# Electrical transport and magnetic properties of the triangular-lattice
compound Zr2NiP2

Zongtang Wan, Yuqian Zhao, Jiabin Liu  Yuesheng Li<EMAIL_ADDRESS>Wuhan National High Magnetic Field Center and School of Physics, Huazhong
University of Science and Technology, 430074 Wuhan, China

###### Abstract

We report the first investigation of the electrical and magnetic properties of
the triangular-lattice compound Zr2NiP2 (space group $P$63/$mmc$). The
temperature evolution of electrical resistivity follows the Bloch-Grüneisen-
Mott law, and exhibits a typically metallic behavior. No transition is visible
by both electrical and magnetic property measurements, and nearly no
magnetization is detected ($M_{0}$ $<$ 0.002$\mu_{\mathrm{B}}$/Ni) down to 1.8
K up to 7 T. The metallic and nonmagnetic characters are well understood by
the first-principles calculations for Zr2NiP2.

###### keywords:

Zr2NiP2, triangular lattice, metallic behavior, non-magnetism

††journal: Chemical Physics Letters

##  1 Introduction

Quasi-two-dimensional materials with exotic properties have fascinated
condensed matter physicists for decades. Among others, the prototype of a
resonating-valence-bond quantum spin liquid state had been proposed by P. W.
Anderson on the $S$ = 1/2 triangular-lattice Heisenberg antiferromagnetic
model in 1973 [1]. The experimental realizations of $S$ = 1/2 triangular-
lattice spin-liquid states had been extensively reported, e.g., in
$\kappa$-(BEDT-TTF)2Cu2(CN)3 [2, 3], EtMe3Sb[Pd(dmit)2]2 [4], Ba3CuSb2O9 [5],
YbMgGaO4 [6, 7], and NaYbCh2 (Ch = O, S, Se) [8, 9]. Recently, $S$ = 1
triangular-lattice spin-liquid ground states were also proposed [10, 11, 12,
13], and might be materialized by the Ni-based compounds, including NiGa2S4
[14, 15] and Ba3NiSb2O9 [16]. Besides this, unconventional high-temperature
superconductors had been discovered in many quasi-two-dimensional compounds,
including Cu-based [17, 18] and Fe-based [19] systems. It has been proposed
for a long time that the high-temperature superconductivity can be considered
as evolving from a doped spin-liquid state [20, 21]. The “smoking gun”
evidence for the intimate relationship between the high-temperature
superconductivity and spin liquid remain absent, and most of the existing
studies on spin liquid are restricted in the quasi-two-dimensional
geometrically frustrated Mott insulators. Therefore, it is intriguing to
explore the physical properties of new Cu-, Ni- or Fe-based metals with quasi-
two-dimensional geometrically frustrated lattices, e.g., the triangular
lattice.

The Ni-based triangular-lattice compound Zr2NiP2 belongs to the family of the
ternary pnictides Ln2NiX2 (Ln = Tb, Dy, Ho, Er and Zr; X = P, As), with the
hexagonal modification ($P$63/$mmc$ space group) [22]. Although these
compounds have been synthesized and structurally characterized long time ago
[22], other physical properties, e.g., electrical conductivity and magnetism,
remain completely unknown. In this work, we conducted the electrical transport
and magnetic property characterizations of Zr2NiP2. As shown in Figure 1, Ni
atoms form a geometrically perfect triangular lattice (intralayer Ni-Ni
distance of $\sim$ 3.77 Å), and are spatially separated by the double layers
of ZrP6 octahedra (interlayer Ni-Ni distance of $\sim$ 6.44 Å). The
temperature dependence of electrical resistivity is reasonably described by
the Bloch-Grüneisen-Mott (BGM) law, and indicates the intrinsic metallic
property of Zr2NiP2. Neither structural nor magnetic transition is observed by
electrical resistivity and magnetic susceptibility down to 1.8 K. The low-$T$
magnetization is measured to be tiny, $M_{0}$ $\leq$
0.002$\mu_{\mathrm{B}}$/Ni, up to 7 T. Ni should be in the nonmagnetic state,
which accounts for the weak magnetism observed in Zr2NiP2.

##  2 Materials and methods

The polycrystalline samples of Zr2NiP2 were synthesized from stoichiometric
mixtures of zirconium (99.5%, aladdin), nickel (99.8%,alfa), and red
phosphorus (99.999%, aladdin). To prevent oxidation, the starting materials
were mixed and pressed into pellets in an argon atmosphere glove box. The
pellets wrapped in platinum foil were transferred into a quartz tube, which
were sealed under vacuum (inner pressure of $\sim$ 2$\times$10-9 bar). The
sealed tube was heated to 500 ∘C at a rate of 1 ∘C/min, and its temperature
was maintained for three days. After that, the tube was further heated to 1000
∘C for seven days, and then cooled down to room temperature at a rate of
$\sim$ $-$1 ∘C/min. Air-insensitive and polycrystalline black Zr2NiP2 samples
were obtained, as shown in Figure 1(c).

The phase purity of the sample was checked by powder x-ray diffraction (XRD,
Rigaku) measurements with Cu $K_{\alpha}$ radiation ($\lambda$ = 1.5418 Å),
and a small weight fraction of nonmagnetic impurity ZrO2, 3.2$\pm$0.1%, was
found from Rietveld refinement (see Figure 1(c)), possibly due to the short
exposure to air during the synthesis process. The reaction between the
mixtures and the quartz tube was prevented by the platinum foil. The General
Structure Analysis System (GSAS) program was used for the Rietveld refinements
[23]. The ratio of Zr:Ni:P was semi-quantitatively determined by a scanning
electron microscope equipped with a x-ray energy dispersive spectrometer
(SEM–EDX, JEOL) to be $\sim$ (2.0$\pm$0.3):1:(1.9$\pm$0.3), consistent with
the ideal ratio of 2:1:2 within the resolution. The electrical resistivity
down to 2 K was measured by using the standard four-probe ac technique on two
cuboid-shaped as-grown samples of Zr2NiP2 (S1 and S2) in a physical property
measurement system (PPMS, Quantum Design) at both 0 and 9 T. The dc
magnetization measurements were carried out in a magnetic property measurement
system (MPMS, Quantum Design) down to 1.8 K up to 7 T, by using the as-grown
samples of $\sim$ 40 mg. As the magnetization signal of the title compound is
very weak, we carefully chose a quartz holder without evident background in
the magnetic property measurements.

Figure 1:  (a) Crystal structure of Zr2NiP2. NiP3 triangles (red) and ZrP6
octahedra (olive) are shown, and the dashed black lines mark the unit cell.
(b) The regular triangular lattice of Ni atoms. The interlayer distance of Ni-
Ni is $c$/2 $\sim$ 6.443 Å, much larger than the intralayer one $a$ $\sim$
3.772 Å. (c) X-ray powder diffraction measured at 300 K and Rietveld
refinement for Zr2NiP2. The inset shows a typical as-grown sample of Zr2NiP2.

We conducted first-principles calculations for Zr2NiP2 based on the density
functional theory (DFT) with the generalized gradient approximation in the
Vienna Ab initio Simulation Package (VASP) [24, 25, 26]. The crystal structure
experimentally determined by XRD was used as the starting one, and the kinetic
energy cutoff for the plane waves was specified to be 330 eV. The
6$\times$6$\times$6 $k$-mesh was used, and the lattice parameters were fixed
to their experimental values. The residual forces were below 0.003 eV/Å and
the total energy was converged to 10-8 eV in the fully optimized structure
with $z$(Zr) = 0.10995. We performed both DFT simulations with Coulomb
repulsions $U$ = 0 and 5 eV on Ni sites, but no essential difference was
found. Furthermore, we also relaxed the lattice parameters simultaneously, and
obtained $a$ = 3.775 Å, $c$ = 13.07 Å, and $z$(Zr) = 0.10996, reasonably
consistent with the experimental result (see Table 1).

##  3 Results and discussion

###  3.1 Crystal structure

Table 1: Crystal structure of the Zr2NiP2 phase determined by XRD at 300 K. The space group is $P$63/$mmc$ (No.194) with $a$ = 3.7717(1) Å and $c$ = 12.8860(4) Å, and the final Rietveld refinement results in $R_{\mathrm{p}}$ = 2.46% and $R_{\mathrm{wp}}$ = 3.99%. The weight fraction of the impurity phase ZrO2 (space group $P$ 21/$c$) is refined to be, 3.2$\pm$0.1%. Due to the low intensities of the reflections of the impurity phase (Figure 1(c)), we only refined the phase fraction and lattice parameters of ZrO2, but fixed other atom parameters as reported in reference [27]. The resulted $a$(ZrO2) = 5.143(2) Å, $b$(ZrO2) = 5.285(3) Å, $c$(ZrO2) = 5.373(3) Å, and $\beta$(ZrO2) = 99.17(2)∘ are reasonably consistent with the reported result of ZrO2 [27]. Atoms | Wyckoff position | $x$ | $y$ | $z$ | Occ. | 100$\times U_{\mathrm{iso}}$ (Å2)
---|---|---|---|---|---|---
Zr | 4f | 1/3 | 2/3 | 0.10995(4) | 1 | 1.10(2)
Ni | 2b | 0 | 0 | 1/4 | 1 | 2.34(5)
P1 | 2a | 0 | 0 | 0 | 1 | 1.22(7)
P2 | 2c | 1/3 | 2/3 | 3/4 | 1 | 1.75(6)

Figure 1(c) shows the powder XRD pattern measured at 300 K and the final
Rietveld refinement. Except the possible nonmagnetic ZrO2 (weight fraction
$\sim$ 3%), no other impurity phases are visible in the samples of Zr2NiP2.
The grain size is estimated to be larger than 100 nm, according to the narrow
full width at half maximum $\sim$ 0.09∘ 111The instrumental resolution is
about 0.05∘. observed at 2$\theta$ = 34.5∘ (see Figure 1(c)) [23]. The
detailed crystallographic parameters and atomic positions are listed in Table
1. The refinement result suggests that the title compound has a hexagonal
structure and the $P$63/$mmc$ space group with two formulae per unit cell, as
previously reported in reference [22]. Moreover, our refined crystal structure
shows quantitative agreement with the previous result [22]. Ni atoms occupy
the 2b Wyckoff position and form a geometrically perfect triangular lattice
(see Figure 1(b)). Along the $c$ axis, the triangular layers of Ni atoms are
stacked in an “AA”-type stacking fashion, and well separated by the double
layers of ZrP6 octahedra. The interlayer Ni-Ni distance is $c$/2 = 6.4430(2)
Å, much larger than the intralayer Ni-Ni distance of $a$ = 3.7717(1) Å. The
Ni-Zr distances $\sim$ 2.8 Å are reasonably short, which may have considerable
influence on the magnetism of Zr2NiP2. All of these indicate a quasi-two-
dimensional nature of the system of Zr2NiP2. Moreover, no antisite mixing was
reported [22] due to the large chemical difference among Zr, Ni, and P atoms,
and thus the structural disorder should have marginal effects in Zr2NiP2.

