Pith. sign in

REVIEW 4 major objections 6 minor 61 references

Anomaly Detection Based on Critical Paths for Deep Neural Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A deep network's anomaly behaviour can be compressed into critical detection paths—one neuron per layer, evolved by mutation—that separate normal images from adversarial, out-of-distribution, and noise inputs across several standard…

desk verdict A genuinely new path-based anomaly detection idea, but the evaluation protocol leaks anomaly information into path selection and threshold calibration, so the headline results are unverified until a clean held-out evaluation is run. read the letter →

arxiv 2505.14967 v1 pith:P6MVK4NO submitted 2025-05-20 cs.LG cs.AI

Fangzhen Zhao , Chenyi Zhang , Naipeng Dong , Ming Li , Jinxiao Shan This is my paper · ORCID
classification cs.LGcs.AI
keywords anomalydetectiondeepneuralnetworkscriticalpathsgeneticmutationsupportvectordomaindescriptionout-of-distributionadversarialexampleensemblevoting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper contends that the internal flow of a deep network can be compressed into a handful of critical detection paths, each a single neuron per layer from input to output, and that these paths carry enough information to separate normal inputs from adversarial, out-of-distribution, and noise inputs. It proposes ADCP, which evolves such paths by repeatedly mutating one neuron and keeping only mutations that raise the true-positive rate of a one-class SVDD trained on that path's activation values. Multiple paths are then ensembled with random subspace sampling and voting. If the claim holds, anomaly detection no longer needs to modify the network or rely on a fixed layer, and one path set can serve several anomaly families at once. The experiments across MNIST, CIFAR-10, and SVHN report that ADCP matches or outperforms ten existing detectors on all three anomaly types.

What carries the argument

The critical detection path is a sequence $\langle n^{v_0}_0, n^{v_1}_1, \dots, n^{v_{N-1}}_{N-1}\rangle$ that selects one neuron per layer, instantiated by a test input as the vector of that neuron's activation values (average-pooled channel values for convolutional layers). The selection loop is a greedy genetic mutation: start from a random path, randomly mutate one neuron, and keep the mutation only if the True Positive Rate of a Support Vector Domain Description trained on that path's features over the mixed normal/anomaly set increases. The method then ensembles $m$ such paths per class (typically $m=21$) using random subspace sampling and a voting rule over min-max normalised SVDD scores, with class-wise thresholds $\tau_i$ fixed at the 95% normal-recall level. This machinery converts the DNN into a small set of measurable neuron chains that serve as anomaly features.

What would settle it

Train ADCP on adversarial samples from FGSM only, then test on adversarial samples from a held-out attack family not used in path selection (e.g. AutoAttack or an adaptive attack); if the TPR at 95% TNR on that held-out family is close to the normal-input false positive rate rather than near the reported 90%+ levels, the claimed generalisation across anomaly types fails.

Watch

Extended reading notes

Core claim

ADCP establishes that a class-wise critical detection path, a sequence containing exactly one neuron per layer, chosen by genetic mutation to maximise TPR on a mixed normal/anomaly set, yields activation-vector features on which a Support Vector Domain Description model separates in-distribution from anomalous inputs. Because different paths capture different features, the method takes 21 such paths per class, trains one SVDD per path, normalises scores, and combines them by voting, with a per-class threshold set so that 95% of normal samples pass. The paper reports AUROC above 0.97 on most AD, OOD, and NS tasks across LeNet, VGG16, and ResNet models, and shows that paths selected on one anomaly type (e.g. OOD) transfer to other types (AD, NS) with only a small drop, which is the basis for the claim that the detector generalises.

Load-bearing premise

The critical paths selected by maximising true-positive rate on a mixed set that already contains the anomaly type being tested must keep separating normal from anomalous inputs when the anomaly type changes, without retraining.

