Pith. sign in

REVIEW 3 major objections 7 minor 48 references

Mitigating Spurious Negative Pairs for Robust Industrial Anomaly Detection

T0 review · 3 major / 7 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read COBRA claims that crafting pseudo-anomalies from hard-augmented normal images and training a contrastive loss on opposite pairs makes anomaly detectors robust to adversarial attacks without extra data or pretrained models.

desk verdict Big reported robustness gains and a genuinely new loss idea, but the loss is undefined as printed; the empirical story is strong enough that it deserves a serious referee, not a desk reject. read the letter →

arxiv 2501.15434 v1 pith:37Y7YUD4 submitted 2025-01-26 cs.CV

Hossein Mirzaei , Mojtaba Nafez , Jafar Habibi , Mohammad Sabokrou , Mohammad Hossein Rohban This is my paper · ORCID
classification cs.CV
keywords anomalydetectionadversarialrobustnesscontrastivelearningpseudo-anomalygenerationhardaugmentationone-classclassificationindustrialinspectiontraining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

COBRA claims that an anomaly detector can be made robust to adversarial attacks without any extra data or pretrained models by crafting pseudo-anomalies directly from normal training images. The paper shows that hard augmentations filtered by a Gaussian mixture threshold produce useful fake anomalies, and that a contrastive loss which pulls each normal sample apart from its own pseudo-anomaly, instead of repelling all negative pairs, creates both intra- and inter-group perturbations during adversarial training. If the claim holds, industrial and medical anomaly detectors that currently collapse under white-box attacks could retain most of their accuracy, with average robust AUROC under PGD-1000 rising from 39.7% to 65.8% on the tested benchmarks.

What carries the argument

The load-bearing object is the opposite pair $(x, \Upsilon(x))$, formed by a normal sample $x$ and its pseudo-anomaly $\Upsilon(x)$ generated by a randomized sequence of hard transformations (Jigsaw, CutPaste, random erasing, extreme blurring, and others) and accepted only when its likelihood under a Gaussian mixture model fitted to normal embeddings falls below a $p$-value threshold of 0.05. The COBRA loss combines a contrastive term aligning positive views, a term that repels the opposite pair by exponentiating its similarity with a negative sign, and a binary classification term; adversarial examples from PGD-10 are added into the positive set. The loss is $\mathcal{L}_{\mathrm{COBRA}} = \mathcal{L}_{\mathrm{CL}} + \mathcal{L}_{\mathrm{Opposite}} + \mathcal{L}_{\mathrm{CLS}}$, and the paper shows each term contributes to the final robust margin.

What would settle it

Measure COBRA's robust AUROC under PGD-1000 on a semantic anomaly detection benchmark where the anomalous classes are semantically distinct objects rather than texture defects, such as one-class CIFAR-10; the paper predicts a gain over the previous robust baseline, and the size of that gain reveals whether the augmentation-based pseudo-anomalies are a faithful proxy for real anomalies.

Watch

Extended reading notes

Core claim

The paper's central claim is that conventional contrastive learning fails at robust anomaly detection because its negative pairs include normal-normal and anomaly-anomaly pairs, which it calls spurious negative pairs; repelling these misdirects inter-group adversarial perturbations and shrinks the margin between normal and anomaly distributions. COBRA instead defines opposite pairs, each pairing a normal sample with its pseudo-anomaly generated by a sequence of hard transformations filtered to be genuinely outside the normal distribution, and trains so that positive pairs are pulled together and opposite pairs are adversarially pulled apart. The result is a detector whose robust AUROC under PGD-1000 is 75.1% on MVTecAD versus 30.1% for the best prior robust method, achieved without any additional dataset or pretrained model.

Load-bearing premise

The pseudo-anomalies produced by hard augmentations and filtered by a Gaussian mixture threshold faithfully represent the real anomalies encountered at test time, so the learned decision boundary aligns with genuine anomaly classes.

