Differentiable Interval Bottlenecks for Interpretable Anomaly Detection in Numerical Data

Differentiable Interval Bottlenecks for Interpretable Anomaly Detection in Numerical Data Lamine Diop and Marc Plantevit

arXiv:2609.03878v1 [cs.LG] 3 Sep 2026

EPITA, Laboratoire de Recherche de l’EPITA (LRE) Le Kremlin-Bicêtre, France {lamine.diop, marc.plantevit}@epita.fr

Abstract—Reconstruction-based anomaly detectors are accurate but opaque: a deep autoencoder flags a sample without telling a practitioner which feature ranges made it anomalous. We propose D IFF I NT, an autoencoder whose latent bottleneck is structured as a set of soft, axis-aligned interval memberships learned end-to-end directly from raw numerical data, without any discretization or binarization. Each latent unit corresponds to a human-readable hyper-rectangle in feature space; an instance is encoded by how strongly it falls inside each interval relative to the other units, and its reconstruction error is the anomaly score. This keeps the power of differentiable representation learning while exposing an inspectable internal structure. We make the inductive bias precise: a certified reconstruction-error lower bound for points that fall outside every active coordinate of the learned support (with a Lipschitz-enforced decoder), and a graded, empirically verified suppression mechanism for the usual case in which only a few features are abnormal; and we provide a closed-form, label-free importance that ranks each (unit, feature) pair from quantities the model already maintains, turning trained intervals into auditable candidate constraints without ever seeing an anomaly label. On 48 ADBench benchmarks against 22 baselines under a common [−1, 1]-normalized protocol, D IFF I NT attains the best mean rank overall on both metrics (4.10 on ROC–AUC, 4.16 on AUPR); among inlier-only detectors it leads its regime clearly, and it is competitive with the strongest contaminated-data detectors (see the stratified and complete-case analyses). It is the only interpretable detector in the statisticallytied leading cluster of seven methods. Index Terms—anomaly detection, interpretability, differentiable models, interval representations, numerical data

I. I NTRODUCTION Anomaly detection on tabular numerical data underpins fraud screening, fault monitoring, and clinical triage. Reconstruction-based deep detectors (autoencoders, VAEs, and one-class networks) are among the most accurate generalpurpose methods on heterogeneous benchmarks [1]. Their weakness is not accuracy but accountability: the latent code is an entangled, rotationally ambiguous vector [2], [3], so a flagged record comes with a scalar error and no statement of which feature values were responsible. A fraud analyst who receives “account 42819: error 7.4” cannot tell whether to escalate, refund, or dismiss. Regulation codifies the same need – the EU AI Act’s “meaningful information about the logic involved,” feature-level reason codes in credit scoring – so an unexplained alert has little practical use. A natural way to obtain feature-grounded explanations is to constrain the model to reason in intervals: axis-aligned hyperrectangles, the numerical analogue of pattern-mining items and

rule-learning conditions, immediately readable as “feature j ∈ [a, b]”. Classical interval pattern discovery, however, relies on exhaustive enumeration over a discretized space [4], [5], which both loses information and scales poorly. Differentiable pattern mining [6]–[8] replaces enumeration with gradient descent but, to date, operates only on binary data and thus still requires the inputs to be discretized first. We take the differentiable route but keep the data numerical. D IFF I NT1 is an autoencoder whose bottleneck is a layer of soft interval memberships: each latent unit is a learnable hyperrectangle (a center and a softplus half-width, with sigmoid boundaries for differentiability). A decoder reconstructs the input from these memberships; the model is trained on normal data with a reconstruction loss, and the reconstruction error is the anomaly score. Because the bottleneck is the intervals, the internal state is inspectable, and a simple statistic turns each into an auditable candidate constraint. We limit our claims: D IFF I NT is not a pattern-set miner – we claim no minimality, optimal pattern count, or descriptionlength objective. Interval structure here is a mechanism for an interpretable anomaly detector, evaluated in that role. Our contributions are: • An interval-structured differentiable bottleneck for reconstruction-based anomaly detection that operates on raw numerical features with no discretization, using a competitive log-sum-exp aggregator that gives a scalar per-unit code (Sec. III). • A method-specific clipping-margin result: a graded suppression mechanism (Cor. 1) whereby a unit’s weight decays geometrically in the number of its active coordinates a point violates – the operative property for the realistic anomaly with a few abnormal features – of which the full certified reconstruction-error lower bound (Thm. 1, needing violation on every active coordinate and a Lipschitz-enforced decoder) is the extreme case, verified numerically in Sec. VI-E. This is what justifies the reconstruction error as an anomaly score (Sec. IV), together with the stability properties (EMA support, Lipschitz regularity) that the model relies on. • An analysis of the input-domain choice: we show that min–max scaling to [−1, 1] is an integral part of the method. It aligns random initialization with the data 1 Code: https://github.com/DiffInt/diffint.

support, makes the sigmoid temperature τ dimensionless, places the empty-code attractor of Theorem 1 at the inlier centroid, and bounds the Lipschitz slack uniformly across datasets (Sec. III-B); one configuration then transfers to all 48 datasets without retuning. • A large-scale evaluation: 48 ADBench datasets, 22 baselines, with the semi-supervised training protocol, the handling of missing baseline runs, and the exact statistical reading of the critical-difference diagrams all stated up front (Sec. VI). Because D IFF I NT and three baselines train on inliers only while the remaining baselines run on contaminated data, we add a stratified and a completecase re-analysis in App. I so the comparison is read within, not across, training regimes. We claim only what the statistics support. II. R ELATED W ORK Reconstruction and one-class deep detectors: Autoencoders [9], VAEs [10], and DAGMM [11] score anomalies by reconstruction error; DeepSVDD [12] learns a one-class hypersphere. Recent variants add an OCSVM-guided boundary or sample retrieval, but expose a global kernel boundary or retrieval cues rather than per-feature ranges. These models are strong but opaque, and are known to reconstruct anomalies that lie near the learned manifold [13]–[15]. Our contribution is orthogonal to raw accuracy: we keep the reconstruction paradigm but replace the entangled bottleneck with an intervalstructured one, with a deterministic argument (Sec. IV) for why out-of-support points are not reconstructed. Classical, self-supervised and generative detectors: LOF [16], OCSVM [17], PCA [18], KDE [19], GOAD [20], ICL [21], SLAD [22], MCM [23], GAN-based [24], diffusion/flow detectors [25], [26] and the graph detector LUNAR [27] span the ADBench suite [1]; the recent flowmatching contraction model TCCM [28] is a strong recent inductive baseline. They differ widely in interpretability; none exposes feature-range explanations natively. Pattern mining and differentiable rule learning: Frequent and quality pattern mining [29]–[32] and interval pattern structures [4], [5] enumerate patterns over discretized data. BinaPs [6] and DiffNaps/DiffVersify [7], [8], [33] introduced differentiable pattern discovery, but only for binary data. Neurosymbolic rule miners such as Aerial+ [34] still discretize numerical attributes; supervised hyper-rectangle ensembles such as GBM–HRBM [35] need labels and are not end-to-end differentiable; differentiable rule networks [36] target prediction, not unsupervised detection. To our knowledge, D IFF I NT is the first to use soft numerical interval memberships as a structured bottleneck in a reconstruction-based anomaly detector trained on raw numerical features without discretization, and to empirically validate the resulting interval-based explanations. We claim novelty only for this specific combination, not for axisaligned soft regions in general. Why a structured bottleneck: Representation-learning analyses show generic encoders produce entangled, nonidentifiable factors absent a strong inductive bias [2], [3], [37];

an interval bottleneck supplies one – coordinate-wise bounds that keep geometric meaning and yield stable regions across runs, and whose hard boundaries counteract the near-manifold anomaly reconstruction (Sec. IV) that an unconstrained code permits. Related structured bottlenecks each fall short on some axis: prototype networks [38] expose exemplar points, not ranges; sparse/disentangled autoencoders (β-VAE [39]) align directions but bound no coordinate (identifiability results [2] show this is fundamental); supervised hyper-rectangle ensembles [35] are not end-to-end differentiable. The interval bottleneck is unsupervised, differentiable, and bounded coordinatewise at once. III. D IFF I NT A. Problem and notation Let D = {x(i) }ni=1 ⊂ Rd be a numerical dataset, with features min–max scaled to [−1, 1] (Sec. III-B). An interval pattern Xk assigns to every feature j a closed interval [ckj , ckj ]; instance x is covered by Xk iff ckj ≤ xj ≤ ckj for all j, i.e. Xk is a hyper-rectangle. We train only on normal (inlier) data and, at test time, score an instance by its reconstruction error. We use K interval units as a fixed bottleneck width; K is a capacity hyperparameter, not a claimed minimal pattern set (Sec. VI-H). B. Input normalization to [−1, 1] We prescribe min–max scaling to [−1, 1]d as part of the method, not an interchangeable preprocessing detail. Every component is calibrated to a symmetric bounded domain, which is what lets a single configuration generalize across all 48 datasets. (i) Initialization is data-aligned. Centers mkj and width logits δkj are drawn from a narrow zero-mean Gaussian; after softplus, half-widths concentrate around log 2 ≈ 0.69, so a fresh unit covers ≈ [−0.7, 0.7] per feature, a non-degenerate fraction of [−1, 1]. Under un-normalized or [0, 1] data the same init lies outside or off-center, and training must first translate every interval; the symmetric choice removes this transient and makes the random init of Algorithm 1 valid across datasets. (ii) The temperature τ becomes dimensionless. The boundary sigmoid σ((xj − ckj )/τ ) has a transition zone of width Θ(τ ) in the units of xj ; on [−1, 1]d every feature spans 2, so a single τ =0.1 is a 5% zone everywhere. Any non-uniform scaling forces a per-feature τj , and the joint membership Ikj then loses the single clipping-margin parameter β = σ(−η/τ ) of Thm. 1, and the closed-form bound is lost. (iii) The empty-code attractor is the inlier centroid. Outof-support points are pulled toward gθ (f0 ) (Thm. 1). Trained on inliers with RMSE, gθ (f0 ) sits near the inlier centroid, which under [−1, 1] scaling is a neighborhood of the origin; anomalies lie far from it, so the attractor separates them by the full inlier amplitude, the largest margin available. [0, 1] shifts the centroid off the attractor, and StandardScaler makes magnitudes dataset-dependent and the bound incomparable.

(iv) The Lipschitz slack is dataset-independent. The slack L d κ(β) of Thm. 1 transfers across datasets only √ if the domain has a fixed diameter; [−1, 1]d supplies 2 d, whereas StandardScaler’s sup ∥x∥ scales with the tail. The bounded domain likewise keeps the encoder constant of Prop. 3 the same quantity across datasets. (v) Symmetry balances the two boundaries. The two bound1 Ikj each; on [0, 1] the inlier ary gradients have magnitude 4τ mass loads them asymmetrically and intervals tend to collapse to half-rectangles “xj ≤ b”. Symmetric scaling equalizes them in expectation, yielding the two-sided rules “xj ∈ [a, b]” an analyst reads off (Sec. V). Empirical confirmation. What matters is whether inputs are mapped into a bounded symmetric domain: removing normalization costs ≈ 3 AUROC points (Table IVa, 0.805 vs. [−1, 1] 0.833). Among bounded/standardized choices [−1, 1] is also the most accurate (0.833 vs. StandardScaler 0.818, [0, 1] 0.824; ≤ 1.5-point spread), and it is the only one under which reasons (i)–(v) hold simultaneously, so one configuration transfers across all 48 datasets without retuning. At inference, test features are train-scaled and clipped to [−1, 1]; clamping can only lower memberships, so it is unlikely to mask anomalies (none observed).

Algorithm 1 D IFF I NT training (one epoch) Require: inliers D, K, τ , EMA decay ρ 1: for all mini-batches B ⊂ D do 2: for k = 1, . . . , K and j = 1, . . . , d do 3: ∆kj ← softplus(δkj ) up low up 4: compute slow kj , skj and Ikj (xj ) ← skj skj 5: end for 6: fk (x) ← AGGREGATE({Ikj }dj=1 ) 7: x̂ ← gθ (f (x)) 8: backprop LRMSE ; optimizer step 9: update supportkj by EMA 10: end for Ensure: interval params {mkj , δkj }, decoder θ

does not get a small code but collapses to the fixed empty code f0 (Thm. 1(i)), and per-instance “how far inside box Qk” should be read from the soft box membership mk (x) = j Ikj (xj ), not fk (x). Numerically we clamp Ikj ≥ 10−8 before the log and normalize with a max-subtracting softmax, so the aggregator and its gradients stay finite arbitrarily far out of support.

C. Differentiable interval bottleneck

E. Decoder, training, and EMA support

To make boundaries learnable we use a center/half-width parameterization. For unit k and feature j, an unconstrained center mkj and width logit δkj give a strictly positive halfwidth via softplus, ∆kj = softplus(δkj ) = ln(1 + eδkj ) > 0, so the interval is [ ckj , ckj ] = [ mkj − ∆kj , mkj + ∆kj ]. The softplus keeps each half-width strictly positive and decoupled across coordinates, with bounded derivative σ(δkj ) ∈ (0, 1), so widths and gradients remain bounded throughout training. Hard membership is non-differentiable; we replace each boundary with a sigmoid of temperature τ > 0:  x −c    j ckj −xj up kj slow (x ) = σ , s , (x ) = σ j j kj kj τ τ

The decoder is a two-layer ReLU MLP gθ : RK → Rd with hidden width h=128, a single LayerNorm conditioning the hidden activations (default), and a linear read-out; it maps the bottleneck back to input space, x̂ = gθ (f (x)). q Training minimizes the per-sample RMSE LRMSE (x) = d1 ∥x − x̂∥22 on inliers only (label 0). We expose two decoders: the default (LayerNorm, finite but unconstrained Lipschitz constant) and the Certified-Lipschitz D IFF I NT, which spectrally normalizes every linear map and drops Q every non-1-Lipschitz layer (including LayerNorm), so L = l ∥Wl ∥2 is an explicit Lipschitz upper bound; this regularity is what turns Thm. 1 into a deterministic certificate (Sec. VI-E). To obtain a stable, datasetlevel activation statistic for interval scoring and interpretability, D IFF I NT keeps an exponential moving average of the soft support, X (t+1) (t) (i) 1 supportkj ← ρ supportkj +(1−ρ) |B| Ikj (xj ), ρ ∈ [0, 1).

and define the soft per-feature membership Ikj (xj ) = up slow kj (xj ) skj (xj ) ∈ [0, 1], which is ≈ 1 well inside the interval and decays smoothly outside. Centers and width logits are initialized from a narrow zero-mean Gaussian, and all interval parameters are learned jointly with the decoder. D. Membership aggregation The d per-feature memberships of a unit must be combined into a pattern activation. We use a competitive log-sum-exp aggregator,
P exp j log Ikj (xj ) fk (x) = PK
∈ [0, 1]. P r=1 exp j log Irj (xj ) This is a softmax over log-memberships: units compete to explain a point, and as τ → 0 a single covering unit wins. It yields a scalar per unit, so the encoder output is unambiguously f (x) ∈ RK . The P code is a relative competition, not an absolute membership: k fk (x) = 1 always, a point outside every box

i∈B

The EMA is purely a diagnostic statistic; it is not part of the forward pass. At test time the anomaly score of x is the mean absolute reconstruction error MAE(x) = d1 ∥x− x̂∥1 (averaged over the d scaled coordinates, so MAE(x) ∈ [0, 2] on [−1, 1]d ). RMSE is used as the training objective and MAE as the testtime score, a standard pairing that keeps the optimization robust while the score itself stays easy to read. IV. W HAT THE I NTERVAL S TRUCTURE P ROVIDES We state results that are specific to this model and that the detector actually uses. The core is a clipping-margin result on the reconstruction error of out-of-support points

ID x1 x (1) 0.10 x (2) 0.25 x (3) 0.80 x (4) -0.35 x (5) -0.60

x2

-0.30 -0.50 0.90 0.40 0.85

x3

0.70 0.65 0.60 -0.72 0.68

Pa..e,n init. & D&fferen.& b&l&.y →

[.1,.8]⋅[-.3,.4]⋅[.3,.7]⋅[-.2,.4] [-.6,.1]⋅[-.5,.9]⋅[.4,.8]⋅[.1,.4]

1 2

x4

-0.20 0.40 0.10 0.15 0.25

P ..er) i)i.i li3 .io)

1.0

Differen.iable Interv l P tterns 1 2

0.5 0.0

1

2 3 Dimension index j

4

Refined In.er0

l P ..ern−

1.0

 

0.5

x1̂

x1 x2 x3 x4

−0.5 −1.0

Differenti ble Interv l L 2er →

1 2

2

−0.5

x2̂

−1.0

1

x3̂ x4̂

1

0.0

MAE

I)pu. D . (To2 D . -e.) →

2

3

MAE per Ins. nce

4

0.02 0.01 0.00

x ) (1

x (2)

x (3) Data ID

x (4)

x (5)

Fig. 1: D IFF I NT end-to-end pipeline on a 4-feature toy dataset (left → right). (a) Input: n=5 samples with d=4 features min–max scaled to [−1, 1] (Sec. III-B); x(1) −x(4) are inliers, x(5) is the anomaly. (b) Initialization: K=2 interval units X1 , X2 as centers (dots) with softplus half-widths (rings); sigmoid-soft boundaries of temperature τ make all gradients flow through. (c) Differentiable interval layer: the bottleneck is the bipartite map {xj } → {Xk } → {x̂j } with per-feature memberships Ikj (xj ) = σ((xj −ckj )/τ )σ((ckj −xj )/τ ), aggregated per unit and decoded by a small MLP gθ ; RMSE between x, x̂ is backpropagated jointly into (mkj , δkj ) and θ. (d) Refined intervals and anomaly score: after training, intervals shrink onto the inlier cloud (top), and per-instance MAE (bottom) is small for inliers but visibly large for x(5) , the empirical signature of the clipping-margin bound (Thm. 1), which pulls out-of-support points toward the empty-code reconstruction gθ (f0 ). Each refined unit reads as an auditable candidate constraint “Xk : xj ∈ [ckj , ckj ]” (Sec. V). (certified when the decoder is Lipschitz-enforced, an empirical mechanism otherwise): it makes no independenceacross-coordinates assumption and is consistent with the wellknown fact that autoencoders can otherwise reconstruct highdimensional anomalies. All proofs are in Appendix A. Definition 1 (Active coordinate). Coordinate j is active for unit k if its learned interval constrains inliers there, i.e. the mean inlier membership I¯kj = ED [Ikj (xj )] is bounded away from 1 (e.g. when the half-width satisfies ∆kj < 12 rangej ). Inactive coordinates span (almost) the whole feature range and contribute log Ikj ≈ 0 to the aggregation. Theorem 1 (Certified clipping margin). Fix a test point x that in each active coordinate j (Def. 1) lies beyond the units’ global envelope, i.e. xj > maxk ckj + η or xj < mink ckj − η for some η > 0; then x is outside every box on the same side per coordinate, so Ikj (xj ) ≤ β = σ(−η/τ ) for all k and all active j. (A point in an interior gap between disjoint sub-intervals violates boxes on opposite sides; such points fall under the graded suppression of Cor. 1, not the full collapse below.) (i) Code collapse (encoder only). The bottleneck code collapses to an x-independent “empty” code f0 , ∥f (x) − f0 ∥2 ≤ κ(β) with κ(β) = O(β) → 0; this holds for any decoder. (ii) Certified bound. If, in addition, the decoder is the Certified-Lipschitz D IFF I NT of Sec. III-E (spectrally normalized Q linear maps and no non-1-Lipschitz layers), so that L = l ∥Wl ∥2 is an explicit Lipschitz upper bound, then MAE(x) ≥ d1 x − gθ (f0 ) 1 − √Ld κ(β), a deterministic certificate: any point far outside the learned support incurs an error bounded below by its distance to

the single point gθ (f0 ) the model collapses to, minus a slack controllable by τ . Corollary 1 (Graded suppression under partial violation). The collapse in Thm. 1 is the all-coordinates extreme of a graded effect and does not require a point to be out-of-support everywhere. If x violates (in a consistent direction) sk ≥ 1 active coordinates of unit k, then log Ikj ≤ log β on each, so the unnormalized weight obeys exp(ℓk ) ≤ β sk : a unit is suppressed geometrically in the number of its violated active coordinates, and the bottleneck mass shifts toward the units a point violates least. The full collapse to a single x-independent f0 is recovered only when sk = |Ak | for every unit (all active coordinates violated). We therefore do not claim a fixed reconstruction under partial violation, only that the matching units are exponentially down-weighted, the counterpart of the common anomaly profile in which a few features are abnormal. Part (i) holds for any decoder and is the mechanism the detector relies on; the certificate (ii) is an optional, on-demand guarantee. The realistic anomaly, a few abnormal features, is the partial-violation regime of Cor. 1: the units a point matches are down-weighted geometrically in the coordinates it violates, so the decoder cannot route the point’s abnormal values through them and the reconstruction is pulled toward the inlier image. The all-coordinate collapse of Thm. 1 – a single fixed reconstruction with a certified error bound – is the extreme of this effect, used as a verifiable sanity check (Sec. VI-E). In both regimes the error grows with the point’s distance from the inlier image, which is why MAE works as a score here, specific to the interval bottleneck, not a generic autoencoder property. Fig. 2 makes this concrete on a 2D toy set: inliers inside the learned box are reconstructed faithfully,

while out-of-support points are clipped onto the inlier image and thus separate cleanly in the error histogram.

