TrainGuard: Training Anomaly Detection and Mitigation

TrainGuard is a PyTorch research framework for detecting and mitigating anomalous or harmful training samples in deep neural networks using signals derived from the model's own training dynamics.

Instead of treating an anomaly only as a property of the input sample, TrainGuard examines how samples affect the optimization process. It monitors layer-wise gradient-derived signals, models normal training behaviour with autoencoders, detects deviations through reconstruction error, and can filter suspicious samples online while training continues.

The framework is intended for research on robust learning, training-time anomaly detection, data poisoning defence, and adaptive learning pipelines.

RoboSAPIENS and INTO-CPS

TrainGuard was developed within the RoboSAPIENS Horizon Europe project and contributes to the WP2 result:

RoboSAPIENS Single-pass Uncertainty Estimation Library

Within this context, TrainGuard provides a training-time robustness component for identifying samples that produce abnormal learning dynamics, including corrupted, noisy, poisoned, or otherwise harmful samples.

The software is prepared for open-source dissemination as part of the wider RoboSAPIENS / INTO-CPS software ecosystem.

• RoboSAPIENS project: https://robosapiens-eu.tech/
• INTO-CPS software catalogue: https://into-cps.org/software

What problem does TrainGuard address?

Training data can contain samples that degrade learning because of annotation errors, corruption, distributional irregularities, or deliberate poisoning. A static inspection of the input may not reveal whether a particular sample is harmful to the current model.

TrainGuard instead asks:

Does this sample produce training dynamics that are inconsistent with the behaviour learned from normal samples?

This makes the detector dependent on the interaction between the data and the model during optimization.

Typical use cases include:

• studying robustness to label noise and label flipping;
• detecting samples affected by input corruption;
• evaluating defences against backdoor or poisoning attacks;
• filtering anomalous samples during training;
• comparing training with and without adaptive anomaly mitigation;
• analysing gradient-space behaviour across models, datasets, and anomaly settings.

TrainGuard is a research framework rather than a certified production-security mechanism. Detection performance depends on the model, dataset, anomaly type, training configuration, and anomaly-detection threshold.

How it works

The main workflow is:

1. Train the target neural network and monitor selected layers.
2. Extract layer-wise gradient-derived training signals.
3. Train autoencoders to model the behaviour considered normal for those signals.
4. Measure reconstruction error for samples observed during training.
5. Apply adaptive percentile-based thresholds to identify anomalous samples.
6. Remove or exclude detected samples from subsequent training.
7. Continue optimization using the updated clean subset.

This produces a closed-loop detect-filter-train process in which anomaly detection adapts together with the target model.

Main features

• Gradient-space anomaly detection based on training dynamics.
• Autoencoder-based modelling of normal behaviour.
• Online and offline anomaly-detection modes.
• Online filtering of detected harmful samples.
• Adaptive percentile-based detection thresholds.
• Configurable monitoring of selected network layers.
• Support for several corruption and poisoning scenarios.
• Support for multiple vision datasets and model architectures.
• PyTorch Distributed Data Parallel (DDP) support.
• TensorBoard, CSV, checkpoint, and detection-statistics outputs.
• Reproducible experiment scripts and YAML configuration.

Supported experimental settings

The main training script currently exposes support for the following datasets:

• CIFAR-10
• CIFAR-100
• SVHN
• Tiny ImageNet
• ImageNet-100

Available model families include MobileNet and several ResNet-family architectures, including ResNet-18/34/50/101, Wide ResNet-50, and ResNeXt-50.

The repository includes experimental support for anomaly settings such as:

• label noise and label flipping;
• occlusion-based corruption;
• backdoor poisoning;
• synthetic/noisy samples;
• mixed anomaly settings;
• PGD-based adversarial poisoning experiments.

Exact behaviour is controlled through the command-line arguments and configs/config.yaml.

