Tianyu Huang, Chung Hoon Hong, Carl Wivagg, Kanna Shimizu

# Record Deduplication for Entity Distribution Modeling in ASR Transcripts

###### Abstract

Voice digital assistants must keep up with trending search queries. We rely on
a speech recognition model using contextual biasing with a rapidly updated set
of entities, instead of frequent model retraining, to keep up with trends.
There are several challenges with this approach: (1) the entity set must be
frequently reconstructed, (2) the entity set is of limited size due to latency
and accuracy trade-offs, and (3) finding the true entity distribution for
biasing is complicated by ASR misrecognition. We address these challenges and
define an entity set by modeling customers’ true requested entity distribution
from ASR output in production using record deduplication, a technique from the
field of entity resolution. Record deduplication resolves or deduplicates
coreferences, including misrecognitions, of the same latent entity. Our method
successfully retrieves 95% of misrecognized entities and when used for
contextual biasing shows an estimated 5% relative word error rate reduction.

Index Terms: Automatic Speech Recognition, Entity Resolution, Record
Deduplication, Contextual Biasing

##  1 Introduction

Voice digital assistants perform automatic speech recognition (ASR), natural
language understanding (NLU), and entity resolution (ER) over a variety of
domains, such as smart home, Q&A, and entertainment. ASR serves a key role as
it is upstream to all other functions, and its performance can determine how
successfully the voice assistant meets customer needs. In modern systems, the
ASR component is an ``end-to-end'' model based on architectures such as
recurrent neural network transducers (RNN-T) [1] or listen-attend-spell (LAS)
[2]. End-to-end ASR models map speech directly from voice data to graphemes
without an intermediate phoneme step. As a consequence, relative to component-
based models, end-to-end models struggle particularly with proper nouns and
rare words [3].

In this work, we focus on optimizing an end-to-end ASR model in the
entertainment domain, where customers search for artists, songs, TV shows, and
movies to play back. In entertainment, proper nouns and rare words are common
with requests such as ``play Metro Boomin'' (a popular singer) or ``search for
Bridgerton'' (a popular Netflix show). Therefore, one key challenge is spoken
entity recognition, where we require speech recognition to perform at scale
for these proper nouns, many of which can be easily confused with more common
words. Furthermore, our model must rapidly adapt to a non-stationary
distribution of requests where new hit songs, movies, and shows come out every
week and may rocket to viral popularity levels with little warning. In this
situation, we need to reconcile the time, cost, and engineering challenges of
frequent model retraining and production release against the need to match the
fast shifting customer request distribution.

We address these challenges with a twofold strategy. First, we leverage
contextual biasing, where we alter the output probability of recognized
entities without the latency or computational expense of full model
retraining. This is accomplished by shallow fusion, which uses on-the-fly
rescoring to adjust output probabilities during runtime inference with an
externalized list of scored entities [4]. Updating biasing in this way does
not require potentially costly model retraining and redeployment. However,
contextual biasing is not without limitations: lengthy lists of entity names
may degrade model accuracy or increase inference latency, which is critical
for a fast response to a customer request. Consequently, biasing lists are
limited to an entity budget of a few thousand entities. A few thousand does
not even meet the number of new songs released every week, much less the
entirety of other entertainment media content such as new movies, TV shows,
and podcast episodes.

The second part of our strategy is to optimize the utility of the entity
budget and to best capture the non-stationary aspects of the request
distribution. We accomplish this by starting with the observed entity
distribution in the ASR output stream. The stream is a distorted version of
the actual customer request distribution because of misrecognitions. For
example, Archive 81, a TV show, can been misrecognized as “arcade eighty one”,
“r. kelly one”, or several other results depending on the speaker conditions.
We deduplicate these multiple references to the same entity by leveraging
clustering techniques developed for record deduplication in ER research. After
we correct for the distortions and reconstruct the entity distribution, we
select entities and optimize weights to bias towards frequently misrecognized
entities.

##  2 Related Work

We are aware of relatively little previous work to optimize the use of a
shallow fusion entity budget. In early shallow fusion research, a weighted FST
representing a language model is derived from training data or some other
external reference [4, 5]; however, the assumption that the entity
distribution – or entity language model – can be derived from training data or
other external data sources does not hold for practical applications. Thus,
more recently, one group used a forecasting model to predict entity popularity
and preemptively populate a biasing list [6]. However, this approach limited
itself to forecasting trends based on exact matches of the entity name to the
reference in the user request. Thus, there is a particular risk of missing the
entities most in need of contextual biasing: those for which the ASR output
frequently differs from the entity name. In our work, we explicitly model the
entity distribution, allowing us in principle to identify the most popular
entities regardless of how they are referred to in user requests.

A subsequent line of research [7] used comparison of entity references to
entities in knowledge graphs to enhance ASR performance, but this differs in
many respects from our approach of co-comparison of entity references to other
references, and ultimately was not used to model the entity distribution for
contextual biasing.

Figure 1: Record Deduplication Model Design. a) Blocking b) Entity Comparison
c) Clustering.

##  3 Model Design

Our model uses a record deduplication framework. We aim to identify different
references to video title entities, like Bridgerton or Archive 81, in ASR
outputs. Different ASR outputs may refer to the same entity because of ASR
errors. For instance, ``arcade eighty one'' is likely a reference to Archive
81 just as ``archive eighty one'' is. So these request patterns are duplicates
from the perspective of the entity being requested. In ER terms, the two
request patterns are coreferent, a term we will use repeatedly going forward.
We aim to deduplicate the total set of references to video title entities by
clustering the references to each entity.

Formally, for a set $R$ of unique entity references drawn from a non-unique
set of user requests $U$ each containing one reference, we seek to create
subsets of $R$ corresponding to coreferences to some latent set of entities
$E$. If the subset of references $r_{1},r_{2},...,r_{n}$ are coreferent to
entity $e_{x}\\!\in\\!E$ and $p_{r_{i}}$ is the probability of encountering
$r_{i}$ in $U$, then $p_{e_{x}}=\sum_{i=1}^{n}p_{r_{i}}$ and is the
probability of a randomly selected user request referring to the entity
$e_{x}$. The set of all $p_{e}$ is the latent entity distribution.

###  3.1 Acquisition of References from the ASR Model

The record deduplication model takes as inputs the ASR outputs from our in-
house RNN-T model, which consists of an encoder LSTM and prediction network
layer with an embedding layer. The model also has a shallow fusion-based
language model that is used to bias to global and personalized catalogs [8].
The model was trained on over 200k hours of interactions with a voice
assistant [9]. We use this model to get the $n$-best ASR recognitions from
user requests or synthetic voice samples. In practice, ASR outputs are usually
further processed by an NLU model to segment entity references and assign them
to entity classes, but for this work, we confined our attention to a single
entity class (video content titles) and to requests consisting only of
references with no surrounding text.

###  3.2 Record Deduplication Model

The record deduplication model transforms the ASR outputs, i.e., the $n$-best
transcriptions of voice requests, into clusters of entity references, each of
which is expected to contain references to exactly one entity. Record
deduplication consists of three discrete steps: blocking, comparison, and
clustering (Figure 1). Blocking places references that are likely to be
coreferences into a ``block'', or group of potential matches. The comparison
task, which is analogous to other comparison, matching, and linking tasks in
ER, consists of an all-against-all comparison of the set of potential
coreferences in a block. The comparison model, which produces a
$[0,1]$-bounded estimate of whether two references are linked, can be either a
rule-based system or a machine learning model. Finally, clustering thresholds
the similarity output, producing a final decision on which references are
coreferent.

####  3.2.1 Blocking

We group our video title requests as a single block for input to comparison.
However, in principle and without any methodological changes, our model could
be extended to handle user requests for different types of content entities by
repeating the procedure with a new block for each type identified in the
request set, which could be done by an NLU model that performs entity
recognition and classification.

####  3.2.2 Comparison Model Features

For some block $B$ containing $n$ references $r_{1},r_{2},...,r_{n}$, we next
perform comparison: we construct a similarity matrix $S$ where element
$s_{ij}$ is the similarity of $r_{i}$ and $r_{j}$, for some
$r_{i},r_{j}\\!\in\\!B$. In this work, we investigate several methods of
computing $s_{ij}$. In all cases $s_{ij}$ is on the interval $[0,1]$.

All of our model configurations use ASR $n$-best cooccurrence. A list of ASR
$n$-best candidate recognitions is automatically produced as part of the
output of most ASR systems. The ASR $n$-best cooccurrence rate is a language-
agnostic proxy for phonetic similarity. For a given $r_{i}$ and $r_{j}$,
tabulate $c_{ij}$, the mean rate of cooccurrence per occurrence, using
$c_{ij}=\big{(}p(r_{i}|r_{j})+p(r_{j}|r_{i})\big{)}/2$.

ASR $n$-bests have been used in a variety of contexts to improve model output;
in modern ASR systems, they are understood to contain potentially relevant
information for accurate recognition [10, 11]. Importantly, our system looks
across aggregate cooccurrences and so is resilient to noise.

We also computed similarities between references from the perspective of
cooccurrence in user histories (the item-item matrix in a collaborative
filtering framework [12]). For any pair of references $r_{i}$, $r_{j}$, their
item similarity $u_{ij}$ is defined as $u_{ij}=(U_{i}\cdot
U_{j})/(\lvert\lvert U_{i}\rvert\rvert\cdot\lvert\lvert U_{j}\rvert\rvert)$,
where $U_{i}$ is the frequency vector of requested references aggregated from
all users who requested content by reference $r_{i}$ over a predefined time
length, i.e., $U_{i}=(n_{1,i},n_{2,i},...)$ where $n_{j,i}=\sum_{k}v_{k}^{j}$
and $v_{k}^{j}$ is the number of times when the $k$-th user who requested
$r_{i}$, also requested $r_{j}$. Intuitively, the score is measuring the
similarity between the users who made the individual references, and the
underlying assumption is that misrecognitions come from a relatively similar
group of users to those with correct recognitions.