Editorial extensions

If this is right

  • If the central claim holds, anomaly detection for image classifiers can be done without retraining or modifying the target DNN, using only the path features and per-path SVDD models.
  • A single set of critical detection paths would suffice for adversarial, out-of-distribution, and noise inputs, so practitioners would not need a separate detector per anomaly family.
  • Because each path contains one neuron per layer, the detector's decision can be traced to specific neurons, giving an interpretable reason why an input was flagged.
  • The ensemble of multiple paths compensates for the fact that individual paths catch different subsets of anomalies, with detection accuracy rising steeply when going from 1 to 3 paths and stabilising by 21 paths.
  • Path-based detection is cheaper at test time than profiling all training inputs as prior path methods do, at the cost of the one-time mutation search.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The transfer experiments in Section 4.8 suggest paths are not tightly coupled to the anomaly family used to select them, but the main evaluation still selects paths on the same family tested, so a fully held-out evaluation would clarify whether ADCP is unsupervised or a per-family supervised detector.
  • The same path-extraction idea could apply to non-image modalities such as speech, text, or network traffic, since the path definition only needs neuron activations and layer connectivity, though the paper tests only image classifiers.
  • Because path selection is driven by TPR on a mixed set, the selected paths may be biased toward the strongest available anomaly family; combining paths selected under several anomaly families might yield a more robust ensemble.
  • One could test path reuse across architectures: paths extracted from a VGG16 on CIFAR-10 may or may not transfer to a differently initialised or deeper model, which would tell whether the paths capture dataset structure or model-specific artefacts.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes ADCP, an anomaly detection method for DNN image classifiers that extracts "critical detection paths" (one neuron per layer) via a genetic mutation search. A candidate path is scored by the True Positive Rate (TPR) achieved when an SVDD model trained on class-specific training activations is applied to a mixed set of normal and anomaly samples, with per-class thresholds set so that 95% of normal samples pass. The selected paths are ensembled with random subspace sampling and a voting mechanism. The method is evaluated on MNIST, CIFAR-10, and SVHN for adversarial (AD), out-of-distribution (OOD), and noise (NS) inputs and compared with LID, Mahalanobis distance, MagNet, Feature Squeezing, NIC, ADCL, MemAE, Max-Softmax, ODIN, ELO, NPC, and EffPath. The authors claim that ADCP outperforms state-of-the-art methods and generalizes across AD, OOD, and NS inputs.

Significance. If the empirical claims survive a clean, held-out evaluation, this would be a useful contribution: the path representation is interpretable, the method does not modify the DNN, the code is publicly available, and the cross-type transfer experiment in Section 4.8 is a valuable check. However, as written, the evaluation protocol leaks both normal test data and the target anomaly types into path selection and threshold calibration, so the reported TPR/AUROC figures and the resulting superiority claims over unsupervised baselines are not yet substantiated. The paper's central claim is therefore plausible but unverified; the missing evidence is obtainable by re-running the evaluation with a stricter protocol.

