An Evidence-Based Post-Hoc Adjustment Framework for Anomaly Detection Under Data Contamination
Authors: Sukanya Patra
Souhaib Ben Taieb
Venue: NeurIPS 2025 spotlight ()
Keywords: anomaly detection
anomaly
contamination
test-time adaptation
Primary area: general_machine_learning

Abstract: Unsupervised anomaly detection (AD) methods typically assume clean training data, yet real-world datasets often contain undetected or mislabeled anomalies, leading to significant performance degradation. Existing solutions require access to the training pipelines, data or prior knowledge of the proportions of anomalies in the data, limiting their real-world applicability. To address this challenge, we propose EPHAD, a simple yet effective test-time adaptation framework that updates the outputs of AD models trained on contaminated datasets using evidence gathered at test time. Our approach integrates the prior knowledge captured by the AD model trained on contaminated datasets with evidence derived from multimodal foundation models like Contrastive Language-Image Pre-training (CLIP), classical AD methods like the Local Outlier Factor or domain-specific knowledge. We illustrate the intuition behind EPHAD using a synthetic toy example and validate its effectiveness through comprehensive experiments across eight visual AD datasets, twenty-six tabular AD datasets, and a real-world industrial AD dataset. Additionally, we conduct an ablation study to analyse hyperparameter influence and robustness to varying contamination levels, demonstrating the versatility and robustness of EPHAD across diverse AD models and evidence pairs. To ensure reproducibility, our code is publicly available at https://github.com/sukanyapatra1997/EPHAD.

An Evidence-Based Post-Hoc Adjustment Framework for Anomaly Detection Under Data Contamination
Sukanya Patra
Souhaíb Ben Taieb"
Department of Computer Science
Department of Statistics and Data Science
University of Mons
Mohamed bin Zayed University of Artificial Intelligence
Mons, Belgium Makkanya.patr@uuonott be
Abu Dhabi, United Arab Emirates souhaib. ventaieb@mbzuai ac.
Abstract
Unsupervised anomaly detection (AD) methods typically assume clean training data, yet real-world datasets often contain undetected mislabeled anomalies, leading to significant performance degradation. Existing solutions require access the training pipelines, data or prior knowledge of the proportions of anomalies in the data, limiting their real-world applicability. To address this challenge, we propose EPHAD, simple yet effective test-time adaptation framework that updates the outputs of AD models trained on contaminated datasets using evidence gath- ered at time. Our approach integrates the prior knowledge captured by the AD model trained on contaminated datasets with evidence derived from multi- Pre-training (CLIP),
modal foundation models like Contrastive Language-Imen classical AD methods like the Local Outlier Factor or domain-specing specific knowledge. We illustrate the intuition behind EPHAD using synthetic toy example and vali- date its effectiveness through comprehensive experiments across eight visual AD datasets, twenty-six tabular AD datasets, and real-world industrial AD dataset. Additionally, we conduct an ablation study to analyse hyperparameter influence and robustness to varying contamination levels, demonstrating the versatility and robustness of EPHAD across diverse AD models and evidence pairs. To ensure reproducibility, our code publicly available".
Introduction
Anomaly detection (AD) is the basis of many critical applications, including cybersecurity (Xiao et al.. 2024; Li et al., 2023a), healthcare (Bijlani et al., 2024; Huang et al.. 2024), and industrial maintenance (Schwarz et al., 2025; Patra al., 2024). By enabling the identification of abnormalities. potential threats, or critical system failures, AD contributes to the robustness and safety of real-world systems. Despite its significance, AD remains a challenging task due to the inherent difficulty in characterising anomalous behaviours and the lack of prior knowledge about anomalous samples (Ruff et al., 2021). Consequently, AD is commonly approached as an unsupervised representation learning problem without access to labelled anomalies (Batzner et al., 2024; You et al., 2022).
standard approach in unsupervised AD involves training model learn a "compact" representation of the normal samples from training dataset under the assumption that the training data is "clean", ie. contains only normal samples (Ruff al., 2021). Then, anomalies are identified as deviations from this learned normality. One-class (OC) classification methods (Ruff et al.. 2018: Tax and Duin, 2004) learn decision boundary that encompasses all the normal samples. In contrast, density-basee based methods (Gudovskiy et al., 2022; Yu et al., 2021) learn the probability distribution of normal samples.
Affiliated with the Department of Computer Seience, University of Mons. https:///ithub. htt.tttthooooooeeeeeeeeooeeeeete cww//oooann/aaeee sukanyapatraa1997/EPAAA
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Furthermore, memory bank-based approaches (Roth et al., 2022) store the features corresponding to normal samples in a memory bank. However, real-world datasets are often contaminated with undetected anomalies (Das et al., 2025; Hien et al., 2024; Qiu et al., 2022). For example, a dataset collected for industrial maintenance may already include unnoticed defects. This leads to biased Al) models that struggle to reliably distinguish between normal and anomalous instances.
We consider the more realistic setting where the training data may be contaminated with anomalies. Existing approaches to handle contamination in the unsupervised setting primarily follow two strategies. The first employs an auxiliary OC classifier to filter out suspected anomalies (Yoon et al., 2022; Jiang et al., 2022), while the second modifies the training pipeline to enhance robustness against contamination (Qiu et al., 2022; Eduardo et al., 2020). Although effective, these methods rely on prior knowledge of the proportion of anomalies in the training data, i.c. the contamination ratio, which is typically unknown. Also, such methods are often computationally expensive. In the semi-supervised setting, methods leverage additional labelled datasets containing normal and anomalous samples (Hien et al., 2024; Ruff et al., 2020). However, their effectiveness diminishes when the anomalous instances encountered during training do not replicate real-world anomalies (Perini et al., 2025).
In this work, we aim to mitigate the possible adverse effects of data contamination on the performance of unsupervised AD models (Bouman et al., 2024). Specifically, we address the challenging setting in which training pipelines, data, or prior knowledge of the proportions of anomalies cannot be accessed. This scenario reflects the growing trend of deploying proprietary AD models in real- world applications, where access to internal model components is often restricted. Even when tine-tuning permitted, it is not only computationally intensive but also unreliable due to the absence of guaranteed clean training data, as anomalies are inherently unknown a priori. This setup aligns with preparation- agnostic test-time adaptation (TTA) methods (Karmanov et al., 2024; Zhang et al., 2023; Xiao and Snoek, 2024). which remain largely unexplored in the context of AD. To address this gap. we introduce the Evidence-based Post-Hoc Adjustment Framework for Anomaly Detection (EPHAD), a simple yet effective method that adjusts the outputs of a pretrained AD model post-hoc, using evidence collected at test time.
Notably, we establish conceptual links between EPHAD and recent advances test-time alignment for generative models (Mudgal et al.. 2024; Li et al., 2024; Korbak et al., 2022), underscoring its broader significance. EPHAD is flexible and can incorporate various forms of evidence, including foundation models like Contrastive Language-Inan classical AD methods such as Local Outlier Factor (LOF) (Breunig et al., 2000), and domain-specific knowledge. Our core contributions are summarised below:
Pre-training (CLIP) (Zhou et al., 2024; Jeong et al., 2023),
We introduce EPHAD, simple yet effective TTA framework for unsupervised AD models trained on contaminated datasets. Unlike existing approaches, it requires no access to training pipelines, data or prior knowledge of the proportions of anomalies in the data, making it highly practical for real-world deployments.
EPHAD performs TTA by combining the prior knowledge captured by the AD model trained on the contaminated dataset and an evidence gathered at test-time. This principled formula- tion allows for conceptual connections to recent test-time alignment techniques in generative modelling.
We illustrate the intuition behind EPHAD using a carefully designed toy examplc. Further- more, extensive experiments across eight visual AD, twenty-six tabular AD datasets, and a real-world industrial AD dataset demonstrate the effectiveness of EPHAD across diverse unsupervised AD models, evidence pairs.
2 Related work
Unsupervised AD. Over the years, numerous approaches have been developed for unsupervised AD, which can be broadly categorised into four main families: one-class classifiers (OCCs), feature umbedding-bassed densiry-based, and reconstruction- based methods. OCCs aim to learn a decision boundary that encapsulates all normal samples. Classical OCC approaches employ shallow models such as support vector-based methods that learn a maximum-marge hyperplane (Schölkopf et al., 2001) or hypersphere (Tax and Duin, 1999). To mitigate the limitations of manual feature engi- neering and extend to high-dimensional data, deep learning- variants like DeepSVDD (Ruff et al., 2018) have been introduced. Feature embedding based methods, on the other hand, leverage
2

---

pre-trained deep models to extract representations of input data. These representations are then either stored in a memory bank (Roth et al., 2022; Lee et al.. 2022) or used to train a student-teacher network (Zhang et al., 2024; Batzner et al., 2024; Patra and Ben Taieb, 2024). Density-based methods detect anomalies by estimating the probability distribution of normal samples, assuming that anomalies reside in low-density regions. While early methods include KDE (Kim and Scott, 2012), more recent deep-learning-basee variants include DAGMM (Zong et al., 2018), CFLOW (Gudovskiy et al., 2022), and FastFlow (Yu et al., 2021). Lastly, reconstruction-buuse into a lower-dimensional bottleneck and reconstruct them. The inability to accurately reconstruct samples during inference serves detection criterion. For a more comprehensive survey, we refer readers to Liu et al. (2024) and Ruff et al. (2021).
approaches learn to map normal samples
Data contamination. Handling dataset contamination in AD typically assumes a low proportion of anomalies, allowing methods to prioritise normal instances (inlier priority) (Wang et al., 2019). However, in practice, this assumption is difficult to ensure since anomalies are often unknown. To mitigate contamination, Yoon et al. (2022) proposed data refinement approach using an ensemble of one-class classifiers (OCCs) to filter suspected anomalies and create cleaner dataset. While effective, this method incurs high computational costs and discards anomalies rather than leveraging them for improved generalisation via Outlier Exposure (Hendrycks et al., 2019). To address this, Qiu et al. (2022) introduced Latent Outlier Exposure (LOE), which iteratively assigns anomaly scores and infers labels using block coordinate descent while incorporating the contamination ratio to prevent degenerate solutions. However, estimating the contamination ratio remains a challenge. Perini et al. (2022) tackled this by leveraging an auxiliary dataset with known contamination ratio, assuming domain similarity. Alternatively, Perini et al. (2023) fits a Dirichlet Process Gaussian Mixture Model to anomaly scores, though this approach lacks closed-form solution. Despite these advancements, existing methods introduce computational overhead and are often impractical for modern pre-trained proprietary models, limiting their real-world applicability.
3 Background
Let X E X and Y E y denote pair of random variables following a joint probability distribution Px, over the space x V, where C Rd and y == (-1,+1]. Here, Y =++1 +1 corresponds to the normal class, while Y = -1 represents the anomalous class. The conditional distribution of normal samples is Px denoted as P with PDF fx Likewise, the conditional distribution of anomalous samples is Px Y= denoted as Px. with PDF fx. The training dataset D := {
contains only normal samples (uncontaminated) i.e., I; X- We denote the test dataset as iid Diest: = {(2, "i which contains both normal and anomalous samples i.e, (24, ~ Px,Y.
Density-based anomaly detection. An anomaly can be defined as "an observation that deviates significantly from some concept of normality" (Ruff et al., 2021). This definition comprises two key aspects: the concept of normality and the significant deviation from it, which can be formalised using a probabilistic framework. The concept of normality is defined as the probubility distribution of normal samples }- To formalise this further. we adopt the concentration assumption (Steinwart et al., 2005), which posits that although the data space X' is unbounded, the high-density regions of X are bounded and concentrated. In contrast, Px is assumed to be non-concentrated (Schölkopf and Smola, 2002), and is often approximated by a uniform distribution over X' (Tax, 2001). Given the PDF ft associated with Pt. which we refer to as inlier density, a data point x E X is identified as an anomaly if it deviates substantially from this concept of normality, i.e., if it resides in low- oww-robabbility region under X However, since f is typically unknown in practice, density- based methods approximate it using density estimator.
Score-based anomaly detection. Density estimation poses significant challenges, particularly in high-dimensional spaces or when data is sparse, and often incurs substantial computational cost. Fortunately, in the context of anomaly detection, the goal is typically not to recover the exact data likelihood but rather to establish ranking of data points based on their degree of normality. This motivates an alternative strategy: learning an anomaly score scorefund function (1) : X - R, which directly assigns an anomaly score to a data point E X, thereby quantifying its degree of unomalousness (Ruff et al., 2021). To complement this, the inlier score function defined as s(n(x) Sout (x). capturing the degree of normality, where higher values indicate that is normal. For AD, first, we
3

---

train a model to learn the anomaly score function Sun (I) using Dit train Then, we define the anomaly detector as
+1, out (x) S As
94, (z)
(I)
-1, if Sun (z) > X
where A 2 0 is a pre-determined threshold (Perini et al., 2023, 2022). The density-based AD method also be interpreted as a specific case of the score-based AD methods where the anomaly score Sour (1) - (fx (x)) and 6(-) is an order-preserving transformation chosen to be the logarithm.
Data contamination. For training the AD method, a common assumption is that the training dataset Derain consists solely of i..d. samples from the normal data distribution P without anomalies. However, this assumption is rarely satisfied in practice, since anomalies are typically unknown priori. As a result, the training dataset is often contaminated with undetected anomalies. more realistic assumption is that the dataset Dirsin = { contains both normal and anomalous samples drawn from a mixture distribution PX with PDF f (Huber and Ronchetti, 2011; Huber, 1992). Letting = P(Y -1) denote the contamination factor, P can be written
(2)
As é increases, the model trained on D its ability to separate normal from anomalous samples (Qiu et al., 2022; Yoon et al., 2022). The existing literature examining the impact of contamination on unsupervised AD methods (Jiang et al., 2022; Qiu et al., 2022; Hien et al., 2024; Perini et al.. 2023, 2022) typically considers contamination levels ranging from 0% to 20%. Additionally, an analysis of 57 datasets spanning Natural Language Processing and Computer Vision in ADBench (Han et al., 2022) [Appendix B.2, Figure B B1] revealed that nearly 70% of the datasets exhibit anomaly ratios below 10%, with a median of 5%.
train becomes biased towards the anomalous regions, reducing
EPHAD: An evidence-based post-hoc adjustment framework
We consider the realistic scenario in which an AD model has already been trained possibly contaminated dataset D Dirain Instead of retraining the model, our goal is to adapt its test-time predictions mitigate the impact of contamination. To this end, introduce novel cridence-basse Post-Hoc Adjustment Framework for Anomaly Detection (EPHAD), that corrects model predictions using evidence function at test-time. The evidence function T(x): X - R assigns higher values to samples deemed more likely to be normal and can incorporate domain-specific knowledge. Thus, EPHAD aligns with preparationagnnoti TTA methods (Xiao and Snoek, 2024).
For density- -bsee AD (refer to Section 3), anomalies are identified as samples lying in the low-density regions under the distribution of normal samples P However, due data contamination, the trained model estimates the PDF f of the contaminated distribution P defined in (2), rather than the inlier PDF f Given evidence function T(x), EPHAD computes a revised PDF f using exponential tilfing as:
[+))) = (x)x) cxp(T(x)/3)
where exp(T(x)/B) is the evidence scaled by temperature parameter 8 E R and Z Sx / (z) exp(T(x)/3) dr is the normalising constant. This formulation upweights normal samples according to the evidence while maintaining consistency with the model's 's original density.
Proposition 4.1 provides a condition under which the revised PDF f closer to the inlinear PDF of normal samples f than the contaminated PDF f in terms of Kullback-Leible (KL) divergence.
Proposition 4.1. Let f f and ft be PDFs over the same domain X. Then the KL divergence between f and x is strictly less than the divergence between ft and f itf
exp(T(x)/3) z
log
0.
The proof is provided in Appendix A.1. Consequently, when condition (4) holds, the revised density f (z) assigns higher relative likelihoods to true inliers, leading to improved separation

