Original: Normality-Calibrated Autoencoder for Unsupervised Anomaly Detection on Data Contamination
Revised: Normality-Calibrated Autoencoder for Unsupervised Anomaly Detection on Data Contamination

Original: AfﬁliationAddress

Original: Abstract
Revised: Abstract

Original: In this paper, we propose Normality-Calibrated Autoencoder (NCAE), whichcan boost anomaly detection performance on the contaminated datasets without any prior information or explicit abnormal samples in the training phase.
Revised: In this paper, we propose Normality-Calibrated Autoencoder (NCAE), which can boost anomaly detection performance on the contaminated datasets without any prior information or explicit abnormal samples in the training phase.

Original: The NCAE adversarially generates high conﬁdent normal samples from a latent space having low entropy and leverages them to predict abnormal samplesin a training dataset.
Revised: The NCAE adversarially generates high confident normal samples from a latent space having low entropy and leverages them to predict abnormal samples in a training dataset.

Original: NCAE is trained to minimise reconstruction errors in uncontaminated samples and maximise reconstruction errors in contaminated samples.
Revised: NCAE is trained to minimise reconstruction errors in uncontaminated samples and maximise reconstruction errors in contaminated samples.

Original: The experimental results demonstrate that our method outperforms shallow, hybrid, and deep methods for unsupervised anomaly detection and achievescomparable performance compared with semi-supervised methods using labelledanomaly samples in the training phase.
Revised: The experimental results demonstrate that our method outperforms shallow, hybrid, and deep methods for unsupervised anomaly detection and achieves comparable performance compared with semi-supervised methods using labelled anomaly samples in the training phase.

Original: The source code is publicly available onhttps://github.com/nonamescientist/NCAE_UAD.git .
Revised: The source code is publicly available on https://github.com/andreYoo/ NCAE_UAD.git .

Original:  Introduction
Revised:  Introduction

Original: Most of anomaly detection (AD) methods [Erfani et al., 2016, Zhai et al., 2016, Chen et al., 2017,
Revised: Most of anomaly detection (AD) methods [Erfani et al., 2016, Zhai et al., 2016, Chen et al., 2017,

Original: Ruff et al., 2018, Deecke et al., 2018, Ruff et al., 2019b, Golan and El-Yaniv, 2018, Pang et al.
Revised: Ruff et al., 2018, Deecke et al., 2018, Ruff et al., 2019b, Golan and El-Yaniv, 2018, Pang et al., 2019, Hendrycks et al., 2019a,b

Original: ,2019, Hendrycks et al., 2019a,b, Zong et al., 2018] assume that the training dataset only consists ofnormal samples; however, datasets in real-world are easily contaminated , which means that datasetscontains both normal and abnormal samples.
Revised: Zong et al., 2018] assume that the training dataset only consists of normal samples; however, datasets in real-world are easily contaminated , which means that datasets contains both normal and abnormal samples.

Original: The contaminated samples signiﬁcantly degrade the
Revised: The contaminated samples significantly degrade the

Original: AD performance of models derived based on the assumption.
Revised: AD performance of models derived based on the assumption.

Original: Various methods have been proposed [Ruff et al., 2019a, Song et al., 2017, Akcay et al., 2018,
Revised: Various methods have been proposed [Ruff et al., 2019a, Song et al., 2017, Akcay et al., 2018,

Original: Chalapathy and Chawla, 2019, Zong et al., 2018] to improve the robustness of AD methods oncontaminated datasets.
Revised: Chalapathy and Chawla, 2019, Zong et al., 2018] to improve the robustness of AD methods on contaminated datasets.

Original: Particularly, ﬁltering contaminated samples based on contamination ratio[Zong

Original:  et al., 2018, Ruff et al., 2019a], semi-supervised learning approaches that uses explicit abnormalsamples in the training step [Wang et al., 2005, Liu and Zheng, 2006, Görnitz et al., 2013, Ruff et al. ,2019a], and contamination sample prediction approaches based on geometric distance measurement[Berg et al., 2019, Li et al., 2021, Lai et al., 2020], have been proposed.
Revised: Particularly, filtering contaminated samples based on contamination ratio [Zong et al., 2018, Ruff et al., 2019a], semi-supervised learning approaches that uses explicit abnormal samples in the training step [Wang et al., 2005, Liu and Zheng, 2006, Görnitz et al., 2013, Ruff et al., 2019a], and contamination sample prediction approaches based on geometric distance measurement [Berg et al., 2019, Li et al., 2021, Lai et al., 2020], have been proposed.

