An Evidence-Based Post-Hoc Adjustment Framework for Anomaly Detection Under Data Contamination

AI summary

Overview

Research area: Unsupervised anomaly detection (AD), specifically test-time adaptation (TTA) and robustness to contaminated training data.

Technical level: Advanced. The paper builds on probability density estimation, exponential tilting, Kullback–Leibler (KL) divergence, and energy-based model formulations, though the practical procedure it proposes reduces to a single additive correction term.

Scope: The paper proposes EPHAD, a post-hoc, preparation-agnostic test-time adjustment framework that corrects the outputs of already-trained unsupervised anomaly detectors without access to training data, training pipelines, or knowledge of the contamination ratio.

What This Paper Is About

Unsupervised anomaly detection methods assume the training set contains only normal samples, but real-world datasets are frequently contaminated with undetected or mislabeled anomalies, which biases the learned model and degrades detection. Existing remedies either require modifying the training pipeline, require access to the training data, or require knowing the proportion of anomalies (the contamination ratio) in advance — none of which is realistic when deploying a proprietary, already-trained AD model. The goal of this paper is to correct such a model's test-time predictions after the fact, using evidence collected at test time, so that the impact of contamination is reduced without retraining.

Key Contributions

1. EPHAD framework. The authors introduce Evidence-based Post-Hoc Adjustment Framework for Anomaly Detection (EPHAD), a simple test-time adaptation method for unsupervised AD models trained on contaminated datasets that requires no access to training pipelines, no access to training data, and no prior knowledge of the anomaly proportion.
2. A principled probabilistic formulation. EPHAD combines the prior knowledge captured by the AD model trained on the contaminated dataset with an evidence function gathered at test time, using exponential tilting of the contaminated density. This yields conceptual connections to recent test-time alignment techniques used in generative modelling.
3. An adaptive hyperparameter variant (EPHAD-Ada). Section 4.3 proposes an unsupervised, test-time method for setting the temperature parameter β using entropy minimisation over inlier probabilities derived from the original model's scores and the evidence function's scores, avoiding the need for a labelled validation set.
4. Extensive empirical validation. The authors illustrate the intuition with a synthetic toy example and validate EPHAD across eight visual AD datasets, twenty-six tabular AD datasets, and a real-world industrial AD dataset, plus an ablation study on hyperparameter influence and robustness to varying contamination levels.