Editorial extensions

If this is right

  • On the paper's ten benchmark datasets, COBRA raises average robust AUROC under PGD-1000 from 39.7% to 65.8%, and on MVTecAD from 30.1% to 75.1%.
  • The robustness transfers across attack families: FGSM, black-box, composite, AutoAttack, and Adaptive AutoAttack all leave COBRA well above the prior robust baseline.
  • Because COBRA needs no additional anomaly dataset and no pretrained backbone, the recipe is portable to domains where real anomalies are scarce, such as medical imaging.
  • The ablations show that removing either the GMM threshold or the opposite-pair loss degrades robust performance, confirming that both components carry the result.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the texture-vs-semantic gap flagged in the paper's limitations holds, then the augmentation prior itself, rather than the adversarial training, may be the main driver of robustness; a semantic one-class benchmark would separate the two.
  • A testable extension is to feed COBRA's embedding-space margin into a segmentation or localization head, since the paper's score-function ablation suggests the margin is carried by the embeddings rather than by the classifier head.
  • The single significance-level hyperparameter of the GMM threshold may need per-dataset calibration when embedding statistics shift, despite the paper's sweep showing stability across its ten benchmarks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes COBRA, an anomaly-aware contrastive learning method for adversarial robustness in unsupervised anomaly detection. It generates pseudo-anomaly samples from normal training data via sequentially applied hard augmentations, filters them with a GMM-based threshold on embeddings of a transformation-classifier, and introduces a contrastive loss LCOBRA (Eq. 2-3) that combines positive-pair attraction with repulsion of 'opposite pairs' between normal and pseudo-anomaly samples. The model is trained with adversarial PGD examples on this loss plus a binary classification head. COBRA is evaluated in one-class and unlabeled multi-class settings on MVTecAD, CIFAR, ImageNet30, VisA, CityScapes, ISIC, and other datasets, reporting a robust AUROC average of 65.8% under PGD-1000 versus 39.7% for the best prior robust method, and 75.1% on MVTecAD. The appendix provides ablations, attack evaluations, and implementation details.

Significance. The reported gains, if reproducible, are substantial and practically important: COBRA does not use external anomaly datasets or pretrained models and shows robustness improvements of roughly 26 AUROC points on average. The paper includes multiple strengths: comparisons against a broad set of baselines, ablation studies of the pseudo-anomaly generator and loss function, evaluations under PGD-1000, AutoAttack, and adaptive attacks, stability and loss plots, per-class results, and a public implementation link. The main weakness is that the central loss equation as printed is mathematically undefined for some inputs, so the method cannot be reproduced or even precisely understood from the manuscript alone.

major comments (3)
  1. [§3.2, Eq. (2)-(3)] Eq. (2) defines LCOBRA as a log of {exp(sim(pos)/t) - exp(sim(opp)/t)} divided by a denominator; because cosine similarity can be -1 and temperature is finite, the numerator is negative whenever the opposite-pair similarity exceeds the positive-pair similarity, making the log undefined. Eq. (3) is worse: it takes the log of -exp(...)/Z, a negative quantity for every real input. Since LCOBRA is the objective used for both the min-max adversarial training and the reported experimental gains, this is a load-bearing problem. Algorithm 1 (Appendix A) invokes LCOBRA without a separate definition. The authors must correct the printed objective, state the exact implemented loss (e.g., whether a stability term or clamping is used), and ideally report the loss value ranges observed in training.
  2. [Tables 1-3] Several comparison tables contain formatting errors that make the empirical results impossible to read: in Table 1, the Screw row reads '98.1/ 0.0 / 98.0 / 3.8' for PatchCore, and in Table 2, the CIFAR10 MSAD cell reads '4.898.3/ 3.7' and the CityScapes COBRA cell reads '81.756.2'. These errors affect the very numbers supporting the central 26.1% improvement claim and must be corrected.
  3. [Appendix P (Limitations)] The appendix states that COBRA's performance is 'more pronounced in texture-based anomaly detection' than in semantic anomaly detection. This is a direct qualification of the central claim, since the headline average includes semantically separated classes such as CIFAR10/100 and ImageNet30. I ask the authors to explicitly quantify the robust gain separately for texture-based and semantic benchmarks and to adjust the abstract and conclusion wording if the average is driven mainly by texture datasets.
minor comments (7)
  1. [Section 3, Outline] The word 'psudo-anomaly' should be 'pseudo-anomaly'.
  2. [Section 5, last paragraph] The word 'perfomanc' should be 'performance'.
  3. [Appendix F, Figure 4 caption] The dataset name 'MVETEC-AD' should be 'MVTecAD'.
  4. [Algorithm 1, PGD comment] The comment 'Sample tow random requence of transforms' should read 'Sample two random sequences of transforms'.
  5. [§3.2, Eq. (2) and final loss] The symbol L is used both for the contrastive loss LCOBRA and for the final total loss, and the text switches from LCOBRA to L without a clear notational separation; please disambiguate these quantities.
  6. [Appendix K] The adaptation of AutoAttack replaces the DLR component with PGD; since this modifies a standard attack, please clarify whether the same altered AutoAttack is used for the baseline methods in Appendix G, and provide the exact attack configuration.
  7. [Table 20] In the 'Adv' row for DAGM, the entry reads '56.8± 56.1±1.42'; a standard deviation value appears to be missing for the first number.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: COBRA's claims are benchmarked against external baselines, and the undefined-loss issue in Eqs. (2)-(3) is a correctness concern, not a circularity.