major comments (4)
  1. [Sections 3.1 and 3.2] The evaluation protocol leaks the normal test set into both path selection and threshold calibration. Section 3.1 states that the mixed set used to score candidate paths contains normal samples "from a test set," and Section 3.2 states that each per-class threshold tau_i is computed to ensure that 95% of the normal samples from class i "of test sets" have scores above tau_i. The reported TPR at 95% TNR and AUROC are therefore computed against normal samples that were already used to select paths and set thresholds. This inflates the headline numbers and makes the comparison against unsupervised baselines unfair, because those baselines do not consume the test normal data during development. The authors should re-run the full evaluation with path selection and threshold calibration performed on a disjoint validation split of the in-distribution data, and report the metrics on a truly held-out test set.
  2. [Section 3.1] The anomaly side is also leaked: the mixed set used for path selection contains the same anomaly types that are later evaluated. For OOD detection the manuscript says, for MNIST, F-MNIST is picked as the anomaly set, and for CIFAR-10/SVHN, TinyImageNet is picked; for AD detection the mixed set is "a collection of adversarial samples of different attack methods," and the same attacks (FGSM, PGD, JSMA, CW, DeepFool) are then reported in Table 2. ADCP thus consumes target-anomaly samples during path selection, while most baselines do not. Section 4.8 provides cross-type transfer evidence, but it is limited to CIFAR-10 and still calibrates thresholds on test normal data, so it cannot rescue the general claim. I request a strict held-out evaluation in which paths are selected without access to the anomaly families used in the reported metrics, or at minimum a complete cross-type evaluation on all model/dataset combinations with thresholds set on validation normal data.
  3. [Section 4.3 and Algorithm 1] All reported numbers are single-point estimates, but Algorithm 1 is stochastic: the initial path, the layer to mutate, and the neuron to mutate are all randomly selected. Tables 2-7 report one number per cell, and the text summarizes rankings such as "the best performance 11 times out of 25" without any measure of dispersion. Given the near-saturated AUROC values (e.g., 99.9% in many cells), repeated runs with mean and standard deviation, or confidence intervals, are needed to determine whether the advantages over ADCL and ELO are significant. This is especially important because several comparisons in Table 4 are within 0.1-0.3 percentage points.
  4. [Section 4.8] The generalization test is incomplete as reported. The section only uses CIFAR-10 models and reports AUROC after ensembling 21 paths; it does not report TPR at 95% TNR or results for MNIST and SVHN. Moreover, even the OOD-to-AD and AD-to-OOD comparisons reuse test normal data for threshold calibration, so they do not address the leakage identified above. A complete cross-type table, including F-MNIST and Omniglot for MNIST and the SVHN OOD sets, with held-out thresholds, is required before the conclusion that "paths selected by different anomaly samples do not have a significant impact on the detection performance" can be accepted.
minor comments (6)
  1. [Section 4.1] The metric is mislabeled: "True Negative Rate at 95% of True Positive Rate" should be "True Positive Rate at 95% True Negative Rate," since the thresholds are set so that 95% of normal samples pass.
  2. [Section 3.1] The phrase "True Positive Positive Rate" should be simply "True Positive Rate."
  3. [Equation (6)] The word "Fasle" in the formal discriminator should be "False."
  4. [Section 5.2] The sentence "Jiang et al. [52] used a similar method" appears to cite the wrong work; reference [52] is Wang et al., and no separate Jiang et al. reference is listed.
  5. [Table 5] In the ResNet/SVHN block, the JSMA row contains "79.11//97.72" with an extra slash; this appears to be a typographical error.
  6. [Table 8] In the LeNet/MNIST row, the reported Total 5514.33 does not equal the sum of the two preceding columns (5740.32 + 44.01 = 5784.33).

Circularity Check

2 steps flagged · score 6.0 of 10

Main ADCP tables report TPR@95%TNR on anomaly populations used to select the paths, so the headline SOTA results are partly in-sample; Section 4.8 and ADCP* provide partial transfer evidence.

  1. fitted input called prediction [Section 3.1 (Critical Detection Path Extraction), Eq. (4); Section 4.1 Metrics; Tables 2-4]
    "Next, we construct a mixed set consisting of anomaly and normal samples belonging to class k. The normal samples are from a test set. ... For OOD/NS detection, we pick one OOD set as anomaly sample. For MNIST, we pick F-MNIST as anomaly set. ... We feed the features of a mixed set of normal and anomaly samples on the same path to the pretrained SVDD model to obtain a score for each sample. ... This is implemented by calculating the True Positive Positive Rate (TPR) ..."

    The path-selection objective is TPR on a mixed set containing the very anomaly populations that the later evaluation reports: F-MNIST for MNIST OOD, the corresponding OOD set for CIFAR-10/SVHN, and adversarial samples of the attack families listed in Table 2. The reported metric is 'TPR at 95% TNR', with the same 95%-on-normal threshold rule, so for the main ADCP columns the path search has already been fitted to maximize the reported quantity on the evaluation anomaly distribution. The result is a partially in-sample score rather than an independent prediction. The FGSM-only ADCP* variant and the cross-type experiments in Section 4.8 are genuine transfer checks and limit the circularity.

  2. fitted input called prediction [Section 3.2 (Anomaly Detection, Threshold paragraph); Section 4.1 Metrics]
    "The threshold τ_i is computed in the same way while it need ensure that 95% of the normal samples from class i of test sets have scores above τ_i."

