{"id":"8bca9791-ed5c-460a-a2df-fc75f8c691d7","arxiv_id":"1909.03835","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"SaneDL detects invalid inputs by using autoencoder reconstruction losses of intermediate activations as assertions, reporting high detection rates on two image dataset pairs.","lead":"Researchers propose SaneDL, a tool that inserts autoencoder-based assertions between layers of a trained neural network to flag input cases the network was not trained on. A generalist might read it to see a simple, non-intrusive idea for detecting out-of-distribution inputs, though the paper offers no comparison with existing methods.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table I's TPR/FPR numbers are unreproducible because the paper never states the exact delta or a threshold-selection rule; a post-hoc delta choice can make any anomaly detector look good.","rationale":"The reader's CONDITIONAL verdict is sensible, and my concern reinforces it rather than overturning it. The reader's weakest_assumption focuses on the separability of the AE loss distribution; my concern sharpens that into the concrete, load-bearing point that even if separability holds, the paper never specifies the operating point. The reported TPR/FPR numbers are meaningless without the delta that produced them and without evidence that delta is chosen from training data alone. This is not an ad hominem or a demand for unrealistic rigor; it is the minimal information needed to check the central claim. The proposed concrete test—reporting delta vs. TPR/FPR curves with training-set-only thresholds—would settle whether a single, fixed delta can achieve the advertised performance. If it can, the concern is resolved and the paper's central claim stands; if not, the effectiveness claim is post-hoc. I keep the verdict UNCHANGED because the reader already recommended CONDITIONAL, and my concern is best addressed by the same conditional requirements: specify the threshold-selection procedure, release the loss distributions, and add sensitivity analysis. An honest non-finding would be inappropriate here because the missing delta is a factual omission directly tied to the credibility of the experimental results.","tokens_in":919,"tokens_out":872,"duration_ms":46597,"concrete_test":"Independently reproduce the method on both scenarios with the same model architectures and instrumented layers, computing thresholds from the training set only. Then vary delta from 1 to 5 in steps of 0.5 and plot TPR and FPR for each model/dataset pair on held-out valid and invalid examples. If no single fixed delta (e.g., delta = 3) achieves TPR at least 0.95 and FPR at most 0.05 across all four rows of Table I, or if the delta that reproduces Table I differs by more than 0.5 between rows, then the reported results are post-hoc and the method lacks a reproducible operating-point selection rule.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The method's only hyperparameter is delta, which scales the mean reconstruction loss to form the assertion threshold (Thres = delta * mean loss). Yet the paper never reports which delta values produced the TPR/FPR numbers in Table I, nor any procedure for choosing delta. The text only says that delta in [2, 4] results in good performance. Because TPR and FPR trade off monotonically with delta, choosing a different delta per dataset and model could inflate the reported results, especially since the test sets are the same ones used to select the operating point. This matters because the central claim—that SaneDL effectively identifies invalid inputs—rests entirely on the assertion thresholds being both principled and fixed before deployment. If the authors selected delta after looking at the test data, the reported FPR of 0.0156 and TPR of 0.9919 are not evidence of a deployable detector. In addition, the paper does not report reconstruction-loss distributions, so the assumed clean separability of valid and invalid losses (the reader's weakest assumption) is untested. For a method whose sole tunable is delta, omitting the actual delta and its sensitivity makes the headline effectiveness claim unfalsifiable from the paper alone. This is a concrete, load-bearing gap, not a stylistic complaint.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SaneDL, a runtime input-validation mechanism for deep learning systems. Autoencoders are inserted between layers of a pre-trained model and trained to reconstruct intermediate activations of valid inputs. At inference time, each assertion computes a reconstruction loss, and the input is rejected if any loss exceeds a threshold defined as a constant delta multiplied by the mean training loss. The method is evaluated on two scenarios: distinguishing MNIST digits from Fashion-MNIST inputs when the model was trained on Fashion-MNIST, and distinguishing Flickr logos from GTSRB traffic signs when the model was trained on GTSRB. The reported results show high true-positive rates, false-positive rates between 0.0156 and 0.1002, and high ROC-AUC scores across LeNet, AlexNet, and VGG16.","tokens_in":5526,"tokens_out":4720,"duration_ms":51133,"significance":"If the results are reproducible, SaneDL offers a simple, non-intrusive mechanism for detecting out-of-distribution inputs at runtime, which is practically valuable for deployed deep learning systems. The use of real-world invalid input cases rather than adversarially crafted perturbations is a strength, and the idea of inserting trainable