Mitigating Convergence Collapse in Fixed-Target Anomaly Detectors via Kernel-Anchored Locality Regularization

# Mitigating Convergence Collapse in Fixed-Target Anomaly Detectors via Kernel-Anchored Locality Regularization
Source: [https://arxiv.org/html/2610.02345](https://arxiv.org/html/2610.02345)
Conference:Proceedings of the 35th ACM International Conference on Information and Knowledge Management; November 07–11, 2026; Rome, ItalyProceedings of the 35th ACM International Conference on Information and Knowledge Management \(CIKM ’26\), November 07–11, 2026, Rome, ItalyDOI:[10\.1145/3799682\.3841143](https://doi.org/10.1145/3799682.3841143)ISBN:979\-8\-4007\-2539\-5/2026/11CCS:Computing methodologies Anomaly detectionCCS:Computing methodologies Kernel methodsCCS:Computing methodologies Unsupervised learningJosé Lucas De Melo Costa[https://orcid.org/0009-0007-5372-9101](https://orcid.org/0009-0007-5372-9101)Note:Corresponding author\.Affiliation:Université Paris\-Saclay, CNRS, CentraleSupélec, LISN UMR 9015,Orsay,Franceemail:[jose\.lucas\-de\-melo\-costa@universite\-paris\-saclay\.fr](mailto:[email protected])Fabrice Popineau[https://orcid.org/0000-0002-2941-9046](https://orcid.org/0000-0002-2941-9046)Affiliation:Université Paris\-Saclay, CNRS, CentraleSupélec, Laboratoire Interdisciplinaire des Sciences du Numérique,Orsay,Franceemail:[fabrice\.popineau@centralesupelec\.fr](mailto:[email protected]),Arpad Rimmel[https://orcid.org/0009-0009-7028-3644](https://orcid.org/0009-0009-7028-3644)Affiliation:Université Paris\-Saclay, CNRS, CentraleSupélec, Laboratoire Interdisciplinaire des Sciences du Numérique,Orsay,Franceemail:[arpad\.rimmel@centralesupelec\.fr](mailto:[email protected])andBich\-Liên Doan[https://orcid.org/0009-0001-5853-2486](https://orcid.org/0009-0001-5853-2486)Affiliation:Université Paris\-Saclay, CNRS, CentraleSupélec, Laboratoire Interdisciplinaire des Sciences du Numérique,Orsay,Franceemail:[Bich\-Lien\.Doan@centralesupelec\.fr](mailto:[email protected])

© cc

###### Abstract\.

A family of tabular anomaly detectors trains a neural map toward a fixed target under squared\-error loss and scores anomalies by the test\-time residual; contraction matching, one\-step rectified flow, and reconstruction autoencoders all fit this template\. We characterize a*convergence collapse*: better optimization makes the detector worse\. At convergence, the learned map tracks the target even off\-distribution, so the residual signal vanishes on anomalies as well as on normal data\. These detectors therefore rely on implicit non\-convergence \(early stopping, capacity caps\) to retain signal\. We argue this is structural: effective anomaly detection requires a*locality constraint*that blocks unconstrained extrapolation\. Classical detectors \(kkNN, KDE, isolation forests, LOF\) enforce locality explicitly; fixed\-target neural detectors do not\. We formalize the connection by showing that the kernel\-regression analog of a fixed\-target detector is a finite\-bandwidth Nadaraya–Watson smoother, which we call*Kernel Contraction Matching*\(KCM\)\. KCM is closed\-form, training\-free, and CPU\-efficient, yet matches established neural baselines on ADBench\. Building on this bridge, we introduce the*Kernel\-Anchored Regularizer*\(KAR\), which penalizes deviation of the neural prediction from a kernel\-weighted average of training targets\. Across collapse\-prone ADBench datasets and three backbones, KAR mitigates collapse and improves AUROC under prolonged training\.

###### Keywords:

Anomaly detection; Tabular anomaly detection; Convergence collapse; Kernel methods; Contraction Matching; Semi\-supervised learning settings; ADBench

††cc\-license:by## 1\.Introduction

Figure 1\.Convergence collapse across fixed\-target anomaly detectors\.*Top:*the anomaly\-score field flattens along training, until the anomalies \(stars\) are no longer separated from the normal cluster \(dots\)\.*Bottom left:*on ADBench\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13)\)7\_Cardiotocography, the methods reach an early peak \(⋆\\star\) and then decay toward convergence \(▽\\triangledown\)\.*Bottom right:*the peak\-to\-converged AUROC drops are0\.1280\.128,0\.0510\.051, and0\.0170\.017\.A four\-panel figure showing that fixed\-target anomaly detectors improve early in training and then collapse as training continues; the anomaly scores flatten, and the AUROC drops while the training loss keeps decreasing\.Tabular anomaly detection identifies records that depart from normal behaviour, a long\-standing problem with stakes in fraud screening, intrusion detection, condition monitoring, and medical diagnosis\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13);[Bouman et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib3)\)\. A growing number of detectors share one design, the*fixed\-target*template: a neural network is trained on normal data to map every input to a predetermined*target*, a value set in advance as a function of the input alone, and a test point is scored by its*residual*, the distance between the network’s output and that target\. The reconstruction autoencoder uses the input itself as its target\([Sattarov et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib31);[Ruff et al\., 2021](https://arxiv.org/html/2610.02345#bib.bib29)\); flow\-matching detectors instead regress a velocity field\([Li et al\., 2025b](https://arxiv.org/html/2610.02345#bib.bib18);[Li et al\., 2025a](https://arxiv.org/html/2610.02345#bib.bib19)\), with contraction matching aiming that velocity at a fixed point\. Fitting a fixed target is ordinary squared\-error regression, with no adversarial game, no density model, and no anomaly labels; the score is the residual, read off in one forward pass\.

This approach carries an implicit promise\. Trained by regression, the detector should only get sharper with more epochs and a lower training loss, so training to convergence looks like good practice\.*We find the opposite\.*As the squared\-error loss is minimized, detection quality first improves and then degrades\. The failure is intrinsic to this class of methods, and we call it*convergence collapse*\. At the optimum the network reproduces the fixed target on the normal data; because the target is a fixed function and the network is free to extrapolate, it reproduces the target off the normal distribution too, exactly where anomalies lie\. The residual then shrinks on anomalies just as it shrinks on normal points, and AUROC declines even as the loss keeps falling\. The collapsed detector is not mistrained: it has correctly solved its squared\-error problem, and that problem was not detection\. The pattern is not specific to one backbone: it has been studied for reconstruction autoencoders, where an expressive network reconstructs anomalies as accurately as normal points\([Gong et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib10);[Ghafourian et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib8)\), and we show the same failure across contraction matching and flow matching\. Figure[1](https://arxiv.org/html/2610.02345#acmlabel1)shows an autoencoder, a contraction matching detector \(TCCM\([Li et al\., 2025a](https://arxiv.org/html/2610.02345#bib.bib19)\)\), and a flow\-matching detector \(REFLECT\([Beizaee et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib2)\)\), each climbing to an early peak and then decaying toward convergence\. The published strength of fixed\-target detectors therefore rests on*implicit non\-convergence*: early stopping and capacity caps that are tuned, rarely reported, and increasingly automated without naming the failure they prevent\([Huang et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib14)\)\.

The root cause is a missing constraint\. The squared\-error loss constrains the network only on the training data, so its score at a test point can be set by free extrapolation rather than by the nearby training points\. The methods that dominate tabular benchmarks\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13);[Bouman et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib3)\), among themkk\-nearest\-neighbour distance, the local outlier factor\([Breunig et al\., 2000](https://arxiv.org/html/2610.02345#bib.bib4)\), kernel density estimation, one\-class SVM\([Schölkopf et al\., 1999](https://arxiv.org/html/2610.02345#bib.bib32)\), and isolation forest\([Liu et al\., 2008](https://arxiv.org/html/2610.02345#bib.bib21)\), rest on the opposite discipline: the score at a point is set mostly by training points in a*bounded neighbourhood*of it\. We call this property*locality*\. Classical detectors enforce it by construction; a fixed\-target neural detector, left to converge, does not\. Convergence collapse is the absence of a locality constraint\.

Locality also points to a cure\.111Code, configurations, and run logs:[https://github\.com/jose\-melo/kernel\-contraction\-matching](https://github.com/jose-melo/kernel-contraction-matching)\.Consider the kernel\-regression analog of a fixed\-target detector, the smoother a wide network approaches in its lazy training regime\([Jacot et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib15);[Lee et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib17)\)\. For the contraction target we call this analog*Kernel Contraction Matching*\(kcm\): instead of learning a map, it predicts a kernel\-weighted average of the training targets, in which each training point’s influence decays smoothly with distance\.kcmhas no optimizer and no epoch axis, and runs on a CPU\. Even so, on ADBench it matches established neural baselines\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13);[Ruff et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib30)\), in line with the finding that non\-deep methods are hard to beat on tabular data\([Grinsztajn et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib12)\)\. Andkcmcannot collapse: every training point’s influence is local, so its prediction levels off as a test point leaves the data and the residual*grows*on far anomalies instead of vanishing\.

kcmshows a collapse\-proof solution exists, but does not let a practitioner keep a neural backbone, so we turn it into a regularizer\. The*Kernel\-Anchored Regularizer*\(kar\) penalizes the deviation of the neural prediction from thekcmprediction across the input domain, confining the network to a narrow tube around the collapse\-immunekcmsolution\. The tube width is the only knob, expressed directly in the units of the data, so there is no loss weight to tune\. Within the tube the anomaly score stays close to thekcmscore at every input, AUROC can move only slightly, and the collapsed constant solution falls outside the hypothesis class\. Across collapse\-prone ADBench datasets and three backbones,karmitigates collapse and improves AUROC under prolonged training\. The division of labour between the two is plain:*kcmis the detector to deploy when scoring is the whole task;karis for when a trainable backbone is a requirement rather than a choice*, because the pipeline fine\-tunes the map downstream, needs a differentiable score, or must expose a learned representation\.kar’s benchmark\-wide contribution is the removal of the collapse at no accuracy cost against its anchor, not an accuracy gain overkcm\. We make three contributions:

1. \(1\)Convergence collapse:we show that fixed\-target detectors degrade as they converge, because the network matches its target off the normal distribution and the residual vanishes on anomalies; the guarantee is formal for backbones whose training covers the off\-data region and empirical for the clean\-input ones \(§[3\.2](https://arxiv.org/html/2610.02345#S3.SS2)\)\. We give a taxonomy of anomaly detectors by their off\-data score behaviour\.
2. \(2\)Kernel Contraction Matching:we identify the kernel analog of any fixed\-target detector as a closed\-form, training\-free, collapse\-immune smoother that still matches established neural baselines on ADBench\.
3. \(3\)Kernel\-Anchored Regularizer:we anchor a neural backbone tokcmand show this removes the collapse across all4747ADBench datasets and three backbones at no accuracy cost against the anchor; on the collapse\-prone subset it also improves on it\.

## 2\.Related Work

Anomaly detection spans a long line of method families\([Chandola et al\., 2009](https://arxiv.org/html/2610.02345#bib.bib5)\), and its deep\-learning branch is by now broad\([Pang et al\., 2021](https://arxiv.org/html/2610.02345#bib.bib25)\)\. Most deep detectors for tabular data learn a model of normal data and score a test point by how poorly that model accounts for it: reconstruction autoencoders by the reconstruction error\([Sattarov et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib31);[Ruff et al\., 2021](https://arxiv.org/html/2610.02345#bib.bib29)\), one\-class networks such as Deep SVDD by the distance to a compact centre\([Ruff et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib30)\), self\-supervised detectors by the consistency of a pretext prediction\([Shenkar and Wolf, 2022](https://arxiv.org/html/2610.02345#bib.bib33);[Qiu et al\., 2021](https://arxiv.org/html/2610.02345#bib.bib27);[Yin et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib38);[Thimonier et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib35);[Wang et al\., 2020](https://arxiv.org/html/2610.02345#bib.bib36)\)\. A more recent line scores the residual of a generative model: diffusion\-based detectors read off a denoising signal\([Livernoche et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib22);[Dai et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib7)\), and flow\-matching detectors regress a velocity field toward a fixed target, first for images\([Li et al\., 2025b](https://arxiv.org/html/2610.02345#bib.bib18);[Beizaee et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib2)\)and then, through contraction matching, for tabular data\([Li et al\., 2025a](https://arxiv.org/html/2610.02345#bib.bib19)\)\. All fit the fixed\-target template, and we study a failure shared by the whole template rather than adding another detector to it\.