###  3.2 Electrical transport

Figure 2:  Temperature dependence of the electrical resistivity ($\rho$) measured at (a) 0 and (b) 9 T on two as-grown samples of Zr2NiP2 (S1 and S2). The colored lines present the BGM fits (see main text) from 2 to 300 K. (c) The magnetoresistance of Zr2NiP2 measured at 9 T, MR(9 T) = [$\rho$(9 T)$-\rho$(0 T)]/$\rho$(0 T). The green lines show 1/[$\rho$(0 T)]2 measured on S1 and S2, respectively. Table 2: The BGM fitting parameters for Zr2NiP2. Here, $\sigma_{\mathrm{LS}}$ presents the least-squares standard deviation. |  $\rho_{0}$ ($\mu\Omega\cdot$m) |  $\Theta_{\mathrm{D}}$ (K) |  $R$ ($\mu\Omega\cdot$m/K) |  $K$ ($\mu\Omega\cdot$m/K3) |  $\sigma_{\mathrm{LS}}$ ($\mu\Omega\cdot$m)
---|---|---|---|---|---
S1, 0 T | 0.93 | 342 | 0.0052 | 4$\times$10-10 | 0.0088
S2, 0 T | 0.98 | 349 | 0.0057 | 1$\times$10-9 | 0.0108
S1, 9 T | 1.05 | 363 | 0.0051 | 8$\times$10-10 | 0.0109
S2, 9 T | 1.10 | 364 | 0.0054 | 8$\times$10-10 | 0.0122

Figure 2(a) and (b) show the electrical resistivity ($\rho$) measured on two
independent as-grown samples of Zr2NiP2 at $\mu_{0}H$ = 0 and 9 T down to 2 K,
and no significant sample dependence is observed. $\rho$ decreases with the
decrease of temperature, and gradually reaches a minimum below $\sim$ 25 K.
The measured temperature dependence can be well described by the BGM law [28,
29],

$\rho(T)=\rho_{0}+4R\Theta_{\mathrm{D}}(\frac{T}{\Theta_{\mathrm{D}}})^{5}\int_{0}^{\Theta_{\mathrm{D}}/T}\frac{x^{5}dx}{(e^{x}-1)(1-e^{-x})}-KT^{3},$
(1)

where $\rho_{0}$ is the temperature-independent residual resistivity, the
second term accounts for the electron-phonon scattering, and the $T^{3}$ term
is due to the Mott-type $s$-$d$ electron scattering. All the least-squares
fitting parameters are listed in Table 2. The resulted $\rho_{0}$, Debye
temperature $\Theta_{\mathrm{D}}$, and electron-phonon coefficient $R$ of
Zr2NiP2 show typically metallic features [30, 31]. In comparison, the
coefficient $K$ that is directly related to the strength of the $s$-$d$
interaction is about one order of magnitude smaller than those of many other
metals [30, 31].

Figure 2(c) shows the magnetoresistance measured on Zr2NiP2 at 9 T, MR(9 T) =
[$\rho$(9 T)$-\rho$(0 T)]/$\rho$(0 T), which also exhibits the common positive
values of metals, MR $\sim$ several percent [32, 33]. As presented in Figure
2(c), the temperature evolution of MR(9 T) roughly follows that of 1/[$\rho$(0
T)]2 in the case of Zr2NiP2. To understand this observation, we consider both
holes and electrons ($n_{1}$, $q_{1}$, $\mu_{1}$, and $n_{2}$, $q_{2}$,
$\mu_{2}$, respectively),

$\mathbf{j}=(\frac{n_{1}q_{1}\mu_{1}}{1+B^{2}\mu_{1}^{2}}+\frac{n_{2}q_{2}\mu_{2}}{1+B^{2}\mu_{2}^{2}})\mathbf{E}+(\frac{n_{1}q_{1}\mu_{1}^{2}}{1+B^{2}\mu_{1}^{2}}+\frac{n_{2}q_{2}\mu_{2}^{2}}{1+B^{2}\mu_{2}^{2}})\mathbf{E}\times\mathbf{B},$
(2)

where the electric field $\mathbf{E}$ and magnetic field $\mathbf{B}$ are
applied perpendicular and parallel to the $z$ axis, respectively. For
simplicity, we assume the carrier density $n_{1}$ = $n_{2}$ = $n$, zero-field
carrier mobility $\mu_{1}$ = $-\mu_{2}$ = $\mu$, and charge $q_{1}$ = $-q_{2}$
= $e$, so that the Hall term is negligible and current density $\mathbf{j}$ is
parallel to $\mathbf{E}$. Thereby, the magnetoresistance is given as, MR($B$)
= $B^{2}\mu^{2}$ = $B^{2}$/[2$ne\rho$(0 T)]2, in agreement with the
experimental observation.

The electrical transport characterizations (Figure 2) consistently suggest
that Zr2NiP2 is a typical metal without any evident transition down to 2 K.
Furthermore, both $\rho$ and low MR imply a nonmagnetic state of Ni in
Zr2NiP2. To confirm this, we conducted the magnetic property measurements (see
below).

###  3.3 Magnetic properties

Figure 3:  (a) Magnetic susceptibilities measured under zero-field cooling
(ZFC) and field cooling (FC) at 0.1 T down to 1.8 K for Zr2NiP2. The scatters
show the contributions of the bulk diamagnetism $\chi_{\mathrm{bulk}}$. (b)
Field dependence of isothermal magnetization measured at various temperatures.
$H_{\mathrm{p}}$ at 1.8 K is marked. The Brillouin fits (lines) to the
experimental magnetization (scatters) by fixing (c) and tuning (d) the $g$
factor.

Neither clear anomaly/kink nor splitting between the ZFC and FC
susceptibilities is observed (see Figure 3(a)), which also precludes the
existence of magnetic transition in Zr2NiP2 down to 1.8 K. Above $\sim$ 10 K,
the magnetic susceptibility is negative, $\chi$ $<$ 0, thus suggesting a
diamagnetism. In contrast, the susceptibility exhibits a profound Curie-like
tail at low temperatures, which is most likely to originate from a
paramagnetic impurity. To confirm this, we fit the experimental magnetization
($M$) by a combination of a Brillouin function for free $s$ = 1 Ni spins
(impurity) and a linear magnetization for the bulk system,

$M(H,T)=fg\mu_{\mathrm{B}}\frac{\exp(\frac{2\mu_{0}Hg\mu_{\mathrm{B}}}{k_{\mathrm{B}}T})-1}{\exp(\frac{2\mu_{0}Hg\mu_{\mathrm{B}}}{k_{\mathrm{B}}T})+\exp(\frac{\mu_{0}Hg\mu_{\mathrm{B}}}{k_{\mathrm{B}}T})+1}+\chi_{\mathrm{bulk}}(T)H,$
(3)

where $f$ is the fraction of free spins. When the $g$ factor is fixed to the
expected value $g$ = 2 with negligible spin-orbit coupling, we obtain $f$ =
0.25% and $\chi_{\mathrm{bulk}}$ = $-$0.0052, $-$0.0043, $-$0.0037, $-$0.0034,
$-$0.0037 cm3/mol-Ni at 1.8, 3, 5 10, 50 K, respectively, with the least-
squares standard deviation $\sigma_{\mathrm{LS}}$ =
0.0002$\mu_{\mathrm{B}}$/Ni (see Figure 3(c)). Moreover, we also treat $g$ as
an adjustable parameter, the goodness of fit gets better
($\sigma_{\mathrm{LS}}$ = 0.00004$\mu_{\mathrm{B}}$/Ni), and we find $g$ =
3.3, $f$ = 0.09%, and $\chi_{\mathrm{bulk}}$ = $-$0.0026, $-$0.0027,
$-$0.0029, $-$0.0032, $-$0.0037 cm3/mol-Ni at 1.8, 3, 5 10, 50 K, respectively
(see Figure 3(d)). Both combined fits suggest that the bulk system of Zr2NiP2
remains diamagnetic/nonmagnetic down to 1.8 K, i.e., $\chi_{\mathrm{bulk}}$
$<$ 0\. The fitted $\chi_{\mathrm{bulk}}$($T$) is roughly consistent with the
total susceptibility measured at high temperatures, but doesn’t exhibit a
profound Curie-like tail at low temperatures (see Figure 3(a)).