####  3.2.3 Comparison Model Training

Our initial proof of concept model uses ASR $n$-best cooccurrence alone to
measure similarity. For more advanced models, to weigh ASR $n$-best
cooccurrence and item similarity, we formulated the comparison task as a
binary classification problem and trained a machine learning model to provide
similarity scores on the $[0,1]$ continuum for candidate pairs of entity
references.

The training dataset consists of ASR and item similarities derived from pairs
of references labeled $1$ if they are coreference and $0$ otherwise. We mine
the ground truth labels from user interactions with our digital assistant.
When a user selects an item from a list of displayed results after a query, we
observe whether the most-clicked item has a clickthrough rate (average number
of clicks per impression) greater than 50%. If so, we consider the query
unambiguous in the sense that it is intended to target a specific video title
(e.g., ``star wars a new hope'') as opposed to a broad search (e.g., ``star
wars movies''), and label the query and entity name as a reference pair. The
positive training data are made up of (1) query pairs with the same intended
video and (2) the same query as both members of the pair. The negative
training data are created by sampling from query pairs with different intended
videos. We use an equal amount of positive and negative samples for model
training.

We used several classification algorithms to train the comparison models,
including logistic regression, decision tree, and support vector
classification [13] 111The models are trained using the scikit-learn package
[14] and the training parameters are kept to module defaults.. All models are
trained with an 80%/20% train-test data split. Note that the goal of the
comparison model is to give binary decisions connecting similar query pairs,
analogous to the link prediction task [15] in network theory for cluster
detection on the generated graph [16].

####  3.2.4 Clustering Algorithm

For the proof-of-concept model using similarity from ASR $n$-bests, we convert
the similarity matrix $S$ to an adjacency matrix $A$ with $a_{ij}\in\\{0,1\\}$
via thresholding, with the threshold empirically tuned based on the training
data. For the classifier models, $A$ is constructed directly from the
classifier output labels, which are also in $\\{0,1\\}$. The sets of adjacent
elements form clusters $c_{1},c_{2},...,c_{m}$ with $m\leq\lvert R\rvert$. For
some cluster $c_{i}$, if $r_{x}\in c_{i}$ and $r_{y}\in c_{i}$, we conclude
that $r_{x}$ and $r_{y}$ are coreferent.

###  3.3 Character Edit Baseline

To contrast record deduplication with a simpler approach, we performed
similarity comparison between ASR inputs and outputs from the public dataset
using character edit distance. If the distance between an ASR output and its
respective input was less than or equal to the next closest edit distance to
other ASR inputs, we considered these entities matched (true positive).
Otherwise, we considered them mismatched and counted both a false positive for
the entity the ASR output was matched to and a false negative for the entity
it was not associated with.

###  3.4 Application to Shallow Fusion

Simply boosting the top $k$ values in the set of all $p_{e}$ would provide an
improvement over an entity distribution derived from static training data. In
practice, we use user feedback signals to determine which references to each
latent entity are likely misrecognitions and perform contextual biasing on the
entity names most likely to be both requested and misrecognized.

##  4 Data and Evaluation

We use two input datasets: a publicly reproducible one using Amazon Polly and
an in-house one derived from anonymized/de-identified real user interactions
with our digital assistant in English. The in-house data was required because
the item-item matrix will not have meaningful information if computed from
synthetic interactions. We thus use the public dataset for an initial proof-
of-concept model using only the ASR $n$-best cooccurrence feature described in
Section 3.2.2 and then move to the anonymized/de-identified in-house dataset
for more complicated models involving item-item cooccurrence.

Since the publicly reproducible dataset is generated from known text, the
ground truth to compute model accuracy is readily available. For the
anonymized/de-identified in-house dataset, we rely on sets of coreferent pairs
identified by user behavior, as described in Sections 4.2 and 4.3.

###  4.1 Public Dataset

We generated 900 synthetic voice samples [17] using Amazon Polly [18] on
randomly selected movie titles from the MovieLens 25M Dataset [19]. Before
inputting the data for audio synthesis, we preprocessed and added tokenization
operations to the movie titles to change official movie titles into spoken
forms (e.g., ``Tiny Times III'' to ``tiny times three'') to reflect speech
patterns of voice digital assistant consumers. We used nine different voice
profiles from English (US) language variants available on Amazon Polly to
generate nine samples for each entity. For the audio synthesis, neural text-
to-speech engine was chosen to create high-quality audio streams. Amazon
Polly's synthesize-speech command was used to generate the audio and convert
it to a wav file.

###  4.2 Recall Computation

Since we do not have ground truth for our anonymized/de-identified in-house
dataset, we instead rely on feedback extracted from user interaction sessions.
To identify related ASR output variants that should be clustered together (or
deduplicated) in record deduplication, we consider cases where a user request
for some reference $r_{a}$ to entity $e_{x}$ does not result in a satisfactory
response, and as a consequence, the user repeats the request, perhaps with
clearer enunciation or in a louder voice, resulting in ASR recognition variant
reference $r_{b}$. If many users repeat a given pair $(r_{a},r_{b})$, we can
conclude that the two variants are coreferent to $e_{x}$. Counting the number
of such pairings recalled as edges in the record deduplication cluster output
gives us an estimate of the model's sensitivity: these pairings are true
positives, while known edges that could have been output but were not are
false negatives.

The recall metrics do not equate to word or sentence error rates for ASR
models, since they describe the _relative_ improvement in ASR sentence error
rate.

###  4.3 Precision Computation

We identify false positive reference pairs output by the record deduplication
model by treating reference-item/entity pairs in Section 3.2.3 as ground
truth: to calculate precision, if $r_{a}$ and $r_{b}$ are clustered together
in record deduplication outputs, but we have $r_{a}$ resolved to $e_{x}$ with
high user satisfaction and $r_{b}$ resolved to $e_{y},y\neq x$, then
$(r_{a},r_{b})$ is counted as a false positive. The precision is the total
number of edges output minus such false positives divided by the total number
of edges output for which both entities have ER results with positive user
feedback.

Although it is possible that a reference could resolve to two entities, this
is rare in practice ($<0.1\%$).

##  5 Results and Discussion

We performed two sets of experiments: an initial proof-of-concept using an
open dataset and similarity as measured by ASR $n$-best cooccurrence, and then
a more extensive set of comparisons of different possible comparison models
containing both of the ASR $n$-best feature and the item similarity feature
described in Section 3.2.2.

###  5.1 Initial Proof of Concept

ASR $n$-best cooccurrence by itself achieved a recall of $0.997$ on the
synthetic dataset of ASR errors created using Amazon Polly (Table 1), with no
loss of precision. In other words, it successfully grouped misrecognized
references with correctly recognized coreferents $99.7\%$ of the time, without
incorrectly grouping any references to different entities. By comparison,
simply using a nearest neighbors approach to grouping misrecognized ASR
variants with correctly recognized coreferences recalled only $50.0\%$ of
errors, with a significant cost to precision. However, these results
translated poorly to the anonymized/deidentified in-house dataset based on
live traffic for our digital assistant. For this dataset, the method achieved
a recall of only $0.918$, with a precision of $0.913$.

The loss in performance likely arises from several factors. First, in the more
limited public dataset, we were able to use an ASR $n$-best with $n=5$, while
the cost and latency requirements on the large anonymized/deidentified in-
house dataset, which was generated at runtime, required $n\leq 2$.

Additional performance loss likely results from the substantially wider
distribution of errors encountered in live traffic. Live recordings may also
contain misdirected traffic from the NLU model performing the blocking.

Table 1: ASR $n$-Best Model Record Deduplication Results Dataset | Model | Recall | Precision | $F_{1}$
---|---|---|---|---
Public | RNN-T only | 0 | 1 | 0.000
Public | Edit similarity | 0.500 | 0.455 | 0.476
Public | Record dedup. | 0.997 | 1.000 | 0.998
Anon. Real | Record dedup. | 0.922 | 0.913 | 0.917

###  5.2 Results Including Item-Item Cooccurrence

To improve accuracy, we introduced the item-item similarity feature. The
hypothesis behind this feature is that users making malformed or misrecognized
entity references should be similar to users requesting the same entity
through a correctly recognized reference. In other words, we hypothesized that
distinct groups of users will request particular entities, and that request
misrecognition is to some extent random within each group for a particular
entity.

We produced comparison scores using a linear weighting of the two features as
well as tree- and SVM-based models (Table 2). The linear and tree-based models
recovered 36% and 49% respectively of the $F_{1}$ loss in moving to live data,
but the SVM only recovered 20% of performance, probably because of its higher
dependence on hyperparameter tuning.