Original: However, the aforementionedapproaches are domain or data-type speciﬁc.
Revised: However, the aforementioned approaches are domain or data-type specific.

Original: Additionally, those methods assume that abnormalsamples are likely to be located far from the distribution of normal samples, and the entropy ofabnormal samples is higher than that of normal samples [Berg et al., 2019, Li et al., 2021, Laiet al., 2020].
Revised: Additionally, those methods assume that abnormal samples are likely to be located far from the distribution of normal samples, and the entropy of abnormal samples is higher than that of normal samples [Berg et al., 2019, Li et al., 2021, Lai et al., 2020].

Original: Unfortunately, as shown in Figure 1, if a training dataset is highly contaminated, thecontaminated samples can also form a low entropy space by themselves.
Revised: Unfortunately, as shown in Figure 1, if a training dataset is highly contaminated, the contaminated samples can also form a low entropy space by themselves.

Original: In this paper, we present Normality-Calibrated Autoencoder (NCAE), which is robust to the trainingdataset contamination.
Revised: In this paper, we present Normality-Calibrated Autoencoder (NCAE), which is robust to the training dataset contamination.

Original: Our key idea on the NCAE is to adversarially generate high conﬁdent normalsamples from a low entropy feature space and then to contrastively compare the generated sampleswith the input samples for estimating contamination score. After identifying the contaminatedsamples, NCAE is trained to maximise reconstruction error of the found sample.
Revised: Our key idea on the NCAE is to adversarially generate high confident normal

Original: Low
Revised: Low

Original: Medium
Revised: Medium

Original: High Entropy    

Revised: High Entropy

Original: Low
Revised: Low

Original: Medium
Revised: Medium

Original: High (a)
Revised: High (a)

Original: No contamination    

Revised: No contamination

Original: Low
Revised: Low

Original: Medium
Revised: Medium

Original: High (b) 1%    

Revised: High (b) 1%

Original: Low
Revised: Low

Original: Medium
Revised: Medium

Original: High (c) 5%    

Revised: High (c) 5%

Original: Low
Revised: Low

Original: Medium
Revised: Medium

Original: High (d) 10%    

Revised: High (d) 10%

Original: Low
Revised: Low

Original: Medium
Revised: Medium

Original: High (e) 20% 
Revised: High (e) 20% samples from a low entropy feature space and then to contrastively compare the generated samples with the input samples for estimating contamination score. After identifying the contaminated samples, NCAE is trained to maximise reconstruction error of the found sample.

Original:  Normality-Calibrated Autoencoder2.1 Learning normality-calibrated autoencoder
Revised:  Normality-Calibrated Autoencoder 2.1 Learning normality-calibrated autoencoder

Original: For n number of input samples with D dimensions X = { x i } i =1: n , x ∈ R D and the correspondinglatent features with d dimensions Z = { z i } i =1: n , z ∈ R d , let an autoencoder is composed of anencoder f ( x ) : x −→ z and a decoder g ( x ) :
Revised: For n number of input samples with D dimensions X = { x i } i =1: n , x ∈ R D and the corresponding latent features with d dimensions Z = { z i } i =1: n , z ∈ R d , let an autoencoder is composed of an encoder f ( x ) : x −→ z and a decoder g ( x ) :

Original: z −→ ¯ x .
Revised: z −→ ¯ x .

Original: The general objective of the autoencoder istraining f and g to minimise an error between input samples x and the reconstruction results ¯ x , asfollows:
Revised: The general objective of the autoencoder is training f and g to minimise an error between input samples x and the reconstruction results ¯ x , as follows:

Original: [Equation]
Revised: [Equation]

Original: ) where p X denotes the entire input samples.
Revised: where p X denotes the entire input samples.

Original: However, an autoencoder is known to have an overconﬁdence issue, i.e., low reconstruction error of unseen samples.
Revised: However, an autoencoder is known to have an overconfidence issue, i.e., low reconstruction error of unseen samples.

Original: AD methods using the autoencoderusually identify abnormal samples using the reconstruction error.
Revised: AD methods using the autoencoder usually identify abnormal samples using the reconstruction error.

