One-Class Signed Distance Function (OCSDF)

• OCSDF is a method that recasts one-class classification as estimating the signed distance function via a 1-Lipschitz neural network.
• It employs a hinge-based HKR loss and Newton–Raphson negative sampling to achieve robust anomaly detection with certified AUROC.
• The framework also facilitates generative visualization and implicit surface reconstruction, demonstrating competitive performance on benchmark datasets.

The One-Class Signed Distance Function (OCSDF) is a provable method for robust one-class classification (OCC) based on learning the signed distance function (SDF) to the support boundary of an arbitrary data distribution. OCSDF formulates anomaly detection and OCC as the estimation of the SDF by a neural network constrained to be 1-Lipschitz. This approach enables rigorous robustness guarantees against $\ell_2$ adversarial attacks and introduces the notion of a certified AUROC, providing a verifiable performance metric under worst-case perturbations. In addition to robust anomaly detection, OCSDF facilitates generative visualization and implicit surface reconstruction, making it a versatile framework for OCC and related geometric learning tasks (Bethune et al., 2023).

1. Mathematical Foundations: The Signed Distance Function

Let $X\sim\mathbb P_X$ be a continuous distribution on $\mathbb R^d$ with compact support $\mathcal S$. Define the boundary of the support as $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$. The Euclidean signed distance function $\mathrm{SDF}:\mathbb R^d\to\mathbb R$ is

$$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$

or equivalently,

$$\mathrm{SDF}(x)=\mathrm{sign}_{\mathcal S}(x)\;\inf_{y\in\partial\mathcal S}\|x-y\|_2,$$

where

$$\mathrm{sign}_{\mathcal S}(x)= \begin{cases} +1,&x\in\mathcal S \ -1,&x\notin\mathcal S \end{cases}$$

and $\|\nabla_x\mathrm{SDF}(x)\|_2=1$ almost everywhere; that is, SDF is 1-Lipschitz in the $X\sim\mathbb P_X$0 norm.

2. Formulating One-Class Classification via SDF Learning

OCSDF recasts OCC—distinguishing $X\sim\mathbb P_X$1 ("inliers") from outliers—as binary classification between

$X\sim\mathbb P_X$2

where $X\sim\mathbb P_X$3 is a “complementary” (synthetic negative) distribution with support separated from $X\sim\mathbb P_X$4 by at least $X\sim\mathbb P_X$5. A 1-Lipschitz network $X\sim\mathbb P_X$6 is trained to minimize the Hinge Kantorovich–Rubinstein (HKR) loss:

$X\sim\mathbb P_X$7

where

$X\sim\mathbb P_X$8

with $X\sim\mathbb P_X$9 for $\mathbb R^d$0. The parameter $\mathbb R^d$1 sets the margin ($\mathbb R^d$2) and $\mathbb R^d$3 weights the hinge penalty. A population-risk minimizer $\mathbb R^d$4 approximates the offset SDF on each class,

$\mathbb R^d$5

and critically, $\mathbb R^d$6, making $\mathbb R^d$7 a normality score.

3. 1-Lipschitz Network Architecture and HKR Loss Implementation

All affine layers (dense and convolutional) are constrained to be 1-Lipschitz by mapping their weight matrices $\mathbb R^d$8 onto the Stiefel manifold ($\mathbb R^d$9), accomplished via the differentiable Björck iteration from unconstrained weights $\mathcal S$0. Activation functions are chosen as GroupSort or FullSort to ensure piecewise linearity, 1-Lipschitzness, and gradient-norm preservation.

The batchwise HKR loss for $\mathcal S$1 positive samples $\mathcal S$2 and corresponding negatives $\mathcal S$3 is

$\mathcal S$4

Training alternates between SGD/RMSProp parameterization and orthogonal reprojected updates for Lipschitz constraints.

