---
title: One-Class Signed Distance Function (OCSDF)
url: https://www.emergentmind.com/topics/one-class-signed-distance-function-ocsdf
type: topic
---

# One-Class Signed Distance Function (OCSDF)

The One-Class Signed Distance Function (OCSDF) is a provable method for robust one-class classification (OCC) based on learning the signed distance function (SDF) to the support boundary of an arbitrary data distribution. OCSDF formulates anomaly detection and OCC as the estimation of the SDF by a neural network constrained to be 1-Lipschitz. This approach enables rigorous robustness guarantees against $\ell_2$ adversarial attacks and introduces the notion of a certified AUROC, providing a verifiable performance metric under worst-case perturbations. In addition to robust anomaly detection, OCSDF facilitates generative visualization and implicit surface reconstruction, making it a versatile framework for OCC and related geometric learning tasks [2303.01978].

## 1. Mathematical Foundations: The Signed Distance Function

Let $X\sim\mathbb P_X$ be a continuous distribution on $\mathbb R^d$ with compact support $\mathcal S$. Define the boundary of the support as $\partial\mathcal S = \overline{\mathcal S} \setminus \mathrm{int}(\mathcal S)$. The Euclidean signed distance function $\mathrm{SDF}:\mathbb R^d\to\mathbb R$ is

\[
\mathrm{SDF}(x) =
\begin{cases}
+\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\in\mathcal S \\
-\inf_{y\in\partial\mathcal S}\,\|x-y\|_2, & x\notin\mathcal S
\end{cases}
\]

or equivalently,

\[
\mathrm{SDF}(x)=\mathrm{sign}_{\mathcal S}(x)\;\inf_{y\in\partial\mathcal S}\|x-y\|_2,
\]
where
\[
\mathrm{sign}_{\mathcal S}(x)=
\begin{cases}
+1,&x\in\mathcal S \\
-1,&x\notin\mathcal S
\end{cases}
\]

and $\|\nabla_x\mathrm{SDF}(x)\|_2=1$ almost everywhere; that is, SDF is 1-Lipschitz in the $L^2$ norm.

## 2. Formulating One-Class Classification via SDF Learning

OCSDF recasts OCC—distinguishing $\mathbb P_X$ ("inliers") from outliers—as binary classification between

\[
\underbrace{\mathbb P_X}_{y=+1} \quad\text{and}\quad \underbrace{Q}_{y=-1},
\]
where $Q$ is a “complementary” (synthetic negative) distribution with support separated from $\mathcal S$ by at least $2\epsilon > 0$. A 1-Lipschitz network $f:\mathbb R^d\to\mathbb R$ is trained to minimize the Hinge Kantorovich–Rubinstein (HKR) loss:

\[
\mathcal L_{\mathrm{HKR}}(f) = \mathbb E_{x\sim\mathbb P_X}\left[\ell_{\mathrm{HKR}}(f(x))\right]
+\mathbb E_{z\sim Q}\left[\ell_{\mathrm{HKR}}\left(-f(z)\right)\right]
\]
where
\[
\ell_{\mathrm{HKR}}(s) = \lambda\max(0, m-s) - s
\]
with $s = -f(z)$ for $z \sim Q$. The parameter $m$ sets the margin ($m=\epsilon$) and $\lambda \gg 1$ weights the hinge penalty. A population-risk minimizer $f^*$ approximates the offset SDF on each class,
\[
f^*(x)\approx \mathrm{SDF}(x)+m \;\;(x\in\mathcal S),\quad f^*(z)\approx \mathrm{SDF}(z)-m\;\;(z\in\supp Q)
\]
and critically, $\mathrm{sign}\, f^* = \mathrm{sign\,SDF}$, making $f(x)$ a normality score.

## 3. 1-Lipschitz Network Architecture and HKR Loss Implementation

All affine layers (dense and convolutional) are constrained to be 1-Lipschitz by mapping their weight matrices $W$ onto the Stiefel manifold ($W^\top W=I$), accomplished via the differentiable Björck iteration from unconstrained weights $A\mapsto W=\Pi(A)$. Activation functions are chosen as GroupSort or FullSort to ensure piecewise linearity, 1-Lipschitzness, and gradient-norm preservation.

The batchwise HKR loss for $b$ positive samples $x_i\sim \mathbb P_X$ and corresponding negatives $z_i\sim Q_t$ is

\[
\mathcal L_{\mathrm{batch}}(\theta) = \frac{1}{b}\sum_{i=1}^b \Big[ \lambda\max(0, m - f_\theta(x_i)) - f_\theta(x_i)
+ \lambda\max(0, m + f_\theta(z_i)) + f_\theta(z_i) \Big]
\]

Training alternates between SGD/RMSProp parameterization and orthogonal reprojected updates for Lipschitz constraints.

