DAAIN: Detection of Anomalous and Adversarial Input using Normalizing
  Flows
  Despite much recent work, detecting out-of-distribution (OOD) inputs and
adversarial attacks (AA) for computer vision models remains a challenge. In
this work, we introduce a novel technique, DAAIN, to detect OOD inputs and AA
for image segmentation in a unified setting. Our approach monitors the inner
workings of a neural network and learns a density estimator of the activation
distribution. We equip the density estimator with a classification head to
discriminate between regular and anomalous inputs. To deal with the
high-dimensional activation-space of typical segmentation networks, we
subsample them to obtain a homogeneous spatial and layer-wise coverage. The
subsampling pattern is chosen once per monitored model and kept fixed for all
inputs. Since the attacker has access to neither the detection model nor the
sampling key, it becomes harder for them to attack the segmentation network, as
the attack cannot be backpropagated through the detector. We demonstrate the
effectiveness of our approach using an ESPNet trained on the Cityscapes dataset
as segmentation model, an affine Normalizing Flow as density estimator and use
blue noise to ensure homogeneous sampling. Our model can be trained on a single
GPU making it compute efficient and deployable without requiring specialized
accelerators.