    The per-class operating threshold is calibrated on the test normal set, and the reported 'TPR at 95% TNR' numbers are then measured at exactly that threshold. The test normal data are therefore used both to fit the detector's operating point and to define the score that is presented as an evaluation result. This is additional test-set leakage: the 95% TNR condition is enforced by construction on the same test set used for reporting, and the comparison with baselines that do not calibrate on the test set is not strictly apples-to-apples.

full rationale

The central derivation of ADCP is not circular in the sense that the SVDD scorer is trained only on normal training data, and the path-search objective is a reasonable way to choose informative neurons. However, the headline experimental claim is partly in-sample: Section 3.1 selects critical paths by maximizing TPR on a mixed set whose anomaly component is the same type later reported in Tables 2-4, and Section 3.2 calibrates thresholds on test normal samples. Thus the reported TPR at 95% TNR for ADCP on OOD/NS and on the all-attack AD scenario is, by construction, the quantity optimized during path selection on the same anomaly population. The paper contains mitigating evidence: ADCP* (trained only on FGSM) still detects other attacks, and Section 4.8 shows paths selected on one anomaly family transfer to another, which is genuine out-of-population support. The self-citations, including the ADCL baseline [60], are not load-bearing for the method's derivation. Overall, the SOTA-superiority claims are not independently verified by the reported protocol, but the method is not equivalent to its inputs; the score reflects a partial by-construction reduction in the main evaluation.

Assumptions & free parameters 6 free parameters · 5 assumptions · 1 invented entities

The method rests on the unproven premise that path activations separate normal from anomaly inputs, plus several unstated hyperparameters (SVDD spread, nu, thresholds, mutation and path counts). The main free parameters are the test-calibrated thresholds and the anomaly-sample-driven path selection, which directly affect the reported performance.

free parameters (6)
  • Number of mutations n = 5000
    Set from stabilization curves in Section 4.5; larger n increases search cost.
  • Number of critical paths m = 21
    Chosen ad hoc in Section 4.5; voting uses 21 paths per class.
  • SVDD kernel spread s = not reported
    Free parameter in RBF kernel (Eq. 3); controls boundary tightness, no value given.
  • SVDD parameter nu = not reported
    Free parameter in Eq. (1) controlling slack and radius trade-off, not specified.
  • Per-class threshold tau = set for 95% TNR on normal test set
    Used in Eq. (6); calibrated on test normal samples, leaking test information into TPR at 95% TNR.
  • Mixed-set composition = 200 or 400 samples per class per attack
    Sampling counts for the adversarial mixed set in Section 3.1; affects TPR estimates.
assumptions (5)
  • domain assumption Normal and anomaly inputs produce separable activation patterns along critical detection paths
    Core premise of the paper, argued from Figure 1 but not proven.
  • domain assumption Greedy single-neuron mutation with TPR as objective converges to representative critical paths
    Algorithm 1 uses local search; the authors admit in the Conclusion that it lacks mathematical proof.
  • domain assumption SVDD with RBF kernel can model per-class path-activation distributions
    Section 3.2 builds one SVDD per path per class; kernel spread and nu are not specified.
  • domain assumption Paths selected on one anomaly type generalize to other anomaly types
    Required for the general-purpose claim; tested only in Section 4.8.
  • standard math SVDD optimization and RBF kernel theory
    Equations (1) to (3) come from Tax and Duin; standard background.
invented entities (1)
  • Critical detection path independent evidence
    purpose: A one-neuron-per-layer sequence used as a feature set for anomaly scoring
    It yields falsifiable detection accuracy on unseen anomaly samples and is compared against other path definitions; not a physical entity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anomaly Detection Based on Critical Paths for Deep Neural Networks." pith.science (2026). https://pith.science/paper/P6MVK4NO

@misc{pith2026250514967,
  author       = {Pith},
  title        = {Pith review of: Anomaly Detection Based on Critical Paths for Deep Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P6MVK4NO}},
  note         = {Machine review of arXiv:2505.14967}
}
read the original abstract