Classical detectors predate these deep models and remain strong baselines on tabular benchmarks\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13);[Goldstein and Uchida, 2016](https://arxiv.org/html/2610.02345#bib.bib9);[Bouman et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib3)\)\. Neighbourhood methods score a point from its proximity to nearby training samples: thekk\-nearest\-neighbour distance\([Ramaswamy et al\., 2000](https://arxiv.org/html/2610.02345#bib.bib28)\), the local outlier factor\([Breunig et al\., 2000](https://arxiv.org/html/2610.02345#bib.bib4)\), and kernel density estimation\([Lang et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib16)\)\. One\-class SVMs separate the data from the origin with a kernel of bounded reach\([Schölkopf et al\., 1999](https://arxiv.org/html/2610.02345#bib.bib32)\); isolation forests\([Liu et al\., 2008](https://arxiv.org/html/2610.02345#bib.bib21)\)and the copula\-based COPOD\([Li et al\., 2020](https://arxiv.org/html/2610.02345#bib.bib20)\)rank a point by how extreme it is relative to the training sample as a whole\. In each design the score is read from the stored training data rather than from a parametric map free to extrapolate; LUNAR\([Goodge et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib11)\)folds the same neighbourhood structure back into a graph neural network\.

That a deep detector can be harmed by additional training is already documented, along two strands\. The first concerns contamination: when the unlabelled training data contains outliers, a discriminative network fits the inliers before the outliers\([Wang et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib37)\), so detection peaks early and falls as the outliers are absorbed\([Nkashama et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib24)\), prompting label\-free stopping criteria such as EntropyStop\([Huang et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib14)\)and GradStop\([Zhang et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib40)\)alongside evaluation protocols for unstable runs\([Perini et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib26)\)\. The second concerns reconstruction autoencoders trained on clean normal data: a sufficiently expressive autoencoder reconstructs some anomalies as accurately as normal points\([Gong et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib10);[Ghafourian et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib8)\), met by autoencoder\-specific responses such as a memory module\([Gong et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib10)\)or a penalty on the latent norm\([Ghafourian et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib8)\)\. A third failure is mode collapse in Deep SVDD, averted by architectural restrictions on bias and activations\([Ruff et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib30)\)or, when those restrictions prove limiting, by explicit regularizers\([Chong et al\., 2020](https://arxiv.org/html/2610.02345#bib.bib6)\)\. We show the effect is a property of the entire fixed\-target template, following from a single missing ingredient, locality, which also yields the cure\.

Our treatment of that failure draws on the link between wide networks and kernel regression: in the lazy training regime the network behaves like a fixed kernel predictor governed by the neural tangent kernel\([Jacot et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib15);[Lee et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib17)\), a picture normally used to study generalization, and recently to build kernel predictors for tabular models directly\([Miftachov et al\., 2026](https://arxiv.org/html/2610.02345#bib.bib23)\)\. We use it in the opposite direction, asking which kernel smoother a fixed\-target detector corresponds to, and find that this smoother retains the locality the trained network loses\. Kernel density estimation already turns a kernel smoother into an anomaly score\([Lang et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib16)\); our construction applies the same principle to the contraction target rather than to the data density\.

## 3\.Convergence Collapse

Fixed\-target detectors degrade as they are optimized\. This section makes the assertion precise\.

### 3\.1\.The fixed\-target template

###### Definition 0 \(Fixed\-target detector\)\.

A*fixed\-target detector*is determined by a*target*T:ℝD→ℝDT:\\mathbb\{R\}^\{D\}\\to\\mathbb\{R\}^\{D\}, a fixed function of the input, specified in advance and independently of the trained map, a*training\-input distribution*μ\\muderived from the normal data, and a neural mapmθ:ℝD→ℝDm\_\{\\theta\}:\\mathbb\{R\}^\{D\}\\to\\mathbb\{R\}^\{D\}\. The map is trained by the squared\-error objective

\(1\)ℒ⁡\(θ\)=𝔼x∼μ​‖mθ​\(x\)−T⁡\(x\)‖2,\\mathcal\{L\}\(\\theta\)=\\mathbb\{E\}\_\{x\\sim\\mu\}\\,\\\|m\_\{\\theta\}\(x\)\-T\(x\)\\\|^\{2\},and a test point is scored by the*residual*

\(2\)s⁡\(x\)=‖mθ​\(x\)−T⁡\(x\)‖\.s\(x\)=\\\|m\_\{\\theta\}\(x\)\-T\(x\)\\\|\.

Three detector classes instantiate Definition[1](https://arxiv.org/html/2610.02345#S3.Thmtheorem1)\. The reconstruction autoencoder takes the identity targetT⁡\(x\)=xT\(x\)=xandμ=ptrain\\mu=p\_\{\\mathrm\{train\}\}, withmθm\_\{\\theta\}the encoder–decoder composition\([Ruff et al\., 2021](https://arxiv.org/html/2610.02345#bib.bib29);[Sattarov et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib31)\)\. Contraction matching\([Li et al\., 2025a](https://arxiv.org/html/2610.02345#bib.bib19)\)trains a velocity field toward the negated input,T⁡\(z\)=−zT\(z\)=\-z; we train it on the noised marginalμ\\muofzt=\(1−t\)​ϵ\+t​xz\_\{t\}=\(1\-t\)\\epsilon\+txand read the residual att=1t=1\. The one\-step rectified\-flow detector regresses a velocity along a straight path to a fixed endpoint\([Beizaee et al\., 2025](https://arxiv.org/html/2610.02345#bib.bib2)\); we re\-implement its rectified\-flow objective on tabular ADBench data, as the original work targets brain\-MRI anomalies\.

What separates a detector that can be trained to convergence from one that cannot is a single property: what bounds the anomaly score*away from the training data*, where anomalies lie\. Table[1](https://arxiv.org/html/2610.02345#S3.T1)organizes detectors along this axis and is exhaustive over the families that populate the ADBench\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13)\)top tier\.

Table 1\.A taxonomy of anomaly detectors by what constrains their off\-data scores\. Fixed\-target methods \(T3\) can collapse\.T1, explicit locality\.The score at a query is a function of the training points in a bounded neighbourhood of it:kk\-nearest\-neighbour distance, the local outlier factor\([Breunig et al\., 2000](https://arxiv.org/html/2610.02345#bib.bib4)\), kernel density estimation, one\-class SVM\([Schölkopf et al\., 1999](https://arxiv.org/html/2610.02345#bib.bib32)\), isolation forest\([Liu et al\., 2008](https://arxiv.org/html/2610.02345#bib.bib21)\), and LUNAR\([Goodge et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib11)\)\. A query with no training point nearby is anomalous by construction\.

T2, density\-coupled target\.The method regresses a target that is itself a functional ofptrainp\_\{\\mathrm\{train\}\}: denoising score matching fits the score∇log⁡pσ\\nabla\\log p\_\{\\sigma\}of the noised density\([Song and Ermon, 2019](https://arxiv.org/html/2610.02345#bib.bib34)\), and energy\-based detectors fit an energy whose negatives depend on the model itself\([Yoon et al\., 2023](https://arxiv.org/html/2610.02345#bib.bib39)\)\. Because the target encodes where the density’s mass lies, its optimum stays non\-trivial off\-manifold\.

T3, fixed target\.The detectors of Definition[1](https://arxiv.org/html/2610.02345#S3.Thmtheorem1)\. The target is fixed in advance and carries no information about where the normal data lies, so the residual off the data is whatever the network chooses to extrapolate\. T3 is the only family in Table[1](https://arxiv.org/html/2610.02345#S3.T1)without an off\-data floor on its score, and, we show next, the only one that collapses\.

### 3\.2\.The collapse, formally

###### Proposition 0 \(Convergence collapse\)\.

Let a fixed\-target detector have targetTT, training\-input distributionμ\\mu, and a hypothesis classℱ⊆C⁡\(ℝD,ℝD\)\\mathcal\{F\}\\subseteq C\(\\mathbb\{R\}^\{D\},\\mathbb\{R\}^\{D\}\)of continuous maps withT∈ℱT\\in\\mathcal\{F\}\. Letm⋆∈arg⁡minm∈ℱ⁡ℒ⁡\(m\)m^\{\\star\}\\in\\arg\\min\_\{m\\in\\mathcal\{F\}\}\\mathcal\{L\}\(m\)attainℒ⁡\(m⋆\)=0\\mathcal\{L\}\(m^\{\\star\}\)=0\. Thenm⋆≡Tm^\{\\star\}\\equiv Tonsupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\), and the residual score \([2](https://arxiv.org/html/2610.02345#S3.E2)\) satisfiess≡0s\\equiv 0onsupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\)\. Every test point insupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\), normal or anomalous, then receives the identical score00, so the detector cannot rank anomalies above normal points: its AUROC onsupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\)is1/21/2\.

###### Proof\.

ℒ⁡\(m⋆\)=∫‖m⋆−T‖2​𝑑μ=0\\mathcal\{L\}\(m^\{\\star\}\)=\\int\\\|m^\{\\star\}\-T\\\|^\{2\}\\,\\mathrm\{d\}\\mu=0forcesm⋆=Tm^\{\\star\}=Ton a setAAwithμ⁡\(Ac\)=0\\mu\(A^\{c\}\)=0\. The setAAis dense insupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\): every open ball around a support point has positiveμ\\mu\-measure and so cannot lie inside the null setAcA^\{c\}, hence meetsAA\. Bothm⋆m^\{\\star\}andTTare continuous, and two continuous maps that agree on a dense subset agree on its closure; thereforem⋆≡Tm^\{\\star\}\\equiv Tonsupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\), ands=‖m⋆−T‖≡0s=\\\|m^\{\\star\}\-T\\\|\\equiv 0there\. A score constant on a set ranks the points of that set uniformly at random, which gives AUROC1/21/2\. ∎

#### Scope of Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)\.

The collapse rests on two premises: the targetTTis fixed in advance, andℱ\\mathcal\{F\}can realizeTTon the region that matters\. The support ofμ\\mudecides which backbones the guarantee covers\.*\(i\) Formal\.*Contraction matching and the rectified\-flow detectors train on a*noised*marginal, sosupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\)covers the off\-manifold region where anomalies lie and Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)applies with no further assumption: the optimum drives the residual to zero on anomalies as exactly as on normal points\.*\(ii\) Empirical\.*The reconstruction autoencoder and Deep SVDD\([Ruff et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib30)\)\(target a constantcc\) train on the clean normal cloud, so Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)pinss≡0s\\equiv 0only there; off it the residual depends on howℱ\\mathcal\{F\}extrapolates the near\-identity \(resp\. near\-constant\) map\. For these backbones the off\-manifold part of the claim is empirical, not proved: the smooth networks used in practice extrapolate their on\-data fit, and Table[2](https://arxiv.org/html/2610.02345#S3.T2)shows the same decay on both\. A regularity assumption on the realized map offsupp⁡\(μ\)\\operatorname\{supp\}\(\\mu\), a Lipschitz bound onm⋆−Tm^\{\\star\}\-T, is the hypothesis that would make case \(ii\) formal; we do not assume it\.

