Unifying Reconstruction and Density Estimation via Invertible Contraction Mapping in One-Class Classification
Authors: Xiaolei Wang
Tianhong Dai
Huihui Bai
Yao Zhao
Jimin XIAO
Venue: NeurIPS 2025 poster ()
Keywords: Anomaly Detection
One-Class Classification
Primary area: deep_learning

Abstract: Due to the difficulty in collecting all unexpected abnormal patterns, One-Class Classification (OCC) has become the most popular approach to anomaly detection (AD). Reconstruction-based AD method relies on the discrepancy between inputs and reconstructed results to identify unobserved anomalies. However, recent methods trained only on normal samples may generalize to certain abnormal inputs, leading to well-reconstructed anomalies and degraded performance. To address this, we constrain reconstructions to remain on the normal manifold using a novel AD framework based on contraction mapping. This mapping guarantees that any input converges to a fixed point through iterations of this mapping. Based on this property, training the contraction mapping using only normal data ensures that its fixed point lies within the normal manifold. As a result, abnormal inputs are iteratively transformed toward the normal manifold, increasing the reconstruction error. In addition, the inherent invertibility of contraction mapping enables flow-based density estimation, where a prior distribution learned from the previous reconstruction is used to estimate the input likelihood for anomaly detection, further improving the performance. Using both mechanisms, we propose a bidirectional structure with forward reconstruction and backward density estimation. Extensive experiments on tabular data, natural image, and industrial image data demonstrate the effectiveness of our method.  The code is available at URD.

Unifying Reconstruction and Density Estimation via Invertible Contraction Mapping in One-Class Classification
Xiaolei Wang!.²
Tianhong Dai
Huihui Bai
Yao Zhao
Jimin Xiao
Xi'an an Miaotong-Liverpee University University of Liverpool
Beijing Jiaotong University
Applied Computing Technologies
Abstract
Due to the difficulty in collecting all unexpected abnormal patterns, One-Class Classification (OCC) has become the most popular approach to anomaly detection (AD). Reconstrucctin-basee AD method relies on the discrepancy between inputs and reconstructed results to identify unobserved anomalies. However, recent methods trained only on normal samples may generalize to certain abnormal inputs, leading to well- rell-reconstructed anomalies and degraded performance. To address this, we constrain reconstructions to remain on the normal manifold using novel AD framework based on contraction mapping. This mapping guarantees that any input converges
fixed point through iterations of this mapping. Based on this property, training the contraction mapping using only normal data ensures that its fixed point lies within the normal manifold. As a result, abnormal inputs are iteratively transformed toward the normal manifold, increasing the reconstruction error. addition, the inherent invertibility of contraction mapping enables flow- based density estimation, where prior distribution learned from the previous reconstruction is used to estimate the input likelihood for anomaly detection, further improving the performance. Using both mechanisms, structure with forward reconstruction and backward density estimation. Extensive experiments on tabular data, natural image, and industrial image data demonstrate the effectiveness our method. Code is available at URD
propose bidirectional
Introduction
Anomaly detection (AD) focuses on identifying unexpected patterns that deviate from the known normal ones. Due to difficulty of collecting abnormal samples, One-Class Classification (OCC)
paradigm 38 10
has become the primary solution for unsupervised anomaly detection (UAD) tasks, In the OCC paradigm, only normal data is provided during training, and the model is expected to detect previously unseen anomalies during inference. Therefore, the key challenge of the OCC paradigm involves effectively modeling the normality of the training data to recognize the abnormal pattern. Recently, reconstruction-bant
43 45
18
49
[12] 14, [4] [9 30) 21 48
and density-estimation methods. The former relies on the assumption that a model trained solely on normal data will be unable to accurately reconstruct anomalies. contrast, the latter focuses on fitting probability distribution over normal data to estimate the likelihood of previously unseen inputs.
[39 26 55 I0 58) methods are the two most widely used OCC AD
Cooresspndiigg Author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Mapping
Narual Abouraul Manisiid
Atnernal
Berrations
Iterations
Tised Point
Reconstactid
Rasats
Nornal
Herraiinn
* Fised Point
Imput
Almermal
CM
(a) Property of Contraction Mapping
(b) Point within Normal Manifold
Reconstruction CM Heeratively
Fixed Point
Iterations=0
Norations=2
Irerations-6
Abuormal
(d) Changes
Manifold
Iterations
Reconstructed Result
Figure I: (a): Any input converges to a fixed point after several CM iterations. (b): The fixed point of CM trained by normal data is located within the normal manifold. (c): Abnormal inputs (red) are
reconstructed into the normal manifold (green) by several iterations of CM. (d) T-SNE visualization of changes in the reconstructed feature manifold on the 'Ionosphere' tabular AD dataset [36]
Specifically, reconstruction-basse methods rely on the discrepancy between the input and its recon- structed output to identify unseen anomalies. However, models trained exclusively on normal data may generalize certain abnormal inputs, resulting in well-reconstructed anomalies and reduced reconstruction error, which affects the performance. To address this issue, previous AD methods [54] [53] adopt reconstruction strategies based partially masked data. However, when using hand- crafted or random mask strategies, not all abnormal information can be covered, so they still cannot prevent well-reconstructtd anomalies and guarantee the effectiveness of all obtained reconstruction discrepancies. Thus, the key question remains: How can reconstruction discrepancies be made sufficiently discriminative for detecting each abnormal input?
An intuitive way to obtain discriminative reconstruction discrepancy to constrain reconstructed results of abnormal inputs remain on the normal manifold. To this end, we propose a novel recon- struction network based on contraction mapping (CM). Based on the property of CM [6], any input theoretically guaranteed to converge
unique fixed point through iterative applications of CM (see Fig [ (a)), and this point depends exclusively on the mapping itself. Inspired by the property of CM-based network with reconstruction
CM, we further observe during training that optimizing loss on normal data encourages the fixed point to lie within the normal manifold (see Fig (b)). Therefore, given abnormal inputs, normal manifold (see Fig [ (c)). T-SNE visualization of real data in (d) also shows that the reconstructed results constrained remain the normal manifold after six iterations of CM, resulting in significant discrepancy between the abnormal input and its reconstruction.
leverage trained CM iteratively to transform them into the
On the other hand, our proposed CM structure is inherently invertible. According to the theory of normalizing flow [13] 27]. an invertible mapping flow can transform a Gaussian prior into a real data distribution, which enables the estimation of the likelihood of the input. Therefore, our invertible CM flow leveraged to perform density estimation to further improve the detection performance. In particular, after the reconstruction stage, the reconstructed output used learn prior Gaussian distribution. Then, we leverage the inverse of the contraction mapping flow on the prior distribution to estimate the likelihood of the inputs. To this end, framework consists of forward reconstruction and backward density estimation, unifying these two popular paradigms to detect unseen anomalies. The main contributions of this paper are summarized follows:
(1) To prevent rellsreconttructed anomalies, we adopt a novel contraction mapping structure to constrain abnormal inputs onto the normal manifold. (2) A unified framework is introduced that

---

combines reconstruction and density estimation using an invertible contraction mapping flow, which bridges two popular paradigms anomaly detection. (3) Extensive experiments on tabular, natural image, and industrial image data demonstrate the effectiveness of our method.
2 Related Work
Anomaly detection aims to recognize unexpected abnormal patterns in different types of data, such as tabular [53. 99. graph [57], and image data [47]
Anomaly Detection
44 Since the form and type
of anomaly events are unpredictable and cannot be fully collected, One-Class- Jlass-Classification based AD
paradigm has become the mainstream solution. The key of OCC approaches is to model the normality
of training data to detect unseen anomalies. Classic OCC methods [35] G 40 46
38 57 learn
profile from normal data, computing the distance between the abnormal input and the center/boundary
of the profile as the anomaly score. KNN [35] and LOF
[6] directly compute the distance between
test input and its several normal neighbors. OCSVM [40 learn a linear boundary of normal samples
to discriminate anomalies. SVDD-baaeed approaches [66 38 57 construct hypersphere boundaries to
effectively surround normal representations, recognizing abnormal patterns based on the distance between these representations and the center/boundary of the sphere.
Reconstruction-base Method Reconstruction-basse based methods rely on the discrepancy of inputs and their reconstructed results to identify unseen anomalies. However, trained reconstruction network may recover some anomalies well, obtaining small reconstruction error and failing to detect anomalies. To alleviate this issue, the tabular AD method, MCM adopts a learnable mask to cover partial areas of the original input and learning normal reconstruction from masked data. UniAD [54], a classic visual AD method, defines this issue as 'identical shortcut" and similarly adopts the neighbor mask in attention computation to alleviate well-reconstructed anomalies. The graph-based based AD method [22] leverages the denoising autoencoder to learn the reconstruction for the noisy perturbation. In this paper, we consider that as long the reconstructed output can be constrained within the normal manifold, well-reconstructed anomalies will be avoided. Based on the above idea, we propose apply contraction mapping conduct reconstruction.
estimationnnbaaie based methods [50 588 apply normal data fit a Gaussian distribution or its variants to estimate the likelihood of each test input as the anomaly score. However, the real normal data distribution is much more complex than a Gaussian distribution.
ConsityEEtimmation-aee Method
Therefore, normalizing-foow flae--aedd AD methods [51 39 55 17 adopt invertible mapping to transform prior distribution of latent variables to the distribution of real inputs, better capturing the probability density of each input. In this paper, the introduced contraction mapping flow is designed to be invertible and can directly estimate the likelihood of input based on a learnable Gaussian prior distribution of reconstructed results. Our framework consists of forward reconstruction and backward density estimation, unifying these two main paradigms.
3 Methodology
Preliminary In the one-class classification (OCC) anomaly detection (AD) task, only normal samples are provided during training, and the goal is to detect previously unseen anomalies in the testing set. Formally, I Itrain U Itest is represented as an AD dataset, where the data can be either tabular or image-based. The training set is denoted Itrain { ys ) where each I, is a normal sample with label y; = 0, and N1 is the number of samples. The testing set is denoted as {I, of M which contains both normal and abnormal samples, y E {0, 1}. and N₂ is the number of testing samples.
Itest =
Overview As shown in Fig 2 our proposed framework consists of two main components: 1) forward reconstruction and 2) backward density estimation. This unified design integrates both oeconstruction-basee and density-basee anomaly detection within single framework, resulting in enhanced detection performance. During training, the normal input is first passed through a standard neural network to achieve the corresponding representations the vector. Next, to mitigate the issues of 'reconstructing anomalies well', novel contraction mapping (CM) based network sp(-) is proposed. This network is trained with a reconstruction loss on
Rd, where d is the dimension of
3

---

Forward Reconstruction
Step-Gradient
Optimization
Tabolar Dara
Representations
Prior Distribttion
F2
FR
Image
ExLL
IT
p(x)
x(z)
Natural Insage
Rackward Density Extimation
Figure 2: Overview of our proposed method. For normal input, we first extract its deep represen- tation. Next, we apply contraction mapping flow to reconstruct the obtained representation. Then, reconstructed outputs used to fit prior distribution. Finally, the reverse of the mapping flow can transform this prior to the imput distribution, enabling likelihood estimation the original input.
normal samples to constrain reconstructed results to lie within the normal manifold. Specifically, the contraction mapping used in a flow-based manner iteratively constrain the reconstruction within the normal manifold, and the final reconstructed result is denoted as E Rd. To further exploit the inherently invertibility CM, we leverage reverse mapping &p (.) to estimate the density p(x) of the input x from learnable prior distribution over the latent variable z. Then, the flow-based reverse mapping o (-) gradually transforms the prior Gaussian distribution iT) to the density p(-). which captures the likelihood of the real input During inference, combination of reconstruction error and likelihood is adopted as the ultimate anomaly score.
3.1 Reconstruction via Contraction Mapping
Anomaly detection via reconstruction relies on the discrepancy between the input and its reconstruc- tion. Typically, reconstruction based methods employ the following objective function train the reconstruction network :p()):
Lrec
1|z x12
(xx),
where is the input feature, is the corresponding reconstruction. and || is fn-norm. During inference, the reconstruction error [|<p('') x'1 1|2 between the input feature x and its reconstruction adopted the anomaly score for the test data. However, discussed in Section recent methods often generalize to anomaly inputs, producing low reconstruction error and thus failing to identify anomalies efficiently. To address this issue, model (p()) contraction mapping with flow-based reconstruction process, enforcing that the reconstructed output from any input remains on the normal manifold. This leads to larger reconstruction errors when receiving anomaly inputs.
3.1.1 Theoretical Analysis of Contraction Mapping Reconstruction
In this section, we provide formal mathematical proofs to demonstrate how the contraction mapping (CM) constrains the reconstruction remain the normal manifold. Specifically, prove two key propositions: 1) training the proposed CM-based network with reconstruction loss on normal data ensures that the fixed point of the CM lies within the normal manifold, and 2) the trained CM network can transform the reconstruction of abnormal inputs toward the normal manifold.
First, we introduce the formal definition and the property of the contraction mapping.
Definition 1 (Contraction Mapping (25]): A mapping f Rd - Rd is called contraction mapping if there exists a constant 1j E j0, 1) such that (I]( - f(x2)]l2 S 1||2 - æ2ll2 for all T1,42 gd The constant 1) is called the Lipschitz constant.
Lemma (Convergence of Iterations (25): Let f(-) be contraction mapping with E [0, 1). For any initial input To E R&d we define the sequence {I,) by Jn+1 = f(x,, ( for n 1,2,... Then
lim In x", where x" is unique and is called fixed point of f(-).