---

between normal and anomalous samples. Hence, we expect EPHAD to yield better anomaly detection performance than the unadjusted model f*)), provided that a suitable detection threshold used.
Moreover, can be shown that (3) is the optimal solution to the KI-rreullrried objective
JKI ( = E. [T(z)] KL (I
(5)
This objective balances two competing goals: aligning the adjusted PDF with the evidence (first term) and maintaining fidelity to the original PDF (second term). The temperature parameter B controls this trade-off, recovering the evidence-driven solution 3 - and reverting to the original model as 3 + oc. For the proof of (5), see Korbak et al. (2022). This interpretation also highlights close connection to well-established TTA approaches used in generative models (Korbak et al., 2022; Mudgal et al., 2024; Li et al., 2024), where the model is viewed as an RI policy fine-tuned with a reward function encoding evidence alignment criteria. In this view, EPHAD performs KL-regularised shift of the contaminated density fx toward regions favored by the evidence function T(r) while preserving consistency with fx through the KL term.
4.1 Extension to score-based anomaly detection
Since estimating explicit densities is often infeasible in high- nigh-dimensional spaces, most modern AD methods rely on scores rather than PDFs. Recall that the inlier score function is an order- rnder-preserving transformation of the inlier PDF, i.e., $ (a) @ff where 66.) is monotonic transformation such the logarithm. When trained on contaminated data Di the model learns contaminated inlier score s (z) ((f (1:) Although & is typically unknown and possibly non-invertible, the sample ranking induced by s (1) is identical to that induced by f (x)).
Following energy-basee model (EBM) formulations (LeCun et al., 2006), we can define the associated contaminated PDF
exp(s (T)
(6)
Z
where Z - fx exp(s (2)) is the normalising constant. Applying exponential tilting to (+r as in (3), we obtain:
exp(s (x)) exx())())(((())))
[x(x) =
x
2 xx
Under Proposition 4.1, when condition (4) holds, the revised / closer the true inlier density
f in KL divergence than the unadjusted ft.. Because AD depends only on the relative ordering of samples, the normalization constants in (7) can be ignored. The exponential mapping is strictly monotonic, so ranking and decision regions are preserved. Consequently, we can write
(x) x exp(s + T(x)/B) 3
(8)
where we define x= as the revised inlier score. The anomaly detector in (1) can thus redefined as
+1, if (x) As
gb. (x)
otherwise.
This extension allows EPHAD operate directly score-based AD models, enabling post-hoc correction of models trained on contaminated datasets without requiring retraining or access to the original training procedure. In all subsequent experiments, we adopt this score-based formulation of EPHAD, reflecting the dominance score-based methods modern anomaly detection practice.
4.2 An illustrative example
To illustrate the effect of EPHAD, use toy dataset inspired by Qju et al. (2022). The dataset generated using two-dimensional mixture model comprising three Gaussian components: a NN,, := (u2,, Ez), cs = Niss Ex). Here, each component follows Gaus- sian distribution Mu, ( E) with mean μ and covariance Σ. Normal samples drawn from ft Ct.
5

---

Anemaly
Ground truth
Befine
ERHAD (Dun)
00
04
00
Figure 1: VeD trained 2D synthetic contaminated training data with different configurations: (I) Supervised AD with ground truth labels for reference, (ii)"Blind considering all samples as normal, (iii) "Refine" filtering a fraction of the anomalies, and (iv) EPHAD updating the "Blind" anomaly detector using evidence computed on the samples available at test-time.
with μ1 = 17 and Σ 0.07 Ig. Anomalous samples drawn from mixture distribution
fx = 0.5c² + 0.5cg where (2g 0.2, 2.5]" 44 [-1, 0.5) and Σg Σg 0.03 Ig. The extended implementation details is provided in Appendix B.2. Using this setting. we create a contam- inated dataset consisting 100 data points. We compare the bascline DeepSVDD (Ruff et al., 2018) across three configurations as illustrated in Figure I: (i) "Blind", (ii) "Refine", and (iii) with EPHAD. We refer the baseline model that treats all samples as normal "Blind", while "Refine" denotes a model that iteratively filters out suspected anomalies during training. As an evidence function in EPHAD, LOF (Breunig al., 2000) is computed test samples at test time. The results in Figure I demonstrate that the "Blind" configuration mistakenly considers all anomalies as normal. The "Refine" configuration improves performance filtering out subset of anomalies. Finally, EPHAD establishes a clearer boundary around normal samples.
4.3 Determining the temperature parameter |
As previously discussed, EPHAD has only a single hyperparameter, 3, which controls the trade-off be- tween reliance on the original AD model and the evidence function T(x). A straightforward approach to selecting / would involve evaluating the AD performance of the prior and (2x) individually
validation set and choosing 3 accordingly. However, this strategy introduces additional computational overhead at test time and requires access to labelled validation set of sufficient size to ensure reliable performance estimation - conditions often impractical in real-world deployments. To address this limitation, we propose an adaptive extension of our approach, termed EPHAD- -daa, that determines the optimal / in an unsupervised manner using only test data at test time. This adaptation is inspired by the principle of Entropy Minimisation (EM) (Press al., 2024), a widely-used technique in test-time adaptation (Xiao and Snoek, 2024). Motivated by the observation from Wang et al. (2021) that models tend to be more accurate when predictions are made with high confidence, we apply to compute the hyperparameter B. Specifically, the computation of 3 depends on the entropy of the inlier probabilities derived from the scores of both the original model and the evidence function.
Computing inlier probability from the output scores. For an output score s E R. the class label given the score be modelled as conditional random variable Y S 8. Following this, the inlier probability can be expressed as
(s)+ P(Y +1|5 P
Ps:
(10)
where p. := P(S < s). Since p. is unknown in practice, we follow the approach of Perini et al. (2021) and treat it as a random variable P. with prior distribution Beta(1, 1, 1), corresponding uniform prior over (0, 1]. Given that the label Y [+1,-1] we model the conditional distribution Y = 8 Bernoulli random variable. To estimate ps, we draw samples s' S by first sampling ~ X' and then computing the corresponding anomaly score s'. We record a success (b 1) if s' < s, and failure (b 0) otherwise. Repeating this procedure n times yields successes and t failures. Then, according to Theorem 2 in Perini et al. (2021), the posterior distribution of P. given the observed binary outcomes ........ bn is Beta(1 + t, + n t). We estimate p, using the posterior mean of P, as
1+1
Ps
E.P.]
(11)
2

---

In practice, the posterior is inferred from test samples, so the sample size n is constrained by the number of available test points. Finally, combining Equations (10) and (11), we obtain the estimated inlier probability for data point with anomaly score as
+
ps)+
p. ++
(12)
Finally, using (12), we compute the inlier probabilities 1 (2) == 2 (z)) and py=+1(1) (x) (T=+) from the scores of the original model and the evidence function, respectively.
Computing the value of the hyperparameter 3. We define the empirical entropy of the binary predictive PMF py (x) as
Hpr)) - Σ
[pv=+1(x) p + pY=-1(x)
log logpy=-(<x)]
(13)
xEDios
The adaptive temperature parameter is then defined as
H ( (p
Bada
(14)
where d >> O is a small constant introduced to ensure numerical stability. A low H (pb) indicates that the original AD model produces confident (low-entropy) predictions, suggesting that a higher value of [3 should be used to place greater trust in this model. Conversely, a lower H (py-) implies higher confidence in the evidence function, motivating smaller Through this formulation, EPHAD-AGE enables unsupervised, test-time determination of B, thereby improving practicality and eliminating the need for labelled validation data.
5 Experiments
We evaluate the effectiveness of EPHAD for unsupervised AD across a range of datasets, including visual AD datasets (Section 5.1), tabular AD datasets (Section 5.2), and an industrial AD use case (Appendix C.2). To systematically investigate the impact of contamination at different levels in rigorous and reproducible way, we introduce controlled contamination into the data, adhering to the experimental design employed in several prior studies (Jiang et al., 2022; Wang et al., 2025; Zhou and Wu, 2024). The evidence functions employed in the experiments are computed in an unsupervised manner without utilising ground-truth labels in the test set Drest, mitigating the risk of overfitting. Unless stated otherwise, we use a contamination factor e = 0.1 and a parameter 3 = 0.5. An ablation study on different values of and 3 is presented in Section 5.3. For image and tabular datasets, we evaluate performance using the AUROC. Following prior work (Roth et al., 2022; Gudovskiy al., 2022), AUROC is averaged across all categories for each dataset.
5.1 Experiments on visual AD datasets
Benchmark datasets. We assess the effectiveness of EPHAD in both sensory and semantic anomaly detection. Sensory AD focuses on detecting physical defects or imperfections, such as broken capsule or a cut in a carpet, while semantic AD identifies anomalies belonging to a different semantic class-for instance, treating cats as normal and any other animal anomalous. For sensory AD in industrial contexts, we evaluate performance using four well-established benchmark datasets: MVTecAD (Bergmann et al., 2019), MPDD (Jezek et al., 2021), ViSA (Zou et al., 2022), and RealIAD (Wang et al., 2024). For semantic AD, we utilise four commonly used datasets, including CIFAR-10, MaSSion-MNISTT MNIST, and SVHN. Following the one-vs-rest protocol (Qiu et al., 2022), construct & AD tasks per dataset, where & corresponds to the number of classes. For MVTecAD, ViSA, MPDD and RealIAD, we adopt the "overlap" setting, introducing e% contamination into the training set by randomly selecting anomalous samples from the test set while retaining them in the test set Jiang et al. (2022). For the remaining datasets, we follow the ove-lllelapppigg setting, excluding anomalous samples used for contamination simulation from the test set. Our implementation is based on the public codebase from Jiang al. (2022). Additional details provided in Appendix B.I.
Baseline AD methods. We evaluate the performance of several state-of-the-arr unsupervised anomaly detection methods, including PatchCore (Roth et al., 2022), PaDim (Defard et al., 2021), CFLOW
7

---

Table I: Performance on both sensory and semantic AD benchmarking datasets with 10% contamina- tion ratio. Style: AUROC % (# SE). Best in bold.
Method
Non-overlap CIFAR1O
Overlap
MNIST
FMNIST
SVHN
ReallAD
MVTec
MPDD
VISA
CLIP
71.15
95.63
98.63
58.46
65.74
86.34
60,02
74,47
CFLOW
77.24 1.01)
72.87 (# 0.8)
65.47 (= 002)
55.09
009)
76.42 (#: 0.47)
87.58 c# 0.77)
66.69
(: 2,00)
75.71 (# 1.28)
EPEAD
78.40 0.51)
0.19)
(1: 0.01)
55.82 (#: 0.06
71.58 (:: 0.17)
87.98 (4 0.12)
65.22 (4 0.90)
78.53 0.27)
EPHAD-Ada
78.08 (+: 0991
91.63 (+ 0.29
(# 0.0
55.78 024)
73.86 (+: 0.20
89.84
0.3)
67.81 (+) 1,33
79.64 (+ 0.63)
DR/EM
71.44 0:28)
76.53 (1: 0.18)
63.41 (1: 0.26)
51.55 0.07)
67 (1: 0.21)
70.55 c2 1.97)
62.32 (1: 1.90)
69.61 (1: 1.57)
EPHAD
73.51 (#: 0.39)
92.46 (# 0.25)
(# 0.02)
54.18 c= 0.07)
69.8 (+t 0.23)
87.13 c- 0.39)
67.02 (+ 0.29)
76.89 (+: 0.99)
EPHAD-Ada
72.88 (#: 0.33)
84,96 (#: 0.97)
87.73 (# 1.52) 53.79 (= 0.36)
70.15 (+ 0.05)
87.24 (- 0.39)
69.55 (:: B42)
74.95 1.15)
FastFlow
82.65 (.L 0.43)
83.66 (1 0.05)
62.94 (1: 0.37) 54.02 (1 0.11)
82.03 (:) 0.08)
84.24 1.00)
71.94 (1 0.57)
77.83 (1 0.22)
EPHAD
(::: 0.43)
93.49 (1: 0:07)
97.34 (:: 0.02)
55.07 <= 0.07)
77.22 (:: 0.08)
87.68
(2 0.5)
66.84 (1: 0.34)
80.29(11 0.07)
EPHAD-Ada
82.83 (cL: 0.44)
12.10
0.14)
96.24 (1: 0.65)
65.26
81.1 (12 0.06)
88.07 c2: 0.8)
70.08 (1 044)
80.71 (1: 0.08)
PaDiM
87.50 (=: 0.23)
86.84 (+: 0.06)
62.53 (#: 0.4)
55.49 (=: 0.28)
80.39 (+t 0.35)
77.85 (st 0.43)
36.58 (+ 2.58)
73.07 (+: 0.27)
+ EPBAD
87:45 (LL 0.22)
94.66 (1L 0.03)
97.10 (1 0.03)
$6.94 0.22)
75.94 (1) 0.25)
86.58 (1) 0.38)
$5.48 (1 0.72)
77.73 (1 0.27)
EPHAD-Ads
87.56 (-L 0.23)
92.87 (4 0.02)
90.23 (1: 0.67)
57.09 (LL 1.08)
79.56 (:) 0.28)
86.
(LL 0.52)
49.06 (1 1,52)
76.62 (1: 0.36)
PatchCore
86. (=: 0.09)
78.97 (# 0.06)
75.69 (# 0.09)
69.64 (= 0.04)
70.08 (:t: 0.07)
70:51 (2) 0.71
53.58 (: 0.54)
21.2 (22 0.31)
+ EPHAD
86.36 (+: 0.3)
99..33 1+: 0.01)
97.74 (#: 0.01) 61.31 (+h 0.00
69.76 (++ 0.2)
86.45 (+ 0.34)
60.58 (+) 1.12)
62.94 (+ 0.41)
EEPHAD-Ads
86.38 (+: 0.31
89.99 (+: 0.2)
96.63 (# 0.99)
68.4 (+: 0.52)
77.18 (-t 0.09)
83.53 (+t 0.18)
56.97 (+ 1,25)
48.60 (+: 0.51)
RD
77.33 (.1 0.09)
84.11 (1 0,72)
66.29 (1 0.31)
55.54 (.1 0.58)
89.13 (.1 0.18)
80.08 (1) 1.32)
75.08 (.) 1,75)
86.33 0.46
+ EPHAD
78. 19 (=: 0.28)
95.77 (# 0.03)
98.40 (# 0.0)
57.38 (= 0.14)
69.35 (:t 0.36)
65.82 0.31)
62.62 (#t 0.27)
71.76 0.119
EPHAD-Ada
78.91 (#: 0.21)
95.64 (# 0.04)
98.0 (+: 0.17)
$7.78 (2 0.5)
72.78 (:: 0.43)
86.69 (2: 0.38)
63.97 (d: 0.88)
79.42 (.334)
ULSAD
90.83 (+ 0.00)
88.64 (+ 0.13)
72.45 (# 0.18)
64.27 (=t 0.22)
89.06 (+ 0,013
91.93 (+ 0.15)
77.67 (+ 0.42)
86.58 (+ 0.13)
+ EPHAD
90.41 (:1 0.06)
95.03 (1 0.07)
97,90 (1: 0.02)
58. 17 (22 0.18)
80.58 (1L 0.06
91.31 (2: 0.06)
72.79 (:): 1,05)
85.82 0.10
Edd
90.8 (.L 0.07)
94,55 (1 0.08) 97.29 (1 0.02)
59.68 (.1 0.16)
85.84 (.L 0.04)
92.25 (.) 0,07)
76.31 (.L 1.00)
87.23 (1 0.05)
(Gudovskiy et al., 2022), FastFLOW (Yu et al., 2021), DRAEM (Zavrtanik et al., 2021), Reverse Distillation (RD) (Deng and Li, 2022), and ULSAD (Patra and Ben Taieb, 2024). both with and without the integration of EPHAD. Implementations for all methods, except ULSAD, are based on the Anomalib library (Akcay et al., 2022), while ULSAD is implemented using its official public code. Since, to the best of our knowledge, no existing AD method with contaminated data offers post-hoc adaptation in the same manner as EPHAD, our primary objective is to demonstrate the effectiveness of EPHAD by comparing its relative performance against the AD model and the evidence function alone. We also provide comparative analyses with three existing frameworks "Refine" (Yoon et al., 2022), Latent Outlier Exposure (LOE) (Qiu et al., 2022), and SoftPatch (Jiang et al., 2022) in Appendix C.3.
Evidence function. For the experiments, we employ Contrastive Language- Pre-training (CLIP) (Radford al., 2021) as the evidence function for image-based datasets, following the anomaly detection approach as in WinCLIP (Jeong et al., 2023). We use CLIP as the evidence function T(x) in EPHAD. We start by defining two lists of textual prompt templates. TN = [n1,-. nn } and TA {aI,.... J. corresponding to normal and anomalous classes, respectively. These templates are -eeendedd,,,,, reflecting subjectivity (e.g.. "missing wire" as anomalous for cables). For each label, compute the mean of text embeddings ły and tA. Finally, given an input image the evidence T(x) at test-time is computed as:
exp (xp((ee())))
T(x) exp ((e((t))tw)/)) + exp ((e(())
Additional implementation details are provided in Appendix B.3.1.
While CLIP has been previously applied as a standalone zero-shot anomaly detector, our methodology leverages it differently: we employ CLIP not as a complete detection system, but as an auxiliary source of evidence integrated into a more general and flexible framework. Importantly, EPHAD is not limited to foundation models such as CLIP; it can seamlessly incorporate domain-specific knowledge as well (see Section C.2), thereby broadening its applicability across diverse domains.
Results. In our experiments, as we adopt CLIP in the same manner as WinCLIP (Jeong et al., 2023), the baseline CLIP results reported here directly correspond to the standalone performance of WinCLIP. In Table 1, we observe that while zero-shot shot AD using CLIP performs well on real-worke image datasets such as CIFAR10 10 and FMNIST, its effectiveness declines on domain -spacffc datasets like MVTee, MPDD, and ViSA, where existing AD methods, such as ULSAD, achieve superior performance. However, when these AD methods are used within the EPHAD framework with CLIP as an evidence function in a post-hoe manner, their performance improves in most cases. Notably, even when CLiP-based AD alone does not achieve the best results, as seen in SVHN incorporating
8