Deep neural networks (DNNs) are notoriously hard to understand and difficult to defend. Extracting representative paths (including the neuron activation values and the connections between neurons) from DNNs using software engineering approaches has recently shown to be a promising approach in interpreting the decision making process of blackbox DNNs, as the extracted paths are often effective in capturing essential features. With this in mind, this work investigates a novel approach that extracts critical paths from DNNs and subsequently applies the extracted paths for the anomaly detection task, based on the observation that outliers and adversarial inputs do not usually induce the same activation pattern on those paths as normal (in-distribution) inputs. In our approach, we first identify critical detection paths via genetic evolution and mutation. Since different paths in a DNN often capture different features for the same target class, we ensemble detection results from multiple paths by integrating random subspace sampling and a voting mechanism. Compared with state-of-the-art methods, our experimental results suggest that our method not only outperforms them, but it is also suitable for the detection of a broad range of anomaly types with high accuracy.

Figures

Figures reproduced from arXiv: 2505.14967 by the authors.

Figure 1
Figure 1. Two-dimensional representations of features extracted from the critical detection path of a LeNet model trained on MNIST. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. The overview of our approach for selecting critical detection path. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The AUROC corresponding to different paths on five models for different anomaly samples. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The TPR corresponding to the mutation number of ADCP on different models for adversarial attack in each class. [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: The TPR corresponding to the mutation number of ADCP on different models for OOD in each class. [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: The AUROC corresponding to the number of paths on different models for different adversarial attacks. [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: The AUROC corresponding to the number of paths on different models for different OOD data. [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: The visualization of 205 samples correctly decided corresponding to Top 3 critical detection paths for PGD (class 3) on MNIST. [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: The correlations of pearson corresponding to Top 10 critical detection paths for FGSM and PGD on MNIST. hIflf DiffAlSlhDiPf [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: The AUROC corresponding to the paths selected with OOD samples applied to AD detection and the paths selected with AD [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 51 canonical work pages

  1. [1]

    Vahdat Abdelzad, Krzysztof Czarnecki, Rick Salay, Taylor Denouden, Sachin Vernekar, and Buu Phan. 2019. Detecting Out-of-Distribution Inputs in Deep Neural Networks Using an Early-Layer Output. CoRR abs/1910.10307 (2019). arXiv:1910.10307 http://arxiv.org/abs/1910.10307

    work page Pith review arXiv 2019

  2. [2]

    Carlini and D

    N. Carlini and D. Wagner. 2017. Towards Evaluating the Robustness of Neural Networks. In Proceedings of 2017 IEEE Symposium on Security and Privacy (IEEE S&P-2017). 39–57

    work page 2017

  3. [3]

    Cohen, G

    G. Cohen, G. Sapiro, and R. Giryes. 2020. Detecting Adversarial Samples Using Influence Functions and Nearest Neighbors. In Proceedings of 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2020) . 14441–14450

    work page 2020

  4. [4]

    J. Deng, W. Dong, R. Socher, L. Li, Kai Li, and Li Fei-Fei. 2009. ImageNet: A large-scale hierarchical image database. In Proceedings of 2009 IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2009) . 248–255

    work page 2009

  5. [5]

    Alexey Dosovitskiy and Thomas Brox. 2016. Inverting visual representations with convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition(CVPR2016) . 4829–4837

    work page 2016

  6. [6]

    Feinman, R

    R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner. 2017. Detecting Adversarial Samples from Artifacts. arXiv 1703.00410

    arXiv 2017

  7. [7]

    Dario Floreano and Claudio Mattiussi. 2008. Bio-inspired artificial intelligence: theories, methods, and technologies . MIT press

    work page 2008

  8. [8]

    Dong Gong, Lingqiao Liu, Vuong Le, Budhaditya Saha, Moussa Reda Mansour, Svetha Venkatesh, and Anton van den Hengel. 2019. Memorizing Normality to Detect Anomaly: Memory-augmented Deep Autoencoder for Unsupervised Anomaly Detection. In IEEE International Conference on Computer Vision (ICCV 2019)

    work page 2019

Show all 61 references
  1. [9]

