💻 computer science

ROAST: Risk-aware Outlier-exposure for Adversarial Selective Training of Anomaly Detectors Against Evasion Attacks

The paper proposes ROAST, a risk-aware selective training framework that enhances anomaly detector recall against evasion attacks by focusing training on less vulnerable patient data and injecting adversarial samples, achieving significant performance gains and reduced training time without compromising precision.

Original authors: Mohammed Elnawawy, Gargi Mitra, Shahrear Iqbal, Karthik Pattabiraman

Published 2026-03-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Mohammed Elnawawy, Gargi Mitra, Shahrear Iqbal, Karthik Pattabiraman

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a high-security airport. Your goal is to stop terrorists (adversarial attacks) from sneaking past the metal detectors (the AI system) and boarding the plane.

In the medical world, Deep Neural Networks (DNNs) are like the flight controllers making life-or-death decisions for patients. But these controllers can be tricked by tiny, invisible changes to the data—like a terrorist wearing a fake mustache to look like a regular passenger. These are called evasion attacks.

To protect the flight controller, we use a "Security Guard" called an Anomaly Detector (AD). Its job is to spot anything weird before it reaches the controller.

The Problem: The "Noisy" Crowd

The paper argues that current security guards are trained poorly. They are trained on everyone's data—every single patient in the hospital.

Think of it like this: Imagine you are teaching a security guard to spot a fake ID.

Patient A is very healthy and stable. Their ID photos are clear, crisp, and easy to recognize as "real."
Patient B has a very complex medical history. Their data is "noisy"—it fluctuates wildly, looks messy, and sometimes looks like a fake ID even when it's real.

If you train your security guard on both Patient A and Patient B, the guard gets confused. They start thinking, "Well, sometimes real IDs look messy like Patient B's." So, when a terrorist tries to sneak in with a messy fake ID, the guard says, "Oh, that looks just like Patient B. Let them through."

Result: The guard misses the bad guys (Low Recall).

The Solution: ROAST

The authors propose a new system called ROAST (Risk-aware Outlier-exposure for Adversarial Selective Training). It works in two clever steps, like a smart hiring process for your security team.

Step 1: The "Risk Profile" (Finding the Stable Patients)

Instead of training on everyone, ROAST first analyzes the patients to see who is "easier to trick" and who is "harder to trick."

The Vulnerable Patients: These are the ones whose data is already messy or close to the edge. It's easy for a hacker to nudge their data just a tiny bit to fool the system.
The Resilient Patients: These are the ones with very stable, clean data. It takes a massive, obvious change to fool the system.

The Analogy: Imagine a game of "Simon Says."

Vulnerable Patients are like people who are already wobbling on a tightrope. A tiny push (an attack) knocks them off.
Resilient Patients are like people standing on solid ground. You have to push them really hard to knock them over.

ROAST filters out the "wobbling" patients and says, "We will only train our security guard on the people standing on solid ground." This gives the guard a much clearer picture of what "normal" looks like.

Step 2: "Outlier Exposure" (The Controlled Chaos)

Here is the tricky part. If you only train the guard on the "solid ground" patients, the guard might become too strict. They might think, "If you aren't perfectly standing on solid ground, you must be a terrorist!" This causes them to stop innocent people who are just slightly wobbly (False Positives).

To fix this, ROAST uses a technique called Outlier Exposure.

The Analogy: The guard is trained on the "solid ground" patients (the clean data). BUT, the trainers then show the guard a few fake scenarios where a "solid ground" person is slightly nudged by a hacker.
They don't show the guard the messy, confusing data from the "wobbly" patients. Instead, they take the clean data and artificially create a few "almost-fake" examples.

This teaches the guard: "Okay, I know what 'solid ground' looks like. But I also know that a hacker might try to push someone just a little bit off the edge. I need to catch that specific push, but I shouldn't stop everyone who is just slightly wobbly."

The Results: Why It's a Game Changer

The paper tested this on real medical data (diabetes, heart rates, sepsis) and found amazing results:

Caught More Bad Guys: The new method caught 16.2% more attacks than the old "train on everyone" method. It stopped the terrorists who were slipping through the cracks.
Fewer False Alarms: It didn't significantly increase the number of innocent people getting stopped. The precision stayed almost the same.
Super Fast Training: Because they stopped training on the messy, confusing data (the "wobbly" patients), they had to process 80% less data. This made the training time 88% faster.

The Bottom Line

ROAST is like hiring a security guard who only studies the clearest, most stable examples of "normal" behavior, and then practices on a few specific, controlled "fake" scenarios.

Instead of trying to learn from a chaotic crowd of 1,000 people (where some are naturally messy), it learns from the 200 most stable people and then practices on a few specific tricks. The result is a guard who is sharper, faster to train, and much better at spotting the real threats without bothering the innocent.

In a world where a missed diagnosis can be fatal, this "selective training" ensures that the AI security system is focused on the most reliable signals, making our healthcare systems safer against digital attacks.

1. Problem Statement

Deep Neural Networks (DNNs) are increasingly used in safety-critical healthcare domains (e.g., medical imaging, personalized medicine) but remain vulnerable to evasion attacks. In these attacks, adversaries introduce minimal perturbations to input data at inference time to cause misclassification, potentially leading to dangerous outcomes like misdiagnosis or incorrect treatment dosages.