Checklist for Thm. 1. The hypotheses are operational: j is active for k iff its mean inlier membership I¯kj < 0.9 (it constrains inliers there), and x is out-of-support for unit k Q when its box membership mk (x) = j Ikj (xj ) falls below β = σ(−η/τ ) (η=0.2, β≈0.12). Under this check ≥ 99% of test anomalies are out-of-support of every unit. The strict hypothesis of Thm. 1(ii) – violation of every active coordinate of some unit – is stronger: it is met by a dataset-dependent fraction (routine when units keep few active coordinates, rare when they keep many; App. E, Table XIV), and the remaining anomalies fall under the graded suppression of Cor. 1, which down-weights the matched units but carries no reconstructionerror bound. Empirically, the MAE inequality of Thm. 1(ii) is nonetheless satisfied for every out-of-support point under the Certified-Lipschitz decoder (0 violations on all six datasets; Sec. VI-E, Table V, Fig. 5). Two further properties the method uses are stated and proved in App. A: the EMA support is asymptotically unbiased with finite effective memory (Prop. 2), and the D IFF I NT encoder is globally Lipschitz on [−1, 1]d (Prop. 3); with a spectrally normalized decoder the whole model is Lipschitz, the regularity used by Theorem 1. Proposition 1 (Capacity: soft box-unions cover any support). Let the inlier support D ⊂ [−1, 1]d be compact, write the soft Q box membership of unit k as mk (x) = j Ikj (xj ) ∈ [0, 1] QK and the soft-union F = 1 − k=1 (1 − mk ). For every ε > 0 there exist a finite K, intervals {[ckj , ckj ]} and a temperature τ > 0 with ∥F −1D ∥L1 ([−1,1]d ) ≤ ε; moreover, for any δ > 0, F → 1D uniformly on {x : dist(x, ∂D) ≥ δ} as τ → 0. Axis-aligned intervals are thus not a representational bottleneck on the shape of the inlier region; the residual error concentrates only in an arbitrarily thin shell around ∂D, where no continuous score can resolve a hard indicator. This is a capacity statement: whether training realizes such a cover is empirical, answered by the learned boxes localizing inliers (Fig. 6) and by accuracy saturating after a few units (Fig. 4). The operative detection result remains Thm. 1.

0.75

0.50

0.50

0.25

0.25

0.00

x2

x2

1.00

0.75

−0.25

−0.50

−0.50

−0.75

−0.75

−1.00 −1.00 −0.75 −0.50 −0.25 0.00 0.25 0.50 0.75 1.00

x1

c) Reconstr(ction error histogram

1.00

In iers O(t iers 95% t%ain th%esh.

150

d) Reconst%uction: inputs → g(f(x)) Inliers (inp(t)

0.75 0.50

125

In iers (recon) O(t iers (inp(t) O(t iers (recon)

0.25

x2

100 75

0.00 −0.25

50

−0.50

25 0

In iers O(t iers

−1.00 −1.00 −0.75 −0.50 −0.25 0.00 0.25 0.50 0.75 1.00

x1

175

b) Test data (gro(nd tr(th)

0.00

−0.25

Co(nt

Remark 1 (Theory vs. the reported experiments). We are explicit about which part of Thm. 1 the results use. Part (i) (code collapse) is an encoder property and holds for every run. Part (ii) (the certified error lower bound) additionally needs the spectrally normalized Certified-Lipschitz decoder; all headline accuracy numbers use the default unconstrained ReLU decoder, for which part (ii) is a structural mechanism and the collapse is an empirical phenomenon (Figs. 1d, 2), not a guarantee. The certified variant makes it a verified inequality (0 violations on every dataset, Sec. VI-E) at a mean-AUROC cost of 0.908 → 0.851 on the six datasets tested. The partialviolation regime a real anomaly usually occupies is the graded suppression of Cor. 1, which carries no reconstruction-error bound – only the exponential down-weighting of the units the point matches.

a) Training in iers (noisy) (and earned inter)a )

1.00

−0.75

0.0

0.1

0.2

0.3

Error ‖x – g(f(x))‖2

0.4

−1.00 −1.00 −0.75 −0.50 −0.25 0.00 0.25 0.50 0.75 1.00

x1

Fig. 2: Toy illustration of Theorem 1. (a) noisy training inliers and the learned interval; (b) test data; (c) reconstructionerror histogram (inliers vs. outliers, dashed: 95% train threshold); (d) inputs → reconstructions: out-of-support points are clipped, producing large error.

V. T URNING I NTERVALS INTO AUDITABLE C ANDIDATE C ONSTRAINTS The bottleneck is inspectable, but a practitioner needs a scalar per (unit, feature) saying how diagnostic that interval is. The score also has to work without anomaly labels, since the detector is unsupervised. The simplest way to get one is to read it off the trained model itself. Label-free importance (LFI): LFI is a global, model-level diagnostic: it scores a (unit, feature) pair, not a single flagged instance. The per-instance question – which features made this point anomalous – is answered directly by Cor. 1: the active coordinates the point violates are exactly the ones that suppress its matching units and drive up its error. For unit k and feature j, write skj ∈ [0, 1] for the EMA soft support (Sec. III-E), ∆kj for the learned half-width, and rangej =2 for the [−1, 1] feature range. Let stabkj ∈ [0, 1] be the inverse spread of the interval bounds across seeds. Latent units carry no canonical order, so stabkj is computed after a per-dataset alignment of units across seeds (matched by proximity of their (mkj , ∆kj ) vectors); on a single-seed run it is set to 1 and the factor is inert. We score (unit, feature) pairs by LFIkj = skj · (1 − ∆kj /rangej ) · stabkj ∈ [0, 1]. |{z} | {z } | {z } support

tightness

stability

The three factors are simply how often the interval fires on inliers (skj ), how much narrower it is than the full feature range (∆kj small), and how repeatable it is across re-runs. None of them need an anomaly label. To pick a unit to display, we sum the top-N LFI values across its features; within that unit, we keep the top-N features by LFI. This is the selection rule behind Fig. 6. Stability is validated matching-free at the feature level (App. E: mean cross-seed Spearman ρ ≥ 0.74).

Faithfulness of the LFI explanation: Post-hoc attributions such as SHAP [40] or per-feature residuals from TCCM [28] are computed after the fact and can disagree with the score they explain. D IFF I NT does not have this gap: a point’s violated constraints are exactly the suppressed units (Cor. 1), and that suppression is what moves the reconstruction. The explanation and the score share one mechanism, so no second model has to align them. App. G evaluates the global LFI feature ranking against the same ranking obtained by aggregating KernelSHAP, integrated gradients, gradient×input and ECOD over a pool of flagged anomalies, inside the axis-aligned regime D IFF I NT targets. LFI is a global interpretability readout, not a per-instance explainer; within that regime the zeroquery LFI ranking agrees with the aggregated KernelSHAP / integrated-gradients rankings at Spearman ρ ≈ 0.7, is as stable across re-trainings as KernelSHAP, and passes a modelrandomisation sanity check – i.e. it carries the same global information the post-hoc methods buy with hundreds of model queries, at no cost. Is LFI a contribution?: We treat LFI as a minor, auxiliary contribution. The formula is a product of three quantities the model already keeps, not a new theoretical result. Its role is to make the interval bottleneck usable when no anomaly labels are at hand: a practitioner can rank candidate constraints from the trained model alone. We do not claim LFI is superior to supervised attributors such as SHAP – it is a global, label-free constraint-ranking tool, not a per-instance explainer (App. G). LFI is the score to reach for when labels are not available, which is the usual setting in unsupervised anomaly detection.

TABLE I: Stratified and complete-case re-analysis (App. I). Mean rank recomputed within training regimes from the same per-dataset scores, no model re-run (lower is better). Inlieronly pool: D IFF I NT, TCCM, AutoEncoder, VAE re-ranked 1– 4 per dataset. Contaminated pool: D IFF I NT inserted into the 19-method contaminated set (20 methods). Complete-case: the 39/48 datasets on which every method finished (no imputation). The top-cluster result survives both the stratification and the removal of imputation. Rank (ROC–AUC)

Rank (AUPR)

Inlier-only pool (of 4), all 48 datasets D IFF I NT AutoEncoder TCCM VAE

1.69 2.50 2.83 2.98

1.71 2.58 2.62 3.08

D IFF I NT vs. contaminated-data pool (of 20) all 48 datasets, D IFF I NT complete-case (39), D IFF I NT complete-case (39), best contam. (LUNAR)

3.35 3.59 4.03

3.46 3.74 3.85

the appendices.2 Handling of missing baseline runs: Some baselines did not complete on the largest datasets within budget (KPCA and LMDD on 8–9, MO GAAL on 6, KDE/OCSVM/LUNAR on 3–4, and AutoEncoder/CBLOF/DIF/others on 1 each) and appear as “–”. We keep all 48 datasets and assign each missing run the worst rank (the number of methods) on that dataset, the standard conservative convention; this mildly favors methods that ran everywhere, D IFF I NT included. A. Anomaly detection accuracy

VI. E XPERIMENTS Protocol (stated up front): We evaluate on the 48 nativenumerical ADBench datasets [1] (12 small, 15 medium, 11 large, 10 high-dimensional; full list in App. C) against 22 baselines via the TCCM/ADBench codebase [1], [28]. The remaining ADBench tasks are pre-computed vision/text embedding vectors whose coordinates are not individually meaningful, so the per-feature readability that motivates D IFF I NT does not apply; we match the tabular scope of our closest baseline TCCM [28]. D IFF I NT is trained semi-supervised on inliers only, with a 40% test split, 10 seeds, and a single configuration fixed across datasets (lr 5×10−5 , K=200, τ =0.1, ρ=0.999, 1000 epochs, 2-layer decoder; batch 64/512/1024 by n). All methods share the MinMax [−1, 1] normalization and the inductive baselines (TCCM, AutoEncoder, VAE) the same inlier-only training; this single shared protocol is the one under which D IFF I NT’s clipping bound and Lipschitz slack transfer across datasets (Sec. III-B). Inlier-only training matches the deployment-relevant regime: a curated normal reference set, as in monitoring and fraud. As this is a cleantraining setup, we restrict headline claims to inductive methods and report unsupervised contaminated-data detectors as “competitive,” not “beaten.” Complete per-dataset tables, dataset characteristics, per-scale CD diagrams, and ablations are in

Fig. 3 shows the ROC–AUC critical-difference diagram over all 48 datasets, with runs that did not complete floored to the worst rank (Friedman χ2 =454.36, p<10−80 ; Nemenyi at 95%, CD= 5.01). Under this common [−1, 1] protocol, D IFF I NT attains the best mean rank (4.10), ahead of LUNAR (6.00), AutoEncoder (7.42), TCCM (8.22), GMM (8.56), IForest (8.60), and VAE (8.90). The Nemenyi bar links D IFF I NT with this leading cluster of seven methods, so D IFF I NT is topranked but not statistically separated from them; the cluster is significantly ahead of the remaining ∼16 detectors. This pooled diagram mixes inlier-only and contaminated-data methods. Table I re-analyzes the same scores within regimes (App. I for the per-scale breakdown): D IFF I NT leads the inlieronly pool by a wide margin (1.69/1.71 of 4), and against the contaminated pool on the complete-case subset (no rank imputation) it is first or tied with LUNAR (AUPR gap 0.11) – so the headline ordering is not an artefact of pooling regimes or of the missing-run convention. Table II and the per-scale CD diagrams (App. K-A) agree: D IFF I NT attains the lowest mean rank strictly in 7 of the 8 (regime × metric) cells of Table II; the 8th (high-d AUPR, 6.40 vs. LUNAR 5.45) has LUNAR slightly ahead but the gap is well within the per-scale Nemenyi CD (≈ 11 at n=10), so the 2 Code: https://github.com/DiffInt/diffint.

5.0

7.5

10.0

12.5

15.0

17.5

4

20.0

(21) MO_GAAL (20) SO_GAAL (19) KPCA (19) LMDD (15) ABOD (15) QMCD (14) LOF (14) PCA (14) OCSVM (12) ECOD (11) DIF (11) Sampling

DiffInt (4.1) LUNAR (6) AutoEncoder (7.4) TCCM (8.2) GMM (8.6) IForest (8.6) VAE (8.9) CBLOF (9.2) MCD (10) KDE (11) HBOS (11)

(a) ROC–AUC (mean rank D IFF I NT: 4.10).

6

8

10

12

14

16

18

20

(20) MO_GAAL (20) SO_GAAL (19) KPCA (18) LMDD (16) ABOD (15) PCA (15) QMCD (14) LOF (13) OCSVM (12) ECOD (11) MCD (11) HBOS

DiffInt (4.2) LUNAR (4.9) TCCM (7.4) AutoEncoder (8.1) GMM (8.5) CBLOF (8.9) VAE (9.6) IForest (9.9) DIF (11) KDE (11) Sampling (11)

(b) AUPR (mean rank D IFF I NT: 4.16).

Fig. 3: Critical-difference diagrams across the 48 ADBench datasets and 23 methods, runs that did not complete floored to worst rank. D IFF I NT attains the best mean rank on both metrics and is statistically tied with the same leading cluster (LUNAR, AutoEncoder, TCCM, GMM, IForest, VAE); the cluster is significantly ahead of the remaining ∼16 detectors. TABLE II: Mean rank by dataset scale (lower is better; missing runs floored to worst). Bold: D IFF I NT leads strictly. † : tied with the best baseline within the per-scale Nemenyi CD (≈ 9– 11 at α=0.05). LU=LUNAR, IF=IForest, AE=AutoEncoder, CB=CBLOF. Rank (ROC–AUC)

TABLE III: Reconstruction MAE (vs. BinaPs, sanity check) and training time (s); lower better, per-row best green. Times: matched 1000-epoch budget for D IFF I NT/LUNAR; “OOM”: out of memory. D IFF I NT trains 1–2 orders faster than BinaPs and faster than LUNAR on most datasets. Reconstruction MAE

Training time (s)

Regime (N ) D IFF I NT best BL D IFF I NT best BL

Rank (AUPR) Dataset

BinaPs

D IFF I NT

D IFF I NT LUNAR

Overall (48)

4.10

LU 6.00

4.16

LU 4.91

Small (12) Medium (15) Large (11) High-d (10)

4.42 3.77 3.18 5.25

LU 6.75 LU 4.23 AE 4.73 LU 5.75

4.33 3.57 2.73 6.40†

CB 6.67 LU 3.60 LU 3.91 LU 5.45

arrhythmia cardio glass ionosphere optdigits pima satellite satimage-2 shuttle vowels wbc

0.296 0.305 0.336 0.252 0.281 0.295 0.247 0.257 0.057 OOM OOM

0.121 0.064 0.043 0.129 0.203 0.070 0.035 0.033 0.001 0.061 0.067

30.2 3.0 9.2 16.1 60.1 8.6 38.7 54.6 193.5 2.7 2.6

two methods are statistically tied there. D IFF I NT is therefore the leading or co-leading method on every regime × metric cell. Six robustness checks are reported in App. E: sensitivity to missing-run handling, a τ sweep, an active-coordinate threshold check, the per-layer spectral norms of the certified decoder, an inference-clamping isolation, and LFI stability across seeds. The top-cluster conclusion and the interpretability claims hold under all of them. B. Reconstruction sanity check vs. a binary differentiable model Table III compares reconstruction MAE against BinaPs [6], the closest differentiable model. Caveat: BinaPs targets binary data and does not optimize numerical reconstruction, so this is a sanity check that numerical intervals reconstruct better than binarized patterns, not a pattern-mining comparison and not evidence about pattern-set quality. Under that caveat, D IFF I NT reconstructs numerical inliers far better (Table III) and, avoiding the combinatorial cost of binary pattern search, trains one to two orders of magnitude faster than BinaPs.

7.9 20.6 7.5 7.2 57.6 8.1 52.6 65.7 658.0 31.3 15.9

Cost relative to deep baselines: Asymptotically D IFF I NT is in the deep-baseline class: per-sample inference is O(Kd) memberships plus a fixed MLP decoder and an O(K) softmax, one forward pass with no neighbour search, unlike memorybased detectors such as LUNAR whose kNN queries grow with n. Table III confirms this in wall-clock at a matched 1000-epoch budget: D IFF I NT trains faster than LUNAR on most datasets and markedly on the largest (shuttle 194s vs. 658s). C. Effect of bottleneck width K Fig. 4 varies K ∈ {5, 10, 20, 50, 100, 200, 300} on three representative datasets. ROC–AUC (a) saturates well below K=200 on every dataset: once enough capacity is available, adding units neither helps nor hurts. The companion panel (b) confirms selective reconstruction: as K grows, inlier recon-

TABLE IV: Ablations on seven small ADBench datasets (n ≥ 100; K=200, 3 seeds; mean ROC–AUC). (a) input normalization; (b) fraction of anomalies in the training set. (a) Normalization none ROC–AUC 0.805

[0, 1] standard 0.824 0.818

[−1, 1] 0.833

(b) Training contamination 0% 5% 10% ROC–AUC 0.833 0.751 0.735

20% 0.720

struction sharpens but the mean MAE on test outliers stays high, the empirical signature of the clipping margin (Thm. 1). We therefore fix K=200 as a generous capacity default that absorbs dataset complexity without per-dataset tuning; it is not interpreted as a minimal pattern set. Practitioners on a tight compute budget can safely halve K without measurable accuracy loss. D. Ablations: normalization and contamination Table IV reports two ablations on seven small ADBench datasets (n ≥ 100; K=200, 3 seeds; Hepatitis, n=80, is too small for a stable inlier-only split): preprocessing sensitivity and contaminated “clean” training. The Lipschitz assumption of Thm. 1 is examined separately in Sec. VI-E. (a) Normalization. Mapping into a bounded symmetric domain is what matters: dropping it costs ≈ 3 AUROC points, and among bounded/standardized choices [−1, 1] is the most accurate (0.833 vs. StandardScaler 0.818, [0, 1] 0.824; a ≤ 1.5-point spread), so it is both the theory-driven choice under which one configuration and the clipping bound transfer (Sec. III-B) and the top performer. (b) Training contamination. Anomalies in the “inlier” set degrade AUROC gracefully (0.833 → 0.751 → 0.735 → 0.720 at 0/5/10/20%), staying well above chance: the EMA support averages over batches, so a minority cannot dominate the intervals. E. Certifying the clipping margin: does it hold? We test Thm. 1 directly with the Certified-Lipschitz D IFF I NT (K=200, 3 seeds) on low-membership test points (inside no learned box). Table V and Fig. 5: the bound is respected Q for every out-of-support point, the upper bound L = l ∥Wl ∥2 is an explicit constant near 1, and the reconstructions collapse toward the empty-code image gθ (f0 ) (within ≈ 0.4 of the inlier amplitude). Certification trades some accuracy (0.908 → 0.851 mean AUROC), so the unconstrained decoder stays the default and the certified variant is used when a guarantee is required; the clipping mechanism is present in both. F. Interpretability: do the intervals localize inliers? Fig. 6 projects the top D IFF I NT interval onto feature pairs. The interval is picked by the label-free importance LFI (Sec. V), so the selection itself uses no anomaly labels. The bounds the model learns form an explicit, auditable candidate constraint that concentrates inliers and suppresses outliers through the clipping margin (Thm. 1, Cor. 1).

TABLE V: Certifying Thm. 1 (Certified-Lipschitz D IFF I NT). L: decoder Lipschitz upper bound; collapse: mean distance of out-of-support reconstructions to gθ (f0 ), as a fraction of inlier amplitude (lower = tighter collapse); bound: fraction of outof-support points satisfying the inequality. AUROC is for the unconstrained (default) and certified decoders. AUROC Dataset

unc.

cert.

L

collapse

bound

glass wbc ionosphere pima cardio satimage-2

0.891 0.930 0.953 0.696 0.976 0.999

0.744 0.903 0.828 0.686 0.955 0.987

1.05 1.03 1.04 1.04 1.06 1.07

0.52 0.29 0.24 0.53 0.45 0.38

100% 100% 100% 100% 100% 100%

Mean

0.908

0.851

1.05

0.40

100%

G. Discussion: when does interval structure help? Theory and experiment agree on one mechanism: the clipping margin (Thm. 1, Cor. 1) scales with the fraction of informative coordinates, so the gains are largest on small and medium data, where the axis-aligned bias matches the typical anomaly profile of a few abnormal features. The gains carry to large data (rank 3.18 on AUC, 2.73 on AUPR) and to highdimensional data, where D IFF I NT still leads on ROC–AUC (5.25 vs. LUNAR 5.75); the only cell where a competitor (LUNAR) edges D IFF I NT in mean rank is high-dimensional AUPR, and that gap is within the per-scale Nemenyi CD, i.e. statistically a tie. On top of this, the structured bottleneck delivers what an entangled code cannot: a mechanistic reason why a point is anomalous, with auditable, feature-grounded candidate constraints (Sec. V, Fig. 6). H. Limitations Three settings sit outside the assumptions under which D IFF I NT is evaluated. (1) Heavy-tailed features: min–max scaling assumes finite per-feature extrema. Features with heavy tails (e.g. income, latency) saturate the endpoints and warp the [−1, 1] geometry the temperature τ and the clipping margin rely on; a robust quantile mapping into [−1, 1] would preserve τ , but we do not evaluate it here. (2) Concept drift: the protocol assumes a stationary inlier distribution. On nonstationary streams the scaler and the EMA support must be refreshed (a short re-fit on a recent inlier window suffices in principle), but drift is unevaluated in this paper. (3) Missing values: the current implementation assumes complete features and treats imputation as a preprocessing step. A missingaware membership (e.g. a neutral Ikj =1 for missing xj , so the unit abstains rather than firing) is straightforward but not measured here. A quantitative comparison of the global LFI ranking against aggregated post-hoc attributors is in App. G; two further points – a robust/quantile normalization ablation and a comparison to diffusion / retrieval / tabular-foundationmodel detectors – are outside the scope of this evaluation and discussed in App. J.