Table 2:  Combined $n$-Best/Item-Item Cooccurrence Model Record Deduplication Results on Anonymized In-House Dataset Model | Recall | Precision | $F_{1}$
---|---|---|---
$n$-best-only | 0.922 | 0.913 | 0.917
Linear | 0.934 | 0.958 | 0.946
Tree | 0.954 | 0.959 | 0.957
SVM | 0.970 | 0.899 | 0.933

###  5.3 Results on Live Data

The cluster output provides a model of entity requests; combined with system
logs, we can quantify the number of entity requests in each cluster that led
to the user being served the correct entity (because the ASR output was
sufficiently similar to the canonical form that downstream ER could perform
correctly). We utilize the record deduplication's model of traffic to perform
contextual biasing on the runtime ASR model (Table 3), boosting the effective
LM probability of outputting canonical entities as in [8] over incorrectly
resolved variants. For evaluation, we use machine generated transcripts from
record deduplication as reference transcripts. Performing contextual boosting
on entities from record deduplication shows relative word error rate (WER)
reduction of 0.67% over randomly selected, anonymized, and annotated user
utterances. By comparison, using a selection of the top $k$ most-mentioned
entities actually _increased_ the error rate by 2.78%. This potentially
surprising finding is consistent with the increase in WER seen for the
``popular last week'' heuristic in [7]. The modest size of the record
deduplication result likely arises from the high diversity of entities in our
total dataset. In a smaller selection (``modeled only'' in Table 3) of
utterances that each contain a coreference used in record deduplication, the
relative improvement was 13.01%. This figure is comparable to the WER
reductions reported in [8] using a different approach, but the data
distributions are very different. Extrapolating from the 0.67% relative WER by
a factor of $1/0.1301$, the entities selected for boosting account for roughly
5% of the misrecognitions in our live distribution.

Table 3:  Relative WER Results on Anonymized In-House Dataset Model | Refs in Dataset | rel. WER (%)
---|---|---
base | full | 0
base + TopK entities | full | 2.78
base + Record dedup. | full | -0.67
base | modeled only | 0
base + Record dedup. | modeled only | -13.01

##  6 Conclusion

Our work demonstrates that using a comparison model within an entity
deduplication framework is an effective way of building a model of entity
requests. Using this entity distribution and the information it contains about
frequently misrecognized entities, we can utilize a shallow fusion entity
budget more effectively than a naive baseline.

Two promising ways to develop the record deduplication model are (1) the use
of a deep phonetic similarity model, similar to [20] to improve performance in
the comparison task and (2) using community detection approaches like spectral
clustering [21] for the clustering task.

## References

  * [1] A. Graves and N. Jaitly, ``Towards end-to-end speech recognition with recurrent neural networks,'' in _Proceedings of the 31st International Conference on International Conference on Machine Learning - Volume 32_. JMLR.org, 2014, p. II–1764–II–1772.
  * [2] W. Chan, N. Jaitly, Q. Le, and O. Vinyals, ``Listen, attend and spell: A neural network for large vocabulary conversational speech recognition,'' in _2016 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2016, pp. 4960–4964.
  * [3] T. N. Sainath, R. Prabhavalkar, S. Kumar, S. Lee, A. Kannan, D. Rybach, V. Schogol, P. Nguyen, B. Li, Y. Wu, Z. Chen, and C.-C. Chiu, ``No Need for a Lexicon? Evaluating the Value of the Pronunciation Lexica in End-to-End Models,'' in _2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE Press, 2018, p. 5859–5863. [Online]. Available: https://doi.org/10.1109/ICASSP.2018.8462380
  * [4] D. Zhao, T. N. Sainath, D. Rybach, P. Rondon, D. Bhatia, B. Li, and R. Pang, ``Shallow-Fusion End-to-End Contextual Biasing,'' in _Proc. Interspeech 2019_ , 2019, pp. 1418–1422.
  * [5] R. Huang, O. Abdel-hamid, X. Li, and G. Evermann, ``Class LM and Word Mapping for Contextual Biasing in End-to-End ASR,'' in _Proc. Interspeech 2020_ , 2020, pp. 4348–4351.
  * [6] C. Van Gysel, M. Tsagkias, E. Pusateri, and I. Oparin, ``Predicting entity popularity to improve spoken entity recognition by virtual assistants,'' in _Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval_. New York, NY, USA: Association for Computing Machinery, 2020, p. 1613–1616. [Online]. Available: https://doi.org/10.1145/3397271.3401298
  * [7] M. Saebi, E. Pusateri, A. Meghawat, and C. V. Gysel, ``A Discriminative Entity-Aware Language Model for Virtual Assistants,'' in _Proc. Interspeech 2021_ , 2021, pp. 2032–2036.
  * [8] A. Gourav, L. Liu, A. Gandhe, Y. Gu, G. Lan, X. Huang, S. Kalmane, G. Tiwari, D. Filimonov, A. Rastrow, A. Stolcke, and I. Bulyko, ``Personalization strategies for end-to-end speech recognition systems,'' in _ICASSP 2021 \- 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2021, pp. 7348–7352.
  * [9] J. Guo, G. Tiwari, J. Droppo, M. V. Segbroeck, C.-W. Huang, A. Stolcke, and R. Maas, ``Efficient Minimum Word Error Rate Training of RNN-Transducer for End-to-End Speech Recognition,'' in _Proc. Interspeech 2020_ , 2020, pp. 2807–2811.
  * [10] L. Zhu, W. Liu, L. Liu, and E. Lin, ``Improving ASR Error Correction Using N-Best Hypotheses,'' in _2021 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU)_ , 2021, pp. 83–89.
  * [11] A. Raghuvanshi, V. Ramakrishnan, V. Embar, L. Carroll, and K. Raghunathan, ``Entity resolution for noisy ASR transcripts,'' in _Conference on Empirical Methods in Natural Language Processing_ , 2019.
  * [12] G. Linden, B. Smith, and J. York, ``Amazon.com recommendations: item-to-item collaborative filtering,'' _IEEE Internet Computing_ , vol. 7, no. 1, pp. 76–80, 2003.
  * [13] E. Alpaydin, _Introduction to machine learning_. MIT press, 2020.
  * [14] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay, ``Scikit-learn: Machine learning in Python,'' _Journal of Machine Learning Research_ , vol. 12, pp. 2825–2830, 2011.
  * [15] M. Zhang and Y. Chen, ``Link prediction based on graph neural networks,'' in _Proceedings of the 32nd International Conference on Neural Information Processing Systems_. Red Hook, NY, USA: Curran Associates Inc., 2018, p. 5171–5181.
  * [16] N. Barbieri, F. Bonchi, and G. Manco, ``Who to follow and why: Link prediction with explanations,'' in _Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining_. New York, NY, USA: Association for Computing Machinery, 2014, p. 1266–1275. [Online]. Available: https://doi.org/10.1145/2623330.2623733
  * [17] T. Huang, H. Chung Hoon, C. Wivagg, and K. Shimizu, ``Open dataset used in Record Deduplication for Entity Distribution Modeling in ASR Transcripts,'' May 2023. [Online]. Available: https://github.com/recorddeduplication/recorddeduplication
  * [18] ``Amazon Polly,'' accessed: 2023-01-31. [Online]. Available: https://aws.amazon.com/polly/
  * [19] ``Movielens 25m dataset,'' Mar 2021. [Online]. Available: https://grouplens.org/datasets/movielens/25m/
  * [20] X. Zhou, R. Bao, and W. M. Campbell, ``Phonetic embedding for asr robustness in entity resolution,'' in _Interspeech 2022_ , 2022. [Online]. Available: https://www.amazon.science/publications/phonetic-embedding-for-asr-robustness-in-entity-resolution
  * [21] S. Fortunato, ``Community detection in graphs,'' _Physics Reports_ , vol. 486, no. 3, pp. 75–174, 2010. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0370157309002841


# TransductGAN: a Transductive Adversarial Model for Novelty Detection

Najiba Toron<EMAIL_ADDRESS>Janaina Mourao-Miranda  J.Mourao-
<EMAIL_ADDRESS>John Shawe-Taylor<EMAIL_ADDRESS>Department of
Computer Science, University College London, London WC1V 6LJ, United Kingdom

###### Abstract

Novelty detection, a widely studied problem in machine learning, is the
problem of detecting a novel class of data that has not been previously
observed. A common setting for novelty detection is inductive whereby only
examples of the negative class are available during training time.
Transductive novelty detection on the other hand has only witnessed a recent
surge in interest, it not only makes use of the negative class during training
but also incorporates the (unlabeled) test set to detect novel examples.
Several studies have emerged under the transductive setting umbrella that have
demonstrated its advantage over its inductive counterpart. Depending on the
assumptions about the data, these methods go by different names (e.g.
transductive novelty detection, semi-supervised novelty detection, positive-
unlabeled learning, out-of-distribution detection). With the use of generative
adversarial networks (GAN), a segment of those studies have adopted a
transductive setup in order to learn how to generate examples of the novel
class. In this study, we propose TransductGAN, a transductive generative
adversarial network that attempts to learn how to generate image examples from
both the novel and negative classes by using a mixture of two Gaussians in the
latent space. It achieves that by incorporating an adversarial autoencoder
with a GAN network, the ability to generate examples of novel data points
offers not only a visual representation of novelties, but also overcomes the
hurdle faced by many inductive methods of how to tune the model
hyperparameters at the decision rule level. Our model has shown superior
performance over state-of-the-art inductive and transductive methods. Our
study is fully reproducible with the code available publicly.

###### keywords:

Generative adversarial networks , transductive learning , novelty detection

††journal: Pattern Recognition

##  1 Introduction

Novelty detection has been addressed widely in the machine learning
literature, its basic form aims at building a decision rule in order to
distinguish a normal set of data points (or inliers/ negative examples) from
novel patterns (or unseen/ positive examples/ novelties). At training time
only examples of inliers are available, this type of learning goes by the name
of inductive novelty detection. Labeled examples of novelties are unavailable
during training in this case. Some notable contributions in this field include
one-class classifiers that attempt to draw a discriminative boundary around
the normal data such as one-class support vector machine (OCSVM) (Schölkopf et
al., 2001) and deep learning related methods - especially with the
advancements of adversarial learning (Goodfellow et al., 2014) \- that rely on
the fidelity of recontruction of the original signal (Schlegl et al., 2017;
Zenati et al., 2018a, b; Akcay et al., 2018; Akçay et al., 2019). One
limitation of those inductive methods is their need for hyperparameter tuning;
the absence of novel examples in this setup during training makes this problem
hard to overcome.