---

Table 2: Performance on tabular AD benchmarking datasets with 10% contamination ratio. Style: AUROC % (= SE). Best in bold. i represents transductive inference.
Dataset
aloi
cover
glass
ionosphere
letter
pendigits
vowels
wine
LOF
72.64 (# 0.1)
52.12 (#: 0.1)
77.52 0.93)
82.43 0.16)
83.15 (# 0.73)
47.21 ( 0.12)
(9 0.67)
97.57 (2: 1.46)
COPOD
51.46 (1: 0.05)
78.7 (1: 0.00
76.11 (2 0.77)
79
1,00)
56.71
(2 0.12)
88.44.1 0.)
56.1 0.30)
80.51 (2: 1.36)
EPHAD
52.55 (1 0.06)
79.01 (1 0.02)
79,45 0.5)
8167
0.5)
57.62
0.99)
88.38 0.)
58.87
(L 036
86.78 (1 1.96)
EPHAD-Ada
Ada
53.65 (+h 0.17)
79.57
0.0
81.77 ( 1.28)
84.15
0.38)
71.03
0.9)
87.09
0.2)
75.39
( 0.8)
93.96 (# 1.00
DDD
54.06 (d: 0.54)
75.11
(4: 11.3%)
61.52
6.57)
83,09
0.7)
(031741250)
74.87
(1 991)
64.47
235)
82.26
(4: 2.29)
EPHAD
64,36 (::: 0.21)
75.74
(#: 11 (6)
80.94
(2 5.1)
84.9 07)
61.26
2.42)
72.68
(2 8.70
76.61
(# 1.24)
92.94 (2: 1.74)
EPBAD-Ada
70.67 (1L 0.23)
75.58
10,82)
80.94 (1
2.52)
85.03
0.5)
65.9
(2: 2.88)
74.08
9.16)
82.12 (1) 0.9)
93.96 (2: 1.77)
DCOD
53.14 (5.14((200000 0.03)
85.34
+ 0.02)
67.65
0.44)
73.04
024)
56.41 (= 0.29)
90.63
( 0.17)
$4.29
0306)
67.12
EPHAD
54.33
0.05)
85,45 (1 0.02)
(1
0.6)
74.34
0.55)
57.17 (1 0.29)
90.65 (1 0.17)
56.82
(L 0.14)
74.97 (L 288)
EPHAD-Ada
55.47 (+) 0.18)
85.45
0.00)
78.43
( 1.72)
78.14
0.4%)
70.15 ( 1.1)
89
66
(2: 0.2
75.39
0.1)
89.27 (# 2.95
Forest
54.05 0.21.
72.59 (+ 1.59)
78.5
147)
89.58
1.57)
59.84
0.64)
81.86
c+ 1.40)
66.01
0.57)
80.4 (+: 3.421
EPHAD
71.75
0.08)
63.64 (+ (.92)
(9.12
1.0))
83.5 (t:
81.53
0.59)
55.56
0.98)
88.59
0165)
97.51
1.51)
EPHAAD Add
57,49 (1.00.11...33 0.31)
73.15 (1 (,57)
83.15
1.36)
90,05
(L 1.22)
71.38
(1 0.86)
79.5
80.76 (L 0.6)
93.56
215)
LLOF
73.57 (#: 0.11
22.44 (2.44
71.79 1.00)
94.64
0.52)
88.74
0.54)
14.87
0.18)
93.04
0.54)
99.94
0.05
EPHAD
73.62 0.07)
44.2
0.00)
76.4 (t: 0.68)
89.74
0.55)
84.84
0.39)
37.64
c+: 0.13)
91.3 (4
99.94
0.05)
BPHADD Ada.
73.85 0.05)
36.78 (+) 0.23)
75.67 0.75)
91.85
(.68)
85.31
0.36)
30.16 1.01)
91.85 0.12)
99.94 0.05)
within EPHAD still leads to significant improvements. For instance, CFLOW, PaDiM, and RD exhibit enhanced performance after using EPHAD, surpassing both CLIP and the standalone AD methods. This highlights the effectiveness of EPHAD in refining anomaly scores for better AD performance. In some cases, such as ULSAD on SVHN, we observe a decline in performance when integrating EPHAD compared to the standalone AD method. This typically occurs when the AD method substantially outperforms the evidence function. such scenarios, overly relying on the evidence can diminish overall performance. To mitigate this effect, careful tuning of 3 enables the framework to adapt effectively to different datasets, AD methods, and evidence functions. A detailed analysis of the impact of varying 3 values is presented in Section 5.3.
Using the adaptive variant, EPHAD-Ada Ada, we observe further improvements in certain settings, such as with PatchCore and DREAM on the RealLAD dataset. Interestingly, in cases where the default value of 3 = 0.5 led to decreased performance (e.g.. ULSAD on SVHN or MPDD), EPHAD-AGa manages to overcome the problem, highlighting its effectiveness. Nevertheless, while EPHAD- Ada offers an unsupervised mechanism for determining 3, its performance often comparable to, or slightly below, that of EPHAD with the default value for B.
5.2 Experiments on tabular AD datasets
Benchmark datasets. We evaluate our proposed framework on 26 classical benchmark datasets from ADBench (Han al., 2022). The classical datasets include datasets from different domains such as healthcare (e.g., annthyroid, breastw), astronautics (c.g. satellite), and finance (fraud). Following Qiu al. (2022), we preprocess, split the dataset into the train and test sets and simulate contamination using synthetic anomalies created by adding zero-mean Gaussian noise with a large variance to the anomalous sample from the test set.
Baseline AD methods. We compare EPHAD against IFOREST (Liu et al., 2012), LOF (Breunig et al., 2000), DeepSVDD (Ruff et al., 2018), ECOD (Li et al., 2023b) and COPOD (Li et al., 2020) using ADBench (Han et al., 2022).
Evidence function. We use the output of Local Outlier Factor (L.OF) (Breunig et al., 2000) and Isolation Forest (IForest) (Liu et al., 2012). Additional details provided in the Appendix B.3.2.
Results. The experimental results for a subset of the 26 benchmarking datasets are presented in Table 2. with the extended version provided in Appendix C. We observe that most AD methods benefit from our post-hoe adjustment framework EPHAD, often achieving performance improvements that surpass both the evidence function and the AD method in isolation. For example, COPOD, when updated with LOF as the evidence function on cover, glass and pendigits datasets, shows this behaviour. Additionally, as seen in the image-based experiments, performance degradation in certain cases arises when the framework places excessive emphasis on an evidence function that is substantially weaker than the AD method. However, as previously discussed, this limitation can be mitigated by appropriately tuning B. Similar to the results in the image-based experiments, we

---

CRSW
ULSAD
Persccm
CRLWW
PICECCI FPNA
CRLOM FRHAD
USSOD 14400
Faceccre ETIA
CILOW AE
U.SAO E7140 ETADD
FaschCore EF9A2AA
CRUW
CP5R10
N0TT::
CIARID
Contors B
30
40 Trepeatio
(a) Ablation on
(b) Ablation on B.
Figure 2: Ablation on parameters.
observe improvements when using the adaptive variant EdaAD-Ada. In some scenarios, we also observe that EPHAD- Ada avoids the performance drop observed with EPHAD, such as with LOF on the ionosphere dataset and with DeepSVDD on the pendigits dataset. Nonetheless, the performance in most cases similar to EPHAD with default value B, suggesting the need for further exploration.
5.3 Ablation study
In this section, we first analyse the sensitivity of EPHAD to various contamination ratios. Then, we investigate the effect of the temperature 3 on AD performance.
Effect of varying contamination ratio. Here, we evaluate the sensitivity of our proposed framework by varying the contamination ratio (0%, 5%, 10%, 15%). The results are summarised in the Figure 2a. Applying EPHAD results in improvements across all contamination ratios for most of the AD methods. Furthermore, in the presence of strong evidence function, such as CLIP, we can observe that the performance becomes almost constant even as the contamination ratio increases from 5% to 15%. An extended version is provided in Figure
Effect of temperature parameter 3. We also analyse the performance of the EPHAD by varying the temperature parameter (8. In Figure 2b, we can how / allows for controlling the trade-off between the prior AD method and the evidence. As discussed earlier, we observe that setting 3 zv 0 results in full reliance T(x)), while with increasing B, T(x) is disregarded and it defaults the prior. Additionally, EPHAD- Ada achieves performance comparable to the best configuration of EPHAD across the explored range of 3, highlighting its effectiveness. An extended version is provided in Figure 4.
6 Conclusion
Limitations and future work. While existing AD methods can serve as domain aagnstic evidence functions within EPHAD, the full potential of our framework is best realised by designing evidence functions that incorporate domain-specific knowledge. Exploring the interplay between datasets, AD methods, and evidence functions remains an open direction for future work. Another limitation concerns the parameter 3, which has a significant influence on overall performance, as demonstrated in our experiments. Although we introduced unsupervised strategy for estimating 3 in EPHAD Ada, this approach does not always lead to performance improvements. We hypothesize that this may stem from uncalibrated inlier probability. Future work should thus investigate more reliable approaches for inferring & based on the anomaly scores and the underlying distributions of normal and anomalous samples in the test set. Finally, integrating explainability techniques into EPHAD represents interesting direction for future research, as it could provide deeper insights for real-world applications.
Concluding remarks. Unsupervised AD methods typically assume anomaly-free training data, yet real-world datasets often contain undetected or mislabeled anomalies, leading to significant performance degradation. Existing approaches to address contamination often require access to model parameters, training data, or the training pipeline, limiting their practicality in real-world deployments. In this work, we introduce EPHAD, simple, post-hoc adjustment framework that refines the outputs of any AD method trained on contaminated data by incorporating evidence collected at test-time. Extensive experiments demonstrate the effectiveness of EPHAD across diverse sources of evidence, multiple AD methods, and various datasets. Additionally, ablation studies analyse the impact of hyperparameters and varying contamination levels, highlighting the robustness of EPHAD.
10

---

Acknowledgments and Disclosure of Funding
This work is supported by the FLARACC research project (Federated Learning and Augmented Reality for Advanced Control Centers), funded by the Wallonia region in Belgium.
References
Akcay, S., Ameln, D., Vaidya, A., Lakshmanan, B., Ahuja, N., and Gene, U. (2022). Anomalib: A Deep Learning Library for Anomaly Detection. In 2022 IEEE International Conference on Image Processing (ICIP), pages 1706-1710. IEEE.
Batzner, K., Heckler, L., and König, R. (2024). Efficientad: Accurate visual anomaly detection at millisecond-level latencies. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision ( (WACV), pages 128-138.
Bergmann, P., Fauser, M., Sattlegger, D., and Steger, C. (2019). MVTEC ad-A comprehensive real-world dataset for unsupervised anomaly detection. Proceedings of the IEEE Computer Society Conference on Computer Vision and Patlern Recognition, pages 9584-9592.
Bijlani, N., Carneiro, G., Barnaghi, P., and Kouchaki, S. (2024). Explainable anomaly detection in sensor-based remote healthcare monitoring with adaptive temporal contrast. In ICLR 2024 Workshop on Learning from Time Series For Health.
Bouman, R., Bukhsh, Z., and Heskes, T. (2024). Unsupervised anomaly detection algorithms real-world data: how many do we need? Journal of Machine Learning Research, 25(105):1-34,
Breunig, M. M., Kriegel, H.-P., Ng. R. T., and Sander, J. (2000). Lof: identifying bensity-based local outliers. In Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, SIGMOD '00, page 93 104, New York, NY. USA. Association for Computing Machinery.
Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. (2020). A simple framework for contrastive learning of visual representations. In III, H. D. and Singh, A., editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 1597-1607. PMLR.
Das, A. S., Pang, G., and Bhuyan, M. (2025). Adaptive deviation learning for visual anomaly detection with data contamination. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), page 8863 8872. IEEE
Defard, T., Setkov, A., Loesch, A., and Audigier, R. (2021). Padim: patch distribution modeling framework for anomaly detection and localization. In Del Bimbo, A., Cucchiara, R., Sclaroff, S., Farinella, G. M., Mei. T., Bertini, M., Escalante, H. J., and Vezzani, R., editors, Pattern Recognition. ICPR International Workshops and Challenges, pages 475 475,489, Cham. Springer International Publishing.
Deng, H. and Li, X. (2022). Anomaly detection via reverse distillation from one-class embedding. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 9737-9746.
Eduardo, S., Nazábal, A., Williams, K. I., and Sutton, C. (2020). Robust variational autoencoders for outlier detection and repair of mixed-type data. In Chiappa, S. and Calandra, R., editors, Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, volume 108 of Proceedings of Machine Learning Research, pages 4056-4066. PMLR.
Gudovskiy, D., Ishizaka, S., and Kozuka, (2022). Cflow-ad: Real-time unsupervised anomaly detection with localization via conditional normalizing flows. In Proceedings of the IEEF/CVF Winter Conference on Applications of Computer Vixion (WACV), pages 98-107.
Han, S., Hu, X., Huang, H., Jiang, M., and Zhao, Y. (2022). Adbench: Anomaly detection benchmark. In Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., and Oh, A., editors, Advances in Neural Information Processing Systems, volume 35, pages 32142-32159, Curran Associates, Inc