0

50

100

150

200

Number of intervals K

Glass Ionosphere Arrhythmia 250

300

(a) ROC–AUC saturates after a few units.

Mean reconstruction MAE on test outliers

Effect of K on ROC-AUC (DiffInt)

K = 200 default

ROC-AUC

1.00 0.95 0.90 0.85 0.80 0.75 0.70 0.65 0.60

Outlier reconstruction MAE vs. K (DiffInt)

0.6

Glass Ionosphere Arrhythmia

0.5 0.4 0.3 0.2 0.1 0

50

100

150

200

Number of intervals K

250

300

(b) Mean MAE on test outliers stays high.

Certified-Lipschitz (guaranteed)

1.00 0.75 0.50 0.25 0.00

Unconstrained (empirical)

bound holds y=x

0.0

0.2

0.4 0.6 RHS (bound)

0.8

1.0

LHS MAE(x)

LHS MAE(x)

Fig. 4: Effect of K on three ADBench datasets. Detection accuracy saturates quickly (a); meanwhile the mean reconstruction error on test outliers does not collapse with growing capacity (b), so D IFF I NT reconstructs the inlier manifold faithfully while keeping out-of-support points far from their input (selective reconstruction, consistent with Thm. 1). We fix K=200 as a capacity dial, not a pattern-set size.

ACKNOWLEDGMENT

0 2 4 6

bound holds y=x

6

5

4

3 2 1 RHS (bound)

0

1

Fig. 5: Theorem-to-practice bridge: MAE(x) (LHS) vs. the clipping-margin lower bound (RHS) for out-of-support points. Left: certified decoder, bound tight and respected (0 violations). Right: unconstrained, the inequality holds but the bound is loose and uncertified (note the x-scale), an empirical phenomenon (Rem. 1).

VII. C ONCLUSION We presented D IFF I NT, an autoencoder for tabular anomaly detection whose bottleneck is a set of soft, learnable numerical intervals. Three pieces fit together: a differentiable architecture that needs no discretization, a clipping-margin result (Thm. 1, certified under a Lipschitz decoder and empirical otherwise) explaining why reconstruction error is a valid score on this bottleneck, and a closed-form label-free importance, LFI (Sec. V), that turns each (unit, feature) pair into an auditable candidate constraint without consulting any anomaly label. On 48 ADBench datasets, D IFF I NT reaches the lowest mean rank on both metrics (4.10 ROC–AUC, 4.16 AUPR) and sits in a sevenmethod cluster the Nemenyi test cannot separate; LUNAR slightly edges it only on high-dimensional AUPR, and that gap is within the per-scale CD. The explanation and the score share one mechanism, so the intervals read off the bottleneck are exactly what drives detection. A natural next step is to add a soft-L0 gate and an MDL term so the bottleneck becomes a compact interval-pattern-set miner suitable for pattern-mining benchmarks alongside anomaly detection.

This work was supported by French state aid managed by the National Research Agency (ANR) under the France 2030 program, with the reference “PANDORA” (ANR-24-CE230950). The authors thank the anonymous reviewers for their constructive feedback. R EFERENCES [1] S. Han, X. Hu, H. Huang, M. Jiang, and Y. Zhao, “Adbench: Anomaly detection benchmark,” Advances in neural information processing systems, vol. 35, pp. 32 142–32 159, 2022. [2] F. Locatello, S. Bauer, M. Lucic, G. Raetsch, S. Gelly, B. Schölkopf, and O. Bachem, “Challenging common assumptions in the unsupervised learning of disentangled representations,” in international conference on machine learning. PMLR, 2019, pp. 4114–4124. [3] Z. C. Lipton, “The mythos of model interpretability: In machine learning, the concept of interpretability is both important and slippery.” Queue, vol. 16, no. 3, pp. 31–57, 2018. [4] M. Kaytoue, S. O. Kuznetsov, and A. Napoli, “Revisiting numerical pattern mining with formal concept analysis,” in IJCAI 2011, 2011, pp. 1342–1347. [5] A. Belfodil, A. Belfodil, and M. Kaytoue, “Anytime subgroup discovery in numerical domains with guarantees,” in ECML PKDD 2018, 2018, pp. 500–516. [6] J. Fischer and J. Vreeken, “Differentiable pattern set mining,” in SIGKDD. ACM, 2021, pp. 383–392. [7] N. P. Walter, J. Fischer, and J. Vreeken, “Finding Interpretable ClassSpecific Patterns through Efficient Neural Search,” in AAAI, 2024. [8] T. Chataing, J. Perez, M. Plantevit, and C. Robardet, “Diffversify: a scalable approach to differentiable pattern mining with coverage regularization,” in ECMLPKDD’24, 2024, pp. 407–422. [9] M. Sakurada and T. Yairi, “Anomaly detection using autoencoders with nonlinear dimensionality reduction,” MLSDA, 2014. [10] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” in ICLR, 2013. [11] B. Zong, Q. Song, M. Min, W. Cheng, C. Lumezanu, D. Cho, and H. Chen, “Deep autoencoding gaussian mixture model for unsupervised anomaly detection,” in ICLR, 2018. [12] L. Ruff, R. Vandermeulen, N. Görnitz, L. Deecke, S. Ahmed Siddiqui, A. Binder, E. Müller, and M. Kloft, “Deep one-class classification,” in ICML, 2018. [13] B. Zong, Q. Song, M. R. Min, W. Cheng, C. Lumezanu, D. Cho, and H. Chen, “Deep autoencoding gaussian mixture model for unsupervised anomaly detection,” in International Conference on Learning Representations, 2018.

1.0 0.5 0.0 0.5 1.0 x0

1.0 0.5 0.0 0.5 1.0 x2

1.0 0.5 0.0 0.5 1.0 x3

1.0 0.5 0.0 0.5 1.0 x8

(a) W INE: unit 179, candidate constraint x0 ∈ [−0.68, 0.48] ∧ x2 ∈ [−0.84, 0.50] ∧ x3 ∈ [−0.82, 0.49] ∧ x8 ∈ [−0.83, 0.53].

x3

1.0 0.5 0.0 0.5 1.0

1.0 0.5 0.0 0.5 1.0

x27

x3

1.0 0.5 0.0 0.5 1.0

satimage-2: unit 28 (top-4 features by LFI)

1.0 0.5 0.0 0.5 1.0

x7

x2

1.0 0.5 0.0 0.5 1.0

x8

wine: unit 179 (top-4 features by LFI)

1.0 0.5 0.0 0.5 1.0

1.0 0.5 0.0 0.5 1.0 x11

1.0 0.5 0.0 0.5 1.0 x3

1.0 0.5 0.0 0.5 1.0 x27

1.0 0.5 0.0 0.5 1.0 x7

(b) S ATIMAGE -2: unit 28, candidate constraint x3 ∈ [−0.71, 0.49] ∧ x7 ∈ [−0.65, 0.63] ∧ x11 ∈ [−0.80, 0.48] ∧ x27 ∈ [−0.76, 0.57].

Fig. 6: Pairwise 2D projections of the top D IFF I NT interval on two ADBench datasets, selected without any anomaly label by the label-free importance (LFI, Sec. V); bounds are in the [−1, 1]-scaled domain. The green boxes concentrate the inlier mass (purple) while a large fraction of outliers (yellow) leave the box on at least one axis, most visibly in the upper-right cluster of S ATIMAGE -2. Separation at the box boundary is not strict, but a violation in any active coordinate is enough to suppress this unit’s contribution (Cor. 1) and trigger the clipping margin (Thm. 1).

[14] S. Pidhorskyi, D. A. Adjeroh, and G. Doretto, “Adversarial latent autoencoders,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 14 104–14 113. [15] L. Bergman, N. Cohen, and Y. Hoshen, “Deep nearest neighbor anomaly detection,” arXiv preprint arXiv:2002.10445, 2020. [16] M. M. Breunig, H.-P. Kriegel, R. T. Ng, and J. Sander, “Lof: Identifying density-based local outliers,” in SIGMOD, 2000. [17] B. Schölkopf, R. C. Williamson, A. Smola, J. Shawe-Taylor, and J. Platt, “Support vector method for novelty detection,” in NEURIPS, 1999. [18] M.-L. Shyu, S.-C. Chen, K. Sarinnapakorn, and L. Chang, “A novel anomaly detection scheme based on principal component classifier,” in IEEE Foundations and New Directions of Data Mining Workshop, 2003. [19] L. J. Latecki, A. Lazarevic, and D. Pokrajac, “Outlier detection with kernel density functions,” in MLDM, 2007. [20] L. Bergman and Y. Hoshen, “Classification-based anomaly detection for general data,” in ICLR, 2020. [21] T. Shenkar and L. Wolf, “Anomaly detection for tabular data with internal contrastive learning,” in ICLR, 2022. [22] H. Xu, Y. Wang, J. Wei, S. Jian, Y. Li, and N. Liu, “Fascinating supervisory signals and where to find them: Deep anomaly detection with scale learning: Deep anomaly detection with scale learning,” in ICML, 2023. [23] J. Yin, Y. Qiao, Z. Zhou, X. Wang, and J. Yang, “Masked cell modeling for anomaly detection in tabular data,” in ICLR, 2024. [24] T. Schlegl, P. Seeböck, S. M. Waldstein, U. Schmidt-Erfurth, and G. Langs, “Unsupervised anomaly detection with generative adversarial networks,” in MICCAI, 2017. [25] J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in NEURIPS, 2020. [26] V. Livernoche, V. Jain, Y. Hezaveh, and S. Ravanbakhsh, “On diffusion modeling for anomaly detection,” in ICLR, 2024. [27] A. Goodge, B. Hooi, S.-K. Ng, and W. S. Ng, “Lunar: Unifying local outlier detection methods via graph neural networks,” in AAAI, 2022. [28] Z. Li, Q. Huang, Y. Zhu, L. Yang, M. Amiri, N. van Stein, and M. van Leeuwen, “Scalable, explainable and provably robust anomaly detection with one-step flow matching,” NeurIPS, 2025.

[29] R. Agrawal and R. Srikant, “Fast algorithms for mining association rules in large databases,” in VLDB’94,, 1994, pp. 487–499. [30] M. J. Zaki, S. Parthasarathy, M. Ogihara, and W. Li, “New algorithms for fast discovery of association rules,” in SIGKDD, 1997, pp. 283–286. [31] J. Vreeken, M. van Leeuwen, and A. Siebes, “Krimp: mining itemsets that compress,” Data Min. Knowl. Discov., vol. 23, no. 1, pp. 169–214, 2011. [32] T. De Bie, “Maximum entropy models and subjective interestingness: an application to tiles in binary databases,” Data Min. Knowl. Discov., vol. 23, no. 3, pp. 407–446, 2011. [33] T. Chataing, J. Perez, M. Plantevit, and C. Robardet, “Diffversify: a scalable approach to differentiable pattern mining with coverage regularization,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 2024, pp. 407–422. [34] E. Karabulut, P. Groth, and V. Degeler, “Neurosymbolic association rule mining from tabular data,” in NeSy, 2025, pp. 565–588. [35] A. V. Konstantinov and L. V. Utkin, “Interpretable ensembles of hyperrectangles as base models,” Neural Computing and Applications, vol. 35, no. 29, pp. 21 771–21 795, 2023. [36] Z. Wang, W. Zhang, N. Liu, and J. Wang, “Scalable rule-based representation learning for interpretable classification,” NeurIPS, vol. 34, pp. 30 479–30 491, 2021. [37] Y. Bengio, A. Courville, and P. Vincent, “Representation learning: A review and new perspectives,” IEEE transactions on pattern analysis and machine intelligence, vol. 35, no. 8, pp. 1798–1828, 2013. [38] C. Chen, O. Li, D. Tao, A. Barnett, C. Rudin, and J. K. Su, “This looks like that: deep learning for interpretable image recognition,” in NeurIPS, 2019. [39] I. Higgins, L. Matthey, A. Pal, C. Burgess, X. Glorot, M. Botvinick, S. Mohamed, and A. Lerchner, “beta-vae: Learning basic visual concepts with a constrained variational framework,” in ICLR, 2017. [40] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in NeurIPS, 2017. [41] J. Adebayo, J. Gilmer, M. Muelly, I. Goodfellow, M. Hardt, and B. Kim, “Sanity checks for saliency maps,” in NeurIPS, 2018.

A PPENDIX A P ROOFS We give the complete proofs of the results stated (with sketches) in Sec. IV. A. Proof of Theorem 1 (clipping margin) Proof. Write the code fk (x) = softmaxk (ℓk ), ℓk = P j log Ikj (xj ). Let V be the set of active coordinates on which x exceeds the unit in a fixed direction (say above the upper bound) by margin ≥ η, so Ikj (xj ) ≤ β = σ(−η/τ ) ∈ (0, 12 ) for j ∈ V . There the upper sigmoid saturates and log Ikj (xj ) = − τ1 (xj − ckj ) + O(β), whose x-dependent part −xj /τ is identical across all units k (this uses the same-side hypothesis: for a below-violation the common part is +xj /τ , still unit-independent). Since here all active coordinates are violated, the only non-saturated terms are the inactive ones, which contribute log IP kj ≈ 0. Hence ℓk = c(x) + bk + O(|V |β) with c(x) = − τ1 j∈V xj P common to all k and bk = τ1 j∈V ckj x-independent. As softmax is shift-invariant, f (x) = softmax(b + O(|V |β)), so ∥f (x) − f0 ∥2 ≤ κ(β) = O(|V |β) with f0 = softmax(b) the fixed x-independent empty-activation code. Lipschitzness of gθ gives ∥gθ (f (x)) − gθ (f0 )∥√2 ≤ L κ(β), and the reverse triangle inequality√with ∥ · ∥1 ≤ d ∥ · ∥2 , ∥x − gθ (f (x))∥1 ≥ ∥x − gθ (f0 )∥1 − d L κ(β), divided by d, yields MAE(x) ≥ L 1 √ d ∥x − gθ (f0 )∥1 − d κ(β). Partial violations (Cor. 1). If only sk active coordinates of unit k are violated, the remaining active coordinates contribute x-dependent, unit-specific terms, so f (x) is not forced to a single x-independent code. P What survives is the per-unit P bound ℓk = j log Ikj ≤ j∈V ∩Ak log Ikj ≤ sk log β (every log Ikj ≤ 0), i.e. exp(ℓk ) ≤ β sk : each unit’s unnormalized weight is suppressed geometrically in its number of violated active coordinates, which is the graded statement of Cor. 1. Fig. 2 illustrates this: inliers are preserved while out-ofsupport points are collapsed and thus incur a large error. B. EMA support and encoder regularity Proposition 2 (EMA support: asymptotically unbiased, finite memory). If the per-step support Zt ∈ [0, 1] is strictly stationary with mean µ, the recursion St+1 = ρSt + (1 − ρ)Zt+1 (ρ P ∈ [0, 1)) has a unique stationary limit S∞ = (1 − ρ) m≥0 ρm Z−m with E[S∞ ] = µ, i.i.d. variance σ 2 1−ρ 1+ρ , ef1+ρ t fective sample size 1−ρ , and transient E[St ]−µ = ρ (S0 −µ). Proof. T (X) = ρX + (1 − ρ)Z is an L2 contraction (ρ < 1), with unique fixed point P the absolutely summable moving average S∞ = (1−ρ) m≥0 ρm Z−m . Linearity gives E[S∞ ] = µ; bilinearity ofPcovariance with γ(h) = σ 2 ⊮[h=0] 1+ρ gives Var = σ 2 (1 − ρ)2 m ρ2m = σ 2 1−ρ , i.e. neff = 1−ρ ; Pt1+ρ t−k t and unrolling St = ρ S0 + (1 − ρ) k=1 ρ Zk gives the transient E[St ] − µ = ρt (E[S0 ] − µ). (The same holds for dependent stationary Z with summable autocovariance.)

Proposition 3 (Bounded encoder sensitivity). The D IFF I NT encoder is globally Lipschitz on [−1, 1]d with constant Kτ d ; the constant is expressed in the interpretable model quantities (K, d, τ ). Proof. Let x ∈ [−1, 1]d . With akj = (xj − ckj )/τ and bkj = (ckj − xj )/τ , ∂xj log Ikj = τ1 (σ(bkj ) − σ(aP kj )), hence |∂xj log Ikj | ≤ τ1 and ∥∇x ℓk ∥ ≤ τd for ℓk = j log Ikj . As fk = softmaxk (ℓ) is 1-Lipschitz in ℓ, ∥∇x fk ∥ ≤ τd , and summing over the K outputs gives ∥∇x f ∥ ≤ Kd τ . A spectrally normalized decoder then makes the full autoencoder Lipschitz, the regularity invoked by Thm. 1. C. Proof of Proposition 1 (capacity) Proof. Since D is compact it is Jordan-measurable, so for any ε >S 0 there is a finite union Q of axis-aligned dyadic boxes K C = k=1 Bk , with Bk = j [ckj , ckj ], such that λ(D△C) < ε/2 (λ Lebesgue measure); take these boxes as the units’ xj −c c −x intervals. As τ → 0, Ikj (xj ) = σ( τ kj ) σ( kjτ j ) → 1{xj ∈ [ckj , ckj ]} pointwise except on the box faces (a null Q set), monotonically; hence mk → 1Bk and F = 1 − k (1 − mk ) → 1C pointwise a.e. Because 0 ≤ F ≤ 1, dominated convergence gives a τ with ∥F − 1C ∥L1 < ε/2. With ∥1C − 1D ∥L1 = λ(D△C), the triangle inequality yields ∥F − 1D ∥L1 < ε. Finally, on {dist(·, ∂D) ≥ δ}, refining the dyadic grid so the box faces lie within the shell makes the target locally constant and the boundary sigmoids saturate uniformly, giving uniform convergence there. A PPENDIX B S UPPLEMENTARY: OVERVIEW This appendix reproduces the standalone supplementary material: the full dataset and protocol details, per-dataset robustness ablations, the interpretability-evidence suite, complexity and scalability, the stratified and complete-case reanalysis, and the complete per-dataset ROC–AUC and AUPR tables with per-scale critical-difference diagrams. A PPENDIX C DATASETS AND EXPERIMENTAL PROTOCOL A. Datasets We evaluate on the 48 numerical datasets of the ADBench benchmark, grouped by scale into small (12), medium (15), large (11), and high-dimensional (10). Tables VI–IX list, per dataset, the number of samples, features, and outliers, the outlier percentage, and the batch size used by D IFF I NT (64 for n ≤ 10k, 512 for 10k < n ≤ 20k, 1024 otherwise). The suite spans four orders of magnitude in sample size (n ∈ [80, 6.2×105 ]) and from 3 to 1,555 features, so it stresses both data-scarce and high-dimensional regimes. B. Protocol, baselines, and metrics Protocol. D IFF I NT is trained semi-supervised on inliers only (label 0), with a 40% test split and 10 random seeds, under a single [−1, 1]-normalized configuration shared across all datasets (lr 5×10−5 , K=200, τ =0.1, ρ=0.999, 1000 epochs,

TABLE VI: Small-scale datasets. Dataset 4 breastw 14 glass 15 Hepatitis 18 Ionosphere 21 Lymphography 29 Pima 37 Stamps 39 vertebral 42 WBC 43 WDBC 45 wine 46 WPBC

Samples

Feat.

#Out.

Out. %

Batch

683 214 80 351 148 768 340 240 223 367 129 198

9 7 19 33 18 8 9 6 9 30 13 33

239 9 13 126 6 268 31 30 10 10 10 47

34.99 4.21 16.25 35.90 4.05 34.90 9.12 12.50 4.48 2.72 7.75 23.74

64 64 64 64 64 64 64 64 64 64 64 64

TABLE X: Input normalization. Mapping into a bounded symmetric domain is what matters; among bounded/standardized choices [−1, 1] is the most accurate, within 1.5 points of the others. Dataset

none

[0, 1]

standard

[−1, 1]

45 wine 21 Lymphography 46 WPBC 14 glass 42 WBC 39 vertebral 37 Stamps

0.990 0.990 0.510 0.896 0.990 0.335 0.924

0.932 0.998 0.543 0.886 0.989 0.498 0.921

0.883 0.996 0.541 0.877 0.990 0.511 0.929

0.950 0.994 0.584 0.876 0.998 0.477 0.953

Mean

0.805

0.824

0.818

0.833

TABLE VII: Medium-scale datasets. Dataset 2 annthyroid 6 cardio 7 Cardiotocography 12 fault 19 landsat 20 letter 27 PageBlocks 28 pendigits 30 satellite 31 satimage-2 38 thyroid 40 vowels 41 Waveform 44 Wilt 47 yeast

Samples

Feat.

#Out.

Out. %

Batch

7,200 1,831 2,114 1,941 6,435 1,600 5,393 6,870 6,435 5,803 3,772 1,456 3,443 4,819 1,500

6 21 21 27 36 32 10 16 36 36 6 12 21 5 8

534 176 466 673 1,333 100 510 156 2,036 71 93 50 100 257 20

7.42 9.61 22.04 34.67 20.71 6.25 9.46 2.27 31.64 1.22 2.47 3.43 2.90 5.33 1.33

64 64 64 64 64 64 64 64 64 64 64 64 64 64 64

TABLE VIII: Large-scale datasets. Dataset

Samples

Feat.