Original: Therefore, even if the autoencodertakes anomaly samples as inputs, it may not distinguish whether the samples are abnormal or not[Pidhorskyi et al., 2018, Yu et al., 2021].
Revised: Therefore, even if the autoencoder takes anomaly samples as inputs, it may not distinguish whether the samples are abnormal or not [Pidhorskyi et al., 2018, Yu et al., 2021].

Original: This over-conﬁdence issue would be more deepened when atraining dataset is contaminated.
Revised: This over-confidence issue would be more deepened when a training dataset is contaminated.

Original: One straightforward approach to prevent this issue is adding an extra term to maximise reconstructionerror for contaminated samples.
Revised: One straightforward approach to prevent this issue is adding an extra term to maximise reconstruction error for contaminated samples.

Original: We deﬁne normality-calibrated reconstruction (NCR) loss as follows:
Revised: We define normality-calibrated reconstruction (NCR) loss as follows:

Original: [Equation]
Revised: [Equation]

Original: where p X N and p X C denote the normal samples and contaminated samples, respectively, among inputsamples p X .
Revised: where p X N and p X C denote the normal samples and contaminated samples, respectively, among input samples p X .

Original: Now, we should ﬁnd out which samples are contaminated to optimise autoencoder using Eq. 2 properly.
Revised: Now, we should find out which samples are contaminated to optimise autoencoder using (2) properly.

Original: 2.2 high-conﬁdence normal samples generation using Generative Adversarial Network
Revised: 2.2 high-confidence normal samples generation using Generative Adversarial Network

Original: We ﬁnd contaminated samples by using high conﬁdent normal samples generated from low entropylatent space.
Revised: We find contaminated samples by using high confident normal samples generated from low entropy latent space.

Original: We apply the generative adversarial network (GAN) Goodfellow et al.
Revised: We apply the generative adversarial network (GAN) Goodfellow et al.

Original: [2014] frameworkto do this.
Revised: [2014] framework to do this.

Original: The high-conﬁdence normal sample generation via the GAN framework is carried out asfollows.
Revised: The high-confidence normal sample generation via the GAN framework is carried out as follows.

Original: Initially, we transform a distribution of all latent features, which are encoded from inputsamples through the encoder f , to a more knowledgeable probabilistic distribution such as Gaussiandistribution.
Revised: Initially, we transform a distribution of all latent features, which are encoded from input samples through the encoder f , to a more knowledgeable probabilistic distribution such as Gaussian distribution.

Original: And then, we generate samples using noise signals sampled from the centre of theknowledgeable distribution, i.e., the low entropy space.
Revised: And then, we generate samples using noise signals sampled from the centre of the knowledgeable distribution, i.e., the low entropy space.

Original: An adversarial loss for transforming a latentfeature distribution to a more knowledgeable probabilistic distribution is deﬁned by follow: 
Revised: An adversarial loss for transforming a latent feature distribution to a more knowledgeable probabilistic distribution is defined by follow: [Equation] ( ω [Equation]

Revised: ] +

Original: [Equation]
Revised: [Equation]

Revised: x

Revised: [Equation]

Revised: P X

Revised: [Equation]

Original:  where D l denotes the discriminator for latent features, and N ( µ Z , I d ) deﬁnes a normal distributionwith the mean of latent features µ Z ∈ R d and a covariance matrix deﬁned by an identity matrix
Revised: log [Equation] [Equation] where D l denotes the discriminator for latent features, and N ( µ Z , I d ) defines a Gaussian distribution with the mean of latent features µ Z ∈ R d and a covariance matrix defined by an identity matrix

Original: I d ∈ R d × d .
Revised: I d ∈ R d × d .

Original: µ Z is initialised by the mean value of latent features: µ Z = 1 n (cid:80) ni
Revised: µ Z is initialised by the mean value of latent features: µ Z = 1 n (cid:80) ni

Original: =

Revised: =

Original: z i .
Revised: z i .

Original: We would want each component of z to be maximally informative such as each of them to be an independent randomvariable.
Revised: We would want each component of z to be maximally informative such as each of them to be an independent random variable.

Original: Therefore, the covariance matrix is determined by the d × d identity matrix.
Revised: Therefore, the covariance matrix is determined by the d × d identity matrix.

Original: Since as f and D l are being updated, µ Z would be shifted during the training step.
Revised: Since as f and D l are being updated, µ Z would be shifted during the training step.