---

(4) Cardia
(b)
Pime
(9) Thyrold
(0) Whe
Figure 3: T-SNE visualization of the fixed point on four AD datasets. Training f()) with Lee on normal data ensures that the fixed point of f(.) lies within the normal manifold.
Lemma D shows that any input will converge to a fixed point after iterative application of contraction mapping (see Fig [ (a)), where the point is only related that mapping itself. Next, the contraction mapping is modeled by a Icarnable network f (-), where 0 denotes the parameters. To simplify the notation, 0 is omitted. Empirically, we observe that training f(-) on normal data using reconstruction
loss Lree = lx) x|I2 result in fixed point that lies within the normal manifold. To theoretically support this observation, we propose the following proposition:
Proposition 1 Let f()) be contraction mapping with v E |0, 1), and let x E R& be a normal sample. Under the optimization of the reconstruction loss Lree llf(()) - x112. the fixed point x* E Rd of f(-) is located within small neighborhood of the normal input x. and Ixx x1|2 S f-y.
proof. Let us assume that f() is a contraction mapping iteration with L E [0. 1). According to Definition 7 Jand Lemma [ one inequality can be obtained: -
[f(x*) (x)
n/ X 2- Next, using the triangle inequality, we obtain -|x*~xxa x12 ||x f(x) f(x)
X
2 S 1xx s(x)ll2 + [lf(x) x 2- Combining the above two inequalities, one can be obtained:
|x* x||2 S (=)) x1|2 I-9
Luee When Lree minimized during training, the fixed point x*
must be the vicinity of the normal input x.
Proposition D provides theoretical analysis of the reconstruction for single sample. In practice, during training, all normal samples are used to optimize the network f()). which drives the fixed point x" converge the interior of the normal manifold. The empirical visualizations in Fig. on real datasets strongly support this theoretical claim, showing the fixed point landing within the normal data manifold.
Next, based on Proposition I and Lemma any input can be iteratively mapped to fixed point within the normal manifold by applying f() recursively. Therefore, inspired by normalizing flow fx o fk-1 .... f-()) to model the iterative process
[3], we adopt a flow-based module &x of the contraction mapping, where each f-(-) shares the same structure but has its own parameters 8g. Given a test abnormal input x", the flow-based module (.) can transform it toward a fixed point x" within the normal manifold, thus inducing a large reconstruction error [xxxx(x') x" ||2 To theoretically support this perspective, we introduce a key proposition along with a related lemma:
Lemma Let (-x(+) = fK of fi(-), where each fü contraction mapping with Te [0, 1). then 9x (-) is contraction mapping with Lipschitz constant nhe I mm -72 -TT---
fi()) is a contraction mapping flow trained by recon- struction loss Lree = =1 xx)-112, where x is normal. The fixed point x" of xxx() (-) is located within a small neighborhood of x. Additionally, for any abnormal input x², as the value of increases, <x((x") is closer to the fixed point x", thereby being closer to normal objective
Proposition 2
Let (px())
proof. According Lemma px() (-) is contraction mapping with Lipschitz constant nl. so also ! under optimization of Lree, one inequality can be obtained: ||x" - x S Lise, where Thp S 771 7)2 ....... `ΙK < Therefore, as minimizing Lrec the fixed point x" must be in the vicinity of normal x. Next, for abnormal input f, the distance between its reconstructed result yp (x²) and the fixed point x" is: 1| - x" 1|2 S 1 l|x x 1|2- Therefore, as K increuses, The decreases and &x (xx) is closer to the fixed point. Moreover, according to triangle inequality and above inequality, one can be obtained: [x(x((x)) -x x||2 I (xxx)
exists a unique fixed point x According to Proposition
I-no'
x" l|2 + Ixx" - -x||2 S l 2|2 + fise, As K increases, Thp decreases, reducing the first term. T-mp"
The second term also decreases due 1/(1- Tpp) where Lree is a small constant through training.
5

---

With the support of Proposition 2 any abnormal input can be transformed into its corresponding normal representation by px resulting more discriminative reconstruction errors and improved detection performance. Fig (d) shows T-SNE visualization of the iterative mapping results of (K(+) for different values of K. Proofs of Lemma 1 and 2
are provided the appendix.
Since the mapping (-(() is trained for reconstruction by minimizing the loss on normal samples, effectively behaves as an approximate identity mapping for normal inputs. It also retains its contraction property, pulling abnormal inputs toward the fixed point, which is clearly illustrated in 4ig 4 Moreover, in practice, K kept small to prevent all inputs from converging to the fixed point.
3.1.2 Modeling of Contraction Mapping Iteration
In this section, based on the above theoretical analysis, a detailed description of the structure of the flow-based contraction mapping (-)) is provided. First, inspired by 3 each contraction mapping unit is represented as f(-):
Id - G
f(x)
(z)
where G is designed as a a Lipschitz-continuuus invertible mapping with Lipschitz constant 17 < 1. For practical implementation, a block-wise approach is used to build yp.)) Specifically, a contraction mapping flow module F' is constructed as composition of K identical mapping units, i.e., F(-) fK o fk-10... f.)). Finally, the contraction mapping flow (p(-) can be written as:
(-)) = FRR FR-1--.FiC; Fi(-,,
(3)
where is the number of flow modules. As reconstruction network, the primary objective is to learn a contraction mapping flow (p(-) via ( which enables the reconstruction of abnormal inputs toward the normal manifold without forcing full convergence to the final fixed point. Thus, K and R are kept relatively small to avoid full convergence and maintain the detection performance.
In addition, to implement (P)), N-DenseNet (33 is applied to parametrize the mapping G. The basic layer of i-DenseNet can be written as * Wx x + b), where weight |||| < 1, || 1/2 denotes the spectral norm (W is matrix), and / is I-Lipschitz activation function. The above constraints ensure that the Lipschitz constant of is less than 1. More details about the implementation of invertible neural network (-) are provided in the appendix.
3.2 Density Estimation via Reversed Flow
Based on 2). the contraction mapping f(-) is an invertible mapping and f (x) ((Id G)/2) (x) - x (the proof can be found in []). Therefore, the flow module ( is also invertible
and i (.) can be written as (-) = F Fz
Fx (.)
As established in the framework of normalizing flows 13 tp (-- is able to transform Gaussian
prior distribution into a real data distribution, allowing for estimating the likelihood of the input. In this section. the previous reconstructed output z is used learn a Gaussian prior distribution x (z). Then, the reversed flow ip (-) is applied on the prior distribution (z) to achieve the log-likelihood log p(x) of the input x:
log p(x) log (Z))
Σ log det([], p. p. (Z)-1))
(4)
where [dct(-)] is the magnitude of the determinant and J p. is the Jacobian matrix of each F,! each n, is the output of the module F-11, i.e., 2,-1 F. (2,), and z Next, we will show more details of prior distribution T--) and optimization objective.
Prior Distribution (..) According to 44, we need to compute log π (z) for the final log p(x). Given a reconstructed output z, the learnable parameters μt and Σ of the prior Gaussian distribu- tion 7(-) are updated through maximizing log ग (z), where z ~ Tz)) A tlop-gradient operation sg(-) is employed during the optimization of prior distribution π T-), which allows to be learned independently without affecting the reconstruction training:
Sprior E (sg(())))),
where E(.] represents the mathematical expectation operator, Next, the distribution p(x) is estimated by transforming the prior distribution π ((z) through (-).

---

Optimization Objective Based on normalizing flows [3,, we adopt maximizing log likelihood to train flow (-)). According Eq. LULE implicitly optimizes both the prior distribution <T-) and the parameters of our INN sp()), i.e.,
LMLE log [[x]] = log (sg(z))] + EE log [det(J p. (2r()))))))1)))
(6)
Combining Eq. and (6). the ultimate loss function is defined as:
Liotal Lre + ALMLE.
where À is hyper-parameter The entire framework is trained in an end-to-end manner.
3.3 Inference and Anomaly Score
During inference, the feature vector x² of given input I' obtained through the feature extraction network. Then, in the forward reconstruction, the reconstruction z' is achieved by using the contrac- tion mapping flow (--) to get the reconstruction error. Next, the log-likelihood log p(x*) of the input is computed according to Eq. (4) and log x (x). Therefore, the final anomaly score is represented as:
S(x') = lxx(x²) x' Il12 log p(x))
(8)
where a is weight coefficient to control the scale of log p(x').
4 Experiment
Datasets In this paper, our method evaluated on anomaly detection (AD) tasks across tabular, graph, and image domains. For tabular AD, select 12 benchmark datasets from OODS (36) and ADBench (20). which include diverse fields, such as healthcare, finance, and social sciences, etc. For visual AD tasks, conduct experiments on both natural and industrial datasets: CIFAR-I0 and MVTec AD [5), respectively. Following previous OCC works [38] 57]. only one class in CIFAR-10 selected as the normal class, while the remaining classes are considered abnormal.
Evaluation Metrics For tabular data, we adopt the Area Under the Receiver Operating Charac- teristic Curve (AUROC) and Area Under the Precision- Curve (AP) evaluation metrics. For image data, image-level AUROC (I-AUROC) is used for anomaly classification and pixel-level AUROC is used for anomaly localization.
Implementation Details The implementation is based on PyTorch. In the tabular AD task, we use three-layer Multilayer Perceptron (MLP) with LeakyReLU activation function feature extractor. The flow- structure is modeled using K = 2 and R = 3. In particular, the hyperparameters are set to À 0.5 and a 0.01 across 20 tabular datasets. During training. Adam optimizer is used to update the network, where learning rate and weight decay are x 10 and 1 x 10 respectively. For natural image datasets, CIFIAR- 10, we use the same convolutional neural network (CNN) as DO2HSC [57 to extract the deep representation of each image. Same as the tabular setting, we set K= 2, R 3, A = 0.5, and a 0.001. The learning rate and weight decay are set to 10-6 and 1x 10-7, respectively. We train the model for 50 epochs with batch size of 32. For the industrial dataset MVTec, a frozen WideResNer-500 23 is used as the backbone for both the encoder and decoder. For fair comparison, each image is resized to 224x 224 without any data augmentation. We select K = and the weight decay are selected 5 10-4 and 1 x 10 respectively. We train the model for 100 epochs with a batch size of 16. All experiments are conducted on a single NVIDIA RTX 3090 24GB GPU. More details can be found in the appendix.
3, 0.5, and a = 0.001 the framework. During training, the learning rate
4.1 Main Results
Tabular OCC Task Tab I demonstrates that our framework outperforms previous state-of-the-art
(SOTA) methods 22 6
40
38
58
42
53 and achieves a competitive performance with an AP of
78.64 and an AUROC of 91.19. Compared to density-estimation based methods [ 38 (88), our
framework adopts the property of the invertible mapping compute the ligeliicldoood of cach input
7