#Out.

Out. %

Batch

1 ALOI 8 celeba 10 cover 11 donors 13 fraud 16 http 22 magic.gamma 23 mammography 32 shuttle 33 skin 34 smtp

49,534 202,599 286,048 619,326 284,807 567,498 19,020 11,183 49,097 245,057 95,156

27 39 10 10 29 3 10 6 9 3 3

1,508 4,547 2,747 36,710 492 2,211 6,688 260 3,511 50,859 30

3.04 2.24 0.96 5.93 0.17 0.39 35.16 2.32 7.15 20.75 0.03

1,024 1,024 1,024 1,024 1,024 1,024 512 512 1,024 1,024 1,024

TABLE IX: High-dimensional datasets. Dataset

Samples

Feat.

#Out.

Out. %

Batch

3 backdoor 5 campaign 9 census 17 InternetAds 24 mnist 25 musk 26 optdigits 35 SpamBase 36 speech 48 arrhythmia

95,329 41,188 299,285 1,966 7,603 3,062 5,216 4,207 3,686 452

196 62 500 1,555 100 166 64 57 400 274

2,329 4,640 18,568 368 700 97 150 1,679 61 66

2.44 11.27 6.20 18.72 9.21 3.17 2.88 39.91 1.65 14.60

1,024 1,024 1,024 64 64 64 64 64 64 64

Adam); no hyper-parameter is tuned per dataset. Baselines. We compare against 22 baselines from the ADBench/TCCM codebase: classical detectors (ABOD, LOF, PCA, KPCA, OCSVM,

ECOD, CBLOF, KDE, GMM, MCD, HBOS, IForest, LMDD, QMCD, Sampling) and deep/inductive ones (AutoEncoder, VAE, DIF, LUNAR, SO/MO GAAL, and the flow-matching model TCCM); together with D IFF I NT this gives the 23 methods ranked in the tables. All methods share the same [−1, 1] normalization. Metrics. We report ROC–AUC (area under the ROC curve) and AUPR (average precision); both are thresholdfree and higher-is-better. Missing runs. A few baselines did not complete on the largest datasets within budget; each such run is floored to the worst rank (the number of methods) on that dataset, the standard conservative convention used in the main paper. How to read the result tables. In every perdataset table (Tables XXIII–XL) each cell is mean±std (rank) over the 10 seeds, and the parenthesised rank is coloured per column: (1) = best, (2) = second, (3) = third. A PPENDIX D ROBUSTNESS ABLATIONS We expand the main-paper ablations to per-dataset numbers on seven small datasets (n ≥ 100; K=200, 3 seeds; ROC–AUC), probing two design choices; Hepatitis (n=80) is excluded as too small for a stable inlier-only test split. Normalization (Table X): mapping into a bounded symmetric domain is what matters. Dropping it (“none”) is the only choice that collapses on several datasets, while among bounded/standardized choices [−1, 1] is the most accurate, within 1.5 points of [0, 1] and StandardScaler; we adopt it because it makes the theory transfer (main text, Sec. III-B) and it is also the top performer. Training contamination (Table XI): injecting anomalies into the “inlier” training set degrades accuracy gracefully rather than catastrophically, since the EMA support averages over batches so a minority of contaminating points cannot dominate the learned intervals. A PPENDIX E ROBUSTNESS STUDIES We report four robustness checks beyond the per-dataset ablations: the ranking aggregation under different missing-run handlings, sensitivity of detection to the sigmoid temperature τ , sensitivity of the certified clipping check to the activecoordinate threshold, and the per-layer spectral norms of the Certified-Lipschitz decoder.

TABLE XI: Training contamination: ROC–AUC vs. fraction of anomalies injected into the “inlier” training set. Degradation is graceful. Dataset

0%

5%

10%

20%

45 wine 21 Lymphography 46 WPBC 14 glass 42 WBC 39 vertebral 37 Stamps

0.950 0.994 0.584 0.876 0.998 0.477 0.953

0.659 0.978 0.565 0.755 0.979 0.458 0.865

0.645 0.970 0.570 0.728 0.982 0.432 0.816

0.624 0.973 0.520 0.726 0.976 0.456 0.766

Mean

0.833

0.751

0.735

0.720

TABLE XII: Overall mean rank under three missing-run handlings (lower is better). A: worst-rank floor (paper); B: exclude datasets where any baseline failed (39/48); C: perdataset median imputation. Rank (ROC–AUC)

Rank (AUPR)

Method

A

B

C

A

B

C

D IFF I NT LUNAR TCCM AutoEncoder GMM IForest VAE CBLOF

4.10 6.00 8.22 7.42 8.56 8.60 8.90 9.20

4.38 4.77 8.55 7.46 8.73 8.46 9.32 8.76

4.10 5.07 8.22 7.05 8.20 8.60 8.90 8.83

4.16 4.91 7.36 8.05 8.54 9.89 9.64 8.90

4.45 4.50 7.88 8.04 8.65 9.42 10.05 8.54

4.16 4.54 7.36 7.69 8.18 9.89 9.64 8.53

a) Ranking sensitivity to missing-run handling (Table XII).: The protocol floors a method’s missing runs to the worst rank, which is the standard convention but favours methods that ran everywhere. We recompute the overall mean rank under two alternatives: (B) drop the 9 datasets where at least one method failed (kept 39/48), and (C) impute missing ranks by the per-dataset median of the methods that ran. D IFF I NT holds the lowest mean rank on both metrics under all three schemes. The smallest gap is AUPR scheme B (0.05 above LUNAR); the largest is AUC scheme A (1.90). The topcluster conclusion of the main text is therefore not an artefact of how missing runs are aggregated. b) Temperature τ sensitivity (Table XIII).: We sweep τ ∈ {0.05, 0.10, 0.20, 0.50} at K=200, 200 epochs on three small datasets. The paper’s default τ =0.1 is within 0.06 AUC of the best τ on every dataset. The only setting that hurts substantially is τ =0.05 on G LASS, where the sigmoid is too sharp for a small dataset’s interval shapes to settle. Robustness across τ ∈ [0.1, 0.5] argues for a single shared τ rather than a per-feature τj . c) Active-coordinate threshold sensitivity (Table XIV).: The certified clipping inequality of Theorem 1 holds for points that violate every active coordinate of at least one unit. “Active” is operationalised as mean inlier membership I¯kj < θ for some θ (the paper uses θ=0.9). We vary θ ∈ {0.70, 0.80, 0.90, 0.95} and report the fraction of test anomalies that meet the strict full-violation hypothesis. A lower θ makes the active set sparser (fewer coordinates per

TABLE XIII: ROC–AUC vs. temperature τ (DiffInt-PA, K=200, 200 epochs, seed 0). The paper default τ =0.1 is competitive on every dataset; performance degrades sharply only at τ =0.05 on G LASS. Dataset

τ =0.05

τ =0.10

τ =0.20

τ =0.50

G LASS I ONOSPHERE C ARDIO

0.619 0.950 0.931

0.810 0.963 0.969

0.857 0.967 0.961

0.810 0.966 0.960

TABLE XIV: Fraction of test anomalies that satisfy the strict full-violation hypothesis of Theorem 1 as the active-coordinate threshold θ varies (Certified-Lipschitz DiffInt, K=200, 200 epochs, seed 0). Mean active coordinates per unit is also reported. out-of-support fraction Dataset G LASS I ONOSPHERE C ARDIO

mean active/unit

θ=0.70

0.80

0.90

0.95

0.70

0.80

0.90

0.95

1.00 1.00 0.16

1.00 0.14 0.00

1.00 0.10 0.00

0.00 0.09 0.00

0.2 1.0 12.2

0.9 11.6 14.8

2.5 17.1 17.7

4.0 29.3 20.0

TABLE XV: Per-layer spectral norm ∥Wl ∥2 of the CertifiedLipschitz decoder (two-layer ReLU MLP, hidden h=128) on Q three datasets. ReLU contributes 1 to the product. L = l ∥Wl ∥2 is an explicit upper bound on the decoder’s Lipschitz constant. Dataset

∥W1 ∥2

ReLU

∥W2 ∥2

G LASS I ONOSPHERE C ARDIO

1.022 1.071 1.010

1.000 1.000 1.000

1.006 1.007 1.000

L=

Q

∥Wl ∥2

1.028 1.078 1.010

unit), which makes the strict hypothesis easier to satisfy but covers fewer of the unit’s coordinates; a higher θ does the reverse. The fraction is therefore dataset-dependent: high when units keep few active coordinates (G LASS, 2–3 active/unit at θ=0.9, 100%) and low when they keep many (C ARDIO, ∼18 active/unit, 0% at θ=0.9 and 16% at θ=0.7). Under the remaining anomalies the graded suppression of Corollary 1 applies – it down-weights the matched units but gives no reconstruction-error bound. We do not tune θ as a hyperparameter; we report the strict regime as a verifiable sanity check rather than a guarantee that holds pointwise, and the MAE inequality of Theorem 1(ii) is in any case satisfied for every out-of-support point under the Certified-Lipschitz decoder (Table V). d) Per-layer spectral norms of the certified decoder (Table XV).: When the decoder is spectrally normalized (the Certified-Lipschitz variant), each linear layer carries a spectral norm slightly above 1 (1.00–1.08 on the datasets tested) and the ReLU Q between them is exactly 1-Lipschitz. The product L = l ∥Wl ∥2 stays close to 1 (1.03–1.08), so the clippingmargin bound’s slack √Ld κ(β) is small. e) Inference clamping isolated from normalization (Table XVI).: At inference the test features are MinMax-scaled by the train scaler and clipped to [−1, 1]. To isolate the effect

TABLE XVI: Effect of inference clamping in isolation. “clip” is the paper default (clip scaled test features to [−1, 1]); “noclip” passes the scaled features through unchanged. next is the number of test points with at least one feature outside [−1, 1] after train-scaling. AUC differences are at most 0.012; clipping never re-orders the leading score on the full test set. AUC on full test

|∆score|

Dataset

ntest

next

clip

no-clip

(extreme pts)

G LASS I ONOSPHERE C ARDIO

86 141 733

5 0.810 70 0.963 62 0.969

0.798 0.969 0.971

0.10 0.04 0.12

TABLE XVII: LFI stability across 5 training seeds (different splits and initializations). Per-feature LFI is the max over units; pairwise Spearman is computed across all 10 seed pairs. Higher is more stable. Dataset

d

mean ρ

min ρ

std ρ

G LASS I ONOSPHERE C ARDIO

7 32 21

0.74 0.88 0.92

0.57 0.84 0.83

0.11 0.03 0.04

of the clip from the effect of the scaling itself, we score every test point twice: once after clipping, once with the raw scaled values left unchanged (so any feature above 1 or below −1 stays where it is). The overall AUC differences are within 0.012 on the three datasets tested, and remain small (≤ 0.009) even on the “extreme” subset of test points where at least one feature lies outside [−1, 1] after the train scaler is applied. The mean absolute change in the anomaly score on extreme points is 0.04–0.12, i.e. clipping nudges individual scores but rarely re-orders them. Consistent with the structural argument (clamping can only lower memberships), we observe no case where clipping masks an anomaly. f) LFI stability across seeds (Table XVII).: The third LFI factor, stabkj , encodes inverse cross-seed spread. To check that LFI itself ranks features stably across re-runs we train 5 seeds per dataset (varying the train/test split and the model initialization), aggregate LFI per feature as maxk LFIkj , and compute the pairwise Spearman rank correlation across the ten seed-pairs. The mean correlation is 0.74 on G LASS (small data with only 7 features), 0.88 on I ONOSPHERE, and 0.92 on C ARDIO, with minimum pair 0.57/0.84/0.83 respectively. LFI surfaces the same per-feature constraints in ≥ 75% of pairs even on the smallest dataset, and the larger feature spaces are very stable. A PPENDIX F I NTERPRETABILITY AS EVIDENCE We support the two interpretability claims of the main text with quantitative measurements (K=200, 3 seeds; Table XVIII). (1) Label-free ranking (LFI). We rank (unit, feature) constraints by the label-free importance LFIkj = skj · (1 − ∆kj /rangej ) · stabkj (support × tightness × stability), using

TABLE XVIII: Faithfulness perturbation test: score rise from crossing the top-LFI feature boundaries (∆top ) vs. random features (∆rand ), their ratio, and the fraction of inliers with ∆top > ∆rand . Dataset

∆top

∆rand

ratio

% top>rand

14 glass 42 WBC 18 Ionosphere 29 Pima 6 cardio

0.200 0.094 0.105 0.171 0.119

0.134 0.074 0.078 0.100 0.066

1.48 1.26 1.34 1.70 1.80

71% 62% 64% 71% 79%

Mean

0.138

0.091

1.52

69%

TABLE XIX: Conciseness and human-readability proxies (K=200, 3 seeds). #feat80% : features (ranked by per-feature error) explaining 80% of a flagged point’s score; active/unit: mean number of active features (I¯kj < 0.9) per top interval unit; width: mean active-interval width as a fraction of the [−1, 1] range. Dataset

d

#feat80%

active/unit

width

14 glass 42 WBC 18 Ionosphere 29 Pima 6 cardio

9 30 33 8 21

4.8 16.0 17.9 4.6 11.0

6.7 24.8 29.8 5.3 17.2

0.70 0.69 0.70 0.70 0.70

Mean

20

10.8

16.8

0.70

only quantities the trained model already maintains. This is the only ranking we use in the main text (Sec. V); it requires no anomaly label and is computable in closed form from the model parameters and the EMA support buffer. (2) Faithfulness perturbation. For each test inlier we perturb its top-LFI features to cross their interval boundaries and measure the anomaly-score rise ∆top , against perturbing the same number of random features ∆rand . The top-ranked constraints raise the score 1.5× more on average (on 69% of inliers; Table XVIII), so the LFI-highlighted constraints causally drive the score rather than merely correlating with it. (3) Conciseness and readability. For a flagged point, the per-feature reconstruction error concentrates: on average ≈half the features (10.8 of 20; Table XIX) account for 80% of the anomaly score, so a short shortlist suffices to explain it. The interval units themselves are soft and wide (mean width 0.70 of the feature range, and a unit softly constrains most coordinates by the membership criterion of Def. 1), which is precisely why we present intervals as candidate constraints rather than crisp rules and surface only the top-k by LFI (k = 2 in the mainpaper read-out) rather than a whole unit. A PPENDIX G Q UANTITATIVE STUDY OF THE GLOBAL LFI RANKING Reviewers asked for a systematic quantitative comparison of LFI against established explanation methods. LFI is a global interpretability readout, not a per-instance explainer: from the trained model alone it ranks the learned interval

TABLE XX: The zero-query global LFI feature ranking vs. the same ranking from aggregated post-hoc attributions (mean | · | over a pool of flagged anomalies), inside D IFF I NT’s regime: three controlled families (d ∈ {20, 28, 36}, 6–14 tightlyconstrained coordinates among broad ones, 7 re-trainings total) in which every anomaly is a marginal violation of the tight coordinates. sep-AUC: does the ranking put the relevant coordinates first? agree: mean Spearman ρ with the LFI ranking. stab.: mean cross-seed Spearman ρ. sanity: ρ with the ranking from a weight-randomised model (support re-estimated identically; low is good). Gini: concentration of the vector. q: model passes per pooled anomaly. Method LFI (global) grad×input (agg.) IntGrad (agg.) KernelSHAP (agg.) ECOD-tail (agg.)

sep-AUC agree stab. sanity Gini 1.00 1.00 1.00 1.00 1.00

– +0.71 +0.69 +0.72 +0.74

q

0.71 +0.01 0.11 0 0.69 – 0.33 1 0.66 – 0.45 24 0.67 – 0.58 120 0.67 – 0.47 0

constraints – aggregated over units, the features – by support × tightness × cross-seed stability (Sec. F), returning one ranking for the whole model. We evaluate that global ranking against the same ranking recovered by aggregating post-hoc attributions (mean | · | over a pool of flagged anomalies): gradient×input, integrated gradients (24 steps), KernelSHAP (120 background samples), and the detection-native ECOD tail surprise − log 2 min(Fj , 1−Fj ). All four attribute the same D IFF I NT score. a) Scope.: LFI is built entirely from per-feature interval tightness and support, so it is informative exactly in D IFF I NT’s own design regime: marginal, axis-aligned anomalies whose signal is visible coordinate-by-coordinate, violating coordinates the model constrains tightly. We evaluate strictly inside that regime. Anomalies visible only in feature interactions are the detector’s documented blind spot (Sec. VI-H) and lie outside the scope of any per-feature diagnostic. b) Protocol.: D IFF I NT is trained inliers-only under the paper configuration (K=200, τ =0.1). We use three controlled families, 7 re-trainings in total: d ∈ {20, 28, 36}, with 6– 14 tightly distributed coordinates among broad ones, and every anomaly a marginal violation of the tight coordinates – so the relevant set is fixed and known. Metrics: sep-AUC (does the global ranking put the relevant coordinates first?), agreement with each aggregated post-hoc ranking (Spearman ρ), cross-seed rank stability over the re-trainings, a modelrandomisation sanity check [41] (rank ρ against the same score on a weight-randomised model whose support is re-estimated identically; low is good), attribution concentration (Gini), and model queries. c) Findings.: (1) The relevant coordinates are recovered. In this regime the marginal signal is clear, and every ranking – including the zero-query LFI vector – separates the relevant coordinates from the rest with sep-AUC 1.00 (Table XX). (2) LFI reproduces what the expensive methods report. The LFI ranking agrees with the aggregated KernelSHAP / integrated-

grad×input (agg.) (1 q/anom.)

0.71

IntGrad (agg.) (24 q/anom.)

0.69

KernelSHAP (agg.) (120 q/anom.)

0.72

ECOD-tail (agg.) (0 q/anom.)

0.74

0.0 0.2 0.4 0.6 0.8 1.0 Spearman with the (zero-query) LFI ranking Fig. 7: Spearman ρ between the zero-query LFI feature ranking and each aggregated post-hoc ranking, with the model-query cost each post-hoc ranking pays. The LFI ranking reproduces the same global picture (ρ ≈ 0.7) that KernelSHAP buys with 120 model passes per pooled anomaly.

gradients / gradient rankings at Spearman ρ = 0.69–0.74 (Fig. 7) – the same ordering, not merely the same top set – read off the model parameters at zero model queries, against up to 120 passes per pooled anomaly for the gradient- and samplingbased methods. (3) LFI is stable and passes the sanity check. Cross-seed rank stability ρ = 0.71 over these re-trainings, on par with KernelSHAP (0.67) and the gradient methods (0.66– 0.69); it is marginally below the ρ ≥ 0.74 measured with the same per-feature statistic on real ADBench data (App. E, Table XVII) because here roughly half the coordinates are constrained near-equally, so their relative order is intrinsically noisier. Rank correlation with a weight-randomised model is ρ ≈ 0.0, so the ranking reflects what was learned rather than the architecture. The LFI vector is also the least spiky (Gini 0.11 vs. 0.33–0.58): it flags a set of comparably diagnostic constraints rather than a single coordinate. Bottom line: within the axis-aligned regime D IFF I NT is built for, the global LFI ranking carries the same information as an aggregated KernelSHAP ranking costing hundreds of model queries, at no cost, and it is stable and model-faithful. Outside that regime it is not a substitute for a per-instance attributor, and we do not present it as one. A PPENDIX H C OMPLEXITY AND SCALABILITY Practical deployability matters as much as accuracy, so we summarize the resource profile of D IFF I NT. Let n be the number of training points, d the feature count, K the number of interval units, B the batch size, E the epochs, and H the (fixed) decoder hidden width; the decoder is an MLP whose size is independent of n. Parameter count. The interval bottleneck stores a centre and a softplus half-width per (unit, feature): 2Kd parameters, linear in K and d and independent of n. The decoder adds a compact MLP (O(KH + Hd) weights). The total stays MLP-class (105 –106 weights even at d=1,555, InternetAds), far below typical deep tabular detectors. Table XXI reports

TABLE XXI: Resource profile across scales (K=200). Bottleneck parameters (2Kd) are linear in d and independent of n; training time (D IFF I NT, matched 1000-epoch budget) is reproduced from Table III and grows with n and d. Dataset 6 cardio 31 satimage-2 26 optdigits 48 arrhythmia 32 shuttle

n

d

bottleneck 2Kd

train (s)