While Anomaly Detectors (ADs) are commonly used as a defense layer to identify adversarial inputs before they reach the DNN, conventional ADs suffer from three critical limitations in healthcare settings:

Indiscriminate Training: They are typically trained on benign data from all patients. However, human physiology varies significantly; data from some patients contains high levels of "noise" (erratic fluctuations due to pathology, lifestyle, or stress) that obscures meaningful patterns, degrading the AD's ability to distinguish between benign noise and malicious attacks.
Reduced Recall: Training on noisy data leads to poorly defined decision boundaries, resulting in high False Negative (FN) rates (failing to detect attacks).
Computational Inefficiency: Training on massive, diverse datasets is computationally expensive and time-consuming.

2. Methodology: The ROAST Framework

The authors propose ROAST (Risk-aware Outlier-exposure for Adversarial Selective Training), a two-stage framework designed to improve AD recall without significantly sacrificing precision, while reducing training costs.

Stage 1: Risk Profiling

This stage identifies patients whose data is "less vulnerable" to evasion attacks.

Attack Simulation: The framework simulates evasion attacks using the Universal Robustness Evaluation Toolkit (URET), a black-box, non-gradient-based framework that manipulates vital signs (e.g., glucose, heart rate) while maintaining physiological plausibility.
Risk Quantification: It calculates an instantaneous risk score for every data point based on the magnitude and severity of the deviation from benign values. The risk formula is a weighted sum: $R(t) = \sum S_i \cdot Z_i(t)$ , where $S_i$ represents the severity coefficient (derived via regression models) and $Z_i(t)$ is the squared difference between manipulated and original values.
Clustering: Patients are grouped into clusters based on their time-series risk profiles using Hierarchical Clustering with Dynamic Time Warping (DTW). This separates patients into "Less Vulnerable" (data further from the decision boundary, more stable) and "More Vulnerable" (data closer to the boundary, noisier, easier to manipulate) groups.

Stage 2: Anomaly Detector Enhancement

Instead of training on all data, ROAST employs a selective training strategy:

Noise Removal: The AD is trained only on the benign data of the "Less Vulnerable" patients. This removes the noisy behavior of vulnerable patients, creating a cleaner baseline.
Controlled Outlier Exposure: To prevent the model from learning an overly narrow definition of "benign" (which would hurt precision), the framework injects adversarial samples generated from the "Less Vulnerable" patients into the training set.
- Mechanism: These adversarial samples are subtle perturbations that "blend in" with normal physiological ranges but are designed to be detected.
- Goal: This forces the AD to learn a richer representation of the feature space, carving a more accurate decision boundary that captures subtle deviations without overfitting to noise.

3. Key Contributions

ROAST Framework: A novel risk-aware selective training framework that quantifies patient-specific vulnerability to evasion attacks and clusters them accordingly.
Selective Training Strategy: A method to train ADs exclusively on "cleaner" data from less vulnerable patients, augmented with controlled adversarial examples (outlier exposure) to balance recall and precision.
Comprehensive Evaluation: Extensive experiments on three real-world healthcare datasets (OhioT1DM, MIMIC, PhysioNet CinC) and three AD architectures (kNN, One-Class SVM, MAD-GAN).
Insights into Robustness: Analysis showing that inter-cluster distance (separation between vulnerable and non-vulnerable groups) correlates directly with the performance gains of the framework.

4. Experimental Results

The evaluation compared ROAST against indiscriminate training (using all patients) and other baselines.

Recall Improvement: ROAST improved the recall (detection of adversarial samples) by an average of 16.2% across all experiments.
- Notable Gains: Up to 27.8% for kNN on OhioT1DM and 89.8% for One-Class SVM on MIMIC.
- Reasoning: Less vulnerable patients have a higher ratio of normal-to-abnormal benign data, allowing the AD to better distinguish true anomalies from physiological noise.
Precision Impact: Precision remained stable or improved in 8 out of 9 experiments.
- In the single case where precision dropped (kNN on OhioT1DM), the decrease was minimal (4.97%).
- The controlled outlier exposure prevented the model from becoming too narrow, maintaining a low False Positive rate.
Efficiency Gains:
- Training Set Reduction: By selecting only the "Less Vulnerable" cluster, the training set size was reduced by 75.0% to 93.2% (average 80.1%).
- Training Time: Training time was reduced by an average of 88.3% (up to 99.77% reduction in some cases).
Robustness: Sensitivity analysis showed that the clustering results remained stable with ±20% variations in severity coefficients and ±10% variations in dendrogram cut thresholds.

5. Significance and Conclusion

ROAST addresses a critical gap in healthcare security: the trade-off between robustness and efficiency in anomaly detection.

Clinical Relevance: In safety-critical systems, missing an attack (False Negative) is often more dangerous than a false alarm (False Positive). ROAST significantly reduces the risk of missed attacks while keeping false alarms manageable for human oversight.
Scalability: By drastically reducing the training data requirements and time, ROAST makes it feasible to deploy robust ADs in resource-constrained or large-scale healthcare environments.
Generalizability: The framework is attack-agnostic (works with various evasion techniques) and adaptable to different AD architectures, offering a scalable solution for protecting DNNs in the Internet of Medical Things (IoMT).

In summary, ROAST demonstrates that selective training based on risk profiling, combined with strategic outlier exposure, creates anomaly detectors that are more robust, efficient, and accurate against evasion attacks than traditional indiscriminate training methods.