DAAIN: Detection of Anomalous and Adversarial Input using Normalizing Flows
This addresses the problem of security and reliability in computer vision systems, particularly for image segmentation, though it appears incremental by combining existing methods like normalizing flows and sampling techniques.
The paper tackled the challenge of detecting out-of-distribution inputs and adversarial attacks for image segmentation models by introducing DAAIN, a technique that monitors neural network activations and uses a density estimator with a classification head, achieving effective detection as demonstrated on an ESPNet trained on Cityscapes with compute efficiency on a single GPU.
Despite much recent work, detecting out-of-distribution (OOD) inputs and adversarial attacks (AA) for computer vision models remains a challenge. In this work, we introduce a novel technique, DAAIN, to detect OOD inputs and AA for image segmentation in a unified setting. Our approach monitors the inner workings of a neural network and learns a density estimator of the activation distribution. We equip the density estimator with a classification head to discriminate between regular and anomalous inputs. To deal with the high-dimensional activation-space of typical segmentation networks, we subsample them to obtain a homogeneous spatial and layer-wise coverage. The subsampling pattern is chosen once per monitored model and kept fixed for all inputs. Since the attacker has access to neither the detection model nor the sampling key, it becomes harder for them to attack the segmentation network, as the attack cannot be backpropagated through the detector. We demonstrate the effectiveness of our approach using an ESPNet trained on the Cityscapes dataset as segmentation model, an affine Normalizing Flow as density estimator and use blue noise to ensure homogeneous sampling. Our model can be trained on a single GPU making it compute efficient and deployable without requiring specialized accelerators.