No obvious magnetic hysteresis is observed, thus precluding ferromagnetic
freezing down to 1.8 K (Figure 3(b)). The diamagnetism is confirmed by $M$
measured above $\sim$ 10 K, as d$M$/d$H$ $<$ 0\. Below $\sim$ 10 K, the
paramagnetism of tiny impurities (i.e. d$M$/d$H$ $>$ 0) dominates at $H$ $<$
$H_{\mathrm{p}}$, whereas the bulk diamagnetism dominates at $H$ $>$
$H_{\mathrm{p}}$ after the polarization of the impurity spins. At
$\mu_{0}H_{\mathrm{p}}$ = 2-3 T and 1.8 $\leq$ $T$ $\leq$ 10 K, $M$ exhibits a
broad hump with the maximum magnetization, $M_{0}$ $\leq$
0.002$\mu_{\mathrm{B}}$/Ni, suggesting that most of Ni atoms are in the
nonmagnetic state in our samples of Zr2NiP2.

Figure 4:  The total, Zr-, Ni-, and P-DOS of Zr2NiP2 calculated by DFT with
$U$ = (a) 0 eV and (c) 5 eV, respectively. (b,d) Partial enlarged views of DOS
near the Fermi energies ($E_{\mathrm{F}}$ = 0 eV). The spin-up and spin-down
states are distinguished by positive and negative DOS, respectively, for
clarity. (e) The band structure. (f) The projection to the Ni-3$d$ states.

###  3.4 First-principles calculations

To understand the observed metallic and nonmagnetic characters, we calculated
the density of states (DOS) by DFT+$U$ for Zr2NiP2. Figure 4 shows the total
and partial DOS of Zr2NiP2 calculated with $U$ = 0 and 5 eV, respectively.
Several dispersive bands passing over the Fermi energy ($E_{\mathrm{F}}$ = 0
eV) are clearly observed with significant DOS (see Figure 4(b), (d), and (e)),
suggesting a typically metallic character of Zr2NiP2. The DOS at $E$ $\geq$
$E_{\mathrm{F}}$ is dominantly contributed by Zr atoms, which accounts for the
metallic nature.

The core diamagnetic contribution to the magnetic susceptibility can be
estimated as $\chi_{\mathrm{D}}$ $\sim$ $-$MW$\times$2$\pi\times$10-6 cm3/mol
(SI unit) [34] $\sim$ $-$2$\times$10-3 cm3/mol-Ni that is close to the
experimental value $\chi_{\mathrm{bulk}}$ $\sim$ $-$3$\times$10-3 cm3/mol-Ni
(see Figure 3(a)), where MW = 303 is the molecular weight of Zr2NiP2.
Therefore, it is reasonable to estimate that the Pauli susceptibility
($\chi_{\mathrm{Pauli}}$) should be less than $\sim$ 3$\times$10-3 cm3/mol-Ni.
We can obtain the DOS at the Fermi level $D$($E_{\mathrm{F}}$) =
$\chi_{\mathrm{Pauli}}$/($N_{\mathrm{A}}\mu_{0}\mu_{\mathrm{B}}^{2}$) $<$ 7
States/eV, which does not contradict with our DFT results. Alternately, the
Pauli susceptibility can be estimated as $\chi_{\mathrm{Pauli}}$ =
$N_{\mathrm{A}}\mu_{0}\mu_{\mathrm{B}}^{2}$$D$($E_{\mathrm{F}}$) =
2$\times$10-4 cm3/mol-Ni, where $D$($E_{\mathrm{F}}$) $\sim$ 0.5 States/eV is
calculated by DFT (see Figure 4(b) and (d)). Usually, it is very difficult to
precisely measure such a small Pauli susceptibility.

In the DFT+$U$ simulations, we considered both the initial antiferromagnetic
and ferromagnetic structures for Ni atoms, $|\uparrow\downarrow\rangle$ and
$|\uparrow\uparrow\rangle$ with a large magnetic moment $m$ =
2$\mu_{\mathrm{B}}$, but finally got the same nonmagnetic state with $m$ $<$
0.01$\mu_{\mathrm{B}}$ after optimizations. Moreover, the spin-up and spin-
down DOS are almost symmetric (see Figure 4), which naturally explains the
non-magnetism observed in Zr2NiP2 (see above) [35, 36]. The number of states
(occupancy) integrated the Ni DOS (Figure 4(a)) over $-$15 $\leq$ $E$ $\leq$ 0
eV (Fermi energy $E_{\mathrm{F}}$ = 0 eV) is calculated to be 9.5, and thus
the Ni valence may be $\sim$ +0.5 in Zr2NiP2. The band structure projected to
the Ni-3$d$ states is shown in Figure 4(f), most of the weight is below the
Fermi level, suggesting Ni tends to have the nonmagnetic electronic
configuration $d^{10}$.

There exists no essential difference between the DFT results calculated with
$U$ = 0 and 5 eV. Furthermore, we also performed the exactly similar DFT+$U$
simulations for the other members of the family, Ln2NiX2 with Ln = Y, In, Lu,
Zr and X = P, As, and obtained similar electrical and magnetic properties,
i.e., metallic nature and nonmagnetic state of Ni. These results imply that
the metallic and nonmagnetic ground state of Zr2NiP2 is fairly stable.

##  4 Conclusions

Polycrystalline and nearly pure-phase Zr2NiP2 has been successfully
synthesized by the solid-state method. Structural characterization shows that
the Ni atoms are arranged on a geometrically perfect triangular lattice and
spatially separated by the double layers of ZrP6 octahedra. The first
electrical transport and magnetic property measurements consistently
demonstrate that the Ni atoms are in the nonmagnetic state. The main actors of
metallicity of Zr atoms are responsible for the observed metallic behavior, as
revealed by the first-principles calculations. Our work should pave the way to
exploring the intriguing properties of the Ni-based triangular-lattice family
Ln2NiX2, as well as other quasi-two-dimensional materials.

## Acknowledgement

We thank Prof. Kan Zhao, Ying Li, and Bin Xi for helpful discussion. This work
was supported by the Fundamental Research Funds for the Central Universities,
HUST: 2020kfyXJJS054.