    I. J. Goodfellow, J. Shlens, and C. Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In Proceedings of International Conference on Learning Representations (ICLR 2015)

    2015

  2. [10]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. BadNets: Evaluating Backdooring Attacks on Deep Neural Networks. IEEE Access 7 (01 2019), 47230–47244. https://doi.org/10.1109/ACCESS.2019.2909068

    2019

  3. [11]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR 2016) . 770–778

    2016

  4. [12]

    Hendrycks and K

    D. Hendrycks and K. Gimpel. 2017. A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks. In International Conference on Learning Representations (ICLR2017)

    2017

  5. [13]

    Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. 2019. Deep Anomaly Detection with Outlier Exposure. In International Conference on Learning Representations (ICLR2019)

    2019

  6. [14]

    Hendrycks, M

    D. Hendrycks, M. Mazeika, and T. Dietterich. 2019. Deep anomaly detection with outlier exposure. In International Conference on Learning Representations (ICLR2019)

    2019

  7. [15]

    Geoffrey E Hinton, Simon Osindero, and Yee-Whye Teh. 2006. A fast learning algorithm for deep belief nets. Neural computation 18, 7 (2006), 1527–1554

    2006

  8. [16]

    Tin Kam Ho. 1998. The random subspace method for constructing decision forests. IEEE transactions on pattern analysis and machine intelligence 20, 8 (1998), 832–844

    1998

  9. [17]

    Y.-C. Hsu, Y. Shen, H. Jin, and Z. Kira. 2020. Generalized ODIN: Detecting Out-of-Distribution Image Without Learning From Out-of-Distribution Data. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR2020) . 10948–10957

    2020

  10. [18]

    Jinhan Kim, Robert Feldt, and Shin Yoo. 2019. Guiding deep learning system testing using surprise adequacy. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . IEEE, 1039–1049. Manuscript submitted to ACM xxii Fangzhen Zhao, Chenyi Zhang, Naipeng Do...

    2019

  11. [19]

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. 2012. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems (NIPS 2012) 25 (2012), 1097–1105

    2012

  12. [20]

    B. M. Lake, R. Salakhutdinov, and J. B. Tenenbaum. 2015. Human-level concept learning through probabilistic program induction. Science 350, 6266 (2015), 1332–1338

    2015

  13. [21]

    K. Lee, K. Lee, H. Lee, and J. Shin. 2018. A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks. In Proceedings of the 32nd International Conference on Neural Information Processing SystemsDecember (NeurIPS 2018) . 7167–7177

    2018

  14. [22]

    Tianlin Li, Aishan Liu, Xianglong Liu, Yitao Xu, Chongzhi Zhang, and Xiaofei Xie. 2021. Understanding adversarial robustness via critical attacking route. Information Sciences 547 (2021), 568–578

    2021

  15. [23]

    Liang, Y

    S. Liang, Y. Li, and R. Srikant. 2018. Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks. InInternational Conference on Learning Representations (ICLR2018)

    2018

  16. [24]

    Julia Lust and Alexandru Paul Condurache. 2020. A Survey on Assessing the Generalization Envelope of Deep Neural Networks: Predictive Uncertainty, Out-of-distribution and Adversarial Samples. arXiv preprint arXiv:2008.09381 (2020)

    2020 arXiv

  17. [25]

    Julia Lust and Alexandru P Condurache. 2022. Efficient detection of adversarial, out-of-distribution and other misclassified samples. Neurocomputing 470 (2022), 335–343

    2022

  18. [26]

    Lei Ma, Felix Juefei-Xu, Fuyuan Zhang, Jiyuan Sun, Minhui Xue, Bo Li, Chunyang Chen, Ting Su, Li Li, Yang Liu, et al. 2018. Deepgauge: Multi- granularity testing criteria for deep learning systems. InProceedings of the 33rd ACM/IEEE International Conference on Automated Softwa...