---

Table I: Comparison of AP/AUROC results with the previous methods on 20 different tabular datasets.
Following MCM [53, all datasets are implemented with identical dataset partitioning. 'DSVDD' stands for 'DeepS VDD'. The best result is highlighted bold.
Dalaset
Rores
LOF
(CD
DSVDD
DGMM
ICL
MCM
Ours
Arrhtthmia
50.97/77.34 34
52.77/76.88
51.39/76.89
60.36/79.40
46.68/72 83
61.55/81.4 1.5
61.07/81.1 1,14
59.63/77.56
Breastw
94.49/97.19 19
39.23/99.37
99.34/99.38
99.24/99.25
75.84/76.05
96.56/97.25
99.52/99.55
99.33/99.45
Cardio
70,1892.20
83.6095.62
86. 14/9649
78.80 18.8093.113
30.89/99.51
80,37/95,14 14
84.89/96.03
86.35/96.21
Census
13.57/60.15
23.43/71.10
22.79/71.58
15.14/63.27
10.66/45.06 06
19,49/68.31
24.20/5..81
37.68/80.64
Campaign
46.08/72.69
59/70.66
47.49/66.26
25.29/52.54
24.72/57.8
45.06/72.41
60.40/89.02
$5.31/84,49
Cardiotoco.
60.36/72.49
57.32/64.49
66. 19/75.22
46.02/51 1.9
44,40/61 .01
59.55/64,78 78
69 (0.93/80.01
73.34/81.17
Fraud
69.39/96.30
40.46/95.73
34.9099548
33.20/95.19
99/97.711
59, 69.66991.07
51.41/93.57
65.48/94.25
Glass
9,52/77.71
9. 23/6..2
8 .6954.80
9 .1/2/55 66
10. 82
25.7 73/83383.50
19.05/72.2 25
50.67/86.32
Jonosphere
97.68/96883
95.91/94.54
89.69/87.65
86,70/85.55 52
70.46/70.41
97.71/97.10
98.02/97.26
97. 97.96/97.34
Mammno,
33.34/82.20
40.63/89.22
41.78/90.03
41.90/88.79
11.41/74.12
18.94/65.48
47.55/90.53
54.32/89.87
NSL KDD
75.32/73.88
74.50/54.96
75. 75.29/57.07
79.35/75.51
75.04/61..0 36
51.94/16.84
90.85/87.88 80
87.20/85.1
Optdigits
15.70/82.39 39
43.63/96.6
3.92263.88
11.59/76.03
3./44.0066 06
16.9677 .87
88.85/99.47
84.32/97.6
Pima
66.62/67.37
69.70/69.1 13
70.08/71.33
71 71.66//3.44 48
59,56/61.00 00
69 (9.65/67.22 27
73.89/76.39
70,51/74. 36
Pendigits
51.33/96.66
75.55/99.05
31.78/96.36
66.16445.66
40.39/91.44
82.58/99.19
86,44/99.24
Satellite
85 85.83/80.26 26
80 88/73.91
77.78/66.63
82.177/7.55 59
68, 64/72.599
87.99 37.99/88.49
85,32/79.62
84.95/82.00 00
Satimage-2
88.46/99.38
96.92/99.61
91.92/98.17
94,27/98.81 81
11.42/89.94
81. $1.24/97.92 .92
98.50/99.92
97. 97.54/99.88 83
Shuttle
91.72/99.61
96.01/99.83
94.88/99.69
98.18/99.52
48.75/900.49
98.11/99.35
94.79/99775
98.63/99.99
Thyroid
60.55/92.71
78 92/98.56
34/98.555
72.82/98.88 87
10.95/71 .49
65.75/95.
84/17/98.04
88.37/99.211
Whe
85.73/97. 15
84. 12/96.70 70
83.91/96.67
83,40/9.33 33
29.59/79.99
72. 18/90.80
88.87/98,
94.72/99.24 24
Wine
24.58/65.71
12.53/40.83
14.24/4 .85
14.76/50.67
49.07/88.33
36.59/91.50
93,35/95.38
99,99/100.0
Average
59.57783.01
63.15/82.15
59.94/81.01
55.51/77.78
34.45/68.08
60,27781.555
74.86/90.44
78.64/91.19
Table 2: Anomaly classification results (AUROC) on CIFAR-10 datasets and anomaly classification (image-level AUROC) localization (pixel-level AUROC) results on MVTec AD dataset. The best and second results are highlighted in bold/underline.
Auto Mobilc
Normal Class
Airplame
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
ID Method
MV AD
DSVDD 38
61.7
65.9
50.8
59.1
60.9
65.7
67.7
67.3
75.9
73.1
PSVDD
52
92.1
95.7
OCGAN 52
75.7
53,1
64.0
62.0
72.3
62.0
72.3
$7.5
82.0
55.4
PaDiM
95.8
97.5
DROCC 15
82.1
64.8
69.2
64.4
72.8
66.5
68.6
67.5
79.3
60.6
CuiPaste 28
96.1
96.0
HRN-L22 24
80.6
48.2
64.9
57.4
73.3
61.0
74.1
55.5
79.9
71.6
DRAEM 56
98.0
97.3
HRN
77.3
69.9
60.6
64.4
71.5
77.4
64.9
77.3
RD4AD
98.5
97.8
PLAD 7
82.5
80.8
68.8
65.2
71.6
71.2
76.4
73.5
80.6
80.5
PatchCore 37
99.1
98.1
DO2HSC 57
81.3
82.7
71.3
71.2
72.9
72.8
83.0
25.5
84.4
82.0
CFlow 17
98.3
98.6
Ours
83.1
78.4
69.8
73.4
75.1
70.9
85.2
76.2
82.3
80.2
Ours
99.5
98.3
from prior distribution, achieving superior performance. Compared to the reconstruction-base work (53), our method improves AP by +3.78 and AUROC by +0.75, benefiting from the proposed forward reconstruction that transforms abnormal inputs toward the normal manifold.
Visual OCC Task Tab2]show: shows the performance of our model on the natural image dataset, CIFAR- 10. and the industrial defect detection dataset, MVTee AD. For CIFAR-10, we follow the standard OCC setting, where only one class is selected as the normal one, and the remaining classes are treated as abnormal. Under this setting, our method achieves the best performance compared to previous SOTA methods 38 32
7 57,, particularly when 'airplane', 'cat', 'deer', 'frog'. and 'horse' are used the normal class. For industrial data, our method also achieves competitive
15
24
37 [7]. Specifically, compared to the reconstruction-baase method [12, our method improves image-level and pixel-level AUROC by +1.0 and +0.5, respectively, as the proposed contraction mapping can constrain reconstructed results to the normal manifold to enhance the performance.
performance compared to widely used methods [52 11 28 56 12
4.2 Ablation Study
In this section, we investigate the contributions of the main components and impact of key hyperpa- rameters of our approach on both tabular and visual datasets.
8

---

Table 3: Ablation study of our method on tabular datasets using AP/AUROC metrics. We show results on 5 selective datasets and mean results on 20 used datasets. 'RE': reconstruction via contraction mapping. 'DE": density estimation via reversed flow. The best result highlighted in bold.
Model 4
RE
DE
Cardio
Glass
Thyroid
Whe
Mamano.
All Tahular Dalinets
A B
80 84/93.71
15.3071.00 .08
82.31/98. 17
71.21/93.53
31 11.42/87.2 21
67. 44/86.55
7
84. 34.25/95.11 15
36.77/85.6
86.01/99.08
88.98/97.18
54.02/89.5
75.21/90.32
/ /
16.64/92.11
39.63/81.87
82.83/98.65
90.04/98.35
52.76/86.66 64
73.59/88.05
D
86.35/96.21
50.67/86.32
88.37/99.21
94.72/99.24
54.32/89.87
78.64/91.19
Effectiveness of Main Components Tab demonstrates the performance of four model variants:
A. the baseline model with a six-layer MLP (equivalent to the number of flow-based iterations for fair comparison) for the reconstruction; B. A reconstruction-only variant using the proposed contraction mapping flow; C. A density eesssity-stimaiionnnnf. variant using the flow structure; D. Our full method combines forward reconstruction and backward density estimation. The model B significantly outperforms the baseline method, which validates the effectiveness of the reconstruction via the contraction mapping. In addition, model C also surpasses the baseline, demonstrating the effectiveness of density estimation via the flow structure. When combining both, our method achieves AP/AUROC by 78.64/91.9. obtaining gain of +11.2/4.67 compared to our baseline. Tab shows an ablation study on visual data, where our framework improves our baseline by +4.87 on CIFAR-10 10 and +1.7/1.1. To this end, the effectiveness of our method is demonstrated in the general OCC-based AD task (visual AD and tabular AD tasks).
Table 4: Ablation study of our method on CIFAR-10 10 and MVTec AD, where image- level AUROC is used for the former and image/pixel-level AUROC for the latter. The best result is highlighted in bold.
Navee
Model
RE
DE
CIFAR-10
MVTec AD
Mapple
72.59
97.8/9722
Figure 4: T-SNE visualization of feature distribution after CM with R = 3 and K = 2 on 'lonosphere' (left) and 'Wbe' (right) datasets.
/
76.88
99. 99.2/97.9
74.27
1/97.9
V
77.46
99.5/98.3
Table 5: Impact of hyperparameters K & in our method, where all tabular and MVTec AD datasets adopted for ablation. AP/AUROC are leveraged for tabular data and image-leve//pixelleedd AUROC for industrial data. The best result highlighted in bold.
K
K
K=2
K
Visual AD
==1
3
n4
Base: 97.8/97.2
60.47/78
64.81/83.20
68.87/85.20
67.04/85.33
97.4/96.8
97.7/97.2
98.397.6
98.2/97.7
64.34/82.11 11
74.89/88.21
75.21/88.95
73.44/87.55 59
98.3/97.4
98.9/98.0
99.1/97.9
99. 2/97.9
R
3
71.21/86.22 32
78.64/91.19
76.42/89.94
70.87/85.11
R
98.4/97.4
99.3/98.3
99.5/98.3
99.1/98.1
R
74.57/89..5 36
7700/90.55
73.14/87.60
73.25/86.4 47
R
98.7/97.8
99.2/98.1
98.9/97.9
98.9/97.7
R
75.38/90.29
74.08/88.76 76
68.27/84.88
63.44/81.00
R
98.6/97.7
99 99.0/98.0
98.5/97.5
98. 3/9.3
Impact of Hyperparameters in Contraction Mapping Flow Tab shows the impact of hyperpa- rameters on 20 tabular datasets and MVTec AD. In the tabular AD task, when R and K due to the limited depth of sp()) results in fewer parameters and insufficient contraction mapping iterations, leading to suboptimal performance. When K and R = 3, our framework achieves the best performance, with an AP/AUROC of 6..69/99..9.... However, when K x R becomes too large, excessive iterations can cause reconstructions to converge too closely the fixed point, degrading the performance. For the industrial image-based AD task, when K = 3 and R = 3, the best performance of 99.5/98.3 in terms of image/pixel-level AUROC is achieved. Both large and small values of K x may degrade the anomaly classification and localization. We provide a T-SNE visualization of the feature distribution after CM with R = 3 and K in Fig where abnormal representations are constrained within the normal manifold and are prevented from fully converging to the fixed point.

---

Conclusion
Recent reconstruction-basee methods trained only on normal samples may generalize to certain abnormal inputs, leading to well-reconstrruete anomalies and degraded detection performance. To address this issue, we propose to apply the contraction mapping structure conduct reconstruction, in which normal and abnormal inputs are transformed into the normal manifold via iterations of this mapping increase the reconstruction error. In addition, the contraction mapping is also designed to be invertible, which means it can estimate the likelihood of the original input based on a Gaussian model in the flow form. Based on the above two points, we propose a bidirectional structure with forward reconstruction and backward density estimation. Extensive experiment evaluations on tabular data, natural image data, and industrial image data demonstrate the effectiveness of our method.
Acknowledgments
This work is supported by the National Natural Science Foundation of China (No. 62471405. 62331003, 62301451). Jiangsu Basic Research Program Natural Science Foundation (BK2024181 Natural Science Foundation of Hebei Province (F2024105029), Suzhou Basic Research Program (SYG202316) and XJTLU REF-22-01-011 XJTLU AI University Research Center, Jiangsu Province Engineering Research Center of Data Science and Cognitive Computation XJTLU and SIP AI innovation platform (YZCXPT2022103).
References
[1] Byeongkeun Ahn, Chiyoon Kim, Youngjoon Hong, and Hyunwoo Kim. Invertible monotone operators for normalizing flows. In NeurIPS, 2022.
[2] Lynton Ardizzone, Jakob Kruse, Sebastian Wirkert, Daniel Rahner, Eric W Pellegrini. Ralf S Klessen, Lena Maier-Hein, Carsten Rother, and Ullrich Köthe. Analyzing inverse problems with invertible neural networks. arXiv preprint
2018.
[3] Jens Behrmann, Will Grathwohl. Ricky TQ Chen, David Duvenaud, and Jörn- Henrik Jacobsen. Invertible residual networks. In ICML,
[4] Liron Bergman and Yedid Hoshen. Classification based anomaly detection for general data. arXiv preprint arXiv:2005.02233 023359, 2020.
[5] Paul Bergmann, Michael Fauser, David Sattlegger, and Carsten Steger. Mytec ad-a comprehen- sive real-world dataset for unsupervised anomaly detection. In CVPR, 2019.
[6] Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density-based local outliers. In SIGMOD, 2000.
[7] Jinyu Cai and Jicong Fan. Perturbation learning based anomaly detection. In NeuriPS, 2022.
[8] Yunkang Cao, Xiaohao Xu, Yuqi Cheng, Chen Sun, Zongwei Du, Liang Gao, and Weiming Shen. Personalizing vision- vasion-language models with hybrid prompts for zero-shot anomaly detection. IEEE Transactions on Cybernetics, 2025.
[9] Chun-Hao Chang, Jinsung Yoon, Sercan Ö Arik, Madeleine Udell, and Tomas Pfister. Data- efficient and interpretable tabular anomaly detection. In KDD, 2023.
[10] Yuanhong Chen, Yu Tian, Guansong Pang, and Gustavo Careiro. Deep one-class classification via interpolated gaussian descriptor. In AAAI, 2022.
[11] Thomas Defard, Aleksandr Setkov, Angelique Loesch, and Romaric Audigier. Padim: patch distribution modeling framework for anomaly detection and localization. In ICPR, 2021.
[12] Hanqiu Deng and Xingyu Li. Anomaly detection via reverse distillation from ole-slass embed- ding. CVPR, 2022.
[13] Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real nvp. arXiv preprint 10Xh::1605.08803 2016.
10

---

[14] Zheng Fang, Xiaoyang Wang, Haocheng Li, Jiejie Liu, Qiugui Hu, and Jimin Xiao. Fastrecon: Few-shot industrial anomaly detection fast feature reconstruction. In ICCV, 2023.
[15]
Sachin Goyal, Aditi Raghunathan, Moksh Jain, Harsha Vardhan Simhadri, and Prateek Jain.
Droce: Deep robust one-class classification. In ICML, 2020.
[16] Andrzej Granas, James Dugundji, et al. Fixed point theory. Springer, 2003.
[17] Denis Gudovskiy, Shun Ishizaka, and Kazuki Kozuka. Cilow-ad: Real-time unsupervised anomaly detection with localization via conditional normalizing flows. In WACV, 2022.
[18] Jia Guo, Shuai Lu, Lize Jia, Weihang Zhang, and Huiqi Li. Recontrast: Domain-specific anomaly detection via contrastive reconstruction. In NeurIPS, 2023.
[19] Jia Guo, Shuai Lu, Weihang Zhang, Fang Chen, Huiqi Li, and Hongen Liao. Dinomaly: The less is more philosophy in multi-class unsupervised anomaly detection. In CVPR, 2025.
[20] Songqiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao. Adbench: Anomaly detection benchmark. In NeurIPS, 2022.
[21] Haoyang He, Jiangning Zhang, Hongxu Chen, Xuhai Chen, Zhishan Li, Xu Chen, Yabiao Wang, Chengjie Wang, and Lei Xie. diffusion -baed framework for multi-class anomaly detection. In AAAI, 2024.
[22] Junwei He, Qiangian Xu, Yangbangyan Jiang, Zitai Wang, and Qingming Huang. Ada-gad: Anomaly-denoisse autocncoders for graph anomaly detection. In AAAI, 2024.
[23] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
[24] Wenpeng Hu, Mengyu Wang. Qin, Jinwen Ma, and Bing Liu. Hm: A holistic approach to one class learning. In NeurlPS, 2020.
[25] EMMETT Keeler and A Meir. A theorem on contraction mappings. J. Math. Anal. Appl, 28(1): 326-329, 1969.
[26] Daehyun Kim, Sungyong Baik, and Tae Hyun Kim. Sanflow: Semantic-aware normalizing flow for anomaly detection. In NeurlPS, 2023.
[27] Durk Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. In NeurIPS, 2018.
[28] Chun-Liang Li, Kihyuk Sohn, Jinsung Yoon, and Tomas Pfister. Cutpaste: Self-supervised learning for anomaly detection and localization. CVPR, 2021.
[29] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou, Isolation forest. In ICDM, 2008
[30] Wei Luo, Yunkang Cao, Haiming Yao, Xiaotian Zhang, Jianan Lou, Yuqi Cheng, Weiming Shen, and Wenyong Yu. Exploring intrinsic normal prototypes within single image for universal anomaly detection. In CVPR, 2025.
[31] Aihua Mao, Biao Yan, Zijing Ma, and Ying He. Denoising point clouds in latent space via graph convolution and invertible neural network. CVPR, 2024.
[32] Pramuditha Perera, Ramesh Nallapati, and Bing Xiang. Ocgan: One-class novelty detection using gans with constrained latent representations. In CVPR, 2019.
[33] Yura Perugachi-Diaz, Jakub Tomezak, and Sandjai Bhulai. Invertible densenets with concate- nated lipswish. In NeurIPS, 2021.
[34] Chen Qiu, Timo Pfrommer, Marius Kloft, Stephan Mandt, and Maja Rudolph. Neural transfor- mation learning for deep anomaly detection beyond images. In ICML, 2021.
[35] Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim. Efficient algorithms for mining outliers from large data sets. In SIGMOD, 2000.

