Scalable, Explainable and Provably Robust Anomaly Detection with One-Step Flow Matching
Authors: Zhong Li
Qi Huang
Yuxuan Zhu
Lincen Yang
Mohammad Mohammadi Amiri
Niki van Stein
Matthijs van Leeuwen
Venue: NeurIPS 2025 poster ()
Keywords: Anomaly Detection
Outlier Detection
Primary area: general_machine_learning

Abstract: We introduce Time-Conditioned Contraction Matching (TCCM), a novel method for semi-supervised anomaly detection in tabular data. TCCM is inspired by flow matching, a recent generative modeling framework that learns velocity fields between probability distributions and has shown strong performance compared to diffusion models and generative adversarial networks. Instead of directly applying flow matching as originally formulated, TCCM builds on its core idea—learning velocity fields between distributions—but simplifies the framework by predicting a time-conditioned contraction vector toward a fixed target (the origin) at each sampled time step. This design offers three key advantages: (1) a lightweight and scalable training objective that removes the need for solving ordinary differential equations during training and inference; (2) an efficient scoring strategy called one time-step deviation, which quantifies deviation from expected contraction behavior in a single forward pass, addressing the inference bottleneck of existing continuous-time models such as DTE (a diffusion-based model with leading anomaly detection accuracy but heavy inference cost);
and (3) explainability and provable robustness, as the learned velocity field operates directly in input space, making the anomaly score inherently feature-wise attributable; moreover, the score function is Lipschitz-continuous with respect to the input, providing theoretical guarantees under small perturbations. Extensive experiments on the ADBench benchmark show that TCCM strikes a favorable balance between detection accuracy and inference cost, outperforming state-of-the-art methods—especially on high-dimensional and large-scale datasets. The source code is provided at https://github.com/ZhongLIFR/TCCM-NIPS.

Scalable, Explainable and Provably Robust Anomaly Detection with One-Step Flow Matching
Zhong Li Qi Huang
Yuxuan Zhu
Lincen Yang + (c
Mohammad Mohammadi Amiri*
Niki van Stein
Matthijs van Leeuwen*
The Leiden Institute of Advanced Computer Science (LIACS)) Leiden University Department of Computer Science, Rensselaer Polytechnic Institute
The Intelligent Computing Research Center, Great Bay University
Corresponding Author (I2): 1. L.yangeliace leidenuniv..... n1 (Lincen Yang)
Abstract
We introduce Cone-Conditioned Contraction Matching (TCCM), novel method for semi-supervised anomaly detection in tabular data. TCCM is inspired by flow matching, recent generative modeling framework that learns velocity fields be- tween probability distributions and has shown strong performance compared to diffusion models and generative adversarial networks. Instead of directly applying flow matching as originally formulated, TCCM builds on its core idea idea-learning velocity fields between distributions but simplifies the framework by predicting a time-conditioned contraction vector toward a fixed target (the origin) at each sampled time step. This design offers three key advantages:
(1) lightweight and scalable training objective that removes the need for solving ordinary differ- ential equations during training and inference; (2) efficient scoring strategy called one time-step deviation, which quantifies deviation from expected con- traction behavior in a single forward pass, addressing the inference bottleneck of existing continuous-time models such as DTE (a diffusion based model with leading anomaly detection accuracy but heavy inference cost); and (3) explain- ability and provable robustness, as the learned velocity field operates directly in input space, making the anomaly score inherently feature-wist attributable; moreover, the score function is hipschitz-continoon providing theoretical guarantees under small perturbations. Extensive experi- ments on the ADBench benchmark show that TCCM strikes favorable balance between detection accuracy and inference cost, outperforming state-of-the-arr meth- ods eddecialllll on high-dimensional and large-scale datasets. The source code is provided hhttps: // gi thub. com/ comm/ZooggLLF//TOMMMMMT3
with respect to the input,
Introduction
Background. Anomaly detection in tabular data is the task of identifying data instances (or patterns) that deviate significantly from expected behavior (Chandola et al. 2009 Aggarwal and Aggarwal 2017a| Pang al.) 2021). It has found widespread applications in various domains, such fraud detection in finance (Hilal et al. 2022), fault detection in manufacturing (Yu and Zhang 2023). intrusion detection in cybersecurity (Chou and Jiang] (202). and medical diagnosis in healthcare (Fernando et al.] 2021). In these high-stakes domains, data is growing rapidly in both size and dimensionality, calling for approaches that are not only effective but also scalable. Equally important, decisions made in these settings often have critical consequences, making interpretability an ethical and regulatory necessity (Li et al. 2023). Therefore, anomaly detection methods should also be able to provide meaningful explanations alongside accurate predictions.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Positioning our work. Existing anomaly detection methods can be broadly categorized into classical machine learning approaches and deep learning- -aseed techniques. Classical methods- suchhsuchee as OCSVM (Schölkopf et al. 1999). LOF (Breunig et al. 2000), PCA (Shyu et al. 2003). and KDF (Latecki et al., ) often struggle with high-dimensional data due to the curse of dimensionality, and with large-scale datasets due to limited computational scalability. To address these limitations, deep learning-bar based anomaly detection methods have gained research attention and achieved strong performance across various domains (Pang et al. 2021). Deep methods can be grouped into two categories: (1) two-stage approaches, which first learn a low-dimensional representation (e.g., via an autoencoder) and then apply off-the-shelf anomaly detectors. However, such decoupled training features due to the lack of joint optimization (Nguyen and Vien 2019); and (2) end-to-end trained approaches, which integrate representation learning and anomaly detection into a unified training objective, achieving better performance. Meanwhile, given that labeled anomalies are both scarce and expensive to obtain in many real-world applications-succh as system failures, fraud, or clinical anomalies- many existing methods, both classical and deep, adopt a semi-supervised setting. In this paradigm, models are trained solely on normal data and tasked with identifying deviations at test time. Although claimed as unsuperviseed in some studies (Goodge al.] (2022), we rigorously refer to this setup as semi-supervised anomaly detection following An and Cho (2013); Ruff et al. (2018); Akcay el al. (2018); Bergman and Hoshen (2020). Our work is situated within this setting, adopting a deep end-to-end, and semi supervisee approach that learns the structure of normality during training and identifies deviations at inference.
strategies often struggle to learn
Limitations of Existing Studies. Despite recent advances in end-to-end deep anomaly de- tection, many existing approaches face fundamental limitations. Adversarial models such as AnoGAN (Schlegl et al.] (017) and GANomaly (Akcay al., (018) often suffer from training insta- bility due to their reliance on min-max optimization. Density- based methods like DAGMM (Zong) ct al. 2018) introduce complex architectures approximate latent distributions. Diffusion-based approaches such as Anomaly-DDPM and DTE (Livernoche et al., 2023) may depend heavily on carefully tuned noise schedules and sampling hyperparameters: in practice, they also suffer from extremely slow inference on scage-scale datasets due to their iterative nature. Normalizing flows (e.g., OneFlow (Maziarka et al. 202I)) require invertibility and Jacobian computations, leading to trade-offs between model expressivity and computational efficiency. LUNAR (Goodge et al. 2022). which employs graph neural networks capture relational structures, incurs high training costs and scales poorly with data size. Methods such as DeepSVDD (Ruff et al. 2018). which focus on compact representation learning, rely on restrictive architectural constraints (e.g., no biases, bounded activations) to avoid representation collapse, and often depend on numerous training heuristics to deep models offer little insight into why sample is considered anomalous. While a few methods have made progress in this direction- e.g., AE-ISVM (Nguyen and Vien 2019) using gradient-baser attribution, ICL (Shenkar and Wolf 2022) identifying key contributing features, MCM (Yin et al., 2024) modeling both feature-Ievel abnormality and inter-feature correlations, and DTE (Livernoche al. 2023) providing denoised reconstructions explanations- such interpretable designs remain the exception rather than the norm. The vast majority of deep anomaly detection models continue to operate as black boxes, limiting their utility in high-stakes domains where interpretability is critical.
yield satisfactory results. Another major limitation lies in the lack of interpretability
Flow Matching. Flow matching has emerged as a promising generative modeling framework that retains the training stability and expressivity of diffusion models, while offering improved computational efficiency (Liu et al. 2022 ( Lee et al. 2023). Instead of relying on stochastic differential equations (SDEs), it learns an ordinary differential equation (ODE) that deterministically maps samples from a source to a target distribution, enabling faster sampling and easier optimization. Flow matching also bypasses the need for forward noising process and explicit density functions, making it well-suited for settings with implicit or intractable data distributions (Albergo and Vanden-Eijndenn 2023, CSAIL 2024). Its interpolant formulation further allows empirical analysis of learned velocity fields over time (Albergo and Vanden- Fijjdenn 2023). enhancing interpretability for downstream tasks. Despite its recent success in generative modeling, flow matching has not been explored for anomaly detection as of this writing, to the best of our knowledge.
Following common practice in the machine learning community, we use the term "deep" to indicate deep learning- based, end-to-end models, even when the employed neural architecture is relatively shallow (c.g.. multi- layer perceptron with two hidden layers).
2

---

Contributions. Motivated by the limitations of existing deep anomaly detection methods and benefiting from recent advances in generative paceedingg-attcuaaaryy flow matching- introduce Time- Lime-Conditionel Contraction Matching (TCCM), a novel flow matching-inspires approach for semi-supervised anomaly detection. Specifically, TCCM learns a time-conditioned velocity field that contracts normal data, drawn from source distribution Psouree towards a degenerate target distribution Prrgett defined as a Dirac delta at the origin. Unlike previous approaches that simulate full continuous trajectories via ODE or SDE integration, TCCM avoids trajectory simulation entirely by directly learning a velocity field that approximates contraction dynamics from any input point at any time (details are described in Section B) At test time, samples are scored based on how much their predicted velocity field deviates from the expected contraction pattern- an idea illustrated in Figure This mismatch in velocity magnitudes and directions forms the basis of our anomaly score. TCCM inherits the scalability and simplicity of flow matching (Liu et al., 2022), and is trained using an unconstrained least-squares objective. It avoids adversarial instability (as in AnoGAN (Schlegl et al. 2017), GANomaly (Akeay et al. (018)), complex density modeling (as in DAGMM Zong et al.
inference (as in DTE (Livernoche) et al. ). Unlike normalizing flows (Maziarka et al. (021). it requires neither invertibility nor Jacobian computation, and unlike DeepSVDD (Ruff' al.) 2018), does not rely on restrictive architectural constraints to avoid collapse. Furthermore, compared to graph-based methods like LUNAR (Goodge al. 2022), TCCM achieves significantly faster training on large-scale datasets. Crucially, TCCM is inherently interpretable its velocity field lives in the input space, supporting feature-wise wise attribution- and provably robust, with a popschitzzcontinnee anomaly score under small input perturbations.
2018) KDE (Latecki et al.) 2007)), and slow sampling-basee
Findings. We evaluate TCCM on 47 benchmark datasets from the ADBench suite (Han al. 2022), comparing it against 44 baseline methods (23 deep learning- based and 21 classical), for a total of 10,575 runs across five seeds. Our results demonstrate five key strengths: (1) Accuracy: TCCM achieves top-1 performance in both AUPRC and AUROC scores (see Appendix B.4] for definitions) across all evaluated methods (see Figures Tigures[2aandd and 2b 2b for aggregated results). (2) Scalability: The model is highly efficient in both training and inference on high-dimensional and large-scale (top-2 in AUROC and AUPRC), and 85x faster inference than LUNAR (top-3 in both metrics), while maintaining superior detection performance (see Figure Baj (3) Explainabilityy TCCM enables feature-level attribution for anomaly scores, supporting interpretable diagnosis an aspect largely absent in existing deep anomaly detection models (see Figure (4) Robustness: We theoretically prove that the anomaly score satisfies a Lipschitz continuity condition, offering provable robustness guarantees under input perturbations (see Proposition[] D]. (5) Simplicit of training: TCCM requires no adversarial it simple to train, stable to optimize, and easy
datasets accieving, on average. 1573x faster inference than DTE-NNoPPaammette
losses, density estimation, or noise schedules-man to reproduce (see Eq, 4.. Together, these findings establish TCCM as a principled, highly effective, scalable, explainable, and provably robust solution for semi- supersupee anomaly detection in tabular data.
Preliminaries
Due to space constraints, we defer a detailed discussion of related work-including anomaly detection methods and flow matching- to Appendix A, and begin with general problem statement.
2.1 Problem Statement
Notations. Bold lowercase letters (c.g., x) denote vectors; bold uppercase letters (c.g., X) represent matrices. Calligraphic symbols (c.g.. X²) denote sets, and standard italic letters (c.g., x)) are used for scalars, unless otherwise specified. Besides, these symbols may be used to denote both random variables and their realizations; this dual use is common in the machine learning literature and will be made explicit whenever necessary.
Problem Setting. We consider semi-supervised anomaly detection scenario, where only normal samples are available during training. Let X = { C Rd be dataset of d-dimensional observations, partitioned into training set Xrmin containing only normal instances sampled from an unknown distribution Pima (zz), and test set X that may include both normal and anomalous samples.
3

---

Problem (Semi-Sune Suserviepee Anomaly Detection), Given access to normal training data Xarain C R., the goal to learn an anomaly scoring function S Re + R that quantifies the deviation of any test inpul i: E Nest from the learned notion of normality.
To solve this problem, we aim to learn the structure of normal data using only unlabeled normal instances. At test time, deviations from this learned structure are quantified and assigned anomaly scores, allowing the detection of abnormal inputs without access anomalous data during training.
2.2 Recap of Flow Matching
Flow matching (or stochastic interpolant) (Lipman et al., 2022
Albergo and Vanden-Eijnden 2023
Liu et al. 2022) provides principled and flexible framework for learning neural ODE-based transport maps between two empirical distributions. Given samples from a source distribution Dy ~ Pu and target distribution æ1 P1. the goal is to learn a dime-dependent velocity field v( t) such that
the following ODE governs the evolution between the two: dæ, = v( t)dt for E [0. 1]. This Lagrangian formulation describes the motion of particles from 2o to I1, implicitly defining the coupling π (Po,P) between the distributions. The velocity field is parameterized as (2 1) via a neural network and trained to match a reference velocity field using simple least-squares objective:
min R.,, [10( 1) - vo (2 1)
Different choices of interpolation path x, and reference velocity v v(æ,, 1) give rise to different flow matching models. A widely used class of methods adopts the probability flow ODE formulation (Song et al. 2020), where the velocity incorporates the score function V log Pt and corresponds to deterministic trajectory derived from an underlying SDE. In this case, the path is often defined via a variance-preserving schedule:
Dt = a, + V os æ1. with a₁ = exp (
B(s) ds
where (s)) is pre-defined noise schedule that controls the rate of variance increase over time. This form allows equivalence to score matching under certain conditions (Lee al. 2023 Zheng et al.. 2023), and is popular in diffusion-based generative models. However, the resulting curved trajectory can complicate optimization and slow down sampling (Liu et al. 2022).
To address these issues, Liu et al. (202)) have proposed a constant velocity ODE approach, where the interpolation path is simply linear: x; (1 I)arg + lær In this case, the reference velocity becomes a constant vector 1 2o, and the flow matching objective reduces to:
min Er, ||=] zo vy (xx, 1]]
(2)
This variant known as the rectified flow model, and has been shown to improve training efficiency and reduce curvature in the learned trajectories. facilitating both forward simulation and backward sampling. Our proposed method builds on this formulation, leveraging its simplicity and scalability while adapting it for the anomaly detection setting.
3 Methodology: Time-Conditioned Contraction Matching (TCCM)
Core idea. Conventional flow matching models (Lipman et al., 2022 Liu et al. 2022 construct continuous-time trajectories that gradually transport samples from a source distribution (at / = 0) to a target distribution (at f = 1) by integrating a learned velocity field over the entire time interval. In contrast, our method departs from this paradigm both conceptually and technically. Rather than relying on the full trajectory across time to learn the transformation, we directly learn a contraction vector field at each time step-one that immediately points from the current position to the fixed target (the origin). This allows the model to predict the contraction behavior independently at each time point, avoiding the need for simulating or reconstructing the full flow path. This provides powerful yet simple framework for anomaly detection: every point learns how to contract back to the origin over time, which motivates the name
Contraction Matching (TCCM).
Formally, we treat the data distribution as the source, 2g := 2 ~ Paata and consider the target as degenerate Dirac distribution at the origin, ø := 0. While this setup may suggest a flow-like

---

interpretation, we emphasize that our model is not tasked with approximating the full solution of a dynamical system such as:
with = =00) 2; -
whose analytical solution would be =(1) = eee However, our model does not supervise or simulate z(1) across time. Instead, we adopt a simplified training strategy that uses a constant target direction -2 for supervision at all time steps. To achieve this, we learn a neural velocity field Se (-) on an augmented space ă = [z; Em)ed Specifically, (-) is conditioned on both the input z and a time variable E [0, 1]. The time is encoded using sinusoidal embeddings ( (Vaswani et al. 2017), which are concatenated with the input: ă = [2; (t)) and passed through the model Je to predict contraction vector.
Faints before Rowin
Pornts before Flowing
Points before Fowiing
& Bugin
Flowiig wwwrring Vector Fells
Fowingg acconding Vecto Reids
Fowing acconding to Weter Ri
Atomal Zore
XXX
25
21
-01
0.2
Figure 1: Core idea of TCCM: TCCM learns a time-conditioned velocity (vector) field that contracts normal data points, sampled from a source distribution Psouree. towards a degenerate target distribution Prarget, defined as Dirac delta at the origin. At test time, anomalies are detected by measuring inconsistency with this learned contraction field. Illustrative examples: We visualize TCCM behavior on synthetic 2D datasets with varying normal (circles) and anomalous (squares) distributions. Left: Normal data form a ring; anomalies are sampled from a central Gaussian. Middle: Normals follow an upper moon; anomalies form sparse lower moon. Right: Normals are clustered bottom- left; anomalies are drawn from a distinct Gaussian in the top-right. In all cases, TCCM successfully distinguishes anomalies based on their deviation from the expected contraction vector.
Training Objective. The training minimizes the following loss:
min E R
([2; Eg (00,) Embed(1)) + = =112]-
Optimizing objective 4 encourages the model to predict a velocity vector that approximates the negation of the current state, i.e ([z: (t)) = z. This guides the system evolve toward the origin by learning both the direction and magnitude of motion in a time-dependent manner. To achieve this, the neural velocity field is required to extract the common factors of variation present in normal data. As a result, normal samples following their predicted velocity fields can approach the origin at any given time, while anomalous instances, due to their deviation from the learned structure, fail to do so. The pscudocode for training is given in Algorithm in Appendix B.5
Interpretation and Motivation. Although not derived from an explicit ODE, our method can be viewed as learning time-aware vector field that approximates the contraction dynamics toward shared target. This formulation provides several advantages: (1) Time-Condee Conditioned Consistency: The model learns to predict contraction vectors across time steps that consistently guide inputs toward the origin, promoting geometric alignment and stability; (2) Simplisied Supervision: Using a fixed supervision target- -z removes the need for trajectory supervision, leading to simpler and smoother optimization process; (3) No ODE Solvers Required: Unlike conventional flow-based models, TCCM avoids numerical integration during both training and inference, resulting in substantial computational
5

---

efficiency; (4) Learnable Temporal Dynamics: Sinusoidal time embeddings allow the model to modulate both the magnitude and direction of contraction vectors over time, enabling rich, non-linear temporal behavior.
Anomaly Scoring at Inference Time. Given test input E Kies and fixed evaluation time Uixxe E (0, 1]. we define the anomaly score as:
Sixed 22; frxee) = Ilfo ([z; Embed(( + += =112
(5)
where [2; Embed(())) denotes the learned velocity field conditioned on both the input feature # and the time variable t, encoded via sinusoidal embeddings and concatenated with & before being passed into multilayer perceptron (MLP). This scoring strategy is grounded in the following expectations: (1) Normal instances are trained to follow a contraction path toward the origin. Since supervision is based on a constant target- across all time steps, well-aligned normal sample satisfies fo([2; (t]) ~ -2, leading to a small residual norm. (2) Anomalous instances, which deviate from the learned contraction pattern, yield misaligned velocities and hence higher residuals. (3) This approach is computationally efficient, as it avoids solving ODEs and requires only a single forward pass through the network a chosen time step (ixed. which overcomes the primary bottleneck of high evaluation cost found in existing continuous-time ODE/SDE models such as Anomaly-
DDPM (Livernoche et al. 2023) and DYTE--Nomarrmmetiic (Livernohhe et al. 2023). (4) Importantly,
because the residual vector [e([z; (mbed(tasea)) + x lies in the original feature space, the absolute values of its entries directly quantify how much each feature contributes the anomaly score. This
provides intrinsic feature-level interpretability, in contrast to post-hoc explanation methods such as SHAP (Lundberg and Lee. 2017) and LIME (Ribeiro et al. 2016).
We refer to this anomaly scoring procedure as one-step flow matching because, unlike classical flow matching models that integrate velocity fields across time to compute transformation paths, our method makes a single-time-pint evaluation to determine alignment with the learned contraction dynamics. While the underlying model is termed TCCM, this scoring mechanism captures the spirit of flow
learned dynamics to an ideal contraction vector- yet does so in a highly scalable one-step formulation. Although the evaluation time fixed in Bq can be any value in (0, 1J. we set faxed 1 by default throughout our experiments for simplicity. Particularly, we provide a sensitivity analysis (see Figure [3) showing that the anomaly detection performance is largely stable across different values of f, validating the temporal consistency of the learned flow field and its ability to produce meaningful predictions at any time step. The pseudocode for inference is
given in Algorithm in Appendix B.5
4 Theoretical Properties of TCCM
In this section, we establish two key theoretical properties of our method: (i) Lipschitz continuity of the anomaly score, which leads to provable robustness guarantees under input perturbations; and (ii) discriminative behavior of the score function under distributional shift, explained via a stylized Gaussian mixture setting. These results offer both certifiability of robustness and theoretical insight into the score function's 's discriminative behavior, complementing our empirical findings.
Proposition 1 (Lipschitz Continuity and Robustness). Let ((sed) be L-Lipschitz continuous in its first argument (for fixed time tjxed E (0, 1)). Then the anomaly score
Sjised (x)) == Il ([æ; Embed(()uea)) + æ=12
is (L + 1)-Lisschitz continuous with respect to æ, i.e.,
SSpee(Dr)) - Sjaned S (L + 1)]la0 - 22/122
Proof. Define g(x) fo (1x; Embeed w. Then:
(19(1))9(<))) || < fl ([x1; (fmbee(t)))=fe(leee (mn)ee)(((( -02122 I (L+1) -xell2 Finally, since the lg norm 1-Lipschitz, we have (x1)) Stxee S (1g(x1) g(#2)l12- D
Remark and Implications. The assumption that fo(: ((xed) is I Lipschitz is both theoretically and practically reasonable. In continuous normalizing flows (CNFs) and flow-matching models, such smoothness is often required to ensure existence and uniqueness of solutions (via Picard-Lindelät

---

theorem (Murray and Miller 2013)) or to stabilize ODE solvers. More specifically, the function fe is implemented as a multilayer perceptron with ReLU activations and a fixed architecture, making piecewise linear and hence Lipschitz continuous, The Lipschitz constant I. can be further controlled through spectral normalization, gradient penalties, or other regularization techniques. Moreover, this proposition has the following two implications:
(1) robusiness: the score is stable under small perturbations, enhancing reliability in noisy or adversarial environments; and (2) certifiability: the bound implies that [s 6) S(x) I (L + 1) if ||0|| providing certifiable safety margin.
To theoretically support the discriminative power of our anomaly score, we analyze an idealized setting where normal and anomalous instances are drawn from two disjoint Gaussian mixture models (GMMs) with shared isotropic covariance. Although simplified, this setup enables a clean analysis of how the learned score function behaves on out-of of-distribution samples. Under the assumption that the model has learned a noisy contraction field of the form fo (a:; Embed(1))) = x + for normal training data, we establish the following result:
Proposition 2 (Discriminative Power under GMM-to-GMM Shift). Let normal samples be drawn from Gaussian mixture Pnormal (z) = > Tr (M,,, I2), and anomalous samples from disjoint mixture Panom (z) -E== 77s (V La), with vs & { 1 Assume the learned con- traction field satisfies fo (ar; (mmbe((1)) - tE, where ~ ~N La));; and the learned velocity field is mismatched for anomalies. Define the anomaly score: S(z) = [o Embed(1))) + +Ø112
J.f
||e||2- Then, it holds that: for normal samples, S(x:) ~ XX oy, and [[S(z)) =0, V2 r( 41)
(2) for anomalies, let Xa -M where r*)s) == arg || 12ll2, we have
of
S(z) ~
> 8 -==1 73 Xa(Aa); and (3) the expected anomaly scores of normal and anomalous instances satisfy: [[S(2)] > E[S(z)]. This implies that our score function assigns. in expectation. higher
founddatoi values to anomalies than to normal pprovidng a theoretical foundation for its discriminative capability.
The proof, provided in Appendix C.2
shows that the anomaly score corresponds to the norm of central chi-distributed variable for normal samples and non-central chi-distributed one for anomalies. The non-centrality parameter captures the squared distance between each anomaly and the closest normal-mode center, leading to systematically larger scores.
Implications. This result provides a theoretical lens into why our anomaly score increases for distributional outliers. Even though real-world data may not exactly follow Gaussian mixtures, the underlying intuition persists: samples that deviate from the structure captured by the contraction field naturally assigned larger residuals.
In addition, Appendix CK further analyzes the model's representation dynamics and verifies that
TCCM avoids degenerate or collapsed mappings in practice, complementing the above theoretical guarantees with empirical evidence of stable and discriminative behavior.
5 Experiments
We conduct comprehensive experiments address the following research questions: (1) Effective- ness-Can TCCM outperform existing baselines in anomaly detection? (2) Scalability-Hov does TCCM compare to the strongest baselines in detection accuracy in terms of training and inference efficiency? (3) Explainability -Are the explanations generated by TCCM intuitive and meaningful to human users? (4) Ablation Studies and Sensitivity Analysis How do various design choices impact the performance of TCCM?
5.1 Experiment Setup
Datasets Description and Processing. (1) Dataset Description: A summary of the datasets used in our study is provided in Table I We adopt 47 benchmark datasets from the well-established ADBENCH benchmark (Han et al. 2022), spanning diverse domains including sociology, finance, linguistics, physics, and healthcare. To enable a comprehensive evaluation of different anomaly detectors, including our proposed method, we categorize the datasets into four groups based on their scale and dimensionality: (a) High-dimenssooall datasets, with more than 50 features; (b)
7

---

Large-scale datasets (but not high- sigh-dimensiona),, containing more than 10,000 instances and fewer than 50 features; (c) Medium-scall datasets (not nigh-dimensional), with 1,000 to 10,000 instances; and (d) Small-scale datasets (not nigh-dimensiona),, containing fewer than 1,000 instances. This categorization facilitates nuanced analysis of model performance across varying data regimes. (2) Data Processing: We adopt a semi-supervised anomaly detection setting, where models are trained solely on normal instances. Specifically, we apply a stratified split to the normal data, using 50% for training and holding out the rest for testing. The test set includes both normal and anomalous samples. All features are standardized using a StandardScaler (Pedregosa et al., 201T)) fitted on the training data (see Figure 16 in Appendix D.3 for an ablation study the effect of feature normalization). This protocol is consistent with common practices in anomaly detection (e.g., (Zong et al. 2018
|Begmman and Hoshen 2020 [Shenkar and Wolf 2022
Yin et al. 2024) and ensures fair evaluation.
Type
Loaming
40
80
Rank
20
TOCM (Cun))
OTEKopPonn LUNAR
Autufroeddr Grodder
op
DT PrEcAtegeios
Glddd
DTE Baseetan
DTE GrEevereGGannn
Sampling
FiatorBary ping
MCM
AE 1S1e
AD
IFomdt
Hacio
MDD
Aneciay
DFF
OTEED tind
Eoop LMDD
Homakzing Flow
KIN
DRoGO alep
INNE
GD
AlG0
Mo GAd
Lap
So GAM DAGIet
CoF
ALAD KIGA
(a) AUPRC ranking distribution across 47 datasets for 45 anomaly detectors.
Dotocirr Typ Chossall (lursaation)
Doup Learniy
Ghookaal trductes)
Rank, AUROC
30
20
Dret pretosParmetto Pormnttee LUNeR
TCOM (Qurs)
Ast
DrEcatagoric GHM
Fertundragen
Sherping
dcSVg W
GrEGamaide
MCA
iPornt
DrElvaane Gamme
MC10
HROS
Dyp
AndGSy
Deepoydo
OsHumess
Normizigg
INkg
KW
DTEZORM
LoDs
Gdcp
LAN30
PGA
ooso
DRoes
AROD
Mo Gol
Loe
80 G44l
cop
DAGMM KPCA
ALAD
(b) AUROC ranking distribution across 47 datasets for 45 anomaly detectors..
Figure 2: Box plots of detector rankings based on AUPRC and AUROC scores across 47 datasets. Medians are marked by horizontal lines; means are shown numbers.
Baselines and Evaluation Metrics. (1) Baselines: We evaluate our method against 44 baselines. including 21 classical (shallow) and 23 deep anomaly detection algorithms. Detailed descriptions of these baselines are provided in Appendix [..2 In particular, we offer a critical review of each deep method, highlighting their limitations in comparison to our approach in Appendix[A.] (2) Evaluation metrics: We adopt two standard metrics- Area Under the Receiver Operating Characteristic curve (AUROC) and Area Under the Precision- Recall Curve (AUPRC) with higher values indicating better performance (see Appendix B.4 for more information).
Configurations. The details of architectures and hyperparameters will be postponed to Appendix B.3 while we highlight some of the main characteristics of our model here: the vector field fo fx t) is parameterized by a 3-layer multilayer perceptron (MLP). where each hidden layer contains 256 units followed by ReLU activations. To incorporate time information, we use a fixed sinusoidal embedding of the scalar time input / E [0, 1). following the positional encoding scheme used in transformer models (Vaswani et al. 2017]. The time embedding is concatenated with the input vector æ. and the combined representation is passed through the MLP to produce the predicted velocity field.
8

