AR-Pro: Counterfactual Explanations for Anomaly Repair with Formal Properties

We thank the reviewer for their useful suggestions on how to improve our experiments and presentation. We will incorporate these changes into our manuscript, and we believe that they will help us greatly improve the quality of our work. We have included some results of our work-in-progress experiments in the supplemental material, namely the addition of new models (EfficientAD [1] for vision, Llama-2-7b [2] for time-series) and datasets (MVTec [3] for vision, WADI [4] and HAI [5] for time-series). Below, we respond to the reviewer's comments and questions.

• Additional Models and Datasets. We are in the process of incorporating more recent models (EfficientAD, Llama-2-7b) and datasets (MVTec, WADI, HAI) to strengthen our experiments. In particular, WADI [4] is a time-series dataset that focuses on water distribution systems and contains anomalies related to sensor malfunctions and system faults. HAI [5] is another time-series dataset used for industrial control systems and includes anomalies such as cyber-attacks and operational failures. Like SWaT, both WADI and HAI have ground-truth feature-level annotations of anomalies. Due to limits in computing resources, we only include a sample of the ongoing experiments in the supplemental PDF. Importantly, we observe similar trends as our other experiments.

• Relation Between Property 1 and Properties 3 and 4. The reviewer is correct in noting the relation between Property 1 and Properties 3 and 4. After some deliberation, we felt that it was simpler for the exposition to keep them separate, particularly in their loss function encodings of Section 3.2. We tried some other formulations but could not reach a satisfactory balance of a smooth exposition and notational compactness. We are open to suggestions on how to rework the presentation, and we would be glad to hear if the reviewer might have some ideas.

• Figure 3 Quality. We have provided an updated Figure 3 in our supplementary PDF.

• Metric of $M_{1-w}$. We intended for this to be without the absolute value. Intuitively, the repair can have a lower anomaly score in the normal region since fixing the anomalous region may reduce the overall score of nearby features.

• Clarity of Section 3.3. We thank the reviewer for identifying this weakness. We will revise this section for greater clarity and detail.

[1] Batzner, Kilian, Lars Heckler, and Rebecca König. "Efficientad: Accurate visual anomaly detection at millisecond-level latencies." Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2024.

[2] Touvron, Hugo, et al. "Llama 2: Open foundation and fine-tuned chat models." arXiv preprint arXiv:2307.09288 (2023).

[3] Bergmann, Paul, et al. "MVTec AD--A comprehensive real-world dataset for unsupervised anomaly detection." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2019.

[4] Ahmed, Chuadhry Mujeeb, Venkata Reddy Palleti, and Aditya P. Mathur. "WADI: a water distribution testbed for research in the design of secure cyber physical systems." Proceedings of the 3rd international workshop on cyber-physical systems for smart water networks. 2017.

[5] Shin, Hyeok-Ki, et al. "{HAI} 1.0:{HIL-based} Augmented {ICS} Security Dataset." 13Th USENIX workshop on cyber security experimentation and test (CSET 20). 2020.

We thank the reviewer for their feedback on problem motivation and potential risks. We will revise our manuscript to address these concerns. Below are our responses to the comments and questions.

• Motivation for Fixing Anomalous Inputs. Anomaly repair is useful when the input data is noisy and needs to be cleaned [1]. This is studied in the context of image data [2, 10], time-series signals [3,4], graph data [5], and also heterogeneous data [6]. A common application is to improve the quality of the training data, while another is to recover from distribution shifts and allow downstream tasks to operate on data that is more in-distribution, i.e. rainy conditions in autonomous driving [7], geolocation data [8]. There are different ways to perform the repair, for example, [9] repairs anomalies through semantic-preserving transformations on images, while our work uses diffusion models for images and time-series, guided by formal specifications. In addition, we see a good opportunity to use repairs as an explainability method to improve the interpretability of black-box machine-learning models. Our proposed framework for counterfactual explanations is a step towards helping users better diagnose whether anomaly "hits" are indeed false positives by revealing what a non-anomalous input should have been like. Counterfactual explanations are especially relevant if the user is inexperienced or the data is complex [11].
• Properties 3 and 4 vs. Properties 1 and 2. Although Properties 3 and 4 are similar to Properties 1 and 2, their respective loss function encodings (Section 3.2) are different. Namely, the loss for Property 1 may be negative, while those for Property 2, 3, and 4 may not be. Moreover, Property 2 concerns similarity, while Property 4 concerns the anomaly score. We will clarify the exposition around this part.
• Embedding Properties into Training. We apologize for not fully understanding the reviewer's question, and we would appreciate some clarification. In the meantime, we hope the following can serve as a partial answer. We have previously tried to encode these properties into a repair model's training objective. In particular, we attempted to perform anomaly repair on image data with VAEs. Despite our best efforts, the repair models often produced blurry or incorrect outputs. It was only when we switched to iterative diffusion-style methods that we could attain high-quality repairs. We will expand our discussions on this.
• Availability of the Anomaly Map. The availability of the anomaly map is indeed a concern, especially if the detector were proprietary or closed-source. For open-sourced models implemented with libraries like PyTorch, we found that the anomaly map was usually available. For instance, the anomaly map was available for many detectors in Anomalib [12]. Nevertheless, the reviewer raises a valid point that the availability of the anomaly map is dependent on software implementation and should not be assumed. We will update our manuscript to address this limitation.
• Region Selector. Our anomalous region selector is the same as the commonly used thresholding methods. The user specifies a threshold vector $\tau \in \mathbb{R}^{n}$ to specify the anomaly threshold of each feature.
• Evasion of Anomaly Detectors. Since our work uses the detector's anomaly score in an optimization objective, attackers could potentially misuse our techniques. We will update our manuscript to discuss these risks. However, if attacks on anomaly detectors become common, it would likely spur interest in developing robust detectors, similar to the advancements in adversarial image classification and LLM jailbreaking defenses that followed extensive study of defensing against attacks.