The traditional inductive learning seeks to infer a decision function by using
a training set and minimizing the error rate on the whole distribution of
examples. Transductive learning (Vapnik, 1998) on the other hand is motivated
by the idea that the latter approach is unnecessarily complex and that we only
care about the decision function so far as the test set is concerned, and
hence the (unlabeled) test set should be incorporated at training time.
Novelty detection methods that adopt the latter approach are referred to as
transductive, one early example adopting this setting is semi-supervised
novelty detection introduced by (Blanchard et al., 2010).

In this study we propose TransductGAN, a novel transductive novelty detection
method using Generative Adversarial Network (GAN) (Goodfellow et al., 2014).
Our model combines an adversarial autoencoder (Makhzani et al., 2015) that
maps the data to a latent space with a GAN. It attempts to simultaneously
separate the inliers from the novelties in the latent space and learns how to
generate both categories of data using two distinct distributions. A standard
binary classifier can then be trained using the artificially generated novel
samples along with the inlier set in order to perform anomaly detection. A
diagram of TransductGAN is provided in Figure 1.

We refer to the proportion of novelties present in the unlabeled set as the
contamination rate. TransductGAN and more generally transductive novelty
detection methods are unsuitable for online applications as they assume access
to a complete test set. Applications of interest include areas where we
benefit from looking at data in a post-event format, and where the novelties
are not rare as in the case of anomaly detection (although we will demonstrate
empirically that our model outperforms the inductive state-of-the-art methods
with a contamination rate as small as 5%). An example of applications could be
the emergence of new topics or themes on social media platforms, such
discoveries could help drive the news coverage on more standard media
channels. Another application could be in commercial deep neural network
systems that are used for classification, and where pre-processing of data is
required to maintain performance quality of pre-trained models. This can be
achieved by detecting novelties in test data that were not present when models
were initially trained (i.e. by monitoring the emergence of a new class).
Another example is the discovery of new user profiles that have become
interested in acquiring a certain product, this could help boost targeted
advertising. In this study we focus on image data.

The main contributions of our work are:

  * 1.

a novel architecture capable of learning how to generate inliers and novelties
simultaneously using distinct distributions in the latent space

  * 2.

by being able to generate the novel points artificially we can train a binary
classifier and tune the hyperparameters without explicitly accessing the
actual outliers, this overcomes the hurdle faced by many inductive methods of
how to tune their hyperparameters in the absence of novel data examples

  * 3.

the introduction of the adversarial autoencoder allows us to use more
informative features from the latent space when training a binary classifier

  * 4.

our model exhibits superior performance over several state-of-the-art
inductive models, and outperforms a vanilla model that is closely related to a
state-of-the-art transductive method

  * 5.

full reproducibility of our model is available on github

##  2 Background

###  2.1 Wasserstein generative adversarial networks with gradient penalty

The generative adversarial network (GAN) in its original form (Goodfellow et
al., 2014) comprises a generator taking as input a latent vector to produce an
image output. This network competes against a discriminator tasked with
identifying the fake images (produced by the generator) from the real images.
By being able to produce samples identical to the real ones at convergence,
the generator implicitly captures the distribution of the real image data.
Although a GAN can produce visually appealing images, they are hard to train
and can suffer from convergence failure or can generate poor quality images.

Subsequent work (Salimans et al., 2016; Metz et al., 2016; Arjovsky et al.,
2017; Poole et al., 2016; Salimans et al., 2018) has been devoted to boosting
training stability. In their work on Wasserstein GAN (Arjovsky et al., 2017),
the authors highlighted that the divergences that are being minimized in the
original GAN framework may not be continuous with respect to the generator’s
parameters which might explain the training difficulty. They instead use the
earth mover distance and argue that under mild assumptions this type of loss
is continuous and almost differentiable everywhere. They propose a weight
clipping of the discriminator in order to enforce those assumptions. The work
was further extended with the introduction of Wasserstein GAN with gradient
penalty (WGAN-GP) in (Gulrajani et al., 2017b) where a gradient penalty was
introduced as an alternative to the weight clipping; in this work the authors
propose to penalize the norm of the gradient of the discriminator with respect
to its input and demonstrate this strategy yields an enhanced performance.

###  2.2 Adversarial Autoencoders

The adversarial autoencoder (AAE) (Makhzani et al., 2015) is a regularized
autoencoder where an adversarial network is tasked with ensuring that the
latent code vector distribution is matched with a prior distribution that is
defined by the user. The AAE includes an encoder-decoder network that maps the
data from the input space to a latent space and a discriminator network that
controls the distribution in the latent space. Two losses are used to train
the model, the traditional reconstruction based loss that operates in the
input space and an adversarial loss that operates on the latent code. The
advantage of the AAE is its ability to generate meaningful samples from any
part of the latent distribution and its superiority in that regard compared to
more traditional methods such as variational autoencoders (Kingma and Welling,
2014) has been demonstrated.

##  3 Related work

###  3.1 Inductive methods

During training, inductive methods in novelty detection rely on the
availability of a negative dataset $X_{n}$ that could be either pure or
contaminated with novelties or outliers. In our study we assume that the
negative dataset is always uncontaminated. There exists a variety of anomaly
detection algorithms and comprehensive literature reviews presenting those
algorithms as part of a taxonomy already exist, a few examples include
(Pimentel et al., 2014; Chalapathy and Chawla, 2019). The approaches can
broadly be categorised into probabilistic models, distance-based,
reconstruction-based, domain-based and information theory-based models. We
will compare our methods against state-of-the-art models that are either
reconstruction-based or domain-based. The main challenge with the other
categories is their poor performance on complex high-dimensional data.

Some notable contributions with regards to the domain-based model include
OCSVM (Schölkopf et al., 2001), it attempts to find the boundary enclosing the
inlier class by separating it from the origin using a hyperplane with maximum
margin.

The reconstruction-based models rely on modelling the data samples in a
latent, lower-dimensional space and on the ability to reconstruct the original
samples thereafter. The novelty measure relies on the fidelity of
reconstruction, i.e. it relies on some similarity measure between the original
sample and its reconstructed version. Algorithms that are able to perform such
tasks include neural networks and subspace-based methods. The main advantages
of using such models is their scalability, with a large enough sample size
they tend to surpass the more traditional methods.

One state-of-the-art method is AnoGAN, introduced by Schlegl et al. in
(Schlegl et al., 2017). It uses a deep convolutional GAN (DCGAN, (Radford et
al., 2015)) to perform anomaly detection using imaging data. It trains the
DCGAN using the inlier data only in the first phase. In the second phase it
learns a mapping from the image space to the latent space for each sample in
the test set iteratively via backpropagation, using the weighted sum of a
residual loss and a discrimination loss. AnoGAN’s main contribution is the
anomaly scoring that involves mapping from the image to the latent space; it
remains a computationally expensive procedure that also requires parameter
tuning.

Efficient GAN-based anomaly detection (EGBAD) (Zenati et al., 2018a) was
introduced soon after and proposes to use a bi-directional GAN (BiGAN)
(Donahue et al., 2016; Dumoulin et al., 2016) in order to overcome the costly
process in AnoGAN of recovering the latent representation for a given input.
BiGAN simultaneously learns an encoder that maps an input sample to a latent
representation along with a generator and discriminator using inlier data. The
discriminator takes as input the image sample (either generated or from
training) along with its latent representation (either the encoder output or
the generator input). With the exception of the introduction of the BiGAN
model that allows to reduce the computational costs, the procedure to derive
the anomaly score is similar to that of AnoGAN with improved performance. The
hyperparameter tuning is still an open issue.

The GANomaly model was introduced in (Akcay et al., 2018) and is inspired by
the AAE network. GANomaly employs a variation of this model that uses an added
encoder and where the discriminator now operates over the image space. The
objectives of GANomaly are similar to the ones presented in the previous two
approaches, namely it attempts to use the inlier set to train the model and
uses an anomaly score to identify the anomalous samples within the
(contaminated) test data. Three types of losses are used to train the model.
Firstly, an adversarial loss measures the $L_{2}$ distance between the feature
representation in the discriminator (hence using the feature matching loss) of
the original (image) inputs and the generated images. Secondly, a contextual
loss measures the $L_{1}$ distance between the input and the generated output
and allows the generator to learn contextual information about the input data.
And finally an encoder loss minimizes the distance between the latent
representation of the input and the latent representation of the generated
output. The overall objective function becomes a weighted sum of the three
losses. During testing only the encoder loss is used by the model as an
novelty indicator. GANomaly’s performance was tested on a variety of real-
world data and has surpassed other state-of-the-art methods such as EGBAD,
AnoGAN as well as more basic methods such as variational autoencoders-based
anomaly detection (An and Cho, 2015). It should be mentioned that the weights
of the objective function were tuned to yield an optimal performance, and in
that regard the labels of the test set were used to drive the performance up.