---

5.2 Results Analysis
Mean_ TeeTTmoe
10"
10'
Arg Soycov
Moan TestTine Time Detector
BNurrPanncie
+75,60
1721
718.78
40942.8
HDC
2977-33
14377
4002
2963 43
48.43
4.32
1:11
1300 01
329 02
1354
2037
LLPAAR
19
8:46
1.53
6.00
0.11
0.
1.53
0.54
0.52 75
0.59
105
1081
+60.01
TCOM (Ourg)
0.59
1.50
0.51
1,88
0:13
0.08
0.02
0.12
0.38
0.29
0.76
0.58
3.02
TR polne
Mitioo
10, Buoi
LACHN
pegggh glannn
23 Samimmnrtt
Ahodi
(a) Mean inference time (in seconds)
Mean, TohiTine
10
T0
10
Mean Theiiing Delector
vs. TCCM
0.07
0.01
0.01
0.04
1197 48
208317
2503 55
2504 32
156:44
29.00
438.37
025-42
370.51
176,00
1012.39
5907 86
TOOM (Ours)
121.00 PM
00
5.31
1.99
252-7 76
6.38
4M
11:.00
10, Meaedd
LAL
magg pamma
Melp
v. Saemppu
(b) Mean training time (in seconds).
Meon me
1o'
Total Time Detector (Trai++ + Test
Va. TOOM
CT PTDrionaaammit:
1F21 87
3.54
1.46
42
W1
714 ID
KDE
8534.93
33156.04
1624
50000
33.09
2022 824
244.24
10331
$18.70
2875
TE4005. EA
(Our))
Soner
11 Laooss
1R, 18,80
LA
megele panms
31 Mln
Sampaag
(c) Mean total time (in seconds).
Figure 3: Mean run time (in seconds) across large-scale datasets for TCCM and other top- pop-perormming baselines in detection accuracy.
(1) Effectiveness. Figures 2a and 2b present the aggregated results based on AUPRC and AUROC
scores, respectively. Due to the large scale of our experiments covering 45 anomaly detectors across 47 datasets with 5 different random seeds, resulting in a total of 10,575 runs-it is impractical to include all individual results in the main paper. We thus report the complete results in Tables [3 in Appendix D Particularly, we evaluate each method by reporting the distribution of its rankings across the 47 datasets. Rankings are computed based on the average AUPRC (respectively, AUROC) across the 5 seeds. As shown in Figures [a and 2b our method, TCCM, achieves the best overall performance in terms of both AUPRC (with an average rank of 5.8) and AUROC (with an average rank of 5.7). While Parrameria (second in both AUPRC and AUROC), LUNAR (third both), and KDE (fourth in both) also demonstrate strong detection accuracy, we will show later that these methods suffer from poor scalability in training and/or inference, making them less favorable for large-scale deployment compared to TCCM. A more detailed analysis is deferred to Appendix due to space constraint. We further perform statistical significance testing using the Friedman (Friedman 1937) and Nemenyi tests (Nemenyi, 1963) to assess whether the observed ranking differences are statistically meaningful; detailed results are provided in Appendix D.5
(2) Scalability. TCCM achieves considerably faster inference than most deep learning baselines, par- ticularly on large-scale and high-dimensional datasets. As shown in Figure it significantly outpaces other high-accuracy methods in inference being 1.573.39x faster than DTT-NNonarrametric. 768 faster than KDE, and 85.91 x faster than LUNAR on average. On the largest dataset, cen- sus (299,28, 285 samples 500 dimensions). TCCM takes just 1.50 seconds, while OTTE-NonParamett requires 48,949 942 seconds. These results highlight TCCM's 's scalability and suitability for real-time anomaly detection in big-data environments. Beyond inference efficiency, we further provide an analysis on training time and total runtime to evaluate the end-to-end deployability of TCCM. As shown in Figure 3b TCCM maintains competitive training efficiency- while ParaaMoni trains faster (requiring only 0.06x the training time of TCCM), KDE and LUNAR are 170.99 x and 51.93x slower, respectively. When considering the overall cost, TCCM exhibits the lowest total runtime among all per-errfoginn baselines (Figure 3c), outperforming DTE-NonParament KDE,

---

and LUNAR by 79.49x, 311.95x, and 50.89 x, respectively. This balanced efficiency across both training and inference phases underscores TCCM's 's suitability for world, large-scale anomaly detection deployments, where both accuracy and runtime constraints are critical. To further contex- tualize the trade-off between speed and performance, we include seatter plots comparing average inference time versus average AUROC (or AUPRC) across all 44 baselines (see Figures Z and in Appendix D.2.I). The results demonstrate that TCCM achieves one of the best balances between detection accuracy and inference efficiency among all evaluated methods. A detailed breakdown and additional comparisons across all 45 anomaly detection methods are provided Appendix [.2]
(3) Explainability. TCCM is designed for tabular data and inherently supports self-explanation by producing -eate importance scores derived from its learned residual velocity field, which characterizes deviation from expected normal contraction behavior. To provide a more intuitive illustration of this property, we apply TCCM to image data (MNIST (Deng 2012)), treating each pixel as a feature in flattened tabular vector. We use digit 1 as the normal class and digit 7 as the anomaly (achieving an AUROC of 0.76). As shown in Figure + the model highlights the additional horizontal stroke that distinguishes 7 from 1, demonstrating that the learned importance scores align well with uoman-interpretablee cues. Importantly, these explanations are intrinsic to TCCM rather than post hoc approximations such SHAP (Lundberg and Lee 2017) or LIME (Ribeiro et al. 2016); the residual vector itself encodes fer-feature contributions to the anomaly score, faithfully reflecting the model's internal reasoning. For this, we provide controlled synthetic study in Appendix [D.22] which quantitatively validates the accuracy of these feature-level attributions and further substantiates TCCM's intrinsic interpretability. This makes the explanations directly actionable in practice, enabling domain experts in areas such as fraud detection, healthcare, or industrial monitoring to identify not only which instances are anomalous but also why.
Delenstion
0010
Cpleattonn
0.000
8000
-0 000
000
-0 000
004
Figure 4: Illustrative examples of anomalous images and their explanations, where digit '1' is treated as the normal class and digit '7' as the anomaly. The highlighted regions correspond to structural differences between '7' and '1', which the model identifies as key contributors the anomaly score.
(4) Ablation Studies and Sensitivity Analysis. We study how major design and data factors influence TCCM (see Appendix D.3): : (1) Time embedding and inference time (Figures 12 results are nearly unchanged across choices, showing strong robustness; (2) Noise injection (Figure 14 deter- ministic training consistently performs better; (3) Training contamination (Figure [55: higher anomaly ratios reduce accuracy, underscoring the need for clean supervision; (4) Feature normalization (Fig- ure 16: z-score normalization is generally beneficial and improves robustness; (5) Time- Time-interpolated
inputs (Figure 17): interpolation offers no gain and may add noise; (6) Comparison with Autoencoder +Time Embedding: confirms that TCCM learns dime-conditionel velocity field rather than reconstruction mapping. Overall, TCCM remains stable and efficient across all variations.
Conclusion
We presented Conditioodi Contraction Matching (TCCM), a novel method for semi-supervised anomaly detection in tabular data. By learning a úime-codditooeed contraction field grounded in flow matching, TCCM avoids adversarial training, trajectory simulation, and density modeling- offering a lightweight yet expressive alternative to existing generative-based anomaly detection methods. On the ADBench benchmark, TCCM outperforms 44 classical and deep baselines in both AUROC and AUPRC, while achieving orders-of of of-magnitude faster inference than the strongest diffusion- based competitor (namely UTE-NonParamettic vector field. Theoretical analysis confirms the Lipschitz continuity and discrininative power of its scoring function. Together, these results position TCCM as an highly effective, scalable, interpretable, and robust solution for large-scale anomaly detection. Future directions include extending to other data modalities. The limitations and broader impacts of our work are further discussed in Appendix D.6
It also provides feature-level interpretability via its learned
10

---

Acknowledgment
We thank all anonymous reviewers for their time and efforts in reviewing this paper and their constructive comments to improve this paper. Qi Huang, Niki van Stein: This publication is partly sponsored by the XAIPre project (with project number 19455) the research program Smart Industry 2020 which is (partly) financed by the Dutch Research Council (NWO).
References
Deepak Agarwal. 2007. Detecting anomalies in cross-classified streams: bayesian approach. Knowledge and information systems 11, (2007), 29-44.
Charu C Aggarwal and Charu C Aggarwal. 2017a. An introduction to outlier analysis. Springer.
Charu C Aggarwal and Charu C Aggarwal. 2017b. Outlier ensembles. Springer.
Samet Akcay, Amir Atapour-Abarghouei, and Toby P Breckon. 2018. Ganomaly: Semi-supervised
anomaly detection via adversarial training. In Asian conference on computer vision. Springer, 622-637.
Leman Akoglu, Hanghang Tong, and Danai Koutra. 2015. Graph based anomaly detection and description: survey. Data mining and knowledge discovery 29, (2015), 626-688
Michael S Albergo and Eric Vanden-Eijnden 2023. Building Normalizing Flows with Stochastic Interpolants. In 11th International Conference on Learning Representations, ICLR 2023.
Jinwon An and Sungzoon Cho. 2015. Variational autoencoder based anomaly detection using reconstruction probability. Special lecture on IE 2, (2015), 1-18.
Fabrizio Angiulli and Clara Pizzuti. 2002. Fast outlier detection in high dimensional spaces. In European conference on principles of data mining and knowledge discovery. Springer, 15-27.
Andreas Arning, Rakesh Agrawal, and Prabhakar Raghavan. 1996. A Linear Method for Deviation Detection in Large Databases.. In KDD, Vol. 1141. 972-981.
Tharindu R Bandaragoda, Kai Ming Ting, David Albrecht, Fei Tony Liu, Ye Zhu, and Jonathan R Wells. 2018. Isolation-based anomaly detection using nearest-neighbor ensembles. Computational Intelligence 34, 4 (2018), 968-998.
Yoshua Bengio, Aaron Courville, and Pascal Vincent. 2013, Representation learning: review and new perspectives. IEEE transactions on pattern analysis and machine intelligence 35, 8 (2013), 1798-1828.
Liron Bergman and Yedid Hoshen. 2020. Classification-batt anomaly detection for general data. arXiv preprint 2XXv:2005.02359 (2020).
Ane Blazquez-Gareía, Angel Conde, Usue Mori, and Jose A Lozano. 2021. A review on out- lier/anomaly detection time series data. ACM computing surveys (CSUR) 54, (2021), 1-33.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and lörg Sander. 2000. LOF: identifying density-based local outliers. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data. 93-104.
Varun Chandola, Arindam Banerjee, and Vipin Kumar. 2009. Anomaly detection: A survey. ACM computing surveys (CSUR) 41, 3 (2009), 1-58.
Ricky TQ Chen, Yulia Rubanova, Jesse Bettencourt, and David K Duvenaud. 2018. Neural ordinary differential equations. Advances in neural information processing systems (2018).
Xin Chen and Anderson Ye Zhang. 2024. Achieving optimal clustering in Gaussian mixture models with anisotropic covariance structures. Advances in Neural Information Processing Systems 37 (2024), 11 113698-11344)
11

---

Dylan Chou and Meng Jiang, 2021. A survey on data-driven network intrusion detection. ACM Computing Surveys (CSUR) 54, 9 (2021), 1-36.
R Dennis Cook. 1977. Detection of influential observation in linear regression. Technometrics 19, 1 (1977), 15-18.
MIT CSAIL. 2024. Introduction to Flow Matching and Diffusion Models. MIT Computer Science
Class 6.S184: Generative AI with Stochastic Differential Equations. https://diffusion csail mii..edu/ Accessed: March 9, 2025.
Quan Dao, Hao Phung, Binh Nguyen, and Anh Tran. 2023. Flow matching in latent space. arXiv preprint arXiv:2307.0860 (2023).
Janez Demšar. 2006. Statistical comparisons of classifiers over multiple data sets. Journal of Machine learning research 7, Jan (2006), 1-30.
Li Deng. 2012. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE signal processing magazine 29, 6 (2012), 141-142.
Laurent Dinh, David Krueger, and Yoshua Bengio. 2014. Nice: Non-linear independent components estimation. arXiv preprint arXiv:1410.8511 (2014).
Tim Dockhorn, Arash Vahdat, and Karsten Kreis. 2022. Genie: Higher-order denoising diffusion solvers. Advances in Neural Information Processing Systems 35 (2022), 30150-30166.
Jeff Donahue, Philipp Krähenbühl, and Trevor Darrell. 2016. Adversarial feature learning. arXiv preprint arXiv:1605.0978 (2016).
Kai-Tai Fang and Chang-Xing Ma. 2001. Wrap-around L2-discrepancy of random sampling, Latin hypercube and uniform designs. Journal of complexity 17, 4 (2001), 608 6224.
Cecile Fauconnier and Gentiane Haesbroeck. 2009. Outliers detection with the minimum covariance determinant estimator in practice. Statistical Methodology 6, (2009), 363-379.
Tharindu Fernando, Harshala Gammulle, Simon Denman, Sridha Sridharan, and Clinton Fookes. 2021. Deep learning for medical anomaly detection-a survey. ACM Computing Surveys (CSUR) 54, 7 (2021), 1-37.
Milton Friedman. 1937. The use ranks to avoid the assumption of normality implicit in the analysis of variance. Journal of the american statistical association 32, 200 (1937), 675-701.
Salvador Garefa, Alberto Fernández, Julián Luengo, and Francisco Herrera. 2010. Advanced nonparametric tests for multiple comparisons in the design of experiments in computational intelligence and data mining: Experimental analysis of power. Information sciences 180, 10 (2010), 2044-2064.
Izhak Golan and Ran El- Yaniv..v. 2018. Deep anomaly detection using geometric transformations. Advances in neural information processing systems 31 (2018).
Markus Goldstein and Andreas Dengel. 2012. Histogram-based outlier score (hbos): fast unsuper- vised anomaly detection algorithm. K1-2012: poster and demo track (2012), 59-63.
Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sher- jil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative Adversarial Networks. arXiv: NMv:1406.266 266. [sIat.MI.] https://arkce org abs/ .6666.66611..
Adam Goodge, Bryan Hooi, See-Kiong Ng. and Wee Siong Ng. 2022. Lunar: Unifying local outlier detection methods via graph neural networks. In Proceedings the AAAI Conference Artificial Intelligence, Vol. 36. 6737-6745.
Sachin Goyal, Aditi Raghunathan, Moksh Jain, Harsha Vardhan Simhadri, and Prateek Jain. 2020. DROCC: Deep robust one-class classification. In International conference on machine learning. PMLR, 3711-3721.
12

---

Will Grathwohl, Ricky TQ Chen, Jesse Bettencourt, Ilya Sutskever, and David Duvenaud. 2018. Fijord: Free-form continuous dynamics for scalable reversible generative models. arXiv preprint arXiv:1810.01367 (2018).
Songgiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao. 2022. Adbench: Anomaly detection benchmark. Advances in neural information processing systems 35 (2022), 32142-32159.
Sahand Hariri, Matias Carrasco Kind, and Robert Brunner. 2019. Extended isolation forest. IEEE transactions on knowledge and data engineering 33, 4 (2019), 1479-1489.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition. 770-778.
Zengyou He, Xiaofei Xu, and Shengchun Deng. 2003. Discovering cluster-based local outliers. Pattern recognition letters 24, 9-10 (2003), 1641-1650.
Waleed Hilal, S Andrew Gadsden, and John Yawney. 2022. Financial fraud: review of anomaly detection techniques and recent advances. Expert systems With applications 193 (2022), 116429.
Jonathan Ho, Ajay Jain, and Pieter Abheel. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems 33 (2020), 6840-6851.
Heiko Hoffmann. 2007. Kernel PCA for novelty detection. Pattern recognition 40, 3 (2007), 863-874.
Kyle Hundman, Vasileios Constantinou. Cody Laporte, Ian Colwell, and Tarek Soderstrom. 2018. Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding. In Pro- ceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. 387-395.
Alexia Jolicoeur-Marte Marttineau, Li, Rémi Piché- Taillefer, Tal Kachman, and Ioannis Mitliagkas. 2021. Gotta go fast when generating data with score-based models. arXiv preprint trXiv:2105.14000 (2021).
Samira Khodabandehlou and Alireza Hashemi Golpayegani. 2024. FiFrauD: unsupervised financial fraud detection in dynamic graph streams. ACM Transactions on Knowledge Discovery from Data 18, 5 (2024), 1-29.
Diederik Kingma, Max Welling, et al. 2013. Auto-encoding variational bayes.
Hans-Peter Kriegel, Matthias Schubert, and Arthur Zimek. 2008. Angle-based outlier detection in high- nigh-dimensional data. In Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining. 444 452.
Guokun Lai, Yiming Zhao, Wei-Cheng Chang, Yiming Yang. and Eric P Xing. 2021. Revisiting time series outlier detection: Robust prediction and interpretable attribution. In International Conference on Artificial Intelligence and Statistics (AISTATS).
Longin Jan Latecki, Aleksandar Lazarevic, and Dragoljub Pokrajac. 2007. Outlier detection with kernel density functions. In International workshop on machine learning and data mining in pattern recognition. Springer, 61-75.
Aleksandar Lazarevic and Vipin Kumar. 2005. Feature bagging for outlerr detection. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery data mining. 157-166.
Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzato, Fujie Huang, et al. 2006. tutorial on energy-based learning. Predicting structured data 1, 0 (2006).
Sangyun Lee, Beomsu Kim, and Jong Chul Ye. 2023. Minimizing trajectory curvature ode-based generative models. In International Conference on Machine Learning. PMLR, 18957-18973.
13

---

Zhong Li, Qi Huang, Lincen Yang, Jiayang Shi. Zhao Yang, Niki van Stein, Thomas Bäck, and Matthijs van Leeuwen. 2025a. Diffusion Models for Tabular Data: Challenges, Current Progress, and Future Directions. arXiv preprint arXiv:2502.171 (2025).
Zhong Li, Sheng Liang, Jiayang Shi, and Matthijs Leeuwen. 2024a. Cross-domain graph level anomaly detection. IEEE Transactions on Knowledge and Data Engineering (2024).
Zhong Li, Jiayang Shi, and Matthijs Van Leeuwen. 2024b. Graph neural networks based log anomaly detection and explanation. In Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings. 306-307.
Zhong Li and Matthijs van Leeuwen. 2022. Feature selection for fault detection and prediction based on event log analysis. ACM SIGKDD Explorations Newsletter 24, 2 (2022), 96-104.
Zhong Li, Yuhang Wang, and Matthijs van Leeuwen. 2025b. Towards automated self-supervised learning for truly unsupervised graph anomaly detection. Data Mining and Knowledge Discovery 39, 5 (2025), 1-43.
Zheng Li, Yue Zhao, Xiyang Hu, Nicola Botta, Cezar Ionescu, and George H Chen. 2022, Ecod: Un- supervised outlier detection using empirical cumulative distribution functions. IEEE Transactions on Knowledge and Data Engineering 35, 12 (2022), 12181-12192
Zhong Li, Yuxuan Zhu, and Matthijs Van Leeuwen. 2023. A survey on explainable anomaly detection. ACM Transactions on Knowledge Discovery from Data 18, 1 (2023), 1-54.
Yaron Lipman, Ricky TQ Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le. 2022. Flow matching for generative modeling, arXiv preprint arXiv:2210.02747 (2022).
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. 2008, Isolation forest. In 2008 eighth ieee international conference on data mining. IEEE, 413-422.
Jiaqi Liu, Guoyang Xie, Jinbao Wang, Shangnian Li, Chengjie Wang. Feng Zheng, and Yaochu Jin. 2024. Deep industrial image anomaly detection: A survey. Machine Intelligence Research 21, 1 (2024), 104-135.
Xingchao Liu, Chengyue Gong, and Qiang Liu. 2022. Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint arXiv:2209.0300 (2022).
Yezheng Liu, Zhe Li, Chong Zhou, Yuanchun Jiang, Jianshan Sun, Meng Wang, and Xiangnan He. 2019. Generative adversarial active learning for unsupervised outlier detection. IEEE Transactions on Knowledge and Data Engineering 32, 8 (2019), 1517-1528.
Victor Livernoche, Vineet Jain, Yashar Hezaveh, and Siamak Ravanbakhsh. 2023. On diffusion modeling for anomaly detection. arXiv preprint arXiv:2305. 18593 (2023).
Scott M Lundberg and Su-In Lee. 2017. A unified approach to interpreting model predictions. Advances in neural information processing systems 30 (2017).
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint 1xXvv:170.00088 (2017).
Julien Marzat, Hélène Piet-Lahanier Frédéric Damongeot, and Eric Walter. 2012. Model-based fault diagnosis for aerospace systems: a survey. Proceedings of the Institution of Mechanical Engineers, Part G: Journal of aerospace engineering 226, 10 (2012), 1329-1360.
Lukasz Maziarka, Marek Šmieja, Marcin Sendera, Lukasz Struski, Jacck Tabor, and Przemystaw Spurek. 2021. OneFlow: One-class flow for anomaly detection based on a minimal volume region. IEEE Transactions on Pattern Analysis and Machine Intelligence 44, 11 (2021), 1558-8519,
Matthew McDermott, Haoran Zhang, Lasse Hansen, Giovanni Angelotti, and Jack Gallifant. 2024. A closer look at auroc and aupre under class imbalance. Advances in Neural Information Processing Systems 37 (2024), 44102-44163.
14

---

Francis J Murray and Kenneth S Miller. 2013. Existence theorems for ordinary differential equations. Courier Corporation.
Anvardh Nanduri and Lance Sherry. 2016. Anomaly detection in aircraft data using Recurrent Neural Networks (RNN). In 2016 Integrated Communications Navigation and Surveillance (ICNS), Ieee, 5C2-1.
Peter Bjom Nemenyi. 1963. Distribution-free multiple comparisons. Princeton University.
Minh-Nghia Nguyen and Ngo Anh Vien. 2019. Scalable and Interpretable One- One-Class SVMs with Deep Learning and Random Fourier Features. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2018, Dublin, Ireland, September 10-14, 2018, Proceedings. Part (Lecture Notes in Computer Science, Vol. 11051). Springer International Publishing, 157-173.
Guansong Pang. Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. 2021. Deep learning for anomaly detection: A review. ACM computing surveys (CSUR) 54, 2 (2021), 1-38.
George Papamakarios, Eric Nalisnick, Danilo Jimenez Rezende, Shakir Mohamed, and Balaji Lakshminarayanan. 2021. Normalizing flows for probabilistic modeling and inference. Journal of Machine Learning Research 22. 57 (2021). 1-64.
Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. 2011. Scikit-leam: Machine learning in Python. the Journal of machine Learning research 12 (2011),
Tomáš Pevný. 2016. Loda: Lightweight on-line detector of anomalies. Machine Learning 102 (2016), 275-304.
Ali Rahimi and Benjamin Recht. 2007. Random features for large-scale kernel machines. Advances in neural information processing systems 20 (2007).
Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. 2000. Efficient algorithms for mining outliers from large data sets. In Proceedings of the 2000 ACM SIGMOD international conference on Management of data. 427-438.
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark DePristo, Joshua Dillon, and Balaji Lakshminarayaman. 2019. Likelihood ratios for out-of-distribution detection. In Advances in Neural Information Processing Systems (NeurIPS). 14680-14691.
Danilo Rezende and Shakir Mohamed. 2015. Variational inference with normalizing flows. In International conference on machine learning. PMLR, 1530-1538.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016. "Why should trust you?" Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining. 1 1135-1144.
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft, 2018. Deep onc-class classification. In International conference on machine learning. PMLR, 4393-4402.
Edin Šabic, David Keeley, Bailey Henderson, and Sara Nannemann. 2021. Healthcare and anomaly detection: using machine learning predict anomalies heart rate data, Ai & Society 36, 1 (2021), 149-158.
Mayu Sakurada and Takehisa Yairi. 2014. Anomaly detection using autoencoders with nonlinear dimensionality reduction. In Proceedings of the MLSDA 2014 2nd workshop on machine learning for sensory data analysis. 4-11.
Thomas Schlegl, Philipp Seeböck, Sebastian M. Waldstein, Ursula
and Georg Langs. 2017. Unsupervised Anomaly Detection with Generative Adversarial Networks to Guide Marker Discovery. In Information Processing in Medical Imaging, Mare Niethammer, Martin Styner, Stephen Aylward, Hongtu Zhu, Ipek Oguz, Pew-Thian Yap, and Dinggang Shen (Eds.). Springer International Publishing, Cham, 146-157.
15

---

Bernhard Schölkopf, Robert C Williamson, Alex Smola, John Shawe-Taylor, Taylor, and John Platt. 1999. Support vector method for novelty detection. Advances in neural information processing systems 12 (1999).
Tom Shenkar and Lior Wolf. 2022. Anomaly detection for tabular data with internal contrastive learning. In International conference on learning representations.
Mei-Ling Shyu, Shu-Ching Chen, Kanoksri Sarinnapakorn, and LiWu Chang. 2003. A novel anomaly detection scheme based on principal component classifier. In Proceedings of the IEEE foundations and new directions of data mining workshop. IEEE Press Piscataway, NJ, USA, 172-179.
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. 2020. Score-based generative modeling through stochastic differential equations. arXiv preprint 2rXiv:2011..344 (2020).
Mahito Sugiyama and Karsten Borgwardt. 2013. Rapid distance-based outlier detection via sampling. Advances in neural information processing systems 26 (2013).
Jian Tang, Zhixiang Chen, Ada Wai-Chee Fu, and David W Cheung. 2002. Enhancing effectiveness of outlier detections for low density patterns. In Advances in knowledge discovery and data mining: 6th Pacific-Asia conference, PAKDD 2002 Taipei. Taiwan, May 6-8. 2002 proceedings 6. Springer, 535-548.
David MJ Tax and Robert PW Duin. 2004. Support vector data description. Machine learning 54 (2004), 45-66.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017).
Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. 2023a. Deep isolation forest for anomaly detection. IEEE Transactions Knowledge and Data Engineering 35, 12 (2023), 12591-12204.
Hongzuo Xu, Yijie Wang, Juhui Wei, Songlei Jian, Yizhou Li, and Ning Liu. 2023b. Fascinating supervisory signals and where find them: Deep anomaly detection with scale learning. In International Conference on Machine Learning. PMLR, 38655-38673.
Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong. Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. 2023. Diffusion models: A comprehensive survey methods and applications. Comput. Surveys 56, 4 (2023), 1-39.
Jiaxin Yin, Yuanyuan Qiao, Zitang Zhou, Xiangchao Wang, and Jie Yang. 2024. Mem: Masked cell modeling for anomaly detection in tabular data, In The Twelfth International Conference on Learning Representations.
Jianbo Yu and Yue Zhang. 2023. Challenges and opportunities of deep learning- based process fault detection and diagnosis: review. Neural Computing and Applications 35, (2023), 211-252.
Houssam Zenati, Manon Romain, Chuan-Sheng Foo, Bruno Lecouat, and Vijay Chandrasekhar. 2018. Adversarially learned anomaly detection. In 2018 IEEE International conference data mining (ICDM). IEÉE, 727-736.
Yue Zhao, Zain Nasrullah, and Zheng Li. 2019. PyOD: A Python Toolbox for Scalable Outlier Detection, Journal of Machine Learning Research 20, 96 (2019), 1-7. http://jmlr org/ papers/v20/19- 0-009-0-1111 html
Kaiwen Zheng, Cheng Lu, Jianfei Chen, and Jun Zhu. 2023. Improved techniques for maximum likelihood estimation for diffusion odes. In International Conference on Machine Learning. PMLR, 42363 42389.
Chong Zhou and Randy C Paffenroth. 2017. Anomaly detection with robust deep autoencoders. In Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining. 665-674.
16

---

Leixin Zhou, Wenxiang Deng, and Xiaodong Wu. 2020. Unsupervised anomaly localization using VAE and beta- VAE. arXiv preprint arXiv:2005.10686 (2020).
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dacki Cho, and Haifeng Chen. 2018. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International conference on learning representations.
17

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: We clearly state that the proposed anomaly detection algorithm addresses major limitations of existing seeerraiveemdee-bbaaee approaches, including scalability (in both training and inference), explainability, and provability. These claims are supported by theoretical analysis and extensive empirical benchmark study.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We outline three limitations of this work in Appendix D.6.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and prool's
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
18