---

[36] Shebuti Rayana. Odds library. Stony Brook University, Department of Computer Sciences, 2016.
[37] Karsten Roth, Latha Pemula, Joaquin Zepeda, Bernhard Schölkopf. Thomas Brox, and Peter Gehler. Towards total recall in industrial anomaly detection. In CVPR, 2022.
[38] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In ICML, 2018.
[39] Robin Schimmeister, Yuxuan Zhou, Tonio Ball, and Dan Zhang. Understanding anomaly detection with deep invertible networks through hicrarchies of distributions and features. In NeurIPS, 2020.
[40] Berharr Schölkopf, John C Platt, John Shawe-Taylos Alex J Smola, and Robert C Williamson. Estimating the support of a high-dimensional distribution, Neural computation, 13(7):1443- 1471, 2001.
[41] Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. arXiv preprint arXiv:2 /20. 2021.
[42] Tom Shenkar and Lior Wolf. Anomaly detection for tabular data with internal contrastive learning. In ICLR, 2022.
[43] Kihyuk Sohn, Chun-Liang Li, Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluating representations for deep one-class classification, arXiv preprint arXiv:2011.02578. 2020.
[44] Han Sun. Yunkang Cao, Hao Dong, and Olga Fink. Unseen visual anomaly generation. In CVPR, 2025.
[45] Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. NeurlPS, 2020.
[46] David MJ Tax and Robert PW Duin. Support vector data description. Machine learning, 54: 45-66, 2004.
[47] Xiaolei Wang, Xiaoyang Wang, Huihui Bai, Eng Gee Lim, and Jimin Xiao. Cnc: Cross-modal normality constraint for unsupervised multi-class anomaly detection. AAAI, 2025.
[48] Xiaolei Wang, Xiaoyang Wang, Huihui Bai, Eng Gee Lim, and Jimin Xiao. Decad: Decoupling anomalies in latent space for multi-class unsupervised anomaly detection. In ICCV, 2025.
[49] Xiaolei Wang, Xiaoyang Wang, Huihui Bai, Eng Gee Lim, and Jimin Xiao. Icc: Intra-cluster contraction for pedestrian anomaly detection under one-class classification setting. JEEE Transactions on Artificial Intelligence, 2025.
[50] Xingwei Yang. Longin Jan Latecki, and Dragoljub Pokrajac. Outlier detection with globally optimal exemplar-based gmm. In ICDM, 2009.
[51] Xincheng Yao, Ruoqi Li, Zefeng Qian, Lu Wang, and Chongyang Zhang. Hierarchical gaussian mixture normalizing flow modeling for unified anomaly detection. In ECCV, 2024.
[52] Jihun Yi and Sungroh Yoon. Patch svdd: Patch-level svdd for anomaly detection and segmenta- tion. In ACCV, 2020.
[53] Jiaxin Yin, Yuanyuan Qiao, Zitang Zhou, Xiangchao Wang, and Jie Yang. Mem: Masked cell modeling for anomaly detection in tabular data. In ICLR, 2024.
[54] Zhiyuan You, Lei Cui, Yujun Shen, Kai Yang. Xin Lu, Yu Zheng, and Xinyi Le. A unified model for multi-class anomaly detection. In NewrIPS, 2022.
[55] Jiawei Yu, Ye Zheng, Xiang Wang, Wei Li, Yushuang Wu, Rui Zhao and Liwei Wu. Fastflow: Unsupervised anomaly detection and localization via 2d normalizing flows. arXiv preprint axXiv:2111.06677.2000 2011. 2021.
12

---

[56] Vitjan Zavrtanik, Matej Kristan, and Danijel Skočaj. Draem-a discriminatively trained recon- struction embedding for surface anomaly detection. In ICCV, 2021.
[57] Yunhe Zhang, Yan Sun, Jinyu Cai, and Jicong Fan. Deep orthogonal hypersphere compression for anomaly detection. In ICLR, 2024.
[58] Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In ICLR, 2018.
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Our contributions are summarized in the Abstract and Introduction sections
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Justification: Please see Appendix E
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
14

---

Justification:
We provide two proposition with corresponding lemmas, where their proofs can be founded in Methodology and Appendix C
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Please the Implementation Details in Section 4
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
15

---

Answer: [Yes]
Justification:
As mentioned the Abstract our code and data will be made publicly
available.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurlPS code and data submission guidelines (https
ssiinyolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Please see Datasets in Section 4 Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We report results averaged across 3 independent runs with different random seeds for all experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
16

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please the Implementation Details in Section
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https::/neurips:
/ http://....c...tttttctccccccaaee
Answer: [Yes]
Justification: We have read the NeurlPS Code of Ethics and confirm that our research complies with these ethical standards.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Anomaly detection is an vital part of industrial quality inspection, disease prediction, safety warning and other fields. Our method can be used for all kinds of data, so it has positive social impact.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification:
We think that our paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The datasets utilized in this paper are all open-source, and we have cited the corresponding papers accordingly.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.papersstt
package should be provided. For popular datasets, paperswi thcode. cww/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer:
[NA]
Justification: Our paper introduces new anomaly detection framework without releasing new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
19

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
Justification: The LLM is used only for editing, and the core method development in our paper does not involve LLMS as any important.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
20

---

A More Implementation Details
In this section, we provide additional implementation details, including the hyperparameters and network architecture for feature extraction.
Hyperparameters for Tabular Datasets Go of the Appendix shows details of 20 tabular anomaly detection (AD) datasets used the experiment. where different datasets contain significantly different numbers of samples and feature dimensions. It is challenging to set global training hyperparameters to achieve optimal performance across all datasets. To ensure good performance while avoiding excessive hyperparameter tuning, fix the learning rate well as the dimension of input and output of the CM across all datasets (see Tab 7). Finally, following previous works [53], we only adjust the batch size and epochs during training for datasets with particularly large small sample sizes to achieve better performance.
Table 6: Detailed information of 20 tabular datasets. N: the total number of samples, the number of attributes in each dataset.
Table 7: Traning hyperparameters for 20 tabu- lar data. 'Lr': learning rate. 'BS': batch size. C the dimension of input and output of CM.
Datasel
Anomalies
Dataset
Epoch
BS
Arhythmia
(14.6%)
Arrhythmia
100
Breastw
683
9
(34.9%%
Breastw
le-5
100
64
32
Cardio
1,831
21
176 (9.6%)
Cardio
le-5
100
Census
299,285
500
18,568 (6.2%)
Census
le:5
150
512
Campaign
41,188
62
4,640 (11.2%)
Campaign
lc-5
150
512
32
Cardottcogruphy
466 (22.0%)
Cundiotocograply
Fraud
284,807
29
492 (0.1%)
Fraud
le.5
150
512
32
(4.2%)
100
lonosphere
351
33
126 (35.8%)
Jonosphere
Ic-5
150
64
32
Mammographh
11,183
260 (2.3%)
Mamnography
le-5
100
$12
NSL. NSLL-DD
148,517
122
77,054 (51.8%
NSL KDL
le:5
100
512
Optdigits
5,216
64
150 (2.8%)
Optdigits
le-5
150
64
32
Pirna
268 (34.8))
Pendigits
6,870
16
156 (2.2%)
Pendigits
le-5
150
64
32
Satellite
6,435
2,036 (31.6%)
Satellite
150
256
Satimago-2
5,803
71 (1.2%)
Satimage-2
Ie-5
150
256
32
Shutile
49,097
9
3,511 (7.1%)
Shuttle
le:5
150
256
Thyroid
3,772
(2.4%)
Thyroid
le.5
150
256
Wbe
278
30
21 (7.5%)
Whe
le-5
150
64
32
(7.7%)
Feature Extractor Following previous work [77 53
we also adopt a three-layer MLP with
LeL activation extract the deep representation of tabular data (see 55g (a)), where the dimension of the output and input in each layer is consistent with previous work [57]. Next, as shown in 5 (b), we leverage simple three-layer CNN extract the deep representation of natural image data, where the setting of the network follows work [57]
Network Details for Industrial Defect Detection Industrial defect detection is primary ap- plication area of anomaly detection that has a well-established standard. Therefore, we adopt baseline model obtain a baseline performance (see Tab.5 in our main manuscript). The baseline model adopts a frozen encoder and a learnable decoder, which is similar to RD4AD [2). Un- like RD4AD, we removed the MMF and OCE modules from baseline framework, resulting in more fundamental performance. Based on this baseline framework, the contraction mapping flow (--) ) is applied after the feature encoder (see Fig[5] (c)). The specific pipeline can be sum- marized as: given an image I E F Ho X3 the frozen encoder E() encodes I into multi-layer features (x))/ each X, TR HixXC denotes the 1-th layer feature. We select 1t, 12-th, la-th layer features as encoded features, denoted by Xx,,X2, X2) Next, we down-sample the size of X1, X2 to Hi, x Wi, Next, we concatenate encoded features in the channel dimension, denoted by [x1, X2, X3] E RHi XWi, +Ci, +Cig), and apply a linear projection (+.)) to fuse them, i.e., ([xx1, X2, x3) E RR XWi, XCis Then, is input to our contraction mapping flow sp(-), obtaining latent variable z. Under the reconstruction branch, we apply learnable decoder to decode into decoded features (x1, R2, Kz). We apply the cosine similarity loss replace the original Cree
21

---

Linear (im,ut_Dim, 300)
Conv2D (2,
Density
Fj
FR.
Patch Prior
Distribution
MaxPool BN (32) & ELIU
Leaky ReI.U
Conv2D (32, 64.
Frozen
Decoder
Dropout
MaxPool & BN (64) & ELU
Learnable
Feature Map
Linear (300, 150)
Conv2D (64, 128,
Encoder
Fi
FR
Linear (150, 32)
MaxPool BN (128) & ELU
Image
CM network
(a) Encoder for Tabular Data
(b) Encoder for Natural Image Data
Framework for Industrial Defect Detection
Figure 5: Different feature extractors used extract deep representations of different data types. (a): Three-layer MIP with LeakyRel.U activation is adopted for tabular data. (b): Three-layer CNN with Batch normalization and ELU activation is used for natural image data. (c): Our proposed method is based on a general baseline method for industrial defect detection.
(Iq.(1) in the main manuscript), i.e.,
Flat(x;) Flat(X;) Flat( Flat (x:)
Lree Σ
where F.at(.) ) is the flatten operator. The density estimation branch adopts patch emhedding features fit the Gaussian prior distribution (-)) and uses o (-) obtain the likelihood of each patch embedding feature. During inference, we adopt a combination of both the cosine distance and the likelihood of each patch embedding feature the patch-level anomaly score. Through the optimization of Eq. (9). contraction mapping flow (p)) can transform any input x onto the normal manifold, which ensures that the decoded features {x1, X2, Xx are on the normal manifold, increasing the reconstruction error.
B
More Contraction Mapping Network Details
According Section 3.1.2 in the main manuscript, the structure of contraction mapping can be written as:
(()) Fn FR-1... F.).),
where each F,(-) Sk fk- .... f.()). Each contraction mapping unit fE(+) is based on the 1-Lipchitz invertible neural network G. i.e.,
f(x) Id G
(z)
where Id denotes the identity function. We adopt i-DenseNet
33 to parametrize G. Following
11.31 31. G is designed as Lipschitz-continuuuss function with Lipschitz constant 7) < 1, where
(G (1r2)ll2 S y||=; 22 112- Based on G, f(.) monotonic with Lipschitz constant 7, < so f(.) is invertible mapping according Banach fixed point theorem []6] (the proof can be found []. Based on and Eq. (2). we can model f (-), which is named as 'Lipschitz Layer'. We then apply the LipSwish activation function to the output of each (-). The LipSwish function is written as:
LipSwish(z) 1.1 * (1 + (xp(-Bx))
C Supplementary Proof
In this section, we supplement the detailed proofs of Lemma and Lemma used in our main manuscript.
22