###  3.2 Transductive methods

Transductive methods for novelty detection were originally introduced in
(Scott and Blanchard, 2008) as a special case of their semi-supervised novelty
detection algorithm (SSND) (Blanchard et al., 2010) where the unlabeled set is
incorporated into the the task and where the end goal is to predict the labels
of the unlabeled (or test) set. In that study the problem is reduced to a
binary classification task subject to a user-specified constraint on the false
positive rate. More recently, Tifrea et al. introduced ensembles with
regularized disagreement (ERD) (Tifrea et al., 2020) by training multiple
multi-class classifiers on the union of labeled and unlabeled sets. The
unlabeled set is assigned random labels and the disagreement between the
classifiers is used as a measure of novelty. The method assumes no knowledge
of the contamination rate, however the class labels of the labeled set are
assumed to be available (i.e. information about the class labels beyond the
fact they are inliers). Other transductive state-of-the-art novelty detection
methods that make use of the inlier class labels include (Yu and Aizawa, 2019)
where the authors train a two-head deep convolutional neural network (CNN)
with one common feature extractor and two classifiers; the discrepancy of
prediction between the two classifiers is used at test time to separate the
inliers from the novel data. The authors have not provided any implementation
for this method.

###  3.3 PU learning methods

PU learning refers to the classification of unlabeled samples given data from
one class during training. A recent survey of PU learning methods can be found
in (Bekker and Davis, 2018). The class that is usually available in this setup
is the novel/ positive class, but PU learning can also be applied to novelty
detection in an unlabeled dataset with access to only the negative data during
training, and some studies (Plessis et al., 2015) consider transductive
novelty detection as defined in (Blanchard et al., 2010) to be a special case
of PU learning.

The unlabeled data is usually handled in to ways, the first set of methods
(Liu et al., 2002; Li and Liu, 2003) attempt to identify negative examples in
the unlabeled set before training a binary classifier using the positive and
newly identified negative samples. This approach is very much dependent on
heuristic strategies and does not guarantee an optimal solution. The second
set of methods (Liu et al., 2003; Lee and Liu, 2003) treat the unlabeled set
as negative with a weight assigned to each sample, finding the optimal weight
is usually costly and the classifiers trained on those datasets suffer from an
estimation bias. Several methods have since emerged that seek to build an
unbiased PU classifier (Plessis et al., 2014, 2015; Kiryo et al., 2017), the
most recent of which, the non-negative PU estimator (nnPU) (Kiryo et al.,
2017), was proven to be the most robust against overfitting in the presence of
a flexible classifier. More recently, GAN-based models have become state-of-
the-art in PU learning applications and a couple of methods are closely
related to our model as they also attempt to generate counter-examples. In
(Hou et al., 2017) a generative positive-unlabeled (GenPU) model is proposed
that makes use of a series of discriminators and generators to produce both
positive and negative samples; GenPU requires prior knowledge of the
contamination rate in the unlabeled set. The authors have not provided any
implementation of that model. Following this work, Chiaroni et al. have
proposed a two-stage GAN model (D-GAN) that learns the counter-examples
distribution before training a binary classifier using the fake generated
negative examples and the already available positive examples. D-GAN
incorporates a biased PU risk in the discriminator loss function that
constrains the generator to learn the positive samples distribution
exclusively. The study also demonstrates that the standard GAN loss function
in use also alleviates the need of prior knowledge of the contamination rate.

##  4 TransductGAN

Figure 1: TransductGAN. The network includes an adversarial autoencoder that
ensures the latent projection’s distributions match with the priors as per
equation 5, and a transductive network that learns to map samples from
$p_{n}(\textbf{z})$ and $p_{p}(\textbf{z})$ into negative and positive
examples respectively. The two networks are trained simultaneously. The
training of $D_{X_{n}}$ is optional and only needed if generating samples from
the negative data is required.

###  4.1 Model objectives

TransductGAN’s objectives are to be able to learn two distinct distributions,
one (optionally) for the inlier data and another for the novel data while
having access to a negative dataset and an unlabeled dataset. It is able to
achieve that by making use of a latent space. TransductGAN is a transductive
adversarial network that includes an adversarial autoencoder that matches the
aggregated posterior distribution of the latent space with a bimodal
distribution, and a generative model that learns how to map each mode in the
latent space to either positive or negative data outputs. By being able to
separate the projections of the positive and negative data in the latent
space, TransductGAN is able to generate both novel and negative data
separately. A binary classifier (e.g. a support vector machine) can then be
trained to identify the novel data points in the unlabeled set. This operation
takes place in the absence of any labeled positive data examples.

More formally, let us define the input as $x\in\mathbbm{R}^{m}$ and its
projection in the latent space (i.e. the output of the encoder $E$ in Figure
1) as $z\in\mathbbm{R}^{n}$ with $m>>n$. We have access to the negative
dataset $X_{n}=\\{x_{n}^{i}\\}_{i=1}^{n_{n}}\sim P_{x_{n}}$ and an unlabeled
dataset that includes novel data $X_{u}=\\{x_{u}^{i}\\}_{i=1}^{n_{u}}\sim
P_{x_{u}}$. Let us also define $y\in\\{-1,+1\\}$ as the class label (novel or
negative). The class conditional positive density (representing the positive
samples in the latent space) is:

$q_{p}(z)=q(z|y=1),$ (1)

and the class conditional negative density (representing the negative data
samples) in the latent space:

$q_{n}(z)=q(z|y=-1).$ (2)

The unlabeled density in the latent space is hence defined as:

$q_{u}(z)=\pi q_{p}(z)+(1-\pi)q_{n}(z).$ (3)

$\pi$ is the prior for the positive class also known as the contamination
rate, we assume we have access to this figure and that it is strictly positive
$\pi>0$:

$\pi=p(y=1)$ (4)

The prior distribution we want to impose directly are $p_{n}(z)$ for the
negative dataset with $N(\mu_{n},\Sigma_{n})$ and $p_{u}(z)$ for the unlabeled
dataset, and indirectly $p_{p}(z)$ for the positive dataset with
$N(\mu_{p},\Sigma_{p})$. The unlabeled prior can also be defined as:

$p_{u}(z)=\pi p_{p}(z)+(1-\pi)p_{n}(z)$ (5)

We assume we have access to $n_{n}$ negative samples and $n_{u}$ unlabeled
samples.

###  4.2 Training methods

The proposed model for learning how to generate negative and positive samples
is summarised in Figure 1. The first part of the model is an adversarial
autoencoder that includes the networks $E$, $G$, and the critic networks
$D_{z_{u}}$ and $D_{z_{n}}$. $E$ and $G$ are trained to minimize a
reconstruction loss, or a minimal $L_{2}$ distance between an image and its
reconstructed version:

$L_{reconstruction}=\min_{E}\min_{G}\mathbb{E}_{x\sim P_{x}}\|x-G(E(x))\|_{2}$
(6)

In the above $P_{x}$ could refer to either $P_{X_{u}}$ or $P_{X_{n}}$.

When using $X_{u}$, $D_{z_{u}}$ and $E$ are trained to match the projections
of $X_{u}$ onto the latent space with $p_{u}(z)$ defined in equation 5, a
Wasserstein loss with a gradient penalty (WGAN-GP) (Gulrajani et al., 2017b)
is used in order to ensure that. And similarly when using $X_{n}$, $D_{z_{n}}$
and $E$ are trained to match the projections of $X_{n}$ onto the latent space
with $p_{n}(z)$. In both cases, the latent loss can be defined as:

$L_{regularization}=\min_{E}\max_{D}\mathbb{E}_{x\sim
P_{x}}[D(E(x))]-\mathbb{E}_{z\sim p(z)}D(z)+\lambda\mathbb{E}_{\hat{z}\sim
P_{\hat{z}}}[(\|\nabla_{\hat{z}}D(\hat{z})\|_{2}-1)^{2}]$ (7)

In the above, depending on whether we are using $X_{u}$ or $X_{n}$ during
training, $P_{x}$ refers to either $P_{X_{u}}$ or $P_{X_{n}}$. $p(z)$ refers
to either $p_{u}(z)$ or $p_{n}(z)$ and the critic network $D$ refers to either
$D_{z_{u}}$ or $D_{z_{n}}$. Similarly to the gradient penalty definition in
(Gulrajani et al., 2017b), the sampling $P_{\hat{z}}$ is a uniform
distribution along straight lines between pairs of points sampled from
$(q_{u}(z),p_{u}(z))$ or $(q_{n}(z),p_{n}(z))$. By imposing $p_{u}(z)$ and
$p_{n}(z)$ on $q_{u}(z)$ and $q_{n}(z)$ respectively, $q_{p}(z)$ will
implicitly match with $p_{p}(z)$.

The second part of the model focuses on $G$, $D_{X_{u}}$ and $D_{X_{n}}$. The
generator $G$ will be trained to produce fake positive samples $G(z_{p})$, and
(optionally) fake negative samples $G(z_{n})$. Let us define
$X_{u}^{{}^{\prime}}$ to be the result of a concatenation operation between
$X_{n}$ and $G(z_{p})$ with proportions of $1-\pi$ and $\pi$ respectively.
With regards to generating $G(z_{p})$, the intuition is that $X_{u}$ is formed
by samples from both the negative set $X_{n}$ and unknown positive samples
$X_{p}$, we ensure $X_{n}$ already forms a subset of $X_{u}^{{}^{\prime}}$,
the generator $G$ is then left with the task of complementing
$X_{u}^{{}^{\prime}}$ with samples not already provided by $X_{n}$, i.e.
samples that are similar to the novel samples $X_{p}$. The role of $D_{x_{u}}$
is to challenge $G$ to produce a set $G(z_{p})$ that is indistinguishable from
$X_{p}$.

With regards to generating $G(z_{n})$, this follows a standard GAN training
approach where $G$ is trained to generate fake negative samples that should
look like $X_{n}$, and $D_{X_{n}}$ is trained to challenge $G$ on that task.