---

Answer: [Yes]
Justification: All propositions the paper are accompanied by well-motivated and clearly stated assumptions, along with complete and correct proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversell, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper provides self-contained description of the proposed algorithm and experimental setup. including all necessary details to reproduce the main results. Addition- ally, we provide open-source implementations via an anonymous online repository to further support reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-souree models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
19

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
The main experimental results based open-source benchmark (AD- Bench), and we provide open-source code with sufficient instructions to ensure faithful reproduction.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co cc/
htt.eeeewuummmsisoooooooo....... for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-sourge benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
gewiii/gguee//eeeeeeeieiiiiiseee CodeeSumieee onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question:
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
The paper provides extensive details of the experimental setup. Additional specifics are included in the appendix ensure clarity and reproducibility.
Justification:
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
We report statistical significance tests in Appendix D.5 for our main conclu- sions, and error bars (in terms of standard deviations) are given on each table and figure (when applicable).
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
20

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eπror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Details of the computing resources used for all experiments, including hardware specifications and runtime, are provided in Appendix B.3
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental rums well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:pp://herrpps..ccpbbbi/iiite
Answer: [Yes]
We confirm that all aspects of our research comply with the NeurIPS Code of Ethics.
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
21

---

Justification: Although this paper presents fundamental research in anomaly detection methodology for tabular data and does involve specific applications or deployments that would raise direct societal concerns, we still outline possible impacts of this work in Appendix [D.6
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative socictal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploymeett of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All external assets used in this work, including datasets, code, and models, have been properly credited, and their licenses and terms use have been appropriately respected.
Guidelines:
22

---

The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thcode. com/ com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The source code, along with clear usage instructions, will be released under the MIT license to support reproducibility and ease of use.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This work does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
23

---

This work does not involve research with human subjects; therefore, IRB approval was not required.
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
Declaration LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: Large language models (LLMs) were not used as part of the core methods in this research; their use was limited to minor editing and polishing of text.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM for what should or should not be described.
24

---

Appendix
Table of Contents
A Related Work
A.1
Anomaly Detection Methods
A.1.1
One-Class Classification Methods
A.1.2
Generative based Approaches
A.1.3
Reconstruction bbase Methods
A.1.4
Self-Supervised based Methods and Other Miscellaneous Methods
A.2
Generative Models
B
Experiment setups
B.1
Datasets
B.2
Baselines
B.3
Conligurations
B.4
Evaluation Metrics
B.5
Pseudo-code of TCCM
C
Property Analysis
C.1
Relation Flow Matching and Diffusion Modeling
C.2
Anomaly Score Expectation under Distributional Shift
D
Full
Results and Analysis
D.1
Full Analysis of Effectiveness
D.2
Full Analysis of Scalability
D.3
Ablation Studies and Sensitivity Analysis: Full Results and Analysis
D.4
Empirical Studies on Robustness and Interpretability
D.5
Statistical Tests
D.6
Limitations and Broader Impacts
Results under the Inductive Evaluation Setting
A Related Work
A.1 Anomaly Detection Methods
Unsupervised VS Semi-Supervised. Labeled anomalies are often scarce in practice, as they typically
correspond to rare and costly events-such as aerospace system crashes (Marzat et al. 2012 Nanduri
and Sherry| 2016), faults in industrial systems (Li and van Leeuwen 2022 Li al. (0244)) financial
fraud (Hilal et al. 2022; Khodabandehlou and Golpayegani 2024), or critical health incidents
(Saiić et al. 2021 Fernando et al., 2021). As a result, anomaly detection is commonly framed unsupervised semi-supervised task. Compared to supervised settings, most unsupervised approaches face a fundamental challenge: the absence of labeled input-output pairs renders standard regression or classification techniques inapplicable (Liu et al. 2022). Anomaly detection inherits this difficulty, requiring alternative methods to detect abnormality without explicit supervision. To address this, many recent deep learning-basse based anomaly detection approaches adopt superieed setting (or one-class classification), where the training data consists exclusively of normal instances, which are relatively easier collect. The underlying principle is that a model trained solely on normal data should learn only normal patterns. When evaluated on test data containing both normal and anomalous instances, those deviating from the learned normal patterns are expected to exhibit larger fitting errors (e.g., reconstruction errors (An and Cho 2015 Zong et al. (2018), prediction scores (Zenati et al., 2018 Ren et al. 2019)), leading to higher anomaly scores. Although many works refer to this setup as unsupervised anomaly detection, we use the term semi-supervised anomaly detection for conceptual clarity and rigor. This setting is widely adopted in recent deep learning-
residuals (Lai al. 2021; Hundman et al. 2018), or likelihood-base
learning-based based anomaly detection
25

---

studies such as DeeDSVDD Ruff et al. 2018), VAE (An and Cho 2015). GANomaly (Akcay et al. 2018). ALAD (Zenati al. 2018).
Shallow vs. Deep. Shallow methods refer to classical anomaly detection approaches that do not
rely on neural networks. Representative examples include One-Class SVM (OCSVM) (Schölkopf
iet al. 1999), Support Vector Data Description (SVDD) (Tax and Duin 2004), Kernel Density
Estimation (KDE) (Lttcci et al. 2007), Isolation Forest (IForest) (Liu al., 2208). and distance- based methods such as K-Nearest Neighbors (KNN) (Angiulli and Pizzuti (002). Local Outlier
Factor (LOF) (Breunig et al., 2000), and Connectivity- based Outlier Factor (COF) (Tang et al. 2002). Kemel-based methods often suffer from poor scalability, as they require constructing large kernel matrices and storing support vectors during inference (Ruff et al.] 2018). IForest, while efficient in low dimensions, tends to degrade in high nigh-dimensional settings due to its reliance on random projections and axis-aligned splits, which may fail to capture meaningful structure in complex data. Similarly, KNN-based methods are sensitive to the curse of dimensionality, where distance metrics lose discriminative power, and their computational complexity scales poorly with dataset size. Overall, these limitations have motivated the development of deep learning-based anomaly detection methods, which can better handle large-scale and high-dimensional data by learning expressive representations.
Deep learning-based anomaly detection methods can be broadly categorized into two groups Ruff al. (2018): : (1) two-stage approaches, which utilize neural networks to learn feature representations, followed by classical anomaly detection algorithms applied to these representations; and (2) end-to- end trained approaches, which integrate representation learning and anomaly detection objectives within a unified deep learning framework. This paper focuses on the latter category. which has received increasing attention due to its potential for end-to-end optimization and adaptability to complex data modalities. We structure our review around four major lines of end-to-end trained approaches: (i) one-class classification paradigms (e.g.. Deep SVDD), (ii) generative based models (e.g.. GANs- based methods, VAEs-based methods, diffusion models-based methods), reconstruction-biat -bsed methods (e.g., autoencoders), and (iv) emerging variants including self-supervised based methods, graph-based methods, and hybrid models. For each group, we review some representative methods and highlight their respective limitations in the following.
A.1.1 One-Class Classification Methods
This line of work draws inspiration from classical one-class classification, such as Support Vector Data Description (SVDD) (Tax and Duin| 2004). For instance, Deep SVDD (Ruff et al., 2018) and its variants train a neural network to map normal data into a compact region in latent space, typically minimizing the distance to a center point or hypersphere. Anomalies are then identified based on their deviation from this learned region. Other examples include AE-1SVM (Nguyen and Vien. (011)). Deep Robust One-Class Classification (DROCC) (Goyal et al. 2020), OneFlow (Maziarka et al. 1021 and they will be reviewed in more details as follows.
DeepSVDD RRuff al. 2018). They train a neural network to learn a hypersphere of minimum volume to enclose the embeddings of normal instances, while the embeddings of abnormal instances tend to lie outside the hypersphere. However, it may suffer from the problem of hypersphere collapse, where the hypersphere collapses to a single point. To alleviate this collapse problem, they authors propose that: 1) all-zero-weight solution cannot be used for the center of hypersphere, 2) only unbounded activations should be used, and 3) bias terms need to be omitted, which may lead to sub-optimal feature representation as bias terms are mandatory to shift activation values in neural networks. In contrast, our method TCCM deliberately learns to flow to such a "collapsed" single point, without suffering from any model collapse problem. Moreover, we operate on the input space without learning an explicit latent space, maintaining the explainability of anomaly scores.
AE-ISVM (Nguyen and Vien 2019). They combine autoencoder (for representation learning) with OCSVM (for anomaly detection) in an end-to-end training manner. Moreover, they extend gradient-basse based attribution methods to analyze the contribution of input features on anomaly scores. Particularly, to solve the scalability issues with kernel machines (which has a complexity of ( with N' the number of samples) in the original SVM, they employ random Fourier features (Rahimi and Recht 2007) to approximate the kernel function. They also point out that "the biggest issue of OCSVM is their (poor) capability to handle large and high-dimensional datatsets due to optimization complexity."
26

---

DROCC Gooya et al. 2020). They assume that instances from the normal class lie on a locally linear low dimensional manifold. which is well-sampled in the training data. A test instance is considered as anomalous if it is outside the union of small l2 balls around the typical normal instances. Particularly, they convert the anomaly detection problem from an unsupervised learning setting to supervised setting as follows: they first generate synthetic anomalous instances (based on the above assumption) to add into the training set, and then train a supervised classifier to distinguish the embeddings of synthetical anomalous instances and those of typical normal instances. This method is robust to representation collapse as mapping all instances into a single point will lead to poor classification results. This method is applicable to tabular data, image, time series, audio, etc. DROCC's s optimization is formulated as a saddle point problem. which is solved using standard gradient descent- algorithm (which may be unstable like in adversarial training).
OneFlow (Mazirrka et al. (02T). They introduce a one-class anomaly detection method based on NICE flows (Dinh et al. (014)) type of normalizing flow with volume-preserve transformation (i.e., constant Jacobian determinant). The core idea is to learn an invertible transformation that maps nominal data to latent space, and then fit a minimal-volume hypersphere that encloses fixed proportion of the mapped points, Anomalies are detected based on their distance from the hypersphere center. This approach avoids full density estimation and focuses on directly modeling the support of normal data. A Bernstein polynomial estimator is used to ensure smooth quantile estimation, and the training loss only depends boundary boundary-adjacent points resembling support vector behavior. While effective in modeling low-density support, OneFlow has several limitations compared to flow flows like NICE limits the expressivity of the
matching methods: the use of volume-preserv learned transformation and the capacity to model complex data distributions.
A.1.2 Generative based Approaches
Generative models, particularly those based on Generative Adversarial Networks (GANs) Good Fellow et al. 2014), have been widely adapted for anomaly detection by learning to approximate the distribution of normal data (Schlegl et al.] 2017: Akcay et al., 2018). These methods typically detect anomalies by measuring reconstruction error, discriminator scores, or deviations in latent space, leveraging GANs" capacity to generate realistic high-dimensional samples. Variational Autoencoders (VAEs) (Kingma et al., 2013) offer an alternative probabilistic formulation, modeling normality via reconstruction likelihood and latent priors. More recently, denoising diffusion probabilistic models (DDPMs) (Ho et al. (020) have been applied to anomaly detection, often by reconstructing inputs through reverse diffusion trajectories and using the reconstruction residual as anomaly score (Livernoche et al.] 2023). However, such models often suffer from high inference latency due the iterative nature of reverse sampling. Most notably, a newer class of generative models known as flow matching (Lipman et al. 2022 Albergo and Vanden-Bijnden 2023] Liu et al.. 2022) has recently emerged as a powerful and stable alternative to diffusion models. Despite its strong theoretical foundation and demonstrated success in generative modeling, flow matching has not yet been systematically explored for anomaly detection, especially in the tabular setting. This leaves a promising research gap. motivating our development of a flow matching-inspire framework tailored specifically to the needs of supesvue anomaly detection.
AnoGAN (Schlegl et al. 2017). This is the first work to employ GANs for anomaly detection. Specifically, they first utilize only normal instances train a GAN model (including generator and a discriminator). At test time, given a query image æ, they iteratively search for a latent embedding z such that the generated image G(z) closely resembles x and lies on the learned data manifold. This is done by minimizing a joint loss consisting of a residual loss and a discrimination loss through I steps of backpropagation. However, such per-instance optimization leads the method less practical for real-time applications. To quantify the abnormality of test sample, AnoGAN defines an anomaly score as weighted sum of the residual loss and the discrimination loss obtained after I optimization steps in the latent space. Specifically, the residual loss captures the pixel-wiss difference between the input image e and the generated image G(ær), while the discrimination loss measures how well the generated image fits on the learned data manifold. A high anomaly score indicates poor reconstruction and/or low likelihood under the discriminator, both of which suggest the input is dissimilar to the normal training distribution. In addition to scalar scoring, AnoGAN also provides visual explanation by computing a residual image a. = |æ - G(zr)), highlighting regions that contribute most to the anomaly.
high inference cost, making
27

---

ALAD Zenati et al. 2018). They propose Adversarially Learned Anomaly Detection (ALAD), reconstruction-basee GAN framework tailored for efficient unsupervised anomaly detection. Unlike earlier methods such as AnoGAN that require costly per-instance optimization during inference, ALAD incorporates an encoder network that directly maps inputs to the latent space, enabling fast, one- pass anomaly scoring. The model builds upon the BiGAN framework (Donahue et al. (016) by jointly training a generator, discriminator, and encoder, with additional cycle-consistency regularizations to enforce accurate reconstruction. Specifically, it introduces two auxiliary discriminators to enforce consistency in both data and latent spaces, improving the quality of reconstructions. To detect anomalies, ALAD defines anomaly score based on the feature difference between the input and its reconstruction, extracted from an intermediate layer of the discriminator operating on sample pairs. This feature-level distance serves more robust indicator than pixel differences, especially for high-dimensional data. While ALAD achieves fast inference and strong performance, it relies on adversarially balancing multiple networks and loss components during training, which may introduce stability challenges and increased complexity compared to simpler reconstruction-base approaches.
GANomaly (Akcay et al. 2018). It is representative GAN-based anomaly detection framework that enhances vanilla GANs by incorporating an explicit encoder-decoder structure. Instead of relying on latent space search at test time, GANomaly introduces dual-encoder architecture to enable efficient, feedforward inference. During training, only normal data are used to train a generator network composed of an encoder and decoder (G GD Gg). which learns to reconstruct the input images. In parallel, a second encoder E is trained to map the reconstructed images back into the latent space. The key assumption is that, for normal samples, the original and reconstructed latent vectors (2 = GF(r) and & = (()())) should be close, whereas for anomalous inputs, their discrepancy will be larger. The training objective combines three losses: (i) contextual loss that encourages pixel-wise similarity between input and reconstruction, (ii) a feature matching loss computed from intermediate discriminator activations to stabilize adversarial learning, and (iii) a latent encoder loss that penalizes the difference between z and 9. At test time, the anomaly score is defined based solely on the latent distance A(x) = ( - [(G(z))) allowing for fast, one-pass anomaly detection without the iterative inference used in methods like AnoGAN. While GANomaly achieves a good trade-off between accuracy and efficiency, it has two notable limitations. First, its anomaly score depends entirely on the latent discrepancy, which may be vulnerable to representation collapse or ambiguous reconstructions. Second, the three-part loss requires balancing multiple objectives, and tuning the corresponding weights without labeled data can be challenging in unsupervised settings.
SO-GAAL and MO-GAAL (Liu et al. 2019). They propose two GAN-based outlier detection methods that approach anomaly detection as an adversarial learning process. In Single-Obeective Generative Adversarial Active Learning (SO-GAAL), a generator is trained to synthesize informative potential outliers, while a discriminator attempts to distinguish these from the real data. This adver- sarial interplay gradually improves the quality of the generated outliers, enabling the discriminator to carve a tighter decision boundary around normal data. However, SO-GAAL may suffer from mode collapse and performance degradation once the generator overfits the data manifold. To address this, the authors further propose -iijee---beective GAAL (MO-GAAL), which introduces multiple uub-generatoor, each responsible for generating outliers relative to a specific subset of the data. By doing so, MO-GAAL builds more diverse and comprehensive reference distribution, allowing the discriminator to maintain stable and accurate detection even when dealing with multi-modal or high- dimensional data. Both approaches ultimately compute outlier score based on the discriminator's output, with higher scores indicating greater deviation from the learned normal distribution.
VAE (Kingma et al., 2013). They introduce a principled probabilistic framework for learning latent representationn via a variational autoencoder. For anomaly detection, the VAE is trained solely on normal instances, learning to encode data into a low- cin-dimeniional latent space and reconstruct inputs through a decoder (An and Cho 2015 Zhou et al. 2020). During training, the model jointly minimizes reconstruction loss and a KL divergence regularizer, which encourages the latent codes to follow a standard Gaussian prior. At test time, given a new input æ, the model produces a reconstructed sample è by encoding and decoding it through the learned latent space. The anomaly score is then computed based on the reconstruction error, typically using an & distance between and &. Since the model is trained to reconstruct normal patterns well, higher reconstruction errors suggest that the input deviates from the normal data distribution. Compared to GaN-based approaches like AnoGAN, VAE offers faster inference no iterative optimization is required at test time, making it more practical for real-time applications. However, the generative quality of
28

---

VAEs is often inferior to GANs, especially when dealing with complex or high-dimensional data. In some cases, even anomalous inputs can be reconstructed with low error, leading to false negatives. Furthermore, the balance between reconstruction fidelity and latent regularization (e.g., via the KI. term or the 8 coefficient in 5- 5-VAE) is sensitive, and improper tuning may lead to posterior collapse or over-regularizztion, which degrades anomaly detection performance.
DTE (Livernoche et al., 2023). ) They propose a novel use of diffusion processes for anomaly detection by predicting the noise level-or diffusion timestep-associated with an input sample. The core intuition is that normal instances lie close to the data manifold and hence resemble samples with low diffusion noise, while anomalies lie further away and mimic samples diffused with stronger noise. During training, DTE simulates noisy samples via a predefined forward diffusion process (e.g., pariance-preserving
and learns a neural network to regress or classify the corresponding diffusion time, using only normal data, At test time, inputs that are harder to explain as low-noise samples receive higher predicted diffusion times and are flagged as anomalies. Notably, this approach avoids learning the full reverse process as in DDPMs and instead frames anomaly detection as diffusion time estimation task. However, PTE-particularlyy its non-parametric variant-facee major scalability bottlenecks. DTE-NonParamettri estimates the diffusion time of test sample by computing a posterior over all training points, using distance-based kernel density approximations. This requires comparing each test input against a large training set, making inference prohibitively slow for high-volume training data adds to the overall preprocessing overhead, limiting DTE's suitability for real-time or settings. Despite its strong detection performance, these computational costs hinder its broad applicability in large-scale anomaly detection pipelines.
high nigh-dimensional data. Moreover, the diffusion process used to synthesize
A.1.3 Reconstruction-bant Methods
Reconstruction- based methods constitute a major paradigm in anomaly detection. The central idea is that models trained to accurately reconstruct normal data will fail do so for anomalous inputs, which typically deviate from the learned data manifold. The reconstruction error-measured in input space or latent space-is then used as an anomaly score. Among the most widely used reconstruction- models are Autoencoders (AEs) and their variants (Sakurada and Yairi 2014 Zhou and Paffenroth 2017p. These models learn compact representations through a bottleneck architecture and are trained to minimize the reconstruction loss on normal data. Anomalies are expected to produce larger reconstruction errors due to their poor aligmment with the learned representation space. Variational Autoencoders (VAEs) (An and Cho 2015) further extend this idea by introducing probabilistic latent space, allowing uncertainty-avee aware reconstructions.
Beyond classical AEs, many generative models also incorporate reconstruction-basee objectives. For example, GAN-based methods such as GANomaly (Akeay et al., 2018) and ALAD (Zenati et al. 2018) utilize an crcoder-decoodr--diiiiiinaa reconstruction fidelity or latent-space consistency. Similarly, recent diffusion- methods (Liver) noche et al., (203)) detect anomalies by reconstructing inputs through reverse diffusion trajectories. As other methods have been (or will be) reviewed in other parts, we will review representative reconstruction based approach, DAGMM (Zong et al. 2018). in the following.
pipeline, where anomaly scores are derived from
DAGMM (Zong et al., 2018). They propose the Deep Autoencoding Gaussian Mixture Model (DAGMM), a unified deep framework for unsupervised anomaly detection that jointly learns low- dimensional representations and density estimation. Specifically, DAGMM integrates two key components: a compression network, which is a deep autoencoder producing both latent features and reconstruction error metrics; and estimation network, which models Gaussian Mixture Model (GMM) over the concatenated features to estimate sample energy (i.e., negative log-likelhhood). To avoid traditional two-step training, DAGMM jointly optimizes the autoencoder and the GMM via a shared objective that includes reconstruction loss, sample energy, and regularization term to prevent degenerate covariance matrices. During inference, an anomaly score is computed as the energy of a test sample under the learned GMM, with higher energy indicating greater anomaly likelihood. Unlike conventional approaches that rely only on reconstruction error or pre- trained representations, DAGMM is trained end-to-end, enabling the autoencoder to adapt its compression strategy in favor of improved density estimation. This results in enhanced ability to detect subtle or "lurking" anomalies that might not have high reconstruction errors but reside in low-density regions. One limitation of DAGMM is that its network configuration-suut -uch as the number of mixture components in the GMM, and the architectures of the compression and estimation networks-nee to be selected in
29

---

detaddependent manner. These choices often require dataset-specific tuning, which may affect the model's 's ease of deployment and generalizability across tasks.
Limitations of Autoencoders. Autoencoders are typically trained to reconstruct the input data while enforcing an intermediate low-dimensional representation, which acts as information bottleneck to encourage the neural network to extract salient features from the training data. In the context of semi-supervised anomaly detection, this promotes learning the underlying factors of variation shared among normal instances. However, since autoencoders do not directly optimize for anomaly detection, their effectiveness heavily depends on how well the latent space captures relevant structure in the data. In particular, the choice of latent dimensionality becomes critical: if it is too high, the model may simply memorize the input: if too low, essential information may be lost. This hyperparameter is often data-dependent and difficult to tune due to the unsupervised nature of the task and the challenges in estimating the intrinsic dimensionality of the data (Bengio et al. 2013).
A.1.4 Self-Supervised based Methods and Other Miscellancous Methods
Recent studies explore alternative deep paradigms for anomaly detection, including self supe-suue
learning-based methods such as GOAD (Bergman and Hoshen (020). ICL (Shenkar and Wolf [022). SLAD (Xu al., 2023b), and MCM (Yin al. 2024), graph neural network-based method such as LUNAR (Goodge et al., 2022), and hybrid models such as DIF (Xu et al. 2023a) that combine deep feature learning with traditional detectors. They will be reviewed in more detail as follows.
GOAD Bergman and Hoshen 2020). They introduce a classification- based approach for anomaly detection that unifies one-class and causformatioon-bssed paradigms. It first applies set of M geometric or affine transformations to each normal training instance and learns a shared feature extractor that maps transformed inputs to a representation space. Each transformed variant is encouraged to cluster around a distinct center using a triplet-style loss, promoting intra-class compactness and inter-class separation. At inference, GOAD computes the transformation prediction likelihood for each transformed test instance and aggregates these into a final anomaly score: samples that are poorly aligned with any learned transformation subspace considered anomalous. Unlike carlier transformation-best based methods (e.g., GEOM (Golan and EI- Yaniv 2018)) that suffer from unreliable extrapolation to unseen anomalies, GOAD regularizes prediction confidence on out-of- distribution regions and generalizes to non-image data via learnable affine transformations. However, GOAD's effectiveness heavily depends on the quality and diversity of the transformations used, and its performance is sensitive to the choice of the number of transformations M, which must be manually specified and tuned per poannsstpoteeniallyy limiting its practicability across domains.
ICL Shenkar and Wolf 2022). They introduce a novel approach to anomaly detection in tabular data by leveraging contrastive learning on internal feature partitions. Unlike methods that depend on external transformations or assume data structure (e.g., spatial correlations in images), ICL operates under the premise that dependencies among feature subsets are class- spassssp Specifically, given a single-class training set, the method slides a window of size k over each input vector æ E Rd to generate set of m = d- + 1 paired sub-vectors (a,.b)). where aj is a segment of & consecutive features and bj is its complement. Two neural networks G and F' embed a and bj. respectively, into a shared latent space IR.", trained to maximize mutual information between matching pairs via a noise contrastive loss. At test time, the anomaly score for sample x is defined as the sum of contrastive losses across all; j. directly measuring how consistenn its internal structure is under the learned embeddings. Importantly, the method is interpretable by design: the local loss for each feature subset allows pinpointing which attributes contribute most to an anomaly. While hyperparameters such as the window size k and latent dimension u must be set (in data-dependent way), empirical evidence shows that performance is robust across a wide range of values, and no datasct-specific tuning is required.
SLAD (Xu et al., 2023b). They propose Scale Learning- based Anomaly Detection (SLAD), self- supervised framework for tabular anomaly detection that avoids reliance on reconstruction losses. SLAD introduces a novel supervision signal scale-whire quantifies the relationship between subspace dimensionality and representation complexity. Specifically, it samples subspaces of each input, maps them to fixed-length representations, and defines scale labels to supervise the learning of a ranking function via distribution alignment. During inference, anomaly scores are computed by measuring the divergence between predicted and target scale distributions, based on the assumption that normal samples produce more consistent and predictable scales. Despite its conceptual novelty
30

---

and strong empirical performance, SLAD presents several limitations. First, the generation of scale labels and the assumption that anomalies inherently exhibit scale inconsistencies may not hold uniformly across datasets or domains, particularly when anomalies are subtle or lie near the decision boundary. Second, SLAD's reliance on distribution alignment adds algorithmic complexity and hyperparameter sensitivity, which may impact robustness in practical deployment. Finally, while the model is self-supervised. its interpretability remains limited, as the learned scale concept is abstract and may not directly correspond to human-underssandable explanations.
MCM (Yin et al., 2024). This is novel self-supervised framework for anomaly detection tabular data. Inspired by masked modeling techniques in NLP and vision (e.g., BERT and MAE), MCM learns to reconstruct randomly masked subsets of input features using only the unmasked portions. The core hypothesis is that normal instances exhibit strong internal feature correlations. which the model can learn to reconstruct effectively- while anomalies violate such correlations, leading to higher reconstruction error. To enhance robustness, MCM introduces a learnable masking strategy that dynamically generates multiple soft masks per instance. These masks are trained end-to-end via a mask generator network. A diversity loss is used to ensure that different masks capture complementary correlations among features, thereby improving the model's s discriminative power. The final anomaly score is computed as the average reconstruction error across all masked versions. Compared to prior methods such as contrastive learning (e.g,, ICL), which often rely on engineered transformations, and flexible mechanism to capture normality. Morcover, the
MCM provides more ensemble of masks makes the method more expressive while maintaining a lightweight architecture based encoder-decoder MLP. MCM also offers interpretability through both per-mask and per-feature contributions, facilitating insight into which correlations are violated by a given anomaly.
LUNAR (Goodge et al., 2022). They propose local outlier detection framework based on graph neural networks (GNNs) with learnable message aggregation. Instead of relying on raw feature vectors, LUNAR constructs a k-nearest neighbor graph from the training data and uses pairwise distances as edge features. A single-layer GNN is trained to distinguish normal points from synthetic negative samples by aggregating the distance vector from each node's 's neighborhood. This design enables the model to learn a parametric anomaly scoring function that adapts better than classical non-trainable local methods such as LOF or KNN. Negative samples are generated using mix of uniform sampling and ceature-space perturbation, which prevents the model from collapsing to trivial solutions. While LUNAR demonstrates strong empirical performance, its reliance on k-NN graph construction introduces scalability challenges in high-dimensional settings, where distance metrics become less meaningful. Moreover, because it avoids using raw features and instead encodes distance information through a learnable aggregation function, it can incur additional computational cost in preprocessing and node. As the nearest neighbor graph must be recomputed for each new input distribution and all neighborhood distances are fed into the model, the method may be less suitable for real-time or streaming applications compared to embedding based approaches.
on large-scale datasets with many neighbors per
DIF [Xu et al. 22023a). They propose the Deep Isolation Forest (DIF), scalable anomaly detection method that extends isolation-based techniques by incorporating random deep representations. Instead of applying axis- alis-ad splits on raw features (as in iForest (Liu et al.) (008)), DIF first transforms input data into multiple representation spaces using randomly initialized, optimization-fre neural networks. These transformations enable nonlinear partitioning in the original space via simple axis-parallel cuts in the projected space. To ensure efficiency, DIF introduces a computation-efficient ensemble mechanism (CERE) that allows all ensemble members be computed simultaneously in mini-batch. For scoring. DIF further proposes a deviation-enhanee (DEAS) that combines traditional path length with deviation from split thresholds to reflect local density and isolation difficulty. The authors show that DIF generalizes both iForest and Extended Isolation Forest (EIF) (Hariri et al., 2019). while preserving linear scalability and offering stronger expressive power. However, DIF relies heavily on the randomness and diversity of representations for performance, which may lead to instability without sufficient ensemble size or structure-aware initialization.
anomaly scoring function
A.2 Generative Models
Generative models span a broad spectrum of paradigms, including energy-based models (LeCun ct al. 2006), variational autoencoders (VAEs) (An and Cho 2015), generative adversarial networks
31