[1] Yang, J., Zhou, K., Li, Y., & Liu, Z. (2024). Generalized out-of-distribution detection: A survey. International Journal of Computer Vision.

[2] Eduardo, S. F. L. M. (2023). Data cleaning with variational autoencoders.

[3] Wang, X., & Wang, C. (2019). Time series data cleaning: A survey. Ieee Access, 8, 1866-1881.

[4] Zhang, A., Song, S., Wang, J., & Yu, P. S. (2017). Time series data cleaning: From anomaly detection to anomaly repairing. Proceedings of the VLDB Endowment, 10(10), 1046-1057.

[5] Akoglu, L., Tong, H., & Koutra, D. (2015). Graph based anomaly detection and description: a survey. Data mining and knowledge discovery, 29, 626-688.

[6] Eduardo, S., Nazábal, A., Williams, C. K., & Sutton, C. (2020, June). Robust variational autoencoders for outlier detection and repair of mixed-type data. In International Conference on Artificial Intelligence and Statistics. PMLR.

[7] Filos, A., Tigkas, P., McAllister, R., Rhinehart, N., Levine, S., & Gal, Y. (2020, November). Can autonomous vehicles identify, recover from, and adapt to distribution shifts?. In International Conference on Machine Learning. PMLR.

[8] Corizzo, R., Ceci, M., & Japkowicz, N. (2019). Anomaly detection and repair for accurate predictions in geo-distributed big data. Big Data Research.

[9] Lin, V., Jang, K. J., Dutta, S., Caprio, M., Sokolsky, O., & Lee, I. (2024, June). DC4L: Distribution shift recovery via data-driven control for deep learning models. In 6th Annual Learning for Dynamics & Control Conference. PMLR.

[10] Pirnay, Jonathan, and Keng Chai. "Inpainting transformer for anomaly detection." In International Conference on Image Analysis and Processing. Cham: Springer International Publishing, 2022.

[11] Verma, Sahil, John Dickerson, and Keegan Hines. "Counterfactual explanations for machine learning: A review." arXiv preprint arXiv:2010.10596 2 (2020)

[12] Akcay, Samet, Dick Ameln, Ashwin Vaidya, Barath Lakshmanan, Nilesh Ahuja, and Utku Genc. "Anomalib: A deep learning library for anomaly detection." In 2022 IEEE International Conference on Image Processing (ICIP). IEEE, 2022.

We thank the reviewer for their positive review. Their feedback will help us greatly improve the clarity throughout the manuscript. We address the reviewer's comments and questions below.

• Scope of the assumptions. Although we use reconstruction-based anomaly detection as a motivating example, we are not restricted to such methods. Rather, our framework focuses on anomaly detectors with a linearly decomposable score (Definition 2.1). Linear decomposability includes many reconstruction-based methods (e.g., VAEs) as well as maximum likelihood-based ones (e.g., FastFlow). Despite this, it does not cover all anomaly detectors, such as clustering-based methods. We will improve our manuscript to better discuss the scope and limitations of our work to avoid confusion.

• Definition of $\hat{x}$ in Section 2. $\hat{x}$ denotes the reconstructed input obtained from reconstruction-based methods. We will update our manuscript to clarify this.

• Availability of base anomaly detector. We assume that the base anomaly detector is available. This is because we take the anomaly score into consideration when performing repairs. We will update our manuscript to clarify this.

• Extension to multivariate instances. Our framework can generalize to the multivariate case. For an input $x \in \mathbb{R}^n$, we use the $n$-dimensional thresholding vector $\tau \in \mathbb{R}^n$ to allow for fine-grained control of the anomaly region selector $\omega(x) \in \\{0,1\\}^n$ at each feature.

• $\alpha_i (x)$ in Definition 2.1. $\alpha_i (x)$ is the $i$th coordinate value of the anomaly map. In the given example, it is the absolute value between the reconstruction and original image on the $i$th feature. We will update our exposition to clarify this.

• Definition of “normal input”. We will update Section 3.1 of our manuscript to clarify that “normal input” means that the entire input (e.g., whole image) is considered non-anomalous.

• Spurious/normal signal in Figure 5(a). This figure compares our method (green) with the baseline (red) and shows that we generate qualitatively better (less “spurious”) signals. We will improve the wording in the experiments section to avoid confusion for future readers.