full rationale

The paper's central claim is that COBRA improves robust anomaly-detection AUROC without extra data or pretrained models. The training objective (Eq. 2) is not defined in terms of the evaluation metric, and the anomaly score used at test time (negative maximum similarity to normal training embeddings) is independent of the loss's specific form. The pseudo-anomaly generation pipeline uses a separately trained transformation classifier and GMM threshold, which are then used to filter augmented samples; this is an input-generation mechanism, not a disguised version of the final AUROC evaluation. Comparisons are made to external methods, including Transformaly, PatchCore, and ZARND; the fact that ZARND shares authors is a self-citation, but it is used only as an empirical baseline and is not load-bearing for COBRA's derivation. The stated limitation that performance is more pronounced for texture-based defects is an honest scope restriction, not an admission of circularity. The undefined logarithms in Eqs. (2) and (3), as printed, are a mathematical correctness and reproducibility issue that prevents full verification, but they do not make the method's derivation equivalent to its inputs by construction. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from the authors' prior work, and no known result is merely relabeled. Therefore the circularity score is 0.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No new physical entities are introduced. The ledger is dominated by hyperparameters of the pseudo-anomaly generator and adversarial training, plus domain assumptions about the representativeness of synthetic anomalies. The central claim is empirical and does not rest on a new conserved quantity, mediator, or dimension.

free parameters (5)
  • significance level beta = 0.05 (default; swept 0.02 to 0.20)
    Controls the GMM p-value threshold deciding whether a hard-augmented sample is a pseudo-anomaly. Chosen by hand as a default significance level; central to the anomaly crafting stage.
  • contrastive temperature t = not reported in text
    Appears in the NT-Xent and LCOBRA denominators; the value must be recovered from code. It affects the sharpness of the similarity distribution and the margin shape.
  • PGD training epsilon = 4/255 (low resolution), 2/255 (high resolution)
    Inner maximization radius for adversarial training; directly determines the robustness level evaluated and the tradeoff with clean accuracy.
  • PGD training steps = 10
    Number of inner iterations during adversarial training; a free choice balancing attack strength and compute cost.
  • number of hard transformations per pseudo-anomaly = at least two, m < k
    Randomized sequence length in the pseudo-anomaly function; not fixed in the paper, so it influences the pseudo-anomaly distribution without a stated rule.
assumptions (4)
  • domain assumption Embeddings from the transformation classifier C are well modeled by a Gaussian mixture model, so p-values from the GMM identify samples outside the normal distribution.
    Used in Section 3.1 threshold computing to decide which hard-augmented samples are pseudo-anomalies.
  • domain assumption Hard-augmented normal samples, after thresholding, approximate the distribution of real anomalies closely enough to train a robust decision boundary.
    The method has no real anomalies during training; this is the core premise of the anomaly crafting strategy. The Limitations section concedes it holds better for texture defects than semantic anomalies.
  • domain assumption Adversarial training with PGD-10 at epsilon 4/255 transfers to stronger evaluation attacks such as PGD-1000, AutoAttack, and A3.
    The paper evaluates robustness at larger step counts and restarts; no formal guarantee is given.
  • ad hoc to paper Maximizing similarity of positive views and repelling only opposite pairs maximizes the margin between normal and anomaly distributions in the learned embedding.
    This is the conceptual motivation for LCOBRA; no theorem or guarantee is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mitigating Spurious Negative Pairs for Robust Industrial Anomaly Detection." pith.science (2026). https://pith.science/paper/37Y7YUD4