The adversarial loss, also a WGAN-GP, is defined as:

$L_{adv}=\min_{G}\max_{D}\mathbb{E}[D(X^{{}^{\prime}})]-\mathbb{E}[D(X)]+\lambda\mathbb{E}_{\hat{x}\sim
P_{\mathbf{\hat{x}}}}[(\|\nabla_{\hat{x}}D(\mathbf{\hat{x}})\|_{2}-1)^{2}]$
(8)

In the above, depending on whether we are using $z_{u}$ or $z_{n}$ during
training, $X^{{}^{\prime}}$ refers to either $X_{u}^{{}^{\prime}}$ or
$G(z_{n})$. $X$ refers to either $X_{u}$ or $X_{n}$ and the critic network $D$
refers to either $D_{X_{u}}$ or $D_{X_{n}}$. Similarly to the gradient penalty
definition in (Gulrajani et al., 2017b), the sampling $P_{\hat{x}}$ is a
uniform distribution along straight lines between pairs of points sampled from
$(X_{u}^{{}^{\prime}},X_{u})$ or $(G(z_{n}),X_{n})$. A pseudocode of
TransductGAN is provided in algorithm 1.

Once the TransductGAN training is completed, a binary classifier can be
trained using the latent projections of $X_{n}$ onto the latent space as one
class and the latent projections of the fake positive images as the other
class as per Algorithm 2.

Algorithm 1 TransductGAN. We use default values of $\lambda=10$,
$n_{critic}=5$ (Gulrajani et al., 2017b).

the contamination rate $\pi$, the gradient penalty coefficient $\lambda$, the
number of critic iterations per generator iteration $n_{critic}$, the batch
size $m$.

initial critics parameters $\theta_{D_{z_{u}}}$, $\theta_{D_{z_{n}}}$,
$\theta_{D_{X_{u}}}$, $\theta_{D_{X_{n}}}$, initial encoder parameters
$\theta_{E}$ and initial generator parameters $\theta_{G}$.

sample $m$ samples from $X_{u}$

minimize $L_{rec}$ wrt $\theta_{E}$ and $\theta_{G}$ and update parameters
accordingly

sample $z\sim p_{u}(z)$

minimize $L_{reg}$ wrt $\theta_{E}$ and update parameters accordingly

for $i=1,...,n_{critic}$ do

maximize $L_{reg}$ wrt $\theta_{D_{z_{u}}}$ and update parameters accordingly

end for

sample $m$ samples from $X_{n}$

minimize $L_{rec}$ wrt $\theta_{E}$ and $\theta_{G}$ and update parameters
accordingly

sample $z\sim p_{n}(z)$

minimize $L_{reg}$ wrt $\theta_{E}$ and update parameters accordingly

for $i=1,...,n_{critic}$ do

maximize $L_{reg}$ wrt $\theta_{D_{z_{n}}}$ and update parameters accordingly

end for

sample $m$ samples from $X_{u}$

sample $int(\pi*m$) samples $z\sim p_{p}(z)$

combine $G(z)$ with $(m-int(\pi*m))$ samples from $X_{n}$ to form
$X_{u}^{{}^{\prime}}$

minimize $L_{adv}$ wrt $\theta_{G}$ and update parameters accordingly

for $i=1,...,n_{critic}$ do

maximize $L_{adv}$ wrt $\theta_{D_{X_{u}}}$ and update parameters accordingly

end for

sample $m$ samples from $X_{n}$

sample $z\sim p_{n}(z)$

minimize $L_{adv}$ wrt $\theta_{G}$ and update parameters accordingly

for $i=1,...,n_{critic}$ do

maximize $L_{adv}$ wrt $\theta_{D_{X_{n}}}$ and update parameters accordingly

end for

Algorithm 2 Binary classifier for novelty detection.

Training of TransductGAN as per Algorithm 1

sample $5000$ samples $z_{p}$ from $p_{p}(z)$

sample $5000$ samples $X_{n}$ from $X_{n}$

train a two-class SVM with linear kernel with $E(G(z_{p}))$ as one class and
$E(X_{n})$ as another

apply classifier on $E(X_{u})$ as novelty detector

Algorithm 3 Vanilla model. We use default values of $\lambda=10$,
$n_{critic}=5$ (Gulrajani et al., 2017b).

the contamination rate $\pi$, the gradient penalty coefficient $\lambda$, the
number of critic iterations per generator iteration $n_{critic}$, the batch
size $m$.

initial critics parameters $\theta_{D_{X_{u}}}$ and initial generator
parameters $\theta_{G}$.

sample $m$ samples from $X_{u}$

sample $int(\pi*m$) samples $z\sim N(\mu,\Sigma)$

combine $G(z)$ with $(m-int(\pi*m))$ samples from $X_{n}$ to form
$X_{u}^{{}^{\prime}}$

minimize $L_{adv}$ wrt $\theta_{G}$ and update parameters accordingly

for $i=1,...,n_{critic}$ do

maximize $L_{adv}$ wrt $\theta_{D_{X_{u}}}$ and update parameters accordingly

end for

Algorithm 4 Binary classifier for novelty detection with vanilla model.

Training of vanilla model as per Algorithm 3

sample $5000$ samples $z$ from $N(\mu,\Sigma)$

sample $5000$ samples from $X_{n}$

train a two-class SVM with radial basis function kernel with $G(z)$ as one
class and $X_{n}$ as another

apply classifier on $E(X_{u})$ as novelty detector

##  5 Experimental results

###  5.1 Datasets

####  5.1.1 MNIST (LeCun and Cortes, 2010).

This dataset of handwritten digits has a training set of 60000 examples, and a
test set of 10000 examples and includes 10 classes. In our novelty detection
formulation we will treat one of the classes as novel and remove it from the
training set, the rest of the classes will be treated as normal. We will
iterate through all the class combinations when reporting our results.

####  5.1.2 CIFAR10 (Krizhevsky, 2009).

This dataset consists of 50000 training images and 10000 test images of 10
classes. We will proceed as with MNIST regarding our novelty detection
formulation.

###  5.2 Performance measure

Our performance will be measured using the area under the curve of the
Receiver Operating Characteristic (AUROC). The Receiver Operating
Characteristic curve plots the true positive rate against the false positive
rate as we vary the threshold of our classifier. We will also include image
outputs of the produced novel images.

###  5.3 Network architectures

The transductive network architecture as highlighted in red in Figure 1
follows the same implementation
111https://github.com/igul222/improved_wgan_training as was provided by
(Gulrajani et al., 2017a). Our open source implementation provides further
details about the adversarial network implementation.

(a) Real novel images

(b) Fake novel images (5%)

(c) Fake novel images (10%)

(d) Fake novel images (30%)

Figure 2: MNIST example with ’0’ as novel class. For the fake examples, the
value in brackets corresponds to the contamination rate in the test set that
was used during training.

(a) Real novel images

(b) Fake novel images (5%)

(c) Fake novel images (10%)

(d) Fake novel images (30%)

Figure 3: CIFAR10 example with ship as novel class. For the fake examples, the
value in brackets corresponds to the contamination rate in the test set that
was used during training.

###  5.4 Methods for comparison

We will compare our model against OCSVM, EGBAD and GANomaly. We use the scikit
implementation of OCSVM 222https://scikit-
learn.org/stable/modules/generated/sklearn.svm.OneClassSVM.html with the
’scale’ default kernel width value. We follow the same training procedures
stated in the original publications regarding EGBAD and GANomaly’s results.
EGBAD’s results with CIFAR10 were taken from (Akcay et al., 2018). The D-GAN
implementation made available by the authors did not include the version they
used with MNIST and CIFAR10 datasets; our attempt to reproduce their results
resulted in a mode collapse with classification results no better than random
so we have not included these in our comparison. We have however built a
vanilla model of TransductGAN that is very close to D-GAN with the exception
that it requires prior knowledge of the contamination rate (its performance
could hence be seen as a best case scenario of D-GAN), it adopts an
architecture that is similar to the transductive TransductGAN in order to
ensure a fair comparison. The vanilla network does not make use of a latent
space and trains a binary classifier (a SVM with a radial basis function
kernel) based on the fake (positive) generated samples from the generator and
the negative images $X_{n}$, it is summarised in Figure 4) and an outline of
the overall procedure is provided in Algorithm 3 and Algorithm 4.

