomaly score.

Cons

	
  * Requires Γ optimization steps for every new input: bad test-time performance.
	
  * The GAN objective has not been modified to take into account the need for the inverse mapping learning.
	
  * The anomaly score is difficult to interpret, not being in the probability range.




 §.§ EGBAD


Efficient GAN-Based Anomaly Detection (EGBAD) <cit.> brings the BiGAN architecture to the anomaly detection domain. In particular, EGBAD tries to solve the AnoGAN disadvantages using <cit.> and <cit.> works that allows learning an encoder E able to map input samples to their latent representation during the adversarial training. The importance of learning E jointly with G is strongly emphasized, hence <cit.> adopted a strategy similar to the one indicated in <cit.> and <cit.> in order to try to solve, during training, the optimization problem min_G,Emax_D V(D, E, G) where V(D, E, G) is defined as in Equation <ref>.
The main contribution of the EGBAD is to allow computing the anomaly score without Γ optimization steps during the inference as it happens in AnoGAN <cit.>.



 §.§ GANomaly





<cit.> introduce the GANomaly approach. Inspired by AnoGAN <cit.>, BiGAN <cit.> and EGBAD <cit.> they train a generator network on normal samples to learn their manifold 𝒳 while at the same time an autoencoder is trained to learn how to encode the images in their latent representation efficiently. Their work is intended to improve the ideas of <cit.>, <cit.> and <cit.>.
Their approach only needs a generator and a discriminator as in a standard GAN architecture.

Generator network The generator network consists of three elements in series, an encoder G_E a decoder G_D (both assembling an autoencoder structure) and another encoder E. The architecture of the two encoders is the same. G_E takes in input an image 𝐱 and outputs an encoded version 𝐳 of it. Hence, 𝐳 is the input of G_D that outputs 𝐱̂, the reconstructed version of 𝐱. Finally, 𝐱̂ is given as an input to the encoder E that produces ẑ. There are two main contributions from this architecture.
First, the operating principle of the anomaly detection of this work lies in the autoencoder structure. Given that we learn to encode normal (non-anomalous) data (producing 𝐳) and given that we learn to generate normal data (𝐱̂) starting from the encoded representation 𝐳, when the input data 𝐱 is an anomaly its reconstruction will be normal. Because the generator will always produce a non-anomalous image, the visual difference between the input 𝐱 and the produced 𝐱̂ will be high and in particular will spatially highlight where the anomalies are located.
Second, the encoder E at the end of the generator structure helps, during the training phase, to learn to encode the images in order to have the best possible representation of 𝐱 that could lead to its reconstruction 𝐱̂.

Discriminator network The discriminator network D is the other part of the whole architecture, and it is, with the generator part, the other building block of the standard GAN architecture. The discriminator, in the standard adversarial training, is trained to discern between real and generated data. When it is not able to discern among them, it means that the generator produces realistic images. The generator is continuously updated to fool the discriminator.
Refer to <ref> for a visual representation of the architecture underpinning GANomaly.

The GANomaly architecture differs from AnoGAN <cit.> and from EGBAD <cit.>. In <ref> the three architectures are presented.



Beside these two networks, the other main contribution of GANomaly is the introduction of the generator loss as the sum of three different losses; the discriminator loss is the classical discriminator GAN loss.

Generator loss The objective function is formulated by combining three loss functions, each of which optimizes a different part of the whole architecture.

Adversarial Loss The adversarial loss it is chosen to be the feature matching loss as introduced in <cit.> and pursued in <cit.>:


    ℒ_adv = 𝔼_𝐱∼ p_X||f(𝐱)-𝔼_𝐱∼ p_X f(G(𝐱))||_2,


where f is a layer of the discriminator D, used to extract a feature representation of the input .
Alternatively, binary cross entropy loss can be used.

Contextual Loss Through the use of this loss the generator learns contextual information about the input data. As shown in <cit.> the use of the ℒ_1 norm helps to obtain better visual results:


    ℒ_con = 𝔼_𝐱∼ p_X||x-G(𝐱)||_1.