## References

  * [1] P. W. Anderson, Resonating valence bonds: A new kind of insulator?, Mater. Res. Bull. 8 (2) (1973) 153–160.
  * [2] Y. Shimizu, K. Miyagawa, K. Kanoda, M. Maesato, G. Saito, Spin liquid state in an organic Mott insulator with a triangular lattice, Phys. Rev. Lett. 91 (2003) 107001.
  * [3] S. Yamashita, Y. Nakazawa, M. Oguni, Y. Oshima, H. Nojiri, Y. Shimizu, K. Miyagawa, K. Kanoda, Thermodynamic properties of a spin-1/2 spin-liquid state in a $\kappa$-type organic salt, Nat. Phys. 4 (6) (2008) 459–462.
  * [4] T. Itou, A. Oyamada, S. Maegawa, M. Tamura, R. Kato, Quantum spin liquid in the spin-1/2 triangular antiferromagnet EtMe3Sb[Pd(dmit)2]2, Phys. Rev. B 77 (2008) 104413.
  * [5] H. D. Zhou, E. S. Choi, G. Li, L. Balicas, C. R. Wiebe, Y. Qiu, J. R. D. Copley, J. S. Gardner, Spin liquid state in the $S$ = 1/2 triangular lattice Ba3CuSb2O9, Phys. Rev. Lett. 106 (2011) 147204.
  * [6] Y. Li, H. Liao, Z. Zhang, S. Li, F. Jin, L. Ling, L. Zhang, Y. Zou, L. Pi, Z. Yang, J. Wang, Z. Wu, Q. Zhang, Gapless quantum spin liquid ground state in the two-dimensional spin-1/2 triangular antiferromagnet YbMgGaO4, Sci. Rep. 5 (2015) 16419.
  * [7] Y. Li, G. Chen, W. Tong, L. Pi, J. Liu, Z. Yang, X. Wang, Q. Zhang, Rare-earth triangular lattice spin liquid: a single-crystal study of YbMgGaO4, Phys. Rev. Lett. 115 (16) (2015) 167203.
  * [8] W. Liu, Z. Zhang, J. Ji, Y. Liu, J. Li, X. Wang, H. Lei, G. Chen, Q. Zhang, Rare-earth chalcogenides: A large family of triangular lattice spin liquid candidates, Chin. Phys. Lett. 35 (2018) 117501.
  * [9] M. Baenitz, P. Schlender, J. Sichelschmidt, Y. A. Onykiienko, Z. Zangeneh, K. M. Ranjith, R. Sarkar, L. Hozoi, H. C. Walker, J.-C. Orain, H. Yasuoka, J. van den Brink, H. H. Klauss, D. S. Inosov, T. Doert, NaYbS2: A planar spin-$\frac{1}{2}$ triangular-lattice magnet and putative spin liquid, Phys. Rev. B 98 (2018) 220409(R).
  * [10] Z.-X. Liu, Y. Zhou, T.-K. Ng, Possibility of $S$ = 1 spin liquids with fermionic spinons on triangular lattices, Phys. Rev. B 81 (2010) 224417.
  * [11] M. Serbyn, T. Senthil, P. A. Lee, Exotic $S$ = 1 spin-liquid state with fermionic excitations on the triangular lattice, Phys. Rev. B 84 (2011) 180403(R).
  * [12] C. Xu, F. Wang, Y. Qi, L. Balents, M. P. A. Fisher, Spin liquid phases for spin-1 systems on the triangular lattice, Phys. Rev. Lett. 108 (2012) 087204.
  * [13] S. Bieri, M. Serbyn, T. Senthil, P. A. Lee, Paired chiral spin liquid with a Fermi surface in $S$ = 1 model on the triangular lattice, Phys. Rev. B 86 (2012) 224409.
  * [14] S. Nakatsuji, Y. Nambu, H. Tonomura, O. Sakai, S. Jonas, C. Broholm, H. Tsunetsugu, Y. Qiu, Y. Maeno, Spin disorder on a triangular lattice, Science 309 (5741) (2005) 1697–1700.
  * [15] S. Nakatsuji, Y. Nambu, S. Onoda, Novel geometrical frustration effects in the two-dimensional triangular-lattice antiferromagnet NiGa2S4 and related compounds, J. Phys. Soc. Jpn. 79 (2010) 011003.
  * [16] J. G. Cheng, G. Li, L. Balicas, J. S. Zhou, J. B. Goodenough, C. Xu, H. D. Zhou, High-pressure sequence of Ba3NiSb2O9 structural phases: New $S$ = 1 quantum spin liquids based on Ni2+, Phys. Rev. Lett. 107 (2011) 197204.
  * [17] J. G. Bednorz, K. A. Müeller, Possible high $T_{\mathrm{C}}$ superconductivity in the Ba-La-Cu-O system, Zeitschrift für Physik B 64 (1986) 189–193.
  * [18] M. K. Wu, J. R. Ashburn, C. J. Torng, P. H. Hor, R. L. Meng, L. Gao, Z. J. Huang, Y. Q. Wang, C. W. Chu, Superconductivity at 93 K in a new mixed-phase Y-Ba-Cu-O compound system at ambient pressure, Phys. Rev. Lett. 58 (1987) 908–910.
  * [19] Y. Kamihara, T. Watanabe, M. Hirano, H. Hosono, Iron-based layered superconductor La[O1-xFx]FeAs ($x$ = 0.05-0.12) with $T_{\mathrm{C}}$ = 26 K, J. Am. Chem. Soc. 130 (2008) 3296–3297.
  * [20] P. W. Anderson, The resonating valence bond state in La2CuO4 and superconductivity, Science 235 (4793) (1987) 1196–1198.
  * [21] P. A. Lee, N. Nagaosa, X.-G. Wen, Doping a Mott insulator: Physics of high-temperature superconductivity, Rev. Mod. Phys. 78 (2006) 17–85.
  * [22] E. H. E. Ghadraoui, J. Y. Pivan, R. Guérin, M. Sergent, New ternary pnictides Ln2NiX2 (X = P, As) with a filled tip-type structure, Mat. Res. Bull. 23 (6) (1988) 891–898.
  * [23] A. C. Larson, R. B. Von Dreele, General Structure Analysis System (GSAS), Los Alamos National Laboratory Report LAUR 86–748, 2004.
  * [24] G. Kresse, J. Furthmüller, Efficiency of ab-initio total energy calculations for metals and semiconductors using a plane-wave basis set, Comput. Mater. Sci. 6 (1996) 15–50.
  * [25] G. Kresse, J. Furthmüller, Efficient iterative schemes for ab initio total-energy calculations using a plane-wave basis set, Phys. Rev. B 54 (1996) 11169–11186.
  * [26] J. P. Perdew, K. Burke, M. Ernzerhof, Generalized gradient approximation made simple, Phys. Rev. Lett. 77 (1996) 3865–3868.
  * [27] D. K. Smith, W. Newkirk, The crystal structure of baddeleyite (monoclinic ZrO2) and its relation to the polymorphism of ZrO2, Acta Cryst. 18 (6) (1965) 983–991.
  * [28] N. F. Mott, H. Jones, The theory of the properties of metals and alloys, Oxford University Press, London, 1958.
  * [29] G. Grimvall, The Electron-Phonon Interaction in Metals, North-Holland, Amsterdam, 1981.
  * [30] D. Kaczorowski, P. Rogl, K. Hiebl, Magnetic behavior in a series of cerium ternary intermetallics: ${\mathrm{Ce}}_{2}$T2In (T = Ni, Cu, Rh, Pd, Pt, and Au), Phys. Rev. B 54 (1996) 9891–9902.
  * [31] A. P. Pikul, D. Kaczorowski, P. Rogl, Y. Grin, Kondo effect in the presence of crystal-field in Ce-Ni-Ge compounds, phys. stat. sol. (b) 236 (2) (2003) 364–367.
  * [32] J. Nickel, Magnetoresistance overview, Hewlett-Packard Laboratories, Technical Publications Dept, 1995.
  * [33] A. B. Pippard, Magnetoresistance in metals, Cambridge University Press, London, 1989\.
  * [34] O. Kahn, Molecular magnetism, Wiley-VCH: New York, 1993.
  * [35] A. Ali, J.-M. Zhang, I. Muhammad, X.-M. Wei, I. Ahmad, M. U. Rehman, Changing the electronic and magnetic properties of monolayer HfS by doping and vacancy defects: Insight from first-principles calculations, Phys. Status Solidi B 257 (6) (2020) 1900768.
  * [36] Y. C. Cheng, Z. Y. Zhu, W. B. Mi, Z. B. Guo, U. Schwingenschlögl, Prediction of two-dimensional diluted magnetic semiconductors, Phys. Rev. B 87 (10) (2013) 100401.


# Trustworthy Anomaly Detection: A Survey

Shuhan Yuan 1 Xintao Wu 2
1Utah State University
2University of Arkansas
<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Anomaly detection has a wide range of real-world applications, such as bank
fraud detection and cyber intrusion detection. In the past decade, a variety
of anomaly detection models have been developed, which lead to big progress
towards accurately detecting various anomalies. Despite the successes, anomaly
detection models still face many limitations. The most significant one is
whether we can trust the detection results from the models. In recent years,
the research community has spent a great effort to design trustworthy machine
learning models, such as developing trustworthy classification models.
However, the attention to anomaly detection tasks is far from sufficient.
Considering that many anomaly detection tasks are life-changing tasks
involving human beings, labeling someone as anomalies or fraudsters should be
extremely cautious. Hence, ensuring the anomaly detection models conducted in
a trustworthy fashion is an essential requirement to deploy the models to
conduct automatic decisions in the real world. In this brief survey, we
summarize the existing efforts and discuss open problems towards trustworthy
anomaly detection from the perspectives of interpretability, fairness,
robustness, and privacy-preservation.

##  1 Introduction

Anomaly detection aims to find instances that are deviated from normal ones.
As a fundamental problem in machine learning with a wide spectrum of
applications, anomaly detection has gained a lot of attention in recent years
Ruff et al. (2021); Pang et al. (2020). Although advanced anomaly detection
techniques significantly improve the performance of identifying anomalies,
there are still high risks to simply count upon the models in sensitive
applications for automatic decision makings, such as health care or financial
systems. Meanwhile, many anomaly detection tasks involve human beings, such as
bank fraud detection, online troll detection, and malicious insider detection.
Therefore, it is natural to ask whether we should trust algorithms for the
task of labeling a person as an anomaly because every human being can be a
potential victim of the algorithms due to intentional or unintentional misuse.

Trustworthy AI, which emphasizes human value as principles in AI algorithms,
such as fairness, transparency, accountability, reliability, privacy, and
security, has become an urgent task for AI researchers Liu et al. (2021a). The
main objective is to design trustworthy AI algorithms that address the social
expectations of enhancing both AI ability and benefits to society without
threat or risk of harm Cheng et al. (2021); Liu et al. (2021a).

In the context of anomaly detection, besides the effectiveness in detecting
anomalies, trustworthy anomaly detection algorithms should also follow the
typical social norms just like all the expectations to AI algorithms. In this
brief survey, we focus on four important dimensions of trustworthy anomaly
detection, including interpretability, fairness, robustness, and privacy-
preservation.

##  2 Brief Review to Anomaly Detection

An anomaly is usually considered as an instance that deviates considerably
from normality Ruff et al. (2021). The anomaly detection model trained on a
given dataset usually aims at deriving an anomaly score for an input test
sample to distinguish anomalies from normal ones.

Due to the scarcity of anomalies in the training dataset, anomaly detection is
usually conducted in unsupervised and semi-supervised settings. The
unsupervised anomaly detection setting usually assumes unlabeled data in the
training set with rare anomalies, which follows the intrinsic property of data
distributions in real-world situations. As anomalies are rare in real cases,
one special case of the unsupervised setting, called one-class setting,
further assumes all those unlabeled training data are normal samples. On the
other hand, the semi-supervised anomaly detection setting typically assumes a
small number of labeled normal and abnormal samples and a large number of
unlabeled samples in the training dataset. Recent studies have demonstrated
that using a few anomalies for training can significantly improve anomaly
detection performance Ruff et al. (2020). Because collecting anomalies is
usually challenging, a special semi-supervised setting is positive-unlabeled
learning, i.e., achieving anomaly detection based on labeled normal and
unlabeled samples.

Based on whether the complex deep neural networks (DNNs) are deployed, the
anomaly detection models can be categorized into shallow and deep models. As
anomaly detection has been studied for decades, many traditional machine
learning models, i.e., shallow models, have been applied for detecting
anomalies, such as support vector data description (SVDD) and principal
component analysis (PCA). The shallow models are usually effective for
detecting anomalies on tabular data, but hard for handling complex data types,
such as text, image, or graph, due to lack of capability to capture non-linear
relationships among features. In recent years, many deep learning models are
proposed for anomaly detection because of their capability to automatically
learn representations or patterns from a variety of data. Both deep and
shallow anomaly detection approaches can be mainly categorized into four
groups, density estimation and probabilistic models, one-class classification
models, reconstruction models, and other miscellaneous techniques Ruff et al.
(2021).