@misc{pith2026250115434,
  author       = {Pith},
  title        = {Pith review of: Mitigating Spurious Negative Pairs for Robust Industrial Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/37Y7YUD4}},
  note         = {Machine review of arXiv:2501.15434}
}
read the original abstract

Despite significant progress in Anomaly Detection (AD), the robustness of existing detection methods against adversarial attacks remains a challenge, compromising their reliability in critical real-world applications such as autonomous driving. This issue primarily arises from the AD setup, which assumes that training data is limited to a group of unlabeled normal samples, making the detectors vulnerable to adversarial anomaly samples during testing. Additionally, implementing adversarial training as a safeguard encounters difficulties, such as formulating an effective objective function without access to labels. An ideal objective function for adversarial training in AD should promote strong perturbations both within and between the normal and anomaly groups to maximize margin between normal and anomaly distribution. To address these issues, we first propose crafting a pseudo-anomaly group derived from normal group samples. Then, we demonstrate that adversarial training with contrastive loss could serve as an ideal objective function, as it creates both inter- and intra-group perturbations. However, we notice that spurious negative pairs compromise the conventional contrastive loss to achieve robust AD. Spurious negative pairs are those that should be closely mapped but are erroneously separated. These pairs introduce noise and misguide the direction of inter-group adversarial perturbations. To overcome the effect of spurious negative pairs, we define opposite pairs and adversarially pull them apart to strengthen inter-group perturbations. Experimental results demonstrate our superior performance in both clean and adversarial scenarios, with a 26.1% improvement in robust detection across various challenging benchmark datasets. The implementation of our work is available at: https://github.com/rohban-lab/COBRA.

Figures

Figures reproduced from arXiv: 2501.15434 by the authors.

Figure 1
Figure 1. ⃝1 : Given a training batch that includes normal group samples A and B, we create a anomaly group using our proposed transformation Υλ. These samples are paired as opposite pairs (e.g., A and AΥ) and subjected to τ1 and τ2 to form batches of positive pairs. Adversarial training is performed with a loss function combining LCLS and LCOBRA, where LCOBRA treats adversarial examples as positive pairs for the correspondin… view at source ↗
Figure 2
Figure 2. The figure highlights the challenges CPAD and CSI face in generating inncorrect anomalies [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. UMAP visualization of features extracted by the encoder [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: This figure depicts COBRA’s loss values and detection performance for each epoch of [PITH_FULL_IMAGE:figures/full_fig_p023_4.png]
Figure 5
Figure 5. Figure 5: Computation cost [PITH_FULL_IMAGE:figures/full_fig_p024_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 14 canonical work pages

  1. [1]

    Towards open world recognition

    Abhijit Bendale and Terrance Boult. Towards open world recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1893–1902,

    work page 1902

  2. [5]

    Robust one-class classification with signed distance function using 1-lipschitz neural networks

    Louis Béthune, Paul Novello, Thibaut Boissin, Guillaume Coiffier, Mathieu Serrurier, Quentin Vincenot, and Andres Troya-Galvis. Robust one-class classification with signed distance function using 1-lipschitz neural networks. arXiv preprint arXiv:2303.01978,

    arXiv

  3. [7]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083,

    arXiv

  4. [11]

    Ablation Study on Thresholding Here, while keeping all components of COBRA constant, we skip the thresholding strategy and instead use a random subset of hard transformations for crafting pseudo-anomaly samples. The results, indicated in Table 12, suggest that this approach leads to decreased performance due to the failure to filter incorrect pseudo-anoma...

    work page 2025

  5. [13]

    Fake it till you make it: Near-distribution novelty detection by score-based generative models

    Hossein Mirzaei, Mohammadreza Salehi, Sajjad Shahabi, Efstratios Gavves, Cees GM Snoek, Mohammad Sabokrou, and Mohammad Hossein Rohban. Fake it till you make it: Near-distribution novelty detection by score-based generative models. arXiv preprint arXiv:2205.14297,

    arXiv

  6. [14]

    Dream the impossible: Outlier imagination with diffusion models

    13 Published as a conference paper at ICLR 2025 Xuefeng Du, Yiyou Sun, Xiaojin Zhu, and Yixuan Li. Dream the impossible: Outlier imagination with diffusion models. arXiv preprint arXiv:2309.13415,

    arXiv 2025

  7. [15]