Figure[1](https://arxiv.org/html/2610.02345#acmlabel1)shows the collapse along training: in the lower panels, nine detectors trained on the ADBench7\_Cardiotocographydataset for30003000epochs and33seeds all reach an early AUROC peak and then degrade, although the training loss keeps decreasing\. The peak\-to\-final AUROC drop is0\.1280\.128for the autoencoder,0\.0510\.051for contraction matching, and0\.0170\.017for the rectified\-flow detector\. Table[2](https://arxiv.org/html/2610.02345#S3.T2)gives the dataset\-level view across six residual\-score detectors and six ADBench datasets; the gap is largest on mid\-difficulty datasets and is not tied to a particular backbone or dataset\.

Table 2\.Peak\-to\-last\-epoch AUROC gap, averaged over33seeds after100100epochs of vanilla training\. Positive values mean that training past the early peak hurts detection\.Two observations rule out a simple early\-stopping interpretation\. The best epoch is unstable: in Figure[1](https://arxiv.org/html/2610.02345#acmlabel1)it varies by more than two orders of magnitude and depends on the seed\. The optimized loss is also misleading, since it decreases monotonically while AUROC follows an inverted\-U curve, so monitoring the training loss pushes the detector toward collapse\.

This is not ordinary overfitting\. Overfitting is a finite\-sample failure, the empirical objective improving while population performance worsens; convergence collapse is a population\-objective failure, the optimum itself having no anomaly signal, which Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)proves independently of train–test generalization\. The experiments agree: the held\-out\-normal residual tracks the training residual with a median difference of0\.010\.01along the contraction backbone’s trajectory, far below the normal–anomaly gap the detector must preserve\.

Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)also names the only two ways out, one per premise\. Negating the first gives a density\-coupled target, the route of family T2\. Negating the second restrictsℱ\\mathcal\{F\}so that the constant target is unreachable on the region that matters; a finite\-bandwidth local smoother does exactly this, the route this paper takes next\.

## 4\.Kernel Contraction Matching

Section[3\.2](https://arxiv.org/html/2610.02345#S3.SS2)closed by naming two ways out of the collapse, one for each premise of Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)\. This section follows the second: restrict the map so that the fixed target cannot be reproduced away from the data\. The restriction needs no new method\. We take a fixed\-target detector and replace its trained map by the kernel\-regression estimator of the same target\. The result is a closed\-form detector we call Kernel Contraction Matching \(kcm\)\.

Figure 2\.kcmat a queryqq: the predictionx^h​\(q\)=∑nwn​\(q\)​xn\\hat\{x\}\_\{h\}\(q\)=\\sum\_\{n\}w\_\{n\}\(q\)\\,x\_\{n\}withwn∝e−∥q−xn∥2/2h2w\_\{n\}\\\!\\propto\\\!e^\{\-\\\|q\-x\_\{n\}\\\|^\{2\}/2h^\{2\}\}is a kernel\-weighted average of the training normals \(point size and colour scale with the weight\)\. The reconstruction lies inconv⁡\(X\)\\operatorname\{conv\}\(X\)\(Proposition[2](https://arxiv.org/html/2610.02345#S4.Thmtheorem2)\), and the anomaly scoreskcm​\(q\)=‖q−x^h​\(q\)‖s\_\{\\textsc\{kcm\}\}\(q\)=\\\|q\-\\hat\{x\}\_\{h\}\(q\)\\\|is the residual arrow\.Schematic of KCM at a single query: training points sit inside their convex hull \(shaded polygon\); point sizes and colours encode their kernel weight to a query \(red X\) outside the hull; a blue star inside the hull marks the kernel\-weighted\-average reconstruction; an arrow from the query to the reconstruction is labelled with the KCM score, the residual norm\.#### The kernel\-regression analog\.

A fixed\-target detector fits a neural mapmθm\_\{\\theta\}to a targetTTon inputs drawn fromμ\\mu\(Definition[1](https://arxiv.org/html/2610.02345#S3.Thmtheorem1)\)\. Its*kernel\-regression analog*keeps the target and the residual score of Eq\. \([2](https://arxiv.org/html/2610.02345#S3.E2)\) and changes only the map\. In place of a trained network it predicts a kernel\-weighted average of the training targets\. LetX=\{xn\}n=1N⊂ℝDX=\\\{x\_\{n\}\\\}\_\{n=1\}^\{N\}\\subset\\mathbb\{R\}^\{D\}be the training normals and letq∈ℝDq\\in\\mathbb\{R\}^\{D\}be a query point\. With an RBF kernelKh\(q,x\)=exp\(−∥q−x∥2/2h2\)K\_\{h\}\(q,x\)=\\exp\(\-\\\|q\-x\\\|^\{2\}/2h^\{2\}\)of bandwidthhh, define the weights and the estimator

\(3\)wn​\(q\)=Kh​\(q,xn\)∑m=1NKh​\(q,xm\),fkcm​\(q\)=∑n=1Nwn​\(q\)​T​\(xn\)\.w\_\{n\}\(q\)=\\frac\{K\_\{h\}\(q,x\_\{n\}\)\}\{\\sum\_\{m=1\}^\{N\}K\_\{h\}\(q,x\_\{m\}\)\},\\qquad f\_\{\\textsc\{kcm\}\}\(q\)=\\sum\_\{n=1\}^\{N\}w\_\{n\}\(q\)\\,T\(x\_\{n\}\)\.This is the Nadaraya–Watson smoother of the target values, a classical estimator\. For the contraction targetT⁡\(x\)=−xT\(x\)=\-xit readsfkcm​\(q\)=−x^h​\(q\)f\_\{\\textsc\{kcm\}\}\(q\)=\-\\hat\{x\}\_\{h\}\(q\), where

\(4\)x^h​\(q\)=∑n=1Nwn​\(q\)​xn\\hat\{x\}\_\{h\}\(q\)=\\sum\_\{n=1\}^\{N\}w\_\{n\}\(q\)\\,x\_\{n\}is the kernel reconstruction ofqqfrom the training normals\. The anomaly score is the residual of Definition[1](https://arxiv.org/html/2610.02345#S3.Thmtheorem1),

\(5\)skcm​\(q\)=‖fkcm​\(q\)−T⁡\(q\)‖=‖q−x^h​\(q\)‖\.s\_\{\\textsc\{kcm\}\}\(q\)=\\bigl\\\|f\_\{\\textsc\{kcm\}\}\(q\)\-T\(q\)\\bigr\\\|=\\bigl\\\|q\-\\hat\{x\}\_\{h\}\(q\)\\bigr\\\|\.
The same substitution sends the other members of the family to the same place: for the identity target of the autoencoder,T⁡\(x\)=xT\(x\)=x, the analog isfkcm​\(q\)=x^h​\(q\)f\_\{\\textsc\{kcm\}\}\(q\)=\\hat\{x\}\_\{h\}\(q\)and the score is again Eq\. \([5](https://arxiv.org/html/2610.02345#S4.E5)\), the fixed target cancelling in the residual\.kcmis the analog of the fixed\-target family, not of one detector in it\.

Equation \([3](https://arxiv.org/html/2610.02345#S4.E3)\) is a*linear smoother*of the fixed target: a prediction linear in the training targetsT⁡\(xn\)T\(x\_\{n\}\), with input\-dependent weights\. The estimator is textbook, and we do not claim it as new\. What we claim is that it belongs to the same estimator class a trained fixed\-target detector occupies in the wide\-network limit, that unlike the trained detector it cannot collapse, and that it anchors the regularizer of Section[6](https://arxiv.org/html/2610.02345#S6); the rest of this section establishes the first two\.

#### The lazy limit of a fixed\-target detector\.

The lazy training regime turns the word “analog” into a theorem: a wide fixed\-target detector trained by gradient flow is itself a linear smoother of its targets\. Letmθm\_\{\\theta\}be a wide network at the standard neural\-tangent parameterization, trained on the squared\-error objective of Eq\. \([1](https://arxiv.org/html/2610.02345#S3.E1)\) over inputsx1,…,xNx\_\{1\},\\dots,x\_\{N\}sampled fromμ\\mu, with targets stacked as𝐓=\(T⁡\(x1\),…,T⁡\(xN\)\)\\mathbf\{T\}=\(T\(x\_\{1\}\),\\dots,T\(x\_\{N\}\)\)\. WriteΘ\\Thetafor the network’s neural tangent kernel,Θ⁡\(X,X\)\\Theta\(X,X\)for its Gram matrix on the training inputs, positive definite for distinct inputs and acting identically on each output coordinate, andΘ⁡\(q,X\)\\Theta\(q,X\)for the row of kernel values between a queryqqand those inputs\.

###### Theorem 1 \(Lazy limit of a fixed\-target detector\)\.

In the infinite\-width limit, and from an initialization with zero output, the detector trained by gradient flow, the continuous\-time limit of gradient descent at learning rateη\\eta, realizes after training timeτ\\tauthe predictor

\(6\)mτ​\(q\)=Θ⁡\(q,X\)​Θ​\(X,X\)−1​\(I−e−η​τ​Θ​\(X,X\)\)​𝐓\.m\_\{\\tau\}\(q\)=\\Theta\(q,X\)\\,\\Theta\(X,X\)^\{\-1\}\\bigl\(I\-e^\{\-\\eta\\tau\\,\\Theta\(X,X\)\}\\bigr\)\\,\\mathbf\{T\}\.Asτ→∞\\tau\\to\\inftythe matrix exponential vanishes andmτm\_\{\\tau\}converges to the tangent\-kernel interpolantm∞​\(q\)=Θ⁡\(q,X\)​Θ​\(X,X\)−1​𝐓m\_\{\\infty\}\(q\)=\\Theta\(q,X\)\\,\\Theta\(X,X\)^\{\-1\}\\mathbf\{T\}, which fits the targets exactly on the training inputs\.

Theorem[1](https://arxiv.org/html/2610.02345#S4.Thmtheorem1)places the trained detector andkcmin one class: both are linear smoothers of the fixed target,∑nαn​\(q\)​T​\(xn\)\\sum\_\{n\}\\alpha\_\{n\}\(q\)\\,T\(x\_\{n\}\)with input\-dependent weights, the former with the tangent\-kernel weights of Eq\. \([6](https://arxiv.org/html/2610.02345#S4.E6)\), the latter with the Nadaraya–Watson weights of Eq\. \([3](https://arxiv.org/html/2610.02345#S4.E3)\)\.kcmis not the lazy limit: one is regularized by the training time on the neural tangent kernel, the other by the bandwidth of a finite\-bandwidth RBF\. The theorem establishes something weaker and more useful than an identity: the two are the same kind of estimator, and which smoother in that class one uses is what the rest of this section turns on\.

#### Why build on a limit that excludes feature learning?

The infinite\-width theory behind Theorem[1](https://arxiv.org/html/2610.02345#S4.Thmtheorem1)assumes no features are learned, while large finite networks are valued exactly because they warp their empirical tangent kernel toward the task, so a method drawn from the lazy limit can look self\-contradictory\. Feature learning, however, is the mechanism that lets a finite network match the fixed target*off*the data, and Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)says that this is what collapse is\. A non\-feature\-learning prior is not an oversight here; it supplies the one thing the feature\-learning regime cannot, an off\-hull floor on the score\.kar\(Section[6](https://arxiv.org/html/2610.02345#S6)\) does not claim the lazy limit describes the trained network; it uses the kernel smoother as a constraint set, and its radius prices the tension:ρ=0\\rho=0is the anchor with no feature learning,ρ→∞\\rho\\to\\inftyis full feature learning and full collapse\. How much feature learning survives inside the tube is not measured here; an empirical\-tangent\-kernel drift measurement along training would quantify it\.