Encoder Loss This loss is used to let the generator network learn how to best encode a normal (non-anomalous) image:


    ℒ_enc = 𝔼_𝐱∼ p_X||G_E(𝐱)-E(G(𝐱))||_2.


The resulting generator loss will be the result of the (weighted) sum of the three previously defined losses:


    ℒ = w_advℒ_adv + w_conℒ_con + w_encℒ_enc  ,


where w_adv, w_con and w_enc are weighting parameters used to adjust the importance of the three losses.

At test stage, the authors proposed to compute the anomaly score in a different way respect to AnoGAN: only using using ℒ_enc:


    𝒜(𝐱) = ||G_E(𝐱)-E(G(𝐱))||_2   .


In order to make the anomaly score easier to interpret, they proposed to compute the anomaly score for every sample 𝐱̂ in the test set D̂, getting a set of individual anomaly scores: 𝒮 = { s_i : 𝒜(x̂_i)  , x̂_i ∈D̂} and then apply feature scaling to have the anomaly scores within the probabilistic range of [0,1]:


    s'_i = s_i + min(S)/max(S) - min(S)  .




  §.§.§ Pros and cons

Pros

	
  * An encoder is learned during the training process, hence we don't have the need for a research process as in AnoGAN <cit.>.
	
  * Using an autoencoder like architecture (no use of noise prior) makes the entire learning process faster.
	
  * The anomaly score is easier to interpret.
	
  * The contextual loss can be used to localize the anomaly.

Cons

	
  * It allows to detect anomalies both in the image space and in the latent space, but the results couldn't match: a higher anomaly score, that's computed only in the latent space, can be associated with a generated sample with a low contextual loss value and thus very similar to the input - and vice versa.
	
  * Defines a new anomaly score.




§ EXPERIMENTS



To evaluate the performance of every Anomaly Detection algorithm described we re-implemented all of them using the popular deep learning framework Tensorflow <cit.> creating a publicly available toolbox for the Anomaly Detection with GANs.

The toolbox is available on PyPI[<https://pypi.org/project/anomaly-toolbox/>], which you can install using the install command:

  pip install anomaly-toolbox

or, alternatively, on GitHub[<https://github.com/zurutech/anomaly-toolbox>] if you want to collaborate and explore the code.

Experiments were made trying to improve, where possible (i.e., where there were known errors communicated directly by the authors), the code. The results shown in the following sections are the best empirically obtained among all the tests carried out and do not necessarily derive from the configurations of the networks that at a theoretical level should be the correct ones.
In particular, as described in <ref>, in version 1 (<ref>) of our tests, with the correct implementation of the BiGAN/EGBAD models, we obtained worse results than those obtained in version 2 (<ref>) of our tests with the architecture already implemented in the reference paper, although this contained known errors.





 §.§ Experimental setup


The experiments are performed using a Intel® Core™ i7-7820X CPU and NVIDIA® GTX 1080 Ti.



  §.§.§ Datasets


We decided to train and test on widely known datasets commonly found in the literature: MNIST <cit.>, FashionMNIST <cit.>, CIFAR-10 <cit.>, and KDD99 <cit.>.

MNIST:
MNIST dataset <cit.> is a database of handwritten digits. It consists of 28 × 28 pixels grayscale images split in a training set of 60,000 examples and a test set of 10,000 examples. The output classes are 10 in total and represent the ten digits from 0 to 9. In order to replicate the results of the papers presented in this work, the training process and the subsequent testing phase have been evaluated on each class, i.e., one at a time, only one class has been considered as the anomaly class, and the remaining nine classes have been considered together as the normal data.