---

Hendrycks, D., Mazeika, M., and Dietterich, T. (2019). Deep anomaly detection with outlier exposure. In International Conference on Learning Representations.
Hien, L. K., Patra, S., and Ben Taieb, S. (2024). Anomaly detection with semi-supervised classífication based on risk estimators. Trunsactions on Machine Learning Research.
Huang, C.,, Jiang, A., Feng. J., Zhang, Y., Wang, X., and Wang, Y. (2024). Adapting visual-language models for generalizable anomaly detection in medical images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 11375-11385.
Huber, J. (1992). Robust estimation of a location parameter. In Breakthroughs in statistics: Methodology and distribution, pages 492-518. Springer.
Huber, P. J. and Ronchetti, F. M. (2011). Robust statistics. John Wiley & Sonns.
Jeong, J., Zou, Y., Kim, T., Zhang, D., Ravichandran, A., and Dabeer, O. (2023). Winclip: Zero-/few- shot anomaly classification and segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 19606-19616.
Jezek, S., Jonak, M., Burget, R., Dvorak, P., and Skotak, M. (2021). Deep learning- defect detection of metal parts: evaluating current methods in complex conditions. In 2021 13th Inter- national Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT), pages 66-71.
Jiang, X., Liu, J., Wang, J., Nie, Q. WU, K., Liu, Y., Wang. C., and Zheng, F. (2022). Softpatch: Unsupervised anomaly detection with noisy data. In Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., and Oh, A., editors, Advances in Neural Information Processing Systems, volume 35, pages 15433-15445. Curran Associates, Inc.
Karmanov, A., Guan, D., Lu, S., El Saddik, A., and Xing, E. (2024). Efficient test-time adaptation of vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 14177.
Kim, J. and Scott, C. D. (2012). Robust kernel density estimation. Journal of Machine Learning Research, 13(82)2552-22555.
Korbak, T., Perez, E., and Buckley, C. (2022). RI. with KI, penalties is better viewed as Bayesian inference. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 1083-1091, Abu Dhabi, United Arab Emirates. Association for Computational Linguisties.
LeCun, Y., Chopra, S., Hadsell, R., Ranzato, M., Huang, F., et al. (2006). tutorial on energy-based learning. Predicting structured data, 1(0).
Lee, S., Lee, S., and Song, B. C. (2022). Cfa: Coupled-hypersphher--bssss feature adaptation for target-oriented anomaly localization. IEEE Access, 10:78446-78454,
Li, R., Li, Q., Zhang, Y., Zhao, D., Jiang, Y., and Yang, Y. (2023a). Interpreting unsupervised anomaly detection in security via rule extraction. In Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., and Levine, S., editors, Advances in Neural Information Processing Systems, volume 36, pages 62224 62243. Curran Associates, Inc.
Li, X., Zhao, Y., Wang, C., Scalia, G., Eraslan, G., Nair, S., Biancalani, T., Ji, S., Regev, A., Levine, S., and Uehara, M. (2024). Derivative-free guidance with soft value-basee decoding.
guidancce in continuous and discrete diffusion models
Li, Z., Zhao, Y., Botta, N., Ionescu, C., and Hu, X. (2020). COPOD: copula-based outlier detection. In IEEE International Conference Data Mining (ICDM), pages 1118-1123, IEEE.
Li, Z., Zhao, Y., Hu, X., Botta, N., Ionescu, C., and Chen. H. (2023b). Ecod: Unsupervised outlier detection using empirical cumulative distribution functions. IEEE Transactions on Knowledge and Data Engineering, 35(12):
Liu, F. T., Ting, K. M., and Zhou, Z.-H. (2012). Isolation-based anomaly detection. ACM Trans. Knowl. Discov. Data 6(1).
12

---

Liu, J., Xie, G., Wang. J., Li, S., Wang, C., Zheng, F., and Jin, Y. (2024). Deep industrial image anomaly detection: survey. Machine Intelligence Research, 21(1):104-135.
Mudgal, S., Lee, J., Ganapathy, H., Li, Y., Wang, T., Huang, Y., Chen, Z., Cheng, H.-T., Collins, M., Strohman, T., Chen, J.. Beutel, A., and Beirami, A. (2024). Controlled decoding from language models. In Salakhutdinov, R., Kolter, Z., Heller, K., Weller, A., Oliver, N., Scarlett, J., and Berkenkamp, F., editors, Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages (6486-36505 PMLR.
Patra, S. and Ben Taieb, S. (2024). Revisiting deep feature reconstruction for logical and structural industrial anomaly detection. Transactions on Machine Learning Research.
Patra, S., Sournac, N., and Taieb, S. B. (2024). Detecting abnormal operations in concentrated solar power plants from irregular sequences of thermal images. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD '24, page 5578-5589, New York, NY, USA. Association for Computing Machinery.
Perini, L., Bürkner, P.-.., and Klami, A. (2023). Estimating the contamination factor's ' distribution in unsupervised anomaly detection. In Krause, A., Brunskill, E.,, Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J., editors, Proceedings of the 40th International Conference Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 77668-27679, PMLR.
Perini, L., Rudolph, M., Schmedding, S., and Qiu, C. (2025). Uncertainty-aware evaluation of auxiliary anomalies with the expected anomaly posterior. Transactions on Machine Learning Research.
Perini, L.,, Vercruyssen, V., and Davis, J. (2021). Quantifying the confidence of anomaly detectors in their example-wise predictions. In Hutter, F., Kersting, K., Lijffijt, J., and Valera, I., editors, Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 227-243, Cham. Springer International Publishing.
Perini, L., Vercruyssen, V., and Davis, J. (2022). Transferring the Contamination Factor between Anomaly Detection Domains by Shape Similarity. Proceedings of the AAAI Conference Artificial Intelligence, 36(4):4128-4136
Press, O., Shwartz-Ziv, R., Lecun, Y., and Bethge, M. (2024). The entropy enigma: Success and failure of entropy minimization. In Salakhutdinov, R., Kolter, Z.,, Heller, K., Weller, A., Oliver, N., Scarlett, J., and Berkenkamp, F., editors, Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 41064-41085. PMLR.
Qiu, C., Li, A., Kloft, M., Rudolph, M., and Mandt, S. (2022). Latent outlier exposure for anomaly detection with contaminated data. In Chaudhuri, K., Jegelka, S., Song, L., Szepesvari, C., Niu, G., and Sabato, S., editors, Proceedings of the 39th International Conference on Muchine Learning, volume 162 of Proceedings of Machine Learning Research, pages 18153-18167 PMLR
Qiu, C., Pfrommer, T., Kloft, M., Mandt, S., and Rudolph, M. (2021). Neural transformation learning for deep anomaly detection beyond images. In Meila, M. and Zhang, T., editors, Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pages 8703 8714. PMLR
Radford, A., Kim, J. W., Hallacy C., Ramesh,
A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. (2021). Learning transferable visual models from natural language supervision. In Meila, M. and Zhang, T., editors, Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pages 8768-8763. PMLR.
Roth, K., Pemula, L., Zepeda, J., Schölkopf, B., Brox, T., and Gehler, P. (2022). Towards total recall in industrial anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 143288.
Ruff, L., Kauffmann, J. R., Vandermeulen, R. A., Montavon, G., Samek, W., Kloft, M., Dietterich, T. G., and Müller, K.-R. (2021). A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 10955)775-
13

---

Ruff, L., Vandermeulen, R., Goernitz, N., Deecke, L., Siddiqui, S. A., Binder, A., Müller. E., and Kloft. M. (2018). Deep one-class classification. In Dy, J. and Krause, A., editors, Proceedings of the 35th International Conference Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 44022, PMLR.
Ruff, L., Vandermeulen, R. A., Görnizz, N., Binder, A., Müller, E., Müller, K.-R., and Kloft, M. (2020). Deep supervise anomaly detection. In International Conference Learning Representations.
Schölkopf, B. and Smola, A. J. (2002). Learning with kernels: support vector machines, regulariza- fion, optimization, and beyond. MIT press.
Schwarz, A., Rahal, J. R., Sahelices, B., Barroso-Garcfa, V., Weis, R., and Duque Antón, S. (2025). Data augmentation in predictive maintenance applicable to hydrogen combustion engines: review. Artificial Intelligence Review, 58(1):1-24.
Schölkopf. B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., and Williamson, R. C. (2001). Estimating the support of a high-dimensional distribution. Neural Computation, 13(7): 1473-1414
Steinwart, I., Hush, D., and Scovel, C. (2005). A classification framework for anomaly detection. Journal of Machine Learning Research, 6(2).
Tax, M. (2001). One-class classification. PhD thesis, Technische Universiteit Delft.
Tax, D. M. and Duin, R. P. (1999). Support vector domain description. Pattern Recognition Letters, (0(11-13):191-11
Tax, D. M. and Duin, R. P. (2004). Support Vector Data Description. Machine Leariing, 54(1):45-66.
Wang, C., Jiang, X., Gao, B.-B., Gan, Z., Liu, Y., Zheng, F,, and Ma, L. (2025). Softpatch+: Fully unsupervised anomaly classification and segmentation. Pattern Recognition, 161:1 11295.
Wang, C., Zhu, W., Gao, B.-B., Gan, Z.., Zhang, J., Gu, Z., Qian, S., Chen, M., and Ma. L. (2024).
Real-iad: A woal-world multi-view dataset for benchmarking versatile industrial anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 22883-22892.
Wang, D., Shelhamer, E., Liu, S., Olshausen, B., and Darrell, T. (2021). Tent: Fully test-time adaptation by entropy minimization. In International Conference on Learning Representations.
Wang, S., Zeng, Y., Liu, X., Zhu, E., Yin, J., Xu, C., and Kloft, M. (2019). Effective end-to- end unsupervised outlier detection via inlier priority of discriminative network. In Wallach, H., Larochelle, H., Beygelzimer, A., d'Alché- -ucc F., Fox, E., and Garnett, R., editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc.
Xiao, J., Xu, Z., Zou, Q., Li, Q., Zhao, D., Fang. D., Li, R., Tang, W., Li, K., Zuo, X., Hu, P., Jiang, Y., Weng, Z., and Lyu, M. R. (2024). Make your home safe: Time-aware unsupervised user behavior anomaly detection in smart homes via goss-guided mask. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD '24, page 3551-3562, New York, NY, USA. Association for Computing Machinery.
Xiao, Z. and Snoek, C. G. (2024). Beyond model adaptation at test time: survey, arXiv preprint arXiv:2411.03687.
Yoon, J., Sohn, K., Li, C.-L., Arik, S. O., Lee, C.-Y,, and Pfister, T. (2022). Self-supervise, refine, repeat: Improving unsupervised anomaly detection. Transactions on Machine Learning Research.
You, Z., Cui. L., Shen, Y., Yang, K., Lu, X., Zheng, Y., and Le, X. (2022). A unified model for multi-class anomaly detection. Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho. K., and Oh, A., editors, Advances in Neural Information Processing Systems, volume 35, pages 4571 4584. Curran Associates, Inc.
Yu, J., Zheng, Y., Wang, X., Li, W., Wu, Y., Zhao, R., and Wu, I.. (2021). FastFlow: Unsupervised Anomaly Detection and Localization via 2D Normalizing Flows. arXiv preprint arXiv:211..0767.
14

---

Zavrtanik, V., Kristan, M., and Skočaj, D. (2021). Dræm discriminatively trained reconstruc- tion embedding for surface anomaly detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 8330-8339.
Zhang, J., Suganuma, M., and Okatani, T. (2024). Contextual affinity distillation for image anomaly detection. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 149-158.
Zhang, Y., Wang, X., Jin, K., Yuan, K., Zhang. Z., Wang, L.,, Jin, R., and Tan, T. (2023). AdaNPC: Exploring non-parametric classifier for test-time adaptation. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J., editors, Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 41647-41613 PMLR.
Zhou, J. and Wu, (2024). anomaly detection on contaminated training data. IEEE Transactions on Circuits and Systems for Video Technology, 34(10): (1100)10000 10023-10035.
based feature adaptation for robust unsupervised
Zhou, Q., Pang, G., Tian, Y., He, S., and Chen, (2024). AnomalyCLIP: Object-agnostic prompt learning for sero-shot anomaly detection. In The Twelfth International Conference on Learning Representations.
Zong, B., Song, Q. Min, M. R., Cheng, W., Lumezanu, C.,, Cho, D., and Chen, H. (2018). Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International Conference on Learning Representations.
Zou, Y., Jeong, J., Pemula, L., Zhang. D., and Dabeer, O. (2022). Spot-the-difference self-supervised pre-training for anomaly detection and segmentation. Avidan, S., Brostow, G., Cissé, M.. Farinella, G. M., and Hassner, T., editors, European Conference on Computer Vision, pages 392 408, Cham. Springer Nature Switzerland.
15

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The contributions are summarised in the introduction and also discussed in the abstract.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed limitations of this work in the Conclusion section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
16

---

Justification:
For each theoretical result, we provide all necessary details and the proof in the Appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification:
We have used all publicly available datasets, and our code can be found here.
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
17

---

Answer: [Yes]
Justification:
We have used all publicly available datasets, and our code can be found here.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /nips. wwtppcccpccccceecccccccccccccltt httpe//ggiieeeeeeeetttiieeeeee /Coo//eoomissssseeeee ssiiisssioiyyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: We have provided key experimental details in the main paper and extended information in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification:
We provide standard errors for the extended tables provided the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
18

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We have provided information on the computer resources in the Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics stttps//neuurs httpss//aarrpps..ppplctc////eee httpppll/tthicsuiiiieee./..ppp ines?
Answer: [Yes]
Justification:
We ensured that our work adheres to the code of ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
19

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We have used publicly available datasets, and for code, we have used open- source GitHub repositories after citing them in the paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
20

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our anonymized code is accessible from here. We have also shared the details for setting up the environment and running the code.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
21

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Answer: [No]
Justification: LLM is solely used for grammar check and formatting purposes.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to L.LM policy (https: http:///eeuupppeeeeee cc/ caarrripsscc/cooffeenneeee////// for what should or should not be described.
22