#### Bandwidth by closed\-form leave\-one\-out\.

kcmhas one parameter, the bandwidthhh\. We set it by leave\-one\-out cross\-validation on the training normals\. For a candidatehh, writeen​\(h\)=‖xn−x^h\(−n\)​\(xn\)‖2e\_\{n\}\(h\)=\\bigl\\\|x\_\{n\}\-\\hat\{x\}\_\{h\}^\{\(\-n\)\}\(x\_\{n\}\)\\bigr\\\|^\{2\}for the squared leave\-one\-out reconstruction error ofxnx\_\{n\}, wherex^h\(−n\)​\(xn\)\\hat\{x\}\_\{h\}^\{\(\-n\)\}\(x\_\{n\}\)is the estimator of Eq\. \([4](https://arxiv.org/html/2610.02345#S4.E4)\) evaluated atxnx\_\{n\}withxnx\_\{n\}removed from the kernel sum and the weights renormalized over the remaining points\. A semi\-supervised training set is rarely perfectly clean: a few unlabeled anomalies sit among the normals, and they carry the largest leave\-one\-out errors\. We therefore selecthhby the*trimmed*mean of these errors, discarding the largest fractionβ\\betabefore averaging\. WithK=⌈\(1−β\)​N⌉K=\\lceil\(1\-\\beta\)N\\rceilande\(1\)​\(h\)≤⋯≤e\(N\)​\(h\)e\_\{\(1\)\}\(h\)\\leq\\dots\\leq e\_\{\(N\)\}\(h\)the sorted errors,

\(7\)h⋆=arg⁡minh​1K​∑n=1Ke\(n\)​\(h\)\.h^\{\\star\}=\\arg\\min\_\{h\}\\;\\frac\{1\}\{K\}\\sum\_\{n=1\}^\{K\}e\_\{\(n\)\}\(h\)\.We fixβ=0\.1\\beta=0\.1\. Trimming keeps the contaminating anomalies from pulling the bandwidth selector;β=0\\beta=0recovers the plain leave\-one\-out mean\. Computingen​\(h\)e\_\{n\}\(h\)for allnnis a single operation: set thenn\-th entry of each kernel row to zero before renormalizing\. The pairwise distances among the training normals are computed once, and the objective is then oneO⁡\(N2\)O\(N^\{2\}\)pass for each bandwidth on a fixed logarithmic grid\. Equation \([7](https://arxiv.org/html/2610.02345#S4.E7)\) uses the training normals alone, with no anomaly labels, no validation split, and no gradient steps: the regularization Remark[1](https://arxiv.org/html/2610.02345#Thmremark1)leaves implicit in a stopping epoch is fixed here at one explicit value\. Algorithm[1](https://arxiv.org/html/2610.02345#alg1)states the procedure in full\.

Algorithm 1Kernel Contraction Matching0:training normals

X=\{xn\}n=1NX=\\\{x\_\{n\}\\\}\_\{n=1\}^\{N\}, bandwidth grid

ℋ\\mathcal\{H\}, trim fraction

β\\beta
1:Fit \(closed form, no labels\):

2:compute the kernel matrix

KhK\_\{h\}on

XXfor each

h∈ℋh\\in\\mathcal\{H\}
3:

h⋆←arg⁡minh∈ℋh^\{\\star\}\\leftarrow\\arg\\min\_\{h\\in\\mathcal\{H\}\}trimmed\-mean

\{en\(h\)\}n=1Nβ\{\}\_\{\\beta\}\\bigl\\\{\\,e\_\{n\}\(h\)\\,\\bigr\\\}\_\{n=1\}^\{N\}⊳\\trianglerightEq\. \([7](https://arxiv.org/html/2610.02345#S4.E7)\)

4:Score a queryqq:

5:return

skcm​\(q\)=‖q−x^h⋆​\(q\)‖s\_\{\\textsc\{kcm\}\}\(q\)=\\\|q\-\\hat\{x\}\_\{h^\{\\star\}\}\(q\)\\\|⊳\\trianglerightEq\. \([5](https://arxiv.org/html/2610.02345#S4.E5)\)

#### KCM cannot collapse\.

kcmcannot undergo a convergence collapse: it is a closed form with no optimization trajectory to degrade along, and its score has a structural floor outside the training hull\.

###### Proposition 0 \(Off\-hull score floor\)\.

For every bandwidthh\>0h\>0and every queryq∈ℝDq\\in\\mathbb\{R\}^\{D\}, the kernel reconstructionx^h​\(q\)\\hat\{x\}\_\{h\}\(q\)lies in the convex hullconv⁡\(X\)\\operatorname\{conv\}\(X\)of the training normals, so thekcmscore is bounded below by the distance from the query to that hull,

\(8\)skcm​\(q\)=\|q−x^h​\(q\)\|≥dist⁡\(q,conv⁡\(X\)\)\.s\_\{\\textsc\{kcm\}\}\(q\)=\\\|q\-\\hat\{x\}\_\{h\}\(q\)\\\|\\;\\geq\\;\\operatorname\{dist\}\\\!\\bigl\(q,\\operatorname\{conv\}\(X\)\\bigr\)\.The bound is zero only forqqinside the hull and grows without bound asqqleaves it: thekcmscore is strictly positive outside the convex hull of the training normals\.

###### Proof\.

The RBF kernel is positive, so the weightswn​\(q\)w\_\{n\}\(q\)of Eq\. \([3](https://arxiv.org/html/2610.02345#S4.E3)\) are non\-negative and sum to one;x^h​\(q\)=∑nwn​\(q\)​xn\\hat\{x\}\_\{h\}\(q\)=\\sum\_\{n\}w\_\{n\}\(q\)\\,x\_\{n\}is then a convex combination ofx1,…,xNx\_\{1\},\\dots,x\_\{N\}and lies inconv⁡\(X\)\\operatorname\{conv\}\(X\)\. Everyc∈conv⁡\(X\)c\\in\\operatorname\{conv\}\(X\)obeys‖q−c‖≥dist⁡\(q,conv⁡\(X\)\)\\\|q\-c\\\|\\geq\\operatorname\{dist\}\(q,\\operatorname\{conv\}\(X\)\)by definition of the distance to a set, andc=x^h​\(q\)c=\\hat\{x\}\_\{h\}\(q\)gives Eq\. \([8](https://arxiv.org/html/2610.02345#S4.E8)\); the hull is bounded, so its distance function is unbounded\. ∎

Theorem[1](https://arxiv.org/html/2610.02345#S4.Thmtheorem1)explains the contrast\. The trained detector andkcmare both linear smoothers of the target; the lazy\-limit weights are signed and need not sum to one, so training off the data collapses the score \(Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)\), whilekcm’s non\-negative weights confinex^h​\(q\)\\hat\{x\}\_\{h\}\(q\)toconv⁡\(X\)\\operatorname\{conv\}\(X\)and floor it\. This placeskcmin family T1 of Table[1](https://arxiv.org/html/2610.02345#S3.T1): it is the collapse\-proof detector Section[3](https://arxiv.org/html/2610.02345#S3)called for, and the anchor the next section regularizes a neural backbone toward\.

## 5\.KCM is Competitive on ADBench

Section[4](https://arxiv.org/html/2610.02345#S4)introducedkcmas a closed\-form detector and proved it cannot collapse\. A separate question is whether a detector built to avoid a failure mode also detects anomalies well\. We answer it on ADBench:kcmis level with the strongest label\-free detectors on the benchmark, and it gets there with no training, no GPU, and no labels\.

#### Evaluation protocol\.

We follow the semi\-supervised protocol\. For each datasetkcmis fit on a sample of normal points and scores a held\-out mixture of normal and anomalous points; the fit is the procedure of Section[4](https://arxiv.org/html/2610.02345#S4)unchanged \(β=0\.1\\beta=0\.1\), no anomaly labels enter it, and features are standardized per coordinate\. We report mean AUROC over the4747datasets, averaged over three seeds\.kcm’s numbers are our runs; the baseline numbers come from the TCCM benchmark\([Li et al\., 2025a](https://arxiv.org/html/2610.02345#bib.bib19)\), which reports per\-dataset AUROC for its4444baselines plus TCCM on the same4747ADBench datasets\.

#### Datasets\.

ADBench\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13)\)collects4747tabular datasets from healthcare, finance, image\-derived, and network domains, spanning nearly four orders of magnitude in sample size and up to more than a thousand features\.

#### Baseline methods\.

We compare against the ADBench suite,4545detectors that together withkcmgive4646label\-free methods and cover the families of the taxonomy in Table[1](https://arxiv.org/html/2610.02345#S3.T1)\. They are classical density and distance detectors \(kernel density estimation,kk\-nearest neighbours, the local outlier factor\([Breunig et al\., 2000](https://arxiv.org/html/2610.02345#bib.bib4)\), isolation forest\([Liu et al\., 2008](https://arxiv.org/html/2610.02345#bib.bib21)\), the one\-class SVM\([Schölkopf et al\., 1999](https://arxiv.org/html/2610.02345#bib.bib32)\), COPOD\([Li et al\., 2020](https://arxiv.org/html/2610.02345#bib.bib20)\), Gaussian mixtures\), deep detectors \(the autoencoder\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13)\), Deep SVDD\([Ruff et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib30)\), LUNAR\([Goodge et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib11)\), the diffusion\-time estimators DTE\-NP \(non\-parametric\) and DTE\-Cat \(categorical\)\([Livernoche et al\., 2024](https://arxiv.org/html/2610.02345#bib.bib22)\)\), and the fixed\-target detectors of §[3](https://arxiv.org/html/2610.02345#S3), among them TCCM\([Li et al\., 2025a](https://arxiv.org/html/2610.02345#bib.bib19)\)\. We state the result as three claims\.

Figure 3\.Per\-dataset AUROC of the4646label\-free detectors over the4747ADBench datasets, ordered by mean \(diamond\)\.kcm\(red\) has the highest mean AUROC, level with DTE\-NP and LUNAR \(the only two methods within0\.0120\.012\)\.Per\-method AUROC distribution over the 47 ADBench datasets, methods ordered left\-to\-right by mean AUROC\. Each method is a box\-and\-whisker with the mean as a diamond\. KCM, drawn red on the far left, has the highest mean AUROC; DTE\-NP and LUNAR are next; the bulk of classical detectors \(grey\) and deep detectors \(blue\) follow\.
#### \(R1\) KCM ranks first by mean AUROC\.

Across the4747datasetskcmreaches a mean AUROC of0\.8710\.871, the highest of the4646label\-free detectors\. The runners\-up are the non\-parametric DTE\-NP at0\.8650\.865and the graph detector LUNAR at0\.8600\.860; the strongest classical baseline, kernel density estimation, follows at0\.8450\.845, and TCCM at0\.8430\.843\.222TCCM is re\-run under our harness and without epoch fine\-tuning; the TCCM paper reports0\.8670\.867on the same4747datasets\.Figure[3](https://arxiv.org/html/2610.02345#acmlabel3)plots the per\-dataset AUROC of every method ordered by mean\.kcmsits at the left with the highest mean and no low tail: rarely the single best detector on a dataset \(55of4747\) but almost never far down the list \(top five on2121of4747\), it leads the aggregate by consistency rather than by spiking on a few datasets\. The trimmed selector contributes a small part of the lead: the untrimmed mean gives0\.8660\.866, also first, and the trim atβ=0\.1\\beta=0\.1adds0\.0050\.005\. On mean AUPRkcmranks third at0\.6440\.644, behind LUNAR and DTE\-NP; it leads the AUROC leaderboard and stays in the top tier on AUPR\.

#### \(R2\) KCM is level with the two strongest deep detectors and clear of the rest\.

A mean of0\.8710\.871against0\.8650\.865is too small to carry an ordering on its own: the seed\-to\-seed standard deviation is about10−310^\{\-3\}, and the leads over DTE\-NP \(\+0\.006\+0\.006\) and LUNAR \(\+0\.011\+0\.011\) sit within the run\-to\-run spread, sokcmis in practice indistinguishable from the two strongest deep detectors\. The margins over the methods below them are larger and consistent:\+0\.026\+0\.026over kernel density estimation,\+0\.028\+0\.028over TCCM,\+0\.040\+0\.040over the autoencoder, and\+0\.074\+0\.074over isolation forest\. The Nemenyi critical\-difference diagram in Figure[4](https://arxiv.org/html/2610.02345#acmlabel4)\(CD=2\.43\\mathrm\{CD\}=2\.43\) gives the same picture as a ranking: it placeskcm, DTE\-NP, and LUNAR in one group, clear of the rest\.