Original: µ Z is updated atevery training step as follows:
Revised: µ Z is updated at every training step as follows:

Original: [Equation]
Revised: [Equation]

Original: where µ t +1 Z and µ t Z denote the µ Z on t + 1 -th and t -th training step, respectively.
Revised: where µ t +1 Z and µ t Z denote the µ Z on t + 1 -th and t -th training step, respectively.

Original: m is the batch sizeand z i is i -th latent features on the batch.
Revised: m is the batch size and z i is i -th latent features on the batch.

Original: γ is a learning rate.
Revised: γ is a learning rate.

Original: To generate high conﬁdent normal samples, we formulate the following adversarial loss:
Revised: To generate high confident normal samples, we formulate the following adversarial loss:

Original: [Equation]
Revised: [Equation]

Original: [Equation] where D s denotes the discriminator for samples, and N ( µ Z , σI d ) is a d -dimensional normal distribution with the mean µ Z ∈ R d and the covariance matrix σI d ∈ R d × d .
Revised: where D s denotes the discriminator for samples, and N ( µ Z , σI d ) is a d -dimensional Gaussian distribution with the mean µ Z ∈ R d and the covariance matrix σI d ∈ R d × d .

Original: µ Z is equivalent to the µ Z in Eq. 3.
Revised: µ Z is equivalent to the µ Z in (3).

Original: σI d is deﬁned by multiplication of a scalar value σ ∈ [0 , 1] and the identity matrix I d .
Revised: σI d is defined by multiplication of a scalar value σ ∈ [0 , 1] and the identity matrix I d .

Original: σ is ahyperparameter to control the compactness of random noise for generating samples using the decoderg .
Revised: σ is a hyperparameter to control the compactness of random noise for generating samples using the decoder g .

Original: The smaller σ can give more strong likely to generate high conﬁdent normal samples.
Revised: The smaller σ can give more chances to generate high confident normal samples by generating a feature close to the centre of the probability distribution.

Original: 2.3 Contaminated sample mining and joint learning
Revised: 2.3 Contaminated sample mining and joint learning

Original: To predict contaminated samples, we use the generated high conﬁdent normal samples as a dictionary.
Revised: To predict contaminated samples, we use the generated high confident normal samples as a dictionary.

Original: With the generation process for high conﬁdent normal samples: g (´ ω ) =
Revised: With the generation process for high confident normal samples: g (´ ω ) =

Original: ´ x , we construct a latentfeature dictionary M =
Revised: ´ x , we construct a latent feature dictionary M =

Original: [´ z i ] i =1: m , ´ z i = f
Revised: [´ z i ] i =1: m , ´ z i = f

Original: (´ x i ) and M ∈ R m × d , where m is the batch size.
Revised: (´ x i ) and M ∈ R m × d , where m is the batch size.

Original: Byleveraging M and given each training batch { x i } i =1: m , we deﬁne a pseudo contamination score c iof each input sample x i as follow:
Revised: By leveraging M and given each training batch { x i } i =1: m , we define a pseudo contamination score c i of each input sample x i as follow:

Original: [Equation]
Revised: [Equation]

Original: where T denotes the transpose of the vector.
Revised: where T denotes the transpose of the vector.

Original: We apply l 2 -normalisation to improve robustness on thevariation of the vector scale of the operation.
Revised: We apply l 2 -normalisation to improve robustness on the variation of the vector scale of the operation.

Original: We predict the contaminated samples by sorting the score in descending order and picking topτ % samples among the sorted results as the contaminated samples; thus, the number of predictedcontaminated samples are decided by τm that is a multiplication of τ and the batch size m .
Revised: We predict the contaminated samples by sorting the score in descending order and picking topτ % samples among the sorted results as the contaminated samples; thus, the number of predicted contaminated samples are decided by τm that is a multiplication of τ and the batch size m .

Original: Theabove process is represented as follow:
Revised: The above process is represented as follow:

Original: [Equation]
Revised: [Equation]

Original: where C is a set of the sorted indices of input batch samples in descending order of the contaminationscore (Eq. 6), and X C is a set of predicted contaminated samples.
Revised: where C is a set of the sorted indices of input batch samples in descending order of the contamination score ((6)), and X C is a set of predicted contaminated samples.

Original: (cid:100)·(cid:101) denotes the ceiling function.τ effects of deciding the number of predicted contaminated samples, so it directly affects the ADperformance of our method.
Revised: ⌈·⌉ denotes the ceiling function. τ effects of deciding the number of predicted contaminated samples, so it directly affects the AD performance of our method.