---

A Proofs
A.1 Proof of Proposition 4.1
Proof. From (2), we have
+
Additionally, from (3), we have
fx(2) (x) cxp(((x))3)
z
Then.
log (x)
DKL (f E22-pt
= [log fx) log (x)
log fx) log f (x) (xpp
P
z
T(x)
Pt
log fx) - log (x) (x)
+ log 2x
B
T(x)
= (KL( - E E
log 2
3
exp(T(x)/3)
= - - E Lowel
log
Zx
We aim to increase the alignment between f and fx. Since the KL divergence is non-negative, if the expectation term positive, we obtain
( S (f+
Therefore, the following condition should hold:
exp(T(x)/33
pt
log
x
2 0.
B
Additional implementation details
B.1
Benchmark datasets
For sensory AD in industrial settings, three widely recognised benchmark datasets. MVTecAD (Bergmann et al., 2019) comprises images from 15 categories (10 objects and 5 textures) with 3629 normal training images and 1258 anomalous and 467 normal test images, each containing pixel-level annotations of defects. MPDD (Jezek et al., 2021) targets metal part defects under varying conditions, offering 888 training images and test datasets consisting of 176 normal and 282 anomalous images across 6 metal part categories. ViSA (Zou et al., 2022) provides 10821 high-resolution images (9621 normal and 1200 anomalous) spanning 12 categories, capturing range of anomalies such as scratches, cracks, missing parts, and misplacements. Each defect type is represented by 15-20 images, and some images feature multiple defects. RealIAD (Wang et al., 2024) large-scale industrial AD dataset comprising ~ 150k images across 30 categories and having various types of defects such as scratches, dirt and missing parts. For experiments with RealIAD, we use the training split with 10% contamination and the test split provided by the authors. For the semantic datasets, using the one-vs-rest protocol, we create AD tasks for each dataset, where the number of classes. In each task, one class is designated as normal, while the remaining classes are treated as anomalous. Across both sensory and semantic AD, the training datasets consist of mixture of normal samples and fraction of anomalous samples, reflecting realistic contamination scenarios.
23

---

B.2 Details of the experiment using synthetic Data
The synthetic dataset is generated using 2D Gaussian mixture model with three components. Normal samples are drawn from (x == == ((1, 1)", 0.07I2), while anomalous samples are sampled from (x)x) == [V[[002 0.25, 2.5 0.0312) + [[ 0.5]", 0.03I2). For the experiments, we use DeepSVDD with a one-layer radial basis function (RBF) network. The hidden layer comprises three neurons, with their centres fixed at the mean of each Gaussian component, while the scales are optimized during training. The RBF network outputs 1D scalar obtained as linear combination of the outputs from the hidden layer. The centre is initialized randomly and made trainable, with an added bias term in the final layer. Although these modifications (2018) to avoid collapse to a trivial solution, Qiu et al. (2022) observed that these changes enhance model flexibility and convergence. Following this, train DeepSVIDD using the Adam optimizer with learning rate of 0.01, 200 epochs, and a mini-batch size of 25.
not recommended by Ruff et al.
B.3
Computing evidence functions
EPHAD relies on an evidence function [z)), computed during test-time, refine anomaly scores by assigning higher values samples from P than those from Px. In this section, introduce domain- agnostic evidence functions applicable to image (Section B.3.1) and tabular datasets (Section B.3.2). While these functions are commonly used as standalone methods for anomaly detection, their role as evidence functions is novel and complementary to our framework. By operating in a transductive setting, they refine the outputs of an AD model initially trained in an inductive setting. Moreover, as shown in Section 5, using these evidence functions solely as anomaly scores does not always yield strong AD performance. However, when integrated into EPHAD, they significantly enhance the performance of a pre-trained model. Finally, the choice of an T(x) is not restricted to AD methods and can be adapted to incorporate domain -peeciic knowledge for improved effectiveness.
B Evidence for visual datasets
For the evidence function in image-based AD, propose using Contrastive Lannguage-Imagg Pre- training (CLIP) (Radford et al., 2021), a robust large-scale framework that learns joint vision-language representations from web-collected image-text pairs. While CLIP has been explored in prior work as a zero-shot AD method (Jeong et al., 2023; Zhou et al., 2024), its performance varies across different datasets. Although CLIP excels in detecting anomalies in real-world image datasets such CIFAR 10, it faces significant challenges when applied to domain-specific datasets, particularly those used for industrial inspection, like MVTec. This limitation stems from the lack of domain-specifie knowledge in CLIP's pre-training. In this section, we describe how CLIP is integrated into EPHAD as an evidence function T(x), leveraging its strengths while mitigating its limitations in specialized domains.
Given a dataset D = {(z,, 1/ CLIP trains an image encoder e and a text encoder e, using contrastive learning (Chen et al., 2020), maximizing the cosine similarity between c; and (t,))) for all (zy D. For input image x, CLIP performs zero-shot classification (Radford et al., 2021) by computing a k-way categorical distribution over a set of candidate class texts C (ci,..., c
cxp((e(().
p(c=cj [x(EE))= Execexp
exp ((<(()).e<())))))
where (..)) denotes the cosine similarity, and y is a temperature parameter that controls the sharpness of the distribution. Pairing class labels E C with prompt templates (c.g., photo of a [c) improves classification accuracy, and aggregating embeddings from multiple prompt variations (c.g.. cropped photo of [c]) further enhances performance.
Building on Jeong et al. (2023), we use CLIP as evidence function T(x) in EPHAD. We start by defining two lists of textual prompt templates, TN {n1.-. .n and TA {aI..... (d..-.....t)) J. corresponding to normal and anomalous classes, respectively. The list of prompts is provided Table 3. These templates are dataset-dependent, reflecting subjectivity (e.g.. "missing wire" as anomalous for cables). For each label, we generate two lists of prompts for normal and anomalous cases using Ty and Ta and compute the mean of text embeddings ty and t.. Finally, given input image z, the evidence
24

---

Table 3: Prompts for CLIP where "c" denotes the category.
Semantic AD
Sensory
Normal "c"
Anomalous damaged "c"
Normal
Anomalous
a photo of the number "c" a photo of something
flawless "c"
"c" with flaw unblemished "c" "c" without flaw "c" without defect
perfect "c"
"c" with defect
"c" with damage
"c" without damage
T(x) during test-time is computed as:
exp (xp(((((t),tx)//) T(x) exp (((((()) + exp ((e(())ta)/)))
One potential concern when using pre-traines models like CLIP the overlap between their training data and the test samples encountered in downstream tasks. Such overlap could challenge the assumption that test-time statistics are based solely on test data. However, Radford al. (2021) provides extensive analysis of this issue and shows that excluding all overlapping samples from CLIIP's pre-training corpus leads to only a negligible performance drop. This result suggests that CLIP's effectiveness stems primarily from its generalisation ability rather than memorisation. Accordingly, our experiments emphasise this generalisation property, ensuring that the use of CLIP within our framework remains valid.
B.3.2 Evidence for tabular datasets
For tabular datasets, we use the output classical unsupervised AD methods as evidence functions T(æ), namely, Local Outlier Factor (LOF) (Breunig et al., 2000) and Isolation Forest (IForest) (Liu et al., 2012).
Local Outlier Factor.
To detect anomalies, the local density of a point is compared to that of its k-nearest neighbours. Specifically, given a dataset D == {xy 1 the k-distance of point æ, denoted k-distance(r), is defined the distance from to its k-th nearest neighbor.
Based on this, the k-distance neighborhood of x, denoted as (Nx consists of all points whose distance from is at most k-distance(zz.. Additionally, the reachability distance of from neighbor J; is computed as reach-dista (x, æ;) = max mnax(K-disttan (k-distance(x). d(x, x;)), where d(x,, æ;) represents the distance between x and z;.
Then, local reachability density (LRD) of is computed as
LRDx(*) = Σ Nx(x) reach-dist, (I, (I,,
[N+(r)
Finally, the LOF-based evidence is computed as
T(x) EmeNN(a) (R),
LRDx(*.)
(x)
Isolation Forest. Anomalies are identified by recursively partitioning the data using tree-based method, where features and split values are selected randomly. IForest operates under the assumption that anomalies are more susceptible to isolation due to their sparsity and distinctiveness in the feature space. Given D. IForest constructs multiple isolation trees (lTrees), where each data point x is assigned a depth representing the number of splits required to isolate it, referred to as the path length. Specifically, the evidence function (xx) is computed as:
T(x) = -2 S(A(e)
where (xx is the path length of i.e., the number of edges traversed from the root node to the leaf node where x isolated in ITree. ((h(x)) the expected path length, i.e., the average path length across multiple ITrees, and c(n) is the average path length of an unsuccessful search.
25

---

B.4 Experimental setup
For training the base AD methods, we use open-source Anomalib and ADBench libraries for experi- ments with image and tabular datasets, respectively. Our decision to rely on these public libraries was intentional, ensuring transparency and facilitating unbiased comparisons. For the training of each base AD model, we used single NVIDIA A100 GPU. Then, we run inference using EPHAD on CPU.
C Extended results
C.1 Additional experiments on tabular Datasets
Table 4,5, 6, and 7 summarise the results on larger set of tabular datasets from ADBench. Each experiment repeated with three seeds. We can observe that most cases AD methods benefit from our post-hoc adjustment framework EPHAD, often achieving performance improvements that surpass both the evidence function and the AD method in isolation.
Table 4: Performance of EPHAD on tabular datasets with 10% contamination ratio and LOF as evidence function. Style: AUROC (+ SE). Best in bold. i represents transductive inference.
Darnet
LoF!
DOPOn
DeepSVIID
ixon
1.00
di
73.8422800 8:11
51
12 onto
63.89
0161
L2 0.54)
66.36
01773
c2 1.00
$6.35
015)
$4.05 -2: 0.311
01000
c2:
73 c2: BC9)
68.53 9:19
T5.45 12 010
33.52
0.00
62.69
1.33)
67.000 3.15
76 115
c2 3.10
76.51
0.11
71.39
:5: 0.54)
711-1 0.10
72. 12: 0.57
71 10--0 9:00
haduderr
10.43 08.0
75.06 11 007)
76,36
78.34
1.2
08.45
0.57
53000 c3 3.09
$5.46
0/6
$1.29 L8: 1.20
71.13 0.15
46
09.11 0.0
eeicba
41.45
72.09 12
51.56
67.51
300
73.99
3.81
63.2
40.09
cove
52.12 8:11
78L
70
12: 000
79:01
8301
75 88 11.50
75.24
85.34
$5.45
72.59 11: 1391
63
22 12
44.20 B17
55.00 (8 0.50)
48,09
13 0.50
45.66:15
8:57
41:34
0000
68.59
0.99
47,00 01 044
46.87
0.0
58.08
18 0.4
55
02
08 0.50
64.41
1.550
59.93 cB 837)
Exzd
45.75 11
94.39 (2:
94.34
59:96
007
$3.86 11
93.62
000
91.85
15: 023
03
(2 0.47
35.02
45.26 <t 0.18
glas
16.11
78.50
76.40
hrp
37.05
M2.35
96.83
6712 10b
81.77
655)
12 0.15
76.34
035
89.08 12: 1:51
831
94.64 (2: 9%
78 855)
kne
85. 0.70
16.71 12 015
57.47 0.00
50.51 02 2.50
61.26 12 2:40:
56.41 (2 3.50
57.17
6.00
59:44
18: 060
81.55 (2 0.59
80.74 12 050
$4.5 639)
09.44
99.52
0.2
99:76
0.19
95.57
070
99.53
0.19
99
cl 0.30
99:76
0.19
99.76
18 0.19
99.52
0.19
98.57
99.36 833)
matengerapyy
must
75.57 12
0201
73.99
4.30
72.62
010
71.27
94.55
c5
makk
(1300
91.95 12 000
91:51 91.91c2:001 0:31
88.57
3.41
87.17
5.50
71.84 12:33
71.78
034
59.39 12: 1281
2000
2n 17 12 1.20
32.43 +2 004
opstigis
99 9:00
62
56
12 076
61.49 071
10.01
10:33
66.77
8%
54 (2701)
51.16
6.1
60:87 4.5
56,00 (2: 9
15 05 9%
58.09 910)
postigis
47:21 125
K8 M6 97
025
74,87
901)
72.68
877
90.67 (1-77---3 175
50.65
$1.86 11: 1.40)
0.0
16.8 87
37.64 9:11
sacllie
64.33
66.59
57.57
76.31
66.73
satrreg??
97.00312:0000 1100
0.00
static
99.26:1:431
99 101912200 0/
97.85
099)
12 077
98.3 (1-1
000
98.37 11: 6.00
81 12
07)
99:11 12: 000
9RA9 8(0)
amip
89.77 0.55
19.54 o0))
88.56:16611 6:15
$4.05
0.5)
96.10 (1:55)
82.95
(3 3.5
88.28
6.0
19:27 (8: 653)
09,00
(8: 0.5)
45.01 (2: 1.57)
W9382 cD: 0.3)
75.91 (1 0250
88.45
88.71 0300
86.75
3.72)
68.33
3.55
94.9 (1 0.3
94.35
0.44
93,67 18: 0.27
62:42 0.29
73,59
77.18 0:3)
56.10
wilt
33.45
(11
16.55
1390
42.92
:1: 1.111
$1.00
wire
90.57441100 100
86.78 1991
12 5/N
92.98 1.00
67.12 260
76997
04:76:74 7391
$0.40 1421
07.81
12:
1.51
99.9 (2: (009)
99:04 915)
Table 5: Performance of EPHAD on tabular datasets with 10% contamination ratio and IForest as evidence function. Style: AUROC % (+= SE). Best in bold. i represents transductive inference
Datacct
Iiveod'
Blned
COPOD
Blast
DveD
EPRADD
Bilne
BOOD
EPPAA
Bllsc
IFvestt
Blins
L.F
c4.18
$1.48
54.43
$4.26
73.57
(7)
c8
73.45
0181
2.19
75:91
hadsftor
67.81k2 166)
75
75/08-12 007)
75.16
1.710
$3.45
0775
83.00 0109
0100
09:90:1 12: 1.70
66-48
1.47
45.05
42: 0176g
114
broedw
91.97 Lg 0:10)
90-45 11 0163
49.06
0.55)
6095)
96.96
000
99 01 (2: 03.0
99.07
010
$9.46 18: 0.0
08.08
C3 0.00
71.39
(2 1.50
R1.16 C3 100)
edeta
66.61
22,89 (1, 000
72.00
67.51
3.67)
68.20
2.50
73.99
73.57
0001
40.00
68.35
1.07
42.97
40.73 (L 945)
full:
52.02
45.69: 0281
47.00
58.06
53.76
0.41
56.97 3551
fiadd
94.37 02 0:111
94.59
00/
$4.40 -: 100
$9:58
92.36
12:00
93
62: 8:01
95.87
0011
$2.95
120 0250
94
02: 0301
33.00 02: 1244
85
2.54
gles
77 177)
76.11
02: 6771
76.29 62 000
64.53 6.55
5,00
67
65 0.00
68.26
0:55
78.90
12: 1:475
77.85
02: 144
71.79
110)
51.23 (2: 545
59.99 11
94.31
96.84
99.24
0.7
$4.19
000
46.
0.5
99.33
01 6.00
17.35
94J CL 905)
anoophere
ketee
c6 0.201
55.74 08: 0.13
56.76 12)
52.37
2.52
56.41 0.20
56.47
0.20
59.64
0.64
61.35
0.33
65.24
3:3))
aps
95.02
0.07
99.52
1 0221
99.52 022
98.57
99.28
044
50,
12: 4.25
99.68
0.17
59.76
18 0.50
99:54
c1: 0.17
95.57
(2 0255
59 99.68.0 ct 0.25
manmgropy
83.95
0.021
89.29
11: 0101
02:
87.25
0050
67.76
1050
59. 39 0100
89.24
$0.14
12:
13.04
01: 0.111
08.70
33.30 cb: 2.15
75.87
76.20
3,00
71
74.36
91. A0
epitipis
62:28:1.00 024
02.25:1.030
10:25
43.56 9:55
54.00 (2. 020
$4.89
0.2
40.87 01 4.5
53.81
c3. 1.57
19.45
38.72 3.67
pesdists
02 0.23
$8.44 02 0.3
(3:5801-33)
74.97 900
79.77
5,09
M0B3 12 0.15
96.73
011
$1.86
18 1
98.40
c3: 0.13
14.5%
0.15)
68.81 cD 1.1)
seaciiie
64.44 0.27)
64.33 :1: 0221
64.33 (2:023)
60.59 1.70
60.84
1,49
$7.57 12 0.50)
$7.60
0.00
76.31 (2
68.34
c1: 0:31
63.01
0,21
72.19 ct 245)
setingee2
97.03
99.41
92.79
shurte
090)
09:46:11:000
46
ump
756441 6m0)
(1:14:1:400
$4.05 12.
87.46 12 075
K7 130%
88.41
000)
19.37 122 0:80
00.78 mm:
41.01 1.5)
88.966 L1: 135)
dhyii
96.65 L:: 8:0)
28-45 01 0.5)
09.21 (1.03)
86.75
377
M9.11 12 2
94.91 (1.01-)
95.86
015
45.67
18 0.77
96602
(1: 0:11
73.59 1.0
90.41 CL 3:5)
rowds
72:33
55.10 0:2)
$6.99 (1:030)
18: 2.50
66.17
2.57
$4.29
54.55
000
68:01
71.88
(1: 0.44
93.04
91.63 CL: 330
wite
c8.05
90.51 :t: 1.28
c0.34
2:20
51.07 2.11
67.12 12: 204
67.06 210)
$0.40
3422
9531
09.72 2:12)
26