    Laion-5b: An open large-scale dataset for training next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. arXiv preprint arXiv:2210.08402,

    arXiv

  8. [16]

    V os: Learning what you don’t know by virtual outlier synthesis

    Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. V os: Learning what you don’t know by virtual outlier synthesis. arXiv preprint arXiv:2202.01197,

    arXiv

Show all 48 references
  1. [19]

    25 Published as a conference paper at ICLR 2025 Table 18: The detailed AUROC scores of the class-wise experiments for One-Class Anomaly Detection setting with PGD-1000 ϵ = 4 255 in CIFAR10, CIFAR100, MNIST, Fashion-MNIST, SVHN datasets. (a) MNIST Method Attack Class Average 0 ...

    2020

  2. [20]

    Simple copy-paste is a strong data augmentation method for instance segmentation

    Golnaz Ghiasi, Yin Cui, Aravind Srinivas, Rui Qian, Tsung-Yi Lin, Ekin D Cubuk, Quoc V Le, and Barret Zoph. Simple copy-paste is a strong data augmentation method for instance segmentation. arXiv preprint arXiv:2012.07177,

    2012 arXiv

  3. [21]

    Eren Akbiyik

    M. Eren Akbiyik. Data augmentation in training cnns: Injecting noise to images. ArXiv, abs/2307.06855,

    arXiv

  4. [22]

    Terrance DeVries and Graham W Taylor

    URL https://openreview.net/forum?id= r1Ddp1-Rb. Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv:1708.04552,

    arXiv

  5. [23]

    Learning and evaluating representa- tions for deep one-class classification

    Kihyuk Sohn, Chun-Liang Li, Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluating representa- tions for deep one-class classification. arXiv preprint arXiv:2011.02578,

    2011 arXiv

  6. [24]

    Contrastive predictive coding for anomaly detection

    14 Published as a conference paper at ICLR 2025 Puck de Haan and Sindy Löwe. Contrastive predictive coding for anomaly detection. arXiv preprint arXiv:2107.07820,

    2025 arXiv

  7. [25]

    Yannis Kalantidis, Mert Bulent Sariyildiz, Noe Pion, Philippe Weinzaepfel, and Diane Larlus

    URL https:// openreview.net/forum?id=Ovp8dvB8IBH. Yannis Kalantidis, Mert Bulent Sariyildiz, Noe Pion, Philippe Weinzaepfel, and Diane Larlus. Hard neg- ative mixing for contrastive learning. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances ...

    2020

  8. [26]

    Novelty detection via contrastive learning with negative data augmentation

    Chengwei Chen, Yuan Xie, Shaohui Lin, Ruizhi Qiao, Jian Zhou, Xin Tan, Yi Zhang, and Lizhuang Ma. Novelty detection via contrastive learning with negative data augmentation. In Zhi-Hua Zhou, editor, Proceedings of the Thirtieth International Joint Conference on Artificial Inte...

    2021 arXiv

  9. [27]

    Killing it with zero-shot: Adversarially robust novelty detection

    Hossein Mirzaei, Mohammad Jafari, Hamid Dehbashi, Zeinab Taghavi, Mohammad Sabokrou, and Moham- mad Hossein Rohban. Killing it with zero-shot: Adversarially robust novelty detection. pages 7415–7419, 04 2024b. doi: 10.1109/ICASSP48485.2024.10446155. Chuan Guo, Jacob Gardner, Y...

  10. [28]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572,

    arXiv

  11. [30]

    Hamprecht

    15 Published as a conference paper at ICLR 2025 Matthias Wieler, Tobias Hahn, and Fred A. Hamprecht. Weakly Supervised Learning for Industrial Optical Inspection, September

    2025

  12. [32]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747,

    arXiv

  13. [33]

    Robustness may be at odds with accuracy

    Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152,

    arXiv

  14. [34]

    Fastflow: Unsupervised anomaly detection and localization via 2d normalizing flows

    Jiawei Yu, Ye Zheng, Xiang Wang, Wei Li, Yushuang Wu, Rui Zhao, and Liwei Wu. Fastflow: Unsupervised anomaly detection and localization via 2d normalizing flows. arXiv preprint arXiv:2111.07677,

    arXiv

  15. [35]