Original: The objective function for joint learning the entire components on our method is as follows:
Revised: The objective function for joint learning the entire components on our method is as follows:

Original: [Equation]
Revised: [Equation]

Original: where ¯ x (cid:48) is deﬁned by the nearest sample from the given contaminated samples among the generatedhigh conﬁdent normal samples g ( N ( µ Z ,σI d )) on the latent feature space.
Revised: where ¯ x ′ is defined by the nearest sample from the given contaminated samples among the generated high confident normal samples g ( N ( µ Z ,σI d )) on the latent feature space.

Original: (a), (b), and (c) denote the
Revised: (a), (b), and (c) denote the

Original: NCR loss and the two adversarial losses, respectively.
Revised: NCR loss and the two adversarial losses, respectively.

Original: [Figure]
Revised: [Figure]

Original:  Experiments 
Revised:  Experiments 3.1 Experiment setting and Dataset

Original: [Figure] 3.1 Experiment setting and Dataset [Figure]

Original: We follow the unsupervised AD protocol described by Ruff et al.
Revised: We follow the unsupervised AD protocol described by Ruff et al.

Original: [Ruff et al., 2019a].
Revised: [Ruff et al., 2019a].

Original: MNIST and
Revised: MNIST and

Original: Fashion-MNIST datasets are used for the experiments.
Revised: Fashion-MNIST datasets are used for the experiments.

Original: We set one of the classes provided by a datasetas normal and others as abnormal.
Revised: We set one of the classes provided by a dataset as normal and others as abnormal.

Original: After we decide contamination ration ρ = AN + A , where N and Aare the numbers of normal and abnormal samples, respectively, we pick normal samples from thechosen class and contaminated samples from the remaining classes.
Revised: After we decide contamination ration ρ = AN + A , where N and A are the numbers of normal and abnormal samples, respectively, we pick normal samples from the chosen class and contaminated samples from the remaining classes.

Original: In the test phase, the samples ofthe normal class are labelled by 0, and other samples are labelled by 1.
Revised: In the test phase, the samples of the normal class are labelled by 0, and other samples are labelled by 1.

Original: For the performance analysis,
Revised: For the performance analysis,

Original: Receiver Operating Characteristic (ROC) curve and Area Under the Curve (AUC) are used.
Revised: Receiver Operating Characteristic (ROC) curve and Area Under the Curve (AUC) are used.

Original: We employ LeNet-type convolutional neural networks (CNNs) on MNIST and Fashion-MNISTdatasets, where each convolutional module consists of a convolutional layer followed by leaky ReLUactivation functions with leakiness of 0.1.
Revised: We employ LeNet-type convolutional neural networks (CNNs) on MNIST and Fashion-MNIST datasets, where each convolutional module consists of a convolutional layer followed by leaky ReLU activation functions with leakiness of 0.1.

Original: We use the Adam optimiser with the recommended defaulthyperparameters [Kingma and Ba, 2015].
Revised: We use the Adam optimiser with the recommended default hyperparameters [Kingma and Ba, 2015].

Original: The batch size is set to 128.
Revised: The batch size is set to 128.

Original: The initial learning rate is 0.01and decayed every 10 epochs by multiplying 0.1.
Revised: The initial learning rate is 0. and decayed every 10 epochs by multiplying 0.1.

Original: σ and τ are decided by 0.1 and 0.1 (based on theresults from the ablation study), respectively.
Revised: σ and τ are decided by 0.1 and 0.1 (based on the results from the ablation study), respectively.

Original: 3.2 Ablation study
Revised: 3.2 Ablation study

Original: We analyse unsupervised AD performance depending on the setting of σ and τ .
Revised: We analyse unsupervised AD performance depending on the setting of σ and τ .

Original: MNIST and
Revised: MNIST and

Original: Fashion-MNIST datasets are used for the ablation study.
Revised: Fashion-MNIST datasets are used for the ablation study.

Original: Ablation studies are conducted based on theexperimental protocol described in the previous section.
Revised: Ablation studies are conducted based on the experimental protocol described in the previous section.

Original: The contamination ratio ρ is ﬁxed to 0.2.
Revised: The contamination ratio ρ is fixed to 0.2.

Original: Parameter analysis on σ : When σ is too small, then the distribution of sample noise for generatingsamples would be too compact so that the generated samples can not provide comprehensive information to cover the diverse patterns of normal samples.
Revised: Parameter analysis on σ : When σ is too small, then the distribution of sample noise for generating samples would be too compact so that the generated samples can not provide comprehensive information to cover the diverse patterns of normal samples.