Main Findings

• Contamination is the norm, not the exception. An analysis of 57 datasets spanning Natural Language Processing and Computer Vision in ADBench (Han et al., 2022) [Appendix B.2, Figure B1] found that nearly 70% of datasets have anomaly ratios below 10%, with a median of 5%. Existing contamination literature typically considers contamination levels from 0% to 20%.
• A theoretical condition for improvement. Proposition 4.1 states that the KL divergence between the true inlier PDF and the revised, tilted PDF is strictly less than the divergence between the true inlier PDF and the contaminated PDF if and only if the expected log-ratio of the tilted evidence term under the normal distribution is greater than zero (condition 4). When this holds, the revised density assigns higher relative likelihoods to true inliers.
• The tilt is the optimal solution to a KL-regularised objective. Equation (5) shows the exponential tilting form balances aligning the adjusted PDF with the evidence (first term) against fidelity to the original contaminated PDF (second term). As β → 0 the solution becomes evidence-driven; as β → ∞ it reverts to the original model.
• The method reduces to an additive score correction. In the score-based extension (Section 4.1), because AD depends only on sample ordering, normalisation constants can be ignored and the revised inlier score is š^±_in(x) = s^±_in(x) + T(x)/β. All subsequent experiments use this score-based formulation.
• Toy example behaviour. On a 2D three-Gaussian synthetic dataset with 100 contaminated data points and DeepSVDD, the "Blind" configuration (treating all samples as normal) misclassified all anomalies as normal. The "Refine" configuration improved by filtering a subset of anomalies. EPHAD, using LOF computed on test samples as evidence, established a clearer boundary around normal samples.
• Visual AD improvements with CLIP as evidence. At a 10% contamination ratio with β = 0.5 (Table 1, AUROC % ± SE), adding EPHAD improved most AD/evidence pairings. Examples: CFLOW on Fashion-MNIST rose from 72.87 (± 0.48) to 92.97 (± 0.19); DRÆM on CIFAR-10 rose from 63.41 (± 0.26) to 97.17 (± 0.02); RD on CIFAR-10 rose from 66.29 (± 0.31) to 98.40 (± 0.0); ULSAD on Fashion-MNIST rose from 88.64 (± 0.13) to 95.03 (± 0.07).
• Gains occur even where CLIP alone is weak. The standalone CLIP results correspond directly to WinCLIP; CLIP performed well on CIFAR-10 (98.63) and Fashion-MNIST (95.63) but declined on domain-specific datasets such as MVTec (86.34), MPDD (60.02) and ViSA (74.47). Despite this, incorporating CLIP inside EPHAD still improved methods such as CFLOW, PaDiM and RD, surpassing both CLIP and the standalone AD method on several datasets.
• EPHAD-Ada is often, but not always, the best. EPHAD-Ada produced the strongest numbers in several cells — for example ViSA with ULSAD (87.23 ± 0.05) and MVTec with CFLOW (89.84 ± 0.3) — but was lower than plain EPHAD in others, such as Fashion-MNIST with DRÆM (84.96 ± 0.97 versus 92.46 ± 0.25) and CIFAR-10 with PaDiM (90.23 ± 0.67 versus 97.10 ± 0.03).
• Regressions are acknowledged. The authors report that in some cases, such as ULSAD on SVHN, performance declined when integrating EPHAD compared to the standalone AD method. They attribute this to the AD method substantially outperforming the evidence function, in which case overly relying on the evidence can be harmful.
• Results for tabular and industrial datasets are referenced but not reported here. The paper states that twenty-six tabular AD datasets are evaluated (Section 5.2) and that an industrial AD use case appears in Appendix C.2, as do comparisons with the existing frameworks "Refine" (Yoon et al., 2022), Latent Outlier Exposure (LOE) (Qiu et al., 2022) and SoftPatch (Jiang et al., 2022) in Appendix C.3. The specific numeric results of those sections are not included in the provided content.

Methodology in Plain English

The authors start from a probabilistic view of anomaly detection: normal samples come from a distribution P⁺_X, anomalies from a non-concentrated distribution P⁻_X, and a contaminated training set actually follows a mixture P^±_X = ε·P⁻_X + (1 − ε)·P⁺_X, where ε is the contamination factor. A model trained on this mixture ends up biased toward anomalous regions.

Instead of retraining, EPHAD "tilts" the contaminated model's density using an evidence function T(x) that gives higher values to samples that look more normal, scaling the evidence by a temperature β and renormalising. Intuitively, the adjustment upweights samples the evidence supports while staying anchored to what the original model already believes. The paper proves that this tilt moves the density closer (in KL divergence) to the true inlier density under a specific expectation condition, and that it is the optimal solution to a trade-off between following the evidence and staying faithful to the original model.

Because modern detectors output scores rather than densities, the authors convert the tilting operation into a simple additive adjustment on inlier scores. The detector then thresholds this revised score: classify as normal if the revised inlier score is at least λ_s, otherwise anomalous. In the entropy-based variant, EPHAD-Ada estimates inlier probabilities from scores by modelling the probability that a randomly drawn score falls below the observed one, using a Beta(1,1) prior and a Beta(1+t, 1+n−t) posterior; it then sets β_ada as the ratio of the evidence entropy to the original model entropy plus a small stability constant δ. A high-entropy original model yields a smaller β; a confident original model yields a larger β.

Experiments introduce controlled contamination (default ε = 0.1) following prior work, evaluate with AUROC averaged across categories, and compute evidence functions in an unsupervised manner without using ground-truth test labels. Image evidence comes from CLIP used in the manner of WinCLIP, with dataset-dependent normal and anomalous text prompt templates and a softmax-style comparison of image-text similarity scores.

