ROAST: Risk-aware Outlier-exposure for Adversarial Selective Training of Anomaly Detectors Against Evasion Attacks

• URL: http://arxiv.org/abs/2603.26093v1
• Date: Fri, 27 Mar 2026 05:47:48 GMT
• Title: ROAST: Risk-aware Outlier-exposure for Adversarial Selective Training of Anomaly Detectors Against Evasion Attacks
• Abstract summary: Anomaly detectors (ADs) are widely used to protect deep neural networks (DNNs)<n>ADs are trained indiscriminately on benign data from all patients, overlooking physiological differences that introduce noise, degrade robustness, and reduce recall.<n>We propose ROAST, a novel risk-aware outlier exposure selective training framework that improves AD recall without sacrificing precision.
• Score: 9.25132407333504
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Safety-critical domains like healthcare rely on deep neural networks (DNNs) for prediction, yet DNNs remain vulnerable to evasion attacks. Anomaly detectors (ADs) are widely used to protect DNNs, but conventional ADs are trained indiscriminately on benign data from all patients, overlooking physiological differences that introduce noise, degrade robustness, and reduce recall. In this paper, we propose ROAST, a novel risk-aware outlier exposure selective training framework that improves AD recall without sacrificing precision. ROAST identifies patients who are less vulnerable to attack and focuses training on these cleaner, more reliable data, thereby reducing false negatives and improving recall. To preserve precision, the framework applies outlier exposure by injecting adversarial samples into the training set of the less vulnerable patients, avoiding noisy data from others. Experiments show that ROAST increases recall by 16.2\% while reducing the training time by 88.3\% on average compared to indiscriminate training, with minimal impact on precision.

Related papers

• Securing Traffic Sign Recognition Systems in Autonomous Vehicles [0.9051212432652913]
  We perform error-minimizing attacks on Deep Neural Networks (DNNs) used for traffic sign recognition.<n>We propose a data augmentation-based training method to mitigate the error-minimizing attacks.<n>Our detection model achieves a success rate of over 99% in identifying the attack.
  arXiv  Detail & Related papers  (2025-06-06T22:35:03Z)
• Learning from the Good Ones: Risk Profiling-Based Defenses Against Evasion Attacks on DNNs [4.837320865223376]
  Safety-critical applications use deep neural networks (DNNs) to make predictions and infer decisions.<n>We propose a novel risk profiling framework that uses a risk-aware strategy to selectively train static defenses.<n>We show that selective training on the less vulnerable patients achieves a recall increase of up to 27.5% with minimal impact on precision.
  arXiv  Detail & Related papers  (2025-05-10T00:33:15Z)
• Adversarial Feature Alignment: Balancing Robustness and Accuracy in Deep Learning via Adversarial Training [10.099179580467737]
  Adversarial training is used to mitigate this problem by increasing robustness against adversarial attacks. This approach typically reduces a model's standard accuracy on clean, non-adversarial samples. This paper proposes a novel adversarial training method called Adversarial Feature Alignment (AFA) to address these problems.
  arXiv  Detail & Related papers  (2024-02-19T14:51:20Z)
• Adversarial training with informed data selection [53.19381941131439]
  Adrial training is the most efficient solution to defend the network against these malicious attacks. This work proposes a data selection strategy to be applied in the mini-batch training. The simulation results show that a good compromise can be obtained regarding robustness and standard accuracy.
  arXiv  Detail & Related papers  (2023-01-07T12:09:50Z)
• Efficient Adversarial Training With Data Pruning [26.842714298874192]
  We show that data pruning leads to improvements in convergence and reliability of adversarial training. In some settings data pruning brings benefits from both worlds-it both improves adversarial accuracy and training time.
  arXiv  Detail & Related papers  (2022-07-01T23:54:46Z)
• Towards Adversarial Patch Analysis and Certified Defense against Crowd Counting [61.99564267735242]
  Crowd counting has drawn much attention due to its importance in safety-critical surveillance systems. Recent studies have demonstrated that deep neural network (DNN) methods are vulnerable to adversarial attacks. We propose a robust attack strategy called Adversarial Patch Attack with Momentum to evaluate the robustness of crowd counting models.
  arXiv  Detail & Related papers  (2021-04-22T05:10:55Z)
• How Robust are Randomized Smoothing based Defenses to Data Poisoning? [66.80663779176979]
  We present a previously unrecognized threat to robust machine learning models that highlights the importance of training-data quality. We propose a novel bilevel optimization-based data poisoning attack that degrades the robustness guarantees of certifiably robust classifiers. Our attack is effective even when the victim trains the models from scratch using state-of-the-art robust training methods.
  arXiv  Detail & Related papers  (2020-12-02T15:30:21Z)
• Robust Pre-Training by Adversarial Contrastive Learning [120.33706897927391]
  Recent work has shown that, when integrated with adversarial training, self-supervised pre-training can lead to state-of-the-art robustness. We improve robustness-aware self-supervised pre-training by learning representations consistent under both data augmentations and adversarial perturbations.
  arXiv  Detail & Related papers  (2020-10-26T04:44:43Z)
• Adversarial Self-Supervised Contrastive Learning [62.17538130778111]
  Existing adversarial learning approaches mostly use class labels to generate adversarial samples that lead to incorrect predictions. We propose a novel adversarial attack for unlabeled data, which makes the model confuse the instance-level identities of the perturbed data samples. We present a self-supervised contrastive learning framework to adversarially train a robust neural network without labeled data.
  arXiv  Detail & Related papers  (2020-06-13T08:24:33Z)
• Adversarial Robustness on In- and Out-Distribution Improves Explainability [109.68938066821246]
  RATIO is a training procedure for robustness via Adversarial Training on In- and Out-distribution. RATIO achieves state-of-the-art $l$-adrial on CIFAR10 and maintains better clean accuracy.
  arXiv  Detail & Related papers  (2020-03-20T18:57:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.