    Universal novelty detection through adaptive contrastive learning

    Hossein Mirzaei, Mojtaba Nafez, Mohammad Jafari, Mohammad Bagher Soltani, Mohammad Azizmalayeri, Jafar Habibi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Universal novelty detection through adaptive contrastive learning. In Proceedings of the IEEE/CVF Conference on Comput...

    arXiv

  16. [36]

    Adversarially robust out-of-distribution detection using lyapunov- stabilized embeddings

    Hossein Mirzaei and Mackenzie W Mathis. Adversarially robust out-of-distribution detection using lyapunov- stabilized embeddings. arXiv preprint arXiv:2410.10744,

    arXiv

  17. [37]

    Scanning trojaned models using out-of- distribution samples

    Hossein Mirzaei, Ali Ansari, Bahar Dibaei Nia, Mojtaba Nafez, Moein Madadi, Sepehr Rezaee, Zeinab Sadat Taghavi, Arad Maleki, Kian Shamsaie, Mahdi Hajialilue, et al. Scanning trojaned models using out-of- distribution samples. In The Thirty-eighth Annual Conference on Neural I...

    arXiv

  18. [38]

    Killing it with zero-shot: Adversarially robust novelty detection

    Hossein Mirzaei, Mohammad Jafari, Hamid Reza Dehbashi, Zeinab Sadat Taghavi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Killing it with zero-shot: Adversarially robust novelty detection. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Pro...

    2024

  19. [39]

    A change of heart: Improving speech emotion recognition through speech-to-text modality conversion

    Zeinab Sadat Taghavi, Ali Satvaty, and Hossein Sameti. A change of heart: Improving speech emotion recognition through speech-to-text modality conversion. arXiv preprint arXiv:2307.11584, 2023a. Zahra Rahimi, Hamidreza Amirzadeh, Alireza Sohrabi, Zeinab Taghavi, and Hossein Sa...

    2024 arXiv

  20. [41]

    Sharif-str at semeval-2024 task 1: Transformer as a regression model for fine-grained scoring of textual semantic relations

    Seyedeh Fatemeh Ebrahimi, Karim Akhavan Azari, Amirmasoud Iravani, Hadi Alizadeh, Zeinab Sadat Taghavi, and Hossein Sameti. Sharif-str at semeval-2024 task 1: Transformer as a regression model for fine-grained scoring of textual semantic relations. arXiv preprint arXiv:2407.12...

    2024 arXiv

  21. [42]

    Understanding and mitigating the tradeoff between robustness and accuracy

    Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint arXiv:2002.10716,

    2002 arXiv

  22. [43]

    17 Published as a conference paper at ICLR 2025 A A LGORITHM BLOCK Algorithm 1 Adversarially Robust Anomaly Detection through Spurious Negative Pair Mitigation T ← {Color Jitter, Horizontal Flip, Grayscale, ...} ▷ Set of k light augmentations T ← {Rotation, Elastic, Distortion...

    2025

  23. [44]

    Recent standard AD methods can be categorized into two types: transfer learning based and CL based methods

    × ∥Bp−anomaly∥ τ1, τ2 = Sample tow random requence of transforms from T Badv ← {} for x, yin (B, Y) do x1, x2 ← τ1(x), τ2(x) P(x1), P(x2) ← {x2}, {x1} N(x) ← τ1(x′) : x′ ∈ B \ {x} ∪ τ2(x′) : x′ ∈ B \ {x} ▷ N(x)=N(x1)=N(x2) x_adv ← PGD(x, y, F , G, H, pgd_steps, α, ϵ) Badv.Add(...

    2021

  24. [45]

    Additionally, we considered A(x) + A′(x) as another alternative

    , which denotes the probability of belonging to the pseudo-anomaly class as assigned by the binary classifier head. Additionally, we considered A(x) + A′(x) as another alternative. As the results presented in Table 10 demonstrate, all strategies achieve significant performance...

    2025

  25. [128]

    Training Computational Cost

    Our experiments were conducted using NVIDIA GeForce RTX 3090 GPUs (24GB). Training Computational Cost. COBRA comprises two main steps: (i) generating pseudo-anomaly samples from the normal training set, and (ii) adversarially training a model using both normal and crafted pseu...