---

Lemma 3 (Convergence of Iterations): Let f()) be contraction mapping with 17 E [0,1). For any initial input Zo E RR,, we define the sequence { by In+1 = f(xx, for n = 1,2. ... Then limm-roo Zn =", where x² is unique and is called fixed point of f()).
proof. We firstly prove that {x,} is Cauchy sequence. For any m n, we have:
1mmm Inll2 = || - Fmll2
1| In+1 1|2 + || - +
|
Fmll2
Nexi, for each term 1 In+k+1 ll2 in this sum:
1Entk In+b+1 2|2 = (f f(xn+k)l2
< 17 T - In+hll2
I n7 || In+x-1lle
S sn 11:0 - 21112-
Therefore, based on the above two inequality, we have:
m----
1m - 2ul12 5
Faath
In k+1
I
Σ
n 1|:00 -21l12
k=
k=0
m- m-n-1
1 1 17
17" |1:0 -x1ll2-
Σ k=
17
17"
1|:00- x1112-
1 1-17
1
S -1100- -01ll2-
As n + JC, 1f" - (since 17 1). so 110m - =nll for any m >> n a- Do. This proves that {rn} is Cauchy sequence. Since TRd with the Euclidean metric is complete, the sequence converges to certain point x² E IR,, i.e. limn-+0o In =x" Next. by continuity of f (which follows from the contraction property) and the definition of {zn):
f(x") f( lim In) = lim f(xx) lim In+1 = x". n=
To this end, we prove that f(x*) = x", i.e., x² is unique fixed point of f(-).
Lemma 4 Let (p((-) fK- (i), where each fo is contraction mapping with me [0, 1), then 4x (.) is a contraction mapping with Lipschitz constant 11p S 1 1/2
proof. First of all, let us prove for base case with K = 2. Let (2(()) f2 o fi(+) be the composition of two contraction mappings. For any two points I1, I2 E Rdd we have:
[1<2(xx) (2(222) = (1f2(f( - fa(fi
Since fa is a contraction mapping with constant 172 ([ - f2(fi (x2)) z mal ( - (x2))l.2.
(10)
Since fi is contraction mapping with constant m/
yall/i (x1) (x22)l1 S 7/2 m m|| - x2112-
(11)
Base on the above Eq. 10 and Eq. we have:
(122(1)) (22()2) & 1/2 mn x1 x2|12
which proves that (p2(-) is contraction mapping with nh S 17 7/2- Next, we apply mathematical
induction to prove the general case. We assume the lemma holds for K mappings, i.e., Pp (-))
fK-1 .... o (-) is a contraction mapping with Lipschitz constant m S m 772 ... 1]K-1- We consider (x(() = fK a (()) For any I1, E IRd we have:
(21) spx (22)ll2 = [1fx - fx fx((fx-1(E2))
(12)
Then, based on the inductive hypothesis and the definition of contraction mapping, we have:
nk|1şp- (11) < I TK (n(n -2. -.---))) x2ll2-
(13)
Combining Eq. ( and Eq. [3). one inequality can be obtained:
p (x1) &K (222))2 S (m .. -Tk) ]1 x2ll2-
Since each Tp E 10, 1), The must also be in [0, 1), i.e. 0 S m 1722 . < 1.
23

---

D Supplementary Experiments
Sensitivity of Balancing the Loss Terms The hyperparameter À in Eq.(7) of the main manuseript balances the reconstruction loss Lree and the maximum likelihood estimation loss LMIE.. To investi- gate its impact, we vary À and evaluate the performance, as shown in Tab. 8 of the appendix. For the 20 tabular datasets, À = 0.5 yields the best AP/AUROC, 78.64/91.19, Slightly higher (A = 0.6) or lower (A 0.4) values show comparable but slightly degraded performance, indicating that the performance is stable around À = 0.5. For the MVTec AD dataset, À = 0.4 provides the highest image-level AUROC, while À = 0.5 achieves the best pixel-level AUROC. Too small À causes & (-) to not fully capture the real distribution of input, degrading the performance of density estimation. Too large a value of may disturb reconstruction training. Therefore, the choice of À 0.5 (as used for both tabular and MVTec AD in our main experiments) achieves robust performance across both types of datasets.
Table 8: Anomaly detection results when varying different À values for balancing free and LMLE- We adopt image-level AUROC metric for 20 tabular datasets and image/pixel-leve AUROC for industrial MVTec AD datasets. Bold/underline values indicate the best/runner-up.
Datasets
A 0.2
0.3
0.4
0.5
0.6
À 0.7
Tabular Data
77.86/1.112
78.29/91.16 99.3/98.1
18.19/91.14
78.6491.
78.55/91.21
78.35/91.00
78.13/91.10
MVTec AD
99.1/98.1
99.6/98.2
99.5/98.1
99.3/98.2
99.4/98.3
98.9/97.9
Sensitivity of Weight Coefficient a The weight coefficient a in the anomaly score (Eq,(8) in the main manuscript) controls the contribution of the log- likelihood term relative to the reconstruction error. We evaluated the effect of different a values, with results presented in Tab. [9 the Appendix. We note that the scale of reconstruction error generally a very small value, while the scale of log likelihood is much larger than the reconstruction error. Therefore, using to control the scale log likelihood necessary for our unified framework that combines these two different paradigms. For the 20 tabular datasets, an of 0.01 achieves the optimal performance by 78.64/91.19, Performance degrades if a is too large or too small because of disturbed reconstruction or density estimation. Similarly, for the MVTec AD dataset, AUROC. Again, performance drops with much larger or smaller a values. This analysis highlights that the density estimation component, when weighted appropriately by a, significantly contributes to the final anomaly score. An a value of 0.001 appears to be a generally effective choice for both types of datasets according to this ablation.
0.001 also results in the best image-level and pixel-level
Table 9: Anomaly detection results with different weight coefficient a in anomaly score. We adopt the image-level AUROC metric for 20 tabular datasets and the image/pixel-level AUROC for industrial MVTec AD datasets. Bold/underline values indicate the best/runner-uy
1
0.5
0.1
= 0.05
= 0.01
0.005
= 0.001
Tabular Data
74.48/88.62
76.40V89.71
77.26/90.97
78.05/91.09
78.64/91.19
78.21/91.15
76.89/90.88
0.1
0.05
0.01
0.005
0.001
0.0005
0.0001
MVTe AD
387367766
98.6/97.6
98.9/98.0
99,3/98.2
99.5/98.3
99.398.1
99.2/98.0
E
Limitations
While our method shows strong AD performance on tabular and image datasets, its current scope is primarily focused on these common data types. It has not yet been extended to critical domains like graph and time-series data, where optimal AD typically requires specialized network architectures to handle their unique structural and dependency characteristics. Future work will involve adapting our URD framework to these distinet modalities by incorporating tailored design principles, aiming to progress toward unified anomaly detection model.
24

---

F Some Questions and Answers regarding Motivation and Methodology
E1 Intuitive Understanding of Proposition]]
Proposition [ mainly focuses on establishing direct causal link between our optimization and the fixed point's location. The proposition states that ||x x S Lree/(1 - 17), which directly and rigorously demonstrates that by minimizing the reconstruction loss Lree normal samples x, we are guaranteed bound the distance to the fixed point x*.
F.2
Why Apply LipSwish Activation Function rather than ReLU?
We note that the choice of LipSwish is deliberate and critical. LipSwish guarantees the reversibility of the entire network, while ReLU cannot guarantee it. In this work, we apply an invertible network o as the foundation, where LipSwish activation function invertible and ensures the invertibility Max (0, .²) maps all negative inputs to zero, which creates many- to-one mapping that is mathematically non-invertible. We adopt i-DenseNet [3 to parameterize our mapping G in Eq. 2.. According to [33], using LipSwish is standard and effective choice in this context, providing more expressive power than simpler activations. LipSwish is also smooth, continuously differentiable, and invertible, which are essential properties for stable training of INNs.
of In contrast, (eLU(x))
F33
How does Our Contraction Mapping Work in Different Data Distributions?
Since the contraction mapping iteratively transforms data toward a fixed point derived by training the model on normal data, what if the normal data distribution itself is chaotic? if the normal data distribution is ring-shaped or U-shaped? Can the fixed point be located in appropriate position? Will the reconstruction discrepancy identification work well such cases?
(a) (Vanilla)
Pinz (Diccunnette)
(Ring-laaedd)
(4) Whe (U-nhaped)
Figure 6: T-SNE visualization of data distribution shapes and corresponding fixed point positions for four types of tabular datasets
Sometimes, extreme and complex distributions may make the reconstruction-ont part ineffective, which also the reason why we introduce a density estimation process collaborate with the reconstruction process. Following the above questions, we discussed several situations and provided special cases of difficult reconstruction.
Vanilla Distribution. In fact, the manuscript visualizes the position of the fixed point in different normal distributions. Generally, the fixed point is not completely located the geometric center of the distribution, and sometimes, due to different data or training settings, fixed points may even fall on the edges of the distribution (see Fig 6 (a)).
Disconnected Distribution. As shown in Fig (b), the normal distribution is relatively scattered and chaotic, and the fixed point is located at the edge of one of the sub distributions. However, because the abnormal distribution is far from the normal one, reconstruction error still an effective criterion, achieving good performance under a reconstruction-only setting.
Ring-shaped Distribution. There currently no typical ring-shapes normal distribution in the used datasets. Fig (b) and (c) show multi-ring and irregular-ring structures. respectively. In fact, through multiple adjustments to the training hyperparameters and random seed, we found that fixed points may be located in some drta-free areas (central regions of the ring) or within the distribution (internal regions of the ring). If the anomaly is located the central area of the ring, this method may theoretically fail, but this situation has not been found in experiments yet.
25

---

U-shaped Distribution. As shown in (d), the normal distribution is U-shaped and the fixed point located at the bottom of 'U'. We found that after adjusting the random seed or training hyperparameters. the position of the fixed point will change and may not necessarily be located at the bottom position. However, the same thing is true: as long as enough training epochs are set, the fixed point is located inside or at the edge of U. CM will achieve good and stable performance as long as the abnormal data is in a distant external area.
In the reconstruction-only experiments, we found that if the abnormal data is very close to the normal distribution in terms of spatial position, the reconstruction errors generated by CM for normal and abnormal data are very close, resulting in false negatives and degrading performance. Of course, this also a challenge for all reconstruction-bast any position on a normal manifold, they may be closer to some anomalies than other normal points, leading to false negatives. Finally, in the most extreme case, our framework will fail when a few anomalies are within the normal distribution. However, it should be noted that almost all existing OCC methods cannot address this type of problem. This combined approach makes our method robust even for complex data distributions.
methods. In addition, since fixed points may appear at
F.4 Trade-off between Convergence a Fixed Point and Bijectivity via Network Design
Our method focuses on leveraging finite number of mapping compositions to simulate iteration of a single contraction mapping, rather than directly using iteration of a single contraction mapping.
Specifically, according to Proposition 2 we apply &px (+) = fx fx-1 ..... f-()) to simulate finite number of iterations of f, rather than directly iterating f. where each fis has its own parameters
8% and Lipschitz constant M/- Lipschitz constant Tip I ? '/2-- 7K < 1 ensures contracting anomalies towards the normal distribution. We leverage Lroe = (x) - x l2 to train the entire network SPK, rather than firstly training a single ʃ and then iterating it few times. From an optimization perspective, Φ optimized by free tends to restore normal input to normal output instead of contracting all inputs (normal and abnormal) to one fixed point. From a mathematical perspective. a finite and small K value gives рж the ability to contract the input to the normal manifold. Still, does not destroy the reversibility of yk. In summary, selecting K finite value, the contraction properties of yx and the training objective jointly ensure that it can map anomalies to normal manifolds. Still, it will not completely shrink to a very small region or even a point and destroy its reversibility.
We intentionally keep K and R small in actual experiments prevent over-contraction. This allows us to benefit from the "pull" of the contraction towards the normal manifold (which increases reconstruction error for anomalies) while not destroying the reversibility of our INN The trade-off is managed by the choice of K and R, which we study empirically in T] The results show that a moderate number of iterations yields the best performance, validating our handling of this trade-off.
F55
The Risk of CM Network Collapsing to the Identity Mapping
The degradation towards identity mapping is a critical concern for contraction mapping trained with reconstruction loss. We show two explicit mechanisms to prevent this: one is the structure of the contraction mapping unit, and the other is the regularity of our backward density estimation.
x, where G is invertible and Idis identity mapping. x = x, which means ( (x))) = 2x. Based on the definition of inverse mapping, we must have Id (2x) x. This means Id(2z) + G(2z) 2x. Then, we can get G(2x) 0 to make f(x) an identity mapping. Paradoxically, G is invertible and a one-to-one mapping. Therefore, in terms of the structure of f. it is difficult to degrade into an identity mapping under the optimization of reconstruction loss.
(1) According to Eq. fx) (1
If f degrades into an identity mapping under reconstruction loss, we have ( (dd+G)-
2
(2) The backward density estimation loss LMLE provides powerful regularizer against identity collapse. In the backward process, LMIE pushes -- to be a mapping that transforms a basic Gaussian distribution x (z) to the (typically complex) input distribution p(x). An identity mapping could only achieve this p(x) is also a Gaussian distribution, which never the case. This forces -1 to learn a non-trivial, meaningful transformation.
26