Why This Matters

Impact on research. The paper reframes contaminated-data anomaly detection as a test-time adaptation problem rather than a training-time correction problem, and explicitly draws a line between EPHAD and test-time alignment methods in generative modelling (KL-regularised objectives for shifting a model's output distribution toward a reward or evidence signal). It also provides a theoretical condition (Proposition 4.1) under which a post-hoc adjustment provably helps, giving a target for future evidence-function design.

Real-world applications:

• Cybersecurity — cited as a core AD application area where threat detection models may be trained on traffic containing unnoticed intrusions.
• Healthcare — cited as a domain where anomaly detectors operate on data that may already contain mislabeled or undetected abnormal cases.
• Industrial maintenance and defect detection — the motivating example is a maintenance dataset that already contains unnoticed defects; the paper evaluates on MVTecAD, MPDD, ViSA and RealIAD as well as a real-world industrial AD dataset.
• Consumer and semantic image monitoring — the semantic AD experiments (MNIST, Fashion-MNIST, CIFAR-10, SVHN) target cases where anomalies belong to a different semantic class.

Industry relevance. The framework targets the practical situation of proprietary or third-party AD models deployed without access to internal components or training data. Even when fine-tuning is permitted, the paper argues it is computationally intensive and unreliable without guaranteed clean data. EPHAD's single hyperparameter and its unsupervised adaptive variant make it deployable when labelled validation data is unavailable.

Future Directions

• Understanding when EPHAD hurts. The authors observe performance declines when the AD method substantially outperforms the evidence function (e.g., ULSAD on SVHN) and attribute this to over-reliance on the evidence. A principled criterion for when to trust evidence over the prior model remains open.
• Extending to contamination levels beyond those tested. The paper notes that existing literature, including this setting, typically studies contamination from 0% to 20%; behaviour at higher contamination is not characterised in the provided content.
• Better evidence functions and their combination. EPHAD is designed to accept multimodal foundation models such as CLIP, classical methods such as Local Outlier Factor, or domain-specific knowledge. How to choose, calibrate, or combine multiple evidence sources is a natural extension.
• Comparative positioning against training-time contamination methods. The paper provides comparative analyses with "Refine", Latent Outlier Exposure (LOE), and SoftPatch only in Appendix C.3; systematic head-to-head evaluation against training-pipeline-modifying approaches is a logical next step.

Target Audience

Researchers and practitioners working on unsupervised anomaly detection, test-time adaptation, and robustness to label noise; machine-learning engineers deploying third-party or proprietary anomaly detectors where training data and pipelines are inaccessible; and industrial, security, or healthcare teams dealing with datasets that contain unknown, undetected anomalies.

Authors’ abstract

Unsupervised anomaly detection (AD) methods typically assume clean training data, yet real-world datasets often contain undetected or mislabeled anomalies, leading to significant performance degradation. Existing solutions require access to the training pipelines, data or prior knowledge of the proportions of anomalies in the data, limiting their real-world applicability. To address this challenge, we propose EPHAD, a simple yet effective test-time adaptation framework that updates the outputs of AD models trained on contaminated datasets using evidence gathered at test time. Our approach integrates the prior knowledge captured by the AD model trained on contaminated datasets with evidence derived from multimodal foundation models like Contrastive Language-Image Pre-training (CLIP), classical AD methods like the Local Outlier Factor or domain-specific knowledge. We illustrate the intuition behind EPHAD using a synthetic toy example and validate its effectiveness through comprehensive experiments across eight visual AD datasets, twenty-six tabular AD datasets, and a real-world industrial AD dataset. Additionally, we conduct an ablation study to analyse hyperparameter influence and robustness to varying contamination levels, demonstrating the versatility and robustness of EPHAD across diverse AD models and evidence pairs. To ensure reproducibility, our code is publicly available at https://github.com/sukanyapatra1997/EPHAD.