    2025

  26. [269]

    16 Published as a conference paper at ICLR 2025 ZeinabSadat Taghavi and Hossein Mirzaei

    URL https://aclanthology.org/2023.semeval-1.269/. 16 Published as a conference paper at ICLR 2025 ZeinabSadat Taghavi and Hossein Mirzaei. Backdooring outlier detection methods: A novel attack approach. arXiv preprint arXiv:2412.05010,

    2023 arXiv

  27. [2007]

    Acknowledge- ments The data was created by Matthias Wieler and Tobias Hahn

    URL https://doi.org/10.5281/zenodo.8086136. Acknowledge- ments The data was created by Matthias Wieler and Tobias Hahn. This work was conducted at the Robert Bosch Corporate Research department, Schwieberdingen, Germany. We also thank the participants in the contest, the parti...

    arXiv

  28. [2009]

    Skin lesion analysis toward melanoma detection 2018: A challenge hosted by the international skin imaging collaboration (isic)

    Noel Codella, Veronica Rotemberg, Philipp Tschandl, M Emre Celebi, Stephen Dusza, David Gutman, Brian Helba, Aadi Kalloo, Konstantinos Liopyris, Michael Marchetti, et al. Skin lesion analysis toward melanoma detection 2018: A challenge hosted by the international skin imaging ...

    2018 arXiv

  29. [2013]

    Large-margin contrastive learning with distance polarization regularizer

    12 Published as a conference paper at ICLR 2025 Shuo Chen, Gang Niu, Chen Gong, Jun Li, Jian Yang, and Masashi Sugiyama. Large-margin contrastive learning with distance polarization regularizer. In International Conference on Machine Learning, pages 1673–1683. PMLR, 2021b. Xux...

    2025 arXiv

  30. [2014]

    Composite adversarial attacks

    Xiaofeng Mao, Yuefeng Chen, Shuhui Wang, Hang Su, Yuan He, and Hui Xue. Composite adversarial attacks. ArXiv, abs/2012.05434,

    2012 arXiv

  31. [2015]

    One-class classification: A survey

    Pramuditha Perera, Poojan Oza, and Vishal M Patel. One-class classification: A survey. arXiv preprint arXiv:2101.03064,

    arXiv

  32. [2016]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255. IEEE,

    2009

  33. [2017]

    Unsupervised learning of visual representations by solving jigsaw puzzles

    Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. In Bastian Leibe, Jiri Matas, Nicu Sebe, and Max Welling, editors, Computer Vision – ECCV 2016, pages 69–84, Cham,

    2016

  34. [2018]

    Using self-supervised learning can improve model robustness and uncertainty

    Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances in Neural Information Processing Systems, 32, 2019a. Kejiang Chen, Yuefeng Chen, Hang Zhou, Xiaofeng Mao, Yuhong Li, Yuan He, Hu...

    2020 arXiv

  35. [2019]

    Generalized out-of-distribution detection: A survey

    Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. arXiv preprint arXiv:2110.11334,

    arXiv

  36. [2020]

    Deep nearest neighbor anomaly detection

    Liron Bergman, Niv Cohen, and Yedid Hoshen. Deep nearest neighbor anomaly detection. arXiv preprint arXiv:2002.10445,

    2002 arXiv

  37. [2021]

    Atom: Robustifying out-of-distribution detection using outlier mining

    Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying out-of-distribution detection using outlier mining. In Machine Learning and Knowledge Discovery in Databases. Research Track: European Conference, ECML PKDD 2021, Bilbao, Spain, September 13–17, 2...

    2021 arXiv

  38. [2022]

    Robust out-of-distribution detection for neural networks

    Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Robust out-of-distribution detection for neural networks. arXiv preprint arXiv:2003.09711, 2020a. Rui Shao, Pramuditha Perera, Pong C Yuen, and Vishal M Patel. Open-set adversarial defense. In Computer Vision–ECCV 2...

    2003 arXiv

  39. [2023]

    mixup: Beyond empirical risk minimization

    Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.09412,

    arXiv

  40. [2024]

    Mean-shifted contrastive loss for anomaly detection

    Tal Reiss and Yedid Hoshen. Mean-shifted contrastive loss for anomaly detection. arXiv preprint arXiv:2106.03844,

    arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.