---

F.6 The Conflict of Optimization Objectives of Reconstruction and Density Estimation
According reconstruction loss ①1 and MLE loss (o), pushes z be close to x, while CMLE pushes the distribution of to be Gaussian distribution. We need to clarify that both forward reconstruction (RE) and backward density estimation (DE) are indispensable, although they may seem contradictory. We have also designed corresponding trade-off schemes in the manuscript.
When only using RE, if some anomalies very close the normal manifold the obtained fixed point terms of spatial position, this causes small reconstruction errors and false negatives. In addition, the distribution of normal data may be very complex, chaotic, and disconnected (see Fig In this case, fixed points may fall on the edges of the distribution, or even in areas without data. In this case, reconstruction error cannot be used introduce density estimation process to probabilistically identify anomalies under these special cireumstances. DE would assign a high likelihood to points in areas with dense data points and a low likelihood to others with low density. An anomaly is thus an input that is both far from its reconstruction (high reconstruction score) and statistically unlikely have a high likelihood (low density estimation score). This synergy makes our method robust. As shown in Fig 2 forward reconstruction process (RE), we apply stop-gradient operation sg(-) in learning of Gaussian distribution π (2), which allows π (z) to be learned independently without affecting the reconstruction training. In addition, the hyperparameter in our total loss Lioral = Liee + ALMLE explicitly controls this trade-off. Our sensitivity analysis on in Shows that balanced value (A = 0.5) performs best, validating that the two objectives are complementary rather than purely conflicting. The reconstruction provides an error-based score, while the flow provides likelihood based score, and their combination more powerful than either alone.
good criterion. To address these issues,
and Eq after
27