Density estimation and probabilistic models detect anomalies by estimating the
normal data distribution. The anomalies are detected with low likelihood in
the normal data distribution. Generative models, including shallow models like
Gaussian mixture models (GMMs) and deep models like variational autoencoder
(VAE) and generative adversarial networks (GAN), have been applied for anomaly
detection. Generative models approximate the data distribution given a dataset
and deep generative models are further able to model complex and high-
dimensional data.

One-class classification models are discriminative approaches for anomaly
detection, which aim to learn a decision boundary based on normal samples.
One-class support vector machine (OC-SVM) as a classical one-class
classification model is widely used for anomaly detection. Similarly, deep
one-class classifiers such as Deep SVDD are developed recently to identify
anomalies from complex data. Deep SVDD trains a neural network to map normal
samples enclosed to a center of the hypersphere in the embedding space and
derives a sample’s anomaly score based on its distance to the center.

Reconstruction models are trained to minimize reconstruction errors on the
normal samples so that anomalies can be detected with large reconstruction
errors. Reconstruction-based anomaly detection models include traditional PCA,
which aims to find an orthogonal projection in a low-dimensional space with
the minimum reconstruction error when mapping back to the original space, and
recent deep autoencoder, which is parameterized by a deep neural network for
encoding and decoding data.

Other miscellaneous techniques, which do not fall in the above three
categories, are also developed for anomaly detection. Isolation forest Liu et
al. (2008) builds trees from unlabeled samples and label anomalies those
samples close to the root of trees. Local outlier factor (LOF), as another
unsupervised anomaly detection approach, computes the local density deviation
of a given data point with respect to its neighbors, and labels points having
a lower density than their neighbors as anomalies Breunig et al. (2000). As
normal samples are usually easy to obtain, Sipple (2020) adopts negative
sampling approaches to generate anomalies and then leverages the
classification models to achieve anomaly detection. Meanwhile, anomaly
detection can be modeled as a special scenario of few-shot learning when a few
anomalies are available for training Pang et al. (2021); Shuhan et al. (2020).

Table 1: Summary of Published Research in Trustworthy Anomaly Detection.
(I–Interpretable; F–Fair; R–Robust; P–Privacy-preserving)

| Approach | I | F | R | P | Structure | Data | Key features
---|---|---|---|---|---|---|---|---
Density models | GEE Nguyen et al. (2019) | $\bullet$ |  |  |  | VAE | Multivariate | Post-hoc gradient-based interpretation
OmniAnomaly Su et al. (2019) | $\bullet$ |  |  |  | GRU+VAE | Multivariate Time Series | Post-hoc interpretation
CAVGA Venkataramanan et al. (2020) | $\bullet$ |  |  |  | VAE | Image | Intrinsic interpretation
PPAD-CPS Keshk et al. (2019) |  |  |  | $\bullet$ | GMM | Multivariate | Anonymization-based approach
One-class models | FCDD Liznerski et al. (2021) | $\bullet$ |  |  |  | CNN | Image | Intrinsic interpretation
EM-attention Brown et al. (2018) | $\bullet$ |  |  |  | RNN | Sequence | Intrinsic interpretation
AE-1SVM Nguyen and Vien (2018) | $\bullet$ |  |  |  | AE-OCSVM | Multivariate/Image | Post-hoc gradient-based interpretation
OC-DTD Kauffmann et al. (2020) | $\bullet$ |  |  |  | OCSVM | Image | Post-hoc gradient-based interpretation
CutPaste Li et al. (2021) | $\bullet$ |  |  |  | CNN | Image | Post-hoc gradient-based interpretation
Deep Fair SVDD Zhang and Davidson (2021) |  | $\bullet$ |  |  | CNN/MLP | Multivariate/Image | Adversarial representation learning
Attack online AD Kloft and Laskov (2010) |  |  | $\bullet$ |  | SVDD | Multivariate | Poisoning attack
Reconstruction models | AE Shapley Takeishi and Kawahara (2020) | $\bullet$ |  |  |  | AE | Multivariate | Post-hoc perturbation-based interpretation
DCFOD Song et al. (2021) |  | $\bullet$ |  |  | MLP | Multivariate | Adversarial representation learning
FairOD Shekhar et al. (2021) |  | $\bullet$ |  |  | MLP | Multivariate | Fair regularizer
APAE Goodge et al. (2020) |  |  | $\bullet$ |  | AE | Multivariate | Adversarial defense
AE+PLS Lo et al. (2021) |  |  | $\bullet$ |  | AE | Multivariate | Adversarial defense
Other Miscellaneous | NGIG Sipple (2020) | $\bullet$ |  |  |  | MLP | Multivariate | Post-hoc gradient-based interpretation
DevNet Pang et al. (2021) | $\bullet$ |  |  |  | CNN | Image | Few-shot; post-hoc gradient-based interpretation
FairLOF P and Abraham (2020) |  | $\bullet$ |  |  | LOF | Multivariate | Heuristic principles
PPLOF P and Abraham (2020) |  |  |  | $\bullet$ | LOF | Multivariate | Cryptographic-based approach
Attack RNN-based AD Xu et al. (2020) |  |  | $\bullet$ |  | RNN | Sequence | Poisoning attack
Robust AD via DP Du et al. (2020) |  |  | $\bullet$ | $\bullet$ | AE/RNN | Image/Sequence | Improve robustness via differential privacy
| DPSGD Abadi et al. (2016) |  |  |  | $\bullet$ | DNN | General | General approach to achieve differential privacy

##  3 Trustworthy Anomaly Detection

From the trustworthy perspective, anomaly detection models should meet the
following key properties.

Performant: Effectively detecting anomalies is the basic requirement for all
anomaly detection models. Targeting on precisely identifying anomalies,
anomaly detection models aim to reduce the rate of misclassifying normal
samples as anomalies, or the rate of missing anomalies, or both. Meanwhile,
due to the scarcity of anomalies, the classical classification evaluation
metrics, such as accuracy, are not suitable to quantify the performance of
anomaly detection. Commonly-used evaluation metrics for anomaly detection
include area under the receiver operating characteristics (AUROC), area under
the precision-recall curve (PRROC), and the false-alert rate when achieving
95% of the true positive rate.

Interpretable: When deploying black-box anomaly detection models to make
critical predictions, there is an increasing demand for interpretability from
various stakeholders Preece et al. (2018). For example, if a bank account is
automatically suspended by algorithms due to potentially fraudulent
activities, both its user and the bank would like to know explanation, e.g.,
what activities lead to the suspension. Therefore, interpretable anomaly
detection requires the models be able to provide interpretations to the
detection results while maintaining the detection performance.

Fair: Ensuring the decisions free from discrimination against certain groups
is critical when deploying anomaly detection models for high-stake tasks,
e.g., predicting recidivism risk Dressel and Farid (2018). Any algorithmic
bias against some groups in anomaly detection models should be avoided, which
is a basic ethical requirement from the public.

Robust: Large pieces of work have demonstrated that machine learning models
including anomaly detection models are vulnerable to various adversarial
attacks. Model robustness is key to ensuring the reliability of models when
deployed to real-world scenarios, like detecting outliers in roadways for
intelligent transportation systems. Robustness in anomaly detection requires
the detection model has consistent outputs in face of attacking samples.

Privacy-preserving: Anomaly detection models require a large number of samples
for training. As a result, massive data collection for model training raises
privacy concerns. Properly protecting users’ sensitive data is important and
also required by government regulations. Privacy-preservation in anomaly
detection should be able to protect the privacy of data in three aspects: data
for training a model (input), the model itself, and the model’s predictions
(output). User private information should not be leaked in the whole pipeline
of training and deploying an anomaly detection model.

Table 1 summarizes existing approaches towards trustworthy anomaly detection
based on the above desideratum. Among them, the approach, Robust AD vis DP,
addresses both robustness and privacy-preservation. Note that we skip the
performance in this brief survey as several surveys in literature well cover
this perspective Ruff et al. (2021); Pang et al. (2020). Figure 1 further
summarizes the existing approaches towards trustworthy anomaly detection from
the perspective of using deep or shallow models. Note that OC-DTD and AE-1SVM
combine the shallow and deep models for interpretation.

Figure 1: Summary of published research in trustworthy anomaly detection by
using deep or shallow models.

##  4 Interpretable Anomaly Detection

Many state-of-the-art anomaly detection models are based on deep learning
models that are considered as black-box models. Because anomaly detection
models are commonly deployed in applications involving human beings, it is
important to achieve interpretability to avoid potential risk against humans
Panjei et al. (2022).

Interpretable anomaly detection aims to provide explanations to individual or
group predictions, especially for samples detected as anomalies. In
literature, interpretable machine learning techniques can be grouped into two
categories: intrinsic interpretability and post-hoc interpretability,
depending on the time when the interpretability is achieved Du et al. (2018).
Intrinsic interpretability means the models are self-explanatory and usually
is achieved by incorporating interpretability constraints or adding
interpretable layers in model structures. Post-hoc interpretability indicates
the use of a second model to provide explanations for the deployed model.
There are two commonly-used post-hoc interpretable techniques, perturbation-
based and gradient-based approaches. Perturbation-based approaches try to find
features that significantly affect model outcomes by sequentially removing or
replacing a feature, while gradient-based approaches calculate the gradient of
an output with respect to each input feature to derive its contribution

The majority of existing interpretable machine learning models are developed
for supervised learning tasks, such as image and text classification tasks,
where the labels are available. However, anomaly detection models are usually
semi-supervised or unsupervised learning models. How to interpret anomaly
detection results with only observing the normal samples is a challenge.