---

(GANs) (Goodfellow et al. 2014). normalizing flows (Papamakarios et al. 202 autoregressive models (e.g., Transtormers /Vaswani et al. 2017)) diffusion models (Ho et al. |2020] and the more recent flow matching framework (Lipman et al. 2022: Albergo and Vanden-Fijnden 2023; Liu et al.,
2022p. While each of these approaches offers unique modeling capabilities, we focus our discussion on flow matching, as it is most directly relevant to the methodology developed in this paper.
GANs and Diffusion Models. Generative adversarial networks (GANs) (Goodfellow et al. 2014 have long been the de facto choice for high-fidelity image generation, but diffusion models have recently surpassed them in terms of mode coverage and conditional flexibility. Despite their ef- fectiveness, diffusion models (Yang et al. 2023) are notoriously computationally intensive, often requiring hundreds of iterative denoising steps generate a single sample. This has spurred efforts to accelerate training and inference (Dockhorn et al., 2022 Jolicoeur- Marieunr-aa et al., [02T); how- ever, many of these approaches still suffer from slow convergence and rely on carefully constructed probability paths, which limit scalability on high-dimensional or large-scale datasets (Dao et al. 2023). Particularly, there is a recent survey paper on diffusion models for tabular data (Li et al. 2025a), which systematically reviewed existing diffusion models for tabular data modeling (including anomaly detection).
Normalizing Flows and Continuous Normalizing Flows. Continuous normalizing flows (CNFs) (Chen et al. 2018 Grathwohl et al. 2018) model invertible transformations between distribu- tions using neural ordinary differential equations (ODEs). While theoretically elegant, training such models computationally intensive, as it involves solving ODEs during each forward and backward pass, making scalability major bottleneck. To overcome this, recent works on flow matching (Al bergo and Vanden- -iijneenn 20233, Lipman et al.] 2022; Liu et al.) 2022) propose simulation-free alternatives that avoid explicit trajectory integration. Inspired by ideas from score-based diffusion models, these methods enable more efficient training of CNFs by directly learning velocity fields without solving full ODE systems.
Flow Matching. Flow matching has emerged as a promising alternative that inherits many of the desirable properties of diffusion models- -schhsuchhh as robustness and expressivity- avoiding their main drawbacks. Rather than relying on stochastic differential equations (SDEs), flow matching learns an ordinary diffcrential equation (ODE) that deterministically maps samples from a source distribution Po (Psource) to a target distribution f (Ptarge). This shift from stochastic to deterministic dynamics leads to lower curvature in generative trajectories, which translates into improved stability, faster sampling, and easier optimization (Liu et al., [022] Lee et al., 2023). The simplicity of its training framework also facilitates broader adoption in settings where computational efficiency is critical. Beyond efficiency, flow matching offers notable modeling flexibility and interpretability. It eliminates the need for forward diffusion process, and training can be performed by directly matching vector fields between arbitrary distributions (CSAIL) 2024, Albergo and Vanden-Liindeni 2023). This generality stands in contrast to denoising diffusion models, which often assume Gaussian base distributions and Gaussian interpolants. In addition, the interpolant formulation of flow matching allows evaluation of intermediate densities P. arbitrary time points E [0. 1]. enabling empirical inspection of the learned velocity field throughout the trajectory (Albergo and Vanden Haadden---jndenn 2023). Although this capability may not always be required-e. e.g., in anomaly detection we often focus only on the terminal velocity at t = 1-it it enhances interpretability. Lastly, because flow matching only requires samples from the source and target distributions (not their explicit densities), is particularly well-suited to scenarios with implicit or intractable data distributions.
Difference from Generative Models. While the main objective of normalizing flows (Rezende and Mohamed 2015) or flow matching (Lipman et al., 2022) is to transform a simple initial distribu- tion into a complex, often multimodal, target distribution either through sequence of invertible mappings (in the case of normalizing flows) or via velocity fields (in flow matching)- our focus, by contrast, is on measuring the distance to the target distribution after applying the learned one step velocity field (at any given time). Importantly, this target distribution a degenerate distribution, which stands in stark contrast to the typical emphasis in generative modeling on the validity and richness of the target distribution.
32

---

B Experiment setups
B.1 Datasets
A summary of the datasets used in our study is provided in Table [ We adopt 47 benchmark datasets from the well-established ADBENCH benchmark (Han et al. (022), spanning diverse domains including sociology, finance, linguistics, physics, and healtheare. To enable a comprehensive evaluation of different anomaly detectors, including our proposed method, we categorize the datasets into four groups based on their scale and dimensionality: (a) ligh--immesional datasets, with more than 50 features; (b) Large-scale datasets (but not sohhdiimnnsioaa), containing more than 10,000 instances and fewer than 50 features; (c) Medium- scale datasets (not high-dimensional), with 1 1,000 to 10,000 instances; and (d) Small-scale datasets (not sig-ddimensioaa), containing fewer than 1,000 instances. This categorization facilitates a nuanced analysis of model performance across varying data regimes.
B.2 Baselines
Before introducing the baseline methods, we clarify an important distinction in anomaly detection paradigms: inductive vs. transductive approaches. Inductive methods learn a generalizable decision function from the training set and apply it directly to unseen test data. In contrast, transductive methods rely on the distribution of the test set during inference, often scoring anomalies relative to the entire evaluation batch. While inductive approaches are generally preferred in deployment scenarios where test data unavailable during training. transductive methods are still commonly included in benchmarking for historical and comparative purposes.
Our proposed method TCCM is inductive method, as it learns model using training data and then computes anomaly scores with the unseen test data. Although comparing inductive and transductive methods directly may not always be ideal due to differing assumptions, we include both for completeness. We categorize the anomaly detection baselines into two main groups:
21 Classical Machine Learning- -based Methods (Transductive and Inductive). (1) Transduc- tive Methods: ABOD (Kriegel et al. (2008), COF Tang et al. (2002). LOF (Breunig et al.
2000), PCA (Shyu | 22003)), KPCA (Hoffmann) 2007), KNN (Ramaswamy et al.) 2000
INNE (Bandaragoda et aal.[2018) and (2) Inductive Methods: CBLOF et al.
2003
CD 1977) ECOD (Li et al. [2022] FeagureBagging (Lazarevic and Kumar
2005
GMM (Agarwal 2007). HBOS (Goldstein and Dengel 2012). Foorest (Liu et al.
2008).
KDE (Latecki et 2007)) LMDD (Arning et al.11996) LODA (Pevný) 2016). MCD
Fauconnier and Haesbroeck 2009). OCSVM (Schölkopf et al. 1999). QMCD (Fang and
Ma 2001), and Sampling (Sugiyama and Borgwardt (013).
based Methods (All are inductive). AutoEncoder (Sakurada and Yairi 2014; Aggarwal and Aggarwal 20176)) ALAD (Zenati et al. 2018)), DIF (Xu et al.
23 Deep Learning- based
2023a
DeepSVDD (Ruff al.] 2018)) LUNAR (Goodge al. [2022). MOGAAL (Liu et al.
2019
SOGAAL (Liu et al.||019) 2019). VAE (An and Cho 2015) AE-ISVM (Nguyen and Vien
2019
AnoGAN (Schlegl
(017). DAGMM (Zong et al.) 2018). PlanarFlow (Normalizin
Flows) (Rezende and Mohamed 2015). SLAD (Xu et al. (0233)), MCM (Yin et al.
20244]
(Shenar and Wolf 2022), GOAD Bergman and Hoshen| (020)). MANomaly(Akcay)
et al. 2018). DTE-Categorical [Livernoche et al. (002)). D'EE-Gausiin (Livernoche et al.
2023 Dammmaaa (Livernoche et al. (002)). DTE-NooParammttric (Livernoche
et al.
2023). DROCC (Goyal et al. 2020), Anomaly- (Livernoche et al. 2023)
B.3
Configurations
All experiments are independently performed five times with different random seeds (0, 1, 2, 3, and 4) on each dataset for all 44 baselines and our proposed TCCM with high reproducibility to ensure high robustness, and account for variability due random initialization.
Implementation Details of TCCM The time-conditioned velocity field fa
(æx t) is parameterized by a 3-layer multilayer perceptron (MLP) with 256 hidden units per layer and ReLU activations. To
Code available at: /tt.////oo//ooooooooooooooo/o//r
33

---

Table 1: Summary of Datasets. To systematically evaluate the performance of various anomaly detectors, we categorize the datasets into four groups based on their data scale and dimensionality: (a) high-dimenssonal datasets, which contain more than 50 features; (b) large-scale datasets (but not high-dimensional), with more than 10,000 instances and fewer than 50 features; (c) medium-scale datasets (not high-dimensional,, with between 1,000 and 10,000 samples; and (d) small-scale (not high-dimensional) datasets, consisting of fewer than 1,000 instances. This categorization allows for nuanced analysis of model behavior under different data regimes.
Dataset
Samples
Features
Anomaly
Anomaly
Domain
Category
census
299285
500
18568
6.2
Sociology
High-dimensional
backdoor
95329
196
2329
2.44
Network
High-dimensional
campaign
41188
62
4640
11.27
Finance
High-dimensional
mnist
7603
100
700
9.21
Image
High-dimensional
speech
3686
400
61
1.65
Linguistics
High-dimensional
optdigits
5216
150
2.88
Image
High-dia diieediimesiional
SpamBase
4207
1679
39.91
Document
High- sineeddimensioaal
musk
3062
166
97
3.17
Chemistry
High-ding high-diimensionll
InternetAds
1966
1555
368
18.72
Image
High- sigh--imeenional
donors
619326
I0
367
5.93
Sociology
Large
http
567498
2211
0.39
Web
Large
cover
286048
10
2747
0.96
Botany
Large
fraud
284807
29
492
0.17
Finance
Large
skin
245057
50859
20.75
Image
Large
celeba
202599
4547
2.24
Image
Large
smip
95156
30
0.03
Web
Large
ALOI
49534
1508
3.04
Image
Large
shuttle
49097
3511
7.15
Astronautics
Large
aagic.gamma
19020
6688
35.16
Physical
Large
mammography
11183
260
2.32
Healthcare
Large
annthyroid
7200
534
7.42
Healthcare
Medium
pendigits
6870
16
156
2.27
Image
Medium
satellite
6435
36
2036
31.64
Astronautics
Medium
landsat
6435
36
1333
20.71
Astronautics
Medium
satimage-2
5803
36
71
1.22
Astronautics
Medium
PageBlocks
5393
10
510
9.46
Document
Medium
Wilt
4819
257
S.33
Botany
Medium
thyroid
3772
93
2.47
Healtheare
Medium
Waveform
3443
100
2,9
Physics
Medium
Cardiotocography
466
22.04
Healthcare
Medium
fault
1941
673
34.67
Physical
Medium
cardio
176
9.61
Healthcare
Medium
letter
1600
32
100
6,25
Image
Medium
yeast
1484
507
34.16
Biology
Medium
vowels
1456
12
50
3.43
Linguistics
Medium
Pima
768
268
34.9
Healthcare
Small
breastw
683
239
34.99
Healthcare
Small
WDBC
367
30
10
2.72
Healtheare
Small
Ionosphere
351
126
35.9
Oryctognosy
Small
Stamps
340
31
9.12
Document
Small
vertebral
240
30
12.5
Biology
Small
WBC
10
4.48
Healthcare
Small
glass
9
4.21
Forensic
WPBC
198
47
23.74
Healthcare
Small
Lymphography
148
18
6
4.05
Healthcare
Small
wine
129
13
10
7.75
Chemistry
Small
Hepatitis
80
19
13
16.25
Healthcare
Small
34

---

incorporate time information, we apply fixed sinusoidal embeddings (Vaswani et al. 2017) to the scalar imput & [0. 1]. following the positional encoding strategy used transformer architectures. The time embedding (default dimension: 128) is concatenated with the input vector at and the combined representation is passed through the MI.P to produce the predicted flow vector. We use the Adam optimizer with learning rate of 0.005. The batch size is set to 1024 for datasets with more than 10,000 samples and to min #training instances) for smaller datasets. The number of training epochs is determined empirically using the unsupervised hyperparameter selection method proposed by Li et al. (2025b), which requires no access to anomaly labels. While their method supports per-seed tuning, for consistency and fair evaluation, we fix the number of epochs across different random seeds. Notably, thanks to the efficiency of TCCM, tuning this single hyperparameter incurs minimal computational overhead. This is also the only data- dependenntd hyperparameter in our setup. The choices of key hyperparameters for our TCCM are presented in T
Implementations of Other Baselines. We utilise the well-established PyOD package (Zhao et al.
2019) for implementing (1) all classical anomaly detectors such as IForest (Liu et al. (008)) KDE (Latecki et al., 2007), etc.. and (2) some deep anomaly detectors, including AutoEncoder (Ag-
garwal and Aggarwal 2017b), ALAD (Zenati et al. 2018), DIF (Xu et al., (202aa), DeepSVDD (Ruff
et al....
2018),
LUNAR (Goodge et al. 2022), MOGAAL (Liu et al. 2019). SOGAAL (Liu et al. VAE (An and 2015)) AE-ISVM (Nguyen and Vien 2019), and AnoGAN (Schlegl
2019.
et al.
2017 ; Additionally, we adapt the implementations from ADBench D for DAGMM (Zong
ctt al.
2018 and GANAnomaly (Akeay et al. (2088:: Besides, we include various advanced deep
DROCC (Goyal et al. 2020 GOAD (Bergman and Hoshen 2020 ICL (Shenkar and Wolf 2022 6 SLAD (Xu et al., 2023b 7 MCM (Yin et al. 2024 $ DTE (with four variants InverseGamma, and DTE-NonParametric and modified DDPM) (Livernoche et al. 2023 The implementation of planar flows (Rezende and Mohamed 2015), a normalizing-flows
detectors,
OTE-Categorical DTTE-Gausii
detector, is also taken from (Livernoche et al. (023). For all baseline detectors, we use their default configurations and hyperparameters as provided by their source implementations.
Hardware and Software. All experiments are conducted on machines equipped with Intel Xeon Gold 6430 CPUs (3.4 GHz, same model across runs, though not necessarily the same physical unit) and 256 GB RAM. No GPU acceleration is used. To ensure a fair comparison, each model is restricted to run on single CPU core, allocated up to 10 GB of RAM, and a maximum runtime of days per dataset. Our implementation is based on Python 3.9.21 with PyTorch 2.0, and experiments are executed within conda-managed environment running Ubuntu 22.04.
B.4 Evaluation metrics
We evaluate our proposed method and baselines using two standard metrics: Area Under the Receiver Operating Characteristic curve (AUROC) and Area Under the Precision-Recall Curve (AUPRC) (McDermott et al. 2024). Both metrics range from 0 to 1, with higher values indicating better performance. AUROC reflects a method's 's ability to distinguish between normal and anomalous instances: a score near indicates near-perfect performance, 0.5 corresponds random guessing, and values below 0.5 imply worse-than than-random behavior. For AUPRC, which is more informative in imbalanced settings, higher values reflect better precision-recall trade-offs. All experiments are repeated over 5 independent runs with different random seeds, and we report the mean and standard deviation of each metric for every (dataset, anomaly detector) pair. For each dataset, we also compute detector rankings based on their mean AUROC and AUPRC. Due to the scale of the experiments, we present the complete tables of AUROC and AUPRC scores in the appendix. visualize the distribution of ranks compteed from the mean AUROC and AUPRC scores across 5 runs-over all datasets using box plots. These plots are ordered by overall performance, defined as
the main paper, we
*DROCC: *GOAD: http:://ggtiiboooo/////errrr/rar
material 'ICL: in the httph//iihiiiinn.oooooo////////a
"SLAD: httpp////tttiiioooo//oonnn/aaaae
$ MMM: http:::/ggsuu.u..o///////i///ttt
'DTE & DDPM: httpaa/pp///ithtuu..oo///l//lll
35

---

the average rank across datasets, where each rank is based on the per-dataset mean score aggregated over the runs.
B.5
Pseudo-code of TCCM
Algorithm TCCM Training
Input:
Training data samples ~ Púna- neural network fo with parameters 0, number of training epochs Nepochs, batch size B, learning rate 17.
2: Initialize model parameters 0.
3: for epoch = to Nepochs do
4: Shuffle training data.
5: for each batch { |i= from Paata do
6:
Sample time steps 1 where each {()) (000 1).
Generate time embeddings: (i) + Sinusoida/Emmeedding/ (t)) for i = 1...., B.
7:
8:
Form augmented inputs: 2 [ for 1, ...... B.
Predict contraction vectors: ((0)) f fo() for 1,...,BB B.
9:
Compute batch loss: (() - 1 _ (()) + 2()
10:
Corresponds to Eq.
17
2
11:
Update parameters: - - ())
12: Output: Trained model fe.
Algorithm TCCM Inference (Anomaly Scoring)
1: Input: Test sample zeest trained model fa. fixed evaluation time lixed E (0, 1] (default 4ixed 1).
2: Generate time embedding: Etsuel &- SinusoidalEnbeeddingg
3: Form augmented input: žiest f- [Ziest; Etwed!
4: Predict contraction vector: Bestt <- (e(2
5: Compute anomaly score: ((zessi (fixed) &- Vtest + Zesall2-
Corresponds to Eg.
Output: Anomaly score S(zrssti (rxed).
B.6
Unsupervised Epoch Selection Strategy
In the main paper, the architecture of TCCM is fixed as a lightweight MLP (2 x 256 ReLU) across all datasets. While this choice ensures efficiency and comparability, the number of training epochs not arbitrarily hardcoded. Instead, we adopt principled and largely automated protocol for unsupervised hyperparameter selection. For completeness, we provide additional details below.
Epoch Selection Protocol. For each dataset, we first examine the empirical training loss curve to identify rough convergence threshold. Using this lower bound, we define bounded search space of candidate epochs. Within this space, we apply the unsupervised hyperparameter tuning method introduced by Li et al. (2025b). based on the Improved Contrast Score Margin (CSM) criterion. This criterion evaluates the margin between top-k predicted anomalous and normal samples solely from the distribution of model outputs, without requiring any ground-truth labels:
ni0 jr
T(f)
2
o7
where Ao, oz denote the mean and variance of anomaly scores for the top-k predicted anomalies, and ūr o correspond to the remaining A presumed inliers. For each candidate epoch, compute T(f) and select the configuration maximizing this criterion.
Hardcoding for Simplicity. Although this procedure yields dataset- and random- seed- dependent epoch values, we ultimately fix the selected epoch across all seeds given dataset for simplicity and reproducibility. We note that using per-seed dynamically tuned epochs can sometimes further improve performance, but we chose not to report this avoid inflating results and to ensure fair comparison across baselines.
36

---

20, Pinw
18 pnsephes
31 mages
44. VWV
AUROC AUPRO
0.4
Number Trakinng
Number Trailing
Number Training Epochs i.iiemeeldd
22. mag.k.amma
muzk
1.0
9.9
50
5.5 1.555000-- -92152022000044
5.5 13330099800088
5/5. 0200-696666-00-
Namber Trasnig Epecta
Namber of Insiing Spocis
Number Traring Eoccht
Nurberr of Inaring Epecdos
Figure 5: Sensitivity of TCCM to the number of training epochs. For each dataset, we evaluate AUROC and AUPRC across wide range of epoch values. Results show stable plateau on most datasets (e.g., Pima, Ionosphere, Musk, InternetAds), where performance converges early and further training offers minimal gain but adds runtime cost. similar plateau also appears on magic. magic.gamma and mammography. albeit with minor fluctuations. On some datasets (c.g., satimage), excessive training leads overfitting, while others (e.g.. Wilt) exhibit stronger fluctuations, reflect- ing less stable convergence. These findings highlight that: for most datasets, TCCM does not rely on finely tuned epoch numbers and remains robust once a reasonable training horizon is reached.
Sensitivity Analysis. To further address this point, we include a sensitivity analysis over represen- tative datasets. Two consistent patterns emerge:
For most datasets (e.g., Pima, Ionosphere, Musk, InternetAds), model performance stabilizes after certain number of epochs, where further training brings little to no improvement but increases runtime. A similar plateau is also observed on magic. gamma and mammography, though with minor fluctuations.
Stable Plateau:
On some datasets (notably satimage), training beyond the plateau results in performance degradation, suggesting overfitting. In contrast, Wilt shows larger Iluctuations, indicating less stable convergence rather than clear overfitting.
Overfitting Risk:
These findings justify our principled choice of using CSM-based epoch selection combined with early convergence boundaries.
Discussion. We emphasize that unsupervised hyperparameter tuning remains an under-explored but important challenge in anomaly detection. Our approach leverages recently proposed and validated criterion, but we believe future work should explore more adaptive and automated tuning protocols.
C Property Analysis
Philosophical Analogy. Our method encodes a natural inductive bias: no matter where sample lies along the temporal axis, it is always guided by the same high-level goal goal-movement toward the origin. This echoes the classical proverb "Only by staying true to our original aspiration can we reach our final destination", embodying consistency that is both geometrically meaningful and empirically effective. this section, we provide some theoretical analyses of our anomaly detection framework in addition to the analyses given in the main paper well as their proof (when applicable).
37

---

C.1 Relation to Flow Matching and Diffusion Modeling
Our proposed TCCM can be viewed as a -psk-specific simplification of flow-based learning frame- works, adapted to the semi-supervised anomaly detection setting.
Conventional flow matching methods (Lipman et al. 2022 Liu al. 2022) aim to learn continuous- time vector field v< 1) that transforms samples from a source to a target distribution, often supervised using interpolated trajectories. Extensions to stochastic generative modeling, such as diffusion models, further describe the evolution of data via a stochastic differential equation (SDE):
dx((!) = -(()a((()))))) + o()e, c~N(0,T), dt
where (t) defines the contraction rate toward the origin, and (t) controls the injection of Gaussian noise over time. While such stochasticity improves sample diversity in generative tasks, may hinder anomaly detection-especiall in the semi-supervised setting where only normal data is observed. The added noise may obscure the underlying structure of normal instances, reducing their separability from anomalies.
deterministic limit of this framework, where we fix a(t) := 1 and set (t) := O. Moreover. instead of simulating time-evolving trajectories, we directly supervise the velocity field at the initial state æ, using the fixed target vector -a: at each sampled time step. This design retains the inductive bias of contraction toward normality while significantly simplifying training and inference, avoiding both trajectory supervision and numerical integration.
TCCM can be interpreted
Ablation on Noise Injection during Training. To evaluate the effect of noise, we compare TCCM with noisy variant that injects Gaussian perturbations during training (emulating the SDE in Eq. (6. As shown in Appendix D.3] noise consistently harms anomaly detection performance across AUPRC and AUROC. This supports our hypothesis that deterministic dynamics better preserve structural regularities in normal data.
C.2 Anomaly Score Expectation under Distributional Shift
To theoretically justify the discriminative behavior of our anomaly score, we analyze its ex- pected value under a Gaussian distributional shift. For notation simplicity, we utilise fa 1) for fe( (1)) and fo(z, 1) for fo([2; (1)) in the following. We consider the case where the learned contraction field satisfies, for all x E RRd in the training set,
fe(æ, 1) x t,, e~N(0,0īía).
The anomaly score then becomes
S(x) [or 1) + 2ll2 = ||E||2-
(8)
Proposition 3 (Discriminative Power under Caussian-to-Gaussin Shift). Let normal samples be drawn from (0, Ia), and anomalous samples from z ~ NN,, d²Ia) with μ + 0. Assume the learned contraction field satisfies fo 1) = x + e. where e NN, 1 Assume that the learned velocity field is mismatched for anomalies. Then the corresponding anomaly scores satisfy:
S(x) ~ Oa,
S(z) ~ xa(A), with x
(10)
where Xa and Xa( denote the central and non-central chi distributions with degrees of freedom and non-centrality parameter X, respectively. Moreover, the expected values satisfy:
d+1
[[S())) =y V2.
E[S(2))
=[((a))
(11)
r
d
2
Proof. For normal samples >N(00 of Ia), the anomaly score reduces to
S(x) [ 1) + æll2 ||e||2.
38

---

where E ~ o( Thus,
S(x) os Xd:
and the expected value is
E[S(x)) = o F[xa] = of V2. r
(())) d+11
d
For anomalous samples Nu, o2 we again have
fo(z.1) -
S(z) = [lfo 1) + x112 = =|e122
but now ~ (V is independent of NN,,, Ia), and is added to the fixed vector Thus, conditional on sample 2, the score becomes
S(z) = || c||2 ||e||2:
but this is misleading. In practice, the model is trained approximate contraction on normal data. For anomalous inputs, the field is mismatched, and we express this by assuming:
fo 1) = pproj +
with Zproj being the projection of onto the normal data manifold. Then:
S(z) [z 1) = 2| || ppmj + Ell2
Let = proj then:
S(z) = 1 c1|2
Since E ~ N(0,0 and d E Rd is fixed conditional on z, it follows that:
S(z) ~ xa(A), with |
of
From standard properties of the non-central chi distribution, we know:
E[xa(A)] [xxa] for all X 0.
Thus:
E[S(2)] > [[S())),
completing the proof.
Proposition 4 (Discriminative Power under GMMstt-Gaussian Shift), Let normal data be sampled from a Gaussian mixture model (GMM)
N(,,, o² LaI)),
Tr 1, Σ r=1
and assume the learned contraction field satisfies
fa(æ, 1) x + 6 6~ N'0, Ta..
Assume that the learned velocity field is mismatched for anomalies. Define the anomaly score as
S(z) [lfo(x x|12 ||e||2-
Then the anomaly score for normal data follows central chi distribution:
S(x) Xa of
and its expected value is
T d+1 [dd+1)
E[S(z)) of V2.
r
39

---

Let anomalous samples be drawn from ~ N with pa & {pr..... PRl. Then the anomaly score for satisfies
:= (1fo + x1|2 = 16 + c|12-
where 8 : 2 prooj is the mismatch between and the normal manifold. Then
|
S(z) ~ xa(x), A of
and the expected unomaly score satisfies
E[S(z)] > E[S(x)).
Proof. For normal samples x: ~ ( 0 Ta), the anomaly score is S(x) ( 1) ælI2 || + + æ|12 ||E||2.
Since of)) it follows that
S(x) 03 Xd.
Hence,
B[S(x)) = o B[xa] = of V2. P (+1
Now consider anomalous input (M, IaIa). not seen during training. The contraction field, trained only on normal GMM components, is not well aligned with z. Let prroj E supp(Pama) be the closest point on the normal manifold, then model the output as:
fo(2, 1) Zproj +
=
S(z) = || + fo(2, 1)llz = || 2prjj + cl12-
Let = 2pooj. which fixed conditioned on 2, then
S(z) ~ Xa(A), with À | oj
It is a known result that for all À > 0, the non-central chi distribution satisfies:
E[xa(A)] [[xa],
implying that
E[S(2)] > E[S(x)].
Proposition (Namely Proposition 2 Discriminative Power under GMM-1o-GMM Shift). Ler normal samples be drawn from a Gaussian mixture model:
R
R
N(
Σ
प. -1
Let anomalous samples be drawn from another Gaussian mixture model with distinct component means:
Σ T N(V., La))), s=1
Σn n 1
s=1
with vs & (pr...., Pn3 for all Assume the learned contraction field satisfies:
fe = te, e~N(0,07La..
40

---

Assume that the learned velocity field is mismatched for anomalies. 10
Define the anomaly score as:
S(x) := [1, + æl12-
Then:
For normal samples:
r [++1
~ Xa of.
B[S(a)) ay V2.
I
2. For anomalous samples, each component satisfies:
114e - H,, (w)
S(z) xa(Ae); Xs
o7
where (y)(s) == arg ming, || 12l12. Then:
8 B[S(z)] =
Σ ((xxx((Aaa)> E[S(x)).
Proof. Step 1: Normal samples.
For any a ~ "N(,,, Ia),, since the contraction field is learned from normal data, we assume satisfies:
fo( 1) - + 6~ (~ Ta
Therefore,
S(x) = (x. - 2||2 ||||| ~ Xa dz-
Thus, for normal samples, the anomaly score distribution is a central chi distribution with scale of Its expectation is given by:
d+1 2
B[S(x)] of v2.
2
Step 2: Anomalous samples.
Each anomalous component is 2 N(v,, T2I2.. Since the model is trained only on normal components n, it cannot learn correct contraction vector for z. As an approximation, model the field as:
So(2, 1) R - projj + e,
where proj is the projection of onto the nearest normal cluster center:
proj My (s) arg min || 11,122
Then the anomaly score becomes:
S(z) = fl 1) x = || proj + Ell2-
Reegardnng empirical support for this assumption, we offer three points of clarification: (1) Direct visual validation: Figure[] provides visualizations of the learned contraction vectors synthetic 2D datasets. These examples clearly demonstrate that anomalous points consistently deviate from the expected contraction field, validating the mismatch assumption controlled and interpretable setting. benchmark results: Across 47 real-world tabular datascts, TCCM consistently achieves strong AUROC and AUPRC scores. This level of performance would be difficult to attain if the model failed to differentiate between normal and anomalous points during inference-ther indirectly supporting the presence and utility of the mismatch behavior assumed in analysis. (3) Controlled synthetic validation: We aslo provide dedicated empirical study based and anomalous points across multiple dimensions (d = 2, 5, 10, 15, 20), we show that anomalies consistently yield higher scores. This directly validates the mismatch assumption in a controlled setting aligned with our theoretical analysis.
Indirect support through
Gaussian mixture setup. By comparing anomaly score distributions
normal
41