---

Table 6: Performance od EPHAD Ada on tabular datasets with 10% contamination ratio and LOF as evidence function. Style: AUROC % (= SE). Best in bold. i represents transductive inference.
Datwol
LOFT
DeeySVDD
iFeest
Riten
-RPRAR-MA
Billec
Fliret
EPRAZ-- Min
71.64 8:11
51.46 15 018)
53.65 11.0 0.17
54.00
0.5))
71067
0.30
55. 141
55.47
0.15
55.09 0 0.311
57.40
0.000
73.57 c2 9-11
7338 cL: R05)
umityyeed
68.53 (3.0
13.45
11 0280)
73.91
3.50
69.27
0.94
0.313
76.25
21.79 0. 0.34)
72.24
0.50
72.11
71,2kc 833)
badadoer
75.06
75:04-05
breate
46.31 (2-0000
96.65
1.55
0144
celehe
41.45 (2:0000
72.09 12 000
70.85
67.51
5000
5000
73.99 12: 1.03
72.85
48.09 12 0131
0.57
97 12
30 0:54
onner
52.1348.000 8:11
76.7 100
78.57
75 62
75.5% 42
85 54
12: 475
55.45
000
17.59 12: 1590
73.16
77
36.78 c2 9:31
15.0 6:511
45.09 50
14:44-0 009
50.25
0.00
46.91
58.08 12
57.01
66.41
1.50
alai
72.52 0.00
76.11 0.77
81.77
54.52 637)
2.52
0.40
78.43
19.5 1.47
83.15 1.80
71.79
73:67
675)
hip
37.65 11 0080
94.91
12 0/1
94.91
0.01
99.17
0
99.17
00800
52.35 c2 0.02)
92.35
600)
96.82 12: 0371
96.92
0.77
17.85 12 2000
15.31 ct 150)
iocoppee
92 12
TM.42
12: 100
84.15 02:15-1::330
$3.09
023
85.00
10.00
73.04
12 1.54
78.14
59:58 1:: 1271
90.05
1.20
94.64 1: M55
91.85 c2: 9281
knner
16.71
5.54
65.9
56.
59:54
71.38
MK.74
59.76
07.29 11:9
3M 12
89:23-5:022 0:01
0053
57.11 0000
3.00
89:32
50.44 0231
69.7 (
73
mist
5963 (2:
78.7
12 000
74.27
74.26
6.30
61.3 8.9
72 (2: 1:50
70.85
0.15
71.27
0.7
70:59 12:
94.85 12 1.:00
c2 844
mok
19 04641222 12: 57>
91.96
18.57
61 7/0
71.34
12 30
94
6:11
10.39 18: 1991
87 04 (2: 3/11
70 17 12 00
28.5 12 0.70
opstigts
62.26 0..00
65.13:1.003 0.21
40.01
10:33
5804 0.9
S4.M
58.99
0.55
40.87
68.26
3.00
18
42.52 CL (5R)
8700918:633)
satcllic
529 5.33
64.33
66.71 0.5
60.59
177)
1.3
57.57
(1 0.30
90,0 0.2)
T6.31
76.00 00:00
61.01
66.74 c5 9.3
salingge-2 2
52.8 0:: 0.33
97.08 12 (06
92.65
[- 1.4))
96.14
c2 0.50
94.21 12:0
96.41
(0
96.91 12: 000)
98.15 0:31
24.52 12 (05
41.8 1: 4772
shurte
91
99.26 0301
97.83
(99
50.97 12 1:50
M8X0 (2-1
99.57 12: 0101
99.57 0.00
59
12 (01
99383 c2: B12)
TM
(1:77
88.27
19.27
45.01 (%)
6318 3.15)
9491
rowels
a2.13
54.29
000
66:00
c8.76 DM
93.04
with
111
35
384422075
19
1.5)
R9.53 12 1.50
09 133
43.86
0.00
41:33
18: 1111
07.27
12:00
81.00
(2:0
76.67 (19
Kire
92.57 (2) 90
10.51 18 130
03.96 -2 1.60
$3.76 (2 2.30)
00.06 (2 1.75
67 17 3.00
50.27
7.9
10 1:455
00.56
(2
315
94.4 (2 0.5
99.44:1 6155)
Table 7: Performance od EdaAD-Ada on tabular datasets with 10% contamination ratio and IForest as evidence function. Style: AUROC % (= SE). Best in bold. represents transductive inference.
Datnot
IFoest
Bladd
CORID
B4X00
livend
c4
51,
$3.43
54.31
53.73
54.27
73.57
62.1
0101
75:66
hadefror
00.81k3
75.06:1 6.01)
8.5
1.740
22.05
11.39 18:
61.25
0:57
46.65 L2 0.76
67.81
broadw
90.01 CB: 0010
99.46 11 0.01
99.20
8.00
98.65
0005)
96.85
0000
99.00
0.0
99.1 08 4.00
99.46 18 0.00
98.17
</. 0.00
73.39
1.5
92.93
CD 3:53)
edcha
66.62
22.09 0001
10.51:10
67.51
3
68.63
73.99
70.52
40.00
$4.01
0:44
42.97
60,04
0.55)
78.7
18.23
fauk:
53.03
59.08
55.16
frasd
94.87 011
94.30
00/
94.1
$9:58
0.11
93 00 02 8:51
94.63
0100
42.90 00
122 01/00
94.33
01: 0.00
13:93 12:
91.86
glex
11 475
75.13 02 67
70.78
11
64.52 6.57
56.35 12 7,00
67
65 12 9.0
74.8%
110
73.5 17)
17.96
1.60
71.79
13.77 155
99.09
94.91
000
99.25
(1)
99.52
000
02.
99.25
000
06.82
0.57)
99.37
(1: 5.01
17.35
99:96
letter
c
55:73 0.121
02:033)
50.51
2.54
56.79
1.04
56.41
59:37
59.54 006
00.93
85.74
262)
bymplhogaphl aply
95.03
010
99.52 [t: 0221
99.76
98.57
99.93
99.6 0:3
99.76
0.15
99.76:2 0.99
99.76
12: 0.151
98.57 (2 L051
59.34 c:: 2.15)
monigggpyy
87.95 01321
89.29 02: 0101
37.000
12:0 13
87.25
0050
64.27
0,20
MM. 12: 0100
$7.51
0.13
50.44 12 0250
83.87
02: 0101
06.77
12:
33.90 +2: 2:31
75.5 0100
25 01)87.42
07)
16:76:
76.04
0.70
72
74.8
71
71
73.83
94.35
940 02.55.1
77.75
optiiiis
62:26:0 0.41
60.85
10.2
58.15
3.71
54.00
0.3
2.15
40.87 01 4.5)
50:42
1.41
15.45 0.50)
35.14 3.0
peadizis
02 022)
58.44 c7 0.2)
90,09 (2:020)
74.87
900)
90.09
2.25
90.6 12 0.17)
92.11
0110
$1.56 18 1
88.36
<- 642)
14.57 (t (J3))
79.82 ct 2.4)
setelite
64.44 01:11
64.33 ::: 0221
64.73 035
60.59 1.70
63.43
57.57
12 4.10)
61.83
(22
76.31 (2:11
69:99
(:: 6411
63.01 <2 0,21
72.04 c: 2.25
satineee?
05.47
97.03
98.19
94
99.31
M5.39
(2.000
ampp
00005 0.78
76644 600)
88.0 11:011)
14.5:11.55
91.08 12 0.33
12.05
96:21 11: 017
19.37 18 0.80
41.01 1.55)
ML. (.20)
dryii
96.65 c8: 020)
85-45 (8 0.51
94.25 (1:030
86.7 18: 377)
95 3.40
94.91 (2 01/)
96.2 420
93.87 18 0.77
98.5 0.14)
73.59 1.0)
95.67 0.)
ronda
72:13 18
56.1
12
65,07
(1:022)
64.47 2:50)
70.74 1,40
$4.29
64.37
067)
66:01
69.74 ct 020
93.04
00,01 ct $24)
wilt
42.57
$1,09
wine
90.51
1251
481
3230
2099
67.12
63.73
73.62 cb: 1.11
C.2 Experiments on industrial use case
CSP plant dataset. For the industrial setting, we utilise the simulated dataset introduced by Patra et al. (2024), which is generated by training a variational autoencoder on real-world data collected from an operational CSP plant. The dataset consists of thermal images of solar panels captured using infrared (IR) cameras, distinguishing from the semantic and sensory anomaly datasets, as the images lack semantic structure and do not depict specific objects.
Baseline AD method. We evaluate the performance of the forecasting- based anomaly detection method ForecastAD, as proposed by the original authors, both with and without the integration of EPHAD. All experiments are conducted using the original implementation provided by the authors.
Rule-based evidence. Foundation models, such as CLIP, which were previously used in our experi- ments on image datasets, are not applicable in specialised applications, such as detecting anomalous behaviour in solar power plants, due to the lack of semantic content in thermal images. This makes zero-shot methods like WinCLIP and AnoCLIP inapplicable. In contrast, while EPHAD can in-
27

---

corporate evidence from foundation models like CLIP, it also allows the seamless integration of domain- -emaii-specific knowledge. To compute evidence, we utilise two of the four rules proposed by Patra et al. (2024) that indicate normal operational behaviour of the CSP plant. The first rule (R1) is based on the difference between consecutive images. Under normal conditions, the plant's 's temperature is expected to remain relatively stable; therefore, substantial deviations from one image to the next suggest potential anomalies. To quantify this, pixel- wise squared differences are computed between every pair of consecutive images, and the 95th percentile of these differences is extracted as the representative evidence for each pair. The second rule (R2) involves the difference from the average daily temperature. Here, samples with average temperatures significantly diverging from the typical daily average could indicate anomalous behaviour. For this, the mean temperature of each day is first determined, and then the absolute difference between each image's 's average temperature and that day's mean is computed to serve as the evidence.
Results.
The results presented in Table 8 under- score the effectiveness and adaptability of our ap- proach. Under a 10% contamination setting, the base- line method ForecastAD experiences a performance drop of approximately 5%. However, by incorporat- ing domain-speciff rules RI and R2 as sources of evidence using EPHAD and further using EPHAD- Ada, the performance nearly matches that on the clean dataset. It emphasises the value of leveraging struc- tured, context-aware evidence to enhance the detec-
Table 8: Performance on CSP plant dataset.
Setting
Method
AUROC (# SB)
Clean
ForecastAD
94,91 (1:0.09
Evidence
Rule-bused (RI, R2)
69.46 (+: 0.0)
Contaminated
ForecastAD
90.45 (t: 0.8)
(c 0.1)
+ EPHADD
93.51 (#: 0.45)
+ EPHAD Ada
93.57 (d: 0.43)
tion of anomalies. Importantly, foundation models like CLIP unsuitable in this context due to the lack of semantic content in thermal imagery, rendering zero-shot approaches such as WinCLIP (Jeong et al., 2023) and AnoCLIP (Zhou et al., 2024) ineffective. EPHAD addresses this limitation by providing a flexible framework that integrates both powerful foundation models, where applicable, and domain-specific knowledge when necessary. This versatility enables EPHAD to deliver robust performance across diverse real-world anomaly detection tasks while maintaining efficiency and ease of deployment.
C.3 Comparison against LOE and SoftPatch
To ensure comprehensive evaluation, we compare the performance of proposed post-hoc framework against SoftPatch (Jiang et al., 2022) and both variants of LOE (Qiu et al., 2022). However, it is important note that, unlike our approach, both SoftPatch and LOE modify the training process to account for contamination, making it inapplicable to pre-trained networks without access to the training dataset and pipeline, which is our main focus.
First, for comparison with LOE, we conduct experiments us- ing the Neural Transforma- tion Learning- beasd based (NTL) AD method (Qiu et al., 2021) and evaluate it under four configura- tions: "Blind", "Refine", LOE- Hard and LOE-Soft. Addi- tionally, we follow the same setup as LOE by extracting im- age features using pre-trained ResNet152 and Wed0ResNet50 for semantic and sensory datasets, respectively, which are then used to train NTL. The results, summarised in Table 9, show that given good evidence function, ie. the performance of the evidence is better than the "Blind" configuration, our simple test-time framework outperforms LOE. Results on MVTec, CIFAR10. FMIST, and SVHN are examples of this behaviour. Also, on the ViSA dataset, the performance improves over the "Blind" and "Refine" configurations. In the converse situations where the performance of the evidence is lower than the "Blind" configuration, we observe a reduction in performance which can be accounted for by putting more emphasis on the AD model by adjusting 3.
Table 9; Comparison with LOE (AUROC %)
Method
Semantic AD FMNIST CIFAR10
Sensory AD
MNIST
SVHN
MVTec
MPDD
VISA
CLIP
71.15
95.63
98.63
58.46
86.34
60.02
74.47
Blind
90.15
89.01
90.79
61.82
78.13
80.41
61.95
Refine
91.35
91.37
92.79
61.78
82.54
87.32
65.63
L.FE-
86.89
90.53
93.10
53.86
79.28
83.34
78.82
LOE-Solt
91.56
92.89
94.71
61.69
85.46
92.31
EPHAD
78.96
95.99
98.65
57.64
86.20
59.88
74.22
28