Fashion MNIST:
Fashion-MNIST dataset <cit.> is a dataset intended to be a more complex drop-in replacement for the traditional MNIST dataset, developed by Zalando® Research Group. It shares with the MNIST dataset the same image size and train-test split; it consists of 28 × 28 pixels images split in a training set of 60,000 examples and a test set of 10,000 examples. Each image is a grayscale image associated, as the MNIST dataset, with a label from 10 classes, from 0 to 9. Each example represents a different item of clothing. As for the MNIST dataset, the training and the following test phase were conducted on each class, one at a time.

CIFAR-10:
A dataset of tiny images of various subjects, CIFAR-10 consists of 60000  32 × 32 color images in 10 classes, with 6000 images per class. There are 50000 training images and 10000 test images.

KDD: KDD dataset <cit.> consists in a collection of network intrusion detection data, this is the data set used for The Third International Knowledge Discovery and Data Mining Tools Competition held in conjunction with KDD-99 The Fifth International Conference on Knowledge Discovery and Data Mining. The competition task was to build a network intrusion detector, a predictive model capable of distinguishing between “bad” connections, called intrusions or attacks, and “good” normal connections. All the examples are string tuples or numbers. Given the considerable amount of data inside the data set, we used as in <cit.>, the KDDCUP99 10 percent version of the data set. Since the anomalies are in a higher percentage than normal data, the normal ones have been considered as anomalies.



  §.§.§ Methodology

We follow the same methodology employed by Zenati et al. in the official code accompanying <cit.>.

We start by getting all the dataset together (train and test split). Starting from this one big pool of examples, we choose one class as an anomaly and, after shuffling the dataset, we then create a training set by using 80% of the whole data while the remaining 20% is used for the testing set, this process is repeated for all the classes in the dataset. Each model is trained accordingly to its original implementation on the training set and is tested on the whole dataset made up of both regular and anomalous data.



 §.§ Results


All tests have been made measuring the area under precision and recall curve (AUPRC). For a complete understanding of all the results, please refer to <ref>. Our fully static-Tensorflow implementation (i.e., only Tensorflow framework has been used, we relied upon neither Keras nor eager execution) produced different results from the one depicted in the original <cit.>, <cit.>, and <cit.> papers. The tests have been made by training the GAN networks with different hyper-parameters configurations in order to test a broader range of models configurations. Moreover, following the GANomaly approach, we have added an evaluation process to make model selection and thus select the best model during the training phase. The model selection has been made for BiGAN and GANomaly, since doing it for AnoGAN would be unfeasible, due to the Γ research steps required for every sample at test-time.
We intentionally left out the performance evaluation of the AnoGAN model. Due to the inner workings of the architecture that should have required a very long time to be tested because of the necessity to find, every time and for every image taken into consideration, the best latent representation, meaning that for every image we would need 500 training step (500 it is an empirical value found in the original paper <cit.>).
Following, the training and test methods are described. A summary of the results is present in <ref> for the MNIST and Fashion-MNIST dataset, and in <ref> for the KDD results.



BiGAN/EGBAD:
With BiGAN/EGBAD <cit.> architecture we have executed the highest number of training and testing configurations, this means we have performed, for every label the combinations depicted in <ref>.
To better understand what the table shows, taking the first row (Case 1) as an example, we are describing the case where, during the training phase, a Binary Cross Entropy loss (BCE) in combination with a Residual loss has been used and, during the testing phase, we computed the anomaly score twice, using the feature matching (FM) and the BCE. All the other cases should be clear.
In particular, during the training phase, the choice between using BCE or FM influences only the generator loss. The residual loss that it is intended as the difference between the original image and the image reconstructed by the generator starting from a latent representation (please refer to <ref>) when used has been added as an additional term to the BCE loss of the encoder.
In <ref> is possible to see the results on the MNIST and Fashion-MNIST datasets. In <ref> it is possible to see the complete results. The images used are the original 28× 28 images. Any additional result from multiple different tests performed with different random seeds has been omitted for the sake of clarity.

GANomaly:
GANomaly training and testing have been done similarly to the previously described BiGAN/EGBAD architecture. The whole procedure is leaner here, with only the combinations shown in <ref>.