Figure 4\.Nemenyi critical\-difference diagram, top twelve methods \(CD=2\.43\\mathrm\{CD\}=2\.43\); methods joined by a bar are not significantly different\.kcmshares the leading group with DTE\-NP and LUNAR\.Nemenyi critical\-difference diagram over the top\-twelve detectors on the 47 ADBench datasets, with critical difference 2\.43\. Methods are arranged along a horizontal mean\-rank axis; methods whose ranks differ by less than the critical difference are joined by a thick horizontal bar\. KCM, DTE\-NP and LUNAR are in the leading group\.
#### \(R3\) KCM reaches this position with no training\.

kcmtrains nothing: no gradient steps, no epochs, no GPU, no early\-stopping search, and no labels, only the closed\-form fit of Section[4](https://arxiv.org/html/2610.02345#S4)\. ForNNtraining normals andMMtest points it costsO⁡\(N2​D\)O\(N^\{2\}D\)to select the bandwidth andO⁡\(N​M​D\)O\(NMD\)to score; for largeNNa uniform reference subsample ofN0N\_\{0\}points \(we useN0=2000N\_\{0\}=2000\) bounds the fit atO⁡\(N02​D\)O\(N\_\{0\}^\{2\}D\)\. Table[3](https://arxiv.org/html/2610.02345#S5.T3)reports single\-CPU\-core wall\-clock over the4747datasets\.kcm’s fit has a median of0\.330\.33seconds and reaches at most1\.21\.2, below LUNAR \(3\.53\.5s median, worst10181018\), the autoencoder \(1\.61\.6s\) and TCCM \(1\.11\.1s, worst9494\); its median inference is0\.060\.06seconds, where the non\-parametric DTE\-NP pays a median of0\.300\.30rising past700700on the largest datasets\. The two methods tied withkcmeach carry a cost it does not: LUNAR in training, DTE\-NP at inference\. The reference cap is priced, not assumed: on the three largest ADBench datasets \(cover,fraud,census\), refitting atN∈\{500,…,20,000\}N\\in\\\{500,\\dots,20\{,\}000\\\}training normals puts the uncapped fit on the quadratic branch \(265265to10301030s atN=20,000N\{=\}20\{,\}000; single core, median of three seeds\) while the capped fit stays below99s at everyNN\. And the subsample does not buy the accuracy: atN=20,000N\{=\}20\{,\}000the cap moves mean AUROC by\+0\.005\+0\.005\(cover\),−0\.001\-0\.001\(fraud\) and−0\.005\-0\.005\(census\), positive favouring the uncapped fit, and stays within±0\.01\\pm 0\.01at every measuredNN\.

Table 3\.Per\-detector wall\-clock over the4747ADBench datasets, one CPU core: median fit, median inference, worst\-case total; cells shaded∝log\\propto\\logwithin each column\. KDE and DTE\-NP did not complete on55and11datasets \(medians cover completed runs\)\. All timings are author measurements\.

## 6\.Kernel\-Anchored Regularization

kcmcannot collapse, at a price: it has no trainable parameters, so a dataset cannot improve it\. The vanilla fixed\-target detector is trainable, and Section[3](https://arxiv.org/html/2610.02345#S3)showed that training is what destroys it\. This section keeps the trainable neural map and removes the failure by constraining it to a fixed radius of the kernel\-weighted average, a regularizer that is collapse\-proof for the same structural reasonkcmis\.

### 6\.1\.Definition

kcmreplaced the neural mapmθm\_\{\\theta\}of Definition[1](https://arxiv.org/html/2610.02345#S3.Thmtheorem1)by the kernel\-weighted averagefkcmf\_\{\\textsc\{kcm\}\}of Eq\. \([3](https://arxiv.org/html/2610.02345#S4.E3)\)\. Kernel\-anchored regularization,kar, keeps the neural map and adds a penalty that holds it close tofkcmf\_\{\\textsc\{kcm\}\}\.

Write the deviation of the prediction from the kernel\-weighted average at a pointxxas

\(9\)δθ​\(x\)=‖mθ​\(x\)−fkcm​\(x\)‖\.\\delta\_\{\\theta\}\(x\)=\\bigl\\\|m\_\{\\theta\}\(x\)\-f\_\{\\textsc\{kcm\}\}\(x\)\\bigr\\\|\.The*kernel\-anchored regularizer*RρR\_\{\\rho\}penalizes this deviation:

\(10\)minθ⁡𝔼x​‖mθ​\(x\)−T⁡\(x\)‖2\+Rρ​\(mθ\),Rρ​\(mθ\)=∑xPρ​\(δθ​\(x\)\),\\min\_\{\\theta\}\\ \\mathbb\{E\}\_\{x\}\\bigl\\\|m\_\{\\theta\}\(x\)\-T\(x\)\\bigr\\\|^\{2\}\+R\_\{\\rho\}\(m\_\{\\theta\}\),\\qquad R\_\{\\rho\}\(m\_\{\\theta\}\)=\\sum\_\{x\}P\_\{\\rho\}\\bigl\(\\delta\_\{\\theta\}\(x\)\\bigr\),withPρP\_\{\\rho\}the deadzone penalty

\(11\)Pρ​\(δ\)=0​for​δ<ρ,Pρ​\(δ\)=\+∞​for​δ≥ρ\.P\_\{\\rho\}\(\\delta\)=0\\ \\text\{ for \}\\delta<\\rho,\\qquad P\_\{\\rho\}\(\\delta\)=\+\\infty\\ \\text\{ for \}\\delta\\geq\\rho\.RρR\_\{\\rho\}is a regularizer in the ordinary sense, a nondecreasing penalty on the size of the deviation fieldδθ\\delta\_\{\\theta\}; the deadzonePρP\_\{\\rho\}leaves the prediction free within the anchor radiusρ\\rhoand forbids it past that radius\. The one parameter isρ\\rho, measured in the units of the data and directly comparable to thekcmresidual scale: atρ=0\\rho=0the prediction is pinned tofkcmf\_\{\\textsc\{kcm\}\}andkariskcm; asρ→∞\\rho\\to\\inftythe penalty vanishes andkaris the vanilla detector\.

#### Constrained form\.

BecausePρP\_\{\\rho\}is infinite outside the anchor radius,RρR\_\{\\rho\}is the indicator function of the set

\(12\)𝒞=\{m:‖m⁡\(x\)−fkcm​\(x\)‖<ρ​for all​x\},\\mathcal\{C\}=\\bigl\\\{\\,m:\\ \\\|m\(x\)\-f\_\{\\textsc\{kcm\}\}\(x\)\\\|<\\rho\\ \\text\{ for all \}x\\,\\bigr\\\},the tube of radiusρ\\rhoaroundfkcmf\_\{\\textsc\{kcm\}\}\. The penalized objective is then identically the constrained problemminθ⁡𝔼x​‖mθ−T‖2\\min\_\{\\theta\}\\mathbb\{E\}\_\{x\}\\\|m\_\{\\theta\}\-T\\\|^\{2\}subject tomθ∈𝒞m\_\{\\theta\}\\in\\mathcal\{C\}; Proposition[1](https://arxiv.org/html/2610.02345#S6.Thmtheorem1)records the equivalence\.

#### The constraint is over the whole input space\.

The membership‖m⁡\(x\)−fkcm​\(x\)‖<ρ\\\|m\(x\)\-f\_\{\\textsc\{kcm\}\}\(x\)\\\|<\\rhoin Eq\. \([12](https://arxiv.org/html/2610.02345#S6.E12)\) is asked at everyx∈ℝDx\\in\\mathbb\{R\}^\{D\}, not only at the training points, and this carries the method: the collapse is an off\-distribution event \(Proposition[2](https://arxiv.org/html/2610.02345#S3.Thmtheorem2)\), and a penalty summed over training inputs is blind there, exactly as the fixed\-target loss is\.RρR\_\{\\rho\}is therefore a constraint on the functionmθm\_\{\\theta\}across its domain, and it is enforced as one\.

#### Realization\.

The membershipmθ∈𝒞m\_\{\\theta\}\\in\\mathcal\{C\}is enforced exactly, at everyxx, by writing the prediction as the kernel\-weighted average plus a bounded correction:

\(13\)mθ​\(x\)=fkcm​\(x\)\+gθ​\(x\),gθ​\(x\)=ρ​uθ​\(x\)1\+‖uθ​\(x\)‖,m\_\{\\theta\}\(x\)=f\_\{\\textsc\{kcm\}\}\(x\)\+g\_\{\\theta\}\(x\),\\qquad g\_\{\\theta\}\(x\)=\\rho\\,\\frac\{u\_\{\\theta\}\(x\)\}\{1\+\\\|u\_\{\\theta\}\(x\)\\\|\},whereuθu\_\{\\theta\}is an unconstrained multilayer perceptron\. The radial squash gives‖gθ​\(x\)‖<ρ\\\|g\_\{\\theta\}\(x\)\\\|<\\rhofor everyxx, somθm\_\{\\theta\}ranges over exactly the open tube𝒞\\mathcal\{C\}, and the correctiongθg\_\{\\theta\}is trained under the fixed\-target loss𝔼x​‖mθ−T‖2\\mathbb\{E\}\_\{x\}\\\|m\_\{\\theta\}\-T\\\|^\{2\}\. This iskar: the regularizer is not a term added to the loss but the hypothesis class the loss is minimized over, which is what lets a constraint over all ofℝD\\mathbb\{R\}^\{D\}be imposed without an intractable optimization\.

### 6\.2\.Propositions

###### Proposition 0 \(Penalty and constraint coincide\)\.

For any objectiveLL,infm\[L⁡\(m\)\+Rρ​\(m\)\]=infm∈𝒞L⁡\(m\)\\inf\_\{m\}\\,\[\\,L\(m\)\+R\_\{\\rho\}\(m\)\\,\]=\\inf\_\{m\\in\\mathcal\{C\}\}L\(m\), with the same infimum\.

Writerkcm​\(x\)=x−x^h​\(x\)r\_\{\\textsc\{kcm\}\}\(x\)=x\-\\hat\{x\}\_\{h\}\(x\)for thekcmresidual, with‖rkcm​\(x\)‖=skcm​\(x\)\\\|r\_\{\\textsc\{kcm\}\}\(x\)\\\|=s\_\{\\textsc\{kcm\}\}\(x\)\(Eq\. \([5](https://arxiv.org/html/2610.02345#S4.E5)\)\)\.

###### Proposition 0 \(Score floor\)\.

For the contraction targetT⁡\(x\)=−xT\(x\)=\-x, thekarscore satisfies, at everyxx,

\(14\)s⁡\(x\)\\displaystyle s\(x\)=‖mθ​\(x\)−T⁡\(x\)‖=‖rkcm​\(x\)\+gθ​\(x\)‖,\\displaystyle=\\bigl\\\|m\_\{\\theta\}\(x\)\-T\(x\)\\bigr\\\|=\\bigl\\\|r\_\{\\textsc\{kcm\}\}\(x\)\+g\_\{\\theta\}\(x\)\\bigr\\\|,\|s⁡\(x\)−skcm​\(x\)\|<ρ\.\\displaystyle\\bigl\|s\(x\)\-s\_\{\\textsc\{kcm\}\}\(x\)\\bigr\|<\\rho\.By Proposition[2](https://arxiv.org/html/2610.02345#S4.Thmtheorem2),s⁡\(x\)\>dist⁡\(x,conv⁡\(X\)\)−ρs\(x\)\>\\operatorname\{dist\}\(x,\\operatorname\{conv\}\(X\)\)\-\\rho, sosscannot vanish sufficiently far outside the convex hull of the training normals: the collapsed solutions≡0s\\equiv 0is outside the hypothesis class for every finiteρ\\rho\.

The two rankings agree on every point pair whosekcmscores differ by more than2​ρ2\\rho, so the peak\-to\-final AUROC gap is controlled by the pair mass below2​ρ2\\rho: it vanishes asρ→0\\rho\\to 0and grows with the radius, as the ablation below measures\.