Reviews:
[{"review_id": "qDPV07hjrB", "reviewer": "Reviewer_eeLX", "summary": "The paper proposes a new method for unsupervised anomaly detection that combines a forward contraction mapping with density estimation via a reversed normalizing flow. The contraction mapping is designed to map any input data point toward a fixed point on the normal data manifold. Specifically in this paper, the mapping $f$ is chosen as a 1-Lipschitz neural network, regularized with spectral normalization and using the LipSwish activation function. The network is trained to minimize the reconstruction error $||f(x) -x||_2$ for arbitrary input \n$x$. Then, leveraging the invertibility of $f$, the method then uses the inverse map of $f$ to transform a Gaussian  prior distribution into a real data distribution, allowing for estimating the likelihood of the input. Overall, the approach jointly minimizes the reconstruction error in the first stage and the negative log-likelihood in the second stage. The method is evaluated on multiple anomaly detection benchmarks and demonstrates competitive performance relative to existing anomaly detection methods.", "questions": "See Weaknesses", "limitations": "See Weaknesses", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. While the individual components of the proposed approach (i.e., the reconstruction map and the use of normalizing flows) draw heavily from prior work, the primary contribution lies in their combination. The experimental results provide reasonable evidence that combining the reconstruction map with normalizing flows leads to improved anomaly detection performance compared to using either component alone.\n2. I appreciate that the authors included a detailed sensitivity analysis of the hyperparameters $\\lambda$ and $\\alpha$, which  illustrate the trade-off between reconstruction error and the MLE loss.\n\nWeaknesses:\n1. The term \"well-constructed anomalies\" was not defined or explained in the introduction, which makes it difficult to grasp the motivation behind the proposed method. It appears to refer to reconstructed anomalous inputs that fall outside the normal data manifold, and I am not even sure if I understand this correctly. Clarifying this early on would make the paper more accessible, especially for\n    readers less familiar with reconstruction-based anomaly detection.\n2. The theoretical guarantees provided for the reconstruction map appear shallow. In particular, Proposition 1 does not rigorously prove that the fixed point $x^*$ will be close to the original input $x$. The paper does not show that, for any chosen mapping $f$ and optimization algorithm, the reconstruction loss $||f(x) - x||_2$ can be made arbitrarily small. \n3. The choice of the activation function $\\psi$ of the neural network employed appears important to me, yet it is omitted from the main text. Only in the appendix do the authors mention that $\\psi$ is the  LipSwish activation function.  Given that ReLU is also 1-Lipschitz and commonly used, why do the author choose LipSwish over ReLU? Does LipSwish bring empirical benefit, possibly related to the extra learnable parameter $\\beta$?\n4.   The paper lacks a theoretical justification for why the integration of reconstruction mapping and normalizing flows should be more effective than using either component independently.", "was_revised": true, "final_justification": "I maintain my score as \"borderline reject\"", "rebuttal": "***Q1. Vague term makes it difficult to understand the core motivation of the paper. (Weakness 1)*** \n\n>We thank you very much for pointing out the ambiguity of this term.\n\n>**(i)** Generally, reconstruction-based methods rely on an assumption: reconstruction network trained on normal samples cannot reconstruct abnormal samples. Ideally, the trained network cannot reconstruct an abnormal sample well during inference, so there is a significant difference between the abnormal input and its reconstruction result. However, general reconstruction network (Autoencoder) often fails to achieve the ideal situation mentioned above and **still reconstructs some abnormal inputs well**. Thus, \"well-reconstructed anomalies\" refers to a common failure mode in reconstruction-based anomaly detection methods. To make this clearer for all readers, we will explicitly define the term \"well-reconstructed anomalies\" in the introduction of the revised manuscript and connect it directly to the problem of low reconstruction error for abnormal samples.\n\n>**(ii)** Our core motivation of reconstruction via contraction mapping is to combat the above failure mode. Instead of allowing the network to freely reconstruct inputs, we constrain the output to lie on the normal manifold. As shown empirically in **Fig. 1(d)** and **Fig. 4**, our contraction mapping iteratively pulls abnormal inputs towards the normal manifold. This process intentionally increases the reconstruction error for anomalies, making them more detectable and directly addressing the \"well-reconstructed anomalies\" problem. We will explicitly state this in the introduction of the revised manuscript.\n\n***Q2. Explanation of Proposition 1. (Weakness 2)***\n\n>Thanks for your insightful comments on the depth of our theoretical analysis.\n\n>**(i)** Proposition 1 mainly focuses on establishing a direct causal link between our optimization and the fixed point's location. The proposition (**line 151-159**) states that $||\\mathrm{x}^* -\\mathrm{x}|| _ {2}\\le \\mathcal{L}_{\\text{rec}}/(1-\\eta )$, which directly and rigorously demonstrates that by minimizing the reconstruction loss $\\mathcal{L} _ {\\text{rec}}$ on normal samples $\\mathrm{x}$ (our training objective), we are guaranteed to bound the distance to the fixed point $\\mathrm{x}^*$. The empirical visualizations in **Fig. 3** on real datasets strongly support this theoretical claim, showing the fixed point landing within the normal data manifold.\n\n>**(ii)** We are unable to prove that for any mapping and optimization algorithm, $\\mathcal{L}_{\\text{rec}}$ can be made arbitrarily small, because this depends on model capacity and data distribution complexity. This is a fundamental challenge in deep learning optimization. The empirical visualizations in Fig. 3 on real datasets, which show the fixed point landing within the normal data manifold, provide strong support for this theoretical claim. In addition, as shown in **line 153**, we only use the term 'a small neighborhood' rather than 'arbitrarily small' or 'complete convergence'.\n\n***Q3. Why apply LipSwish activation function. (Weakness 3)***\n\n>Thanks for your professional comments. We note that the choice of LipSwish is deliberate and critical. LipSwish guarantees the reversibility of the entire network, while ReLU cannot guarantee it. We provide a specific analysis below for your reference.\n\n>**(i)** In this work, we apply an invertible network $\\varphi$ as the foundation, where LipSwish activation function is invertible and ensures the invertibility of $\\varphi$. In contrast, $\\mathbf{ReLU}(x)=\\mathbf{Max}(0,x)$ maps all negative inputs to zero, which creates a many-to-one mapping that is mathematically non-invertible. When $x < 0$, the input information is permanently lost, making it impossible to recover the input from the output.\n\n>**(ii)** As mentioned in the appendix (**line 45,appendix**), we adopt i-DenseNet [1] to parameterize our mapping $\\mathbf{G}$ in **Eq.(2)**. According to [1], the use of LipSwish is a standard and effective choice in this context, providing more expressive power than simpler activations. LipSwish is also smooth, continuously differentiable, and invertible, which are essential properties for stable training of INNs.\n\n>[1] Yura Perugachi-Diaz, et al. Invertible densenets with concatenated lipswish. In NeurIPS, 2021.\n\n***Q4. Why the integration of reconstruction and density estimation should be more effective. (Weakness 4)***\n\n>The two components are not just used together and they are synergistic.\n\n>**(i)** When only using reconstruction mapping, we found that some anomalies were very close to the normal manifold in terms of spatial position, which caused small reconstruction errors and false negatives. In addition, the distribution of normal data may be very complex, chaotic, and disconnected. In this case, fixed points may fall on the edges of the distribution, or even in areas without data. In this case, reconstruction error cannot be used as a good criterion. To cope with the above situations, we introduce a density estimation process to probabilistically identify anomalies near the normal manifold.\n\n>**(ii)** Generally, an anomaly is thus an input that is both far from its reconstruction (high reconstruction score) and statistically unlikely to have high likelihood (low density estimation score). Therefore, we apply a integration of reconstruction and density estimation to identify test input (see **Eq.(8)**).\n\n>**(iii)** Our ablation studies (**Table 3 & 4**) provides strong support for this synergy. The full model **(D)** consistently and significantly outperforms the reconstruction-only **(B)** and density-only **(C)** variants, demonstrating that their combination is more powerful than either part alone."}, {"review_id": "sBYzbGixQA", "reviewer": "Reviewer_bUw6", "summary": "This paper proposes to resolve one class classification based unsupervised anomaly detection problem with thecontraction mapping. By iteratively transform samples through the contraction mapping, normal samples stayclose and abnormal samples moves far away, resulting large discrepency. The invertablity property of contractiohmapping enables backward density estimation, and thus present a unifed anomaly detection framework withforward reconstruction and backward density estimation. The method's efficacy is demonstrated throughextensive experiments on a variety of datasets and it shows competitive performance against currentstate-of-the-art methods.", "questions": "1. Are there any experiments to directly evaluate the effect of using contract mapping instead of indirect evaluation?\n\n2. Can you further discuss the affects of different kinds of normal data distribution on CM results? It's interesting to see in what circumstances dose CM work well and in which case it may not well distinguish abnormal samples.", "limitations": "No Limitations", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1.Introducing contract mapping into one class based anomaly detection is interesting2.The performance is promising3. The paper content and illustrations are clear and easy to follow\n\nWeaknesses:\n1. It seems that the main contribution largely comes from the introduced contraction mapping model. The author provides results for single forward reconstruction and backward density estimation in Table 3 and 4.in which the performance boost is observed. However, direct and clear evaluation of performance of contract mapping itself is needed. Just showing the RE an DE is indirect. From my perspective, they are just components of the unified framework.\n\n2. Sensitivity of data distribution. Since the contraction mapping iteratively transforms data toward a fixed point derived by training the model on normal data, what if the normal data distribution itself is chaotic? Or if the normal data distribution is ring-shaped or U-shaped? Can the fixed point locate in an appropriate position? Will the reconstruction discrepancy identification work well in such cases?\n\nAs contraction mapping is an introduced mathematical tool, further justification for its use in anomaly detection should be supplemented.", "was_revised": true, "final_justification": "The author's response addressed my concerns. Referring to the reviews of other reviewers, I improved my score.", "rebuttal": "***Q1. More direct and detailed evaluation on contraction mapping (CM). (Weakness 1 and Question 1)***\n\n>Thanks for your insightful comments and valuable suggestions. In fact, we compared the reconstruction-only CM (DE process is removed) with MLP-based and CNN-based Autoencoders in variants **(A)** and **(B)** in Tables **3&4**, but did not provide more detailed explanations for these experiments. Following your professional suggestions, we supplement these sections as follow. Moreover,we also add ablation studies of the components of reconstruction-only CM for your reference.\n\n>**(i)** In **Table 3 and lines 288-289**, to directly and fairly show the superiority of CM reconstruction, model **(A)** adopt the MLP structure with the same dimension of input and output, and the same number of layers for reconstruction as our CM. The significant performance improvement from Model **(A)** (AP/AUROC: 67.44/86.52) to Model **(B)** (75.21/90.32) represents a gain of +7.77 AP / +3.80 AUROC on all tabular datasets. This improvement can be directly attributed to the effectiveness of the contraction mapping in creating more discriminative reconstruction errors compared to a standard reconstruction approach. \n\n>**(ii)** As shown in **Table 4 (A&B)**, compared with the original CNN-based Autoencoder network, reconstruction-only CM variant **(B)** obtained gain of image-level AUROC by +4.29 on natural image data and image-level/pixel-level AUROC by +1.4/0.7. All of these directly demonstrate that the reconstruction of CM is superior on image datasets. In our manuscript, due to the space limitations, we did not provide a detailed comparison between variants **(A)** and **(B)** in the ablation experiment.\n\n>**(iii)** We directly provide a comparison between a non-CM invertible network and a CM invertible network. According to **Eq.(2)** in main manuscript **lines 197-198**, the core of each contraction mapping unit $f$ is the INN $\\mathbf{G}$ that is a guarantee of contract mapping. Next, we test general INN network, Glow [1], widely used i-ResNet [2], and our used i-DenseNet [3] as $\\mathbf{G}$ respectively in the following table. In these experiments, we only test reconstruction process. Although the structure of Glow is also an INN, each layer does not meet the requirements of CM ($\\eta<1$), which makes $f$ no longer a CM. This also means that under the training of reconstruction loss, $f$ may degenerate into an identity map, without solving the 'well reconstructed anomalies' issue. On the contrary, i-ResNet and i-DensNet satisfy the conditions of our CM and achieve higher performance on used datasets. The comparison of the three groups also directly indicates that using CM for reconstruction is effective.\n\n||All Tabular Datasets|CIFAR-10|MVTec AD|\n|---|---|---|---|\n|Glow [1]|66.14/84.39|71.27|97.3/96.5|\n|i-ResNet [2]|74.83/90.47|74.57|98.9/97.9|\n|i-DensNet [3]|75.21/90.32|76.88|99.2/97.9|\n\n>[1] Durk P Kingma, et al. Glow: Generative flow with invertible 1x1 convolutions. In NeurIPS, 2018.\n\n>[2] Jens Behrmann, et al. Invertible residual networks. In ICML, 2019.\n\n>[3] Yura Perugachi-Diaz, et al. Invertible densenets with concatenated lipswish. In NeurIPS, 2021.\n\n***Q2. CM results on different kinds of normal data distributions. (Weakness 2 and Question 2)***\n\n>These questions you raised about the CM results on different normal data distributions are very crucial and very interesting. Sometimes, extreme and complex distributions may make reconstruction-only part ineffective, which is also the reason why we introduce density estimation process to collaborate with reconstruction process. Following your series of questions, we discussed several situations and provided some special cases of difficult reconstruction.\n\n>**(i) Ordinary circumstances.** In fact, the manuscript visualizes the position of the fixed point in different normal distributions. Generally, the fixed point is not completely located at the geometric center of the distribution, and sometimes due to different data or training settings, fixed points may even fall on the edges of the distribution (see **Fig.3 (a)**). \n\n>***Disconnected distribution.*** As shown in **Fig.4 (left)**, normal distribution is relatively scattered and chaotic, and the fixed point is located at the edge of one of the sub distributions. However, due to the fact that the abnormal distribution is far from the normal one, reconstruction error is still an effective criterion, achieving a good performance under reconstruction-only setting.\n\n>***U-shaped distribution.*** As shown in **Fig.3 (d)**, normal distribution is U-shaped and the fixed point is located at the bottom of U. We found that after adjusting the random seed or training hyperparameters, the position of the fixed point will change and may not necessarily be located at the bottom position. But the same thing is that as long as enough training epochs are set, the fixed point is located inside or at the edge of U. As long as the abnormal data is in a distant external area, CM will achieve good and stable performance (AP/AUROC: 88.98 $\\pm$ 0.73 /97.18 $\\pm$ 0.41 under reconstruction-only setting).\n\n>***Ring-shaped or multi-ring-shaped distribution.*** There is currently no typical ring-shaped normal distribution in the used datasets. **Fig.3 (b) and (c)** show multi-ring and irregular-ring structures, respectively. In fact, through multiple adjustments to the training hyperparameters and random seed, we found that fixed points may be located in some data free areas (central regions of the ring) or within the distribution (internal regions of the ring). If the anomaly is located in the central area of the ring, this method may theoretically fail, but this situation has not been found in experiments yet.\n\n>**(ii) Special difficult circumstances.** In the reconstruction-only experiments, we found that if the abnormal data is very close to the normal distribution in terms of spatial position, the reconstruction errors generated by CM for normal and abnormal data are very close, resulting in false negative and degrading performance. Of course, this is also a challenge for all reconstruction-based methods. In addition, In addition, due to the fact that fixed points may appear at any position on a normal manifold, they may be closer to some anomalies than other normal points, leading to false negatives.\n\n>Finally, in the most extreme case, when a few anomalies are within the normal distribution, our framework will fail. However, it should be noted that almost all existing OCC methods cannot address this type of problem. We believe this combined approach makes our method robust even for complex data distributions. We will add a discussion of this aspect to the limitations section in the appendix.\n\n>**(iii) Strategies for address difficult circumstances.** According to difficult circumstances in **(ii)**, CM reconstruction may fail due to the spatial position of fixed points and abnormal data. To address these issues, backward density estimation (DE) is introduced to learn probability distribution of original normal data. Even if the anomaly is close to normal in space, its likelihood may be much lower than that of normal data.\n\n>Regarding the typical ring-shaped situation where reconstruction with CM may fail, DE would assign a high likelihood to points on the ring but a low likelihood to points in the empty center. This synergy makes our method robust, as an anomaly would be flagged by either a large reconstruction error, a low likelihood, or both."}, {"review_id": "6mhbLc6Mfw", "reviewer": "Reviewer_A2j8", "summary": "This paper proposes an unsupervised anomaly detection method that unifies reconstruction and density estimation via contraction mappings.\nBy employing Lipschitz-continuous mappings with a Lipschitz constant less than one, any input is guaranteed to converge to a unique fixed point.\nSince this fixed point lies on the normal data manifold, reconstruction errors for anomalous inputs become significantly larger, enabling effective anomaly detection.\nMoreover, the invertibility of the contraction mapping allows for density estimation in the style of flow-based models.\nThe proposed method jointly optimizes both reconstruction and density estimation through a bidirectional architecture,\nachieving competitive or superior performance compared to existing methods on both tabular and image anomaly detection tasks.", "questions": "- If a contraction mapping is bijective, then its repeated application should also be bijective. However, since the mapping converges to a unique fixed point after repeated applications, it seems to contradict bijectivity. I understand that your method mitigates this issue by limiting the number of iterations. Still, increasing the number of iterations might make the reconstruction error for anomalies even larger. Could you elaborate on this trade-off and how it is handled in your method?\n\n- While your method is based on reconstruction error, it is not encoder–decoder–based like an autoencoder. Instead, it uses a sequence of same-dimensional mappings. In such a case, there is a risk of the network collapsing into the identity mapping. Even with contraction mappings, if the Lipschitz constant is close to 1, the mapping could behave similarly to identity. How is this issue mitigated? My understanding is that the network design in Section 3.1.2 (Equation (2)) and the integration with a flow-based model help regularize the mapping by enforcing alignment with the prior. Is this correct?\n\n- What is the motivation behind jointly optimizing reconstruction error and the flow-based likelihood? If \\phi is trained to minimize reconstruction error, the transformed data distribution should resemble the original input distribution. On the other hand, maximizing the likelihood via a flow-based model pushes the transformed data to match a Gaussian prior. These two goals appear to be in conflict. Is my understanding correct, and if so, how is this trade-off addressed in your method?\n\n- I also have some questions regarding the hyperparameters. For instance, setting $R=2$ or $3$ seems quite shallow compared to typical flow-based models, which often require deep compositions to capture complex distributions. However, from the ablation study, it appears that combining reconstruction and flow-based density estimation yields the best performance. Does this imply that the role of the flow in your method is not to model the data distribution in detail, but rather to act as a complementary scoring mechanism? I would appreciate it if you could clarify the intended role of the flow component.\n\nIf these concerns are resolved, I would be happy to increase both my overall score and confidence.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths\n- This paper is well-written and easy to follow.