We added a step of model selection during the training phase in order to always save the very best model. For this architecture, the testing phase has been done using an anomaly score equal to the squared difference between the latent representations of the image encoded first with autoencoder part of the network and, after being reconstructed, encoded again with the encoder. To briefly review the working of GANomaly, see <ref>. The images used are the original ones resized to 32× 32. Refer to the plot on the right of <ref> to a  brief summary of the results on MNIST and Fashion-MNIST datasets and on <ref> for the results on KDD dataset.

AnoGAN:
As previously stated, the results of AnoGAN have not been reproduced due to the onerous computational requirements causing the train and test phases to be intensively time-consuming. The reader could refer to the original paper <cit.> to an overview of the results.





§ CONCLUSIONS


We implemented and evaluated the state-of-the-art algorithms for anomaly detection based on GANs. In this work, we unified the three major works under the same framework (Tensorflow) and within the same code-base. The analysis and implementation of the algorithms allowed us to verify the effectiveness of the GANs-based approach to the anomaly detection problem and, at the same time, highlight the differences between the original papers and the publicly available code. Besides, to test the feasibility of the architectures mentioned above, this work intends to provide a modular and ready-to-go solution for everyone desiring an anomaly detection toolkit working out of the box.

icml2019


§ ADDITIONAL RESULTS



In this section, we present more detailed results regarding the different combinations of training-testing pipelines of the BiGAN/EGBAD and GANomaly architectures on MNIST and Fashion-MNIST; results of the CIFAR10 dataset, trained with GANomaly are presented too.
Moreover, the results of the addition of a function (namely, a leaky relu activation function in the first layer of the encoder) that was missing from inside the EGBAD published code architecture will be introduced. Surprisingly, the tests have led to the result that without that activation function the network performs better.



 §.§ Version 1


Before getting the results shown in <ref> we have employed a different test pipeline with a different architecture of the BiGAN network. The main difference was mainly related to:

	-3em
	      

	
  * Testing phase The testing phase is applied twice (for both BiGAN/EGBAD and GANomaly architectures). Once during the model selection during training, and once after the training was finished as a stand alone phase.
	
  * Activation function A Leaky Relu function, erroneously missing from the original EGBAD <cit.> work has been here inserted after the first convolutional layer of the encoder model.
	



A brief visual understanding of the configuration cases for the BiGAN/EGBAD architecture it is shown in <ref> below. The configuration is similar to the one shown in <ref> with the difference that, here, the testing phase has been done separately. The same is true for the GANomaly implemented architecture, shown in <ref>.








  §.§.§ MNIST

Here, we present the results on the MNIST dataset. We show in <ref> the results of the BiGA/EGBAD architecture and in <ref> the results of the GANomaly architecture.
In the following, MNIST results are depicted.







  §.§.§ Fashion-MNIST

Here we present the results obtained on the Fashion-MNIST dataset. In <ref> we show the results of BiGAN/EGBAD architectures and in <ref> the results of the GANomaly architecture.







  §.§.§ CIFAR10

In the following <ref> we present the results on the CIFAR10 dataset.





 §.§ Version 2


In <ref> we get back to the original version of the EGBAD <cit.> and find that the results are much better, even if there is no activation function in the first convolutional layer. The main differences from <ref> are the following:

	
  * Testing phase The testing phase is applied only once during the model selection during training.
	
  * Activation function The Leaky Relu function has here been left out as for the original EGBAD paper<cit.>.


The training and testing pipelines employed have been already described. Please refer to section <ref> and section <ref> for more details. Every following section will introduce the results for a specific dataset.



  §.§.§ MNIST

Here we present the results for the MNIST dataset. In <ref> we show the results of BiGAN/EGBAD. In <ref> we show the results of GANomaly architecture.








  §.§.§ Fashion-MNIST

In the following, we present the plots regarding the performances on Fashion-MNIST dataset. <ref> shows the performance of BiGAN/EGBAD model and <ref> the performance of GANomaly model.







  §.§.§ CIFAR10