assertions into existing networks is intuitively appealing. However, the evaluation is too thin to establish the stated general claim: there are no comparisons with existing out-of-distribution detection baselines, no error bars or significance tests, and no public implementation or detailed hyperparameter report. The method's single tunable parameter, delta, is never reported exactly, which makes the headline numbers in Table I unreproducible. The significance is therefore conditional on a substantially strengthened evaluation.","major_comments":[{"comment":"The operating point behind Table I is not specified. The threshold is defined as Thres = delta times the mean reconstruction loss on training data, and the text states only that 'selecting this scale coefficient in an interval from 2 to 4 results in good performance.' The exact delta used for each model, any selection procedure, and the sensitivity of TPR and FPR to delta are omitted. Because TPR and FPR trade off monotonically with the threshold scale, the reported values such as FPR 0.0156 and TPR 0.9919 cannot be reproduced or interpreted from the paper. This is load-bearing: the entire detection mechanism depends on this threshold, and if delta was chosen after observing the test set, the reported numbers could be optimistically biased.","section":"Section II, threshold equation; Table I"},{"comment":"The core assumption that valid and invalid intermediate activations yield cleanly separable reconstruction-loss distributions is not demonstrated. The paper asserts that invalid inputs cause 'a huge deviation' but provides no loss distributions, no per-assertion thresholds, and no per-assertion AUC or false-positive rates. Since the final decision requires passing 'all the assertions,' per-assertion false-positive rates compound, and without per-assertion data it is unclear how the aggregated FPR is achieved. This is central to the effectiveness claim, and the omission prevents the reader from validating the mechanism on subtle or adversarial distribution shifts, which may not exhibit clean separation.","section":"Section II and Section III-A"},{"comment":"The empirical support for the general claim is insufficient. There is no comparison with even simple baselines such as softmax confidence thresholds, input-space reconstruction error, or established out-of-distribution detectors, so the relative benefit of SaneDL is unknown. The two scenarios are easy dataset shifts (MNIST versus Fashion-MNIST, traffic signs versus logos), and the test-set sizes, replacement proportions, and random-seed details are not reported. No error bars or significance tests are given, so the differences between models (for example, FPR 0.0801 versus 0.1002) may be within noise. These details are necessary to assess whether the proposed method is reliably effective.","section":"Section III-A, Table I"}],"minor_comments":[{"comment":"The manuscript contains several typos and grammatical errors: 'evluate' in Section III-A, 'dont' and 'constrains' in Section II, and 'the intermediate results of invalid puts' in Section II. These should be corrected.","section":"Throughout"},{"comment":"The text refers to 'FlickrLogos-273' while the reference is titled 'FlickrLogos-27'; the dataset name is inconsistent and should be unified.","section":"Section III-A, Reference [11]"},{"comment":"The AE architectures, training epochs, and the exact layer insertion points are not described. Figure 1 is referenced but not visible in the manuscript text; the authors should ensure the figure clearly shows where assertions are placed and how the thresholds are computed per layer.","section":"Section II, Figure 1"},{"comment":"The related work section cites software testing literature but does not discuss the large body of work on out-of-distribution detection in machine learning (for example, softmax-based confidence methods and density-based detectors). This makes the novelty claim of an 'assertion-based tool' difficult to evaluate and should be addressed.","section":"Related Work"},{"comment":"The text says ROC-AUC is used to evaluate performance under different delta, but Table I reports only a single point per model with no ROC curves or AUC intervals. Clarify how the tabulated TPR/FPR values relate to the reported AUC.","section":"Section III-A, Table I"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to be an early-stage research report. The central idea is plausible and worth pursuing, but the missing delta value, the absence of reconstruction-loss distributions, and the lack of baseline comparisons are genuine technical gaps that must be fixed before the paper can be considered. I would not recommend rejection based on the idea itself, but the current evaluation does not support the strength of the claims made in the abstract and conclusion."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper reframes a standard technique—autoencoder reconstruction error as an anomaly score—as a runtime 'assertion' mechanism for deep learning systems. The reframing is fine as a packaging exercise, but the evidence is thin and the paper omits the one number that would make its claims reproducible: the δ values used to produce Table I.\n\nWhat's actually new is the software-engineering angle: inserting AE-based checks between layers, scaling the threshold from the mean training loss, and presenting it as a non-intrusive plugin for deployed models. That's a reasonable thing to try, and I'll credit the authors for testing on real-world distribution shifts (MNIST vs Fashion-MNIST, GTSRB vs FlickrLogos) rather than adversarial perturbations. The AUC scores in Table I are threshold-independent and quite high (0.97–0.99), so the core idea probably has something to it.