###  4.1 Approaches

Several studies extend the density-based anomaly detection approaches to
achieve interpretability. GEE adopts VAE to capture normal patterns and
derives anomaly scores for multivariate input samples Nguyen et al. (2019).
The post-hoc interpretation is achieved based on a gradient-based approach,
where features with large absolute gradients indicate significant contribution
to the output. CAVGA adopts the convolution-VAE to learn the latent
representation with the preservation of spatial information of images and
incorporates an attention map for interpretation Venkataramanan et al. (2020).
The attention map is trained to cover all the normal regions and the anomalous
regions can then be highlighted as the attention map without covering.

Several interpretable one-class anomaly detection models are developed. FCDD
provides intrinsic interpretation by generating anomaly heat maps to highlight
anomalous regions in abnormal maps Liznerski et al. (2021). Its core idea is
to generate a matrix with entries corresponding to the abnormal regions in an
image. If an image is abnormal, the sum of all entries in the matrix should be
maximized, while the sum for a normal image should be minimized. Besides image
data, an attention mechanism, which can highlight the important features in
sequential data, is used to identify anomalous events in log anomaly detection
Brown et al. (2018). To enhance the traditional one-class anomaly detection
models with explanations, one direction is neuralization, which is to convert
the non-neural network models to functionally equivalent neural network models
so that the interpretation techniques developed for deep learning models can
be leveraged Kauffmann et al. (2020). For example, OC-DTD models one-class SVM
as a three-layer structure, consisting of feature extraction, distance
computation, and pooling, and then applies the Layer-wise Relevance
Propagation (LRP) interpretation approach to assign scores to input features
Kauffmann et al. (2020). Another direction is to combine the deep model with
the shallow model. Nguyen and Vien (2018) develops an autoencoder based one-
class support vector machine (AE-1SVM) and uses the gradient-based attribution
methods to explain the detection results.

Regarding the reconstruction-based anomaly detection models, Antwarg et al.
(2020) develops interpretable autoencoder models to identify features leading
to high reconstruction errors based on SHAP, which is able to provide post-hoc
interpretation of detection results.

Some other techniques are also developed to achieve interpretable anomaly
detection. To leverage the interpretable techniques for supervised learning
models, Sipple (2020) develops a framework, which first generates anomalies by
negative sampling to train a binary classifier and then adopts a gradient-
based approach to detect abnormal features. InterpretableSAD further extends
the above idea to achieve interpretable sequence anomaly detection Han et al.
(2021). DevNet is a few-shot learning-based anomaly detection model and also
leverages the idea of the gradient-based approach to detect abnormal regions
in an image Pang et al. (2021).

###  4.2 Discussions

Existing approaches mainly focus on providing interpretation on point
anomalies, such as abnormal pixels in an image. Providing explanations on
contextual and collective anomalies is more challenging and greatly needed.
Meanwhile, besides providing local interpretation for a single prediction
result, understanding why a group of samples are labeled as anomalies, i.e.,
local interpretability for a group of predictions, can provide more insights
into abnormal behaviors.

##  5 Fair Anomaly Detection

The research community has well recognized that data-driven decision
algorithms can produce unfair or biased decisions against a group of people,
especially the minority groups, on the basis of some personal characteristics,
such as gender, race, or age, called protected or sensitive attributes.
Therefore, algorithmic fairness has received substantial attention in recent
years Zhang and Wu (2017); Mehrabi et al. (2021). Currently, a large number of
studies aim to achieve fairness in classical machine learning tasks, such as
classification, regression, clustering, or dimensionality reduction Mehrabi et
al. (2021). Recently, researchers notice that ensuring fairness in anomaly
detection is also critical. However, achieving fair anomaly detection has its
unique challenges due to the potentially high correlation between minority
groups and outliers, which means that anomaly detection approaches could
produce injustice outcomes by overly flagging the samples from the minority
groups as outliers. Currently, only a few studies target this emerging task.

###  5.1 Approaches

Following the typical requirements for fair machine learning models, existing
approaches usually decompose fair anomaly detection into two objectives,
anomaly detection and fair learning. Therefore, fair anomaly detection aims to
find potential anomalies that substantially differ from the majority instances
while maintaining insignificant to sensitive attribute subgroups Davidson and
Ravi (2020).

A few notions of fair anomaly detection are proposed, such as treatment parity
or statistical parity Shekhar et al. (2021); Song et al. (2021). The basic
idea is to ensure the anomaly detection result is invariant or independent of
the protected attributes. Therefore, fairness can be evaluated based on the
detection difference on protected and unprotected groups in terms of an
anomaly detection metric such as AUC.

FairLOF P and Abraham (2020) is one pioneering work to tackle the fair anomaly
detection problem with the focus on the local outlier factor (LOF) algorithm.
FairLOF proposes several heuristic principles to mitigate unfairness via
incorporating a correction term on LOF’s distance function so that samples in
under-represented groups have a similar distance distribution with the whole
population.

In the category of one-class anomaly detection, Deep Fair SVDD enhances the
Deep SVDD model with a fairness guarantee Zhang and Davidson (2021). The
approach adopts an adversarial fair representation learning model such that a
discriminator cannot predict the protected attribute given representations
derived by Deep SVDD. Therefore, the anomaly detection results are independent
of the protected attribute.

In the category of reconstruction-based anomaly detection, two approaches
based on autoencoder are developed. DCFOD adopts adversarial training to
ensure the representations derived from autoencoder free from the protected
attributes’ information with the discriminator’s guidance Song et al. (2021).
FairOD incorporates fairness regularization terms in addition to the regular
reconstruction loss into the objective function to minimize the absolute
correlation between the reconstruction error and protected attributes Shekhar
et al. (2021).

###  5.2 Discussions

Currently, research on fair anomaly detection is still in its infancy. In the
literature of fair machine learning, researchers have proposed a large number
of fairness notions in categories of group fairness, sub-group fairness, and
individual fairness. Current fair anomaly detection approaches only achieve
group fairness in terms of demographic parity that requires equal detection
rates across groups. Other fairness notions, especially individual fairness,
are still under-exploited. Meanwhile, as minority groups could have a strong
correlation with anomalies, correlation-based anomaly detection approaches
could mislabel minority groups as anomalies. It is imperative to develop
causation-based anomaly detection approaches that can provide a way to achieve
causation-based fair anomaly detection.

##  6 Robust Anomaly Detection

Recent studies have demonstrated that machine learning models are vulnerable
to intentionally-designed input samples from attackers, which can lead to
catastrophic results.

There are two common attacking strategies: 1) data poisoning attacks that are
conducted on the training time by injecting poisoned samples into training
data to compromise the learning model; 2) evasion attacks that try to fool the
detection models to make incorrect predictions on the testing phase by
carefully designed samples Chakraborty et al. (2018); Zhang et al. (2020).
Meanwhile, attacks can be further categorized into white-box attacks or black-
box attacks based on the amount of information available to attackers. In
white-box attacks, the attacker has complete access to the model, including
its structure and weights, and in black-box attacks, the attacker can only
access the probabilities or the labels of some probed inputs.

One connection between adversarial attacks and anomaly detection is that
adversarial samples can be considered as extremely hard-to-detect out-of-
distribution samples Bulusu et al. (2021); Ruff et al. (2021) because these
samples are crafted to mislead learning models. Several studies have
demonstrated that out-of-distribution detection can improve the model
robustness against adversarial attacks Hendrycks et al. (2019). While it is
interesting to study model robustness through out-of-distribution detection,
in this paper, we focus on reviewing adversarial attacks and defenses for
anomaly detection itself, where the attacker aims to craft adversarial samples
to evade detection or corrupt detection models.

###  6.1 Approaches

Some traditional one-class anomaly detection models, such as PCA, are
sensitive to noisy samples in the training set. Some outliers in the normal
training set may totally destroy the performance of detection models.
Therefore, robust models, such as robust PCA or robust SVM, are developed to
make detection models robust to noisy data that are arbitrarily corrupted.
Kloft and Laskov (2010) studies the poisoning attacks in an online one-class
anomaly detection scenario, where an anomaly score is derived based on a data
point’s distance to the center of normal samples. The goal of the attack is to
make the detection model accept anomalies with large distances to the center.
The theoretical analysis shows that if the attacker can control the training
data more than a traffic ratio, the poisoning attack can succeed to push the
center towards the attacking points. On the other hand, if the attacker can
control only a small ratio of training data, the attack would fail with an
infinite effort.

Recent studies have demonstrated that many popular white-box adversarial
attack approaches can be adapted for attacking anomaly detection models,
especially the reconstruction-based anomaly detection models, while common
defense approaches for classifiers are not very effective for anomaly
detection models Lo et al. (2021); Goodge et al. (2020). For example, the
autoencoder-based anomaly detection models are vulnerable to many white-box
attacking approaches, such as fast gradient sign method (FGSM) Kurakin et al.
(2017) or projected gradient descent (PGD) Madry et al. (2018). As a result,
perturbations on anomalous samples can cause the model to misclassify the
anomalies as normal samples by making the reconstruction errors decrease
rather than increase. To defend against such attacks, Goodge et al. (2020)
develops an approximate projection autoencoder (APAE) model with the
combination of two defense strategies, approximate projection and feature
weighting. The approximate projection is to update the latent embeddings
derived from the encoder to ensure the reconstructions have minimum changes,
while the feature weighting is to normalize reconstruction errors to prevent
the anomaly score from being dominated by the poorly reconstructed features.
Lo et al. (2021) also applies the idea of updating latent embeddings and
develops Principal Latent Space (PLS), which purifies the latent embeddings of
autoencoder based on principal component analysis.