    2018

  19. [27]

    Lei Ma, Fuyuan Zhang, Jiyuan Sun, Minhui Xue, Bo Li, Felix Juefei-Xu, Chao Xie, Li Li, Yang Liu, Jianjun Zhao, et al. 2018. Deepmutation: Mutation testing of deep learning systems. In 2018 IEEE 29th International Symposium on Software Reliability Engineering (ISSRE) . IEEE, 100–111

    2018

  20. [28]

    Shiqing Ma and Yingqi Liu. 2019. Nic: Detecting adversarial samples with neural network invariant checking. In Proceedings of the 26th network and distributed system security symposium (NDSS 2019)

    2019

  21. [29]

    X. Ma, B. Li, Y. Wang, M. S. Erfani, N. R. S. Wijewickrema, E. M. Houle, G. Schoenebeck, D. Song, and J. Bailey. 2018. Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. In Proceedings of International Conference on Learning Representations (ICLR 2018)

    2018

  22. [30]

    Dongyu Meng and Hao Chen. 2017. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security (CCS 2017) . 135–147

    2017

  23. [31]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition . 2574–2582

    2016

  24. [32]

    Netzer, T

    Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Ng. 2011. Reading Digits in Natural Images with Unsupervised Feature Learning. In Proceedings of NIPS Workshop on Deep Learning and Unsupervised Feature Learning (NIPS 2011 Workshop)

    2011

  25. [33]

    Nguyen, J

    A. Nguyen, J. Yosinski, and J. Clune. 2015. Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Images. In Proceedings of 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2015) . 427–436

    2015

  26. [34]

    Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, et al. 2018. Technical Report on the CleverHans v2.1.0 Adversarial Examples Library. arXiv preprint arXiv:1610.00768 (2018)

    2018 arXiv

  27. [35]

    Papernot, P

    N. Papernot, P. D. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami. 2016. The Limitations of Deep Learning in Adversarial Settings. In Proceedings of 2016 IEEE European Symposium on Security and Privacy (EuroS&P-2016) . 372–387

    2016

  28. [36]

    Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. 2017. Deepxplore: Automated whitebox testing of deep learning systems. In proceedings of the 26th Symposium on Operating Systems Principles . 1–18

    2017

  29. [37]

    Yuxian Qiu, Jingwen Leng, Cong Guo, Quan Chen, Chao Li, Minyi Guo, and Yuhao Zhu. 2019. Adversarial defense through network profiling based path extraction. In the IEEE/CVF Conference on Computer Vision and Pattern Recognition(CVPR2019) . 4777–4786

    2019

  30. [38]

    Jayaram Raghuram, Varun Chandrasekaran, Somesh Jha, and Suman Banerjee. 2021. A general framework for detecting anomalous inputs to DNN classifiers. In International Conference on Machine Learning . PMLR, 8764–8775

    2021

  31. [39]

    Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. 2019. Likelihood ratios for out-of-distribution detection. Advances in Neural Information Processing Systems (NiPS2019) 32 (2019)

    2019

  32. [40]

    Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft

  33. [41]

    Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft

    Lukas Ruff, Robert A. Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft. 2020. Deep Semi-Supervised Anomaly Detection. In International Conference on Learning Representations . https://openreview.net/forum?id=HkgH0TEYwH

    2020

  34. [42]

    Chandramouli Shama Sastry and Sageev Oore. 2020. Detecting out-of-distribution examples with gram matrices. In International Conference on Machine Learning(ICML2020). PMLR, 8491–8501

    2020

  35. [43]

    Schölkopf, J

    B. Schölkopf, J. C. Platt, J. C. Shawe-Taylor, A. J. Smola, and R. C. Williamson. 2001. Estimating the Support of a High-Dimensional Distribution. Neural Computation 13, 7 (2001), 1443–1471

    2001

  36. [44]

    Weijun Shen, Jun Wan, and Zhenyu Chen. 2018. MuNN: Mutation Analysis of Neural Networks. In 2018 IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) . 108–115. https://doi.org/10.1109/QRS-C.2018.00032 Manuscript submitted to ACM Anomal...