\n- Models that minimize reconstruction error, such as autoencoders, can sometimes reconstruct both normal and anomalous data. The idea of using contraction mappings to address this issue is highly original and important. Additionally, leveraging the invertibility of contraction mappings to integrate with flow-based models is effective and appears to contribute meaningfully to anomaly detection performance.\n\n## Weakness\n- On the other hand, there are several points I did not fully understand or found somewhat unclear; I will list them in the “Questions” section.\n- This is a very minor issue, but in line 183, I believe the expression should more precisely denote the L2 norm.", "was_revised": true, "final_justification": "Incorporating contraction mappings into autoencoder-based anomaly detectors is an interesting idea, and the proposed method demonstrates strong empirical performance. In addition, the rebuttal has addressed my concerns. I recommend an Accept.", "rebuttal": "***Q1. The trade-off between convergence to a fixed point (iterations of $f$) and bijectivity (each $f$ unit). (Question 1)***\n\n>This is a very sharp and important observation. You are correct that infinite iterations of a contraction mapping unit $f$ would map all inputs to a single point, breaking bijectivity.  In the following response, we first need to clarify a mathematical conclusion that the composition of a finite number of invertible mappings is still an invertible mapping, but the composition of an infinite number of mappings is not necessarily an invertible mapping. Next, our method focuses on leverage a finite number of mapping composition to simulate iteration of a single contraction mapping, rather than directly using iteration of a single contraction mapping.\n\n>**(i) A general mathematical conclusion.**  First of all, we need to clarify that that the composition of a finite number of invertible mappings is still an invertible mapping, but the composition of an infinite number of mappings is not necessarily an invertible mapping. A simple counterexample: we consider that $f(x)=x/2$ is invertible with $x\\in \\mathbb{R}$ and has a unique inverse $f^{-1}(x)=2x$. the composition of an infinite number of $\\lim_{n\\to\\infty} f^n(x) = \\lim_{n\\to\\infty}x/2^n=0$. The infinite composite of this mapping is a constant function that is irreversible. So, in a finite number of composites, there is no contradiction between contraction mapping and reversibility. \n\n>**(ii) Consideration on mapping structure.**  According to **lines 166-168**, we apply $\\varphi_{K}(\\cdot)=f_{K}\\circ f_{K-1}\\circ \\cdots f_{1}(\\cdot)$ to simulate a finite number of iterations of $f$, rather than directly iterating $f$, where each $f_{k}$ has its own parameters $\\theta_{k}$ and Lipschitz constant $\\eta_{k}$. Lipschitz constant $\\eta_{\\varphi}\\le \\eta_{1}\\cdot \\eta_{2}\\cdots \\eta_{K}<1$ ensures contracting anomalies towards the normal distribution.  We leverage $\\mathcal{L}_{\\text{rec}}=||\\varphi _ {K}(\\mathbf{x})-\\mathbf{x}|| _ {2}$ to train the entire network $\\varphi _ {K}$, rather than firstly training a single $f$ and then iterating it a few times. From an optimization perspective, $\\varphi _ {K}$ optimized by $\\mathcal{L} _ {\\text{rec}}$ tends to restore normal input to normal output instead of contracting all inputs (normal and abnormal) to one fixed point. From an mathematical perspective, a finite and small $K$ value gives $\\varphi _ {K}$ the ability to contract the input to the normal manifold, but does not destroy the reversibility of $\\varphi _ {K}$ .  In summary,  selecting $K$ as a finite value, the contraction properties of $\\varphi _ {K}$ and the training objective jointly ensure that it can map anomalies to normal manifolds, but it will not completely shrink to a very small region or even a point and destroy its reversibility. \n\n>**(iii) Consideration on the number of mapping layer.**  In actual experiments, we intentionally keep $K$ and $R$ small to prevent over-contraction. This allows us to benefit from the \"pull\" of the contraction towards the normal manifold (which increases reconstruction error for anomalies) while does not destory the reversibility of our INN. The trade-off is managed by the choice of $K$ and $R$, which we study empirically in Table 5 (main manuscript). The results show that a moderate number of iterations yields the best performance (corresponding reasons also are provided in **lines 299-309**), validating our handling of this trade-off.\n\n***Q2. The risk of collapsing to the identity mapping. (Question 2)***\n\n>The degradation towards identity mapping is a critical concern for contraction mapping trained with reconstruction loss. We show two explicit mechanisms to prevent this as follow, where one is the structure of contraction mapping unit and the other is regularity of our backward density estimation.\n\n>**(i)** According to **Eq.(2) and lines 197-198**, $f(x)=\\left(\\frac{\\text{Id} + \\text{G}}{2}\\right)^{-1}(x) - x$, where $\\text{G}$ is invertible and $\\text{Id}$ is identity mapping. If $f$ degrades into an identity mapping under reconstruction loss, we have $\\left(\\frac{\\text{Id} + \\text{G}}{2}\\right)^{-1}(x) - x = x$, which means $\\left(\\frac{\\text{Id} + \\text{G}}{2}\\right)^{-1}(x) = 2x$. Based on definition of inverse mapping, we must have $\\frac{\\text{Id} + \\text{G}}{2}(2x) = x$.  This means $\\text{Id}(2x) + \\text{G}(2x) = 2x$. Then, we can get $\\text{G}(2x) = 0$ to make $f(x)$ an identity mapping. Paradoxically, $\\text{G}$ is invertible and one-to-one mapping. Therefore, in terms of the structure of $f$, it is difficult to degrade into an identity mapping under the optimization of reconstruction loss.\n\n>**(ii)** The backward density estimation loss $\\mathcal{L}_{\\text{MLE}}$ provides a powerful regularizer against identity collapse. In the backward process, $\\mathcal{L} _ {\\text{MLE}}$ pushes $\\varphi^{-1}$ to be a mapping that transforms a basic Gaussian distribution $\\pi(\\mathrm{z})$ to the (typically complex) input distribution $p(\\mathrm{x})$. An identity mapping could only achieve this if $p(\\mathrm{x})$ is also a Gaussian distribution, which is never the case. This forces $\\varphi^{-1}$ to learn a non-trivial, meaningful transformation.\n\n***Q3. The conflicting objectives of reconstruction and density estimation. (Question 3)***\n\n>Your understanding is perfectly correct. $\\mathcal{L}_ {\\text{rec}}$ pushes $\\mathrm{z}$ to be close to $\\mathrm{x}$, while $\\mathcal{L}_ {\\text{MLE}}$ pushes the distribution of $\\mathrm{z}$ to be a Gaussian distribution. What we need to clarify is that both forward reconstruction (RE) and backward density estimation (DE) are indispensable, although they may seem contradictory. We have also designed corresponding trade-off schemes in the manuscript.\n\n>**(i) The motivation of integration of DE and RE.** When only using RE, if some anomalies are very close to the normal manifold or obtained fixed point in terms of spatial position, which causes small reconstruction errors and false negatives. In addition, the distribution of normal data may be very complex, chaotic, and disconnected (see **Fig 3&4**). In this case, fixed points may fall on the edges of the distribution, or even in areas without data. In this case, reconstruction error cannot be used as a good criterion. To address these issues, we introduce a density estimation process to probabilistically identify anomalies under these special circumstances. DE would assign a high likelihood to points on areas with dense data points and a low likelihood to others with low density. An anomaly is thus an input that is both far from its reconstruction (high reconstruction score) and statistically unlikely to have high likelihood (low density estimation score). This synergy makes our method robust.\n\n>**(ii) Our trade-off strategies.** As shown in **Fig.2 and lines 224-226**, after forward reconstruction process (RE), we apply a stop-gradient operation $\\text{sg}(\\cdot)$ in learning of Gaussian distribution $\\pi(\\mathrm{z})$, which allows $\\pi(\\mathrm{z})$ to be learned independently without affecting the reconstruction training.  In addition, the hyperparameter $\\lambda$ in our total loss $\\mathcal{L}_ \\text{total} = \\mathcal{L}_ \\text{rec} + \\lambda\\mathcal{L}_ \\text{MLE}$ (Eq.(7)) explicitly controls this trade-off. Our sensitivity analysis on $\\lambda$ in **Table 3 (Appendix,Section D)** shows that a balanced value ($\\lambda=0.5$) performs best, validating that the two objectives are complementary rather than purely conflicting. The reconstruction provides an error-based score, while the flow provides a likelihood-based score, and their combination is more powerful than either alone.\n\n***Q4. Regarding the shallow depth of the flow network. (Question 4)***\n\n>Your understanding is correct. In fact, our goal is not to build a superior flow model compared to previous density-estimation-only methods and flow-based generative model, which would indeed require a much deeper architecture. According to our answer in **Q3.(i)**, our reconstruction-only method may may encounter some challenges caused by the spatial distribution of data. Therefore, the purpose of the flow component in our framework is precisely to act as an effective complementary scoring mechanism.\n\n>**(i)** The core of our method actually lies in the reconstruction part. A too large $R$ and $K$ will increase the network capacity, making reconstruction training difficult and requiring more training inference costs.\n\n>**(ii)** For fair comparision with previous tabular AD method, MCM [46], the value of $K \\cdot R$ are roughly equivalent to the number of network layers of MCM (around six layers). In addition, visual AD method, CFlow [16], adopts the flow structure of 8 layers, while we set $K \\cdot R = 9$ on MVTec AD dataset, which can actually meet the accuracy of visual anomaly detection.\n\n***Q5. A minor issue of L2 norm notation. (Weakness 2)***\n\n>We thank the reviewer for their careful reading. We agree and will correct the notation $||\\cdot||$ to $||\\cdot||_{2}$ in line 183 and ensure consistency throughout the revised manuscript."}, {"review_id": "MnUjQXNuCw", "reviewer": "Reviewer_Cw95", "summary": "This paper introduces an anomaly detection framework for one-class classification that combines reconstruction and density estimation through an invertible contraction mapping. The authors propose a reconstruction process where all inputs are iteratively mapped to a fixed point within the normal data manifold. This makes it so abnormal inputs yield high reconstruction errors. Additionally, the invertibility of the CM enables flow-based density estimation by learning a prior distribution over normal reconstructions and computing input likelihoods via the inverse mapping. By integrating both reconstruction-based and likelihood-based scoring, the method achieves strong performance across tabular and image datasets. Experiments and ablations demonstrate the value of both components in improving detection accuracy.", "questions": "While the theoretical analysis shows convergence of inputs toward fixed points within the normal manifold, it would be helpful to include a discussion of how this property behaves on real data, especially when dealing with ambiguous or near-boundary anomalies. Could this contraction mapping project mild anomalies too close to the manifold and reduce separability as a result?", "limitations": "The authors briefly acknowledge the limitation to tabular and image data, but the societal impact discussion is overly generic. It would strengthen the paper to include concrete considerations around false positives in safety-critical domains and the risk of over-relying on reconstruction-based signals in real-world deployments.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n- The application of contraction mappings to enforce convergence of abnormal samples toward a fixed point on the normal manifold is theoretically grounded. The paper includes clear propositions and quantifies how reconstruction errors grow for anomalies.\n\n- The proposed method merges two dominant OCC paradigms using a single CM-based architecture. This dual use of forward for reconstruction and reverse for flow-based likelihood estimation is efficient and clean.\n\n- The approach outperforms state-of-the-art methods on tabular datasets (+3.78 AP and +0.75 AUROC vs MCM) and improves image-level and pixel-level AUROC on CIFAR-10 and MVTec AD.\n\n- The authors conduct clear component ablations (reconstruction only, density only, full) and show sensitivity to hyperparameters to identify over-contraction issues when the product is too large.\n\nWeaknesses:\n\n- While the paper presents proofs around convergence of contraction mappings (e.g., fixed points within a normal manifold), it assumes the mapping generalises beyond the training data. There is no empirical validation of the fixed-point behavior on hard real-world anomalies.\n\n- Iteratively mapping all inputs, including anomalies, toward a normal manifold may suppress outlier signals rather than enhance them. While this increases reconstruction error superficially, could it not also degrade interpretability or confuse downstream use cases? There should be a discussion on whether the model distinguishes subtle anomalies versus simply \"normalising\" everything.\n\n- The CIFAR-10 experiments use a one-vs-all setting, which favours semantic class separation rather than true anomaly detection and does not reflect real-world conditions with subtle in-class deviations. While MVTec AD is a more appropriate benchmark, relying on a single real-world dataset limits the generality of the conclusions.", "was_revised": true, "final_justification": "The paper provides an interesting contribution to the field and the authors have addressed many of my and other reviewers' concerns so I recommend an accept.", "rebuttal": "***Q1. Empirical validation of fixed-point behavior on hard, real-world anomalies. (Weakness 1 and Question 1)***\n\n>Thank you for your professional comments and insightful questions. The normal distribution of real world is irregular and complex, and we have also found these phenomena in experiments on tabular and image data. Although our Proposition 1 theoretically shows that fixed points will approach the normal manifold with optimization of reconstruction loss, real-world situations are even more complex. Following your comments, we discuss our reconstruction-only part on several specific situations and show corresponding empirical validation. In some simple cases, the reconstruction part is very effective, but in some complex or even extreme cases, the reconstruction part may fail.\n\n>**(i) Simple and general situations.** In actual experiments, we found that common normal manifolds are often connected and do not appear as ring-shaped or multi-ringed structures (see **Fig. 3(a)**). Under optimizatin of reconstruction loss, the fixed point is not completely located at the geometric center of the distribution, and sometimes , fixed points may even fall on the edges of the distribution. It is worth noting that in this simple case, the fixed points will all fall inside the normal manifold. Anomalies will are contracted towards the normal manifold, leading to more reconstruction error. In addition, some data manifolds are U-shaped (see **Fig. 3(d)**), the fixed point is located at the bottom of U. We found that after adjusting the random seed or training hyperparameters, the position of the fixed point will change and may not necessarily be located at the bottom position. But the same thing is that as long as enough training epochs are set, the fixed point is located inside or at the edge of U.\n\n>**(ii) Difficult and failure situations.** The normal data manifold in the real world is stochastic and complex, which may be non-connected (see **Fig. 4 (left)**), ring-shaped, or even multi-ring-shaped. In these complex cases, there is a high probability that the fixed point will be optimized to the non-data region and outside the manifold, and the fixed point may be very close to the abnormal data, resulting in false negative. In addition, if some abnormal data is very close to the normal manifold, almost all reconstruction-based methods will fail. To address these issues on reconstruction part, we introduce backward density estimation part to  learn probability distribution of original normal data. Even if the anomaly is close to normal in space, its likelihood may be much lower than that of normal data.\n\n***Q2. Whether the mapping suppresses or enhances outlier signals. (Weakness 2)***\n\n>This is a very insightful observation. You are correct that our mapping 'normalizes' the abnormal features in the output space. However, this feature suppression is precisely the mechanism we leverage to amplify the anomaly signal in the form of reconstruction error. Next, we will show detailed reasons.\n\n>The key is that our reconstruction anomaly score is not the output $\\mathbf{z}=\\varphi(\\mathbf{x})$ itself, but the discrepancy between the input and output, i.e., $||\\mathbf{z}-\\mathbf{x}||_{2}$. For a normal input $\\mathbf{x}_n$, the contraction mapping acts nearly as an identity function, so $\\mathbf{z}_n ≈ \\mathbf{x}_n$ and the reconstruction error is minimal (see **lines 190-193**). For an abnormal input $\\mathbf{x}_a$, the mapping pulls it towards the normal manifold, so $\\mathbf{z}_a$ becomes significantly different from $\\mathbf{x}_a$. This results in a large reconstruction error. Therefore, by suppressing the anomalous characteristics in the output $\\mathbf{z}_a$, we create a large, easily detectable discrepancy signal. This enhances, rather than suppresses, the final anomaly score.\n\n***Q3. Limitations of the experimental datasets. (Weakness 3)***\n\n>Thanks for your professional comments and valuable suggestions.\n\n>First of all, it should be noted that that we follow the initial works, DeepSVDD [1], and choose the one-vs-all setting for CIFAR-10 that is the classic setting in the OCC task. Using this established benchmark allows for direct and fair comparison against a wide range of state-of-the-art methods, which is essential for positioning our work. Next, we recognize the limitations of MVTec AD. Following your suggestions, we test our method on an extra non-toy industrial dataset, MPDD [2], with significant intra-class differences and a real-world medical datasets, ISIC [3].\n\n>**(i) MPDD.**  MPDD contains 1,346 images from 6 types of industrial metal products with varying lighting conditions, non-uniform backgrounds, and multiple products in each image. We continue to adopt the model and training settings (visual anomaly detection) in the manuscript for this experiment, where only resolution is adjusted to $256\\times 256$. As shown in table below, compared to some classic methods, the performance of our method is competitive.\n\n\n|  | image-level AUROC | Pixel-level AUROC |Mean|\n| --- | --- | --- |  ---|\n| PaDim | 74.8 | 96.7 | 85.7 |\n| PatchCore | 82.1 | 95.7 | 88.9 |\n| CFlow | 86.1 | **97.7** | 91.9 |\n| Ours | **90.2** | 97.4 | **93.8** |\n\n>**(ii) ISIC.** ISIC is a real-word skin lesion dataset, originating from the ISIC 2018 challenge, contains dermoscopic images across seven categories. We employs 6,705 normal images from the official training set for model training and the remaining images, including normal and abnormal ones, for testing, where only classification label can be given and image-level AUROC,F1,ACC are envaluated.  We continue to adopt the same model and training settings as **(i)**. As a real-world dataset, defects are more diverse, and all models that perform well on the toy dataset perform poorly on this dataset. However, our method is superior compared to some classic methods.\n\n\n|  | AUROC | F1 | ACC |\n| --- | --- | --- | --- | \n| PatchCore | 68.09 | 61.98 | 59.26 |\n| FastFlow | 67.27 | 63.46 | 57.34 |\n| CFlow | 66.97 | 60.81 | 57.80 |\n| RD4AD | 76.48 | **67.94** | 67.72 |\n| SimpleNet | 69.01 | 60.66 | 56.99 |\n| Ours | **78.51** | 67.08 | **72.17** |\n\n>Finally, it should be noted that due to the limitation of rebuttal time, we did not fine tune more parameters to achieve optimal performance on two new datasets. In addition, the results on MPDD are sourced from [4], and the results on ISIC are sourced from [5].\n\n>[1] Lukas Ruff, et al. Deep one-class classification. In ICML, 2018.\n\n>[2] Stepan Jezek, et al. Deep learning-based defect detection of\nmetal parts: evaluating current methods in complex conditions. In ICUMT workshop, 2021.\n\n>[3] Gutman David, et al. \"Skin Lesion Analysis toward Melanoma Detection: A Challenge at ISBI 2016. In ISIC, 2016.\n\n>[4] Ximiao Zhang, et al. Realnet: A feature selection network with realistic synthetic anomaly for anomaly detection. In CVPR, 2024.\n\n>[5] Chunlei Li, et al. Scale-Aware Contrastive Reverse Distillation for Unsupervised Medical Anomaly Detection. In arXiv, 2025.\n\n***Q4. Limitations and societal impact discussion. (Limitations)***\n\n>Thank you for this valuable suggestion. We also agree that a more concrete discussion of societal impact and practical risks is warranted. In fact, in our used tabular data, 'Arrhythmia' and 'Fraud' datasets are from real medical diagnostic data, where false positives may lead to some negative societal impact. Following your suggestions, we will expand the Limitations section (Appendix E) in the final version. We will add a discussion on the real-world consequences of detection errors (false positives/negatives) in safety-critical domains reflected in our datasets, such as medical misdiagnosis ('Arrhythmia') or failed fraud detection ('Fraud'). We will also connect this back to our method's design, arguing that our unified framework, which combines reconstruction with density estimation, provides a more robust signal than methods relying on a single paradigm, thereby potentially mitigating some of these risks in real-world deployments."}]

Author rebuttal:

Meta-review: The paper proposes a new framework for one-class classification by introducing invertible contraction mappings to unify reconstruction and density estimation. The authors effectively addressed reviewers' concerns regarding theoretical depth, validation, and clarity, with rebuttals supported by additional experiments and analysis. While one reviewer maintained a borderline reject, this reviewer did not provide any specific reasons after reading the author response. Therefore, I recommend accepting the paper.
Decision: Accept (poster)