\n\nBut the evaluation is not enough. There are no baseline comparisons—no ODIN, no Mahalanobis-distance OOD detection, no even simple softmax-confidence baseline. No error bars or significance tests. And the stress-test concern is real: the paper never states which δ gives TPR 0.9919 and FPR 0.0156, only that δ in [2,4] 'results in good performance.' Since TPR and FPR trade off monotonically with δ, the reported operating point is not reproducible from the paper alone. That's not a stylistic complaint; for a method whose only knob is δ, it's a load-bearing gap. Missing AE hyperparameters, insertion-layer choices, and the number of assertions per model compound the problem. The writing is also sloppy, but that's minor.\n\nI don't find the method circular—the AEs are trained on valid inputs and thresholds are calibrated from training data, which is standard practice. The AUC numbers are plausible. What bothers me more is the novelty claim: calling this the first assertion-based tool for DL systems ignores a substantial OOD-detection literature that already uses intermediate-layer features with learned thresholds. The authors don't cite any of it.\n\nWho is this paper for? Software-engineering researchers who want a simple runtime monitor for DL systems and haven't followed the OOD detection literature. For an ML audience, it's a rehash. A serious referee at a SE-focused venue could extract a usable paper by enforcing baselines, variance reporting, and the exact δ values; as it stands, it's a workshop-level draft. I'd send it back for major revision rather than reject, but only if the authors can show the threshold choice is fixed before deployment and the reported numbers hold under sensitivity analysis.","headline":"This paper re-frames autoencoder anomaly detection as 'learnt assertions' for DL systems; the framing is plausible but the evaluation is too thin and the exact thresholds behind its headline numbers are never reported.","tokens_in":5973,"tokens_out":3009,"would_cite":false,"duration_ms":36136,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SaneDL inserts autoencoder-based assertions into pretrained neural networks to flag inputs the model was never trained on.","keywords":["data sanity check","deep learning reliability","invalid input detection","autoencoder assertion","out-of-distribution detection","neural network testing","runtime validation","data flow footprint"],"falsifier":"Take a set of inputs that are close to the valid data distribution, such as valid images with small added noise, mild blur, or a different handwriting style, and measure their per-layer autoencoder losses; if a substantial fraction have losses below $\\delta \\times$ mean training loss, then the pass-all-assertions rule would wrongly accept them as valid.","tokens_in":4971,"feed_emoji":"🛡️","tokens_out":2918,"duration_ms":32339,"temperature":0.7,"pith_summary":"The paper proposes SaneDL, a tool that checks whether an input is valid for a deep learning system before the system fully processes it. The central idea is to insert autoencoder-based assertions between the layers of a pretrained network, train those autoencoders only on intermediate activations produced by valid inputs, and then reject any input whose reconstruction loss at any layer exceeds a threshold. The paper argues that valid inputs are reconstructed well because their activations match the training distribution, while invalid inputs produce abnormal activations and therefore high losses. If this claim holds, SaneDL offers a lightweight, non-intrusive runtime guard for existing deep learning systems, catching out-of-distribution inputs that would otherwise cause unpredictable behavior.","feed_headline":"Autoencoder assertions catch invalid inputs to deep learning systems","feed_subtitle":"Learned checks between layers flag out-of-distribution data before it causes misbehavior.","key_machinery":"The central object is the autoencoder-based assertion: a small autoencoder placed between two layers of a pretrained network, trained to reconstruct that layer's intermediate activations from valid inputs. Its reconstruction loss serves as an anomaly score for the input's behavior at that layer, and the threshold is set as a multiple of the mean training loss. The mechanism works by cascading these assertions across layers so that an input must satisfy every layer-specific reconstruction constraint to be accepted.","core_discovery":"The paper's central claim is that data sanity can be enforced for deep learning systems by treating each intermediate layer's activations as a data-flow signal and checking it with a learned assertion. Concretely, for a pretrained network N, autoencoders are inserted between layers and trained on the intermediate results of valid training inputs; at runtime, an input is verified only if it passes all assertions, meaning every per-layer reconstruction loss stays below the threshold $\\delta \\cdot \\frac{1}{m}\\sum_{j=1}^{m}\\text{Loss}_{AE}(IR_j)$, where $\\delta$ is a scale coefficient typically chosen between 2 and 4. In the two tested scenarios, the method reports true positive rates of 0.9268 to 0.9975 and false positive rates of 0.0156 to 0.1002 across LeNet, AlexNet, and