---

Boxplot of Anoomaly Scores Diffrent Dimensions
14
12.5
20
12
0.20
Aconay Saore
Acuney Spate
Stare
Acomey Score
0.10
0.70
0.8
0.00
00
Nome
Ancrcily
Normal
Anemaly
horrll
Antraay
Atomaly
Novral
Aponnty
Figure 6: Empirical validation of the mismatch assumption in Propositions 3, 4, and 5. Boxplots show anomaly score distributions for normal and anomalous samples under different data dimensions (d = 2, 5, 10, 15, 20). Across all cases, anomalous points consistently yield higher scores than normal points, supporting the assumption that anomalies incur a systematic mismatch under the learned contraction field.
Let 6, == 2 (s) which satisfies 6, ~ N(vs (r) La). Since e ~ NN(0, o3 the sum
8, + t N(ve (r)(()) (o² of)(a). Hence,
|I40 - (s)
S(z) xa(ds), Ag
of
Then the overall anomaly score distribution for anomalous samples (from the mixture) is:
S(z) Σ ns Xa(As), with X 0.
It is a standard result that:
(axaaXaa)) Bixal 4y, > O.
Therefore.
[[((2)] = Σ El(x(AAs)] > [[xa] 1 B[S(()),
of
which implies:
B[S(2)] E[S(z)),
completing the proof.
Empirical Study: Validating the Mismatch Assumption. To empirically validate the key assump- tion in Propositions 4, and -ht the learned contraction field is mismatched for anomalies we conduct experiment synthetic Gaussian mixture data. Normal samples are drawn from GMM with R components (each with isotropic covariance o² Ta)a), while anomalous samples are generated from a single Gaussian ((u,, T²Ta) whose mean is located outside the mixture centers. The contraction field fa is trained exclusively on normal data using our objective function (see Eq. [ and anomaly scores S(x) fl (z, + 2/I2 are computed for both groups. Figure 6 shows boxplots of the score distributions for normals and anomalies across {2, 5, 10, 15, 203. In all cases, anoma- lous points exhibit consistently higher scores than normal points, with AUROC values exceeding 0.9 regardless of dimension. These results provide direct empirical evidence that anomalies indeed incur systematic mismatch under the learned contraction field, thereby justifying the modeling assumption made in Propositions 3, 4, and 5.
Limitation of Theoretical Analysis and Future Work. We acknowledge that Proposition 5 is derived under a simplified setting involving Gaussian mixture models (GMMs). We would like to clarify that the use of GMMs in this theoretical result is a deliberate and well-motivated modeling choice:
42

---

(1) GMMs have been widely adopted as analytical tools in the machine learning literature not only anomaly detection but also in clustering and density modeling. For example, the work of Zong et al. 2018) introduces the DAGMM model for unsupervised anomaly detection based on similar distributional assumptions. Likewise, GMMs serve as the theoretical backbone clustering studies such as (Chen and Zhang] 2024), which performs theoretical analysis under anisotropic GMMs. These works demonstrate that GMM-based settings are not only standard but also provide valuable theoretical insight despite being idealized; (2) Our aim is not to suggest that real-world data exactly follow GMMs, but rather to use this setup as a clean, analyzable lens to understand the discriminative behavior of the TCCM scoring function. The result shows that under mild assumptions, the anomaly score is provably larger in expectation for out-of- distriibuttion samples drawn from disjoint mixtures thus justifying the of the residual norm discriminative signal; (3) Deriving general results under arbitrary data distributions is typically intractable, especially for deep models. Our theoretical analysis strikes a practical balance by providing provable insight under realistic yet analyzable settings. In future work, we aim to explore theoretical extensions to broader classes of distributions, but believe the current result already provides valuable intuition and justification for the observed empirical behavior.
C.3 Analysis of Representation Collapse
One potential concern for our model is the possibility of representation collapse, where the learned mapping trivially reproduces the input converges to a constant output, thereby failing distinguish between normal and anomalous data. To verify that TCCM does not suffer from this issue, we provide both theoretical and empirical evidence.
Architectural Considerations. The trivial mapping case, e.g., fo( Embed(t))) [I, []; Embed(t)]* ates to a single-layer linear transformation without bias or activation, and where the time embedding has no influence. However, this configuration does not reflect the architecture used in TCCM. In practice, TCCM employs multi-layer MIP with RELU activations and high-dimensional sinusoidal time embeddings that explicitly concatenated to the input. These design choices allow the model to learn complex, time-varying contraction dynamics, making identity or highly unlikely.
corresponds to highly restricted setting where the model degener-
mappings
Implicit Regularization. Unlike previous methods such as DeepSVDD (Ruff et al. 2018) that prevent collapse by imposing explicit architectural constraints (e.g., bounded activations or bias removal), TCCM avoids such restrictions and instead discourages collapse through time-conditioned supervision, multi-time-seep optimization, and implicit regularization induced by nonlinear transfor- mations. The temporal embedding ensures that each training instance contextually distinct across time, which prevents the network from converging single trivial representation.
Empirical Verification. To further examine this, we track training dynamics and representation diversity throughout training. Empirically, we observe no evidence of collapse: training loss decreases smoothly without flattening, and anomaly scores exhibit non-degenerate distributions across both normal and anomalous samples. Additionally, the learned feature representations maintain high variance across dimensions, and anomaly detection performance remains stable across datasets (see Figure 2). These observations collectively confirm that TCCM learns meaningful, discriminative representations rather than degenerate identity mappings.
Summary. Overall, TCCM's deesin-ecimbbiieee multi-layer nonlinear mappings, explicit temporal conditioning, and implicit eggulariztionneffeeciiee mitigates representation collapse without relying handcrafted architectural constraints. This ensures that the learned contraction field remains expressive and discriminative, supporting robust anomaly detection across diverse data regimes.
43

---

D Full Results and Analysis
D.1 Full Analysis of Effectiveness
(1) Effectiveness Small-scale Dataset. As shown in Table 6 TCCM achieves strong performance in terms of AUROC on small-scale datasets, ranking in the top 10 on 10 out of 12 datasets, with an average rank of 4.42 the best among all evaluated methods. This result highlights the effectiveness of TCCM in low-data regimes. Despite being a deep learning method-whicl are typically considered data-hungry and prone underperformance on small datasets-TCCMM consistently outperforms both classical and deep baselines. Similar conclusions hold for AUPRC, as shown in T
(2) Effectiveness on Medium-scale Datasets. As shown in Table g TCCM demonstrates strong performance on medium-scale datasets in terms of AUROC, ranking in the top 10 on 13 out of 15 datasets, with average rank of 1.80-the second best among all anomaly detectors (slightly outperformed by
with an average of 6.20). Similarly, Table shows that TCCM ranks in the top 10 13 out of 15 datasets in terms of AUPRC, with average rank of 6.60, achieving the best position overall (followed by OTE-NonParametric with an average rank of 7.13). In both cases, OTE-NonPPrammeto lacks provable robustness, limiting its practical deployment in sensitive or high-stakes applications.
achieves strong performance, but suffers from poor explainability and
(3) Effectiveness on Large-scale Datasets. From Table I0 we can that TCCM gives good performance in terms of AUROC score: it gives top- results 9 out of 11 datasets, with an average ranking of 7.36, the second highest ranking among all anomaly detectors (slightly outperformed by DTE-NonParamettro with a rank of 6.36). Meanwhile, Table shows that: concerning AUPRC Score, it gives top-10 10 results 9 out of 11 datasets, with an average ranking of 7.18 (followed by DTraNnonarammttiic with a rank of 8, 8,45), the highest ranking among all anomaly detectors. Note that OTE-NonParamettie suffers from low scalability and lack of provable robustness and explainability.
(4) Effectiveness on High-dimensional Datasets. From Table 12 we can see that TCCM gives good performance in terms of AUROC score: it gives top- 10 results 9 out of 9 datasets, with an average ranking of 4.89, the second highest ranking among all anomaly detectors (slightly outperformed by OTE-NonParamettic with an average rank of 4.44). Mcanwhile, Table 13 shows that: concerning AUPRC score, it gives top-10 10 results on 8 out of datasets, with an average ranking of 5.56 (followed by
with rank of 6.56), the highest ranking among all anomaly detectors. Note that Pere-NooPPrrmetric suffers from low scalability at inference and lack of provable robustness and explainability.
D.2
Full Results on Scalability Analysis
D.2.1 Analysis of the Trade-off Between Inference Speed and Accuracy
To further contextualize the efficiency of TCCM, follow the evaluation practice introduced by DTE (Livernoche et al.] 2023) and analyze the relationship between average inference time and detection performance (measured by AUROC and AUPRC) across all 46 anomaly detection methods. As shown in Figures 7 and D. TCCM occupies the lower-left region of the plot, indicating simultaneously high accuracy and low inference latency.
Most competing methods fall into one of two regimes: (1) slow but accurate models such as DTE- NonParametric, LUNAR, and KDE, which achieve comparable AUROC and AUPRC but require several orders of magnitude longer inference; and fast but less accurate methods such as GMM, CBLOF, and Sampling, which exhibit shorter inference but substantially reduced detection accuracy. In contrast, TCCM provides a favorable middle ground deliveriei high detection accuracy without compromising inference efficiency.
These results reinforce our claim that TCCM achieves one of the best overall balances between accuracy and computational cost among deep learning- approaches, demonstrating its strong potential for deployment in real-time and resource-constraaned anomaly detection scenarios.
D.2.2 Scalability Analysis on All Algorithms
To assess the practical deployability of TCCM, we perform a comprehensive scalability analysis across three runtime dimensions: training time, inference time, and total execution time (training
44

---

Tradkoof Lxteooor AUCROC fhack Inforonoa
XPGA
G0000
ABC0
LODA
Aveegge AWO.OOOOOOOOOO
Delecar Calegery
Dasoiall (eeadee))
10 parownii intennoss Stree
Average Iooetoomed ineeneca time juding logil 1080
8:500
82400
10154
(n-ooords)
Figure 7: Distribution of average inference time (transformed with log (1 + 1)) to achieve better visualization, with is the 1st percentile of all inference times t) vs. average AUROC rank across all 45 anomaly detection methods. The ticks corresponding to the original average inference time are also displayed underneath. TCCM achieves the best balance between inference speed and detection accuracy, outperforming both slow but accurate (e.g., DTE-Nonparametric, KDE) and fast but less accurate (e.g., GMM, CBLOF, Sampling) methods.
+ testing). Unlike the main paper, which focuses on comparisons with the strongest deep baselines (DTE-NonParametric, LUNAR, and KDE), here we extend the evaluation to all 44 baselines- including classical (transductive and inductive) and deep learning-based methods to provide a complete view of computational efficiency.
Our analysis centers on large and high-dimensional datasets, where runtime diffcrences become most pronounced. Smaller datasets tend to produce negligible timing gaps, finish within seconds. In contrast, the large-scale datasets (with hundreds of thousands of samples or high feature dimensionality) amplify differences in efficiency, offering realistic measure of scalability in deployment settings.
slower models
(1) Training Time. As shown in Figure 9 TCCM achieves one of the lowest training times within the deep learning group. Its distribution centers near fast, lightweight models such as AutoEncoder and DeepSVDD, while being faster than most other deep learning methods (c.g., ANOGAN, DTE- Categorical, GOAD). Some classical algorithms (c.g., KDE, OCSVM, LMDD) display higher variability and much longer training durations due to nonparametric pairwise computations. Overall, TCCM provides a strong balance between model capacity and training efficiency, confirming its practicality for large-scale learning.
(2) Inference Time. Figure presents the distribution of inference times across detectors. Within the deep learning group. TCCM ranks among the fastest methods, close to simple methods such as ALAD and DROCC, but with markedly higher detection accuracy. By contrast, diffusion-based approaches such as DTra-noParrmmttrcc and DTE-DDPM lie at the upper end of the runtime spectrum, often exhibiting multi-order magnitude slower inference across large datasets. Compared to classical baselines (c.g., CBLOF, IFOREST, ECOD), TCCM maintains similar or better inference efficiency while achieving superior detection performance.
(3) Total Runtime. The total runtime (training inference), summarized in Figure 11 shows that TCCM achieves one of the best overall efficiency fffcurancy-acuuracyy trade-offs among all evaluated methods. Within the deep learning family, TCCM clusters in the lower range of the runtime distribution, far outperforming heavier diffusion (namely DTE-Gaussian, DTT--InversGGamaa) and kernel-based methods (namely KDE). Its compact and stable distribution across large datasets highlights its consistent computational advantage. These results demonstrate that TCCM maintains both scalability and practicality for real-world, high-volume anomaly detection deployments.
45

---

Tradkos betivess AUDHH Infoneo
GAM NOLOAAL
AUCP Saheeooo
5pan
-0000
Simpping
Delectr Galagery
Dasoiall (eeadee))
10
Averngs tooetoored ineeneca time juding logil 1n80
fid parownia intensoss Siree
8.000
8240
10154
inforeece (noooodd))
Figure 8: Distribution of average inference time (transformed with log (1 b)) to achieve better visualization, with ò is the 1st percentile of all all inference times t) vs. average AUPRC rank across all 45 anomaly detection methods. The ticks corresponding to the original average inference time are also displayed underneath. TCCM achieves the best balance between inference speed and detection accuracy, outperforning both slow but accurate (e.g., DTE-NNoparammtrric KDE) and fast but less accurate (e.g., GMM, CBLOF, Sampling) methods.
Delectar
Didt bution of Training Time on Large and High-Dimensional Daliovats (lag scill)
Hep10 903
LOCA
sPowed
cor
Nete
Figure 9: Distribution of training times (log-scale) on large and gigh-dimensional datasets across all 45 anomaly detectors. TCCM achieves one of the lowest training times among deep learning models, comparable to simple architectures such as AutoEncoder and DeepSVDD, while significantly faster than most other deep learning methods. Some classical models (e.g., KDE, LMDD) show much higher variability and longer training durations.
Discussion on Larra-Large-Scale Scenarios. While our experiments already include a wide spectrum of realistic datasets with 14 datasets exceeding 10,000 samples and 6 high-dimensional Latasets-two cases are particularly noteworthy: donors (619K samples, 10 dimensions) and census (299K samples, 500 dimensions). On these datasets, TCCM completes inference in merely 1.05s and 3.02s, respectively, whereas the most accurate competitor IDTE-NonParametrio requires 476.60s and 48,94 48.942.85s. This striking difference (3-4 orders of magnitude) highlights the practical scalability of TCCM in both sample size and feature dimensionality. Furthermore, several conventional and
46

---

Cassical (tanedadee)
Casrcal
Distibution of Inforence Time Large and Dimensionnl Dalssets (log scale)
wntoroneon (50
Nic cal
Poc
Berotiroo
cade
TOOM peee
the
LONMR
E2t
car
Figure 10: Distribution of inference times (ogg-ccale) on 14 large and high-dimensions datasets. TCCM ranks among the fastest deep learning methods, close to methods such as ALAD and DROCC, but far more accurate. In contrast, diffusion-based baselines (i.e., DTEE-NonParametric DTTE-DDMM occupy the slowest end of the spectrum, illustrating T TCCM's superior efficiency for large-scale inference.
Dkop Launndy
Quierial (tatedle))
Distribttion Total Runtine (Trin Tead) on Large and Iig--immmiione Datasats (lg stall)
Oopo 80
Pot
cane
co ove
vescca
oo cop
Asd
TOOM (Dea))
80 osel
to coreoneee
Figure 1I: Distribution of total runtimes (training + inference, log-scale) across the 14 large and high-dimensional datasets. TCCM demonstrates one of the best efficiency-accuracy trade-offs within the deep learning category, remaining among the overall fastest detectors. Its compact runtime distribution contrasts sharply with heavier diffusion (namely OTE-Gaussian DTE-InverseGamme and kernel- based methods (namely KDE), confirming its scalability and deployability in high-volume environments.
deep baselines fail to process such large-scale inputs within reasonable resource constraints (e.g.. memory overflow or exceeding 72h runtime; see Tables 10 and 12). Although evaluating on tens of millions of samples remains exciting direction for future work, our current results already provide compelling evidence that TCCM is well-suited for real-world, large-scale anomaly detection deployments.
47

---

D.3
Ablation Studies and Sensitivity Analysis: Full Results and Analysis
Livear+Sin
Sirusoical joebuut)
ruso MMP
Time Eribodding Aslaton
Emoodd ng Abillion AUPRO
0.
0.8
Bootc
0.0
AUROC
02
Pins
loongiette
44 Mi
22, maggiin maromoopppyyy
istemetoo
Pinn
18, dourgilate
22 muumppic garmna
Heua
Figure 12: Ablation Study on Time Embedding Methods. We compare three different time embedding strategies used in our flow-based anomaly detection model: Linear+Sin, Sinusoidal (default), and MLP. across eight representative datasets spanning four categories: Small (29_ Pima, 18 Jonosphoree,, Medium (31 s_stimaaageee, 44_ Wilt), Large wwg.aaag.gaaatnm 23 mammography) and High-dimensionall (25 __5_mss,11 17 InternetAds). The figure shows AUROC (left) and AUPRC (right) scores the y-axis versus dataset names on the x-axis. Bars are grouped by embedding method and include standard deviation as error bars. Results show that our model is robust across all embedding types, with the default Sinusoidal embedding generally offering strong and stable performance.
23. Pina
31, sutimagg-222
0.0
Sepmaly
0.6
AUROC
0.6
022
0.4
0.6
0.8
1/0
08
02
84
06
0.6
1.0
0.0
62
0.4
06
0.8
1.0
0.0
02
0.4
046
0.8
Food Time Value Callereeeene
Food Time Valus Eal. Inforncce
Fxod Time Value E inforencc
Fooed Time Value Cal Inforence
22, mag c.garmm
23, mammorg uptty
muakk
0.8
0.6
0.6
0.2
0.4
0.6
0.8
1/2
0.2
0.2
04
0.6
0.6
1.0
0.0
6.2
0.4
0.6
0.8
1.0
0.0
02
0.4
0.5
0.8
Food Time Value c arffereence
Food Time Val un af inference
Faod Time Valua af inforence
Food Time Value call infererce
Figure 13: Sensitivity Analysis on Time Value at Inference. We evaluate the sensitivity of our model to different fixed time inputs [0.0, 1.0) inference across four categories of datasets: Small 29m_, 18 Jonosphere), Medium (31 satimage-2, 44_ Wilt), Large (22 mag.amaggaaaaa......m... 23 mammography), ) and High-dimensional (25 musk, 17 InternetAds). Each plot shows the average AUROC (blue) and AUPRC (red) across 5 random seeds, with individual points marked on each curve. Shaded regions indicate one standard deviation. The x-axis represents the fixed value of time f, while the y-axis reports the detection performance (AUROC or AUPRC). The results demonstrate that our method is insensitive to the specific choice of t. Other datasets show similar behavior and are omitted for brevity.
48

---

Nase (dofouit)
(defaur))
Efecc Nolon AUROC
Wi Noove
Notee
Effect of No on AUPUR
0.5
AUTOOCC Croce
0.4
2.4
22
0.2
8.
0.0
23 Mone
2
Hin
peggh parma
mevnignaty
28 poat
Intemmoll
M88
28 Maak
Datacee:
Dananee
Figure 14: Ablation Study on the Effect of Injecting Noise during Training. We compare the anomaly detection performance (AUROC and AUPRC) of TCCM trained with and without noise perturbation. We report results across representative datasets spanning four categories (small, medium, large, and high-dimensional). Each bar shows the average score over 5 random seeds, with error bars indicating standard deviation. Key findings: (1) On most datasets, adding noise during training does not significantly impact performance; (2) However, in some cases (c.g., Wilt, mammography), injecting noise leads to a substantial drop in AUROC and/or AUPRC, This indicates that noise injection, while helpful in diffusion based generative modeling, may hinder learning deterministic anomaly detection tasks.
Study 1: Time Embedding Variants Used in TCCM. We consider three different time embedding strategies within the TCCM architecture, each representing a trade-off between simplicity and expressiveness:
Linear + Sin: This basic approach applies a single linear layer followed by a sine trans- formation to the scalar time input t. It is defined as Φ(t) = sin(Wt WW b), where W and b are learnable parameters. This encoding is computationally efficient and empirically fast to converge, making it suitable for lightweight applications.
Sinusoidal (default): Inspired by the positional encoding in Transformers, this method maps time fixed set of sinusoidal functions different frequencies. It is defined as
(t)) = [sin(w1f), cos(wit), sinaa)) cos(wat)).
where frequencies W; are logarithmically spaced. This embedding captures richer periodic structure without additional learnable parameters.
Sinusoidal + MLP: To enhance the expressiveness of the sinusoidal embedding, we append two-layer feedforward MLP to it. This allows the model to learn nonlinear combinations the sinusoidal basis, which is often beneficial when modeling more complex dynamics. However, it introduces more parameters and increases training time.
All three variants are seamlessly plugged into the same backbone network, differing only in the time embedding module. In our experiments, we observe consistent performance across them, while the sinusoidal embedding offers a good balance between performance and simplicity.
Study 2: Sensitivity to Fixed Time t during Inference. In the TCCM framework, the final anomaly score is computed based on the model output at a specific time f, typically fixed to = 1.0 during inference. To assess the robustness of our method to the choice of t, we conduct a sensitivity analysis by varying uniformly in the range [0.0, 1.0] and measuring the performance in terms of AUROC and AUPRC eight representative datasets.
For each dataset, we fix to different values and compute the anomaly score as S(x) = [xx () at|2, where fo(ær, !) is the predicted vector field. This formulation relies the observation that, for normal samples, the model learns to approximate fo(2, I) R -æ, such that the residual becomes small. Anomalous samples, being out-of-distribution, typically incur larger residuals.
49

---

13
22, 22,
12 Jascspee
3t auaddrege-2
44,W11
BISCHNDOCH
CaRe
22. pare
25 maanernreraatyy
25 mm
17. FieemdAAs
Aewmmd Fusing
Abnorenc Thaningg
(a) AUPRC vs. contamination ratio.
22, Pre
18 Janeptee
2L audereeee
44
Cale
23.marerepeety
25
17. Klooddds
Atromna Farter Furting
Aarimaal Parinn Set
Abcoresi Tharing St
(b) AUROC contamination ratio.
Figure 15: Sensitivity to training- set contamination for TCCM and 10 top- pop-efforming baselines. For each dataset, we fix the train/test split by using 50% of normal samples for training and progressively inject anomalies into the training set (up to the dataset's natural anomaly ratio). The x-axis denotes the abnormal ratio training; curves summarize mean and variance across multiple seeds (see legends for methods). Overall, increasing contamination tends to reduce performance for most methods; TCCM remains among the most robust, though degradation can still occur on some datasets. We present AUPRC (top) and AUROC (bottom) separately to improve readability.
The results (see Figure 13 demonstrate that the detection performance is largely invariant to the specific value of t, indicating that our method not sensitive to this hyperparameter. This makes the approach more robust and practical, it avoids the need for tuning t at inference. The shaded areas the figure denote standard deviation over five random seeds, further confirming the stability of the results.
Study 3: Effect of Noise Injection during Training. To assess the role of stochasticity in our framework, we compare two variants of TCCM: one trained with Gaussian noise injection- motivated by the SDE formulation in Appendix C.1 and another trained deterministically without noise. In the noisy case, input samples are perturbed as Ø(t) = x + te with N/ I). ) but the model is still supervised predict the residual vector = This setup preserves the inductive bias toward contraction while introducing input-level stochasticity during training. In contrast, the deterministic variant trains unperturbed inputs using the same supervision.
Empirical results, summarized Figure 14 show that noise injection does not consistently improve performance and in many cases leads to a significant drop in AUROC and AUPRC- AUPRC-particulal for datasets such as Wilt and mammography. These findings validate our theoretical motivation: while noise injection can enhance sample diversity in generative modeling, anomaly detection- esspecillly
50

---

Standardiaaioon
Cled of Ebentactoalion AURDC
EPed Stancantionl ALPREC
1,0
AUNDC Dooe
0.5
2.4
0.4
Pm
salmagrn
prgpli ganma
PMng
20, Minagli parome
jivennngg only
Dalaset
Figure 16: Ablation Study on the Effect of Performing Z-score Normalization before Model Training. We compare the anomaly detection performance (AUROC and AUPRC) of TCCM trained with and without noise z-score normalization. We report results across 8 representative datasets spanning four categories (small, medium, large, and high-dimensional), Each bar shows the average score over random seeds. with error bars indicating standard deviation. Key findings: (1) On most datasets, performing z-score normalization does not significantly impact performance; (2) In some cases (c.g.. Ionosphere, Wilt), performing Z-score normalization Ieads to substantial increase in AUROC and/or AUPRC. This indicates that without normalization, the anomaly scores may be dominated by features with larger scales, leading to suboptimal ranking behavior, However, we note that performing z-score normalization on a few datasets (e.g., InternetAds) leads drop in AUPRC.
No Time Surpping With Timm Samp
Effct of Thme weightd Sampling NUROC
Efest Time weightg AUPRO
1.0
0.5
0.5
AUROC Stoe
0.4
Phos
12, sonnughtte
37. 2
44,
pagl Gemma
25 maneappia
17 Jnerroodds
25, Pins
12 Immophht
11 2
40,
20 magile genunm
mask
12 hetennadd
Dataso:
Dataset
Figure 17: Ablation Study the Effect of Training with Interpolated T'mee-Dependent Inputs. We compare the anomaly detection performance (AUROC and AUPRC) of TCCM trained with and without interpolated inputs z, tz, while keeping all other configurations identical. Results are reported across 8 representative datasets spanning four categories (small, medium, large, and nigh-dimensional), Each bar shows the average performance indicating standard deviation. Key findings: (1) Introducing lime-interpolater samples generally does not improve anomaly detection performance. with results remaining approximately unchanged or moderately degraded on most datasets; (2) The degradation is more evident on certain datasets (c.g.. Wilt, magic_.ig.. c_gamma), suggesting that interpolated trajectories may introduce undesirable temporal supervision signals; (3) These results empirically support our design choice of directly supervising time-conditioned vector fields at fixed input locations, as discussed in Section 3
5 random seeds, with error bars
under a semi- semi-supervised regime-relies on preserving the precise structure of normal data. Even mild stochastic perturbations may obscure this structure, weakening the learned vector field. Consequently, deterministic training procedure yields more stable and effective results for anomaly detection.
51

---

Tin:Enoodiing
TCOM (OuiS)
AUROO Compatson
AUPRI Comparson
1.0
1.0
0.8
0.9
AU/DOC Cooe
3.9
Phos
44 Mit
mugii gereo
mantrogiuhh
shot W7.nemoddd
Pies
Way
cogii poiros
28 m.on
Figure 18: Comparison between TCCM and Autoencoder with Time Embedding (AE+TE) across eight datasets. Bars represent mean AUROC and AUPRC values averaged over 5 random seeds; error bars indicate standard deviation. TCCM consistently performs on par or better, especially on Wilt and magic_gamma, demonstrating that direct residual learning without reconstruction bottlenecks better captures anomaly-relevant dynamics.
Study 4: Effect of Contamination in Training Data. This study examines how varying degrees of contamination--ie.. abnormal samples present in the training set-affect model performance. Unlike the main experimental setup, where 50% of normal data is used for training and the test set contains the remaining normal and all abnormal samples, here we fix the train/test split by randomly dividing both normal and abnormal data in half: 50% of the normals are used for training, and evaluation conducted on the remaining normals plus half of the anomalies. We then progressively inject additional anomalies into the training set, increasing the abnormal ratio from near-zero up to each dataset's 's intrinsic anomaly rate. This protocol normalizes the contamination range across datasets and isolates its effect under the semi-supervised assumption.
Empirical results (Figures 15b) compare TCCM with ten cop-performing baselines. While TCCM maintains stable AUROC and AUPRC on several datasets, its performance like that of most methods--deteriooaall particularly evident when the abnormal ratio approaches the dataset's natural contamination level, suggesting that even small amounts of anomaly leakage distort learned decision boundaries. Overall, the results indicate that no method is entirely immune to contaminated supervision and reinforce the practical importance of maintaining clean training set in semi-supervised anomaly detection.
as contamination increases, sometimes substantially. This degradation is
Study Effectiveness Conventional Flow Matching on Anomaly Detection. While princi- ple conventional Flow Matching can be adapted for anomaly detection, our preliminary experiments indicate two natural strategies yield suboptimal results: (i) using a standard Flow Matching model to reconstruct the input from a Iearned trajectory and computing the final-step reconstruction error as the anomaly score; (ii) computing a cumulative reconstruction error across multiple time steps along the trajectory. We implemented both approaches and found them to be worse than our proposed TCCM terms of both detection accuracy and inference efficiency. In particular, trajectory simula- tion requires numerical integration and multiple model evaluations, incurring high computational cost at inference time. In contrast, TCCM performs anomaly scoring with single forward pass at a fixed time step, offering both speed and accuracy advantages.
Study 6: Effect of Feature Normalization. In practice, we apply z-score normalization (zero mean, unit variance) all features before training and inference, which aligns the origin with the center of the normal data distribution. To further evaluate the impact of normalization, we conduct an ablation study comparing TCCM trained with and without z-score normalization. Results across eight representative datasets (see Figure 16) show that normalization does not significantly affect performance on most datasets but leads substantial gains some cases (e.g., Ionosphere, Wilt). This suggests that without normalization, features with larger scales may dominate the anomaly score,
52