Repository structure

.
|-- configs/
|   `-- config.yaml               # Default experiment configuration
|-- data/
|   `-- data_extraction.py        # Gradient-delta data loading utilities
|-- experiments/
|   |-- experiment.sh             # Example experiment sweep
|   `-- monitor.py
|-- models/                       # Model definitions
|-- preprocessing/                # Dataset/anomaly preprocessing
|-- scripts/
|   |-- proposed_training.py      # Main TrainGuard training pipeline
|   |-- train_ae.py               # Autoencoder training
|   |-- cold_start.py             # Cold-start AD bootstrap
|   |-- aes_val.py
|   `-- evaluate.py
|-- utils/                        # Training, logging, and AD utilities
|-- requirements.txt
|-- RELEASE_NOTES_v0.1.0.md
|-- LICENSE
`-- README.md

Experiment outputs are written under the configured logging directory, which is logs/ in the standard project setup.

Installation

Clone the repository:

git clone https://github.com/BillMousta/TrainGuard.git
cd TrainGuard

Create and activate a virtual environment:

python -m venv .venv
source .venv/bin/activate

Install the dependencies:

pip install -r requirements.txt

A CUDA-capable GPU is recommended for the larger experiments. The PyTorch installation must be compatible with the CUDA version available on the system.

Quick start

The main entry point is:

scripts/proposed_training.py

A representative CIFAR-100 / ResNet-34 run with online anomaly detection is:

CUDA_VISIBLE_DEVICES=0 python scripts/proposed_training.py \
  --gpu_id 0 \
  --type_of_model resnet34 \
  --dataset_name CIFAR100 \
  --seed 5 \
  --num_samples -1 \
  --num_anomalies 0.4 \
  --ad_method online \
  --use_pretrained false \
  --batch_size 256 \
  --aggregation_layers last_feat \
  --type_anomalies mentornet_label_noise \
  --use_ad true \
  --percentile 85 \
  --anomaly_detection_check 10 \
  --epochs 300 \
  --noise_rate 0.4

The repository also contains an experiment sweep matching this style of configuration:

bash experiments/experiment.sh

Configuration

The default configuration is stored in:

configs/config.yaml

Command-line arguments override the corresponding YAML values.

Important options include:

Parameter	Purpose
--dataset_name	Dataset used for training.
--type_of_model	Target neural-network architecture.
--use_ad	Enables or disables anomaly detection.
--ad_method	Selects the anomaly-detection mode, e.g. online.
--aggregation_layers	Selects the monitored layer or layers.
--layers_ae	Selects layers used by the autoencoder pipeline.
--type_anomalies	Selects the anomaly/corruption setting.
--num_anomalies	Controls the amount of anomalous data.
--noise_rate	Controls the configured noise ratio where applicable.
--percentile	Sets the percentile-based anomaly threshold.
--anomaly_detection_check	Controls how often anomaly detection is executed.
--epochs_ae	Sets the number of autoencoder training epochs.
--ad_bootstrap	Selects the anomaly-detection bootstrap strategy.
--seed	Sets the experimental random seed.
--epochs	Sets the target-model training duration.

Run the training script with --help to inspect the complete set of available command-line options.

Outputs

Depending on the experiment configuration, TrainGuard can produce:

• target-model checkpoints;
• autoencoder checkpoints;
• TensorBoard logs;
• CSV training and evaluation metrics;
• precision, recall, F1, and false-positive statistics for anomaly detection;
• stored gradient-delta information;
• filtered-sample information.

Outputs are grouped by experiment configuration so that runs can be compared reproducibly.

Associated publication

TrainGuard implements the training-aware anomaly-detection and mitigation methodology described in:

Vasilios Moustakidis, Nikolaos Passalis, and Anastasios Tefas.
"Detecting and mitigating training anomalies in deep neural networks."
Neurocomputing, 702, 134666, 2026.
https://doi.org/10.1016/j.neucom.2026.134666

If you use TrainGuard in academic work, please cite:

@article{moustakidis2026detecting,
  title   = {Detecting and mitigating training anomalies in deep neural networks},
  author  = {Moustakidis, Vasilios and Passalis, Nikolaos and Tefas, Anastasios},
  journal = {Neurocomputing},
  volume  = {702},
  pages   = {134666},
  year    = {2026},
  doi     = {10.1016/j.neucom.2026.134666}
}

License

TrainGuard is released under the Apache License 2.0. See LICENSE for the full license text.

Acknowledgment

This work was funded by the European Union's Horizon Europe research and innovation programme under grant agreement No. 101133807 (RoboSAPIENS).

This publication reflects only the authors' views. The European Commission is not responsible for any use that may be made of the information it contains.