    2018

  37. [45]

    Youcheng Sun, Min Wu, Wenjie Ruan, Xiaowei Huang, Marta Kwiatkowska, and Daniel Kroening. 2018. Concolic Testing for Deep Neural Networks. In 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE) . 109–119. https://doi.org/10.1145/3238147.3238172

    2018

  38. [46]

    D. Tax. 2001. One-class classification: Concept-learning in the absence of counter-examples . Ph. D. Dissertation. Delft University of Technology

    2001

  39. [47]

    D. M. J. Tax and R. P. W. Duin. 1999. Support vector domain description. Pattern Recognit. Letters. 20, 11-13 (1999), 1191–1199

    1999

  40. [48]

    Giovanni Vacanti and Arnaud Van Looveren. 2020. Adversarial detection and correction by matching prediction distributions. arXiv preprint arXiv:2002.09364 (2020)

    2020 arXiv

  41. [49]

    V. Vapnik. 2000. The Nature of Statistical Learning Theory . Springer

    2000

  42. [50]

    Dong Wang, Ziyuan Wang, Chunrong Fang, Yanshan Chen, and Zhenyu Chen. 2019. DeepPath: Path-driven testing criteria for deep neural networks. In 2019 IEEE International Conference On Artificial Intelligence Testing (AITest) . IEEE, 119–120

    2019

  43. [51]

    Jingyi Wang, Guoliang Dong, Jun Sun, Xinyu Wang, and Peixin Zhang. 2019. Adversarial sample detection for deep neural network through model mutation testing. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . IEEE, 1245–1256

    2019

  44. [52]

    Yulong Wang, Hang Su, Bo Zhang, and Xiaolin Hu. 2018. Interpret neural networks by identifying critical data routing paths. In the IEEE conference on computer vision and pattern recognition(CVPR2018) . 8906–8914

    2018

  45. [53]

    H. Xiao, K. Rasul, and R. Vollgraf. 2017. Fashion-MNIST: A Novel Image Dataset for Benchmarking Machine Learning Algorithms. arXiv 1708.07747

    2017 arXiv

  46. [54]

    Xiaofei Xie, Tianlin Li, Jian Wang, Lei Ma, Qing Guo, Felix Juefei-Xu, and Yang Liu. 2022. NPC: N euron P ath C overage via Characterizing Decision Logic of Deep Neural Networks. ACM Transactions on Software Engineering and Methodology (TOSEM) 31, 3 (2022), 1–27

    2022

  47. [55]

    P. Xu, K. A. Ehinger, Y. Zhang, A. Finkelstein, S. R. Kulkarni, and J. Xiao. 2015. TurkerGaze: Crowdsourcing Saliency with Webcam based Eye Tracking. arXiv 1504.06755

    2015 arXiv

  48. [56]

    W. Xu, D. Evans, and Y. Qi. 2018. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. In Proceedings of The Network and Distributed System Security (NDSS 2018)

    2018

  49. [57]

    Fuxun Yu, Zhuwei Qin, and Xiang Chen. 2018. Distilling critical paths in convolutional neural networks. arXiv preprint arXiv:1811.02643 (2018)

    2018 arXiv

  50. [58]

    F. Yu, Y. Zhang, S. Song, A. Seff, and J. Xiao. 2015. LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop. arXiv 1506.03365

    2015 arXiv

  51. [59]

    Ziqi Zhang, Yuanchun Li, Yao Guo, Xiangqun Chen, and Yunxin Liu. 2020. Dynamic slicing for deep neural networks. In the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering(ESEC/FSE-2020) . 838–850

    2020

  52. [60]

    Fangzhen Zhao, Chenyi Zhang, Naipeng Dong, Zefeng You, and Zhenxin Wu. 2022. A Uniform Framework for Anomaly Detection in Deep Neural Networks. Neural Processing Letters (2022), 1–22. Manuscript submitted to ACM

    2022

  53. [2018]

    In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol

    Deep One-Class Classification. In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 80), Jennifer Dy and Andreas Krause (Eds.). PMLR, Stockholmsmässan, Stockholm Sweden, 4393–4402. http://proceedings.mlr.press/...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.