Original: On the other hand, when σ is too large, thenthere is a possibility that the noise can be sampled from low entropy space ( i.e., abnormal samplesalso can be generated).
Revised: On the other hand, when σ is too large, then there is a possibility that the noise can be sampled from low entropy space ( i.e., abnormal samples also can be generated).

Original: Figure 2(a) shows the AUC trends depending on the σ .
Revised: Figure 2(a) shows the AUC trends depending on the σ .

Original: The AUC increases rapidly in the caseof sigma is less than 0.1, and then decreases gradually.
Revised: The AUC increases rapidly in the case of sigma is less than 0.1, and then decreases gradually.

Original: This can be interpreted as follows.
Revised: This can be interpreted as follows.

Original: If thesampling space is too compact ( i.e., when σ is too small), it means that the generated normal sampledoes not provide enough information to distinguish the contaminated sample.
Revised: If the sampling space is too compact ( i.e., when σ is too small), it means that the generated normal sample does not provide enough information to distinguish the contaminated sample.

Original: When sampling spaceis too broad ( i.e., when σ is too large), it also degrades performance, but the impacts of the braodersampling space are relatively less than that of the smaller sampling space (e.g., when σ ≤ 0 . 1 ).
Revised: When sampling space is too broad ( i.e., when σ is too large), it also degrades performance, but the impacts of the braoder sampling space are relatively less than that of the smaller sampling space (e.g., when σ ≤ 0 . 1 ).

Original: Thebest performance is obtained by σ of 0.1.
Revised: The best performance is obtained by σ of 0.1.

Original: Parameter analysis on τ : τ decides the number of predicted contaminated samples per trainingbatch.
Revised: Parameter analysis on τ : τ decides the number of predicted contaminated samples per training batch.

Original: The lower τ can provide more precise prediction performance but may not enough to providemore comprehensive prediction performance.
Revised: The lower τ can provide more precise prediction performance but may not enough to provide more comprehensive prediction performance.

Original: In contrast, when τ is too large, the predicted resultspossibly more accurate but also may have a lot of false-positive results.
Revised: In contrast, when τ is too large, the predicted results possibly more accurate but also may have a lot of false-positive results.

Original: [Table]
Revised: [Table]

Original: As shown in Figure 2(b), the AUC increases rapidly with τ from 0 to 0.1 and then decreases slowly.
Revised: As shown in Figure 2(b), the AUC increases rapidly with τ from 0 to 0.1 and then decreases slowly.

Original: The results can be interpreted as follows.
Revised: The results can be interpreted as follows.

Original: Finding contaminated samples themselves has a largeimpact on the AD performance, but the quantity of found samples affects less to AD performance.
Revised: Finding contaminated samples themselves has a large impact on the AD performance, but the quantity of found samples affects less to AD performance.

Original: But, predicting too many samples may degrade AD performance by taking a great number of falsepositives.
Revised: But, predicting too many samples may degrade AD performance by taking a great number of false positives.

Original: The best performance is obtained by τ of 0.1.
Revised: The best performance is obtained by τ of 0.1.

Original: 3.3 Comparison with other methods
Revised: 3.3 Comparison with other methods

Original: We consider the OC-SVM [Schölkopf et al., 2001] , isolation forest (IF)
Revised: We consider the OC-SVM [Schölkopf et al., 2001] , isolation forest (IF)

Original: [Liu et al., 2008], and KDE[Parzen, 1962] for shallow unsupervised baselines.
Revised: [Liu et al., 2008], and KDE [Parzen, 1962] for shallow unsupervised baselines.

Original: For deep unsupervised competitors, we considergeneral binary classiﬁder (supervised), convolutional autoencoders (CAE), deep support vector datadescription (Deep SVDD)
Revised: For deep unsupervised competitors, we consider general binary classifider (supervised), convolutional autoencoders (CAE), deep support vector data description (Deep SVDD)

Original: [Ruff et al., 2018], semi-supervised anomaly detection (SSAD)
Revised: [Ruff et al., 2018], semi-supervised anomaly detection (SSAD)

Original: [Ruffet al., 2019a], semi-supervised deep generative model (SS-DGM) [Kingma and Ba, 2015], and deepsemi-supervised anomaly detection (Deep SAD)
Revised: [Ruff et al., 2019a], semi-supervised deep generative model (SS-DGM) [Kingma and Ba, 2015], and deep semi-supervised anomaly detection (Deep SAD)

Original: [Ruff et al., 2019a].
Revised: [Ruff et al., 2019a].