VGG16, using real-world invalid input cases from MNIST and FlickrLogos rather than artificially perturbed samples. The paper thus establishes that behavior deviation, measured through data-flow reconstruction losses, is a workable symptom for identifying inputs a deep learning system cannot properly handle.","pith_inferences":["The global threshold $\\delta \\times$ mean loss treats every layer identically; a natural extension is to calibrate $\\delta$ per layer against a validation set to optimize the trade-off between true and false positives.","The method essentially performs out-of-distribution detection on intermediate activations, so it could be tested on subtler distribution shifts, such as corrupted or lightly perturbed inputs, where the loss separation may be less clean.","Since the autoencoders are trained only on valid inputs, they could be updated online as the production data distribution drifts, keeping the sanity check aligned with evolving input patterns.","The assertion cascade could be combined with prediction confidence to catch inputs whose activations look normal but still produce incorrect outputs, though the paper does not explore this combination."],"forward_implications":["Existing pretrained models can be guarded without retraining or architectural changes, since the autoencoders are inserted as add-on monitors.","The same pipeline applies across different network architectures and domains, as demonstrated with LeNet, AlexNet, and VGG16 in both digit recognition and traffic-sign recognition.","The trade-off between catching invalid inputs and accepting valid ones is controlled by the single scale coefficient $\\delta$, giving operators a direct knob for system sensitivity.","Real-world invalid inputs, not just crafted adversarial samples, can be detected at runtime with the reported true and false positive rates.","Because the check is per-layer, it can localize which stage of the network first deviates from expected behavior, aiding diagnosis."],"supporting_citations":[{"why":"Supplies the autoencoder method used to build reconstruction-based assertions on intermediate activations.","marker":"[9]"},{"why":"Provides the underlying premise that bugs or invalid behavior manifest as deviant behavior, which the paper adapts to deep learning data flow.","marker":"[8]"},{"why":"Provides the GTSRB traffic-sign dataset used as the valid-input source in Scenario II.","marker":"[10]"},{"why":"Provides the FlickrLogos dataset used to create real-world invalid inputs for the traffic-sign recognition scenario.","marker":"[11]"},{"why":"Defines the LeNet architecture used as one of the pretrained models in the Fashion-MNIST experiment.","marker":"[12]"},{"why":"Defines the AlexNet architecture used in both experimental scenarios.","marker":"[13]"},{"why":"Defines the VGG16 architecture used for the traffic-sign recognition experiment.","marker":"[14]"}],"fun_headline_variants":["Layer-wise autoencoders veto unseen inputs for DNNs","Reconstruction loss between layers flags OOD data","Learned assertions reject invalid inputs pre-inference","Autoencoder sentinels flag untrained inputs at test time"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that every invalid input produces intermediate activations whose autoencoder reconstruction loss clearly exceeds the training-time mean, so that a single global threshold per layer can cleanly separate valid from invalid inputs.","fun_headline_variants_meta":{"raw":{"variants":["Layer-wise autoencoders veto unseen inputs for DNNs","Reconstruction loss between layers flags OOD data","Learned assertions reject invalid inputs pre-inference","Autoencoder sentinels flag untrained inputs at test time"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001185,"raw_usage":{"total_tokens":4864,"prompt_tokens":887,"completion_tokens":3977,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":503,"completion_tokens_details":{"reasoning_tokens":3912}},"tokens_in":503,"tokens_out":3977,"duration_ms":29822,"temperature":1.0,"reasoning_tokens":3912,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:37:41.252480+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of inputs that are close to the valid data distribution, such as valid images with small added noise, mild blur, or a different handwriting style, and measure their per-layer autoencoder losses; if a substantial fraction have losses below $\\delta \\times$ mean training loss, then the pass-all-assertions rule would wrongly accept them as valid.","supporting_citations":[{"cited_title":"Bugs as deviant behavior: A general approach to inferring errors in systems code,","cited_arxiv_id":null,"evidence_quote":"Provides the underlying premise that bugs or invalid behavior manifest as deviant behavior, which the paper adapts to deep learning data flow."},{"cited_title":"Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark,","cited_arxiv_id":null,"evidence_quote":"Provides the GTSRB traffic-sign dataset used as the valid-input source in Scenario II."},{"cited_title":"Scalable triangulation-based logo recognition,","cited_arxiv_id":null,"evidence_quote":"Provides the FlickrLogos dataset used to create real-world invalid inputs for the traffic-sign recognition scenario."},{"cited_title":"Gradient-based learning applied to document recognition,","cited_arxiv_id":null,"evidence_quote":"Defines the LeNet architecture used as one of the pretrained models in the Fashion-MNIST experiment."}],"review_version":1}