# ARAE: Adversarially Robust Training of Autoencoders Improves Novelty Detection

arXiv: https://arxiv.org/abs/2003.05669 · HTML: https://mlsanity.com/paper/2003.05669/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Mar 2020.

## Built on by (most cited first, 27 of 27)

- [Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models](https://mlsanity.com/paper/2302.04222/) (2023)
- [A Unified Survey on Anomaly, Novelty, Open-Set, and Out-of-Distribution Detection: Solutions and Future Challenges](https://mlsanity.com/paper/2110.14051/) (2021)
- [Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training](https://mlsanity.com/paper/2102.04716/) (2021)
- [One-Class Classification: A Survey](https://mlsanity.com/paper/2101.03064/) (2021)
- [Adversarially Robust One-class Novelty Detection](https://mlsanity.com/paper/2108.11168/) (2021)
- [Visual Anomaly Detection Via Partition Memory Bank Module and Error Estimation](https://mlsanity.com/paper/2209.12441/) (2022)
- [Your Out-of-Distribution Detection Method is Not Robust!](https://mlsanity.com/paper/2209.15246/) (2022)
- [Autoencoders for Anomaly Detection are Unreliable](https://mlsanity.com/paper/2501.13864/) (2025)
- [PseudoBound: Limiting the anomaly reconstruction capability of one-class classifiers using pseudo anomalies](https://mlsanity.com/paper/2303.10704/) (2023)
- [Unsupervised Visual Defect Detection with Score-Based Generative Model](https://mlsanity.com/paper/2211.16092/) (2022)
- [Data Invariants to Understand Unsupervised Out-of-Distribution Detection](https://mlsanity.com/paper/2111.13362/) (2021)
- [Hierarchical Semi-Supervised Contrastive Learning for Contamination-Resistant Anomaly Detection](https://mlsanity.com/paper/2207.11789/) (2022)
- [Ano-Graph: Learning Normal Scene Contextual Graphs to Detect Video Anomalies](https://mlsanity.com/paper/2103.10502/) (2021)
- [Fake It Till You Make It: Towards Accurate Near-Distribution Novelty Detection](https://mlsanity.com/paper/2205.14297/) (2022)
- [Managing the unknown: a survey on Open Set Recognition and tangential areas](https://mlsanity.com/paper/2312.08785/) (2023)
- [Exploiting Autoencoder's Weakness to Generate Pseudo Anomalies](https://mlsanity.com/paper/2405.05886/) (2024)
- [On Generalization of Graph Autoencoders with Adversarial Training](https://mlsanity.com/paper/2107.02658/) (2021)
- [GRAM: An Interpretable Approach for Graph Anomaly Detection using Gradient Attention Maps](https://mlsanity.com/paper/2311.06153/) (2023)
- [Robust Semi-Supervised Anomaly Detection via Adversarially Learned Continuous Noise Corruption](https://mlsanity.com/paper/2303.03925/) (2023)
- [Critical Review for One-class Classification: recent advances and the reality behind them](https://mlsanity.com/paper/2404.17931/) (2024)
- [Self-supervised New Activity Detection in Sensor-based Smart Environments](https://mlsanity.com/paper/2401.10288/) (2024)
- [InForecaster: Forecasting Influenza Hemagglutinin Mutations Through the Lens of Anomaly Detection](https://mlsanity.com/paper/2210.13709/) (2022)
- [A Robust Likelihood Model for Novelty Detection](https://mlsanity.com/paper/2306.03331/) (2023)
- [A Hierarchically Feature Reconstructed Autoencoder for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2405.09148/) (2024)
- [How to Enhance Downstream Adversarial Robustness (almost) without Touching the Pre-Trained Foundation Model?](https://mlsanity.com/paper/2504.10850/) (2025)
- [Adversarially Robust PAC Learning with Optimal VC Rates](https://mlsanity.com/paper/2609.24260/) (2026)
- [When Does Unsupervised Learning Succeed or Fail? A PoS Perspective on Reconstruction-Based Anomaly Detection](https://mlsanity.com/paper/2609.28832/) (2026)

## Abstract (arXiv)

Autoencoders (AE) have recently been widely employed to approach the novelty detection problem. Trained only on the normal data, the AE is expected to reconstruct the normal data effectively while fail to regenerate the anomalous data, which could be utilized for novelty detection. However, in this paper, it is demonstrated that this does not always hold. AE often generalizes so perfectly that it can also reconstruct the anomalous data well. To address this problem, we propose a novel AE that can learn more semantically meaningful features. Specifically, we exploit the fact that adversarial robustness promotes learning of meaningful features. Therefore, we force the AE to learn such features by penalizing networks with a bottleneck layer that is unstable against adversarial perturbations. We show that despite using a much simpler architecture in comparison to the prior methods, the proposed AE outperforms or is competitive to state-of-the-art on three benchmark datasets.