Original: We repeat this training setgeneration process 10 times per AD setup over all the nine respective anomaly classes and report theaverage results over the resulting 90 experiments per contamination ratio.
Revised: We repeat this training set generation process 10 times per AD setup over all the nine respective anomaly classes and report the average results over the resulting 90 experiments per contamination ratio.

Original: Table 1 shows the quantitative performance comparison depending on the contamination ratio ρ .
Revised: Table 1 shows the quantitative performance comparison depending on the contamination ratio ρ .

Original: Inthe comparison using the MNIST dataset, the proposed NCAE achieves the best performances exceptwhen the dataset is not contaminated ( ρ = 0 . 0 ).
Revised: In the comparison using the MNIST dataset, the proposed NCAE achieves the best performances except when the dataset is not contaminated ( ρ = 0 . 0 ).

Original: Even compared with semi-supervised approaches[Ruff et al., 2018, 2019a] which use explicit anomaly samples in the training phase, the NCAEshows outstanding performances.
Revised: Even compared with semi-supervised approaches [Ruff et al., 2018, 2019a] which use explicit anomaly samples in the training phase, the NCAE shows outstanding performances.

Original: This trend is also shown in the performance comparison using the
Revised: This trend is also shown in the performance comparison using the

Original: Fashion-MNIST dataset.
Revised: Fashion-MNIST dataset.

Original: The NCAE produces the AUC of 91.57 and 88.97 for the Fashion-MNISTdataset with 0.1 and 0.2 contamination ratios, respectively.
Revised: The NCAE produces the AUC of 91.57 and 88.97 for the Fashion-MNIST dataset with 0.1 and 0.2 contamination ratios, respectively.

Original: Those ﬁgures are the best performanceamong the listed methods when a dataset is contaminated.
Revised: Those figures are the best performance among the listed methods when a dataset is contaminated.

Original: The interpretation of the relatively low performance on the uncontaminated dataset ( ρ = 0 . 0 ) is asfollows.
Revised: The interpretation of the relatively low performance on the uncontaminated dataset ( ρ = 0 . 0 ) is as follows.

Original: Basically, our method is derived under the assumption that a training dataset is contaminated.
Revised: Basically, our method is derived under the assumption that a training dataset is contaminated.

Original: Therefore, even if the dataset is not contaminated, the NCAE tries to ﬁnd some anomaly samples andmaximise the reconstruction errors of the samples during the model training.
Revised: Therefore, even if the dataset is not contaminated, the NCAE tries to find some anomaly samples and maximise the reconstruction errors of the samples during the model training.

Original: This process degradesthe performance of our methods as shown in the experimental results.
Revised: This process degrades the performance of our methods as shown in the experimental results.

Original: This is a critical defect of ourmethod;
Revised: This is a critical defect of our method;

Original: Overall, the comparison results demonstrate the advantage of the proposed NCAE that can detectanomaly samples on data contamination without prior knowledge or explicit abnormal samples in thetraining phase.
Revised: Overall, the comparison results demonstrate the advantage of the proposed NCAE that can detect anomaly samples on data contamination without prior knowledge or explicit abnormal samples in the training phase.

Original:  Conclusion
Revised:  Conclusion

Original: In this work, we have proposed NCAE that is a generative method for fully unsupervised anomalydetection on contaminated data.
Revised: In this work, we have proposed NCAE that is a generative method for fully unsupervised anomaly detection on contaminated data

Original: The experimental results have suggested that the NCAE outperformsexisting methods for fully unsupervised anomaly detection with a large margin, and they have alsoprovided competitive performances compared with semi-supervised methods using explicit abnormalsamples to train their AD model. 
Revised: The experimental results have suggested that the NCAE outperforms existing methods for fully unsupervised anomaly detection with a large margin, and they have also provided competitive performances compared with semi- supervised methods using explicit abnormal samples to train their AD model. Acknowledgement

Revised: This work was supported by Institute of Information & communications Technology Planning &

Revised: Evaluation (IITP) grant funded by the Korea government(Ministry of Science and ICT; MSIT)

Revised: (No.

Revised: 2020-0-00833, A study on 5G based Intelligent IoT Trust Enabler).