---

degrading ranking quality. On few datasets (e.g.. InternetAds), normalization slightly reduces AUPRC, indicating dataset-specific effects. Overall, these findings demonstrate that normalization generally improves robustness and provides a principled justification for contracting toward the origin our framework.
Study 7: Effect of lime-lnterpolated Inputs. A key design choice in TCCM is to supervise the time-conditioned vector field directly fixed input locations, without using interppereoo samples. To examine whether incorporating interpolated inputs (i.c., Zz = tz) influences performance, we conduct an ablation study comparing models trained with and without time interpolation. Re- sults across eight representative datasets (see Figure 17) show that introducing interpolated samples generally does not improve anomaly detection performance, with results remaining approximately unchanged or moderately degraded on most datasets. The degradation is more evident on certain datasets ge.g., Wilt, s_ggmma),,) suggesting that interpolated trajectories may introduce unde- sirable redundant temporal supervision signals, which can interfere with the learning of stable contraction dynamies. Overall, these findings empirically support our design choice of training with fixed imputs and time-conditioned supervision, confirming that TCCM effectively captures temporal dependencies without requiring explicit trajectory interpolation.
Study 8: Distinction Between TCCM and Autoencoder with Time Embedding (AE+TE). A remaining concern pertains to the conceptual distinction between TCCM and an autoencoder (AE) architecture applied to aime-augmented data. While both methods may take the same input form (x, Embed(t)), their training objectives, architectural principles, and learned representations differ fundamentally.
Conceptual Comparison. Autoencoders aim minimize reconstruction loss (c.g.. 1|2 = learning to reproduce the input itself. In contrast, TCCM learns a time-conditioned velocity field fo (f)) that is explicitly supervised toward a fixed contraction direction (-2). This dis- tinction fundamentally alters both the optimization target and the semantics of the learned mapping: TCCM predicts the instantaneous contraction dynamics of the data manifold, rather than reconstruct- ing input values. Consequently, the model operates under the framework of vector field learning. akin to score-based diffusion or flw-maathing methods, not under the reconstruction paradigm of autoencoders.
Architectural Comparison. TCCM predicts the residual vector field directly in the input space using a 3-layer MLP without bottleneck compression, maintaining full dimensionality throughout. In contrast, the AE+TE baseline employs symmetric encoder-decoder architecture with latent bottleneck layer, formulated as:
Encoder: Linear(input dim time temeed dim 256) ReLU + Linear(256
bottleneck -iieeeeeedd_md))_ee + ReLU
Decoder: Linear(bottleneck dim input dim + time time_embed dim)
256)
ReLU
Linear(256
This bottleneck compression can discard anomaly-related signals, particularly in early training, whereas TCCM preserves feature-level information and learns residual dynamics directly.
We compare both models on eight representative datasets (see Figure I8). spanning small, medium, large, and high-dimensional settings. TCCM consistently matches or outperforms Time baseline exhibits pronounced performance degradation on datasets such as Wilt and magic_ confirming that its reconstruction oriented learning objective is less suited for capturing contraction- based anomalies. These results demonstrate that the advantages of TCCM arise not from architectural complexity but from its fundamentally different learning principle.
Experimental Results.
in both AUROC and AUPRC metrics. Notably, the AE+TE
Conclusion. Both empirically and conceptually, TCCM is not an autoencoder. Its flow-inspired supervision, residual prediction mechanism, and non-bottleneck design collectively enable model anomaly- molleatt dynamics more effectively than reconstruction-base alternatives.
53

---

D.4 Empirical Studies on Robustness and Interpretability
D.4.1 Empirical Studies on Robustness
Although has been shown theoretically, we provide an empirical study on robustness here. By following (Bergman and Hoshen 2020), we utilize PGD (Madry et al., 2017 to create adversarial examples, aiming to make anomalies appear like normal instances (or make normal instances look like anomalies). We measure the increase of false negative rate (i.e., the decrease of anomaly score) or false positive rate (i.e., the increase of anomaly score) on the adversarial examples. To make sure that the attacks are non-trivial, we must limit the allowed budget to use.
Experiment Setup. The experiment is conducted a suite of synthetic datasets generated from two disjoint Gaussian mixture models. Details of the dataset construction are provided in Table 2 In line with the 65-95-99.7 rule for standard normal distributions, this setup largely satisfies the assumptions of Proposition | (namely Proposition i in the main paper), while enabling us to evaluate the robustness of the proposed TCCM method. The training set consists of 5,000 samples randomly drawn from the mixture distribution P. The test set comprises 4,000 samples from P and 1,000 samples from Q, resulting in an anomaly ratio of 0.2. Following our experimental setup used in ADBench, both training and test sets are standardized prior to attack. We consider two types of attacks: 1) False positive attack, where normal samples are perturbed to appear anomalous; 2) False negative attack, where anomalous samples are perturbed to resemble normal data. For the PGD-based attack setup, we evaluate 30 levels of perturbation budgets, e E (0.1,022,0 0.3 .... 2.8, 2.9, 3.0), under the Lo norm. Each attack is performed with step size of 0.01 and maximum of [200-6 iterations. is worth noting that, given the data is standardized, a perturbation budget of e = 3 corresponds to a substantial shift in feature space. For both attack types, we track how AUROC and AUPRC evolve with increasing perturbation strength. All experiments are independently repeated five times using different random seeds to ensure statistical robustness.
Table 2: Specifications of synthetic data for robustness verification. La is identity matrix with
size d. The normal data is sampled from GMM with three modes, where ll = -3 x 1a, Oa. and μ3 3 x 1 The anomaly data is sampled from two-mode GMM, where V1 - x 1,
and = 9 x 1d- The experiments are performed across 5 different dimensionalities, i.e., d E
{2, 10, 20, 50, 100).
Datasets
Normal P
Anomaly Q
Robustness
(ur, Ta) Σ N Ta) Cr 3
Ome 10
Dte 24
Cim
Dm:: 106
Figure 19: Results of false negative attacks (attack on anomaly samples) on synthetic GMM shift datasets across five different dimensionalities. The horizontal axis represents the maximum perturbation budget (measured in the L norm), while the vertical axis indicates the area under the curve (AUC) value.
ROC
RR
10
15
Masiage
21
14
Figure 20: Results of false positive attacks (attack on normal samples) on synthetic GMM-to-GMM shift datasets across five different dimensionalities. The horizontal axis represents the maximum perturbation budget (measured in the L norm), while the vertical axis indicates the area under the curve (AUC) value.
54

---

The results are presented in Figure 19 and Figure 20, with baseline AUROC and AUPRC scores (i.e.. before attack, when the maximum perturbation budget is zero) also indicated for reference. As shown, TCCM is both theoretically justified and empirically validated to be robust under the GMM-to-GMM shift setting. It consistently achieves the highest AUROC and AUPRC across all random seeds and dimensionalities, effectively detecting anomalous samples from Q in all cases. TCCM demonstrates strong robustness against false negative attacks: both AUROC and AUPRC remain at 1.0, regardless of the perturbation strength. This indicates that adversarial perturbations fail to disguise anomalous inputs as normal. In the case of false positive attacks, TCCM also exhibits a notable degree of robustness. As normal samples distribution, TCCM maintains high AUROC and AUPRC cacuuus-prrticllattt up to perturbation levels equivalent to standard deviation of the standardized data. The only exception occurs in high-dimensional settings (e.g., d = 100), where performance slightly degrades. These results suggest that TCCM learns compact and stable representation of normality, enabling it to ignore semantically meaningless variations within a reasonable margin.
gradually perturbed away from their original
D.4.2 Empirical Studies on Interpretability
To further validate the reliability of TCCM's feature-level importance scores, conduct con- trolled synthetic experiment designed to quantitatively assess whether the learned residual vector field can accurately identify the features responsible for anomalies. This study complements the qualitative analyses in the main paper by providing direct empirical evidence of the model's intrinsic interpretability.
Experimental Design. We construct a well-controlled anomaly detection task based on Gaussian Mixture Model (GMM) with known anomalous dimensions, enabling precise evaluation of whether TCCM attributes anomalies to the truly perturbed features.
Normal samples: Drawn from a standard multivariate Gaussian No,, I).
Anomalous samples: Generated from 3-component GMM:
Commponett 1: dimension shifted,
- Component dimensions shifted,
Component 3: dimensions shifted.
Shift magnitude: Each shifted feature is perturbed by a random offset uniformly sampled from the range [15, 20).
Input dimensions: We vary d E {5, 10, 15, 20, 25).
Training: The model is trained exclusively on normal samples.
Evaluation: Both anomaly detection and feature-level explanation are assessed on the combined test set.
Evaluation Metrics.
We employ two complementary metrics that do not rely on any external
explainer:
The proportion of anomalies for which the predicted top- features exactly coincide with the ground-truth anomalous dimensions, where k equals the number of shifted dimensions per sample (k e (1))
Exact Match:
Jaccard Index: The average intersection-over-uuii (IoU) between predicted and true anomalous dimensions across all anomalous samples.
Both metrics are derived directly from the model's built-in residual vector field, computed as [[x,(((x (t)) + x x]]12, as defined in 5l the main paper. This ensures that interpretability evaluated based on the model's internal reasoning rather than post hoe approximations.
Results and Discussion. The outcomes in Table shoow that TCCM consistently and accurately identifies the ground-truth anomalous features across all tested dimensionalities.
The near-perfect ExactMatch and Jaccard scores confirm that TCCM's residual velocity field yields faithful, fine-grained feature-leved attributions. Crucially, this interpretability arises intrinsically from
55

---

Table 3: Quantitative evaluation explanation accuracy on synthetic GMM anomalies.
Setting
ExactMatch
Jaccard
AUROC
AUPRC
5D
1.000
1.000
1.000
1.000
10D
1.000
1.000
1.000
1.000
15D
1.000
1.000
1.000
1.000
20D
0.996
0.998
1.000
1.000
25D
0.996
0.997
1.000
1.000
the model's formulation-ns auxiliary explanation method (e.g., SHAP or LIME) is required. The residual components directly encode each feature's 's contribution to the contraction mismatch, offering transparent and actionable view of the decision process. This property enables practitioners in domains such as fraud analysis, medical diagnostics, and industrial monitoring to understand not only which samples are anomalous but also why.
D.5 Statistical Tests
To rigorously assess whether the performance differences between TCCM and competing methods are statistically significant, we conduct non-parametric statistical tests on their rankings across 47 datasets. For each method, compute its average AUPRC and AUROC rankings over five random seeds on each dataset. Given the multi-method, multi-dataset nature of this evaluation, traditional pairwise tests are inadequate due to increased risk of Type I error. Hence, follow the protocol proposed by Demšar (2006), which recommends a two-stage procedure:
First, we apply the Friedman test (Friedman) 1937). non-parametric alternative to repeated- measures ANOVA, to determine whether there is any statistically significant difference in performance rankings among all methods.
If the null hypothesis is rejected, we proceed with the Nemenyi post hoc test (Nemenyi 1963), which compares all classifiers pairwise. Two methods considered significantly different if their average ranks differ by at least the critical difference (CD).
Compared alternatives like the Wilcoxon-Hoon method (Gareía et al. 2010), which performs pairwise tests between a control method and others with Holm correction, the Nemenyi test is more conservative-it simultaneously controls the family-wise error rate across all pairwise comparisons, not just against a reference. While this often results in fewer significant findings, it provides a stronger guarantee against false positives, especially important in benchmark settings involving many methods.
We report the results using critical difference diagrams (see Figure 21 and 22). For AUPRC, the Nemenyi test indicates that there group, which includes TCCM (ranked 5.8), DTTa-NoPParametric, LUNAR, KDE, AutoEncoder, ICL, CBLOF, DTE-Categorical, GMM, and OCSVM. For AUROC, the top group includes TCCM (ranked 5.7), Parramtrir,iitrricc LUNAR, KDE, AutoEncoder, ICI,, CBLOF DTE-Categorical, GMM, and Sampling. Although TCCM achieves the best average rank in both metrics, the conservative nature of the Nemenyi test explains the lack of statistically significant superiority. Nonetheless, TCCM consistently ranks at the top, reinforcing its robustness and broad effectiveness across diverse datasets.
statistically significant differences among the top-performing
Table 4: Overall comparison of cop-performant anomaly detection algorithms (with top-4 performance in terms of AUROC and AUPRC) across four key dimensions.
Algorithm
Accuracy
Scalability
Explainability
(Provable) Robustness
TCCM
(feature contribution)
OVE--NoPPrrametii Livernocbe et al. 2023
x (slow inference)
/ /treconstruction)
X
LUNAR (Goodge et 2022
(slow trining)
X
X
KDE (Latecki el al 2007
X (slow training)
(density)
X
56

---

Crticall Difference Diagram (AUPRC)
CD -0-3
COLOT
A000
DADMM (0.51
1400
0040 $5.5
DITEOONI
UMMerayy (A11)
(22
Nomalang"ov (2.00
Figure 21: Critical difference (CD) diagram illustrating statistical rank comparisons of the 45 anomaly detection methods based on their AUPRC performance across 47 datasets. Each method is ranked by its mean AUPRC over five random seeds. The CD value, computed via the Nemenyi post-hoc test at significance level 0.05, indicates the minimum difference in average rank that is statistically significant. Notably, TCCM (ranked 5.8 on average) is part of the top-performing group including OTTE-NonParametiic LUNAR, KDE, AutoEncoder, ICL,, CBLOF, TTEe-aatgorical, GMM, and OCSVM.
Critiall Differance Diagram (AUROC)
CD 64
TCOM Dant 5.)
AU40
LSMO
40.000 (407)
A. 01.5
C000440
J800 0000
08000 p91
PQkk (43)
3M/D PM0
26.1
1004.200
240 01:40
ADDW (8.2)
(811)
1806 21.5)
Deeat/000 942
Baenalerghie 2000)
Figure 22: Critical difference (CD) diagram illustrating statistical rank comparisons of the 45 anomaly detection methods based on their AUROC performance across 47 datasets. Each method is ranked by its mean AUROC over five random seeds. The CD value is derived using the Nemenyi post-hoc test with significance level of 0.05. TCCM (with an average rank of 5.7) belongs to the top-performing group, which includes DTE-NonParammttric LUNAR, KDE, AutoEncoder, ICL, CBLOF, DTE- Categorical, GMM, and Sampling.
57

---

D.6 Limitations and Broader Impacts
Limitations. While TCCM achieves state-of-the-ar performance with relatively low computational cost, we outline three limitations that offer promising directions for future research. (1) Data Modality: As the first work on adapting flow-matching modeling to anomaly detection, our study focuses exclusively on tabular data. Extending TCCM to other data modalities, such as vision (Liu et al.] (021), or graph-structured data (Akoglu al.
et al. 2024), time series (Blázquez-Garee 2015 Li et al. 2024a), is an exciting avenue for exploration. (2) Neural Architecture: To achieve maximum efficiency, TCCM models the velocity field using multilayer perceptron. This design choice raises an open question: could more sophisticated neural architectures, such as ResNet (He) et al. 2016), further improve performance? (3) Soal-World Usability: Our evaluation is conducted on ADBench (Han et al., 2022), following the common practice in the anomaly detection research community. Exploring TCCM's effectiveness in real-world high-stakes domains, e.g., finance or healthcare, under more dynamic and complex conditions would be valuable.
Broader Impacts. While the TCCM methodology, as presented, is foundational research focused on advancing anomaly detection in tabular data, its limitations inherently shape its potential broader impacts and demarcate avenues for future work that could address these implications. The current focus on tabular data, while demonstrating significant methodological advancements, means that the direct applicability to other prevalent data types like images, time series, complex graph structures is not yet established. The broader societal impact of anomaly detection often lies in these other domains such as medical imaging analysis, financial transaction monitoring over time, social network security. Therefore, until TCCM is extended and validated on these diverse data modalities, its positive impact in such critical areas remains future prospect, and any potential negative impacts from misuse these unvalidated contexts are purely speculative but warrant caution.
Furthermore, the utilization of multilayer perceptron (MLP) for the velocity field, chosen for efficiency, may cap the model's capability to discern highly complex patterns compared to more so- phisticated architectures. This architectural limitation could influence its broader impact in scenarios demanding exceptional nuance and accuracy, potentially limiting its deployment in safety-critical applications where the cost of a false negative or positive is extremely high. The ethical implications of deploying a system that might not capture the full complexity of a problem due to architectural constraints should be considered the rescarch progresses.
Lastly, the evaluation of TCCM primarily on the ADBench benchmark, though standard practice, means its performance characteristics in messy, dynamic, and potentially adversarial real-world environments are not fully known. The broader impact, particularly concerning fairness, robustness to unforeseen data shifts, privacy implications in data-sensitive fields like finance or healthcare, and security against emergent threats, can only be truly assessed through rigorous testing in such operational settings. Without this, the translation of TCCM into systems with significant societal touchpoints should proceed with a clear understanding of these unevaluated risks. Future work addressing these limitations will be crucial in responsibly broadening the positive societal impact of this line of research.
E Results under the Inductive Evaluation Setting
To ensure a protocol that is consistent across all methods evaluated together, we additionally report results under unified inductive (semi-supervised) setting, in which training is performed solely on normal samples without access to anomalous data. Most methods in our manchmark-includinn majority of deep learning approaches and many classical baselines are already inductive by design and thus remain unchanged. For completeness, we adapt the following algorithms that were originally formulated as transductive detectors to inductive training procedure: ABOD, COF, LOF, PCA, KPCA, KNN, and INNE. All other experimental configurations, datasets, and evaluation metrics are identical those used in the main paper.
the
E.1 Effectiveness under the Inductive Setting
Figures 23a and 23b summarize the aggregated rankings 45 detectors across 47 datasets, based on AUPRC and AUROC, respectively. Each ranking averages over five random seeds.
58

---

Denocer Typa
Deep Leankng
Chnrica (Farss iniitow)
Goneral (nrkcte
50
40
AUFRG
30
20
8
TOOM (Cues) DTE Paramettt
Riee semisun for DT
DK DTEGs
KPCA DTE Aaidennn
Sumpin Ml Fatumillatry
UiE
Avoth GAloemel Doapo
Nomm LMb
Kow
COF ALAD
PPRC
rowy
ABOO
PCA
(a) AUPRC ranking distribution across 47 datasets for 45 anomaly detectors under the inductive setting,
Deledor Type
Danp Loarnig
Cankal F Farw mntitie
Gaaarol Intccho
Rank AUROC
xp
23
10
OTElloPee (Oum)
KAy surm LUNAR
Koe
CBL
Aued mender
DIECater vemthuu
KPCA semitup
Fentandting GC
ViL DTE
Hel00 PCA Semilup
Avnazall DeadVvDD
Geilomal Nomationg
CDF cOr. simedog DAOMM ALAD
KPGA
D'E
Mo so
ABGO
(b) AUROC ranking distribution across 47 datasets for 45 anomaly detectors under the inductive setting.
Figure 23: Updated detector ranking distributions (AUPRC and AUROC) under the inductive (semi-
supervised) protocol, where models trained exclusively on normal data. Medians are indicated by horizontal lines; means are shown as numbers.
Findings. The ranking trends for deep learning methods remain highly consistent with the main paper: TCCM continues to rank first overall in both AUPRC and AUROC under the inductive setting, indicating that its performance advantage does not rely on transductive assumptions of other baselines. Other strong baselines (e.g., LUNAR, OTE-NonParametric. KDF) approximately preserve their relative positions.
Notably, several classical methods that we adapted from transductive to inductive exhibit substantial performance gains. The improvements are most pronounced for KNN, ABOD, and INNE: for KNN, the average rank in AUPRC improves from 27.9 to 11.1, and in AUROC from 26.4 to 9.2; for ABOD, AUPRC average rank improves from 32.6 to 31.6 and AUROC average rank from 36.1 1 to 15.5; INNE shows similarly notable gains. These changes indicate that experimental protocol can materially affect certain neighborhood- or structure- based detectors.
E.2 Scalability, Explainability, and Ablation Analyses
Scalability. The scalability conclusions remain aligned with the main paper: TCCM retains its efficiency advantages. Methods that were already inductive (e.g.. TCCM, LUNAR, KDE, DTE- NonParametric) are unaffected by the protocol change.
Interpretability. The interpretability analysis in Section 5.1 is unchanged, as TCCM's feature-level explanations stem from its model structure.
Ablation and Sensitivity. We did not repeat ablation/seenittiity studies under the inductive reformu- lation, since the algorithms modified here (ABOD, COF, LOF, PCA, KPCA, KNN, INNE) were not part of those studies.
59

---

Why in the Appendix? We place the inductive-varinn variant results here to keep the main text focused and methodologically consistent: introducing non-canonical inductive variants of originally transductive algorithms into the main tables would complicate the primary comparison without changing our conclusions. The appendix ensures transparency while preserving the clarity of the main results.
In summary, adopting a fully inductive evaluation protocol does not qualitatively change our con- clusions. TCCM remains the most effective and scalable detector, with robust performance under semi-supervised training conditions for all baselines.
60

---

Table 5: Configuration details for each dataset used in TCCM experiments. To avoid bias from aggressive hyperparameter tuning, we adopt a fixed configuration for all core components (e.g.. architecture, time embedding, optimizer) across all datasets. Since our setting is fully unsupervised, we refrain from using label information to optimize hyperparameters. The number of training epochs adjusted in a dataset-dependent but label-agnostic manner by following the unsupervised internal evaluation strategy in Li et al. (2025b). Note that the backbone architecture is a lightweight 3-layer MLP (two hidden layers), chosen deliberately for efficiency on tabular data; we use the term "deep" in line with common practice to indicate a deep learning-basee based. end-to-end neural approach rather than architectural depth per se,
Dataset
Category
Archisecture
Time Embedding
Loss Function
Optimizer
#kppcchs
Hatch Size
Sceds
census
Fligh-iimeniooal
MLP (2:56
Sinusoidal
MSE Loss
Adamn (I=00000))
[0.1.2.344]
backdoor
High-dimmssiional
MLP
Simusoidal (125)
Loss
Adam (le=0.005)
[0.1.2.344
campaign
High dimeusiccal
MLP (2x256 ReLU)
Sinusoidal (128)
MSE Loss
Adam (1=+0.005)
50
1024
[0.1.2.3.4]
mnist
High-dimmeniooal
ML.P (2x256 Rel.Ui)
Sinnsnddll (128)
MSF Loss
Adam (I--00005)
500
512
[0.1.2,344
speech
High-
MLP (2x256 ReLUU)
Sinusoidal (128)
MSE Loss
Adam (1=-0.005)
500
512
(0.1.2.3.4)
optdiiits
High-dimmmioell
MLP (2:226 Rel.U)
Sinusidal (128)
MSE Loss
Adam (I=50,005)
2000
512
[0.1.23344]
SpamRRse
High-dimansiceal
(2x/266 Rel.U)
Sinusoidal
MSF
(1--0.005)
5000
(0.1.2.344
musk
Iligh-dimeniioal
MLP (2:256
Sinusidall (128)
Loss
Adam (I=00.005)
[0.1.2.344)
Ads
High-Simmmioool
MLP (2:4266 Rel.U)
Sinwoidhl (128)
MSE Loss
Adam (I=00.005)
50
512
(0.1.2.344
Janons
Targe
MIP Rol.1]
Sinseddal (122)
MSF Loss
Adam (I--0.015)
30
1034
[0.12.344)
hmp
Large
MLP (2x256 Rel.U)
Sinusoidal (128)
MSE Loss
Adam (1=-0.005)
100
1024
[0.1.233.4)
Largo
MLP (2 (2:256 ReLUU)
Sinuoidi (128)
MSE Loss
Adamn (Iz00,005
10
1024
[0.1.2334)
Frndd
Largo
MI.P 25x
Simmoidal
MSF
(l=0.0005)
75
1024
[0.1.2.3.4
Largo
Sinusoidal (128)
Loss
Adam
1024
[0.1.2.344
celeba
Larpo
MLP (2x256 ReL.U)
Sinusiihal (128)
MSE Loss
Adam (I=0.005)
1024
[0.1.2.344
smip
Larpo
MLP (2x256 Kel.U)
Sinusoidal (128)
MSE Loss
Adam (lr00.005)
1024
[0.1.2334
ALOI
Largo
MLP (2x256 ReLU)
Sinusoidal (128)
MSE Less
Adam (I==0.005)
100
1024
(0.1.233.4
shuttl
Large
MLP (2x256 Rel.U)
Sinusoidal (128)
MSE Loss
Adam (1--0.005)
200
1024
[0.1.233.4
magic
MLP (2x256 ReL.U)
Sinusoidal
MSE Loss
Adam (In-0.005)
10
1024
30.1.233.4
manmography
Larpo
MI.P 255266
Simuoodal
MSF
(l=500005)
(
aambyroid
Mechum
MLP (2:256 KeLU)
Sinusadaal (128)
MSE Loss
Adam (1=00.005]
2000
512 0.1.2.54
pandigits gits
Medium
MLP (2x256 Rel.U)
Sinutoidal (128)
MSE Loss
Adam (In-0.005]
1000
512
(..12.3.4
satellite
Medium
MLP (2x256 ReLU)
Sinusoidal (128)
MSE Loss
Adam (I=-0.005)
10
512
30.12.3..4
landatt
Madium
MIP 25x226 Rel.I
Sinusoidal (128)
MSF Loss
Adam (I-41.005)
512
[4.4..33.4
Medium
ML.P (2x256 Rel.U)
Sinusodda
MSE
(I--0.005)
3.1
PogeBlocks
Medium
ML. 256
Simuoidal
MSE
(I=50000))
1800
Medium
(2:2266 Rel.
Simusidal (128)
Loss
Adam (l=00.005)
512 (0.1,233. 4
thyroid
Medium
MLP (2x256 ReLUU
Sinusoidal (128)
MSE Loss
Adam (1=-0.005)
10
512 00.12.33
Waveform
Medium
MLP (2x ReI.U)
Sinusoidal (128)
MSE Less
Adam (I=00.005)
580
512
(..12.33.4
Candiotocoraphyy
Medium
MLP (2x256 ReLU)
Sinusoidal (128)
MSE Loss
Adam (I=-0.005)
512
(..1.233.4
Fault
Medium
MLP (2 x256 ReLU)
Sinusoidal (128)
MSE Loss
Adam (I=50.005)
5000
512 3
cardio
Medium
ML. (2x256 Rel.U)
Simusoddal
MSE
(I--0.005)
2000
3..1.233.4
letter
MLP
Simusoidal (128)
Loss
Adam
512
(0.1.233.
year
Medium
MI.P (2:/266 Rel
Simusidal (128)
MSE Loss
Adam (l=00.005)
512
(0.1.2334
vowels
Medium
ML. (2x2266 Rel.U)
Sinnsaddl (128)
MSE Loss
Adam (I-000005)
20
512
20.12.34
Pina
Small
MLP (2R256 ReLU)
Simusoidal (128)
MSE Loss
Adam (I=-00005]
512 0.1.2334
breastw
Small
MLP (2 x266 RcLU)
Sinusoidal (128)
MSE Loss
Adam (I-00.005
512 3...2.3.44
WDRC.
Small
MI.P (2x256 Rel.U)
Simusoddal
MSE
Adam (I--0.005)
3..1.23344
lonosphere
MLP (2x256
Simusoidal (128)
Loss
Adam (1e=0.005)
512
(0.1.233.
Stamps
Small
MLP (2: Rel.U)
Sinusidall (128)
MSE Loss
Adam (I=50.005)
200
512
(0.1.2.34
vertehent
Small
MI.P 25x Rel IT]
Sinnsnddal (128)
MSF Los
Adam (I-000015)
25
512
(0.1..33.
WBC
Small
MLP (2x256 ReLU)
Sinusoidal (128)
MSE Less
Adam (I==0.005)
1
512
[0.1.233.4
glass
Small
MLP (2 256 Rel.U)
Simusiddl (128)
MSE Less
Adam (1=5).005)
200
512
[
WPBC
Small
MLP (2 x256 ReLU)
Sinusoidal (128)
MSE Loss
Adam (I=000005)
512
(..12.334)
Lymphographt
MLP (2:256
Sinusoidal (128)
Loss
Adam (I=00000))
[0.1.2334)
wine
MLP Rel.U)
Simusoidal (12%)
Loss
Adam (I=-0.005)
512
[0.1.233
Hepatitis
Small
MLP (2x256 ReLUi
Sinusoidal (128)
MSE Loss
Adam (1=000005)
512
[0.12234)
61