Figure 4: Vanilla transductive model. The network is only based on a GAN model
and does not exploit learning in the latent space as with TransductGAN. The
generator will learn to generate positive fake images that will be used along
with the negative images $X_{n}$ to train a binary classifier. The algorithm
is outlined in Algorithm 3 and the classification task is summarised in
Algorithm 4.

| OCSVM | GANomaly | EGBAD | TransductGAN(5%) | Vanilla(5%) | TransductGAN(10%) | Vanilla(10%) | TransductGAN(30%) | Vanilla(30%)
---|---|---|---|---|---|---|---|---|---
0 | 0.853(0) | 0.882 | 0.86 | 0.983(0.002) | 0.985(0.003) | 0.991(0.002) | 0.995(0) | 0.996(0.001) | 0.998(0)
1 | 0.315(0.001) | 0.663 | 0.314 | 0.994(0.001) | 0.997(0) | 0.996(0) | 0.996(0) | 0.998(0) | 0.998(0)
2 | 0.775(0.002) | 0.952 | 0.835 | 0.954(0.001) | 0.944(0.009) | 0.985(0.002) | 0.981(0.001) | 0.997(0.002) | 0.997(0)
3 | 0.655(0.004) | 0.794 | 0.712 | 0.949(0.007) | 0.955(0.007) | 0.975(0.005) | 0.972(0.004) | 0.996(0.002) | 0.995(0.001)
4 | 0.498(0.003) | 0.803 | 0.655 | 0.952(0.008) | 0.948(0.005) | 0.978(0.004) | 0.976(0.005) | 0.994(0.001) | 0.997(0)
5 | 0.589(0.003) | 0.864 | 0.713 | 0.917(0.007) | 0.924(0.007) | 0.975(0.002) | 0.962(0.004) | 0.994(0.001) | 0.996(0)
6 | 0.691(0.003) | 0.852 | 0.753 | 0.983(0.003) | 0.987(0) | 0.994(0.002) | 0.994(0) | 0.996(0.001) | 0.998(0)
7 | 0.582(0.009) | 0.697 | 0.525 | 0.96(0.005) | 0.954(0.003) | 0.976(0.005) | 0.974(0.001) | 0.993(0.001) | 0.996(0)
8 | 0.544(0.002) | 0.792 | 0.728 | 0.936(0.006) | 0.921(0) | 0.967(0.001) | 0.964(0.003) | 0.992(0) | 0.992(0.001)
9 | 0.349(0.005) | 0.534 | 0.547 | 0.938(0.012) | 0.902(0.018) | 0.968(0.005) | 0.912(0.063) | 0.988(0.002) | 0.99(0.001)
| 0.585 | 0.783 | 0.664 | 0.956 | 0.952 | 0.98 | 0.973 | 0.994 | 0.996

Table 1: ROC (AUC) results summary - MNIST. Results for TransductGAN are from
the z features. Three different random seeds are used with standard deviations
shown in brackets for TransductGAN, the vanilla model and OCSVM.

| OCSVM | GANomaly | EGBAD | TransductGAN(5%) | Vanilla(5%) | TransductGAN(10%) | Vanilla(10%) | TransductGAN(30%) | Vanilla(30%)
---|---|---|---|---|---|---|---|---|---
plane | 0.54(0.01) | 0.622 | 0.582 | 0.763(0.003) | 0.625(0.005) | 0.81(0.004) | 0.786(0.009) | 0.86(0.002) | 0.84(0)
car | 0.657(0.002) | 0.632 | 0.527 | 0.7(0.009) | 0.756(0.018) | 0.85(0.002) | 0.77(0.007) | 0.906(0.004) | 0.843(0.037)
bird | 0.384(0.011) | 0.513 | 0.386 | 0.6(0.018) | 0.39(0.011) | 0.66(0.007) | 0.633(0.015) | 0.766(0.008) | 0.713(0.018)
cat | 0.577(0.012) | 0.575 | 0.455 | 0.586(0.045) | 0.56(0.013) | 0.655(0.004) | 0.64(0) | 0.786(0.009) | 0.69(0.025)
deer | 0.32(0.005) | 0.591 | 0.385 | 0.55(0.007) | 0.376(0.055) | 0.686(0.007) | 0.62(0.008) | 0.796(0) | 0.713(0.006)
dog | 0.57(0.005) | 0.625 | 0.490 | 0.65(0.021) | 0.62(0.01) | 0.715(0.011) | 0.68(0.018) | 0.816(0.006) | 0.753(0.004)
frog | 0.397(0.001) | 0.668 | 0.359 | 0.613(0.022) | 0.493(0.073) | 0.736(0.015) | 0.643(0.007) | 0.86(0.011) | 0.746(0.011)
horse | 0.54(0.005) | 0.650 | 0.527 | 0.636(0.021) | 0.606(0.007) | 0.74(0.011) | 0.696(0.012) | 0.856(0.009) | 0.78(0.031)
ship | 0.51(0.009) | 0.622 | 0.411 | 0.8(0.007) | 0.736(0.008) | 0.87(0.006) | 0.836(0.019) | 0.9(0.001) | 0.89(0.003)
truck | 0.66(0.006) | 0.615 | 0.554 | 0.696(0.027) | 0.77(0.007) | 0.81(0.009) | 0.776(0.005) | 0.876(0.005) | 0.816(0.028)
| 0.515 | 0.611 | 0.468 | 0.6596 | 0.5935 | 0.7533 | 0.7053 | 0.8426 | 0.7786

Table 2: ROC (AUC) results summary - CIFAR10. Three different random seeds are
used with standard deviations shown in brackets for TransductGAN, the vanilla
model and OCSVM.

###  5.5 Discussion

The results of our experiments are presented in Table 1 (MNIST) and Table 2
(CIFAR10). Each row corresponds to a different novelty class and the last row
summarises the average performance in terms of AUROC score. On average, our
TransductGAN model outperforms GANomaly (the best performing inductive model)
by 22.09% (MNIST) and 7.95% (CIFAR10) when the contamination rate in the test
set is 5%. With a contamination rate of 10% TransductGAN outperforms GANomaly
by 25.15% (MNIST) and by 23.28% (CIFAR10). When the latter figure increases to
30%, TransductGAN outperforms GANomaly by 26.94% (MNIST) and 37.9% (CIFAR10).
This highlights the suitability of our model in cases where the novelties are
not rare, however even in cases where the contamination rate drops to 5% our
model still outperforms GANomaly. Unsurprisingly, the higher the contamination
rate the better the performance as the model is able to learn from a wider
pool of novel data points. This is further confirmed by assessing the
improvement in image quality of the fake novel samples in Figure 2(d) and
Figure 3(d) as the contamination rate increases. It should also be noted that
EGBAD and GANomaly’s performances rely on hyperparameter tuning as noted in
their respective publications, the tuning was carried to yield optimal
performance which suggests the test set labels were used in the process. Our
model, although transductive, does not make use of the test set labels at any
training stage. Finally, our model also offers the advantage of generating
examples of good quality novel images as shown in Figure 2(d) and Figure 3(d).
Some further examples of novel image generation are included in Appendix A.

As mentioned previously, we were not able to carry any direct comparison to
state-of-the-art transductive methods due to the difference in experimental
design where we do not make use of the class labels in the training set (as
opposed to the work of (Tifrea et al., 2020) for example). The state-of-the-
art PU learning method (D-GAN) did not have a full implementation available,
and although it has an advantage over our method (i.e. the fact it does not
require any prior knowledge of the contamination rate in the test set), it
only works with a specific type of discriminator loss (the cross-entropy).
Previous studies have shown the limitations of using this type of loss and
have highlighted issues such as mode collapse or non-informative gradients.
Optimal transport type of losses (Arjovsky et al., 2017; Salimans et al.,
2018) have shown more stability in the training process, our model has the
flexibility of using any of those losses during training. We have compared our
method to a vanilla version of TransductGAN that is closely related to D-GAN.
Its performance results are displayed under the ’Vanilla’ columns (with
varying rates of contamination) in Table 1 and Table 2. With regards to MNIST,
our model outperforms the vanilla version by 0.51% and 0.8% for a
contamination rate of 5% and 10% respectively, it underperforms the vanilla
version by -0.15% for a contamination rate of 30%. On average across all
contamination rates, it outperforms the vanilla model by 0.39%. This low
performance comparison level is due to the MNIST results already being $>0.95$
for the vast majority. With regards to CIFAR10, our model outperforms the
vanilla version by 10.03%, 6.37% and 7.59% for a contamination rate of 5%, 10%
and 30% respectively, this demonstrates a superior performance across all
contamination levels.

##  6 Conclusion and future work

We have introduced a novel architecture that learns to generate inliers and
novel data using separate distributions by combining an adversarial
autoencoder with a GAN under a transductive mode. A binary classifier is
trained in the second stage using the latent features of the encoder network
to distinguish the novel samples from the inliers. By being able to generate
the novel data points artificially we overcome the hurdle of hyperparameter
tuning that is faced by state-of-the-art inductive methods. Our model
outperforms the latter methods and is capable of reproducing good quality
visual representations of the novel images. Our model also outperforms a
vanilla model that is closely related to D-GAN; this highlights the advantage
that the latent space projections offer in TransductGAN over the image space
features in the vanilla model. TransductGAN is most suitable for situations
where the novelties are not rare but also shows competitive results when the
contamination rate drops to low levels. It also requires prior knowledge of
the contamination rate which is a disadvantage over other state-of-the-art PU
learning methods, but it allows for the use of more powerful loss functions
with enhanced stability during training. Future work will focus on learning
the contamination rate and assessing cases where the contamination rate falls
to levels below 5%. Future work will also extend to include labels of the
inlier set during training when these are available; this should yield an
enhanced performance and allow us to compare our model against a wider range
of transductive models.

## Acknowledgements

JMM is supported by the Wellcome Trust under Grant No. WT102845/Z/13/Z. NT is
funded by the Engineering and Physical Sciences Research Council. We would
like to thank Giulia Luise and Florent Chiaroni for insightful comments.

## Appendix A

This appendix presents additional results using different novel class examples
with MNIST and CIFAR10 datasets.

(a) Real novel images

(b) Fake novel images (5%)

(c) Fake novel images (10%)

(d) Fake novel images (30%)

Figure 5: MNIST example with ’4’ as novel class. For the fake examples, the
value in brackets corresponds to the contamination rate in the test set that
was used during training.

(a) Real novel images

(b) Fake novel images (5%)

(c) Fake novel images (10%)

(d) Fake novel images (30%)

Figure 6: MNIST example with ’6’ as novel class. For the fake examples, the
value in brackets corresponds to the contamination rate in the test set that
was used during training.

(a) Real novel images

(b) Fake novel images (5%)

(c) Fake novel images (10%)

(d) Fake novel images (30%)

Figure 7: CIFAR10 example with horse as novel class. For the fake examples,
the value in brackets corresponds to the contamination rate in the test set
that was used during training.