---

Now, we compare it against SoftPatch, an approach built upon PatchCore (Roth et al., 2022). SoftPatch enhances PatchCore by incorporating traditional anomaly detection (AD) techniques to refine the memory bank, specifically by identifying and re-weighting patches based on their outlier scores during training- While this strategy improves performance, introduces a strong dependency on the choice of AD method and increases the computational burden of the training pipeline.
For a fair comparison, we adopt the Local Outlier Fac- lor (LOF) as the AD method, as it has been empirically found to be the most effective for SoftPatch. As shown in Table 10, our method, EPHAD, achieves competitive re- sults despite being fully post-hoc approach that requires no modification to the training process. Crucially, while methods, SoftPatch tailored for sannory-bank-basee EPHAD is inherently model-agnostic and can be seamlessly applied to any combination of a pre-trained model and an evidence function. This versatility highlights EPHAD's
Table 10: Comparison with SoftPatch
Sensory AD
Method
MVTec
MPDD
ViSA
CLIP
86.34
60.02
74.47
PatehCore
Blind
70.02
51.41
19.91
SoftPatch
90.40
67.00
86.54
EPHAD
86,45
60.58
62.94
broad applicability and practical utility across a diverse range of settings.
C.4 Ablation on e and
Extended ablation on and / can be found in Figure 3, 4. We can make similar conclusions as discussed above in Section 5.3.
.B- CUP
-
PatchCore
CFLOW
- ULSAD
PatchCore EPHAD
CFLOW EPHAD
ULSAD EPHAD
PatchCore EPHAD-Ada
CFLOW + EPHAD-Ado
ULSAD EPHAD-Ads
MV
VISA
CIFARID
SVHN
100
8
70.0
AUROC 0%)
67.5
AUROC
63.0
15
82
62.5
70-
95
3
60.3
30
22
57.5
60
55.0
2B
20
25
10
20 Contamination Ratio (9))
Contamination Ratio (%))
Contiminnt on Ratio (%)
Contamination Ratio (%)
Figure 3: Ablation E.
D- CUP
PatchCore
CO
ULSAD
-
PatchCore EPHAD
CFLOW EPHAD
ULSAD EPHAD
PatchCore EPHAD-Ada
CTLOW EPHAD-Ada
ULSAD EPHAD-ide
MV Tec
VISA
CIFAR10
SVHN
0
00
55
20
80
AUROCC (86)
-5
AUROC (80
ALROC (46)
AUROC (N4
50
8
8
0
-
0
75
70-
3.0
5.
10.0
10.0
0.1
3.0
10.0
0.1
0.5
3.0
10.0
Temperature
Temperature 9
Temperature 9
Temperature
Figure 4: Ablation on 33.
C.5 Effect of test set size n
The performance of our proposed framework, EPHAD, is influenced by both the pre-trained AD method and the evidence funetion. While the pre-trained AD method affected only by the training data, for the evidence function, we evaluated two scenarios: (1) When using foundation models such as CLIP, the evidence function remains independent of the test sample distribution. (2) When employing traditional AD methods like Isolation Forest Local Outlier Factor, the evidence function
29

---

relies on the local density of test samples, meaning that an insufficient number of test samples could lead less informative evidence which can be accounted for EPHAD by adjusting the temperature parameter 9. In Figure 5, we analyse the impact of varying the proportion of anomalies in the test set, which exhibits consistent improvements across all tested settings.
CLI
PatchCore
CFLOW
PatchCore
EPHAD
CFLOW EPHAD
Mv
MPDD
VISA
70
85-
70
AUROC (96)
80
AUROC (%)
60
AUROC (9))
70-
30
65
10
20
40
60
90
10
20
40
60
80
10
20
40
60
80
Anomalous samples (%)
Anomalous samples (%)
Anomalous samples (%)
Figure Ablation on varying proportion of anomalies in the test set.
30


