提出首个无需训练的少样本异常检测抗攻击方法，兼顾鲁棒性与精度。
Adversarially Robust Few-Shot Anomaly Detection with Vision Foundation Models
- 用轻量MLP预测每块特征的k-NN距离，实现非参数检测器的可微代理
- 在k=4时图像级AUROC提升27%，像素级PRO提升51%，保持97%干净准确率
- 适合部署在冻结主干网络的工业异常检测场景，尤其对抗攻击敏感任务
视觉基础模型如DINOv2通过冻结补丁特征的非参数k-NN评分实现强大少样本异常检测（FSAD）。现有鲁棒检测方法依赖大量正常类训练数据和特征提取器的对抗训练，而少样本场景（仅用冻结主干+非参数评分器）仍未被解决。本文提出适配k-NN记忆库检测器的白盒攻击框架，并设计无需主干训练的抗攻击方法。引入DistanceProbe（DP），一个通过回归训练的轻量MLP，直接从冻结特征预测每块k-NN距离，提供梯度攻击所需的可微代理。进一步提出两级联合防御：输入层采用PatchShift（PS），通过随机像素偏移利用对抗扰动与编码器补丁网格的错位，结合元素中值池化聚合多视图得分；特征层采用FeaturePurifier（FP），一个轻量残差MLP，在清洁与对抗增强的支持特征上训练，将受扰表示投影回干净特征流形。在MVTec-AD、VisA和MPDD数据集上，k=4时，相比未防御基线，图像级AUROC提升约27%，像素级PRO提升约51%，干净准确率损失低于3%，媲美全样本对抗训练基线，且对自适应攻击保持鲁棒。
原文摘要 · Abstract (English)
Vision foundation models such as DINOv2 enable strong few-shot anomaly detection (FSAD) through simple non-parametric k-nearest-neighbor (k-NN) scoring over frozen patch features. Existing robust anomaly detection methods assume large normal-class training sets and adversarial training of the feature extractor. The few-shot regime, where the detector consists of a frozen backbone and a non-parametric scorer, has remained unaddressed despite its widespread deployment. We develop a white-box attack framework adapted to k-NN memory-bank detectors and introduce an adversarially robust FSAD method which is training-free with respect to the backbone. We introduce the DistanceProbe (DP), a lightweight MLP trained by regression to predict per-patch k-NN distance directly from frozen features, providing the differentiable proxy required for gradient-based attacks against non-parametric scorers. We further propose a two-level combined defense that operates using only the normal reference support set images. At the input level, PatchShift (PS) applies random pixel shifts to exploit the misalignment of adversarial perturbations with the encoder's patch grid, aggregating scores across multiple shifted views via element-wise median pooling. At the feature level we employ the FeaturePurifier (FP), a lightweight residual MLP trained on clean and adversarially augmented support features to project perturbed representations back toward the clean feature manifold. Through comprehensive experiments under various adversarial settings, we show that our method exhibits robust detection and localization with performance gains of ~27% image-level AUROC and ~51% pixel-level PRO over the undefended attacked baseline across MVTec-AD, VisA, and MPDD at k=4 shots, while preserving clean accuracy within 3%, matching full-shot adversarially-trained baselines on pixel-level AUROC, and holding under adaptive attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。