### Newton–Raphson Negative Sampling

Outlier samples $z\sim Q_t$ are generated via backpropagation with the current classifier $f_t$:

```python
# Algorithm 1: Negative Sampling for OCSDF
Input: current classifier f_t, # steps T
Output: z∼Q_t
    η∼Uniform(0,1)
    z₀∼Uniform(B)
    for k=0…T−1 do
        g←∇_z f_t(z_k)   # (‖g‖≤1)
        z_{k+1}←Proj_B[z_k−(η/T)(f_t(z_k)+ε)g/‖g‖²]
    end
    return z_T
```

Full OCSDF training alternates between positive batch sampling, negative sampling via Algorithm 1, computation of batch HKR loss, and 1-Lipschitz-constrained optimizer steps.

Typical hyperparameters include $m=\epsilon \in [0.01,0.2]$ (tabular) or $0.02\sqrt{d}$ (images), $\lambda=100-1000$, $T=4-32$ (negative sampling steps), batch size $b=128-256$, and RMSProp or SGD.

## 4. Robustness and Certified AUROC

Owing to the 1-Lipschitz constraint, for any adversarial perturbation $\|\delta\|\leq\rho$, the classifier output satisfies

\[
f(x)-\rho\le f(x+\delta)\le f(x)+\rho
\]
Thus, positive ($f(x)>0$) and negative ($f(x)<0$) classifications can only flip under perturbations exceeding the margin, directly supporting the derivation of a certified AUROC:

\[
\mathrm{AUROC}_\rho(f)\ge \int_{-\infty}^{+\infty} F_0(t)\;p_1(t-2\rho)\,dt
\]
where $p_1(t)$ is the pdf of $f(x)$ for $x\sim \mathbb P_X$ and $F_0$ the CDF for $f(z)$, $z\sim Q$.

This certified AUROC can be computed from score histograms of the unperturbed network, incurring no extra attack cost.

## 5. Empirical Benchmarking

OCSDF shows competitive result on both tabular and image OCC benchmarks.

| Dataset           | Clean AUROC (%) | $\epsilon{=}8/255$ | $\epsilon{=}36/255$ |
|-------------------|----------------|--------------------|---------------------|
| MNIST             | 95.5 ± 0.4     | 93.2 ± 2.1         | 78.4 ± 6.4          |
| CIFAR10           | 57.4 ± 2.1     | 53.1 ± 2.1         | 38.4 ± 1.9          |

For tabular anomaly detection (ODDS/ADBench), OCSDF achieves an average rank of $7.1\pm3.6$ compared to IsolationForest's $4.5\pm3.2$, and in \texttt{satimage-2} achieves $97.9\pm0.4\%$ AUROC (SOTA $99.8\%$).

Certified AUROC matches closely with empirical results under $\ell_2$-projected gradient descent (PGD) attacks, notably outperforming DeepSVDD and OC-SVM in robust operating regimes.

## 6. Generative Visualization and Implicit Surface Reconstruction

OCSDF enables generative visualization by starting from latent noise $z_0$ and iteratively attracting $z_t$ onto the level set $f(z)=-\epsilon$, where $z_T$ cluster near the learned boundary $\partial\mathcal S$ and visually resemble real inlier samples.

For 3D point clouds $P=\{p_i\}\subset\mathbb R^3$, fitting OCSDF yields $f^*(x)\approx \mathrm{SDF}_P(x)$ without explicit distance computation. This provides scalable implicit surface parameterization; forward passes cost $O(1)$ versus $O(n\log n)$ (kNN) or $O(n^2)$ (full pairwise), and applying Marching-Cubes to the learned field produces high-quality meshes.

## 7. Summary and Scope

OCSDF provides a principled reduction of one-class anomaly detection to learning the SDF via HKR loss in a 1-Lipschitz neural network framework, supporting formal $\ell_2$-robustness certification through the certified AUROC metric. It features a Newton–Raphson negative sampling procedure and achieves robust, competitive performance across structured tabular and image benchmarks. OCSDF also serves as a generative mechanism and an implicit surface parameterization tool, enabling visualization and geometric reconstruction tasks efficiently [2303.01978].

Source: https://www.emergentmind.com/topics/one-class-signed-distance-function-ocsdf