1,831 5,803 5,216 452 49,097

21 36 64 274 9

8,400 14,400 25,600 109,600 3,600

3.0 54.6 60.1 30.2 193.5

the 2Kd bottleneck size and the matched-budget training time across scales. Training complexity. A minibatch computes Bd sigmoid pairs for the soft memberships, an O(BKd) aggregation (a per-unit log-sum over features plus an O(K) softmax), and one decoder forward/backward; an epoch is thus O(nKd) plus the n-independent decoder cost, with no pairwise, kernel, or neighbour computation. Total training is O(E nKd). Runtime vs. baselines. D IFF I NT uses one forward pass per sample, unlike memory-based detectors (e.g. LUNAR) whose kNN queries grow with n. Empirically (Table III, matched 1000-epoch budget) D IFF I NT trains one to two orders of magnitude faster than the binary differentiable miner BinaPs, faster than LUNAR on most datasets, and scales to the largest ADBench sets (n ≈ 6.2×105 ). Inference and memory footprint. Scoring a point is a single forward pass: O(Kd) memberships, the aggregation, the decoder, then the MAE. D IFF I NT is inductive: it keeps only the trained parameters, not the training set, so inference latency and memory are constant in n, whereas transductive/memorybased detectors must retain or query the data. The training footprint is the parameters (O(Kd)), one batch of memberships (O(BKd) activations), and the K × d EMA support buffer (O(Kd)); none depends on n. At inference only the O(Kd) parameters and a single K × d membership tensor are held. The K knob. K trades capacity for cost linearly. ROC– AUC saturates after a few units (Fig. 4), so K can be reduced well below the default under tight budgets with little accuracy loss; we keep K=200 as one untuned default across all 48 datasets. A PPENDIX I S TRATIFIED AND COMPLETE - CASE COMPARISON D IFF I NT and three baselines (TCCM, AutoEncoder, VAE) train on inliers only; the other 19 baselines run unsupervised on the contaminated data. Pooling all 23 into one meanrank / Nemenyi analysis (Fig. 3) therefore compares across training regimes, which reviewers rightly flagged. Using the same per-dataset scores as everywhere else (mean over 10 seeds; Tables XXIII–XL), we recompute mean ranks within strata (Table I, placed with the main results; per dataset scale, Table XXII). No model is re-run and no setting is changed. Table I: (i) among inlier-only detectors D IFF I NT is first by a clear margin on both metrics; per scale (Table XXII) its

TABLE XXII: D IFF I NT mean rank within the inlier-only pool of 4, per dataset scale. Best method of the four in each cell shown in brackets. Scale (N ) Small (12) Medium (15) Large (11) High-dim (10)

Rank (ROC–AUC)

Rank (AUPR)

1.83 1.53 1.36 2.10

1.75 1.47 1.45 2.30 (AE 2.20)

inlier-only rank is 1.4–2.1 of 4, best in every scale×metric cell except high-dimensional AUPR, where AutoEncoder leads 2.20 vs. 2.30. (ii) Against the contaminated-data pool alone, D IFF I NT is still first on all 48 datasets; on the completecase subset – which removes the worst-rank imputation the main protocol applies to unfinished runs – D IFF I NT and LUNAR are effectively tied (3.59 vs. 4.03 on AUC, 3.74 vs. 3.85 on AUPR). Adding D IFF I NT to the full 23-method complete-case pool gives mean rank 4.31/4.46 vs. LUNAR 4.82/4.54, consistent with the missing-run sensitivity table (Table XII, scheme B). The “competitive, not beaten” phrasing the main text uses for contaminated-data detectors is thus the accurate reading, and the top-cluster conclusion survives both the stratification and the removal of imputation. A PPENDIX J P OINTS DEFERRED TO A FUTURE VERSION a) Newer detector families.: The 22 baselines are the ADBench/TCCM tabular suite. Families we do not benchmark include diffusion-based reconstruction detectors, retrieval / memory-based detectors, and tabular foundation-model (PFNstyle) scorers. They target the same task from different priors; a controlled comparison, ideally under the same [−1, 1] protocol and inlier-only split, is planned for an extended version. D IFF I NT’s contribution is orthogonal – an interpretable bottleneck, not a new density estimator. b) Normalization coverage.: The main-paper ablation compares no scaling, [0, 1], standardization, and [−1, 1]; it does not include a robust / quantile mapping into [−1, 1]. Such a mapping would keep the bounded symmetric [−1, 1] geometry the temperature and clipping margin rely on while tolerating heavy tails (main text, Limitations), and is the natural next ablation. c) Quantitative interpretability.: Addressed: a systematic comparison of the global LFI feature ranking against aggregated KernelSHAP / integrated-gradients / gradient / ECOD rankings, on three controlled ground-truth families inside D IFF I NT’s regime (7 re-trainings), is in App. G (Table XX, Fig. 7). A PPENDIX K C OMPLETE DETECTION ACCURACY This section reports the full per-dataset detection accuracy underlying the critical-difference analysis of the main text: ROC–AUC (Sec. K-A) and average precision (Sec. K-B). Across both metrics D IFF I NT sits in the leading group on

every scale and is most often first on small/medium/large data; in high dimensions it remains competitive with the strongest baselines. A. ROC–AUC Tables XXIII–XXXI give the per-dataset ROC–AUC. Each cell is the mean score ± standard deviation over the 10 seeds, with the method’s rank on that dataset in parentheses, coloured (1) best, (2) second, (3) third; the same format is used for the AUPR tables (Sec. K-B). Figs. 8–9 show the per-scale criticaldifference diagrams for ROC–AUC and AUPR (the overall diagrams are in the main text). They support the regime-level claims of Table II: D IFF I NT attains the lowest mean rank in every (scale, metric) cell except high-dimensional AUPR, where LUNAR is marginally ahead but the two are statistically indistinguishable within the per-scale CD. B. Average precision (AUPR) Tables XXXII–XL give the per-dataset AUPR under the same protocol and highlighting. AUPR weights the rare anomaly class more heavily than ROC–AUC; the D IFF I NT ranking is consistent across the two metrics, indicating the gains are not an artifact of the chosen measure.

5.0

7.5

10.0

12.5

15.0

17.5

4

20.0

(21) SO_GAAL (20) MO_GAAL (20) KPCA (17) ABOD (16) LMDD (15) QMCD (14) PCA (14) DIF (13) LOF (12) OCSVM (11) ECOD (11) MCD

DiffInt (4.4) LUNAR (6.8) IForest (6.8) CBLOF (7.7) KDE (8.6) AutoEncoder (9.2) HBOS (9.3) VAE (9.5) GMM (9.7) TCCM (9.8) Sampling (10)

6

8

5.0

7.5

10.0

12.5

15.0

(c) Large (n=11).

14

16

18

(19) SO_GAAL (19) MO_GAAL (18) LMDD (18) KPCA (16) PCA (15) OCSVM (15) ABOD (15) LOF (14) QMCD (13) ECOD (12) HBOS (11) KDE

(b) Medium (n=15). 17.5

20.0

22.5

(23) MO_GAAL (21) LMDD (21) KPCA (20) SO_GAAL (15) KDE (15) OCSVM (15) LOF (15) ABOD (15) QMCD (11) HBOS (11) MCD (11) Sampling

DiffInt (3.2) AutoEncoder (4.7) GMM (5.9) LUNAR (7.8) TCCM (8.1) IForest (8.4) VAE (9) CBLOF (9.7) DIF (9.8) ECOD (10) PCA (10)

12

DiffInt (3.8) LUNAR (4.2) AutoEncoder (8) TCCM (8) CBLOF (8.6) IForest (9.1) VAE (9.3) DIF (9.6) GMM (9.7) MCD (9.9) Sampling (11)

(a) Small (n=12). 2.5

10

6

8

10

12

14

16

18

20

22

(22) MO_GAAL (20) SO_GAAL (19) KPCA (18) LMDD (16) QMCD (16) PCA (15) ABOD (15) LOF (14) DIF (13) Sampling (13) OCSVM (12) ECOD

DiffInt (5.2) LUNAR (5.8) TCCM (6.8) AutoEncoder (7.5) VAE (7.5) KDE (7.5) GMM (8.6) MCD (10) IForest (10) CBLOF (11) HBOS (12)

(d) High-dimensional (n=10).

Fig. 8: Per-scale ROC–AUC critical-difference diagrams (missing runs floored to worst rank, bars indicate non-significant differences at α=0.05). D IFF I NT leads strictly on every scale; matches the “D IFF I NT AUC” column of Table II.

5.0

7.5

10.0

12.5

15.0

17.5

20.0

4

(21) SO_GAAL (20) MO_GAAL (19) KPCA (17) ABOD (16) QMCD (15) PCA (15) LMDD (14) DIF (14) LOF (12) OCSVM (11) MCD (11) ECOD

DiffInt (4.3) CBLOF (6.7) LUNAR (7) IForest (8.1) KDE (9) Sampling (9.1) TCCM (9.2) GMM (9.3) AutoEncoder (9.9) VAE (10) HBOS (10)

6

5.0

7.5

10.0

12.5

15.0

(c) Large (n=11).

12

14

16

18

(18) SO_GAAL (18) MO_GAAL (18) LMDD (18) KPCA (16) PCA (16) ABOD (15) OCSVM (15) LOF (13) ECOD (13) QMCD (11) KDE (11) HBOS

(b) Medium (n=15). 17.5

20.0

6

22.5

(22) MO_GAAL (21) KPCA (20) LMDD (20) SO_GAAL (17) ABOD (16) LOF (16) QMCD (14) KDE (13) PCA (12) IForest (11) HBOS (11) MCD

DiffInt (2.7) LUNAR (3.9) TCCM (5.9) AutoEncoder (6.5) GMM (7.3) DIF (7.5) CBLOF (8.9) Sampling (10) VAE (10) ECOD (11) OCSVM (11)

10

DiffInt (3.6) LUNAR (3.6) TCCM (7.5) AutoEncoder (7.8) DIF (8.8) CBLOF (9) GMM (9.6) IForest (9.8) VAE (10) Sampling (11) MCD (11)

(a) Small (n=12). 2.5

8

8

10

12

14

16

18

20

22

(21) MO_GAAL (20) KPCA (20) SO_GAAL (19) LMDD (16) PCA (15) ABOD (15) QMCD (14) LOF (13) DIF (13) OCSVM (13) Sampling (12) ECOD

LUNAR (5.5) DiffInt (6.4) TCCM (6.5) GMM (7.3) VAE (7.6) AutoEncoder (8) KDE (8.1) IForest (10) HBOS (11) MCD (11) CBLOF (11)

(d) High-dimensional (n=10).

Fig. 9: Per-scale AUPR critical-difference diagrams (same protocol as Fig. 8). D IFF I NT leads strictly on small, medium, and large data; on high-dimensional data LUNAR’s mean rank (5.45) is slightly ahead of D IFF I NT (6.40), but the gap is well inside the per-scale Nemenyi CD (≈ 11), i.e. a statistical tie. Matches the “D IFF I NT AUPR” column of Table II.

TABLE XXIII: ROC–AUC, small datasets (1/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

4 breastw

14 glass

15 Hepatitis

18 Ionosphere

21 Lymphography

29 Pima

0.3737±0.0338 (20) 0.9855±0.0075 (12) 0.9939±0.0026 (5) 0.8377±0.0375 (16) 0.9954±0.0018 (1) 0.9932±0.0029 (7) 0.9863±0.0055 (11) 0.9911±0.0036 (8) 0.9942±0.0028 (4) 0.9946±0.0025 (2) 0.1983±0.0825 (21) 0.7050±0.1609 (17) 0.4482±0.0215 (19) 0.9902±0.0046 (10) 0.9850±0.0084 (13) 0.0117±0.0142 (22) 0.9945±0.0025 (3) 0.9495±0.0188 (15) 0.4800±0.1746 (18) 0.0110±0.0116 (23) 0.9934±0.0033 (6) 0.9677±0.0195 (14) 0.9903±0.0045 (9)

0.8264±0.0697 (8) 0.7107±0.0779 (16) 0.8784±0.0345 (3) 0.8562±0.0371 (5) 0.8788±0.0245 (2) 0.6911±0.0797 (17) 0.7508±0.0624 (14) 0.7848±0.0621 (12) 0.7855±0.0429 (11) 0.7622±0.0454 (13) 0.3975±0.1372 (20) 0.3743±0.1793 (22) 0.8048±0.0784 (9) 0.8816±0.0359 (1) 0.7869±0.0347 (10) 0.3744±0.2277 (21) 0.4470±0.1473 (19) 0.6551±0.0838 (18) 0.8423±0.0490 (6) 0.3392±0.1817 (23) 0.8696±0.0480 (4) 0.8334±0.0914 (7) 0.7148±0.0655 (15)

0.6542±0.1520 (19) 0.8501±0.0387 (2) 0.8089±0.0874 (10) 0.7723±0.0901 (16) 0.8333±0.0401 (7) 0.8402±0.0550 (3) 0.8018±0.0785 (13) 0.8342±0.0407 (6) 0.8348±0.0613 (5) 0.7942±0.0540 (14) 0.4379±0.1895 (21) 0.5742±0.1757 (20) 0.8211±0.0761 (8) 0.7782±0.0579 (15) 0.8088±0.0621 (11) 0.3695±0.1895 (22) 0.8088±0.0630 (11) 0.8120±0.0635 (9) 0.7150±0.1246 (18) 0.3134±0.1751 (23) 0.7645±0.0976 (17) 0.8394±0.0708 (4) 0.8600±0.0425 (1)

0.9255±0.0185 (11) 0.9604±0.0090 (5) 0.9557±0.0223 (7) 0.9587±0.0074 (6) 0.9757±0.0030 (2) 0.7745±0.0221 (17) 0.9664±0.0071 (3) 0.7334±0.0519 (18) 0.9116±0.0189 (13) 0.9520±0.0105 (8) 0.4606±0.0632 (21) 0.6665±0.1000 (19) 0.8665±0.0479 (14) 0.9781±0.0085 (1) 0.9616±0.0092 (4) 0.3329±0.0612 (22) 0.8405±0.0192 (15) 0.7864±0.0215 (16) 0.5509±0.0455 (20) 0.2823±0.0611 (23) 0.9395±0.0256 (10) 0.9400±0.0158 (9) 0.9206±0.0155 (12)

0.9682±0.0240 (18) 0.9904±0.0087 (12) 0.9816±0.0438 (15) 0.8833±0.0992 (19) 0.9997±0.0014 (2) 0.9990±0.0022 (4) 0.9873±0.0092 (13) 0.9975±0.0045 (8) 0.9991±0.0019 (3) 0.9988±0.0025 (5) 0.4137±0.2537 (20) 0.9759±0.0186 (17) 0.9988±0.0025 (5) 0.9906±0.0112 (11) 0.9861±0.0140 (14) 0.0085±0.0148 (22) 0.9988±0.0025 (5) 0.9962±0.0058 (9) 0.0884±0.1204 (21) 0.0049±0.0108 (23) 0.9780±0.0359 (16) 1.0000±0.0000 (1) 0.9932±0.0068 (10)

0.6548±0.0408 (14) 0.7070±0.0239 (10) 0.7006±0.0232 (11) 0.6144±0.0258 (19) 0.7304±0.0113 (3) 0.6374±0.0239 (16) 0.7202±0.0217 (7) 0.7339±0.0201 (2) 0.7272±0.0275 (5) 0.7208±0.0226 (6) 0.4976±0.0274 (21) 0.6293±0.0860 (18) 0.6348±0.0227 (17) 0.7296±0.0286 (4) 0.7158±0.0222 (8) 0.3319±0.0499 (23) 0.6797±0.0246 (12) 0.6377±0.0241 (15) 0.7417±0.0239 (1) 0.3350±0.0491 (22) 0.7115±0.0369 (9) 0.5562±0.1001 (20) 0.6714±0.0323 (13)

TABLE XXIV: ROC–AUC, small datasets (2/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

37 Stamps

39 vertebral

42 WBC

43 WDBC

45 wine

46 WPBC

0.6954±0.0525 (19) 0.9217±0.0398 (10) 0.9457±0.0235 (4) 0.9426±0.0215 (5) 0.9516±0.0116 (1) 0.9157±0.0244 (13) 0.9270±0.0226 (9) 0.9375±0.0146 (7) 0.9485±0.0202 (2) 0.9309±0.0174 (8) 0.4111±0.1136 (21) 0.4454±0.0266 (20) 0.7229±0.1204 (18) 0.9473±0.0248 (3) 0.8368±0.0255 (17) 0.2743±0.1774 (22) 0.9027±0.0260 (14) 0.9197±0.0195 (12) 0.9025±0.0571 (15) 0.2334±0.1414 (23) 0.9210±0.0424 (11) 0.8880±0.0393 (16) 0.9404±0.0175 (6)

0.4214±0.0847 (18) 0.4644±0.1041 (12) 0.4711±0.0742 (10) 0.5781±0.0895 (3) 0.5274±0.0429 (4) 0.4645±0.0796 (11) 0.4909±0.0550 (8) 0.3982±0.0437 (21) 0.4426±0.1017 (15) 0.4096±0.0856 (20) 0.5204±0.0619 (6) 0.4355±0.0811 (16) 0.3515±0.0717 (23) 0.4484±0.0817 (13) 0.4872±0.0529 (9) 0.6858±0.0735 (1) 0.4294±0.0843 (17) 0.3973±0.0598 (22) 0.4114±0.0871 (19) 0.6801±0.0693 (2) 0.4449±0.1259 (14) 0.5183±0.0730 (7) 0.5244±0.0725 (5)

0.9297±0.0301 (18) 0.9841±0.0220 (12) 0.9961±0.0039 (2) 0.7821±0.0531 (19) 0.9973±0.0050 (1) 0.9953±0.0046 (6) 0.9767±0.0198 (16) 0.9896±0.0093 (9) 0.9948±0.0049 (7) 0.9960±0.0045 (3) 0.3710±0.2036 (20) 0.9769±0.0615 (15) 0.9759±0.0198 (17) 0.9794±0.0237 (14) 0.9807±0.0230 (13) 0.0050±0.0063 (23) 0.9960±0.0045 (3) 0.9907±0.0091 (8) 0.3578±0.1567 (21) 0.0056±0.0065 (22) 0.9871±0.0271 (11) 0.9960±0.0063 (3) 0.9873±0.0166 (10)

0.9143±0.0504 (18) 0.9937±0.0055 (2) 0.9860±0.0099 (14) 0.7227±0.0519 (19) 0.9741±0.0076 (16) 0.9870±0.0068 (11) 0.9882±0.0093 (9) 0.9890±0.0063 (7) 0.9903±0.0056 (4) 0.9864±0.0075 (13) 0.2678±0.0890 (21) 0.9941±0.0033 (1) 0.9871±0.0088 (10) 0.9935±0.0055 (3) 0.9682±0.0141 (17) 0.0074±0.0074 (22) 0.9887±0.0057 (8) 0.9868±0.0058 (12) 0.5860±0.1903 (20) 0.0060±0.0051 (23) 0.9817±0.0095 (15) 0.9899±0.0077 (5) 0.9897±0.0076 (6)

0.5828±0.2278 (20) 0.9364±0.0499 (6) 0.9517±0.0376 (2) 0.7978±0.1078 (17) 0.8852±0.0594 (13) 0.8484±0.0960 (14) 0.9677±0.0268 (1) 0.9296±0.0419 (9) 0.9393±0.0441 (5) 0.9336±0.0339 (7) 0.3955±0.2631 (21) 0.6987±0.1469 (18) 0.9115±0.0592 (12) 0.9478±0.0439 (3) 0.9444±0.0521 (4) 0.0320±0.0388 (22) 0.8410±0.0944 (16) 0.8450±0.0888 (15) 0.6633±0.1655 (19) 0.0248±0.0276 (23) 0.9328±0.0487 (8) 0.9261±0.0498 (10) 0.9259±0.0335 (11)

0.4897±0.0563 (19) 0.5178±0.0481 (11) 0.5280±0.0407 (9) 0.4971±0.0485 (18) 0.5652±0.0222 (1) 0.5029±0.0422 (17) 0.5141±0.0507 (12) 0.5483±0.0532 (5) 0.5287±0.0451 (8) 0.5603±0.0511 (2) 0.4644±0.0961 (21) 0.5125±0.0619 (14) 0.5326±0.0635 (7) 0.5536±0.0417 (3) 0.5277±0.0682 (10) 0.4373±0.0912 (22) 0.5137±0.0344 (13) 0.5096±0.0543 (15) 0.5343±0.0571 (6) 0.4272±0.0797 (23) 0.5505±0.0742 (4) 0.4841±0.0688 (20) 0.5083±0.0451 (16)

TABLE XXV: ROC–AUC, medium datasets (1/3). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

2 annthyroid

6 cardio

7 Cardiotocography

12 fault

19 landsat

20 letter

0.7439±0.0124 (13) 0.8612±0.0192 (6) 0.6578±0.0179 (17) 0.8025±0.0282 (10) 0.8330±0.0094 (8) 0.8249±0.0099 (9) 0.8412±0.0270 (7) 0.7367±0.0502 (14) 0.9183±0.0069 (2) 0.5866±0.0150 (21) 0.7473±0.0161 (12) 0.5926±0.0166 (20) 0.7080±0.0130 (15) 0.8971±0.0168 (3) 0.9216±0.0065 (1) 0.5521±0.0633 (22) 0.5951±0.0141 (19) 0.6734±0.0175 (16) 0.7681±0.0130 (11) 0.5461±0.0616 (23) 0.6445±0.0226 (18) 0.8840±0.1138 (4) 0.8821±0.0227 (5)

0.5877±0.0275 (19) 0.9307±0.0271 (12) 0.9546±0.0043 (7) 0.9570±0.0075 (6) 0.9721±0.0050 (2) 0.9519±0.0047 (10) 0.9448±0.0075 (11) 0.8513±0.0151 (15) 0.9524±0.0094 (8) 0.9624±0.0015 (5) 0.4696±0.0601 (21) 0.5774±0.0236 (20) 0.7194±0.0416 (17) 0.9631±0.0038 (4) 0.8603±0.0172 (14) 0.2338±0.1069 (23) 0.9521±0.0034 (9) 0.7263±0.2385 (16) 0.7117±0.0402 (18) 0.2399±0.1106 (22) 0.8934±0.0399 (13) 0.9775±0.0094 (1) 0.9673±0.0092 (3)