###### Proposition 0 \(One detector across backbones\)\.

Instantiatekaron a fixed\-target backbone with targetTBT\_\{B\}by anchoring atAB=TB\+rkcmA\_\{B\}=T\_\{B\}\+r\_\{\\textsc\{kcm\}\}and predictingmθ=AB\+gθm\_\{\\theta\}=A\_\{B\}\+g\_\{\\theta\}\. Then the training loss and the anomaly score,

\(15\)𝔼x​‖mθ​\(x\)−TB​\(x\)‖2\\displaystyle\\mathbb\{E\}\_\{x\}\\bigl\\\|m\_\{\\theta\}\(x\)\-T\_\{B\}\(x\)\\bigr\\\|^\{2\}=𝔼x​‖rkcm​\(x\)\+gθ​\(x\)‖2,\\displaystyle=\\mathbb\{E\}\_\{x\}\\bigl\\\|r\_\{\\textsc\{kcm\}\}\(x\)\+g\_\{\\theta\}\(x\)\\bigr\\\|^\{2\},‖mθ​\(x\)−TB​\(x\)‖\\displaystyle\\bigl\\\|m\_\{\\theta\}\(x\)\-T\_\{B\}\(x\)\\bigr\\\|=‖rkcm​\(x\)\+gθ​\(x\)‖,\\displaystyle=\\bigl\\\|r\_\{\\textsc\{kcm\}\}\(x\)\+g\_\{\\theta\}\(x\)\\bigr\\\|,are both independent ofTBT\_\{B\}:karis the one detector of Proposition[2](https://arxiv.org/html/2610.02345#S6.Thmtheorem2)on any fixed\-target backbone\.

For contraction matching \(T=−xT=\-x\) the anchorAB=−x^hA\_\{B\}=\-\\hat\{x\}\_\{h\}is the kernel\-weighted averagefkcmf\_\{\\textsc\{kcm\}\}itself; for the autoencoder \(T=\+xT=\+x\) and Deep SVDD \(T≡cT\\equiv c\) it differs fromfkcmf\_\{\\textsc\{kcm\}\}but yieldsmθ−TB=rkcm\+gθm\_\{\\theta\}\-T\_\{B\}=r\_\{\\textsc\{kcm\}\}\+g\_\{\\theta\}all the same \(Appendix[B](https://arxiv.org/html/2610.02345#A2)\)\.

### 6\.3\.Experiments

#### Setup\.

We evaluatekaron the six ADBench datasets where Section[3](https://arxiv.org/html/2610.02345#S3)found a clear convergence collapse, namelyannthyroid,Pima,Ionosphere,WDBC,cardio, andvertebral\. Splits are those of Section[5](https://arxiv.org/html/2610.02345#S5); every number is from our own runs\. The collapse metric is the peak\-to\-final AUROC gap,gap=peak−final\\mathrm\{gap\}=\\mathrm\{peak\}\-\\mathrm\{final\}\. The correctiongθg\_\{\\theta\}is a three\-layer perceptron trained for100100epochs over three seeds, except where a longer horizon is stated, and the anchor radius is swept overρ∈\{0,0\.5,1,2,5,100\}\\rho\\in\\\{0,0\.5,1,2,5,100\\\}\. The kernel anchor uses the same bandwidth grid as Section[4](https://arxiv.org/html/2610.02345#S4)with the untrimmed leave\-one\-out selector \(β=0\\beta=0\)\.

#### The anchor radius interpolates KCM and the vanilla detector\.

Table[4](https://arxiv.org/html/2610.02345#S6.T4)sweepsρ\\rho\. Atρ=0\\rho=0the correction is identically zero andkarreproduceskcmwithgap=0\\mathrm\{gap\}=0on all six datasets\. Asρ\\rhogrows the bounded correction is free to move: at its best radiuskarimproves on the kernel\-weighted average it anchors to on three of the six datasets, by\+0\.019\+0\.019onannthyroidand\+0\.028\+0\.028onPima, and ties it on two more that are already near saturation; the gains do not extend to the full benchmark \(below\)\. The collapse stays bounded; atρ=0\.5\\rho=0\.5the gap is at most\+0\.004\+0\.004\. Removing the regularizer,ρ=100\\rho=100in the table, brings the collapse back: the final AUROC falls belowkcmon every competitive dataset, by0\.0150\.015to0\.0260\.026, and the gap widens to as much as\+0\.044\+0\.044, growing withρ\\rhothroughout, consistent with the score bound of Proposition[2](https://arxiv.org/html/2610.02345#S6.Thmtheorem2)\.

Table 4\.karanchor\-radius ablation, six collapse\-prone datasets \(mean of three seeds,100100epochs\)\.ρ⋆\\rho^\{\\star\}, the smallest positive radius approaching the best final AUROC, is an*oracle upper bound*\. Last columns: regularizer removed \(ρ=100\\rho=100\)\.gap=peak−final\\mathrm\{gap\}=\\mathrm\{peak\}\-\\mathrm\{final\}\.
#### A fixed radius avoids per\-dataset label tuning\.

ρ⋆\\rho^\{\\star\}in Table[4](https://arxiv.org/html/2610.02345#S6.T4)is an oracle: it relies on information unavailable at deployment, an upper bound rather than a rule a practitioner can run\. The deployable rule is a constant: the radius is expressed inkcm\-residual units onzz\-scored features, andρ=0\.5\\rho=0\.5is used unchanged on every dataset in this paper; the4747\-dataset sweep prices the choice\. Against the oracle radius, the fixed default costs a mean of0\.00490\.0049AUROC and a median of0\.00070\.0007over the4747datasets\. On five of the six collapse\-prone datasets of Table[4](https://arxiv.org/html/2610.02345#S6.T4)it is within0\.0010\.001of the oracle, and on four it attains it\. Eight of the4747lose more than0\.0050\.005: the two largest losses \(0\.0670\.067,0\.0370\.037\) are on datasets where the kernel anchor itself is at or near chance \(0\.620\.62and0\.480\.48AUROC\), wherekarhas nothing to sharpen; the remaining six lose0\.0070\.007to0\.0280\.028\.

#### The full benchmark\.

We repeat theρ\\rho\-ablation over all4747ADBench datasets,846846runs in total\. Figure[5](https://arxiv.org/html/2610.02345#acmlabel5)sorts the per\-dataset gap\. Atρ=0\.5\\rho=0\.5karholds the gap below0\.020\.02on4242of the4747datasets; with the regularizer removed the gap clears0\.020\.02on1414\.karalso stays on its anchor: the mean final AUROC atρ=0\.5\\rho=0\.5is within0\.0010\.001of theρ=0\\rho=0smoother and within0\.020\.02of it on4343datasets, while the regularizer\-removed limit falls more than0\.010\.01below the anchor on1717\.

Figure 5\.Convergence\-collapse gap on the4747ADBench datasets,karatρ=0\.5\\rho=0\.5vs the regularizer removed \(ρ=100\\rho=100\); each series sorted independently, dotted line at the0\.020\.02threshold\. Mean of three seeds,846846runs\.Per\-dataset convergence\-collapse gap across the 47 ADBench datasets\. Two lines, each sorted ascending: KAR at radius rho equals 0\.5 stays at or below a 0\.02 collapse threshold on 42 of 47 datasets, while the regularizer\-removed limit exceeds the threshold on 14 datasets\.
#### The three backbones are one detector\.

Instantiated through TCCM, an autoencoder, and Deep SVDD,kargives the same detector: the three final AUROCs agree to a cross\-backbone spread of at most2\.2×10−22\.2\\times 10^\{\-2\}on the five competitive datasets, with a median of2\.4×10−32\.4\\times 10^\{\-3\}, as Proposition[3](https://arxiv.org/html/2610.02345#S6.Thmtheorem3)predicts\.

#### Prolonged training\.

Figure[6](https://arxiv.org/html/2610.02345#acmlabel6)runs the training five times longer, to500500epochs, on four of the six datasets\. The anchored detector,ρ=0\.5\\rho=0\.5, holds its AUROC flat across the whole horizon: the gap is at most\+0\.0022\+0\.0022on all four, and the final AUROC stays above bothkcmand the unconstrained limit\. With the regularizer removed,ρ=100\\rho=100, the same backbone drifts down as training continues, and the gap opens to between\+0\.018\+0\.018and\+0\.069\+0\.069\.

Figure 6\.Test AUROC over500500epochs \(4 of 6 datasets\)\.karatρ=0\.5\\rho=0\.5\(red\) stays flat; with the regularizer removed \(ρ=100\\rho=100, grey\) the backbone drifts\. Dotted:kcm\. Mean of three seeds, shaded±1\\pm 1s\.d\.Four side\-by\-side line plots, one per dataset \(annthyroid, Pima, cardio, WDBC\), showing test AUROC over 500 training epochs\. The red curve \(KAR with rho equals 0\.5\) stays high and flat; the grey curve \(regularizer removed, rho equals 100\) drifts downward as training continues; a black dotted line marks the KCM reference\. Shaded bands are one standard deviation over three seeds\.

## 7\.Discussion

kcmwas built to avoid convergence collapse, and Section[5](https://arxiv.org/html/2610.02345#S5)shows the construction costs nothing in accuracy: a closed\-form local smoother is level with the strongest label\-free detectors on the benchmark\. The mean\-AUROC lead over the next methods is a tie within run\-to\-run noise, so the substance is the asymmetry behind it: the detectors that matchkcmare trained neural networks, andkcmmatches them with no gradient training, no GPU, and no labels\. The accuracy is stable across the benchmark, with mean AUROC about0\.880\.88on the low\-dimensional datasets \(D≤10D\\leq 10\),0\.870\.87in the middle range, and0\.850\.85on the high\-dimensional ones \(D\>50D\>50\)\.

TheO⁡\(N2​D\)O\(N^\{2\}D\)fit is the main limitation; Section[5](https://arxiv.org/html/2610.02345#S5)\(R3\) prices it: theN0=2000N\_\{0\}=2000cap makes the fit constant inNNat a measured cost within±0\.01\\pm 0\.01AUROC\.

#### Limitations\.

Two limitations bound thekarclaim, two more the locality argument itself\.karis anchored tokcm, so where the kernel anchor is near chance it has nothing to sharpen;vertebralis that case, andkardoes not help there\. Across the full benchmarkkarmatches the anchor rather than improving on it; the benchmark\-wide contribution is the removal of the collapse at no accuracy cost\. The locality argument is strongest for*extrapolative*anomalies, points that leave the training data; clustered, conditional, or in\-hull anomalies are not separately evaluated here\. And necessity is not shown: Proposition[2](https://arxiv.org/html/2610.02345#S6.Thmtheorem2)needs only an off\-hull floor on the reference score, so other locality constraints could serve as the anchor; whether they do equally well is untested\.

## 8\.Conclusion

We identified a convergence collapse in fixed\-target anomaly detectors: training the neural map toward its target erases the residual signal off the data, so better optimization makes the detector worse\. The cause is a missing locality constraint, and we supplied it twice\.kcm, the kernel\-regression analog of the fixed\-target family, is a closed\-form, training\-free detector that cannot collapse and matches the strongest trained detectors on ADBench\.karcarries the same constraint into a trainable detector, regularizing a neural map to a tube around the kernel\-weighted average; it is collapse\-proof by construction, holds its accuracy across all4747ADBench datasets and three backbones under prolonged training, and improves on the kernel anchor where the data are collapse\-prone\. Both rest on one principle: an anomaly detector must not be free to extrapolate its on\-data behaviour past the data, and anchoring the prediction to a local kernel estimate enforces that, in closed form or as a regularizer\.

Accuracy under prolonged training, not at an early peak, is the right metric: the same backbone can swing by0\.10\.1AUROC with the stopping epoch, and a paper that quotes only the peak is reporting a regularizer it has not named\. Andkcmraises the bar a trained detector must clear: where a closed\-form kernel smoother matches the best neural detector, the deep methods are paying their training cost for no accuracy gain\.