Reviews:
[{"review_id": "nIwywbIbDq", "reviewer": "Reviewer_sGXx", "summary": "This paper addresses the problem of deploying unsupervised anomaly detection (AD) models that have been trained on datasets contaminated with anomalies without the possibility of retraining, modifying the model, or accessing the original training data. To tackle this, the authors propose EPHAD, a general post-hoc framework that adjusts model outputs at inference time using auxiliary evidence. The approach is formulated as a Bayesian correction, treating the original AD model as a prior and integrating external evidence (e.g., outputs from foundation models like CLIP) as likelihood signals. EPHAD supports both density-based and score-based AD models by estimating inlier probabilities in a statistically principled way using test-time rankings and a Beta posterior.", "questions": "1. Can EPHAD be adapted for online settings? The score-based update requires estimating the empirical score distribution across the test batch. Is it feasible to apply EPHAD when samples arrive sequentially, and if so, how could the rank-based prior be computed incrementally?\n\n2. Why are standard deviations not reported in Table 2?\n\n3. What is the computational cost of EPHAD at inference time, especially when using large evidence models like CLIP?\n\n4. How is the decision threshold λ selected in the absence of labeled validation data? \n\n5. How does EPHAD handle cases where the evidence function T(x) is noisy? How robust is EPHAD if the evidence is misleading?", "limitations": "- The score-based variant of EPHAD requires access to a batch of test-time scores for rank-based estimation, which makes it unsuitable for online AD scenarios.\n\n- The framework depends on auxiliary evidence functions, whose quality significantly affects performance. Though some mitigation strategies are discussed, the method assumes that the evidence is broadly aligned with the true anomaly structure. \n\n- Although the method is designed for test-time use, some evidence functions such as CLIP may introduce non-trivial computational overhead.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n- The paper addresses an important but underexplored real-world challenge: adapting AD models trained on contaminated data when retraining is not feasible. This reflects realistic deployment scenarios, such as in industry, where model internals and training data are often unavailable.\n\n- The paper draws a novel connection between post-hoc anomaly score correction and KL-regularized inference, as used in reward shaping for generative models and policy improvement in reinforcement learning (RL).\n\n- EPHAD’s use of auxiliary evidence functions offers flexibility across domains and modalities which makes it agnostic to the source of evidence and helps to incorporate external knowledge without modifying the base AD model.\n\n- The experiments convincingly show that EPHAD improves performance under contamination across diverse AD models, data modalities, and domains.\n\nWeaknesses:\n\n- **Thresholding Left Unspecified:** The paper uses thresholds λp and λs to make binary decisions but does not describe how these are chosen.\n\n- **No reporting of standard deviations in result table:** In Table 2 (tabular datasets), only mean AUROC scores are reported, with no variance across seeds.\n\n- **Lack of resource efficiency reporting or runtime metrics:** Despite promoting EPHAD as a practical test-time intervention, the paper provides no analysis of runtime overhead, memory usage, or latency—particularly when computationally expensive evidence functions like CLIP are used.\n\n- **Missing discussion of broader societal impacts:** The authors mark the broader impact section as “NA” without justification, despite the method being applicable to high-stakes domains such as industrial automation, medical diagnostics, or financial fraud detection.", "was_revised": true, "final_justification": "I initially viewed this paper positively for its practical and well-motivated framework for post-hoc anomaly detection correction, but raised questions about its applicability in online settings, threshold selection, the inference-time cost of large evidence models such as CLIP, and robustness when the auxiliary evidence function T(x) is noisy or misaligned. The authors’ rebuttal addressed these questions, providing explanations that clarified the method’s design and deployment considerations.\nWhile these responses resolved my specific questions, they did not materially change my overall assessment. The strengths of the paper remain in its broad applicability, principled formulation, and strong empirical results, while the key limitations, such as reliance on evidence quality and lack of calibration evaluation, remain. I therefore keep my original evaluation unchanged.", "rebuttal": "We sincerely appreciate the reviewer’s insightful and valuable feedback. We are happy to note that the reviewer finds the problem addressed in our work to be an important but under-explored real-world challenge. We address the reviewer's concerns in the points below.\n\n**[W1, Q4] Thresholding Left Unspecified.** Selecting a threshold is an essential consideration in deciding the final label given an anomaly score. Thus, several existing studies are dedicated solely to this aspect [1-3]. However, the primary focus of our work lies in refining the anomaly scoring mechanism itself, not in optimising the decision threshold. As such, determining a fixed threshold falls outside the scope of this study. To ensure a fair and threshold-independent evaluation aligned with our objectives, we report performance using AUROC.\n\n**[W2, Q2] No reporting of standard deviations in result table.** We have now repeated all the experiments with three seeds in our updated draft.\n\n**[W3, Q3, L3] Lack of resource efficiency reporting or runtime metrics.** We would like to emphasise that EPHAD operates without modifying the base AD model and does not introduce any additional fine-tuning steps. As a result, the memory and computational requirements remain unchanged relative to the original model. The only additional cost stems from the auxiliary evidence function, whose overhead depends on the specific implementation chosen.\n\nFor example, in our real-world use case involving solar power plants, a simple rule-based heuristic serves as the evidence function, resulting in negligible memory and compute overhead. Similarly, in the tabular AD setting where we employ Local Outlier Factor (LOF), the added cost is minimal. In scenarios involving foundation models such as CLIP, while there is an increase in memory usage due to model size, the latency remains low, as adaptation involves only a single forward pass followed by a lightweight similarity computation with predefined templates.\n\nTo better illustrate these trade-offs, we will include a dedicated section in the updated draft of our paper that reports runtime and memory overheads across the different use cases under consideration to provide clarity about the practical applicability of EPHAD.\n\n**[W4] Missing discussion of broader societal impacts.** Thank you for your suggestion. We will incorporate a section discussing the broader impact of our work in the updated draft. EPHAD provides an effective way to adapt pre-trained AD models during inference, removing the need for specialised architectures to handle data contamination. This is crucial for high-stakes applications such as industrial automation and medical diagnostics.\n\n**[Q1, L1] Can EPHAD be adapted for online settings?** For the approach discussed in our current draft, we need to have the unlabelled test set together to compute the outlier probability. Thus, it cannot be applied in online settings. However, we provide an alternative approach to applying EPHAD, which does not require converting the anomaly score to outlier probability for non-density-based methods. Consequently, EPHAD can be applied in an online setting, provided the evidence function can be computed sample-wise, such as when using CLIP or rule-based evidence functions. The alternative version of EPHAD is summarised below:\n    \nGiven an AD model trained on the contaminated dataset, we denote the anomaly score for a data point $x$ as $ s^-_u(x) $. Then, we can compute the inlier score as $ s^+_u(x) = - s^-_u(x) $. Considering $ s^+_u(x) $ as prior and an auxiliary evidence function $T(x)$, EPHAD computes the revised score $ s^+_c(x) $ using exponential tilting. It is a technique used to adjust a PDF by ``tilting'' it toward a specific outcome. Recall that the inlier score is an order-preserving transformation of the inlier PDF, i.e., $ s^+(x) = \\phi(f^+_X(x)) $ where $\\phi$ is a transformation function, e.g. log-likelihood. Thus, given a score-based AD model that learns $s^-_u(x)$, tilting increases the relative scores of the normal samples over the anomalous samples, steering the model toward an outcome supported by the evidence function. We first exponentiate the inlier score $ s^+_u(x) = - s^-_u(x) $ to ensure non-negativity. Then, we rescale $T(x)$ with a temperature parameter $\\beta$ and exponentiate it. Finally, the revised inlier score is computed as:\n    \n$$s^+_c(x) = \\exp(s^+_u(x))\\exp(T(x)/\\beta).$$\n\n**[Q5, L2] How does EPHAD handle cases where the evidence function $T(x)$ is noisy? How robust is EPHAD if the evidence is misleading?** In our experiments on the image-based AD datasets presented in Table 1, we employed CLIP as the evidence function. In certain datasets, such as SVHN, the evidence function can be noisy. For instance, when used in isolation (i.e., without EPHAD), CLIP achieves an AUROC of only 58.46\\% on SVHN, indicating limited reliability in this context. In such cases, applying EPHAD with the default setting of $\\beta=0.5$ does not lead to improvements over the base detector. However, we emphasise that $\\beta$ is a tunable parameter.  As shown in Figure 4 in our current draft, EPHAD offers a smooth transition between the two models, illustrating not only reliability but also adaptability, offering a principled way to balance the contributions of the base detector and the evidence function. To further support this adaptability, we provide an unsupervised strategy for selecting an appropriate $\\beta$ in Appendix C.6.\n\n[1] Perini et al., \"Estimating the contamination factor’s distribution in unsupervised anomaly detection.\" ICML, 2023.  \n[2] Perini et al., \"Transferring the contamination factor between anomaly detection domains by shape similarity.\", AAAI, 2022.  \n[3] Hendrickx et al., \"Machine learning with a reject option: a survey.\" Machine Learning, 2024."}, {"review_id": "FBKR9Mw0PE", "reviewer": "Reviewer_68bH", "summary": "This work introduces a framework for correcting the posterior distribution of the inlier samples given a model that is trained with contaminated data. This framework, dubbed EPHAD, is based in a generalized Bayesian inference framework, using the a CLIP-based evidence function. EPHAD aims to perform test-time adaption by correcting the posterior via $p^c_{Y=+1} (x) = p^u_{Y=+1} (x) \\exp (T(X)/\\beta)$, where $p^u$ and $p^c$ are the uncorrected and corrected posterior probabilities. The work shows that using the EPHAD framework may help in improving the anomaly detection performance when the detectors are trained with contaminated data. Experimentation in tabular and image data is presented, with ablations for the introduced hyperparameters also shown. Additionally, the authors discuss the connection of their approach with inference-time alignment of generative models.", "questions": "- Why is it valid to use the entire test-set in one go as extra information to improve anomaly detection within the same test-set?\n\n- How would you use this technique in a real-world scenario? Do you need a set of test images beforehand?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "I think the paper is really well written and has a strong mathematical background, with the appropiated works cited and discussed. The motivation behind it is quite sound, and I completely agree with the claims made by the authors in the introduction and related work. Additionally, there are several experiments including toy examples, tabular data and images, showing that the proposed approach improves the metrics.\n\nHowever, I think I find a big flaw in the process that makes me go for a reject instead of an accept (which I would normally choose for a paper like this): your test-time adaption method is performed using the whole test set at the same time and then reporting the metrics using your adjustment framework. Specifically, you say: \"In practice, the posterior is inferred from test samples, so the sample size n is constrained by the number of available test points.\" Basically, the problem I find is that in Equation (11), the $t$ is obtained from the test set and then used to adjust the posterior probability. From my point of view, that is training, because you are using the whole test-set to adjust the posterior to have a better performance on that test set. Therefore, the improved results for EPHAD are clearly obtained because you looked at the test set and then adjusted to perform better in that test set. I think it would be better if you had a validation set to perform and obtain the values for Eq (11), or if you implemented EPHAD in a batch manner. I am willing to change my rate if the problem I'm exposing is solved or justified.\n\nOther minor weakneses:\n- It'd be great to expand a bit more in Lines L183-L185\n- L173: Should be Eq. (3), not (3)\n- L195-196: How do you choose the threshold?\n- Eq (13): I think you have an extra \"exp\"\n- L291: I think the $\\epsilon \\\\%$ should only be $\\epsilon$ \n- I would expand a bit more in how did you use the evidence function for the image datasets and move the \"Connection with inference-time alignment of generative models\" section to the appendix.", "was_revised": true, "final_justification": "The authores answered most of my concerns and clarified about how they adapt TTA into anomaly detection within their framework. Additionally, the authors compromised to add further clarifications in the final version. I think the paper is of good value and has strong theoretical background, therefore I change my initial score from Reject to Accept. Good work!", "rebuttal": "We sincerely appreciate the reviewer's thoughtful and constructive feedback. It is encouraging to hear that the reviewer finds our paper to be well written with clear motivation and a strong mathematical background. We address the reviewer's concerns in the points below.\n\n**[W1, Q1] Why is it valid to use the test-set as extra information to improve anomaly detection?** We would like to clarify a key aspect of our method, EPHAD, which may help address the concern regarding potential test set exposure.\n\nEPHAD is explicitly designed as a test-time adaptation (TTA) method in which anomaly scores produced by a detector trained on a contaminated dataset are updated during inference using an auxiliary evidence function. Importantly, **during adaptation, we do not have access to ground-truth labels for test samples. This ensures that our approach strictly avoids data leakage and remains consistent with standard practices in the TTA literature** [1,2].\n    \nWe would also like to highlight a critical difference between Source-Free Unsupervised Domain Adaptation (SF-UDA) and TTA. While both operate without test labels, SF-UDA typically involves a separate, offline adaptation phase before inference, often requiring iterative fine-tuning on the unlabelled validation samples from the test distribution [3]. In contrast, TTA methods, under which EPHAD falls, do not have a separate model adaptation step. Here, the model is adapted during inference. The benefits of TTA approaches are twofold: (i) they avoid iterative training, improving the computational efficiency, and (ii) they do not require additional validation samples, which is beneficial for data-starved settings such as AD.\n    \nMoreover, EPHAD takes a step forward by being model-agnostic. It operates in a black-box setting, requiring only the output scores from the base detector. This flexibility broadens its applicability, particularly in settings where access to model internals is restricted.\n    \nWe hope this clarifies that the effectiveness of EPHAD does not arise from any exposure to the test set, but rather stems from our proposed adaptation strategy, aligned with established TTA methodologies.\n\n**[W2] It'd be great to expand a bit more in Lines L183-L185.** We have expanded lines 183-185 in our updated draft describing how EPHAD is a simple yet effective method for real-world applications. The revised text reads as follows:\n    \nEPHAD is a simple yet effective inference-time adaptation framework aimed at mitigating the effects of training data contamination without requiring access to the pre-trained anomaly detection model’s weights or original training pipeline. This makes EPHAD uniquely suited for integration with existing systems, especially when retraining is not feasible due to resource, access, or time constraints. EPHAD can seamlessly incorporate evidence from foundation models such as CLIP and also domain-specific knowledge in specialised applications.\n    \n**[W3] L173: Should be Eq. (3), not (3).** In the current draft, we have referred to equations using their corresponding number within the first bracket, e.g. (3). We have updated the format in our updated draft.\n    \n**[W4] L195-196: How do you choose the threshold?** Threshold selection plays a crucial role in deciding the final label given an anomaly score. Thus, several existing studies are dedicated solely to this aspect [4-6]. However, the primary focus of our work lies in refining the anomaly scoring mechanism itself, not in optimizing the decision threshold. As such, determining a fixed threshold falls outside the scope of this study. To ensure a fair and threshold-independent evaluation aligned with our objectives, we report performance using AUROC.\n    \n**[W5, W6] Eq (13): I think you have an extra \"exp\". L291: I think the $\\epsilon\\%$ should only be $\\epsilon$.** We have fixed the typos in our updated draft.\n    \n**[W7] I would expand a bit more in how did you use the evidence function.** Following the reviewer's suggestion and to help our readers, we added further details on how CLIP is used as an evidence function, which was previously in our appendix.\n    \n**[Q2] How would you use this technique in a real-world scenario?** The approach presented in our current draft requires access to the full unlabelled test set to compute the outlier probability. Thus, it cannot be applied in online settings. However, we provide an alternative approach to applying EPHAD, which does not require converting the anomaly score to outlier probability for non-density-based methods. Consequently, EPHAD can be applied in an online setting, provided the evidence function can be computed sample-wise, such as when using CLIP or rule-based evidence functions. The alternative version of EPHAD is summarised below:\n    \nGiven an AD model trained on the contaminated dataset, we denote the anomaly score for a data point $x$ as $ s^-_u(x) $. Then, we can compute the inlier score as $ s^+_u(x) = - s^-_u(x) $. Considering $ s^+_u(x) $ as prior and an auxiliary evidence function $T(x)$, EPHAD computes the revised score $ s^+_c(x) $ using exponential tilting. It is a technique used to adjust a PDF by ``tilting'' it toward a specific outcome. Recall that the inlier score is an order-preserving transformation of the inlier PDF, i.e., $ s^+(x) = \\phi(f^+_X(x)) $ where $\\phi$ is a transformation function, e.g. log-likelihood. Thus, given a score-based AD model that learns $s^-_u(x)$, tilting increases the relative scores of the normal samples over the anomalous samples, steering the model toward an outcome supported by the evidence function. We first exponentiate the inlier score $ s^+_u(x) = - s^-_u(x) $ to ensure non-negativity. Then, we rescale $T(x)$ with a temperature parameter $\\beta$ and exponentiate it. Finally, the revised inlier score is computed as:\n\n$$s^+_c(x) = \\exp(s^+_u(x))\\exp(T(x)/\\beta).$$\n\n[1] Wang et al., \"Tent: Fully test-time adaptation by entropy minimization.\" ICLR 2021.  \n[2] Xiao et al., \"Beyond model adaptation at test time: A survey.\" ArXiv 2024.  \n[3] Fang et al., \"Source-free unsupervised domain adaptation: A survey.\" Neural Networks 2024.  \n[4] Perini et al., \"Estimating the contamination factor’s distribution in unsupervised anomaly detection.\" ICML, 2023.  \n[5] Perini et al., \"Transferring the contamination factor between anomaly detection domains by shape similarity.\", AAAI, 2022.  \n[6] Hendrickx et al., \"Machine learning with a reject option: a survey.\" Machine Learning, 2024."}, {"review_id": "TZ3Nkq8p4f", "reviewer": "Reviewer_qm8P", "summary": "This paper focuses on anomaly detection under data contamination. Through an evidence function, this paper proposes EPHAD, an inference-time adaptation framework that updates the outputs of AD models trained on contaminated datasets using evidence gathered at inference. Experiments are conducted on several popular datasets and show good performance.", "questions": "See the weakness. The concerns are mainly from the design of the evidence function.", "limitations": "See above.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "1. The design of the Evidence Function constitutes the most critical part of the paper and decisively influences the results. However, the main text downplays this aspect. After reading the entire paper, it remains unclear how the Evidence Function was designed. This design should be discussed in detail as a central component of the main text.\n2. The supplementary materials describe the Evidence Function, revealing a severe contradiction in the paper's methodology. CLIP inherently supports zero-shot anomaly detection (e.g., WinCLIP [a], MVFA [b]), which is unaffected by contamination in training data. This suggests the authors merely combined methods that inherently ignore anomalous noise. Moreover, no experimental comparison was made with these CLIP-based approaches.\n3. Does using CLIP as the Evidence Function introduce data leakage? For instance, WinCLIP excels on MVTec but underperforms on datasets like MPDD. This is reflected in Table 1: when EPHAD is combined with RD and ULSAD, performance on MPDD deteriorates compared to not using EPHAD at all. Also, how EPHAD performs when it is used on datasets in other domains, such as medical data used in MVFA.\n4. The Introduction claims that existing methods rely on 'the contamination ratio.' However, these papers never mention such a ratio. Some use hyperparameters to set the proportion of anomalous noise removal, but this proportion ≠ the contamination ratio. Experiments confirm these hyperparameters minimally affect results, contradicting the authors' overstated dependency claims.\n\n[a] WinCLIP: Zero-/Few-Shot Anomaly Classification and Segmentation. CVPR 2023.\n[b] Adapting Visual-Language Models for Generalizable Anomaly Detection in Medical Images. CVPR 2024.", "was_revised": true, "final_justification": "Thank you for the response. As the authors have addressed all my concerns, I will raise my score to accept.", "rebuttal": "We thank the reviewer for their constructive feedback. We address the reviewer's concerns in the points below.\n\n**[W1] It remains unclear how the Evidence Function was designed.** In our current draft, we provide additional details on the evidence functions in Appendix B.3. Notably, while EPHAD can incorporate evidence from foundation models like CLIP, it also allows the seamless integration of domain-specific knowledge. To demonstrate this versatility, we have shown CLIP as evidence for image-based experiments and LOF as evidence for tabular datasets. Furthermore, in the appendix, we have shown domain-specific rules as evidence. For this, we examine the AD method, forecastAD, for thermal images introduced by [1] and compare the performance of forecastAD with and without EPHAD under $10\\%$ contamination. The results presented in Table 5 of our current draft show that while forecastAD experiences a performance drop of approximately $5\\%$, incorporating domain-specific rules R1 and R2, as outlined in [1], provides evidence for EPHAD, which recovers about $2.5\\%$ of the lost performance. Moreover, we show this generality beyond image data by applying EPHAD to tabular datasets using traditional AD methods such as LOF and Isolation Forest as the evidence function.\n\n**[W2, W3] CLIP inherently supports zero-shot anomaly detection (e.g., WinCLIP [a], MVFA [b]), which is unaffected by contamination in training data. Does using CLIP as the Evidence Function introduce data leakage?** While CLIP has been employed in prior work for zero-shot anomaly detection, our approach does not rely on CLIP as a standalone anomaly detector. Instead, we leverage its image-text matching capabilities to provide auxiliary evidence that is integrated within a broader and more flexible framework. It is also worth highlighting that foundation models like CLIP are not applicable in specialised applications such as the detection of anomalous behaviour in solar power plants due to the lack of semantic content in thermal images. This makes zero-shot methods like WinCLIP and AnoCLIP inapplicable. In contrast, while EPHAD can incorporate evidence from foundation models like CLIP, it also allows the seamless integration of domain-specific knowledge as shown in Appendix C.1 of our current draft. This makes our framework more adaptable and broadly applicable across domains.\n\nFor the experiments on image-based datasets, we adopt CLIP as used by the authors of WinCLIP, following their zero-shot detection setup (not segmentation). The exact implementation details, including the prompts used, are provided in Appendix B.3.1 of our submission. Thus, in our results, the baseline CLIP performance reflects the standalone performance of WinCLIP. Our method shows the gains achieved when integrating CLIP-based evidence with a base AD model using EPHAD.\n\nLastly, unlike MVFA, we do not fine-tune the CLIP model. To apply EPHAD in the medical domain, we can use any SOTA AD methods as the base detector with the finetuned CLIP or any other domain-specific evidence function.\n\n**[W4] The Introduction claims that existing methods rely on 'the contamination ratio.' However, these papers never mention such a ratio.** While it is true that many existing AD methods that operate under contamination do not explicitly assume knowledge of the exact contamination factor, they often rely, either directly or indirectly, on having a reasonable approximation of it for effective performance. For instance, in [2], the contamination factor $\\alpha$ is treated as a hyperparameter that \"characterizes the assumed fraction of anomalies\" in the training data. The authors further provide a sensitivity analysis (Figure 3), which clearly demonstrates that performance degrades significantly, especially for LOE-Hard, when the assumed value deviates from the true contamination level. Similarly, in [3], the threshold $\\gamma$ is introduced for refining the contaminated training set. In Section 3.3, the authors note that their method (SRR) remains robust as long as $\\gamma$ is selected from a **reasonable range**, which they define as 1 to 2 times the true anomaly ratio. This again suggests that their method implicitly depends on a rough estimate of the true contamination level for optimal results. Therefore, while these works may not rely on the exact contamination factor, they do depend on having a reasonable approximation.\n\n\n[1] Patra et al., \"Detecting Abnormal Operations in Concentrated Solar Power Plants from Irregular Sequences of Thermal Images.\" KDD, 2024.  \n[2] Qiu et al., \"Latent outlier exposure for anomaly detection with contaminated data.\" ICML, 2022.  \n[3] Yoon et al., \"Self-supervise, Refine, Repeat: Improving Unsupervised Anomaly Detection\" TMLR, 2022."}, {"review_id": "31Hh521SJM", "reviewer": "Reviewer_qVBz", "summary": "This paper proposes a test-time framework to adapt the scores learnt by anomaly detection models trained on contaminated training data using Bayesian inference. The method is tested on a variety of AD datasets and shows consistent improvement over anomaly detection performance with the base anomaly scores.", "questions": "How does this approach differ from and compare with other methods which address data contamination in anomaly detection?", "limitations": "Limitations are addressed but are fairly surface-level.", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The motivation for the methodology is well explained and clear.\n\nThe experiments are comprehensive across a wide variety of datasets, of different modalities and contexts (synthetic, tabular, image, industrial) and across a variety of base AD methods.\n\nThe methodology shows consistent and noticeable improvement in AD performance. \n\nNo significant weaknesses to mention, except the authors could make more of an effort to provide context for this methodology within AD research. What other similar methods have been taken along this approach? How does this methodology improve upon those?", "was_revised": true, "final_justification": "I am satisfied with the authors original paper as well as subsequent rebuttal.", "rebuttal": "We thank the reviewer for their constructive feedback. We are happy to note that the reviewer finds our proposed method well motivated, clearly explained and empirically effective in improving AD performance. We address the reviewer's concerns in the points below.\n\n**[W1, Q1] How does this approach differ from and compare with other methods which address data contamination in anomaly detection?** While we acknowledge prior work on anomaly detection with contaminated data, to the best of our knowledge, no existing framework offers post-hoc adaptation in the same manner as EPHAD. Unlike previous methods, EPHAD does not require access to the pre-trained anomaly detection (AD) model’s weights or training pipeline, making it fundamentally different in its approach. Our primary focus in the experiments is to demonstrate the effectiveness, versatility, and applicability of EPHAD, a simple yet powerful Bayesian inference-based framework, by evaluating its relative performance against the pre-trained model and the evidence function in isolation.  \n    \nNonetheless, for completeness, we have compared EPHAD to two existing frameworks: ``Refine'' [1] and Latent Outlier Exposure (LOE) [2], as reported in Table 2 of our paper. While Refine iteratively identifies and removes anomalies during training, LOE incorporates identified anomalies using a contrastive loss. \n\n[1] Yoon et al., \"Self-supervise, Refine, Repeat: Improving Unsupervised Anomaly Detection\" TMLR, 2022.  \n[2] Qiu et al., \"Latent outlier exposure for anomaly detection with contaminated data.\" ICML, 2022."}]

Author rebuttal:

Meta-review: This paper addresses the important problem of anomaly detection under contaminated training data by introducing a novel Bayesian test-time adaptation framework, demonstrating strong versatility and effectiveness across diverse models and datasets. Its strengths lie in the practical motivation, sound methodology, and comprehensive experiments confirming consistent improvements. However, reviewers raised concerns about threshold selection, computational efficiency, evidence function design, and the use of the test set, questioning some aspects of the empirical validity. The rebuttal successfully addressed most concerns, and all reviewers expressed positive evaluations. I recommend acceptance, with the expectation that final revisions incorporate reviewer feedback.
Decision: Accept (spotlight)