(a) Real novel images

(b) Fake novel images (5%)

(c) Fake novel images (10%)

(d) Fake novel images (30%)

Figure 8: CIFAR10 example with car as novel class. For the fake examples, the
value in brackets corresponds to the contamination rate in the test set that
was used during training.

## References

  * Akcay et al. (2018) Akcay, S., Abarghouei, A.A., Breckon, T.P., 2018.  Ganomaly: Semi-supervised anomaly detection via adversarial training.  CoRR abs/1805.06725.  URL: http://arxiv.org/abs/1805.06725, arXiv:1805.06725.
  * Akçay et al. (2019) Akçay, S., Abarghouei, A.A., Breckon, T.P., 2019.  Skip-ganomaly: Skip connected and adversarially trained encoder-decoder anomaly detection.  CoRR abs/1901.08954.  URL: http://arxiv.org/abs/1901.08954, arXiv:1901.08954.
  * An and Cho (2015) An, J., Cho, S., 2015.  Variational autoencoder based anomaly detection using reconstruction probability.
  * Arjovsky et al. (2017) Arjovsky, M., Chintala, S., Bottou, L., 2017.  Wasserstein gan.  arXiv:1701.07875.
  * Bekker and Davis (2018) Bekker, J., Davis, J., 2018\.  Learning from positive and unlabeled data: A survey.  CoRR abs/1811.04820.  URL: http://arxiv.org/abs/1811.04820, arXiv:1811.04820.
  * Blanchard et al. (2010) Blanchard, G., Lee, G., Scott, C., 2010.  Semi-supervised novelty detection.  Journal of Machine Learning Research 11, 2973–3009.  URL: http://jmlr.org/papers/v11/blanchard10a.html.
  * Chalapathy and Chawla (2019) Chalapathy, R., Chawla, S., 2019\.  Deep learning for anomaly detection: A survey.  CoRR abs/1901.03407.  URL: http://arxiv.org/abs/1901.03407, arXiv:1901.03407.
  * Donahue et al. (2016) Donahue, J., Krähenbühl, P., Darrell, T., 2016.  Adversarial feature learning.  CoRR abs/1605.09782.  URL: http://arxiv.org/abs/1605.09782, arXiv:1605.09782.
  * Dumoulin et al. (2016) Dumoulin, V., Belghazi, I., Poole, B., Mastropietro, O., Lamb, A., Arjovsky, M., Courville, A., 2016.  Adversarially learned inference.  arXiv:1606.00704.
  * Goodfellow et al. (2014) Goodfellow, I.J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y., 2014\.  Generative adversarial networks.  arXiv:1406.2661.
  * Gulrajani et al. (2017a) Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., Courville, A., 2017a.  Improved training of wasserstein gans.  arXiv:1704.00028.
  * Gulrajani et al. (2017b) Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., Courville, A.C., 2017b.  Improved training of wasserstein gans.  CoRR abs/1704.00028.  URL: http://arxiv.org/abs/1704.00028, arXiv:1704.00028.
  * Hou et al. (2017) Hou, M., Zhao, Q., Li, C., Chaib-draa, B., 2017.  A generative adversarial framework for positive-unlabeled classification.  CoRR abs/1711.08054.  URL: http://arxiv.org/abs/1711.08054, arXiv:1711.08054.
  * Kingma and Welling (2014) Kingma, D.P., Welling, M., 2014\.  Auto-encoding variational bayes.  arXiv:1312.6114.
  * Kiryo et al. (2017) Kiryo, R., Niu, G., du Plessis, M.C., Sugiyama, M., 2017\.  Positive-unlabeled learning with non-negative risk estimator.  arXiv:1703.00593.
  * Krizhevsky (2009) Krizhevsky, A., 2009.  Learning multiple layers of features from tiny images.  Technical Report.
  * LeCun and Cortes (2010) LeCun, Y., Cortes, C., 2010\.  MNIST handwritten digit database URL: http://yann.lecun.com/exdb/mnist/.
  * Lee and Liu (2003) Lee, W.S., Liu, B., 2003.  Learning with positive and unlabeled examples using weighted logistic regression, in: Proceedings of the Twentieth International Conference on International Conference on Machine Learning, AAAI Press. p. 448–455.
  * Li and Liu (2003) Li, X., Liu, B., 2003.  Learning to classify texts using positive and unlabeled data, in: Proceedings of the 18th International Joint Conference on Artificial Intelligence, Morgan Kaufmann Publishers Inc., San Francisco, CA, USA. p. 587–592.
  * Liu et al. (2003) Liu, B., Dai, Y., Li, X., Lee, W.S., Yu, P.S., 2003\.  Building text classifiers using positive and unlabeled examples, in: Proceedings of the Third IEEE International Conference on Data Mining, IEEE Computer Society, USA. p. 179.
  * Liu et al. (2002) Liu, B., Lee, W.S., Yu, P.S., Li, X., 2002.  Partially supervised classification of text documents, pp. 387–394.
  * Makhzani et al. (2015) Makhzani, A., Shlens, J., Jaitly, N., Goodfellow, I.J., 2015\.  Adversarial autoencoders.  CoRR abs/1511.05644.  URL: http://arxiv.org/abs/1511.05644, arXiv:1511.05644.
  * Metz et al. (2016) Metz, L., Poole, B., Pfau, D., Sohl-Dickstein, J., 2016.  Unrolled generative adversarial networks.  CoRR abs/1611.02163.  URL: http://arxiv.org/abs/1611.02163, arXiv:1611.02163.
  * Pimentel et al. (2014) Pimentel, M.A., Clifton, D.A., Clifton, L., Tarassenko, L., 2014\.  A review of novelty detection.  Signal Processing 99, 215 – 249.  URL: http://www.sciencedirect.com/science/article/pii/S016516841300515X, doi:https://doi.org/10.1016/j.sigpro.2013.12.026.
  * Plessis et al. (2014) Plessis, M.C.d., Niu, G., Sugiyama, M., 2014.  Analysis of learning from positive and unlabeled data, in: Proceedings of the 27th International Conference on Neural Information Processing Systems - Volume 1, MIT Press, Cambridge, MA, USA. p. 703–711.
  * Plessis et al. (2015) Plessis, M.D., Niu, G., Sugiyama, M., 2015.  Convex formulation for learning from positive and unlabeled data, in: Bach, F., Blei, D. (Eds.), Proceedings of the 32nd International Conference on Machine Learning, PMLR, Lille, France. pp. 1386–1394.  URL: https://proceedings.mlr.press/v37/plessis15.html.
  * Poole et al. (2016) Poole, B., Alemi, A.A., Sohl-Dickstein, J., Angelova, A., 2016\.  Improved generator objectives for gans.  CoRR abs/1612.02780.  URL: http://arxiv.org/abs/1612.02780, arXiv:1612.02780.
  * Radford et al. (2015) Radford, A., Metz, L., Chintala, S., 2015.  Unsupervised representation learning with deep convolutional generative adversarial networks.  arXiv:1511.06434.
  * Salimans et al. (2016) Salimans, T., Goodfellow, I.J., Zaremba, W., Cheung, V., Radford, A., Chen, X., 2016\.  Improved techniques for training gans.  CoRR abs/1606.03498.  URL: http://arxiv.org/abs/1606.03498, arXiv:1606.03498.
  * Salimans et al. (2018) Salimans, T., Zhang, H., Radford, A., Metaxas, D.N., 2018\.  Improving gans using optimal transport.  CoRR abs/1803.05573.  URL: http://arxiv.org/abs/1803.05573, arXiv:1803.05573.
  * Schlegl et al. (2017) Schlegl, T., Seeböck, P., Waldstein, S.M., Schmidt-Erfurth, U., Langs, G., 2017.  Unsupervised anomaly detection with generative adversarial networks to guide marker discovery.  CoRR abs/1703.05921.  URL: http://arxiv.org/abs/1703.05921, arXiv:1703.05921.
  * Schölkopf et al. (2001) Schölkopf, B., Platt, J.C., Shawe-Taylor, J.C., Smola, A.J., Williamson, R.C., 2001.  Estimating the support of a high-dimensional distribution.  Neural Comput. 13, 1443–1471.  URL: https://doi.org/10.1162/089976601750264965, doi:10.1162/089976601750264965.
  * Scott and Blanchard (2008) Scott, C., Blanchard, G., 2008\.  Transductive anomaly detection.  Technical Report.
  * Tifrea et al. (2020) Tifrea, A., Stavarache, E., Yang, F., 2020.  Learn what you can’t learn: Regularized ensembles for transductive out-of-distribution detection.  CoRR abs/2012.05825.  URL: https://arxiv.org/abs/2012.05825, arXiv:2012.05825.
  * Vapnik (1998) Vapnik, V.N., 1998.  Statistical Learning Theory.  Wiley-Interscience.
  * Yu and Aizawa (2019) Yu, Q., Aizawa, K., 2019.  Unsupervised out-of-distribution detection by maximum classifier discrepancy.  CoRR abs/1908.04951.  URL: http://arxiv.org/abs/1908.04951, arXiv:1908.04951.
  * Zenati et al. (2018a) Zenati, H., Foo, C.S., Lecouat, B., Manek, G., Chandrasekhar, V.R., 2018a.  Efficient gan-based anomaly detection.  arXiv:1802.06222.
  * Zenati et al. (2018b) Zenati, H., Romain, M., Foo, C.S., Lecouat, B., Chandrasekhar, V.R., 2018b.  Adversarially learned anomaly detection.  CoRR abs/1812.02288.  URL: http://arxiv.org/abs/1812.02288, arXiv:1812.02288.