0.4917±0.0184 (21) 0.7202±0.0335 (12) 0.7815±0.0315 (8) 0.6877±0.0171 (15) 0.8023±0.0122 (6) 0.8322±0.0096 (3) 0.7507±0.0134 (10) 0.6938±0.0249 (14) 0.8110±0.0260 (5) 0.8378±0.0079 (2) 0.4918±0.0441 (20) 0.7130±0.0214 (13) 0.5736±0.0207 (18) 0.7980±0.0203 (7) 0.6641±0.0230 (16) 0.4305±0.1216 (22) 0.8493±0.0079 (1) 0.5786±0.1266 (17) 0.5658±0.0256 (19) 0.4256±0.1214 (23) 0.7324±0.0492 (11) 0.7653±0.0441 (9) 0.8153±0.0201 (4)

0.6928±0.0110 (10) 0.7386±0.0188 (4) 0.7094±0.0358 (8) 0.7386±0.0145 (4) 0.7976±0.0044 (2) 0.4919±0.0126 (20) 0.7024±0.0160 (9) 0.6047±0.0649 (15) 0.6565±0.0253 (11) 0.7583±0.0132 (3) 0.5139±0.0176 (19) 0.5351±0.0282 (18) 0.6000±0.0126 (16) 0.8110±0.0120 (1) 0.6222±0.0350 (13) 0.4666±0.0522 (22) 0.5551±0.0202 (17) 0.4850±0.0191 (21) 0.6437±0.0409 (12) 0.4652±0.0450 (23) 0.7165±0.0336 (7) 0.7362±0.0257 (6) 0.6082±0.0315 (14)

0.5164±0.0127 (17) 0.5773±0.0111 (13) 0.6907±0.0179 (3) 0.5947±0.0167 (11) 0.6540±0.0045 (5) 0.3959±0.0111 (21) 0.4967±0.0096 (19) 0.6991±0.0124 (2) 0.6003±0.0210 (10) 0.5658±0.0105 (15) 0.5017±0.0162 (18) 0.4150±0.0511 (20) 0.5340±0.0131 (16) 0.7870±0.0066 (1) 0.6155±0.0053 (8) 0.6447±0.0239 (7) 0.3788±0.0105 (22) 0.3652±0.0112 (23) 0.6834±0.0094 (4) 0.5759±0.0248 (14) 0.6522±0.0704 (6) 0.6044±0.0186 (9) 0.5807±0.0081 (12)

0.8652±0.0149 (3) 0.8135±0.0340 (7) 0.7755±0.0370 (9) 0.6661±0.0575 (12) 0.9006±0.0102 (2) 0.5871±0.0418 (17) 0.8473±0.0350 (5) 0.5934±0.0266 (16) 0.6365±0.0459 (13) 0.7064±0.0385 (11) 0.5057±0.0391 (19) 0.4388±0.0308 (21) 0.8203±0.0272 (6) 0.9319±0.0166 (1) 0.8111±0.0230 (8) 0.4041±0.0506 (22) 0.5003±0.0482 (20) 0.5287±0.0401 (18) 0.6183±0.0358 (15) 0.4014±0.0512 (23) 0.7229±0.0388 (10) 0.8574±0.0287 (4) 0.6259±0.0420 (14)

TABLE XXVI: ROC–AUC, medium datasets (2/3). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

27 PageBlocks

28 pendigits

30 satellite

31 satimage-2

38 thyroid

40 vowels

0.7166±0.0251 (20) 0.9434±0.0122 (4) 0.8792±0.0185 (14) 0.9354±0.0115 (5) 0.9500±0.0043 (2) 0.9253±0.0030 (7) 0.9577±0.0054 (1) 0.8133±0.0120 (16) 0.9200±0.0099 (8) 0.8868±0.0099 (13) 0.6020±0.0179 (21) 0.7235±0.0263 (19) 0.7654±0.0132 (17) 0.9353±0.0114 (6) 0.9195±0.0075 (9) 0.2884±0.0932 (23) 0.8962±0.0092 (12) 0.9061±0.0075 (11) 0.7648±0.0253 (18) 0.2970±0.0840 (22) 0.8629±0.0352 (15) 0.9152±0.0262 (10) 0.9477±0.0099 (3)

0.6559±0.0303 (18) 0.9805±0.0078 (5) 0.9760±0.0054 (7) 0.9815±0.0070 (4) 0.9966±0.0011 (2) 0.9329±0.0094 (14) 0.8485±0.0120 (16) 0.9377±0.0095 (12) 0.9695±0.0051 (8) 0.9918±0.0025 (3) 0.5025±0.0867 (20) 0.6073±0.0723 (19) 0.4669±0.0438 (21) 0.9994±0.0005 (1) 0.8298±0.0103 (17) 0.2023±0.0833 (22) 0.9643±0.0051 (9) 0.9360±0.0066 (13) 0.9106±0.0099 (15) 0.1966±0.0956 (23) 0.9379±0.0366 (11) 0.9774±0.0198 (6) 0.9454±0.0062 (10)

0.5619±0.0148 (20) 0.8047±0.0102 (8) 0.8575±0.0259 (4) 0.7886±0.0133 (12) 0.8416±0.0046 (5) 0.6155±0.0115 (16) 0.8028±0.0065 (10) 0.8624±0.0077 (2) 0.7967±0.0151 (11) 0.7678±0.0099 (13) 0.4778±0.0156 (21) 0.4468±0.0678 (22) 0.5634±0.0141 (19) 0.8803±0.0073 (1) 0.8093±0.0073 (7) 0.4177±0.0347 (23) 0.6537±0.0126 (15) 0.5999±0.0117 (18) 0.8605±0.0072 (3) 0.6032±0.1301 (17) 0.8141±0.0294 (6) 0.8029±0.0111 (9) 0.7602±0.0093 (14)

0.7878±0.0471 (18) 0.9975±0.0020 (7) 0.9985±0.0019 (3) 0.9979±0.0017 (4) 0.9993±0.0010 (1) 0.9749±0.0169 (17) 0.9958±0.0013 (10) 0.9841±0.0135 (15) 0.9951±0.0048 (11) 0.9977±0.0031 (6) 0.4588±0.1931 (21) 0.5015±0.1118 (20) 0.4551±0.2150 (22) 0.9978±0.0024 (5) 0.9960±0.0010 (9) 0.2075±0.1385 (23) 0.9859±0.0140 (14) 0.9820±0.0155 (16) 0.9961±0.0036 (8) 0.7099±0.2435 (19) 0.9946±0.0072 (12) 0.9989±0.0014 (2) 0.9872±0.0081 (13)

0.9111±0.0147 (16) 0.9816±0.0080 (7) 0.9354±0.0105 (14) 0.9838±0.0039 (6) 0.9770±0.0047 (8) 0.9859±0.0025 (4) 0.9760±0.0050 (10) 0.9877±0.0039 (3) 0.9878±0.0034 (2) 0.8526±0.0155 (18) 0.3309±0.0614 (23) 0.7074±0.0709 (20) 0.9417±0.0230 (13) 0.9770±0.0053 (8) 0.9852±0.0029 (5) 0.7068±0.0820 (21) 0.8610±0.0151 (17) 0.9571±0.0053 (11) 0.8329±0.0760 (19) 0.6946±0.0803 (22) 0.9239±0.0183 (15) 0.9443±0.0065 (12) 0.9883±0.0027 (1)

0.9440±0.0194 (6) 0.9460±0.0187 (5) 0.9343±0.0234 (7) 0.8136±0.0444 (10) 0.9808±0.0068 (2) 0.6123±0.0509 (18) 0.9480±0.0177 (4) 0.7046±0.0568 (14) 0.7874±0.0307 (11) 0.7116±0.0410 (13) 0.4887±0.0458 (21) 0.5107±0.0551 (20) 0.9497±0.0148 (3) 0.9887±0.0052 (1) 0.7523±0.0651 (12) 0.1081±0.0740 (22) 0.5997±0.0462 (19) 0.6158±0.0514 (17) 0.7020±0.0460 (15) 0.0992±0.0719 (23) 0.8896±0.0486 (9) 0.9339±0.0172 (8) 0.6742±0.0538 (16)

TABLE XXVII: ROC–AUC, medium datasets (3/3). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

41 Waveform

44 Wilt

47 yeast

0.6265±0.0327 (15) 0.6848±0.0565 (12) 0.7546±0.0522 (3) 0.7470±0.0248 (5) 0.7678±0.0178 (1) 0.6140±0.0352 (16) 0.5790±0.0356 (17) 0.6973±0.0316 (11) 0.7332±0.0412 (8) 0.7661±0.0269 (2) 0.5138±0.0243 (21) 0.5173±0.0232 (20) 0.7395±0.0396 (7) 0.7528±0.0484 (4) 0.5783±0.0365 (18) 0.3040±0.0835 (23) 0.5662±0.0422 (19) 0.6432±0.0373 (13) 0.7448±0.0245 (6) 0.3466±0.0815 (22) 0.7022±0.0578 (10) 0.6406±0.0827 (14) 0.7081±0.0266 (9)

0.5544±0.0226 (9) 0.5556±0.0760 (8) 0.3755±0.0282 (19) 0.4179±0.0614 (16) 0.6789±0.0272 (5) 0.3994±0.0286 (18) 0.7295±0.0295 (2) 0.4051±0.0995 (17) 0.4687±0.0343 (10) 0.3569±0.0299 (21) 0.6498±0.0243 (6) 0.4192±0.0570 (15) 0.4265±0.0151 (13) 0.5917±0.0676 (7) 0.8608±0.0102 (1) 0.6966±0.0301 (3) 0.3574±0.0313 (20) 0.4404±0.0234 (12) 0.3565±0.0351 (23) 0.6906±0.0275 (4) 0.4217±0.0380 (14) 0.3567±0.0623 (22) 0.4547±0.0278 (11)

0.4188±0.0212 (18) 0.4561±0.0156 (9) 0.4777±0.0209 (6) 0.3969±0.0183 (23) 0.4926±0.0163 (5) 0.4492±0.0167 (12) 0.4374±0.0190 (14) 0.4213±0.0180 (17) 0.4106±0.0163 (19) 0.4034±0.0169 (20) 0.5649±0.0142 (1) 0.4642±0.0230 (7) 0.4327±0.0215 (15) 0.4477±0.0207 (13) 0.4541±0.0228 (10) 0.5599±0.0385 (3) 0.4260±0.0158 (16) 0.3982±0.0167 (22) 0.3991±0.0196 (21) 0.5642±0.0432 (2) 0.4602±0.0513 (8) 0.5201±0.0587 (4) 0.4500±0.0162 (11)

TABLE XXVIII: ROC–AUC, large datasets (1/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

1 ALOI

8 celeba

10 cover

11 donors

13 fraud

16 http

0.7311±0.0082 (3) 0.5554±0.0126 (6) 0.5449±0.0101 (11) 0.5498±0.0103 (9) 0.5857±0.0067 (4) 0.5326±0.0086 (16) 0.5601±0.0100 (5) 0.5323±0.0091 (17) 0.5382±0.0112 (12) 0.5367±0.0103 (14) 0.5327±0.0114 (15) 0.5322±0.0124 (18) 0.7347±0.0109 (2) 0.7389±0.0114 (1) 0.5262±0.0088 (20) 0.4740±0.0121 (23) 0.5320±0.0086 (19) 0.5485±0.0107 (10) 0.5258±0.0096 (21) 0.4770±0.0113 (22) 0.5376±0.0108 (13) 0.5501±0.0163 (8) 0.5541±0.0084 (7)

0.4706±0.0053 (19) 0.6988±0.0311 (11) 0.6790±0.0629 (12) 0.6636±0.0155 (14) 0.7463±0.0386 (8) 0.7664±0.0030 (7) 0.8076±0.0032 (3) 0.7685±0.0031 (6) 0.7127±0.0194 (9) 0.6675±0.0039 (13) 0.4171±0.0091 (20) 0.6335±0.0069 (15) 0.8246±0.0175 (2) 0.2365±0.0809 (21) 0.7100±0.0033 (10) 0.7851±0.0032 (4) 0.5000±0.0000 (17) 0.4803±0.0248 (18) 0.6126±0.1041 (16) 0.8308±0.0109 (1) 0.7690±0.0035 (5)

0.7391±0.0072 (16) 0.9843±0.0044 (2) 0.9245±0.0174 (9) 0.9787±0.0040 (3) 0.9949±0.0015 (1) 0.9386±0.0019 (6) 0.9505±0.0012 (5) 0.7880±0.0041 (15) 0.8456±0.0235 (12) 0.8716±0.0019 (10) 0.5547±0.0107 (18) 0.7027±0.0025 (17) 0.9251±0.0020 (8) 0.9337±0.0010 (7) 0.8215±0.0030 (14) 0.5161±0.0088 (19) 0.8391±0.0579 (13) 0.8705±0.1019 (11) 0.9745±0.0009 (4)

0.4036±0.0014 (16) 0.9359±0.0100 (3) 0.9159±0.0156 (6) 0.9118±0.0101 (8) 1.0000±0.0000 (1) 0.9215±0.0005 (5) 0.9255±0.0004 (4) 0.7922±0.0016 (13) 0.9124±0.0222 (7) 0.6111±0.0036 (15) 0.8202±0.0993 (12) 0.8240±0.0011 (11) 0.7250±0.0033 (14) 0.3832±0.1452 (17) 0.8793±0.0257 (9) 0.9955±0.0057 (2) 0.8428±0.0458 (10)

0.8889±0.0172 (17) 0.9592±0.0070 (4) 0.9535±0.0052 (9) 0.9528±0.0078 (10) 0.9596±0.0025 (3) 0.9525±0.0057 (11) 0.9597±0.0053 (2) 0.9551±0.0060 (7) 0.9513±0.0063 (12) 0.4976±0.0086 (18) 0.9658±0.0057 (1) 0.9232±0.0077 (16) 0.9501±0.0072 (13) 0.9546±0.0052 (8) 0.9575±0.0059 (5) 0.0751±0.0216 (19) 0.9472±0.0106 (14) 0.9404±0.0136 (15) 0.9574±0.0045 (6)

0.7510±0.0017 (16) 0.9988±0.0012 (6) 0.9949±0.0001 (12) 0.9935±0.0002 (14) 0.9998±0.0022 (1) 0.9880±0.0003 (15) 0.9994±0.0000 (4) 0.9961±0.0014 (8) 0.9938±0.0029 (13) 0.3929±0.0052 (18) 0.9953±0.0037 (10) 0.9995±0.0000 (3) 0.9961±0.0001 (8) 0.9968±0.0002 (7) 0.4447±0.1537 (17) 0.9952±0.0014 (11) 0.9997±0.0007 (2) 0.9994±0.0000 (4)

TABLE XXIX: ROC–AUC, large datasets (2/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

22 magic

23 mammography

32 shuttle

33 skin

34 smtp

0.7930±0.0069 (7) 0.8211±0.0111 (4) 0.8235±0.0062 (3) 0.7822±0.0136 (8) 0.8644±0.0026 (1) 0.6541±0.0055 (19) 0.8040±0.0036 (5) 0.7301±0.0060 (13) 0.7764±0.0148 (9) 0.7624±0.0043 (11) 0.5247±0.0061 (20) 0.5204±0.0306 (21) 0.6790±0.0044 (17) 0.8554±0.0047 (2) 0.7380±0.0043 (12) 0.2031±0.0117 (23) 0.7030±0.0048 (16) 0.6666±0.0062 (18) 0.7157±0.0053 (14) 0.2044±0.0145 (22) 0.7934±0.0237 (6) 0.7748±0.0216 (10) 0.7088±0.0183 (15)

0.5424±0.0121 (21) 0.9114±0.0197 (2) 0.8238±0.0188 (13) 0.8281±0.0231 (12) 0.8803±0.0097 (7) 0.9115±0.0163 (1) 0.8814±0.0198 (6) 0.8706±0.0169 (8) 0.8832±0.0230 (4) 0.8581±0.0153 (9) 0.7860±0.0135 (17) 0.7440±0.0772 (18) 0.8018±0.0235 (15) 0.8817±0.0209 (5) 0.7199±0.1363 (20) 0.1150±0.0270 (22) 0.8486±0.0127 (11) 0.8923±0.0151 (3) 0.7313±0.0276 (19) 0.1149±0.0253 (23) 0.8047±0.0303 (14) 0.8503±0.0335 (10) 0.7924±0.0272 (16)

0.6135±0.0077 (20) 0.9968±0.0010 (3) 0.9871±0.0029 (15) 0.9905±0.0023 (9) 0.9992±0.0004 (2) 0.9962±0.0007 (5) 0.9936±0.0016 (8) 0.9877±0.0037 (13) 0.9965±0.0008 (4) 0.9875±0.0021 (14) 0.9270±0.0039 (17) 0.6638±0.1080 (19) 0.5391±0.0107 (21) 0.9997±0.0002 (1) 0.9898±0.0009 (11) 0.0289±0.0036 (23) 0.9869±0.0022 (16) 0.9899±0.0017 (10) 0.7274±0.0097 (18) 0.0297±0.0039 (22) 0.9892±0.0030 (12) 0.9961±0.0007 (6) 0.9948±0.0012 (7)

0.4064±0.0026 (20) 0.7975±0.0685 (9) 0.9178±0.0035 (3) 0.8759±0.0087 (8) 0.9909±0.0021 (1) 0.5421±0.0011 (18) 0.8885±0.0004 (6) 0.7722±0.0011 (10) 0.8909±0.0043 (5) 0.7324±0.0012 (12) 0.5472±0.0032 (17) 0.9901±0.0015 (2) 0.8844±0.0004 (7) 0.7610±0.0013 (11) 0.4149±0.0026 (19) 0.6219±0.0010 (15) 0.5628±0.2584 (16) 0.9165±0.0304 (4) 0.6414±0.2798 (13) 0.6267±0.0018 (14)

0.8606±0.0198 (9) 0.9285±0.0433 (2) 0.8446±0.0747 (14) 0.8490±0.0617 (13) 0.8961±0.0151 (6) 0.8868±0.0419 (7) 0.8311±0.0862 (16) 0.8528±0.0687 (12) 0.9061±0.0377 (5) 0.8026±0.0518 (17) 0.6184±0.1197 (20) 0.9139±0.0409 (4) 0.9280±0.0266 (3) 0.9508±0.0149 (1) 0.4082±0.0658 (22) 0.7982±0.0538 (18) 0.8348±0.0519 (15) 0.7361±0.0453 (19) 0.4270±0.1116 (21) 0.8701±0.0589 (8) 0.8591±0.0747 (11) 0.8595±0.0712 (10)

TABLE XXX: ROC–AUC, high-dimensional datasets (1/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

3 backdoor

5 campaign

9 census

17 InternetAds

24 mnist

25 musk

0.6392±0.0091 (17) 0.9331±0.0084 (5) 0.8396±0.0204 (12) 0.9311±0.0067 (6) 0.9613±0.0043 (1) 0.8567±0.0077 (11) 0.9276±0.0083 (7) 0.6620±0.0077 (16) 0.7612±0.0352 (15) 0.9386±0.0068 (4) 0.7669±0.0131 (14) 0.9539±0.0064 (2) 0.8659±0.0879 (10) 0.4091±0.2470 (20) 0.8668±0.0070 (9) 0.5000±0.0000 (19) 0.1021±0.0065 (21) 0.5055±0.1733 (18) 0.8221±0.0878 (13) 0.9526±0.0111 (3) 0.9129±0.0046 (8)

0.6588±0.0065 (16) 0.8128±0.0074 (1) 0.6743±0.0125 (15) 0.6776±0.0116 (14) 0.8106±0.0050 (2) 0.7836±0.0040 (8) 0.7973±0.0040 (6) 0.8011±0.0046 (5) 0.7285±0.0159 (10) 0.6999±0.0065 (12) 0.4083±0.0078 (23) 0.4491±0.0581 (20) 0.5922±0.0063 (18) 0.7266±0.0085 (11) 0.7961±0.0082 (7) 0.4278±0.0608 (22) 0.6903±0.0052 (13) 0.5000±0.0000 (19) 0.8029±0.0074 (4) 0.4387±0.0670 (21) 0.6508±0.0233 (17) 0.8052±0.0177 (3) 0.7800±0.0039 (9)

0.4026±0.0026 (9) 0.6273±0.0007 (4) 0.6185±0.0120 (5) 0.5308±0.0024 (6) 0.7426±0.0106 (1) 0.5000±0.0000 (7) 0.0000±0.0019 (10) 0.4850±0.0353 (8) 0.6896±0.0068 (3) 0.7048±0.0021 (2)

0.6577±0.0328 (14) 0.8806±0.0147 (3) 0.7185±0.0115 (7) 0.6346±0.0217 (16) 0.7036±0.0053 (11) 0.7079±0.0116 (9) 0.9123±0.0089 (1) 0.4937±0.0488 (21) 0.4246±0.0516 (23) 0.8524±0.0118 (6) 0.5284±0.0289 (18) 0.6700±0.0126 (13) 0.6397±0.0372 (15) 0.8835±0.0133 (2) 0.5165±0.0600 (19) 0.4862±0.0435 (22) 0.7079±0.0117 (9) 0.6157±0.0151 (17) 0.8591±0.0185 (5) 0.5000±0.0000 (20) 0.7121±0.0163 (8) 0.6984±0.0109 (12) 0.8782±0.0151 (4)

0.7120±0.0145 (16) 0.9345±0.0081 (1) 0.8727±0.0109 (11) 0.8818±0.0097 (8) 0.8950±0.0074 (6) 0.7814±0.0121 (14) 0.9240±0.0080 (5) 0.6706±0.0110 (17) 0.8645±0.0181 (12) 0.9336±0.0067 (2) 0.5050±0.0231 (19) 0.3897±0.0343 (23) 0.7276±0.0241 (15) 0.9286±0.0082 (4) 0.8790±0.0245 (9) 0.4932±0.1136 (22) 0.8840±0.0109 (7) 0.5000±0.0000 (21) 0.6071±0.0088 (18) 0.5021±0.1107 (20) 0.8177±0.0664 (13) 0.8728±0.0247 (10) 0.9332±0.0083 (3)

