DAAIN: Detection of Anomalous and Adversarial Input using Normalizing Flows

TL;DR

DAAIN introduces a unified method using normalizing flows to detect out-of-distribution and adversarial inputs in image segmentation, enhancing security and robustness without requiring specialized hardware.

Contribution

The paper presents a novel detection technique that monitors neural network activations with a density estimator, improving detection of anomalies and adversarial attacks in segmentation tasks.

Findings

Effective detection of OOD and AA inputs in segmentation models

Operates efficiently on a single GPU without specialized hardware

Hardens models against attacks by obscuring the detection process

Abstract

Despite much recent work, detecting out-of-distribution (OOD) inputs and adversarial attacks (AA) for computer vision models remains a challenge. In this work, we introduce a novel technique, DAAIN, to detect OOD inputs and AA for image segmentation in a unified setting. Our approach monitors the inner workings of a neural network and learns a density estimator of the activation distribution. We equip the density estimator with a classification head to discriminate between regular and anomalous inputs. To deal with the high-dimensional activation-space of typical segmentation networks, we subsample them to obtain a homogeneous spatial and layer-wise coverage. The subsampling pattern is chosen once per monitored model and kept fixed for all inputs. Since the attacker has access to neither the detection model nor the sampling key, it becomes harder for them to attack the segmentation network, as the attack cannot be backpropagated through the detector. We demonstrate the effectiveness of our approach using an ESPNet trained on the Cityscapes dataset as segmentation model, an affine Normalizing Flow as density estimator and use blue noise to ensure homogeneous sampling. Our model can be trained on a single GPU making it compute efficient and deployable without requiring specialized accelerators.