---

Table 6: AUROC results on 12 small datasets, where we compare TCCM to 44 baselines (with independent runs). We report the mean + std (rank).
Degalte
WBBC
2410
721
675
0.02
050
658 201
6422. mid)
4.2
163
16:35
NAV
1718
5117
1126
11.9
mm:10
MILDAM
10.00
m101
MUBC
14
100
E4
645
121
430
Fartag
2414
2039
1796
Ihand
34
880
191
(1
161
150
(2)
Surple
A30m
10F
(1
150
0.20 m0l
61x
655
133 (0t
1417
171
152
Table 7: AUPRC results on 12 small datasets, where we compare TCCM to 44 baselines (with independent runs). We report the mean + std (rank).
108M
435
4.3 640
WBBC
635
20
nallin
185
131
Lemphegptty
C1)
621
RV
X71
10
MILIAM
(8)
100. 200
048 201
132--22201
130
638
(11
111
1.
(2)
Kartnng
2140
11.
12.3
15%
11/6
306
17A0
21.7
113
17l
000.00
126
1900
Lints
Rellaa 14
195
(31
60hes012 (1llaam
21
124-
0031
201
170
MEZC
Hepesto
0087 0007.mm02
138
0.80
Sarknng
2150
12-3
62

---

Table 8: AUROC results on 15 medium datasets, where we compare TCCM to 44 baselines (with 5
independent runs). We report the mean + std (rank in terms of mean among all anomaly detectors).
100 m000
199 m0050
MeSo (3)
211
40
20
contmamn 21
(3)
(30
11)
24
Duse
Galbeak
GB4B
MB GAAL
Buarbe
2A.0
90.GAL
67750mm 24)
658
637
130
06
4702e000 Ni
100
190 mat
(1)
with
Partng
1230
705
Diann
CB
BC10
G994
1B06
Fres
DMB0
L0DA
NED
00VM
(3 (3)
(03 [1)
008
658
30
67
(31
(000 (0)
(00 [5)
65% -it
005 w0th
afthese 30)
(0
aolinwile
47
(0
20
457
[2]
645) mm00000
0487
m0
addtere
1241
1627
X62
193
Diaeet
QMCD
B0G
(33
183
100 (5
14 30
180
(0k
120
(08 (3)
20
Wondan
040
(122) 07)
180
[50
(10
120
63

---

Table 9: AUPRC results on 15 medium datasets, where we compare TCCM to 44 baselines (with 5
independent runs). We report the mean + std (rank in terms of mean among all anomaly detectors).
uiE-wen-d (9)
13:
0.3
n2
c 60
30
anthessn Bi
8
201
(180 1
0100 mullt
(1
177
Duset
BILAP
Galreak
GB4B
10.
MB GAAL
Buarke
2LAB
90.GML
E6
20 261
659
638
(3
678
6THammn 101
10
487 3
6477
135
100
(obuse [i]
120
550
[30
019
Partng
-11
1130
13:
20.7
100
2531
Diann
BC00
0194
I806
DMB0
LODA
NLD
063M
101
(l
Lil
OdBlasen 30
18
058
181
058mm.13
[3)
030
47
42
1ullum [6]
(4 30)
(CCleaa (11
(
35
[50
3540me10 10
ad2.mm (0)
0dE (21
Di
14.22
2001
22.1
Diaeet
CMCD
Seapkig
B0G
(1
LBG (2)
100
(80
(1
A.
028
(33
(7
(5
(4)
Wondan
(illiamm/3
cade
15
Lill--0
L35
1Munnth
64

---

Table 10: AUROC results on 11 large datasets, where we compare TCCM to 44 baselines (with independent runs). We report the mean + std (rank).
A10I
1555
add
aat with
a0 19
12-4403
6
1983
21
6:73
00 181
0431
(0
178
134 (2)
RAY
(U]
191 +.33)
6557
6550
157
20
65
137t
700
2011
1597
8000
ALDI
50
0d0)
220
029
30
(9)
n0m (2)
0180mm211
05
[6]
KAY
Table 11: AUPRC results on 11 large datasets, where we compare TCCM to 44 baselines (with independent runs). We report the mean + std (rank).
Diaset
Deetvoo
330 2215
noth
11 mith
455 m0
0.84 mih
b00bba 31
1 18 07
(2
15
20
635
30 m020
(1]
(9)
066
183
RAY
(l
KAY
(1
194-10013
20000
152
660
130 280
637
alThacoo (1)
211
150
(16
000 20
0370
Sarting
1.55
260
213
1615
6.3
-40
34C
31.
20.4
16:0
CBE.8
5000
Libs
ALDI
1i (2)
(41
(0l [S]
130
125
(3
6570
1:1 (15)
655
12
130 (3:
atth
201
4
K020
0317
Roal
RAY
820 m/3
JAN
124
1342.220
NAY
128 (30
JAN
65

---

Table 12: AUROC results on 9 high-dimensional datasets, where we compare TCCM to 44 baselines
(with 5 independent runs). We report the mean + std (rank).
8300 meneeeo
will
8373
348
448 sedi
120 34
6080
550
Bathawen
4.8
220
3128
P12.00
GANemaly
GOAD
LUMAR
MIN
GRAL
50 GAA
Nax
wdft
20
0.52
(1)
fas
Wy Surayy
1997
15%g
2097
1578
Da
Calas
HB0s
kit
MCD
KAY
4700 wxd
850
340
130 [1)
0427
Spaefacc
B4ll B/
830
850
hibkee
m0 125
655 D0
100
291
198
201
(58
63%
005 (ld)
(30
61%
mddterath
40h
&
100
Eftt
w0th
433
0.7
Table 13: AUPRC results on 9 high-dimensional datasets, where we compare TCCM to 44 baselines (with 5 independent runs). We report the mean + std (rank).
a0--au su 121
108 co
1.40-aamt 20
2
163
87:44
120
2211
Thandd
mm:-0
KB
MIN
30.0
50.08
HI
3i0boo 201
Wak
20
w-10
(1)
Avg Korkey
18:1
6.8
17.66
11:5
1511
33.4
Datirt
CaLos
40
DooD
cass
kile
Lonk
MCD
635 133
1- (1))
3.00
mi)))
Ang
31.28
Date
QMED
DOE
0101
119
632
0177
Spa
men ouder
66