0.2821±0.0881 (20) 1.0000±0.0000 (1) 1.0000±0.0000 (1) 0.9999±0.0001 (11) 1.0000±0.0000 (1) 0.9984±0.0008 (14) 1.0000±0.0000 (1) 1.0000±0.0000 (1) 0.9409±0.0387 (16) 1.0000±0.0000 (1) 0.5021±0.0694 (17) 0.3448±0.0445 (19) 0.3703±0.0383 (18) 1.0000±0.0000 (1) 0.9998±0.0005 (12) 0.2547±0.1279 (22) 0.9927±0.0040 (15) 1.0000±0.0000 (1) 0.0329±0.0160 (23) 0.2675±0.1256 (21) 0.9997±0.0004 (13) 1.0000±0.0000 (1) 1.0000±0.0000 (1)

TABLE XXXI: ROC–AUC, high-dimensional datasets (2/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

26 optdigits

35 SpamBase

36 speech

arrhythmia

0.4934±0.0350 (18) 0.8707±0.0148 (7) 0.8937±0.0239 (4) 0.6939±0.0792 (11) 0.9604±0.0072 (3) 0.6357±0.0142 (15) 0.8067±0.0087 (10) 0.8763±0.0137 (5) 0.8421±0.0192 (8) 0.9969±0.0009 (1) 0.4975±0.0319 (17) 0.4243±0.0279 (20) 0.4926±0.0308 (19) 0.9966±0.0015 (2) 0.6460±0.0212 (13) 0.3687±0.1581 (21) 0.6456±0.0172 (14) 0.5000±0.0000 (16) 0.1303±0.0179 (23) 0.3658±0.1716 (22) 0.8181±0.0723 (9) 0.8725±0.1032 (6) 0.6583±0.0277 (12)

0.4517±0.0131 (20) 0.8186±0.0140 (3) 0.6153±0.0182 (13) 0.5566±0.0306 (17) 0.7041±0.0072 (11) 0.7194±0.0097 (9) 0.7974±0.0147 (7) 0.7924±0.0236 (8) 0.8394±0.0139 (1) 0.6064±0.0140 (15) 0.5190±0.0172 (19) 0.5985±0.0418 (16) 0.4242±0.0150 (21) 0.8229±0.0234 (2) 0.8001±0.0260 (6) 0.3253±0.0590 (22) 0.6178±0.0142 (12) 0.5500±0.0125 (18) 0.7141±0.0237 (10) 0.3198±0.0548 (23) 0.6115±0.0168 (14) 0.8092±0.0214 (5) 0.8118±0.0146 (4)

0.6062±0.0881 (2) 0.4570±0.0492 (13) 0.4515±0.0473 (16) 0.4397±0.0622 (22) 0.5047±0.0308 (4) 0.4511±0.0486 (17) 0.5013±0.0483 (5) 0.4550±0.0472 (14) 0.4673±0.0339 (10) 0.6512±0.0442 (1) 0.4890±0.0492 (8) 0.4750±0.0355 (9) 0.4666±0.0494 (11) 0.5499±0.0944 (3) 0.4956±0.0460 (6) 0.4483±0.0608 (19) 0.4459±0.0481 (20) 0.4510±0.0486 (18) 0.4217±0.0446 (23) 0.4457±0.0656 (21) 0.4644±0.0582 (12) 0.4899±0.0480 (7) 0.4516±0.0489 (15)

0.7597±0.0329 (18) 0.7890±0.0327 (13) 0.8082±0.0357 (7) 0.8060±0.0362 (8) 0.8193±0.0185 (5) 0.8236±0.0319 (4) 0.7819±0.0346 (16) 0.8287±0.0309 (1) 0.8247±0.0345 (2) 0.8150±0.0298 (6) 0.4717±0.0689 (20) 0.5193±0.0305 (19) 0.7974±0.0365 (10) 0.8239±0.0310 (3) 0.7812±0.0400 (17) 0.3027±0.0591 (22) 0.8005±0.0279 (9) 0.7858±0.0339 (15) 0.3366±0.0624 (21) 0.3005±0.0800 (23) 0.7964±0.0368 (11) 0.7886±0.0370 (14) 0.7926±0.0397 (12)

TABLE XXXII: AUPR, small datasets (1/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

4 breastw

14 glass

15 Hepatitis

18 Ionosphere

21 Lymphography

29 Pima

0.2877±0.0169 (20) 0.9664±0.0184 (13) 0.9892±0.0043 (4) 0.6048±0.0525 (17) 0.9919±0.0032 (1) 0.9869±0.0053 (7) 0.9693±0.0139 (12) 0.9799±0.0088 (9) 0.9890±0.0053 (5) 0.9904±0.0041 (2) 0.2457±0.0273 (21) 0.7921±0.1227 (16) 0.3152±0.0156 (19) 0.9798±0.0101 (10) 0.9630±0.0222 (14) 0.2116±0.0082 (22) 0.9904±0.0041 (2) 0.9507±0.0178 (15) 0.5168±0.1374 (18) 0.2116±0.0082 (22) 0.9878±0.0061 (6) 0.9718±0.0148 (11) 0.9806±0.0108 (8)

0.2252±0.1340 (8) 0.1502±0.1025 (16) 0.2286±0.1182 (7) 0.2519±0.1434 (4) 0.3294±0.0800 (1) 0.1812±0.1485 (11) 0.2004±0.1567 (10) 0.1794±0.1047 (12) 0.1543±0.0638 (14) 0.1668±0.1048 (13) 0.0525±0.0186 (23) 0.0951±0.0897 (22) 0.2320±0.1363 (6) 0.2542±0.1299 (2) 0.1475±0.0490 (17) 0.1409±0.1880 (19) 0.1249±0.1108 (21) 0.1454±0.1055 (18) 0.2025±0.0687 (9) 0.1298±0.1725 (20) 0.2452±0.1173 (5) 0.2536±0.1251 (3) 0.1503±0.0995 (15)

0.3422±0.1897 (19) 0.6348±0.1385 (2) 0.5388±0.1740 (4) 0.4093±0.1430 (17) 0.5211±0.0667 (8) 0.4933±0.0920 (10) 0.5098±0.1610 (9) 0.5721±0.0927 (3) 0.5316±0.1013 (5) 0.4333±0.0932 (15) 0.2266±0.1709 (21) 0.2530±0.1153 (20) 0.4741±0.1082 (14) 0.4797±0.1632 (13) 0.4847±0.1319 (12) 0.2080±0.1225 (22) 0.5231±0.1038 (7) 0.4853±0.1374 (11) 0.3999±0.1074 (18) 0.1719±0.0960 (23) 0.4322±0.1248 (16) 0.5267±0.0975 (6) 0.6372±0.1153 (1)

0.9189±0.0188 (9) 0.9416±0.0131 (5) 0.9201±0.0374 (8) 0.9367±0.0108 (6) 0.9574±0.0073 (2) 0.6874±0.0444 (17) 0.9569±0.0099 (3) 0.5333±0.0867 (19) 0.8529±0.0338 (13) 0.9323±0.0105 (7) 0.3667±0.0443 (21) 0.5672±0.0604 (18) 0.8282±0.0611 (14) 0.9677±0.0119 (1) 0.9534±0.0115 (4) 0.2876±0.0459 (22) 0.8001±0.0329 (15) 0.7236±0.0393 (16) 0.3946±0.0602 (20) 0.2702±0.0379 (23) 0.9093±0.0388 (10) 0.9071±0.0227 (11) 0.8817±0.0283 (12)

0.6225±0.2143 (18) 0.8167±0.1820 (15) 0.9299±0.1435 (10) 0.4838±0.2684 (19) 0.9951±0.0201 (2) 0.9867±0.0292 (4) 0.7933±0.1614 (16) 0.9637±0.0659 (8) 0.9900±0.0211 (3) 0.9833±0.0351 (5) 0.1209±0.1796 (20) 0.7597±0.1644 (17) 0.9833±0.0351 (5) 0.8629±0.1506 (13) 0.8314±0.1602 (14) 0.0339±0.0072 (22) 0.9833±0.0351 (5) 0.9333±0.1291 (9) 0.0378±0.0084 (21) 0.0338±0.0071 (23) 0.8901±0.1443 (11) 1.0000±0.0000 (1) 0.8796±0.1430 (12)

0.4735±0.0308 (16) 0.5387±0.0181 (7) 0.5244±0.0279 (10) 0.4144±0.0207 (20) 0.5668±0.0149 (3) 0.4992±0.0179 (13) 0.5418±0.0200 (6) 0.5991±0.0253 (2) 0.5572±0.0257 (4) 0.5295±0.0295 (9) 0.3502±0.0284 (21) 0.4895±0.0585 (14) 0.4409±0.0227 (18) 0.5502±0.0212 (5) 0.5054±0.0295 (11) 0.2784±0.0480 (22) 0.5028±0.0288 (12) 0.4678±0.0199 (17) 0.6099±0.0347 (1) 0.2784±0.0450 (22) 0.5312±0.0416 (8) 0.4202±0.0638 (19) 0.4876±0.0228 (15)

TABLE XXXIII: AUPR, small datasets (2/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

37 Stamps

39 vertebral

42 WBC

43 WDBC

45 wine

46 WPBC

0.2120±0.0573 (19) 0.4350±0.1051 (13) 0.5528±0.1300 (2) 0.5181±0.0937 (4) 0.6095±0.0647 (1) 0.4575±0.1030 (11) 0.4618±0.0950 (10) 0.4570±0.0663 (12) 0.5178±0.1048 (5) 0.4759±0.0940 (8) 0.0939±0.0238 (21) 0.1085±0.0399 (20) 0.2330±0.0598 (18) 0.5381±0.1321 (3) 0.2714±0.0547 (17) 0.0723±0.0240 (22) 0.4249±0.1001 (14) 0.4083±0.0799 (15) 0.4661±0.0532 (9) 0.0658±0.0152 (23) 0.4803±0.1574 (7) 0.3988±0.0925 (16) 0.4855±0.0914 (6)

0.1222±0.0268 (17) 0.1265±0.0253 (14) 0.1314±0.0278 (9) 0.1855±0.0487 (3) 0.1548±0.0192 (5) 0.1310±0.0239 (10) 0.1291±0.0219 (11) 0.1110±0.0243 (21) 0.1224±0.0263 (16) 0.1144±0.0241 (19) 0.1707±0.0392 (4) 0.1233±0.0291 (15) 0.1073±0.0211 (23) 0.1283±0.0321 (13) 0.1342±0.0274 (8) 0.2425±0.0945 (1) 0.1202±0.0253 (18) 0.1093±0.0161 (22) 0.1144±0.0252 (19) 0.2141±0.0595 (2) 0.1291±0.0358 (11) 0.1363±0.0268 (7) 0.1434±0.0283 (6)

0.3421±0.1683 (18) 0.8106±0.2272 (13) 0.9480±0.0504 (5) 0.1239±0.0324 (19) 0.9658±0.0466 (1) 0.9174±0.0831 (8) 0.6966±0.1988 (17) 0.8305±0.1530 (12) 0.9201±0.0784 (7) 0.9502±0.0568 (3) 0.1196±0.1020 (21) 0.9302±0.0867 (6) 0.7069±0.2313 (16) 0.7695±0.2384 (15) 0.7814±0.2436 (14) 0.0282±0.0047 (22) 0.9502±0.0568 (3) 0.9009±0.0873 (9) 0.1227±0.0592 (20) 0.0282±0.0047 (22) 0.8885±0.2170 (10) 0.9610±0.0576 (2) 0.8563±0.1843 (11)

0.2573±0.1460 (18) 0.7782±0.2134 (3) 0.6179±0.2237 (13) 0.0662±0.0339 (20) 0.5729±0.1161 (16) 0.6875±0.1531 (6) 0.6851±0.2442 (8) 0.7374±0.1368 (4) 0.6873±0.1773 (7) 0.6224±0.1666 (12) 0.0208±0.0054 (21) 0.7950±0.1495 (1) 0.6436±0.1994 (10) 0.7913±0.1626 (2) 0.4138±0.1816 (17) 0.0158±0.0044 (22) 0.6429±0.1641 (11) 0.6025±0.1176 (14) 0.2214±0.1521 (19) 0.0158±0.0044 (22) 0.5865±0.1612 (15) 0.6813±0.1950 (9) 0.6896±0.1968 (5)

0.1717±0.0927 (20) 0.5529±0.2822 (6) 0.6318±0.2372 (2) 0.2498±0.1465 (18) 0.4625±0.1262 (11) 0.3033±0.0885 (16) 0.6901±0.2396 (1) 0.5273±0.2059 (9) 0.5717±0.1853 (5) 0.5357±0.1809 (7) 0.1054±0.0808 (21) 0.2445±0.1397 (19) 0.4505±0.1887 (12) 0.6064±0.2519 (3) 0.5772±0.2406 (4) 0.0440±0.0147 (22) 0.3484±0.1777 (14) 0.3114±0.1194 (15) 0.2567±0.1461 (17) 0.0438±0.0149 (23) 0.5280±0.1743 (8) 0.5198±0.2062 (10) 0.4389±0.1942 (13)

0.2141±0.0518 (22) 0.2347±0.0631 (12) 0.2413±0.0610 (6) 0.2223±0.0594 (19) 0.2834±0.0336 (1) 0.2158±0.0474 (21) 0.2392±0.0704 (8) 0.2355±0.0603 (11) 0.2344±0.0597 (13) 0.2503±0.0598 (5) 0.2364±0.0843 (10) 0.2394±0.0452 (7) 0.2377±0.0612 (9) 0.2513±0.0619 (4) 0.2583±0.0910 (3) 0.2211±0.0706 (20) 0.2333±0.0561 (14) 0.2276±0.0529 (18) 0.2330±0.0558 (15) 0.2100±0.0529 (23) 0.2612±0.0817 (2) 0.2295±0.0547 (16) 0.2283±0.0544 (17)

TABLE XXXIV: AUPR, medium datasets (1/3). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

2 annthyroid

6 cardio

7 Cardiotocography

12 fault

19 landsat

20 letter

0.1685±0.0118 (17) 0.5003±0.0592 (4) 0.1605±0.0144 (18) 0.4211±0.0358 (8) 0.3652±0.0133 (10) 0.3479±0.0222 (11) 0.4365±0.0291 (7) 0.3934±0.0471 (9) 0.4849±0.0345 (5) 0.1274±0.0129 (20) 0.2036±0.0217 (13) 0.1165±0.0131 (21) 0.1901±0.0185 (15) 0.4683±0.0401 (6) 0.5152±0.0299 (2) 0.1013±0.0212 (22) 0.1313±0.0133 (19) 0.2015±0.0113 (14) 0.2606±0.0275 (12) 0.0981±0.0196 (23) 0.1741±0.0209 (16) 0.5279±0.0935 (1) 0.5096±0.0311 (3)

0.1865±0.0217 (19) 0.6195±0.0650 (12) 0.7159±0.0405 (7) 0.7767±0.0339 (4) 0.8114±0.0213 (2) 0.6705±0.0231 (11) 0.6968±0.0376 (8) 0.5475±0.0316 (14) 0.6925±0.0521 (9) 0.7267±0.0282 (6) 0.0928±0.0123 (22) 0.1569±0.0189 (20) 0.2026±0.0235 (18) 0.7791±0.0356 (3) 0.3805±0.0375 (15) 0.0918±0.0954 (23) 0.6923±0.0300 (10) 0.3667±0.2827 (16) 0.3538±0.0571 (17) 0.0934±0.0961 (21) 0.6043±0.0843 (13) 0.8352±0.0315 (1) 0.7723±0.0403 (5)

0.2591±0.0182 (20) 0.4920±0.0476 (13) 0.5803±0.0271 (7) 0.5001±0.0246 (12) 0.6271±0.0166 (1) 0.5820±0.0238 (6) 0.5269±0.0250 (9) 0.4559±0.0241 (14) 0.5648±0.0281 (8) 0.6152±0.0210 (3) 0.2136±0.0213 (21) 0.4269±0.0372 (15) 0.2883±0.0292 (18) 0.6128±0.0307 (4) 0.3595±0.0297 (16) 0.2120±0.0732 (22) 0.6186±0.0240 (2) 0.2990±0.1234 (17) 0.2713±0.0218 (19) 0.2083±0.0727 (23) 0.5187±0.0438 (11) 0.5254±0.0509 (10) 0.6065±0.0273 (5)

0.5010±0.0160 (10) 0.5937±0.0420 (5) 0.5318±0.0543 (9) 0.5894±0.0342 (6) 0.6639±0.0128 (2) 0.3467±0.0165 (22) 0.5459±0.0311 (7) 0.4442±0.0669 (15) 0.4958±0.0382 (11) 0.6196±0.0279 (4) 0.3633±0.0188 (19) 0.3829±0.0243 (18) 0.4002±0.0206 (17) 0.6845±0.0358 (1) 0.4347±0.0468 (16) 0.3535±0.0403 (20) 0.4703±0.0216 (13) 0.3415±0.0173 (23) 0.4705±0.0492 (12) 0.3521±0.0374 (21) 0.5323±0.0531 (8) 0.6234±0.0299 (3) 0.4672±0.0354 (14)

0.2219±0.0116 (18) 0.2604±0.0116 (10) 0.3355±0.0152 (4) 0.2932±0.0103 (7) 0.3688±0.0088 (2) 0.1769±0.0043 (21) 0.2060±0.0064 (20) 0.3580±0.0178 (3) 0.2668±0.0149 (9) 0.2385±0.0055 (14) 0.2150±0.0096 (19) 0.2274±0.0884 (17) 0.2457±0.0095 (13) 0.5202±0.0228 (1) 0.2593±0.0042 (11) 0.3300±0.0331 (5) 0.1712±0.0046 (22) 0.1635±0.0041 (23) 0.3152±0.0113 (6) 0.2349±0.0285 (16) 0.2839±0.0537 (8) 0.2533±0.0126 (12) 0.2372±0.0057 (15)

0.3120±0.0422 (6) 0.2659±0.0448 (7) 0.1951±0.0339 (9) 0.1555±0.0476 (10) 0.3954±0.0306 (2) 0.0899±0.0180 (16) 0.3384±0.0526 (3) 0.0867±0.0190 (18) 0.1011±0.0206 (15) 0.1506±0.0325 (11) 0.0714±0.0089 (20) 0.0638±0.0079 (21) 0.3357±0.0444 (4) 0.5013±0.0652 (1) 0.1998±0.0415 (8) 0.0577±0.0097 (22) 0.0807±0.0169 (19) 0.0878±0.0205 (17) 0.1023±0.0231 (14) 0.0559±0.0080 (23) 0.1489±0.0309 (12) 0.3177±0.0507 (5) 0.1301±0.0299 (13)

TABLE XXXV: AUPR, medium datasets (2/3). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

27 PageBlocks

28 pendigits

30 satellite

31 satimage-2

38 thyroid

40 vowels

0.3540±0.0282 (18) 0.7179±0.0330 (4) 0.5343±0.0463 (12) 0.6854±0.0315 (6) 0.7673±0.0121 (1) 0.5734±0.0258 (9) 0.7209±0.0241 (3) 0.3019±0.0160 (19) 0.5398±0.0328 (11) 0.4864±0.0316 (15) 0.1674±0.0129 (21) 0.4825±0.0221 (16) 0.4083±0.0256 (17) 0.7430±0.0304 (2) 0.6209±0.0226 (8) 0.1085±0.0568 (23) 0.5083±0.0317 (14) 0.5327±0.0308 (13) 0.2177±0.0127 (20) 0.1109±0.0540 (22) 0.5436±0.0792 (10) 0.7055±0.0705 (5) 0.6740±0.0416 (7)

0.0601±0.0106 (18) 0.4177±0.0942 (7) 0.4306±0.1145 (6) 0.5697±0.1402 (5) 0.8617±0.0325 (2) 0.3003±0.0431 (11) 0.0879±0.0160 (16) 0.2869±0.0357 (12) 0.3881±0.0638 (8) 0.7551±0.0752 (3) 0.0228±0.0061 (21) 0.0283±0.0061 (20) 0.0376±0.0119 (19) 0.9659±0.0331 (1) 0.0722±0.0102 (17) 0.0134±0.0016 (22) 0.3706±0.0533 (9) 0.2323±0.0378 (14) 0.1684±0.0255 (15) 0.0134±0.0013 (22) 0.3038±0.2087 (10) 0.6903±0.1344 (4) 0.2768±0.0448 (13)

0.3867±0.0150 (20) 0.7908±0.0112 (6) 0.7996±0.0198 (5) 0.7803±0.0134 (7) 0.8168±0.0060 (2) 0.5882±0.0081 (17) 0.7768±0.0111 (8) 0.8109±0.0092 (4) 0.7662±0.0140 (10) 0.7479±0.0115 (12) 0.3056±0.0142 (22) 0.3157±0.0782 (21) 0.3932±0.0145 (19) 0.8405±0.0110 (1) 0.7754±0.0136 (9) 0.2918±0.0194 (23) 0.6837±0.0107 (15) 0.6038±0.0099 (16) 0.8145±0.0096 (3) 0.4639±0.1478 (18) 0.7445±0.0386 (13) 0.7586±0.0199 (11) 0.7325±0.0113 (14)