###### Acknowledgements\.

This work was performed using HPC resources from the “Mésocentre” computing center of CentraleSupélec and École Normale Supérieure Paris\-Saclay supported by CNRS and Région Île\-de\-France \([http://mesocentre\.centralesupelec\.fr/](http://mesocentre.centralesupelec.fr/)\)\. This research benefited from the support of the Chair “Artificial Intelligence applied to the banking domain and to global health” led by CentraleSupélec and sponsored by Lusis, and by a CIFRE fellowship\. This project was provided with computing AI and storage resources by GENCI at IDRIS thanks to the grant 2026\-AD011011828R6 on the supercomputer Jean Zay’s H100 partition\.

## Appendix AProofs

###### Proof of Theorem[1](https://arxiv.org/html/2610.02345#S4.Thmtheorem1)\.

In the infinite\-width limit the tangent kernel is constant through training\([Jacot et al\., 2018](https://arxiv.org/html/2610.02345#bib.bib15)\), and the trained network evolves as a linear model under gradient descent\([Lee et al\., 2019](https://arxiv.org/html/2610.02345#bib.bib17)\)\. On the training inputs the squared\-error objective makes the function\-space gradient flow the linear systemd​mτ​\(X\)/d​τ=−η​Θ​\(X,X\)​\(mτ​\(X\)−𝐓\)\\mathrm\{d\}m\_\{\\tau\}\(X\)/\\mathrm\{d\}\\tau=\-\\eta\\,\\Theta\(X,X\)\\,\(m\_\{\\tau\}\(X\)\-\\mathbf\{T\}\), whose solution from a zero\-output initialization ismτ​\(X\)=\(I−e−η​τ​Θ​\(X,X\)\)​𝐓m\_\{\\tau\}\(X\)=\(I\-e^\{\-\\eta\\tau\\,\\Theta\(X,X\)\}\)\\,\\mathbf\{T\}\. For vector targets the linearized flow is coordinate\-wise under the standard NTK parameterization, so theDD\-dimensional system decouples intoDDscalar copies\. The constant kernel propagates this flow to a query asmτ​\(q\)=Θ⁡\(q,X\)​Θ​\(X,X\)−1​mτ​\(X\)m\_\{\\tau\}\(q\)=\\Theta\(q,X\)\\,\\Theta\(X,X\)^\{\-1\}m\_\{\\tau\}\(X\), which is Eq\. \([6](https://arxiv.org/html/2610.02345#S4.E6)\); sendingτ→∞\\tau\\to\\inftydrives the matrix exponentiale−η​τ​Θ​\(X,X\)e^\{\-\\eta\\tau\\Theta\(X,X\)\}to zero\. ∎

###### Proof of Proposition[1](https://arxiv.org/html/2610.02345#S6.Thmtheorem1)\.

RρR\_\{\\rho\}is the indicator of𝒞\\mathcal\{C\}, zero on it and\+∞\+\\inftyoff it, so adding it changes neither the value nor the infima ofLLon𝒞\\mathcal\{C\}\. ∎

###### Proof of Proposition[2](https://arxiv.org/html/2610.02345#S6.Thmtheorem2)\.

WithT=−xT=\-x,fkcm​\(x\)=−x^h​\(x\)f\_\{\\textsc\{kcm\}\}\(x\)=\-\\hat\{x\}\_\{h\}\(x\)by Eq\. \([3](https://arxiv.org/html/2610.02345#S4.E3)\), somθ​\(x\)−T⁡\(x\)=−x^h​\(x\)\+gθ​\(x\)\+x=rkcm​\(x\)\+gθ​\(x\)m\_\{\\theta\}\(x\)\-T\(x\)=\-\\hat\{x\}\_\{h\}\(x\)\+g\_\{\\theta\}\(x\)\+x=r\_\{\\textsc\{kcm\}\}\(x\)\+g\_\{\\theta\}\(x\); taking norms gives the first equality of Eq\. \([14](https://arxiv.org/html/2610.02345#S6.E14)\)\. The reverse triangle inequality with‖gθ​\(x\)‖<ρ\\\|g\_\{\\theta\}\(x\)\\\|<\\rhothen gives\|‖rkcm​\(x\)\+gθ​\(x\)‖−‖rkcm​\(x\)‖\|<ρ\|\\,\\\|r\_\{\\textsc\{kcm\}\}\(x\)\+g\_\{\\theta\}\(x\)\\\|\-\\\|r\_\{\\textsc\{kcm\}\}\(x\)\\\|\\,\|<\\rho, the second\. Proposition[2](https://arxiv.org/html/2610.02345#S4.Thmtheorem2)boundsskcm​\(x\)≥dist⁡\(x,conv⁡\(X\)\)s\_\{\\textsc\{kcm\}\}\(x\)\\geq\\operatorname\{dist\}\(x,\\operatorname\{conv\}\(X\)\), sos⁡\(x\)\>skcm​\(x\)−ρ≥dist⁡\(x,conv⁡\(X\)\)−ρs\(x\)\>s\_\{\\textsc\{kcm\}\}\(x\)\-\\rho\\geq\\operatorname\{dist\}\(x,\\operatorname\{conv\}\(X\)\)\-\\rho, unbounded asxxleaves the hull, sos≡0s\\equiv 0is excluded for every finiteρ\\rho\. ∎

###### Proof of Proposition[3](https://arxiv.org/html/2610.02345#S6.Thmtheorem3)\.

SubstitutingAB=TB\+rkcmA\_\{B\}=T\_\{B\}\+r\_\{\\textsc\{kcm\}\}intomθ=AB\+gθm\_\{\\theta\}=A\_\{B\}\+g\_\{\\theta\}givesmθ−TB=\(TB\+rkcm\)\+gθ−TB=rkcm\+gθm\_\{\\theta\}\-T\_\{B\}=\(T\_\{B\}\+r\_\{\\textsc\{kcm\}\}\)\+g\_\{\\theta\}\-T\_\{B\}=r\_\{\\textsc\{kcm\}\}\+g\_\{\\theta\}; taking the norm directly gives the second equality of Eq\. \([15](https://arxiv.org/html/2610.02345#S6.E15)\), and squaring then taking𝔼x\\mathbb\{E\}\_\{x\}gives the first\. Both right\-hand sides depend only ongθg\_\{\\theta\},rkcmr\_\{\\textsc\{kcm\}\}and the input distribution, not onTBT\_\{B\}\. ∎

## Appendix BBackbone independence

Table[5](https://arxiv.org/html/2610.02345#A2.T5)gives the per\-dataset breakdown of the cross\-backbone result\. TCCM and Deep SVDD share the same loss and score in exact arithmetic \(Proposition[3](https://arxiv.org/html/2610.02345#S6.Thmtheorem3)\); the AE route is the sign reparameterizationgθ→−gθg\_\{\\theta\}\\\!\\to\\\!\-g\_\{\\theta\}\.vertebralis the Scope case of §[6\.3](https://arxiv.org/html/2610.02345#S6.SS3)\.

Table 5\.karthrough three fixed\-target backbones \(ρ=1\\rho=1, mean of three seeds,100100epochs\);*spread*= maximum, over seeds, of the per\-seed pairwise gap of the three final AUROCs\.Table with one row per of six datasets and four numeric columns: AUROC via TCCM, via AE, via Deep SVDD, and the cross\-backbone spread\. On five of the six datasets the three AUROCs differ by less than 2\.2e\-2; on vertebral the spread reaches 6\.2e\-2 because the kernel anchor is near random\.
## Appendix CReproduction

All experiments use the4747ADBench datasets\([Han et al\., 2022](https://arxiv.org/html/2610.02345#bib.bib13)\)under the standardized semi\-supervised splits \(50%50\\%normals for training\), withzz\-scored features; thekcmfit and thekarsetup are exactly those of Sections[4](https://arxiv.org/html/2610.02345#S4)and[6\.3](https://arxiv.org/html/2610.02345#S6.SS3), withuθu\_\{\\theta\}a three\-layer width\-256256ReLU MLP trained with Adam \(10−310^\{\-3\}, batch256256\)\. Full configurations, run logs, and the per\-run results behind every table and figure:[https://github\.com/jose\-melo/kernel\-contraction\-matching](https://github.com/jose-melo/kernel-contraction-matching)\.

## Disclosure of Generative AI Use

Large language model assistants \(Anthropic Claude\) were used during the preparation of this work for grammar checking, writing assistance, and figure\-generation code\. All theoretical statements, proofs, experimental designs and reported results were produced and verified by the authors, who take full responsibility for the content of this paper\. No generative tool is listed as an author\.