Reviews:
[{"review_id": "MoQEAh8Vnv", "reviewer": "Reviewer_Tprs", "summary": "The authors propose Time-Conditioned Contraction Matching (TCCM), a method for semi-supervised anomaly detection in tabular data. TCCM avoids adversarial training, trajectory simulation, and density modeling—offering a lightweight yet expressive alternative to existing generative approaches. Evaluated on the ADBench benchmark, TCCM outperforms 44 classical and deep-learning baselines in terms of both AUROC and AUPRC, while achieving significantly faster inference than the strongest diffusion-based competitor. It also provides feature-level interpretability through its learned vector field. Theoretical analysis supports the Lipschitz continuity and discriminative capability of the scoring function. Overall, the method presents itself as a highly effective, scalable, interpretable, and robust solution for large-scale anomaly detection.", "questions": "1. Compared to traditional Flow Matching, the proposed training objective removes the need for sampling from a noise distribution. What are the concrete advantages of this modification? Could the original Flow Matching framework be directly applied to anomaly detection, and how would it compare?\n\n2. While a scalability study is included, the datasets used are not extremely large. On what basis is the method claimed to be scalable for very large-scale scenarios?\n\n3. The paper highlights feature-level interpretability. If the method does not provide additional or actionable insights beyond the scoring function, how strong is its claim of being explainable?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n1. The authors conduct extensive empirical evaluations, comparing TCCM against a wide range of baseline methods.\n\n2. The evaluation includes multiple datasets and baselines, demonstrating consistent performance improvements.\n\n3. The paper is well written with a good structure. \n\n\nWeaknesses\n\n1. The core idea of the paper appears to be a direct application of Flow Matching. The results, while strong, may not offer substantial novelty.\n\n2. The theoretical analysis is somewhat limited, as it focuses on specific distributions (e.g., Gaussian and Gaussian Mixture Models), which may restrict its generalizability.", "was_revised": true, "final_justification": "I have read the authors' response, participated in the discussion, and provided final feedback.", "rebuttal": "We thank the reviewer for the accurate summary and encouraging feedback. Below, we address the concerns point by point.\n\n> Weaknesses: 1. The core idea of the paper appears to be a direct application of Flow Matching. The results, while strong, may not offer substantial novelty. \n\nWe thank the reviewer for raising this concern. While our work is inspired by flow matching, TCCM introduces several key innovations that go beyond a direct application:\n\n- **No trajectory supervision or integration**: Classical flow matching relies on supervising interpolated paths and integrating velocity fields over time to transport samples between distributions. In contrast, TCCM learns a time-conditioned contraction vector field via one-step supervision toward a fixed target (−**z**), entirely avoiding trajectory simulation.\n\n- **Task-specific adaptation**: Flow matching was developed for unsupervised generative modeling. TCCM repurposes the idea for semi-supervised anomaly detection, where generation is not required. Instead, we focus on detecting deviations from contraction behavior—this shift in objective leads to a fundamentally different formulation.\n\n- **New scoring strategy**: Our anomaly score evaluates alignment with the contraction field at a single time step (e.g., *t = 1*), rather than integrating over trajectories. This one-step formulation is both efficient and empirically robust.\n\n- **Stability via constant supervision**: Unlike generative models that require noisy targets or interpolation, our method always supervises toward −**z**, simplifying optimization and improving consistency, as shown in ablation results.\n\nWe believe these distinctions make TCCM a novel and principled adaptation of flow matching to a new task setting.\n\n> Weaknesses: 2. The theoretical analysis is somewhat limited, as it focuses on specific distributions (e.g., Gaussian and Gaussian Mixture Models), which may restrict its generalizability.\n\nWe appreciate the reviewer’s concern about the scope of our theoretical analysis. While the robustness result (**Proposition 1**) applies quite generally under the mild assumption of Lipschitz continuity, we acknowledge that the second result (**Proposition 2**) is derived under a simplified setting involving Gaussian mixture models (GMMs). We would like to clarify that the use of GMMs in our second theoretical result is a deliberate and well-motivated modeling choice.\n\nFirst, GMMs have been widely adopted as analytical tools in the machine learning literature—not only in anomaly detection but also in clustering and density modeling. For example, the work of [Zong2018Deep] introduces the **DAGMM** model for unsupervised anomaly detection based on similar distributional assumptions. Likewise, GMMs serve as the theoretical backbone in clustering studies such as [Chen2024Cluster], which performs theoretical analysis under anisotropic GMMs. These works demonstrate that GMM-based settings are not only standard but also provide valuable theoretical insight despite being idealized.\n\nSecond, our aim is not to suggest that real-world data exactly follow GMMs, but rather to use this setup as a clean, analyzable lens to understand the discriminative behavior of the **TCCM** scoring function. The result shows that under mild assumptions, the anomaly score is provably larger in expectation for out-of-distribution samples drawn from disjoint mixtures—thus justifying the use of the residual norm as a discriminative signal.\n\nFinally, deriving general results under arbitrary data distributions is typically intractable, especially for deep models. Our theoretical analysis strikes a practical balance by providing provable insight under realistic yet analyzable settings. We will make this intent and the general relevance of the GMM assumption clearer in the final version. In future work, we aim to explore theoretical extensions to broader classes of distributions, but we believe the current result already provides valuable intuition and justification for the observed empirical behavior.\n\n**References**  \n- [Zong2018Deep] Zong, Bo, et al. *Deep autoencoding Gaussian mixture model for unsupervised anomaly detection*. ICLR, 2018.  \n- [Chen2024Cluster] Chen, Xin, and Anderson Ye Zhang. *Achieving optimal clustering in Gaussian mixture models with anisotropic covariance structures*. NeurIPS, 2024.\n \n>Questions: 1. 1) Compared to traditional Flow Matching, the proposed training objective removes the need for sampling from a noise distribution. What are the concrete advantages of this modification? 2) Could the original Flow Matching framework be directly applied to anomaly detection, and how would it compare?\n\n**(1) *Advantages of Removing Noise During Training.***  \n\nTraditional diffusion-based frameworks inject Gaussian noise to model stochastic evolution—useful for generation, but potentially harmful in anomaly detection where preserving the structure of normal data is critical. Flow Matching, though deterministic, often supervises the vector field using interpolated or perturbed points. Such perturbations, while useful for smooth transport, may obscure the underlying structure of normal data, reducing the separability between normal and anomalous instances.  In contrast, TCCM uses direct supervision without interpolation or noise, leading to more stable dynamics. We analyze this distinction in detail in Appendix C.1: Relation to Flow Matching and Diffusion Modeling.\n\nIn our ablation study (*Appendix D.3, Figure 9*), we compare our deterministic formulation to a noisy variant (where inputs are perturbed as $\\tilde{\\boldsymbol{x}}(t) = \\boldsymbol{x} + t\\boldsymbol{\\epsilon}$ while still predicting $-\\boldsymbol{x}$). Empirically, noise injection consistently reduces performance across datasets like `Wilt` and `mammography`, confirming that deterministic dynamics better preserve anomaly-relevant features.\n\n**(2) *Can Conventional Flow Matching Be Applied to Anomaly Detection?***  \nWhile in principle Flow Matching can be adapted for anomaly detection, our preliminary experiments indicate two natural strategies yield suboptimal results:  \n(i) using a standard Flow Matching model to reconstruct the input **x** from a learned trajectory and computing the final-step reconstruction error as the anomaly score;  \n(ii) computing a cumulative reconstruction error across multiple time steps along the trajectory.\n\nWe implemented both approaches and found them to be worse than our proposed **TCCM** in terms of both detection accuracy and inference efficiency. In particular, trajectory simulation requires numerical integration and multiple model evaluations, incurring high computational cost at inference time. In contrast, **TCCM** performs anomaly scoring with a single forward pass at a fixed time step, offering both speed and accuracy advantages.\n\nWe will clarify this comparison more explicitly in the revised paper.\n\n> Question: 2. While a scalability study is included, the datasets used are not extremely large. On what basis is the method claimed to be scalable for very large-scale scenarios?\n\nWe appreciate the reviewer’s concern. While not all datasets are ultra-large, our benchmark includes **14 datasets** with over 10,000 samples and **6 high-dimensional datasets**, covering a broad range of realistic settings. Notably, two datasets are particularly large: *donors* (619K samples, 10 dim) and *census* (299K samples, 500 dim). As shown in *Figure 3*, **TCCM** achieves inference times of **1.05s** and **3.02s** on these, while the overall most accurate competitor  (DTE-NonParametric) requires **476.60s** and **48,942.85s**, respectively—demonstrating a **3–4 orders of magnitude** speedup.\n\nConventional methods often suffer from the curse of dimensionality (e.g., PCA, KPCA, COF) or poor scaling (e.g., COF, LMDD timeout after 72h or exceed 10GB memory; see *Tables 9 & 11*). Similarly, several deep baselines (PlanarFlow, GOAD, SLAD, DAGMM) could fail to train on large or high-dimensional inputs due to architectural bottlenecks.\n\nImportantly, **TCCM** achieves top-1 **AUROC and AUPRC** rankings across datasets *without sacrificing efficiency*, offering strong practical scalability. While testing on tens of millions of samples is future work, our current results already provide compelling evidence of real-world scalability. We will clarify this in the final version.\n> Question: 3. The paper highlights feature-level interpretability. If the method does not provide additional or actionable insights beyond the scoring function, how strong is its claim of being explainable?\n\nWe thank the reviewer for raising this important question. Our goal is not merely to provide a scoring function, but to offer actionable, feature-level explanations that directly reflect which input dimensions contribute most to a sample’s anomaly score. Unlike methods where interpretability is obtained via separate post hoc techniques (e.g., SHAP or LIME), TCCM’s interpretability is *intrinsically built into its model design*. Specifically, the anomaly score is derived from a learned velocity field, and the **residual vector** $f_\\theta([\\mathbf{x}; \\text{Embed}(t)]) + \\mathbf{x} \\in \\mathbb{R}^d$ is fully interpretable: each coordinate reflects the contribution of a feature to the contraction mismatch. This provides fine-grained attribution that is faithful to the model’s internal reasoning, rather than an external approximation.\n\nTo illustrate this, we visualized explanations on image data (Figure 4) despite our model being designed for tabular settings—showing that the highlighted regions align with semantically meaningful structures (e.g., the extra stroke in digit `7`). These per-feature deviations are immediately actionable in domains such as fraud detection, healthcare, or industrial monitoring, where practitioners often seek to understand not just which instance is anomalous, but *why*. We will make this explanatory mechanism more explicit in the revised version."}, {"review_id": "wRLsYpaA0g", "reviewer": "Reviewer_eFMQ", "summary": "The paper proposes a novel anomaly detection method (TCCM) inspired by flow-matching techniques.\nThe core idea of TCCM is to learn a velocity field that contracts normal datapoints towards the origin.\nThe key assumption is that, during inference, the normal data will be \"squashed\" near the origin, while anomalies will be dispersed elsewhere, thus making them more distinguishable.\nThe paper provides proofs (Appendix C.2) and an extensive experimental evaluation (Section5,  Appendix D) to validate the model against the existing SOTA (Appendix B.2).", "questions": "Major points:\nSee Weaknesses.\n\nSpelling and notation:\n- L131: I find the notation somewhat ambiguous, as $\\mathbf x$ indicates both a vectors (as on L135) and random vectors (as in (4)).\n- L242 (and elsewhere): Sometimes $$||\\cdot||$ has a pedix, sometimes it doesn't. \n\nOpen points for discussion:\n- The authors refer to TCCM as a deep method (L53, L1270), yet Appendix B.3 reports that its architecture is in fact a 3-layer MLP. As the authors acknowledge in the limitations (Appendix D.6), this choice likely trades efficacy for efficiency (potentially explaining the vastly superior speed of TCCM). My point is: why should one consider TCCM a deep method?\n- What if the model learned to contract normal data to another point (e.g., the mean of normal data)?", "limitations": "Discussed in Appendix D.6.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "After a careful read, I believe the strengths of this paper greatly outweigh its weaknesses.\nI am giving a lower confidence score because I am not familiar with the related work.\n\n\n## S1 - Simplicity\nTCCM is conceptually straightforward: it contracts normal data to the origin while dispersing anomalies. This simplicity is a major strength, as it makes the method intuitive, (potentially) easy to implement, and it allows to get strong theoretical guarantees (with some caveats, see W1). Yet, TCCM achieves SOTA performance. \n\n## S2 - Extensive evaluation\nThe experimental evaluation is comprehensive and rigorous, considering a wide range of datasets and baselines. \n\n## S3 - Clarity\nThe paper is exceptionally well-written: clear, detailed, and easy to follow. \nThe presentation is well-structured and the figures informative, in particular Figure 1. \n\n## W1 - Assumed mismatch for anomalies\nOne major theoretical claim (Proposition 2) relies on the assumption that the learned velocity field is mismatched for anomalies (L1208, 1230). \nHowever, this point is stated without formal or experimental justification, nor is it clearly indicated as an assumption of the propositions---L1222 does include it as a *result* of the theorem, but the proof relies on the assumption made on L1230.", "was_revised": true, "final_justification": "I am satisfied by the rebuttal with the authors and do not have any more points to raise.", "rebuttal": "We thank the reviewer for the accurate summary and encouraging feedback. Below, we address the concerns point by point.\n\n>W1 - Assumed mismatch for anomalies: One major theoretical claim (Proposition 2) relies on the assumption that the learned velocity field is mismatched for anomalies (L1208, 1230). However, this point is stated without formal or experimental justification, nor is it clearly indicated as an assumption of the propositions---L1222 does include it as a result of the theorem, but the proof relies on the assumption made on L1230.\n\nWe thank the reviewer for pointing out the implicit assumption regarding the mismatch between anomalies and the learned contraction field in Proposition 2. We fully agree that this modeling assumption should have been stated more explicitly. In the revised version, we will clearly include this as part of the formal assumptions of the proposition to avoid any ambiguity.\n\nRegarding empirical support for this assumption, we offer two points of clarification:\n\n1. *Direct visual validation:* Figure 1 in the main paper provides visualizations of the learned contraction vectors on synthetic 2D datasets. These examples clearly demonstrate that anomalous points consistently deviate from the expected contraction field, validating the mismatch assumption in a controlled and interpretable setting.\n\n2. *Indirect support through benchmark results:* Across 47 real-world tabular datasets, TCCM consistently achieves strong AUROC and AUPRC scores. This level of performance would be difficult to attain if the model failed to differentiate between normal and anomalous points during inference—thus indirectly supporting the presence and utility of the mismatch behavior assumed in our analysis.\n\nTo further address this point, we will also include an additional empirical study in the appendix based on the Gaussian mixture setup discussed in Proposition 2. This will offer quantitative evidence that the score distributions for anomalies and normals diverge under the learned field, thereby justifying the theoretical assumption through experiment.\n\n> Spelling and notation: 1. L131: I find the notation somewhat ambiguous, as $\\textbf{x}$  indicates both a vectors (as on L135) and random vectors (as in (4)).\n\nWe appreciate the reviewer’s attention to notational clarity. Indeed, as noted in Section 2.1, we adopt the convention that bold lowercase symbols (e.g., $\\boldsymbol{x}$) denote vectors, which we use to represent both random variables and their realizations for notational simplicity. While this is common practice in many machine learning papers, we acknowledge that it may introduce ambiguity—especially for readers from a more formal mathematical background.\n\nIn the revised version, we will revise the relevant statements (including Equation (4)) to clearly distinguish between random variables and realizations (e.g., by explicitly writing $\\boldsymbol{x} \\sim p(\\boldsymbol{x})$ and clarifying when $\\boldsymbol{x}$ denotes a sample from $p$). We will also include a brief remark in the notation section to make this dual use explicit while explaining our design choice for readability.\n\n> Spelling and notation: 2. L242 (and elsewhere): Sometimes $||\\cdot||$ has a pedix, sometimes it doesn't.\n\nThank you for pointing out the inconsistency in the use of the norm notation. In some places (e.g., Proposition 1), we explicitly write $\\|\\|\\cdot\\|\\|_2$ to emphasize the use of the Euclidean norm, while in others we simply use $\\|\\|\\cdot\\|\\|$ for brevity. We agree that this may lead to confusion.\n\nIn the revised version, we will standardize all norm expressions to explicitly include the subscript (e.g., $\\|\\|\\cdot\\|\\|_2$) to maintain consistency and improve clarity.\n\n>Open points for discussion: 1. The authors refer to TCCM as a deep method (L53, L1270), yet Appendix B.3 reports that its architecture is in fact a 3-layer MLP. As the authors acknowledge in the limitations (Appendix D.6), this choice likely trades efficacy for efficiency (potentially explaining the vastly superior speed of TCCM). My point is: why should one consider TCCM a deep method?\n\nWe appreciate the reviewer’s attention to the precision of our terminology. When referring to *deep* methods (e.g., L53 and L1270), our intention was to align with the widely adopted convention in the machine learning literature, where “deep” often serves as shorthand for “deep learning-based” methods. This usage is common even when the neural architecture employed is relatively shallow, as long as it involves end-to-end learning via neural networks.\n\nFormally, as noted by [Abiodun2018Survey, Goodfellow2016Deep], a neural network with more than one hidden layer is typically considered a *deep* model. TCCM uses a 3-layer MLP with two hidden layers, placing it within this broad category.\n\nThat said, we agree that the architecture we adopted for TCCM is deliberately lightweight—optimized for tabular data efficiency. As discussed in Appendix D.6, this reflects a design choice to trade architectural complexity for scalability and speed, especially in large-scale tabular scenarios. We will clarify this in the main text and acknowledge that our use of “deep” emphasizes the modeling paradigm rather than the architectural depth per se.\n\nImportantly, the TCCM framework is modular and readily extensible to deeper neural architectures (e.g., ResNet) and other data modalities (e.g., vision, time series). Our current architecture is a task-specific instantiation, not a limitation of the framework itself.\n\n**References**  \n- [Abiodun2018Survey] Abiodun, Oludare Isaac, et al. \"State-of-the-art in artificial neural network applications: A survey.\" Heliyon 4.11 (2018).\n- [Goodfellow2016Deep] Goodfellow, Ian, et al. *Deep learning*. Vol. 1. No. 2. Cambridge: MIT Press, 2016.\n\n> Open points for discussion: 2. What if the model learned to contract normal data to another point (e.g., the mean of normal data)?\n\nWe thank the reviewer for this insightful question. While our method contracts inputs toward the origin by default, the choice of origin is not fundamentally restrictive. In fact, we apply **z-score normalization (zero mean, unit variance)** to all features before model training and inference. As a result, the empirical mean of the normalized data is approximately zero, making the origin coincide with the center of the normal data distribution. Therefore, contracting toward the origin is effectively equivalent to contracting toward the mean of the normal data. \n\nAlthough this implementation detail was described in the main paper (see Lines 301-302), we will make it more explicit in the revised version. Furthermore, we conducted an ablation study (to be included in Appendix D) comparing models trained with and without feature normalization. The results show that normalization consistently improves performance across most datasets. A likely explanation is that without normalization, the anomaly scores may be dominated by features with larger scales, leading to suboptimal ranking behavior.\n\nMore generally, the choice of normalization strategy—and its impact on different anomaly detection methods—has been recognized as an important topic in recent literature (e.g., [Kandanaarachchi2020normalization]). We will include a discussion and relevant references in the updated paper.\n\n**References**  \n- [Kandanaarachchi2020normalization] Kandanaarachchi, Sevvandi, et al. \"On normalization and algorithm selection for unsupervised outlier detection.\" *Data Mining and Knowledge Discovery* 34.2 (2020): 309–354."}, {"review_id": "LOpMxfXBQR", "reviewer": "Reviewer_3Lxk", "summary": "The authors present a novel approach to anomaly detection in tabular data coined TCCM, leveraging a flow matching framework to learn a time-conditioned contraction field that guides samples towards a degenerate target distribution.  This work is inspired by flow matching, but also deviates from it with a simpler more efficient method dedicated to anomaly detection. Especially, no differential equation is involved in the process. The method is inherently interpretable and provably robust, with a Lipschitz-continuous anomaly score that provides theoretical guarantees under small perturbations. The paper provides an extensive experimental evaluation of TCCM across 47 benchmark datasets and against 45 anomaly detectors, demonstrating its effectiveness and robustness. Also, TCCM is shown to be quite highly efficient and scalable, outperforming state-of-the-art methods in terms of detection accuracy and inference speed.", "questions": "- How the hyperparameters have been fixed? What is the sensitivity to them?\n- How does the model extrapolate to 50/50 classification? (OK, not anymore AD, but could have been discussed)", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 4, "strengths_and_weaknesses": "#### Strengths\n\n- The paper is very clearly written and organized.\n- The set of experiments to support the claims is extensive, whether by the number of datasets and contenders, or by the study of ablation, contamination, time embeddings, performance (inference time). \n- Especially the AUROC and AUPRC are reported with mean and std over 5 runs\n- Code is published for replaying the experiments\n- Scalability: TCCM achieves state-of-the-art performance on large-scale and high-dimensional datasets (up to those available in ADBench), demonstrating its ability to handle complex data distributions.\n- Explainability: The method provides feature-level importance scores, enabling interpretable diagnosis and supporting the identification of key contributing factors to anomalies.\n- Robustness: TCCM is theoretically justified and empirically validated to be robust under the GMM-to-GMM shift setting, ensuring reliable anomaly detection in the presence of distributional shifts.\n- Efficiency: The approach requires no adversarial training, trajectory simulation, or density modeling, making it more efficient and scalable than existing generative-based anomaly detection methods.\nAll in all, the model provides a good balance between simplicity - efficiency and performance.\n\n#### Weaknesses\n\n- The architecture is fixed as MLP(2 x 256 ReLU) and the hyperparameter of attention is the number of epochs for training. The reference of Li et al. (2025b) is given for the number of epochs. However, the hyperparameters are hardcoded in the provided code. So it is not clear how they have been determined. It would be helpful to know how well TCCM has converged in each case.", "was_revised": true, "final_justification": "I have read the rebuttal and other reviews. I align with Reviewer Gjui’s concern about protocol parity (inductive vs transductive, esp. for kNN) and the AE vs TCCM distinction. \n\nI maintain my Accept (5). For camera-ready, please ensure that the following items will be addressed:\n1- separate inductive/transductive leaderboards and clear labeling of each method’s setting and tuning parity; \n2- clarify AE vs. TCCM with brief derivation and, if feasible, an AE+time baseline/ablation. \nWith these edits, the contribution remains strong (single-pass scoring, broad SOTA, Lipschitz robustness).", "rebuttal": "We thank the reviewer for the accurate summary and encouraging feedback. Below, we address the concerns point by point.\n\n>Weaknesses: 1. The architecture is fixed as MLP(2 x 256 ReLU) and the hyperparameter of attention is the number of epochs for training. The reference of Li et al. (2025b) is given for the number of epochs. However, the hyperparameters are hardcoded in the provided code. So it is not clear how they have been determined. It would be helpful to know how well TCCM has converged in each case.\n\nWe thank the reviewer for raising this important point. While the architecture of TCCM is fixed as a MLP(2 x 256 ReLU) for all datasets, the training process is not arbitrarily hardcoded, but follows a principled and largely automated protocol based on unsupervised hyperparameter selection, which will be detailed in *Appendix B.6* for completeness.\n\n**(1) Epoch Selection Strategy.**  \nFor each dataset, we initially examine the empirical training loss curve to identify a rough convergence threshold. Using this as a lower bound, we define a bounded search space for training epochs. Within this space, we apply the unsupervised hyperparameter tuning method introduced by [Li2025Towards] to select the best epoch value. Specifically, we adopt the *Improved Contrast Score Margin (CSM)* criterion, which evaluates the margin between top-*k* anomalous and normal samples based solely on the distribution of model outputs, without requiring any ground-truth labels:  $T(f)=\\frac{\\hat{\\mu} _ {\\mathbf{O}}-\\tilde{\\mu}_{\\mathbf{I}}}{\\sqrt{\\hat{\\delta}^2 _ {\\mathbf{O}}+\\tilde{\\delta}^2 _ {\\mathbf{I}}}},$\nwhere $\\hat{\\mu} _ {\\mathbf{O}}, \\hat{\\delta}^2 _ {\\mathbf{O}}$ denote the mean and variance of anomaly scores for the top-*k* predicted outliers, and $\\tilde{\\mu} _ {\\mathbf{I}}, \\tilde{\\delta}^2 _ {\\mathbf{I}}$ correspond to those of the remaining *n-k* points (presumed inliers). This metric is computed for each candidate epoch, and the configuration maximizing $T(f)$ is selected (see Algorithm 1 in the original paper).\n\n**(2) Hardcoding for Simplicity.**  \nWhile the above procedure yields dataset-specific and random seed-dependent epoch values, we ultimately *fix the selected epoch* across all seeds for a given dataset to ensure simplicity and reproducibility across baselines. The reported results in our main tables use these fixed values. Notably, we found that using per-seed dynamically tuned epoch values can sometimes improve performance, but we chose not to report this for simplicity.\n\n**(3) Sensitivity Analysis and Observations.**  \nTo further address the reviewer’s concern, we will include in *Appendix D.3* a sensitivity analysis over representative datasets. We observe two consistent patterns:\n\n- *Type I: Stable Plateau.* For most datasets, model performance stabilizes after a certain number of epochs, where additional training yields no further gain but incurs higher runtime.\n- *Type II: Overfitting Risk.* For a few datasets, excessive training leads to overfitting and degraded performance.\n\nThese findings support our principled choice of using CSM-based selection with early convergence boundaries to prevent both underfitting and overfitting.\n\n**(4) Broader View.**  \nFinally, we emphasize that unsupervised hyperparameter tuning remains an under-explored but essential challenge in anomaly detection. Our work adopts a recently proposed and well-validated criterion, but we believe this area deserves further attention and plan to explore more adaptive tuning methods in future work. We will provide our automatic hyperparameter tuning code as part of the final version to encourage reproducibility and future extensions.\n\n**Reference**  \n- [Li2025Towards] Li, Zhong, Yuhang Wang, and Matthijs van Leeuwen. \"Towards automated self-supervised learning for truly unsupervised graph anomaly detection.\" Data Mining and Knowledge Discovery 39.5 (2025): 1-43.\n\n>Questions: 1. How the hyperparameters have been fixed? What is the sensitivity to them?\n\nWe thank the reviewer for raising this important question. Please refer to our detailed response to the previous weakness point, where we describe our principled protocol for hyperparameter selection—including automatic epoch tuning via unsupervised validation, simplicity considerations, sensitivity analysis, and our commitment to releasing the full hyperparameter selection code.\n\n> Questions: 2. How does the model extrapolate to 50/50 classification? (OK, not anymore AD, but could have been discussed)\n\nWe appreciate the reviewer’s interest in extending TCCM beyond the standard anomaly detection setting. Indeed, as noted, a perfectly balanced 50/50 classification problem falls outside the conventional semi-supervised anomaly detection regime.\n\nThat said, our framework naturally accommodates two related extensions:\n\n*_(1) Semi-supervised 50/50 classification._*  \nIf training data only contains samples from one class (e.g., class A), and test data includes both class A and class B in equal proportion, this becomes a one-class classification task—a setting where TCCM remains directly applicable. The model learns a contraction field over class A during training, and can detect samples from class B at inference time via high residual scores.\n\n*_(2) Fully supervised binary classification._*  \nIf training labels for both classes are available, the model could be extended to learn *dual contraction targets*, mapping class A samples toward center **$c_a$** (which can be the mean of samples from class A) and class B samples toward center **$c_b$** (which can be the mean of samples from class B). At inference, the predicted class could be determined by which center the sample contracts toward more closely. While this falls outside the current anomaly detection scope, it offers a promising direction for future generalizations of TCCM to supervised settings."}, {"review_id": "gSnV3ZcNvI", "reviewer": "Reviewer_ve56", "summary": "The paper concerns an unsupervised anomaly detection problem (the authors call it semi-supervised), where a training set consists only of normal instances and the model is trained to detect anomalies by defining a score. The authors propose a model based on flow matching that predicts a contracting vector towards the origin at each time step. The model seems to be intuitive and is demonstrated to be competitive with related approaches. The evaluation was performed on well established benchmark. Additionally the authors claim that the model is efficient from the computational point of view, intepretable, and robust (the authors give theoretical statement for this).", "questions": "The authors use claims which are not supported in the paper. The method does not seem to be explainable no more efficient than the other methods. In consequence, the title and main contributions are incorrect. The results are do not support the claims are hidden in appendix. I do not see why the method is called semi-supervised since is does not use labeled samples in training.\n\nThe authors say that the method is designed for tabular data. Tabular data is specific. It consists of mixed-type features, have high extreme values, etc. I do not see where the authors address this data type is a special way.\n\nThe authors say \"Despite its recent success in generative modeling, flow matching has not been explored for anomaly detection, to the best of our knowledge\". I do not think it is a good motivation for the paper.\n\nThe authors report ROC curves in their experiments which do not require setting a threshold whether the sample is normal or abnormal. F1 and Acc are equally popular but the method needs to find a threshold. Can we find a natural threshlod in this method? I would like to see experiment on that. \n\nI like the experiment presented in Fig 10. I think this should be in the main paper (instead of interpretability experiment). Additionally, the authors should show how their method compares with baselines in this setting. Without it, it is difficult to see the advantage.\n\nThe Table 3  present incorrect information - DTE is as scalable as the proposed method. Moreover, the method is not interpretable/explainable.\n\nI am not sure whether eq 4 is correct. Looking at the paper https://arxiv.org/pdf/2209.03003 is seems that instead of \"z\" we should have \"tz\" or \"(1-t)z\". Otherwise the model will return constant identity function (ignoring t).", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The experimental results presented in the main paper show that the method outperforms almost all methods. The evaluation uses 47 datasets and more than 30 algorithms taken in part from ADBench.\n2. The method simplifies a standard flow matching model to directly describe the underlying problem. In consequence, no irrelevant distribution modeling is performed and the method focuses on the anomaly detection problem.\n3. The authors provide theoretical analysis certifying the robustness and giving the insight into the score function behavior.\n\nWeaknesses:\n1. The interpretability experiment is not convincing at all. The authors show two examples on MNIST, which do not support the claim \"the model highlights the additional horizontal stroke that distinguishes 7 from 1\". The model also highlight digit borders and the bottom. Nevertheless, the authors are required to show this propoerty on more examples, e.g. user-study.\n2. The computation efficiency of the method on inference compared to 3 best performing baselines is ok. The question is how the method compares with all 30 algorithms? Moreover, Fig 5 show that the best performing DTEN method is significantly faster at training, which is in contrast to authors claim. Fig 6 show that the training + inference time of both methods is comparable.", "was_revised": true, "final_justification": "The authors addressed my concerns and I am for accepting this work.", "rebuttal": "We thank the reviewer for the summary and positive comments.  **Due to space limitations, we will post the responses to the two weaknesses in the discussion period**.  Below, we first answer the questions point by point.\n\n>Question: 1. The authors use claims which are not supported in the paper. 1.1) The method does not seem to be explainable 1.2) no more efficient than the other methods. In consequence, the title and main contributions are incorrect. 1.3) The results are do not support the claims are hidden in appendix. 1.4) I do not see why the method is called semi-supervised since is does not use labeled samples in training.\n\nWe thank the reviewer for raising this multi-part question. We respectfully address each subpoint below.\n\n**(1.1) On the claim of explainability.**  \nWe respectfully disagree with the reviewer’s assertion. As stated in Lines 15–16, 118–120, and 343–350, TCCM provides *feature-level importance scores* derived from the learned residual vector field. These scores reflect the deviation from expected contraction behavior and are fully accessible at inference time. This enables direct attribution at the input feature level. While the reviewer may find the MNIST visualization less compelling, we emphasize that this example was only meant as an intuitive illustration. Most importantly, the model’s interpretability arises *not from post-hoc saliency*, but from its intrinsic architecture and scoring function—Eq. (5)—which directly enables per-feature relevance estimation.  \nWe further note that other reviewers explicitly acknowledged this aspect:\n- Reviewer **Tprs**: *“It also provides feature-level interpretability through its learned vector field.”*\n- Reviewer **3Lxk**: *“The method provides feature-level importance scores, enabling interpretable diagnosis and supporting the identification of key contributing factors to anomalies.”*\n\nTo further clarify, we will expand the explanation of this property in Section 3 of the revised version.\n\n**(1.2) On the claim of efficiency.**  \nWe refer the reviewer to our detailed response to Weakness 2 in discussion period.\n\n**(1.3) On the results being \"hidden\".**  \nWe respectfully clarify that all key results are prominently presented in the main paper (Figure 3), and additional findings are provided in the appendix due to page limits. This follows standard practice for large-scale benchmark papers (e.g., DTE-NP), and our goal was to ensure clarity and readability. Far from being \"hidden\", we will make the additional tables and figures even more accessible by referencing them more clearly in the revised draft.\n\n**(1.4) On the term \"semi-supervised\".**  \nWe use the term following established conventions in the anomaly detection literature. As noted in Lines 51–54, the model is trained using *only normal data*, which is a form of implicit label usage (since the “normal” label is known). This setting is widely referred to as **semi-supervised anomaly detection** or **one-class classification**, and our usage aligns with both academic precedent and benchmarking standards.\n\n>Question: 2. The authors say that the method is designed for tabular data. Tabular data is specific. It consists of mixed-type features, have high extreme values, etc. I do not see where the authors address this data type is a special way.\n\nWe clarify that “tabular” in our paper follows the standard usage in anomaly detection (e.g., ADBench), where each instance is represented as a fixed-length numerical feature vector.\n\n**(1) Mixed-type features and extreme values:**  \nCategorical features are typically encoded numerically (e.g., one-hot or learned embeddings), enabling uniform modeling across features. Additionally, we apply standard normalization before training, which mitigates the impact of scale differences and extreme values.\n\n**(2) Tabular-specific design and generality:**  \nOur architecture relies on MLPs without modality-specific priors (e.g., convolutions or recurrence), which aligns well with tabular data that lacks spatial or temporal structure. That said, the core framework of TCCM can be extended to other modalities (e.g., images or time series) by incorporating suitable preprocessing and neural architectures (e.g., CNNs, transformers). We focus on tabular data in this work to isolate and validate the core mechanism.\n\n>Question: 3. The authors say ``Despite its recent success in generative modeling, flow matching has not been explored for anomaly detection, to the best of our knowledge\". I do not think it is a good motivation for the paper.\n\nThis statement is intended to highlight the novelty of our contribution, not serve as the sole motivation. Our actual motivation for choosing flow matching is explained in Lines 77-86, Lines 88-90 and further explained in Appendix~A.2 (Lines 1034–1052).\n\n>Question: 4. The authors report ROC curves in their experiments which do not require setting a threshold whether the sample is normal or abnormal. F1 and Acc are equally popular but the method needs to find a threshold. Can we find a natural threshold in this method? I would like to see experiment on that.\n\n(1). While F1-score is sometimes reported in anomaly detection, it is less commonly used than AUROC or AUPRC, which are threshold-independent and more informative under severe class imbalance. In contrast, metrics like Accuracy are rarely used, as they can be dominated by the majority class (e.g., always predicting “normal” yields 95% accuracy when the anomaly ratio is 5%).\n\n(2). F1-score requires a threshold on anomaly scores, typically assuming access to the ground-truth anomaly ratio (*k%*). A common practice is to sort test scores and classify the top-*k%* as anomalies. However, this is inherently data-dependent and less generalizable than AUROC/AUPRC, which evaluate performance across all thresholds.\n\n(3). Nevertheless, we have evaluated TCCM under the F1-score metric and found that it remains the top-performing method across most datasets (i.e., main conclusions remain the same). We will include full results in the Appendix.\n\n(4). Regarding a natural threshold: While the anomaly score from TCCM (i.e., distance to origin) is continuous, its distribution varies across datasets and anomaly ratios. Empirically, we observe that when TCCM performs well (high AUROC/AUPRC), the score distributions for normal and anomalous samples often exhibit a clear gap—making threshold selection feasible (e.g., at the valley between modes). However, in lower-performing cases, the distributions overlap heavily, making thresholding unreliable. Learning a universal or adaptive threshold remains an open problem and is beyond the scope of this work.\n\n>Question 5: I like the experiment presented in Fig 10. I think this should be in the main paper (instead of interpretability experiment). Additionally, the authors should show how their method compares with baselines in this setting. Without it, it is difficult to see the advantage.\n\nFigure 10 intended to study the performance of TCCM under training contamination. Our goal was not to demonstrate superiority over other methods in this setting, but rather to assess the sensitivity of TCCM to anomalous instances present in the training set—a concern shared by most semi-supervised anomaly detectors.\n\nExtending this experiment to compare TCCM with all baselines (45 baselines) across 47 datasets would involve over 100,000 additional runs, which is computationally infeasible within the review timeline. Nevertheless, we conducted a focused study involving the 10 best-performing baselines (based on AUROC), across the 8 datasets shown in Figure 10. The results (to be added in *Appendix D.3*) indicate that most methods exhibit a similar degradation trend under increased contamination, consistent with TCCM’s behavior. We will also consider including parts of this analysis in the main paper.\n\n>Question 6: The Table 3 present incorrect information - DTE is as scalable as the proposed method. Moreover, the method is not interpretable/explainable.\n\nWe respectfully disagree with the reviewer’s claim that Table 3 presents incorrect information.\n\n**(1) On scalability:**  \nIn Table 3, we classify DTE-NP as “not scalable” due to its extremely slow inference speed, as demonstrated in Figure 3 (e.g., 48,942s on *census*). While DTE-NP may be fast in training, real-time or large-scale deployment often depends on inference efficiency—an area where TCCM is orders-of-magnitude faster. Please refer to our response to **Weakness 2** (especially point 3) for further justification.\n\n**(2) On explainability:**  \nWe acknowledge that explainability is nuanced and subject to interpretation. As noted by the DTE authors themselves (see Appendix B of [Livernoche2024Diffusion]), DTE provides interpretability via reconstruction-based heatmaps. TCCM, on the other hand, derives feature-level scores directly from its learned vector field (Eq. (5)), offering built-in importance attribution. While perspectives may differ, both methods align with definitions of explainability discussed in recent surveys (e.g., [Yepmo2022XAD] and [Li2023XAD]). Thus, we believe both can reasonably be considered explainable under standard criteria.\n\n**References:**\n- [Livernoche2024Diffusion] Livernoche, Victor, et al. *On Diffusion Modeling for Anomaly Detection*. ICLR, 2024.  \n- [Yepmo2022XAD] Yepmo, Véronne, et al. *Anomaly explanation: A review*. DKE, 2022.  \n- [Li2023XAD] Li, Zhong, et al. *A survey on explainable anomaly detection*. TKDD, 2023.\n\n>Question 7: I am not sure whether eq 4 is correct. Looking at the paper https://arxiv.org/pdf/2209.03003 is seems that instead of \"z\" we should have \"tz\" or \"(1-t)z\". Otherwise the model will return constant identity function (ignoring t).\n\nThis concern is closely related to **Weakness\\#3 from Reviewer Gjui**, where we addressed the role of $t$ in the velocity field. Due to space limitations, we refer the reviewer to that response for full clarification."}, {"review_id": "2uI1aEGxiG", "reviewer": "Reviewer_Gjui", "summary": "This paper proposes a novel semi-supervised AD method for tabular data using the concept of flowing matching. Specifically, the author uses a neural network to predict the time-dependent velocity field in the transformation between normal data distribution and a degenerate Dirac distribution at the origin. The method is evaluated on the popular benchmark ADbench, and the  method outperforms all baselines in the average rank, also the authors provides several theoretical guarantees for the method and detailed experimental results for ablation studies.", "questions": "**Method**:\nSee weakness. If the authors address my concerns properly, i will raise my score.\n\n**Experimental Results**:\n\n1. In the experimental results of the paper, the performance of $k$NN is much worse than most of methods. However, in [1],  following the same experimental setting, $k$NN is almost the most powerful semi-supervised AD method. Why the perfromance of $k$NN is so different in the paper? Also, there are several recent AD methods based on generative models and AE to be mentioned and compared, e.g. [2] [3] [4].\n\n[1] Livernoche, Victor, et al. \"On diffusion modeling for anomaly detection.\" arXiv preprint arXiv:2305.18593 (2023).\n\n[2] Liu et al. Unsupervised Anomaly Detection by Robust Density Estimation, AAAI 2022\n\n[3] Rozner et al. Anomaly Detection with Variance Stabilized Density Estimation, UAI 2024 \n\n[4] Lindenbaum, et al. Transductive and inductive outlier detection with robust autoencoders. UAI 2024 \n\n\n2. In the time comparison part, the authors compare TCCM with two non-parametric methods: KDE and DTENP, and LUNAR which requires graph converting. Then the authors claim that \"TCCM achieves considerably faster inference than most deep learning baselines\". I think this is quite unfair since the time complexity of the $3$ methods is at least $\\mathcal{O}(n^2d)$ and there are many faster deep learning methods like auto-encoder, DeepSVDD, MCM and so on.", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths:**\n\n1. The authors provide complete experimental results. 2. The method demonstrates good experimental performance on a wide range of datasets. 3. The paper is easy to follow and well written.\n\n**Weaknesses:**\n1. In the limitations of existing studies, the authors mention that \"rely on restrictive architectural constraints (e.g., no biases, bounded\nactivations) to avoid representation collapse\". For TCCM, i think representation or model collapse could also happen, e.g., consider the neural network is a one-layer MLP, $f_θ([\\mathbf{z}; \\mathrm{Embed}(t)])=[-I,\\mathbf{0}][\\mathbf{z}; \\mathrm{Embed}(t)]^T=-\\mathbf{z}$. In this case, the loss attains minimal but the model can not identify normal data and anomalous data, and it seems that this model collapse is not mentioned and solved in the paper.\n\n2. Usually, in flow matching or score matching, the points in the original distribution and points in the target distribution correspond one-to-one. But in the paper authors use \"a degenerate Dirac distribution at the origin\" as the target distribution, which contains only one point, indicating a relationship of one-to-many.  This does not make sense to me.\n\n3. In the training process of TCCM, for different timestep $t$, $\\mathbf{z}_t=\\mathbf{z}_0$, and this is different from original flow matching. The only change in $\\tilde{\\mathbf{z}}_t$ is the time embedding. If  $\\mathbf{z}_t$ does not change for different $t$, then it is not a \"flow\".  In my understanding, the trajectory is a straight line and you should sample from the line $\\mathbf{z}_t=\\frac{\\mathbf{z}-\\mathbf{0}}{t}$ to train TCCM. For this reason, TCCM is more like an AE on augmented data combining self-supervised learning and auto-encoder, which is not novel.", "was_revised": true, "final_justification": "The authors solved most of my concerns, I decide to raise my score.", "rebuttal": "We thank the reviewer for the summary and positive comments. Below, we address the concerns point by point.\n> Weaknesses 1:  In the limitations of existing studies, the authors mention that “rely on restrictive architectural constraints (e.g., no biases, bounded activations) to avoid representation collapse\". For TCCM, I think representation or model collapse could also happen, e.g., consider the neural network is a one-layer MLP,  $f_{\\theta}([\\mathbf{z}, \\text{Embed}(t)]) = [\\mathbf{I}, \\mathbf{0}] [\\mathbf{z}; \\text{Embed}(t)]^T = \\mathbf{z}$.  In this case, the loss attains minimal but the model cannot identify normal data and anomalous data, and it seems that this model collapse is not mentioned and solved in the paper.\n\n\nWe thank the reviewer for raising the concern regarding potential representation collapse. The illustrative case  $f_{\\theta}([\\mathbf{z},\\text{Embed}(t)] )$ $ = [\\mathbf{I},\\mathbf{0}][\\mathbf{z};\\text{Embed}(t)]^{T} = \\mathbf{z}$  \nassumes a highly restricted architecture—a single-layer linear mapping without bias or activation—where the time embedding has no effect. While this is a valid theoretical edge case, it does not reflect the architecture used in TCCM.\n\nIn practice, **TCCM** uses a multi-layer MLP with ReLU activations and high-dimensional sinusoidal time embeddings, explicitly concatenated to the input. This enables the model to learn complex, time-varying contraction dynamics, making trivial identity (or partial identity) mappings unlikely.\n\nUnlike prior methods such as Deep SVDD [Ruff2018Deep]—which require architectural constraints (e.g., no bias, bounded activations) to avoid collapse—TCCM imposes no such restrictions. Instead, collapse is discouraged through the use of time-conditioned supervision, multi-time-step training, and implicit regularization from architectural nonlinearity.\n\nEmpirically, we observe no evidence of collapse: training loss does not flatten trivially, anomaly scores vary meaningfully across test points, and anomaly detection accuracy remains consistently strong across datasets.\n\nWe will clarify this point in the final version and explicitly discuss how our design mitigates collapse without relying on handcrafted constraints.\n\n**Reference**\n\n- [Ruff2018Deep] Ruff, Lukas, et al. \"Deep one-class classification.\" ICML, 2018.\n\n>Weaknesses 2: Usually, in flow matching or score matching, the points in the original distribution and points in the target distribution correspond one-to-one. But in the paper authors use ``a degenerate Dirac distribution at the origin\" as the target distribution, which contains only one point, indicating a relationship of one-to-many. This does not make sense to me.\n\nWe thank the reviewer for this insightful comment regarding the use of a degenerate (Dirac) target distribution in our formulation. Below we clarify the motivation and appropriateness of this design in the context of anomaly detection.\n\n**(1) Different objective from conventional flow matching.**  \nClassical flow matching and score matching methods are typically used for *generative modeling*, where samples from the source and target distributions correspond one-to-one to ensure reconstruction quality. In contrast, our goal is not generation but *anomaly detection*—we care about measuring how well a sample follows contraction dynamics, not whether it can be mapped to a specific output point. As such, we do not require a bijective mapping between distributions.\n\n**(2) One-to-many mapping is intentional and beneficial.**  \nThe use of a Dirac distribution at the origin introduces a *consistent supervision signal*: every normal point learns to contract toward the same target. This simplifies optimization and injects a strong geometric prior that improves both efficiency and robustness. The resulting one-to-many relationship does not harm performance—in fact, it supports generalization, as anomalies that do not conform to this contraction pattern are naturally identified as outliers.\n\n**(3) Similarity to Deep SVDD, but extended to continuous flows.**  \nThis idea mirrors the intuition behind **Deep SVDD**, which learns to map normal data into a compact region (typically a small hypersphere) in latent space. TCCM generalizes this notion to a continuous-time setting via a learned vector field, which guides contraction toward the origin across time. We note that Deep SVDD does *not* collapse all samples to the center but instead penalizes distance to a hypersphere center—our design is even more aggressive in promoting compactness.\n\n**(4) Clarification is already provided in Appendix A.2 and Appendix C.1.**  \nWe have discussed (1) the difference of TCCM from generative models in *Appendix A.2* (see paragraph and *“Difference from Generative Models”*), and (2) the connection and distinction between TCCM, flow matching, and diffusion models in detail in *Appendix C.1* (*“Relation to Flow Matching and Diffusion Modeling”*).\n\n**In summary,** the “one-to-many” design is not only valid in our setting, but also *aligned with the goals of semi-supervised anomaly detection*. Our theoretical and empirical results (e.g., Figure 1 and Section 5) demonstrate its effectiveness.\n\n>Weakness 3: In the training process of TCCM, for different timestep $t$, \n$\\mathbf{z} _ {t}=\\mathbf{z} _ {0}$, and this is different from original flow matching. The only change in $\\tilde{\\mathbf{z}}$ is the time embedding. If \n$\\mathbf{z} _ {t}$ does not change for different $t$, then it is not a ``flow\". In my understanding, the trajectory is a straight line and you should sample from the line $\\mathbf{z} _ {t}=\\frac{\\mathbf{z}-\\mathbf{0}}{t-0}$ to train TCCM. For this reason, TCCM is more like an AE on augmented data combining self-supervised learning and auto-encoder, which is not novel.\n\nWe thank the reviewer for the thoughtful comments regarding the design of our training procedure and its relation to classical flow matching. Below we clarify the rationale and provide empirical and conceptual justifications.\n\n**(1) Time-conditioned vector fields without interpolated inputs.**  \nIt is correct that during training, TCCM always takes the original input $\\mathbf{z}_0 = \\mathbf{z}_t$, and the variation across time is introduced solely via the time embedding. Unlike standard flow matching, which supervises the velocity field on interpolated samples along a trajectory (e.g., $\\mathbf{z}_t = t\\mathbf{z} + (1 - t)\\mathbf{0}$), TCCM directly supervises the field at the initial position $\\mathbf{z}$ with a fixed target vector $-\\mathbf{z}$.\n\nThis is *intentional and appropriate* for our task: our model learns a time-conditioned vector field $\\mathbf{f}_\\theta(\\mathbf{z}, t)$ that outputs the *instantaneous velocity* at location $\\mathbf{z}$ and time $t$, rather than simulating or reconstructing trajectories. This formulation enables consistent, efficient learning without requiring time-dependent input sampling.\n\n**(2) Empirical justification via ablation.**  \nWe conduct an ablation study comparing our design against a variant that trains on interpolated inputs $t \\cdot \\mathbf{z}$ (i.e., $\\mathbf{z}_t = t\\mathbf{z}$). Results across multiple datasets show that this modification *hurts performance*, validating our choice of fixed inputs with time-conditioned supervision. We will include these results in the appendix.\n\n**(3) Distinction from autoencoders.**  \nWe respectfully disagree with the claim that TCCM reduces to an autoencoder with augmented inputs. Autoencoders are trained to reconstruct $\\mathbf{z}$ using a decoding loss (e.g., $\\|\\hat{\\mathbf{z}} - \\mathbf{z}\\|$), whereas TCCM learns a contraction vector field supervised by directional alignment $\\mathbf{f}_\\theta(\\mathbf{z}, t) \\approx -\\mathbf{z}$. This leads to fundamentally different inductive biases and optimization dynamics. TCCM does not reconstruct inputs—it measures their deviation from contraction, enabling effective anomaly detection with strong empirical performance and interpretable scoring (see Eq. (5)).\n\n>Experimental Results: 1. ...Why the performance of \nkNN is so different in the paper? ...recent AD methods to be mentioned and compared [2] [3] [4].\n\n**(1) On the discrepancy in `kNN` performance:**  \nThe stronger results in [1] may stem from two key differences:  \n(1) *Subsampling*: [1] subsamples datasets to 50,000 samples, while we use full datasets (up to 600K), making `kNN` more prone to scalability issues.  \n(2) *Protocol*: [1] treats `kNN` as inductive (trained on normal samples), whereas we follow PyOD’s transductive setting (no separation), aligning with its official leaderboard. These factors explain the gap.\n\n**(2) On more baselines:**  \nWe thank the reviewer for pointing out [2,3,4]. We will refer to them in the revised version. However, it is challenging to implement (code is not given for some of them) and/or integrate them into our pipeline, and run all experiments during the rebuttal phase.\n\n>Experimental Results: 2. ...the authors compare TCCM with two non-parametric methods: ... Then the authors claim that ``TCCM achieves considerably faster inference than most deep learning baselines\". I think this is quite unfair since the time complexity of the 3 methods is at least $O(n^{2}d)$ and there are many faster deep learning methods like auto-encoder, DeepSVDD, MCM and so on.\n\nWe will include full runtime results (training, inference, and total) for all 45 algorithms in *Appendix D.2*. We also add a scatter plot of *inference time vs. AUROC* across all deep learning methods. Among 24 deep models, TCCM ranks 8th in inference time, while achieving the best AUROC. Although a few methods (e.g., DeepSVDD, GANomaly) are marginally faster, they suffer from significantly lower detection performance. In contrast, TCCM offers a strong trade-off between speed and effectiveness—making it one of the most efficient high-performing methods overall.\n\n>Formatting Concerns:\n\nFormatting suggestions will be taken in the revised version."}]

Author rebuttal:

Meta-review: This work describes an anomaly detection algorithm inspired by flow-matching. Theoretical insights are provided into the behaviour of the anomaly scoring function, and the proposed method is extensively evaluated on 47 datasets against 44 baselines. All reviewers agreed that the experiments were comprehensive and the proposed method convincingly showed improvements over baselines. They also thought the theoretical insights provided were interesting, and appreciated the clear presentation. Various questions about the method were addressed by the rebuttal to the reviewers' satisfaction and reviewers were unanimously positive about the paper post rebuttal. The AC agrees with the reviewers' assessment that this is a well executed piece of work with an interesting algorithm, extensive evaluation and theoretical insight, and hence recommends acceptance. The authors should incorporate all promised changes into the final version of the paper.
Decision: Accept (poster)