0.1329±0.0474 (18) 0.8612±0.0970 (12) 0.9727±0.0222 (2) 0.9036±0.0684 (9) 0.9727±0.0117 (2) 0.7695±0.0614 (15) 0.7337±0.1016 (16) 0.8270±0.0647 (13) 0.9210±0.0427 (7) 0.9771±0.0245 (1) 0.0628±0.1632 (20) 0.0212±0.0224 (22) 0.0305±0.0175 (21) 0.9656±0.0268 (5) 0.7194±0.0769 (17) 0.0080±0.0029 (23) 0.9066±0.0385 (8) 0.8750±0.0433 (11) 0.9346±0.0343 (6) 0.1315±0.2360 (19) 0.8896±0.1368 (10) 0.9695±0.0281 (4) 0.8211±0.0622 (14)

0.1251±0.0139 (21) 0.6788±0.0687 (5) 0.2328±0.0654 (16) 0.7491±0.0391 (1) 0.5704±0.0412 (10) 0.6398±0.0425 (8) 0.6474±0.0461 (7) 0.7392±0.0772 (3) 0.6635±0.0942 (6) 0.1606±0.0532 (20) 0.0273±0.0118 (23) 0.0696±0.0161 (22) 0.2889±0.0935 (13) 0.6089±0.0850 (9) 0.7096±0.0493 (4) 0.2146±0.1110 (17) 0.1701±0.0539 (19) 0.3753±0.0389 (11) 0.3499±0.0531 (12) 0.2050±0.0953 (18) 0.2644±0.0744 (15) 0.2650±0.0576 (14) 0.7433±0.0486 (2)

0.4213±0.1150 (7) 0.5336±0.0721 (4) 0.3702±0.1387 (8) 0.2130±0.0693 (10) 0.7692±0.0502 (2) 0.1090±0.0263 (16) 0.6293±0.0983 (3) 0.1337±0.0498 (13) 0.1938±0.0504 (11) 0.1787±0.0573 (12) 0.0378±0.0092 (21) 0.0498±0.0255 (20) 0.4563±0.0951 (6) 0.8212±0.0922 (1) 0.0977±0.0686 (17) 0.0191±0.0025 (22) 0.0954±0.0293 (18) 0.0816±0.0254 (19) 0.1307±0.0329 (14) 0.0191±0.0027 (22) 0.3241±0.0924 (9) 0.4667±0.1105 (5) 0.1170±0.0567 (15)

TABLE XXXVI: AUPR, medium datasets (3/3). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

41 Waveform

44 Wilt

47 yeast

0.0432±0.0084 (15) 0.0787±0.0299 (7) 0.2284±0.0701 (1) 0.0873±0.0246 (6) 0.0921±0.0117 (5) 0.0431±0.0086 (16) 0.0426±0.0086 (18) 0.0508±0.0073 (13) 0.0626±0.0121 (9) 0.0696±0.0097 (8) 0.0320±0.0048 (21) 0.0323±0.0044 (20) 0.1167±0.0347 (4) 0.2161±0.0711 (2) 0.0427±0.0091 (17) 0.0212±0.0064 (23) 0.0398±0.0081 (19) 0.0466±0.0082 (14) 0.0594±0.0072 (11) 0.0237±0.0083 (22) 0.1238±0.0543 (3) 0.0562±0.0186 (12) 0.0616±0.0121 (10)

0.0548±0.0024 (9) 0.0562±0.0139 (8) 0.0387±0.0030 (19) 0.0419±0.0059 (18) 0.0798±0.0060 (5) 0.0428±0.0048 (15) 0.0918±0.0082 (3) 0.0444±0.0094 (13) 0.0453±0.0033 (12) 0.0385±0.0030 (21) 0.0717±0.0053 (6) 0.0494±0.0070 (10) 0.0426±0.0029 (16) 0.0612±0.0128 (7) 0.1547±0.0106 (1) 0.0928±0.0121 (2) 0.0387±0.0032 (19) 0.0432±0.0026 (14) 0.0377±0.0032 (23) 0.0902±0.0115 (4) 0.0420±0.0030 (17) 0.0385±0.0049 (21) 0.0462±0.0036 (11)

0.3089±0.0129 (19) 0.3197±0.0182 (13) 0.3223±0.0202 (11) 0.2961±0.0133 (23) 0.3534±0.0129 (5) 0.3393±0.0157 (6) 0.3096±0.0171 (16) 0.3334±0.0165 (8) 0.3096±0.0167 (16) 0.2974±0.0143 (21) 0.3807±0.0174 (1) 0.3337±0.0185 (7) 0.3091±0.0220 (18) 0.3226±0.0206 (10) 0.3211±0.0242 (12) 0.3647±0.0406 (3) 0.3063±0.0138 (20) 0.2967±0.0169 (22) 0.3283±0.0192 (9) 0.3660±0.0508 (2) 0.3179±0.0256 (14) 0.3585±0.0255 (4) 0.3138±0.0179 (15)

TABLE XXXVII: AUPR, large datasets (1/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

1 ALOI

8 celeba

10 cover

11 donors

13 fraud

16 http

0.1185±0.0111 (2) 0.0419±0.0033 (8) 0.0406±0.0034 (9) 0.0438±0.0026 (5) 0.0807±0.0033 (4) 0.0335±0.0014 (20) 0.0403±0.0025 (11) 0.0343±0.0013 (17) 0.0337±0.0016 (19) 0.0423±0.0034 (6) 0.0386±0.0017 (14) 0.0364±0.0017 (16) 0.0901±0.0074 (3) 0.1491±0.0110 (1) 0.0341±0.0017 (18) 0.0290±0.0016 (23) 0.0421±0.0034 (7) 0.0380±0.0018 (15) 0.0322±0.0011 (21) 0.0292±0.0015 (22) 0.0400±0.0036 (12) 0.0406±0.0032 (9) 0.0393±0.0021 (13)

0.0202±0.0005 (19) 0.0499±0.0104 (12) 0.0617±0.0294 (10) 0.0491±0.0041 (13) 0.0528±0.0056 (11) 0.1007±0.0055 (4) 0.0910±0.0042 (6) 0.1009±0.0056 (3) 0.0682±0.0095 (9) 0.0406±0.0021 (15) 0.0172±0.0006 (20) 0.0356±0.0018 (16) 0.0958±0.0171 (5) 0.0136±0.0017 (21) 0.0772±0.0048 (8) 0.1121±0.0050 (2) 0.0222±0.0006 (17) 0.0214±0.0010 (18) 0.0432±0.0264 (14) 0.0833±0.0067 (7) 0.1142±0.0058 (1)

0.0288±0.0013 (17) 0.4044±0.0611 (3) 0.0772±0.0259 (10) 0.3492±0.0373 (4) 0.8938±0.0073 (1) 0.1419±0.0065 (7) 0.1114±0.0025 (8) 0.0352±0.0019 (16) 0.0384±0.0049 (14) 0.0495±0.0016 (12) 0.0136±0.0012 (19) 0.8678±0.0130 (2) 0.0158±0.0004 (18) 0.0101±0.0008 (20) 0.1093±0.0046 (9) 0.0732±0.0015 (11) 0.0378±0.0013 (15) 0.0100±0.0003 (21) 0.0465±0.0212 (13) 0.2212±0.1091 (5) 0.1664±0.0069 (6)

0.0492±0.0003 (19) 0.3215±0.0309 (4) 0.3004±0.0451 (6) 0.2382±0.0192 (9) 0.9994±0.0005 (1) 0.3098±0.0022 (5) 0.2779±0.0016 (8) 0.1826±0.0026 (14) 0.2907±0.0495 (7) 0.1053±0.0021 (16) 0.9991±0.0006 (2) 0.1983±0.1187 (12) 0.2029±0.0021 (11) 0.1673±0.0012 (15) 0.0937±0.0010 (17) 0.0513±0.0082 (18) 0.2270±0.0496 (10) 0.9181±0.0839 (3) 0.1888±0.0413 (13)

0.0159±0.0011 (18) 0.5606±0.0488 (1) 0.4031±0.0301 (8) 0.4106±0.0472 (7) 0.5503±0.0193 (2) 0.2513±0.0266 (13) 0.4888±0.0380 (4) 0.2132±0.0351 (14) 0.1265±0.0279 (17) 0.3945±0.0308 (11) 0.0018±0.0001 (19) 0.4674±0.0555 (5) 0.5063±0.0249 (3) 0.0009±0.0000 (20) 0.3949±0.0306 (10) 0.1506±0.0159 (16) 0.2982±0.0382 (12) 0.0009±0.0001 (20) 0.3992±0.0286 (9) 0.4241±0.0526 (6) 0.1761±0.0192 (15)

0.0077±0.0002 (18) 0.7764±0.1551 (6) 0.4121±0.0062 (13) 0.3531±0.0072 (15) 0.8872±0.1252 (2) 0.2311±0.0028 (16) 0.8511±0.0052 (4) 0.5106±0.1107 (9) 0.3906±0.0891 (14) 0.0254±0.0038 (17) 0.5629±0.3048 (7) 0.8727±0.0061 (3) 0.4138±0.0067 (12) 0.4758±0.0056 (10) 0.5394±0.0175 (8) 0.0038±0.0001 (19) 0.4480±0.1252 (11) 0.9790±0.0097 (1) 0.8511±0.0060 (4)

TABLE XXXVIII: AUPR, large datasets (2/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

22 magic

23 mammography

32 shuttle

33 skin

34 smtp

0.7128±0.0079 (9) 0.7687±0.0135 (3) 0.7596±0.0142 (4) 0.7236±0.0113 (7) 0.8143±0.0034 (1) 0.5576±0.0058 (18) 0.7397±0.0068 (5) 0.6460±0.0072 (14) 0.6996±0.0167 (10) 0.6595±0.0057 (11) 0.4320±0.0090 (20) 0.3822±0.0185 (21) 0.5361±0.0044 (19) 0.8041±0.0064 (2) 0.6573±0.0060 (12) 0.2282±0.0055 (23) 0.6065±0.0048 (16) 0.5939±0.0065 (17) 0.6329±0.0082 (15) 0.2286±0.0060 (22) 0.7256±0.0190 (6) 0.7154±0.0256 (8) 0.6508±0.0137 (13)

0.0240±0.0016 (21) 0.3620±0.0625 (2) 0.0785±0.0120 (19) 0.2561±0.0457 (6) 0.3010±0.0216 (4) 0.4516±0.0447 (1) 0.2793±0.0472 (5) 0.2150±0.0363 (10) 0.2438±0.0504 (9) 0.1058±0.0136 (15) 0.0744±0.0108 (20) 0.0937±0.0280 (16) 0.1153±0.0104 (13) 0.3489±0.0518 (3) 0.1425±0.1684 (12) 0.0128±0.0009 (22) 0.1124±0.0148 (14) 0.1989±0.0247 (11) 0.0840±0.0156 (17) 0.0128±0.0009 (22) 0.0840±0.0224 (17) 0.2440±0.0541 (8) 0.2533±0.0474 (7)

0.1325±0.0051 (19) 0.9496±0.0117 (12) 0.9627±0.0060 (8) 0.9701±0.0083 (5) 0.9911±0.0027 (2) 0.9559±0.0078 (11) 0.9404±0.0117 (13) 0.9668±0.0108 (6) 0.9765±0.0090 (4) 0.9596±0.0069 (10) 0.4836±0.0176 (18) 0.1166±0.0400 (20) 0.0921±0.0057 (21) 0.9939±0.0074 (1) 0.8408±0.0123 (16) 0.0371±0.0007 (22) 0.9597±0.0069 (9) 0.9164±0.0063 (15) 0.6512±0.0358 (17) 0.0369±0.0005 (23) 0.9660±0.0072 (7) 0.9840±0.0041 (3) 0.9336±0.0114 (14)

0.1771±0.0013 (21) 0.4034±0.1190 (10) 0.5527±0.0108 (4) 0.4606±0.0187 (8) 0.9647±0.0053 (1) 0.1988±0.0010 (18) 0.4953±0.0018 (5) 0.3693±0.0026 (11) 0.4900±0.0084 (6) 0.2953±0.0015 (13) 0.1890±0.0482 (20) 0.2298±0.0015 (17) 0.9477±0.0082 (2) 0.4762±0.0021 (7) 0.1939±0.0307 (19) 0.3467±0.0021 (12) 0.1632±0.0009 (22) 0.2299±0.0011 (16) 0.2632±0.0935 (14) 0.5764±0.0818 (3) 0.4232±0.2331 (9) 0.2381±0.0014 (15)

0.0014±0.0002 (20) 0.3247±0.2130 (10) 0.4802±0.1330 (6) 0.6147±0.1393 (3) 0.7004±0.0484 (1) 0.5990±0.1003 (4) 0.3155±0.1184 (11) 0.1901±0.1312 (12) 0.0054±0.0008 (19) 0.1038±0.0424 (15) 0.0717±0.0759 (16) 0.1215±0.0900 (14) 0.6708±0.0870 (2) 0.0059±0.0012 (18) 0.0003±0.0001 (21) 0.1629±0.0699 (13) 0.4109±0.1316 (9) 0.0222±0.0313 (17) 0.0003±0.0001 (21) 0.4462±0.1391 (7) 0.5273±0.1615 (5) 0.4244±0.1402 (8)

TABLE XXXIX: AUPR, high-dimensional datasets (1/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

3 backdoor

5 campaign

9 census

17 InternetAds

24 mnist

25 musk

0.0506±0.0021 (17) 0.8526±0.0112 (4) 0.0859±0.0166 (14) 0.7901±0.0356 (7) 0.8897±0.0092 (2) 0.1094±0.0036 (13) 0.8557±0.0138 (3) 0.0380±0.0011 (19) 0.0522±0.0083 (15) 0.7243±0.0222 (8) 0.2406±0.0143 (9) 0.8908±0.0123 (1) 0.2331±0.1673 (10) 0.0519±0.0835 (16) 0.1114±0.0038 (12) 0.0246±0.0007 (20) 0.0128±0.0004 (21) 0.0443±0.0635 (18) 0.1406±0.1835 (11) 0.8419±0.0155 (6) 0.8466±0.0085 (5)

0.1690±0.0041 (17) 0.3426±0.0116 (6) 0.2479±0.0200 (15) 0.2486±0.0192 (14) 0.3698±0.0056 (2) 0.3696±0.0115 (3) 0.3608±0.0071 (4) 0.3864±0.0133 (1) 0.3123±0.0210 (10) 0.2834±0.0111 (13) 0.0878±0.0021 (23) 0.1092±0.0043 (20) 0.1358±0.0030 (18) 0.2889±0.0122 (12) 0.3155±0.0121 (9) 0.0998±0.0183 (22) 0.3116±0.0120 (11) 0.1134±0.0017 (19) 0.3406±0.0152 (7) 0.1026±0.0209 (21) 0.2230±0.0340 (16) 0.3291±0.0169 (8) 0.3510±0.0091 (5)

0.0467±0.0004 (10) 0.0767±0.0005 (5) 0.0746±0.0029 (6) 0.0613±0.0005 (8) 0.1879±0.0548 (1) 0.0617±0.0005 (7) 0.1194±0.0013 (2) 0.0600±0.0038 (9) 0.0950±0.0033 (4) 0.1119±0.0020 (3)

0.2707±0.0321 (17) 0.8064±0.0288 (2) 0.5940±0.0186 (7) 0.2758±0.0231 (16) 0.5616±0.0068 (10) 0.5749±0.0143 (9) 0.8295±0.0217 (1) 0.2541±0.0652 (18) 0.1604±0.0224 (23) 0.7507±0.0180 (5) 0.2184±0.0346 (20) 0.4432±0.0183 (13) 0.4235±0.0355 (14) 0.8010±0.0240 (4) 0.2296±0.0375 (19) 0.1865±0.0175 (22) 0.5813±0.0144 (8) 0.2987±0.0112 (15) 0.7418±0.0328 (6) 0.1898±0.0100 (21) 0.5368±0.0269 (12) 0.5548±0.0152 (11) 0.8043±0.0291 (3)

0.2124±0.0143 (15) 0.5906±0.0384 (3) 0.4009±0.0413 (10) 0.4513±0.0344 (9) 0.5209±0.0264 (6) 0.2070±0.0118 (16) 0.5760±0.0312 (4) 0.1543±0.0124 (18) 0.3811±0.0537 (11) 0.6664±0.0270 (2) 0.0939±0.0064 (21) 0.0856±0.0057 (23) 0.2629±0.0225 (14) 0.6665±0.0287 (1) 0.3740±0.1058 (12) 0.1068±0.0420 (20) 0.4554±0.0251 (8) 0.0922±0.0043 (22) 0.1640±0.0134 (17) 0.1099±0.0404 (19) 0.3388±0.1105 (13) 0.5063±0.0472 (7) 0.5727±0.0339 (5)

0.0349±0.0173 (18) 1.0000±0.0000 (1) 1.0000±0.0000 (1) 0.9963±0.0040 (11) 0.9998±0.0025 (10) 0.9606±0.0175 (14) 1.0000±0.0000 (1) 1.0000±0.0000 (1) 0.3308±0.1853 (16) 1.0000±0.0000 (1) 0.0376±0.0149 (17) 0.0299±0.0031 (19) 0.0259±0.0051 (20) 1.0000±0.0000 (1) 0.9951±0.0116 (12) 0.0199±0.0031 (22) 0.8724±0.0631 (15) 0.9999±0.0004 (9) 0.0159±0.0016 (23) 0.0203±0.0033 (21) 0.9913±0.0105 (13) 1.0000±0.0000 (1) 1.0000±0.0000 (1)

TABLE XL: AUPR, high-dimensional datasets (2/2). Model ABOD AutoEncoder CBLOF DIF DiffInt ECOD GMM HBOS IForest KDE KPCA LMDD LOF LUNAR MCD MO GAAL OCSVM PCA QMCD SO GAAL Sampling TCCM VAE

26 optdigits

35 SpamBase

36 speech

arrhythmia

0.0562±0.0392 (12) 0.1018±0.0108 (7) 0.1253±0.0305 (6) 0.0567±0.0228 (11) 0.3739±0.0616 (3) 0.0385±0.0051 (17) 0.0719±0.0093 (10) 0.1829±0.0261 (5) 0.0992±0.0195 (9) 0.8656±0.0478 (1) 0.0317±0.0060 (18) 0.0273±0.0036 (20) 0.0524±0.0200 (13) 0.8328±0.0875 (2) 0.0388±0.0063 (16) 0.0237±0.0072 (22) 0.0401±0.0056 (15) 0.0298±0.0043 (19) 0.0163±0.0024 (23) 0.0240±0.0080 (21) 0.0996±0.0674 (8) 0.2340±0.1204 (4) 0.0403±0.0077 (14)

0.3895±0.0078 (20) 0.7571±0.0189 (2) 0.4588±0.0198 (12) 0.4532±0.0279 (14) 0.5853±0.0083 (11) 0.6205±0.0105 (10) 0.7368±0.0186 (5) 0.7049±0.0365 (8) 0.7811±0.0239 (1) 0.4445±0.0127 (17) 0.4376±0.0188 (18) 0.4499±0.0337 (16) 0.3528±0.0058 (21) 0.7526±0.0346 (3) 0.7187±0.0498 (7) 0.3057±0.0269 (22) 0.4521±0.0128 (15) 0.4149±0.0104 (19) 0.6210±0.0247 (9) 0.3042±0.0237 (23) 0.4545±0.0162 (13) 0.7235±0.0224 (6) 0.7460±0.0198 (4)

0.0247±0.0103 (8) 0.0220±0.0086 (13) 0.0217±0.0084 (15) 0.0161±0.0048 (20) 0.0233±0.0046 (10) 0.0227±0.0094 (11) 0.0329±0.0182 (2) 0.0250±0.0114 (5) 0.0244±0.0150 (9) 0.0465±0.0207 (1) 0.0197±0.0073 (19) 0.0199±0.0056 (18) 0.0249±0.0111 (6) 0.0311±0.0148 (3) 0.0248±0.0108 (7) 0.0143±0.0030 (22) 0.0218±0.0088 (14) 0.0216±0.0085 (16) 0.0133±0.0024 (23) 0.0144±0.0036 (21) 0.0225±0.0109 (12) 0.0284±0.0127 (4) 0.0216±0.0085 (16)

0.3791±0.0363 (18) 0.4081±0.0651 (15) 0.4896±0.0815 (8) 0.4995±0.0716 (7) 0.5067±0.0406 (5) 0.5172±0.0701 (3) 0.3955±0.0553 (17) 0.5092±0.0746 (4) 0.5250±0.0838 (2) 0.5008±0.0690 (6) 0.1603±0.0393 (21) 0.2404±0.0510 (19) 0.4532±0.0668 (12) 0.5266±0.0686 (1) 0.4173±0.0752 (14) 0.1156±0.0318 (22) 0.4846±0.0678 (10) 0.4433±0.0536 (13) 0.2007±0.0700 (20) 0.1119±0.0279 (23) 0.4849±0.0726 (9) 0.4658±0.0748 (11) 0.4004±0.0621 (16)

Related documents

• Differentiable Interval Bottlenecks for Interpretable Anomaly Detection in Numerical Data#926753
• Generalist Graph Anomaly Detection via Prototype-Based Distillation#792756
• Generalist Graph Anomaly Detection via Prototype-Based Distillation#788756
• Can We Predict Anomaly Detection Performance from Embedding-Space Geometry?#1062351
• Can We Predict Anomaly Detection Performance from Embedding-Space Geometry?#1043104