## References

- Beizaee et al\.\(2025\)Farzad Beizaee, Sina Hajimiri, Ismail Ben Ayed, Gregory Lodygensky, Christian Desrosiers, and Jose Dolz\. 2025\.REFLECT: Rectified Flows for Efficient Brain Anomaly Correction Transport\. In*Medical Image Computing and Computer Assisted Intervention – MICCAI 2025**\(Lecture Notes in Computer Science, Vol\. 15963\)*\. 456–466\.[doi:10\.1007/978\-3\-032\-04965\-0\_43](https://doi.org/10.1007/978-3-032-04965-0_43)
- Bouman et al\.\(2024\)Roel Bouman, Zaharah Bukhsh, and Tom Heskes\. 2024\.Unsupervised Anomaly Detection Algorithms on Real\-world Data: How Many Do We Need?*Journal of Machine Learning Research*25, 105 \(2024\), 1–34\.
- Breunig et al\.\(2000\)Markus M\. Breunig, Hans\-Peter Kriegel, Raymond T\. Ng, and Jörg Sander\. 2000\.LOF: Identifying Density\-Based Local Outliers\. In*Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data \(SIGMOD ’00\)*\. 93–104\.[doi:10\.1145/342009\.335388](https://doi.org/10.1145/342009.335388)
- Chandola et al\.\(2009\)Varun Chandola, Arindam Banerjee, and Vipin Kumar\. 2009\.Anomaly detection: A survey\.*ACM Comput\. Surv\.*41, 3, Article 15 \(July 2009\)\.[doi:10\.1145/1541880\.1541882](https://doi.org/10.1145/1541880.1541882)
- Chong et al\.\(2020\)Penny Chong, Lukas Ruff, Marius Kloft, and Alexander Binder\. 2020\.Simple and Effective Prevention of Mode Collapse in Deep One\-Class Classification\. In*2020 International Joint Conference on Neural Networks \(IJCNN\)*\. 1–9\.[doi:10\.1109/IJCNN48605\.2020\.9207209](https://doi.org/10.1109/IJCNN48605.2020.9207209)
- Dai et al\.\(2025\)Wei Dai, Kai Hwang, and Jicong Fan\. 2025\.Unsupervised Anomaly Detection for Tabular Data Using Deep Noise Evaluation\.*Proceedings of the AAAI Conference on Artificial Intelligence*39, 11 \(apr 2025\), 11553–11562\.[doi:10\.1609/aaai\.v39i11\.33257](https://doi.org/10.1609/aaai.v39i11.33257)
- Ghafourian et al\.\(2025\)Amin Ghafourian, Huanyi Shui, Devesh Upadhyay, Rajesh Gupta, Dimitar Filev, and Iman Soltani\. 2025\.Targeted Collapse Regularized Autoencoder for Anomaly Detection: Black Hole at the Center\.*IEEE Transactions on Neural Networks and Learning Systems*36, 6 \(jun 2025\), 10348–10358\.[doi:10\.1109/TNNLS\.2024\.3472456](https://doi.org/10.1109/TNNLS.2024.3472456)
- Goldstein and Uchida \(2016\)Markus Goldstein and Seiichi Uchida\. 2016\.A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data\.*PLOS ONE*11, 4 \(2016\), e0152173\.[doi:10\.1371/journal\.pone\.0152173](https://doi.org/10.1371/journal.pone.0152173)
- Gong et al\.\(2019\)Dong Gong, Lingqiao Liu, Vuong Le, Budhaditya Saha, Moussa Reda Mansour, Svetha Venkatesh, and Anton van den Hengel\. 2019\.Memorizing Normality to Detect Anomaly: Memory\-Augmented Deep Autoencoder for Unsupervised Anomaly Detection\. In*2019 IEEE/CVF International Conference on Computer Vision \(ICCV\)*\. 1705–1714\.[doi:10\.1109/ICCV\.2019\.00179](https://doi.org/10.1109/ICCV.2019.00179)
- Goodge et al\.\(2022\)Adam Goodge, Bryan Hooi, See\-Kiong Ng, and Wee Siong Ng\. 2022\.LUNAR: Unifying Local Outlier Detection Methods via Graph Neural Networks\.*Proceedings of the AAAI Conference on Artificial Intelligence*36, 6 \(2022\), 6737–6745\.[doi:10\.1609/aaai\.v36i6\.20629](https://doi.org/10.1609/aaai.v36i6.20629)
- Grinsztajn et al\.\(2022\)Léo Grinsztajn, Edouard Oyallon, and Gaël Varoquaux\. 2022\.Why do tree\-based models still outperform deep learning on typical tabular data?\. In*Advances in Neural Information Processing Systems, Datasets and Benchmarks Track*, Vol\. 35\. 507–520\.[doi:10\.52202/068431\-0037](https://doi.org/10.52202/068431-0037)
- Han et al\.\(2022\)Songqiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao\. 2022\.ADBench: Anomaly Detection Benchmark\. In*Advances in Neural Information Processing Systems, Datasets and Benchmarks Track*, Vol\. 35\. 32142–32159\.[doi:10\.52202/068431\-2329](https://doi.org/10.52202/068431-2329)
- Huang et al\.\(2024\)Yihong Huang, Yuang Zhang, Liping Wang, Fan Zhang, and Xuemin Lin\. 2024\.EntropyStop: Unsupervised Deep Outlier Detection with Loss Entropy\. In*Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining**\(KDD ’24\)*\. 1143–1154\.[doi:10\.1145/3637528\.3671943](https://doi.org/10.1145/3637528.3671943)
- Jacot et al\.\(2018\)Arthur Jacot, Franck Gabriel, and Clément Hongler\. 2018\.Neural Tangent Kernel: Convergence and Generalization in Neural Networks\. In*Advances in Neural Information Processing Systems*, Vol\. 31\.
- Lang et al\.\(2022\)Christopher I\. Lang, Fan\-Keng Sun, Bruce Lawler, Jack Dillon, Ash Al Dujaili, John Ruth, Peter Cardillo, Perry Alfred, Alan Bowers, Adrian McKiernan, and Duane S\. Boning\. 2022\.One Class Process Anomaly Detection Using Kernel Density Estimation Methods\.*IEEE Transactions on Semiconductor Manufacturing*35, 3 \(aug 2022\), 457–469\.[doi:10\.1109/TSM\.2022\.3181468](https://doi.org/10.1109/TSM.2022.3181468)
- Lee et al\.\(2019\)Jaehoon Lee, Lechao Xiao, Samuel S\. Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl\-Dickstein, and Jeffrey Pennington\. 2019\.Wide Neural Networks of Any Depth Evolve as Linear Models Under Gradient Descent\. In*Advances in Neural Information Processing Systems*, Vol\. 32\. 8570–8581\.
- Li et al\.\(2025b\)Liangwei Li, Lin Liu, Hanzhe Liang, Juanxiu Liu, Jing Zhang, Ruqian Hao, Xiaohui Du, Yong Liu, and Pan Li\. 2025b\.Time\-reversed Flow Matching with Worst Transport in High\-dimensional Latent Space for Image Anomaly Detection\.arXiv:2508\.05461 \[cs\.CV\][doi:10\.48550/arXiv\.2508\.05461](https://doi.org/10.48550/arXiv.2508.05461)
- Li et al\.\(2025a\)Zhong Li, Qi Huang, Yuxuan Zhu, Lincen Yang, Mohammad Mohammadi Amiri, Niki van Stein, and Matthijs van Leeuwen\. 2025a\.Scalable, Explainable and Provably Robust Anomaly Detection with One\-Step Flow Matching\. In*Advances in Neural Information Processing Systems*, Vol\. 38\. 97620–97685\.[doi:10\.52202/085713\-2936](https://doi.org/10.52202/085713-2936)
- Li et al\.\(2020\)Zheng Li, Yue Zhao, Nicola Botta, Cezar Ionescu, and Xiyang Hu\. 2020\.COPOD: Copula\-Based Outlier Detection\. In*2020 IEEE International Conference on Data Mining \(ICDM\)*\. 1118–1123\.[doi:10\.1109/ICDM50108\.2020\.00135](https://doi.org/10.1109/ICDM50108.2020.00135)
- Liu et al\.\(2008\)Fei Tony Liu, Kai Ming Ting, and Zhi\-Hua Zhou\. 2008\.Isolation Forest\. In*2008 Eighth IEEE International Conference on Data Mining \(ICDM 2008\)*\. 413–422\.[doi:10\.1109/ICDM\.2008\.17](https://doi.org/10.1109/ICDM.2008.17)
- Livernoche et al\.\(2024\)Victor Livernoche, Vineet Jain, Yashar Hezaveh, and Siamak Ravanbakhsh\. 2024\.On Diffusion Modeling for Anomaly Detection\. In*The Twelfth International Conference on Learning Representations*\.
- Miftachov et al\.\(2026\)Ratmir Miftachov, Bruno Charron, and Simon Valentin\. 2026\.Interpretable Tabular Foundation Models via In\-Context Kernel Regression\.arXiv:2602\.02162 \[cs\.LG\][doi:10\.48550/arXiv\.2602\.02162](https://doi.org/10.48550/arXiv.2602.02162)
- Nkashama et al\.\(2025\)D’Jeff K\. Nkashama, Jordan F\. Masakuna, Arian Soltani, Jean\-Charles Verdier, Marc Frappier, Pierre\-Martin Tardif, and Froduald Kabanza\. 2025\.Deep Learning for Network Anomaly Detection Under Data Contamination: Evaluating Robustness and Mitigating Performance Degradation\. In*Computer Security\. ESORICS 2024 International Workshops – SECAI, DisA, CPS4CIP, and SecAssure, Bydgoszcz, Poland, September 16–20, 2024, Revised Selected Papers, Part II**\(Lecture Notes in Computer Science, Vol\. 15264\)*\. 68–87\.[doi:10\.1007/978\-3\-031\-82362\-6\_5](https://doi.org/10.1007/978-3-031-82362-6_5)
- Pang et al\.\(2021\)Guansong Pang, Chunhua Shen, Longbing Cao, and Anton van den Hengel\. 2021\.Deep Learning for Anomaly Detection: A Review\.*ACM Comput\. Surv\.*54, 2, Article 38 \(March 2021\)\.[doi:10\.1145/3439950](https://doi.org/10.1145/3439950)
- Perini et al\.\(2025\)Lorenzo Perini, Maja Rudolph, Sabrina Schmedding, and Chen Qiu\. 2025\.Uncertainty\-aware Evaluation of Auxiliary Anomalies with the Expected Anomaly Posterior\.*Transactions on Machine Learning Research*\(January 2025\)\.
- Qiu et al\.\(2021\)Chen Qiu, Timo Pfrommer, Marius Kloft, Stephan Mandt, and Maja Rudolph\. 2021\.Neural Transformation Learning for Deep Anomaly Detection Beyond Images\. In*Proceedings of the 38th International Conference on Machine Learning**\(Proceedings of Machine Learning Research, Vol\. 139\)*\. 8703–8714\.
- Ramaswamy et al\.\(2000\)Sridhar Ramaswamy, Rajeev Rastogi, and Kyuseok Shim\. 2000\.Efficient algorithms for mining outliers from large data sets\. In*Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data \(SIGMOD ’00\)*\. 427–438\.[doi:10\.1145/342009\.335437](https://doi.org/10.1145/342009.335437)
- Ruff et al\.\(2021\)Lukas Ruff, Jacob R\. Kauffmann, Robert A\. Vandermeulen, Grégoire Montavon, Wojciech Samek, Marius Kloft, Thomas G\. Dietterich, and Klaus\-Robert Müller\. 2021\.A Unifying Review of Deep and Shallow Anomaly Detection\.*Proc\. IEEE*109, 5 \(may 2021\), 756–795\.[doi:10\.1109/JPROC\.2021\.3052449](https://doi.org/10.1109/JPROC.2021.3052449)
- Ruff et al\.\(2018\)Lukas Ruff, Robert A\. Vandermeulen, Nico Görnitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft\. 2018\.Deep One\-Class Classification\. In*Proceedings of the 35th International Conference on Machine Learning**\(Proceedings of Machine Learning Research, Vol\. 80\)*\. 4393–4402\.
- Sattarov et al\.\(2025\)Timur Sattarov, Marco Schreyer, and Damian Borth\. 2025\.Diffusion\-Scheduled Denoising Autoencoders for Anomaly Detection in Tabular Data\. In*Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V\.2**\(KDD ’25\)*\. 2478–2489\.[doi:10\.1145/3711896\.3736910](https://doi.org/10.1145/3711896.3736910)
- Schölkopf et al\.\(1999\)Bernhard Schölkopf, Robert C\. Williamson, Alex J\. Smola, John Shawe\-Taylor, and John C\. Platt\. 1999\.Support Vector Method for Novelty Detection\. In*Advances in Neural Information Processing Systems*, Vol\. 12\. 582–588\.
- Shenkar and Wolf \(2022\)Tom Shenkar and Lior Wolf\. 2022\.Anomaly Detection for Tabular Data with Internal Contrastive Learning\. In*International Conference on Learning Representations*\.
- Song and Ermon \(2019\)Yang Song and Stefano Ermon\. 2019\.Generative Modeling by Estimating Gradients of the Data Distribution\. In*Advances in Neural Information Processing Systems*, Vol\. 32\. 11895–11907\.
- Thimonier et al\.\(2024\)Hugo Thimonier, Fabrice Popineau, Arpad Rimmel, and Bich\-Liên Doan\. 2024\.Beyond Individual Input for Deep Anomaly Detection on Tabular Data\. In*Proceedings of the 41st International Conference on Machine Learning**\(Proceedings of Machine Learning Research, Vol\. 235\)*\. 48097–48123\.
- Wang et al\.\(2020\)Hu Wang, Guansong Pang, Chunhua Shen, and Congbo Ma\. 2020\.Unsupervised Representation Learning by Predicting Random Distances\. In*Proceedings of the Twenty\-Ninth International Joint Conference on Artificial Intelligence, IJCAI\-20*\. 2950–2956\.[doi:10\.24963/ijcai\.2020/408](https://doi.org/10.24963/ijcai.2020/408)
- Wang et al\.\(2019\)Siqi Wang, Yijie Zeng, Xinwang Liu, En Zhu, Jianping Yin, Chuanfu Xu, and Marius Kloft\. 2019\.Effective End\-to\-end Unsupervised Outlier Detection via Inlier Priority of Discriminative Network\. In*Advances in Neural Information Processing Systems*, Vol\. 32\. 5960–5973\.
- Yin et al\.\(2024\)Jiaxin Yin, Yuanyuan Qiao, Zitang Zhou, Xiangchao Wang, and Jie Yang\. 2024\.MCM: Masked Cell Modeling for Anomaly Detection in Tabular Data\. In*The Twelfth International Conference on Learning Representations*\.
- Yoon et al\.\(2023\)Sangwoong Yoon, Young\-Uk Jin, Yung\-Kyun Noh, and Frank C\. Park\. 2023\.Energy\-Based Models for Anomaly Detection: A Manifold Diffusion Recovery Approach\. In*Advances in Neural Information Processing Systems*, Vol\. 36\. 49445–49466\.[doi:10\.52202/075280\-2152](https://doi.org/10.52202/075280-2152)
- Zhang et al\.\(2024\)Yuang Zhang, Liping Wang, Yihong Huang, Yuanxing Zheng, Fan Zhang, and Xuemin Lin\. 2024\.GradStop: Exploring Training Dynamics in Unsupervised Outlier Detection through Gradient\.arXiv:2412\.08501 \[cs\.LG\][doi:10\.48550/arXiv\.2412\.08501](https://doi.org/10.48550/arXiv.2412.08501)