Newton–Raphson Negative Sampling

Outlier samples $\mathcal S$5 are generated via backpropagation with the current classifier $\mathcal S$6:

$$\mathrm{SDF}(x)=\mathrm{sign}_{\mathcal S}(x)\;\inf_{y\in\partial\mathcal S}\|x-y\|_2,$$1

Full OCSDF training alternates between positive batch sampling, negative sampling via Algorithm 1, computation of batch HKR loss, and 1-Lipschitz-constrained optimizer steps.

Typical hyperparameters include $\mathcal S$7 (tabular) or $\mathcal S$8 (images), $\mathcal S$9, $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$0 (negative sampling steps), batch size $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$1, and RMSProp or SGD.

4. Robustness and Certified AUROC

Owing to the 1-Lipschitz constraint, for any adversarial perturbation $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$2, the classifier output satisfies

$$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$3

Thus, positive ($$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$4) and negative ($$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$5) classifications can only flip under perturbations exceeding the margin, directly supporting the derivation of a certified AUROC:

$$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$6

where $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$7 is the pdf of $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$8 for $$\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$$9 and $\mathrm{SDF}:\mathbb R^d\to\mathbb R$0 the CDF for $\mathrm{SDF}:\mathbb R^d\to\mathbb R$1, $\mathrm{SDF}:\mathbb R^d\to\mathbb R$2.

This certified AUROC can be computed from score histograms of the unperturbed network, incurring no extra attack cost.

5. Empirical Benchmarking

OCSDF shows competitive result on both tabular and image OCC benchmarks.

Dataset	Clean AUROC (%)	$\mathrm{SDF}:\mathbb R^d\to\mathbb R$3	$\mathrm{SDF}:\mathbb R^d\to\mathbb R$4
MNIST	95.5 ± 0.4	93.2 ± 2.1	78.4 ± 6.4
CIFAR10	57.4 ± 2.1	53.1 ± 2.1	38.4 ± 1.9

For tabular anomaly detection (ODDS/ADBench), OCSDF achieves an average rank of $\mathrm{SDF}:\mathbb R^d\to\mathbb R$5 compared to IsolationForest's $\mathrm{SDF}:\mathbb R^d\to\mathbb R$6, and in \texttt{satimage-2} achieves $\mathrm{SDF}:\mathbb R^d\to\mathbb R$7 AUROC (SOTA $\mathrm{SDF}:\mathbb R^d\to\mathbb R$8).

Certified AUROC matches closely with empirical results under $\mathrm{SDF}:\mathbb R^d\to\mathbb R$9-projected gradient descent (PGD) attacks, notably outperforming DeepSVDD and OC-SVM in robust operating regimes.

6. Generative Visualization and Implicit Surface Reconstruction

OCSDF enables generative visualization by starting from latent noise $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$0 and iteratively attracting $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$1 onto the level set $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$2, where $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$3 cluster near the learned boundary $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$4 and visually resemble real inlier samples.

For 3D point clouds $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$5, fitting OCSDF yields $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$6 without explicit distance computation. This provides scalable implicit surface parameterization; forward passes cost $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$7 versus $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$8 (kNN) or $$\mathrm{SDF}(x) = \begin{cases} +\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \ -\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S \end{cases}$$9 (full pairwise), and applying Marching-Cubes to the learned field produces high-quality meshes.

7. Summary and Scope

OCSDF provides a principled reduction of one-class anomaly detection to learning the SDF via HKR loss in a 1-Lipschitz neural network framework, supporting formal $$\mathrm{SDF}(x)=\mathrm{sign}_{\mathcal S}(x)\;\inf_{y\in\partial\mathcal S}\|x-y\|_2,$$0-robustness certification through the certified AUROC metric. It features a Newton–Raphson negative sampling procedure and achieves robust, competitive performance across structured tabular and image benchmarks. OCSDF also serves as a generative mechanism and an implicit surface parameterization tool, enabling visualization and geometric reconstruction tasks efficiently (Bethune et al., 2023).