###  6.2 Discussions

From the attack perspective, there are very limited studies in literature
focusing on the adversarial attack against anomaly detection models. Recently,
Xu et al. (2020) develops a poisoning attack approach against RNN-based
anomaly detection models and shows the attack can generate discrete
adversarial samples to damage the RNN model with a few instances. Various
adversarial attack strategies, such as exploratory attacks that try to gain
information about the model states by probing the models Chakraborty et al.
(2018) or backdoor attacks that create a backdoor into a learning model Chen
et al. (2017), are not explored in the anomaly detection context. It is
imperative to know how effective these potential adversarial attacks would be
against anomaly detection models before they are launched by attackers in
real-world applications.

From the defense perspective, existing studies focus on model-specific
defending strategies for whit-box attacks. Other defending strategies are also
worth exploring. For example, adversarial training is a widely-used strategy
to improve model robustness against adversarial attacks by incorporating
adversarial samples in the training set Goodfellow et al. (2015). However,
under the settings of unsupervised or one-class learning, we do not have
anomalies. In such cases, how to craft adversarial samples, especially the
anomalies in the purpose of evading detection, is challenging. It is also
interesting to develop new anomaly detection approaches to detect adversarial
samples that are crafted for anomaly detection models, e.g., based on the idea
of using out-of-distribution detection models to detect adversarial samples
from a polluted training set Bulusu et al. (2021).

##  7 Privacy-preserving Anomaly Detection

Many anomaly detection tasks involve the use of personal data, such as online
troll detection, bank fraud detection, or insider threat detection. Therefore,
privacy-preservation as a process of protecting sensitive information against
being revealed or misused by unauthorized users has been studied extensively
Xu et al. (2021c). The goal of privacy-preserving anomaly detection is to
achieve anomaly detection with the protection of sensitive information and
without compromising its effectiveness.

###  7.1 Approaches

Privacy-preserving anomaly detection can be categorized into three classes,
anonymization-based, cryptographic-based, and perturbation-based approaches.

Anonymization-based approaches are to achieve privacy protection by removing
personally identifiable information while keeping the utility of the data for
anomaly detection. Keshk et al. (2019) develops a privacy-preserving anomaly
detection framework for cyber-physical systems (PPAD-CPS). Its key idea is to
filter and transform original data into a new format in the data-processing
step, and adapt the Gaussian Mixture Model and Kalman Filter to detect
anomalies on the anonymized data.

Privacy-preserving LOF (PPLOF) is a cryptographic-based approach for anomaly
detection over vertically partitioned datasets among two parties Li et al.
(2015). A privacy-preserving windowed Gaussian anomaly detection algorithm on
encrypted data is developed for an edge computing environment in Mehnaz and
Bertino (2020).

Differential privacy (DP) is the de facto standard for conducting
perturbation-based privacy-preserving data analysis Dwork and Roth (2014).
However, fraud detection and differential privacy protection are intrinsically
conflicting because the goal of DP is to conceal presence or absence of any
particular instance and the problem of fraud detection is to identify anomaly
instances. Okada et al. (2015) balances these two tasks by using two
differentially private queries, counting the number of outliers in a subspace
and discovering top subspaces with a large number of outliers, to understand
behavior of outliers. DP can generally be achieved by injecting some random
noises to model’s input data, output, or objective function. To ensure
differential privacy in fraud detection, we can collect input data with local
differential privacy protection, use differentially private aggregates or
statistics for downstream anomaly detection tasks Fan and Xiong (2013), or
train deep learning based anomaly detection models by differentially private
stochastic gradient descent (DPSGD) Abadi et al. (2016), which adds Gaussian
noise to the aggregated gradients during the gradient descent process.

###  7.2 Discussions

There is always a trade-off between privacy protection and other quality of
models, such as model effectiveness or efficiency. It is well-known that
cryptographic-based approaches require high computational overhead, and
perturbation-based approaches could damage the model’s accuracy. Recently Du
et al. (2020) shows that applying differential privacy can potentially improve
the robustness of anomaly detection when the training set contains noises. The
intuition is that deep learning models with millions of parameters are capable
of remembering all the training samples including the noises. In the
unsupervised anomaly detection scenario, the model would consider rare
samples, such as backdoor samples, in the training set as normal ones due to
potential overfitting to rare samples. However, DP makes the model underfit
rare samples by injecting random noise during the training so that the overall
performance can be improved. It is worth studying in what circumstances
privacy-preserving approaches can also improve performance and robustness.

##  8 Future Directions

In this brief survey, we review the current research in trustworthy anomaly
detection from four perspectives, interpretability, fairness, robustness, and
privacy-preservation. Overall, compared with widely-studied classification
models, ensuring trustworthiness of anomaly detection models still has a large
room for improvement. Below we point out several potential future directions.

$\bullet$ Benchmark Datasets. There are limited datasets designed for
trustworthy anomaly detection. For interpretable anomaly detection, only a few
image and time series datasets with fine-grained labels regarding abnormal
regions can be used for evaluation Bergmann et al. (2019); Jacob et al.
(2021). Meanwhile, for fair anomaly detection, current studies usually adopt
widely-used datasets in the fair machine learning domain, such as COMPAS
Dressel and Farid (2018), but these datasets are not designed for anomaly
detection. Therefore, developing datasets related to trustworthy anomaly
detection is critical for conducting rigorous evaluation and boosting this
line of research.

$\bullet$ Model Agnostic Approaches. Current approaches to achieve specific
trustworthy desideratum for anomaly detection are often developed for each
specific model, such as fair autoencoder or interpretable CNN. Different
anomaly detection models are developed to tackle different types of data such
as images, videos, audios, text, graphs, and sequences, developing model-
agnostic approaches for trustworthy anomaly detection is important yet
exploited.

$\bullet$ Achieving Multiple Desiderata. Interpretability, fairness,
robustness, and privacy are not orthogonal to each other. Several recent works
have studied their connections in learning. Note that one desideratum would
affect another in an either positive or negative manner. For example,
Bagdasaryan and Shmatikov (2019) shows that differential privacy can lead to
disparate impact against minority groups and Xu et al. (2021a) studies how to
mitigate the disparate impact. On the other hand, Du et al. (2020) shows
differential privacy improves model robustness against backdoor attacks.
Moreover, privacy-preserving techniques can also act as defenders to protect
models from some other attacks, such as membership inference attacks. Xu et
al. (2021b) shows adversarial learning based defense techniques do not provide
sufficient protection to minority groups, which incurs unfairness. On the
contrary, Liu et al. (2021b) shows adversarial attack and defense can help
interpretation because both adversarial attack and interpretation need to
identify important features of input samples or important parameters of
models. In addition to understanding their inherent relationships, it is
imperative to develop a unified anomaly detection framework and new mechanisms
that can achieve multiple trustworthy desiderata simultaneously. For example,
Xu et al. (2019) shows both differential privacy and fairness can be achieved
by adding less noise to the objective function of logistic regression than
adding noise separately. Moreover, in addition to four desiderata studied in
this survey, it is also important to study other dimensions such as
auditability, and environmental well-being Liu et al. (2021a) in anomaly
detection. However, there are very limited research in this direction.

## References

  * Abadi et al. (2016) Martín Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang.  Deep Learning with Differential Privacy.  In CCS, 2016.
  * Antwarg et al. (2020) Liat Antwarg, Ronnie Mindlin Miller, Bracha Shapira, and Lior Rokach.  Explaining Anomalies Detected by Autoencoders Using SHAP.  arXiv:1903.02407, June 2020.
  * Bagdasaryan and Shmatikov (2019) Eugene Bagdasaryan and Vitaly Shmatikov.  Differential Privacy Has Disparate Impact on Model Accuracy.  In NeurIPS, October 2019.
  * Bergmann et al. (2019) Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger.  MVTec AD — A Comprehensive Real-World Dataset for Unsupervised Anomaly Detection.  In CVPR, 2019.
  * Breunig et al. (2000) Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and Jörg Sander.  LOF: Identifying density-based local outliers.  ACM SIGMOD Record, 29(2):93–104, May 2000.
  * Brown et al. (2018) Andy Brown, Aaron Tuor, Brian Hutchinson, and Nicole Nichols.  Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection.  In MLCS, 2018.
  * Bulusu et al. (2021) Saikiran Bulusu, Bhavya Kailkhura, Bo Li, Pramod K. Varshney, and Dawn Song.  Anomalous Example Detection in Deep Learning: A Survey.  arXiv:2003.06979, 2021.
  * Chakraborty et al. (2018) Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay.  Adversarial Attacks and Defences: A Survey.  arXiv:1810.00069 [cs, stat], September 2018.
  * Chen et al. (2017) Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song.  Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.  arXiv:1712.05526 [cs], December 2017.
  * Cheng et al. (2021) Lu Cheng, Kush R. Varshney, and Huan Liu.  Socially Responsible AI Algorithms: Issues, Purposes, and Challenges.  arXiv:2101.02032, 2021.
  * Davidson and Ravi (2020) Ian Davidson and S. S. Ravi.  A Framework for Determining the Fairness of Outlier Detection.  ECAI 2020, pages 2465–2472, 2020.
  * Dressel and Farid (2018) Julia Dressel and Hany Farid.  The accuracy, fairness, and limits of predicting recidivism.  Science advances, 4(1), 2018.
  * Du et al. (2018) Mengnan Du, Ninghao Liu, and Xia Hu.  Techniques for Interpretable Machine Learning.  arXiv:1808.00033 [cs, stat], July 2018.
  * Du et al. (2020) Min Du, Ruoxi Jia, and Dawn Song.  Robust anomaly detection and backdoor attack detection via differential privacy.  In ICLR, April 2020.
  * Dwork and Roth (2014) Cynthia Dwork and Aaron Roth.  The algorithmic foundations of differential privacy.  Foundations and Trends in Theoretical Computer Science, 9(3-4):211–407, 2014.
  * Fan and Xiong (2013) Liyue Fan and Li Xiong.  Differentially Private Anomaly Detection with a Case Study on Epidemic Outbreak Detection.  In ICDMW, 2013.
  * Goodfellow et al. (2015) Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and Harnessing Adversarial Examples.  arXiv:1412.6572, 2015.
  * Goodge et al. (2020) Adam Goodge, Bryan Hooi, See Kiong Ng, and Wee Siong Ng.  Robustness of Autoencoders for Anomaly Detection Under Adversarial Impact.  In IJCAI, 2020.
  * Han et al. (2021) Xiao Han, He Cheng, Depeng Xu, and Shuhan Yuan.  InterpretableSAD: Interpretable anomaly detection in sequential log data.  In IEEE Big Data, 2021.
  * Hendrycks et al. (2019) Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song.  Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty.  In NeurIPS, October 2019.
  * Jacob et al. (2021) Vincent Jacob, Fei Song, Arnaud Stiegler, Bijan Rad, Yanlei Diao, and Nesime Tatbul.  Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series.  arXiv:2010.05073 [cs], 2021.
  * Kauffmann et al. (2020) Jacob Kauffmann, Klaus-Robert Müller, and Grégoire Montavon.  Towards explaining anomalies: A deep Taylor decomposition of one-class models.  Pattern Recognition, 101:107198, May 2020.
  * Keshk et al. (2019) Marwa Keshk, Elena Sitnikova, Nour Moustafa, Jiankun Hu, and Ibrahim Khalil.  An Integrated Framework for Privacy-Preserving Based Anomaly Detection for Cyber-Physical Systems.  IEEE Transactions on Sustainable Computing, 6(1):66–79, 2019.
  * Kloft and Laskov (2010) Marius Kloft and Pavel Laskov.  Online Anomaly Detection under Adversarial Impact.  In AISTATS, 2010.
  * Kurakin et al. (2017) Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial Machine Learning at Scale.  In ICLR, February 2017.
  * Li et al. (2015) Lu Li, Liusheng Huang, Wei Yang, Xiaohui Yao, and An Liu.  Privacy-preserving LOF outlier detection.  Knowledge and Information Systems, 42(3):579–597, 2015.
  * Li et al. (2021) Chun-Liang Li, Kihyuk Sohn, Jinsung Yoon, and Tomas Pfister.  CutPaste: Self-Supervised Learning for Anomaly Detection and Localization.  In CVPR, April 2021.
  * Liu et al. (2008) F. T. Liu, K. M. Ting, and Z. Zhou.  Isolation Forest.  In ICDM, 2008.
  * Liu et al. (2021a) Haochen Liu, Yiqi Wang, Wenqi Fan, Xiaorui Liu, Yaxin Li, Shaili Jain, Yunhao Liu, Anil K. Jain, and Jiliang Tang.  Trustworthy AI: A Computational Perspective.  arXiv:2107.06641 [cs], August 2021.
  * Liu et al. (2021b) Ninghao Liu, Mengnan Du, Ruocheng Guo, Huan Liu, and Xia Hu.  Adversarial Attacks and Defenses: An Interpretation Perspective.  ACM SIGKDD Explorations Newsletter, 23(1):86–99, May 2021.
  * Liznerski et al. (2021) Philipp Liznerski, Lukas Ruff, Robert A. Vandermeulen, Billy Joe Franks, Marius Kloft, and Klaus-Robert Müller.  Explainable Deep One-Class Classification.  In ICLR, March 2021.
  * Lo et al. (2021) Shao-Yuan Lo, Poojan Oza, and Vishal M. Patel.  Adversarially Robust One-class Novelty Detection.  arXiv:2108.11168 [cs], August 2021.
  * Madry et al. (2018) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards Deep Learning Models Resistant to Adversarial Attacks.  In ICLR, 2018.
  * Mehnaz and Bertino (2020) Shagufta Mehnaz and Elisa Bertino.  Privacy-preserving Real-time Anomaly Detection Using Edge Computing.  In ICDE, 2020.
  * Mehrabi et al. (2021) Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan.  A Survey on Bias and Fairness in Machine Learning.  ACM Computing Surveys, 54(6):115:1–115:35, July 2021.
  * Nguyen and Vien (2018) Minh-Nghia Nguyen and Ngo Anh Vien.  Scalable and Interpretable One-class SVMs with Deep Learning and Random Fourier features.  In ECML-PKDD, October 2018.
  * Nguyen et al. (2019) Quoc Phong Nguyen, Kar Wai Lim, Dinil Mon Divakaran, Kian Hsiang Low, and Mun Choon Chan.  GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection.  In CNS, 2019.
  * Okada et al. (2015) Rina Okada, Kazuto Fukuchi, and Jun Sakuma.  Differentially private analysis of outliers.  In ECML PKDD, 2015.
  * P and Abraham (2020) Deepak P and Savitha Sam Abraham.  Fair Outlier Detection.  In arXiv:2005.09900, 2020.
  * Pang et al. (2020) Guansong Pang, Chunhua Shen, Longbing Cao, and Anton van den Hengel.  Deep Learning for Anomaly Detection: A Review.  arXiv:2007.02500 [cs, stat], July 2020.
  * Pang et al. (2021) Guansong Pang, Choubo Ding, Chunhua Shen, and Anton van den Hengel.  Explainable Deep Few-shot Anomaly Detection with Deviation Networks.  arXiv:2108.00462 [cs], August 2021.
  * Panjei et al. (2022) Egawati Panjei, Le Gruenwald, Eleazar Leal, Christopher Nguyen, and Shejuti Silvia.  A survey on outlier explanations.  The VLDB Journal, 2022.
  * Preece et al. (2018) Alun Preece, Dan Harborne, Dave Braines, Richard Tomsett, and Supriyo Chakraborty.  Stakeholders in Explainable AI.  arXiv:1810.00184 [cs], September 2018.
  * Ruff et al. (2020) Lukas Ruff, Robert A. Vandermeulen, Nico Görnitz, Alexander Binder, Emmanuel Müller, Klaus-Robert Müller, and Marius Kloft.  Deep Semi-Supervised Anomaly Detection.  In ICLR, February 2020.
  * Ruff et al. (2021) Lukas Ruff, Jacob R. Kauffmann, Robert A. Vandermeulen, Grégoire Montavon, Wojciech Samek, Marius Kloft, Thomas G. Dietterich, and Klaus-Robert Müller.  A Unifying Review of Deep and Shallow Anomaly Detection.  Proceedings of the IEEE, 109(5):756–795, May 2021.
  * Shekhar et al. (2021) Shubhranshu Shekhar, Neil Shah, and Leman Akoglu.  FairOD: Fairness-aware Outlier Detection.  In AIES, 2021.
  * Shuhan et al. (2020) Yuan Shuhan, Zheng Panpan, Wu Xintao, and Tong Hanghang.  Few-shot Insider Threat Detection.  In CIKM, 2020.
  * Sipple (2020) John Sipple.  Interpretable, Multidimensional, Multimodal Anomaly Detection with Negative Sampling for Detection of Device Failure.  In ICML, 2020.
  * Song et al. (2021) Hanyu Song, Peizhao Li, and Hongfu Liu.  Deep Clustering based Fair Outlier Detection.  In KDD, June 2021.
  * Su et al. (2019) Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei.  Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network.  In KDD, 2019.
  * Takeishi and Kawahara (2020) Naoya Takeishi and Yoshinobu Kawahara.  On Anomaly Interpretation via Shapley Values.  arXiv:2004.04464 [cs, stat], April 2020.
  * Venkataramanan et al. (2020) Shashanka Venkataramanan, Kuan-Chuan Peng, Rajat Vikram Singh, and Abhijit Mahalanobis.  Attention Guided Anomaly Localization in Images.  In ECCV, July 2020.
  * Xu et al. (2019) Depeng Xu, Shuhan Yuan, and Xintao Wu.  Achieving differential privacy and fairness in logistic regression.  In Companion of WWW, 2019.
  * Xu et al. (2020) Jinghui Xu, Yu Wen, Chun Yang, and Dan Meng.  An Approach for Poisoning Attacks Against RNN-Based Cyber Anomaly Detection.  In TrustCom, 2020.
  * Xu et al. (2021a) Depeng Xu, Wei Du, and Xintao Wu.  Removing disparate impact on model accuracy in differentially private stochastic gradient descent.  In KDD, 2021.
  * Xu et al. (2021b) Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang.  To be Robust or to be Fair: Towards Fairness in Adversarial Training.  In ICML, 2021.
  * Xu et al. (2021c) Runhua Xu, Nathalie Baracaldo, and James Joshi.  Privacy-preserving machine learning: Methods, challenges and directions.  arXiv preprint arXiv:2108.04417, 2021.
  * Zhang and Davidson (2021) Hongjing Zhang and Ian Davidson.  Towards Fair Deep Anomaly Detection.  In ACM FAccT, 2021.
  * Zhang and Wu (2017) Lu Zhang and Xintao Wu.  Anti-discrimination learning: A causal modeling-based framework.  IJDSA, 4(1):1–16, 2017.
  * Zhang et al. (2020) Wei Emma Zhang, Quan Z. Sheng, Ahoud Alhazmi, and Chenliang Li.  Adversarial Attacks on Deep-learning Models in Natural Language Processing: A Survey.  TIST, 11(3):24:1–24:41, April 2020.