Testing the Test: Score-Direction Instability in Class-Split Anomaly Detection

# Testing the Test: Score-Direction Instability in Class-Split Anomaly Detection
Source: [https://arxiv.org/html/2606.02601](https://arxiv.org/html/2606.02601)
###### Abstract

Within\-dataset class\-split evaluation is widely used as a proxy for fully unconditional out\-of\-distribution anomaly detection\. We show that this protocol can become ill\-posed when the held\-out anomaly class overlaps the normal mixture in representation space\. In this regime, anomaly scores may collapse toward chance or even invert, and the preferred score direction can depend on the unknown anomaly class\. We introduce a simple training\-free diagnostic, neighborhood class leakage, and show that it predicts score\-direction instability across Fashion\-MNIST, CIFAR\-10, and Imagenette, in both pixel and VAE latent spaces\. Our results suggest that class\-split AD benchmarks should be treated as geometry\-dependent stress tests rather than unconditional evidence of anomaly\-detection ability\.

Anomaly detection, OOD detection, class\-split benchmarks, AUROC inversion, score\-direction instability, neighborhood leakage, benchmark diagnostics

## 1Introduction

A common evaluation strategy in anomaly detection \(AD\)\(Chalapathy and Chawla,[2019](https://arxiv.org/html/2606.02601#bib.bib1); Panget al\.,[2021](https://arxiv.org/html/2606.02601#bib.bib2)\)is to*simulate*anomalies by repurposing existing labeled datasets\. Two families of protocols dominate practice\. First,*cross\-dataset*evaluations train on one dataset and treat samples from a different dataset as anomalies, e\.g\., CIFAR vs\. SVHN\(Krizhevsky and Hinton,[2009](https://arxiv.org/html/2606.02601#bib.bib3); Netzeret al\.,[2011](https://arxiv.org/html/2606.02601#bib.bib4)\)\. Second,*within\-dataset class\-split*evaluations designate some semantic classes as normal and others as anomalous \(e\.g\., “99normal classes vs\.11anomalous class”\)\. This protocol is attractive because it appears “closer” to fully unconditional\-OOD AD: anomalies are not imported from an external source, and the semantic boundary is less contrived\. However, as we show, in the fully unconditional\-OOD regime this class\-split protocol can become*ill\-posed*in a precise operational sense\.

The core issue is distributional overlap\. In many natural image datasets, the set of samples from a designated “anomaly class” can lie*closer*to the bulk of the \(multi\-class\) normal mixture than a substantial fraction of the normal samples themselves\. In this regime, AD scores that are monotone in distance\-to\-normality can become unstable across anomaly choices: AUROC can collapse toward chance and may even*invert*\(AUROC<0\.5<0\.5\) for certain anomaly classes\. A tempting reaction is to treat inversion as a cosmetic artifact—e\.g\., by flipping the score direction—or to argue that a sufficiently strong detector will “re\-invert” the ranking and restore AUROC\. We argue this misses the underlying failure mode: when the direction of “anomalousness” depends on the \(unknown\) anomaly type, low scores are no longer interpretable in a consistent way\. Consequently, benchmark conclusions become fragile and can reward methods that exploit dataset\- and split\-specific quirks rather than reflecting robust unconditional\-OOD AD capability\.

This paper develops a practical diagnostic and an empirical characterization of this phenomenon\. We view class\-split AD benchmarks through the lens of*overlap*between class\-conditional manifolds in a given representation space\. We introduce a simple, training\-free*ill\-posedness index*based on local neighborhood class leakage, which quantifies the extent to which class labels fail to align with geometry\. Across datasets and representations, we show that this index predicts when class\-split fully unconditional\-OOD AD is likely to yield unstable or inverted rankings\.

### Contributions\.

Our contributions are:

- •We identify and formalize a practical failure mode of within\-dataset class\-split evaluation for fully unconditional\-OOD anomaly detection: class\-dependent score\-direction instability, AUROC collapse, and inversion driven by normal–anomaly overlap\.
- •We propose a simple, training\-free diagnostic \(a neighborhood leakage\-based ill\-posedness index\) that predicts when class\-split benchmarking is unreliable in a given representation space\.
- •We empirically validate the phenomenon and the diagnostic across a controlled matrix of settings: three datasets spanning increasing visual complexity \(Fashion\-MNIST as a negative control, CIFAR\-10, and Imagenette\), two representations \(pixel space and a fully unconditional\-OOD VAE latent space\), and multiple scoring families \(kNN, Isolation Forest, and Local Outlier Factor\)\.

## 2Problem setup and evaluation protocol

Consider a labeled dataset with classesy∈\{1,…,K\}y\\in\\\{1,\\ldots,K\\\}\. In a within\-dataset class\-split protocol, a subsetNNis designated normal and a disjoint subsetAAanomalous\. An AD method is fit only on unlabeled samples fromDND\_\{N\}, then evaluated by scoring samples fromDN∪DAD\_\{N\}\\cup D\_\{A\}\. We focus on the commonK−1K\-1vs\.11protocol: each classccis held out in turn as the anomalous class, producing class\-wise AUROC scoresAUC​\(c\)\\mathrm\{AUC\}\(c\)\(Fawcett,[2006](https://arxiv.org/html/2606.02601#bib.bib12)\)\. Class labels are used only for constructing evaluation splits, computing metrics, and computing the diagnostic below; no class\-dependent tuning or representation learning is performed\.

### Hypothesis\-test view\.

We interpret the class\-split protocol as an implicit test of whether a fixed representation and scoring rule induce a stable ordering in which the held\-out class is more atypical than the normal mixture\. Under this view, low AUROC is not the only failure mode\. A more structural failure occurs when the preferred score direction varies with the held\-out class: then the benchmark no longer tests a single class\-agnostic notion of anomalousness\. The leakage diagnostic below is intended to test this precondition before class\-split AUROC values are used as evidence for unconditional\-OOD AD ability\.

## 3A diagnostic for ill\-posed class\-split benchmarking

The within\-dataset class\-split protocol implicitly assumes that the designated anomalous class is sufficiently separated from the normal mixture in the chosen representation space\. When this assumption fails—i\.e\., when class\-conditional manifolds overlap strongly—the benchmark can exhibit AUROC collapse and class\-dependent score\-direction instability\. We now introduce a simple, training\-free diagnostic that quantifies this overlap and predicts when class\-split fully unconditional\-OOD AD evaluation is likely to be unreliable\.

### Representation space\.

Letr:𝒳→ℝdr:\\mathcal\{X\}\\to\\mathbb\{R\}^\{d\}denote a fixed representation map\. In our experiments,r​\(x\)r\(x\)is either the vectorized input \(pixel space\) or a latent code produced by a VAE encoder trained fully unconditional\-OOD on normal data\. All definitions below apply to any fixed representation\.

### Neighborhood class leakage\.

Given a labeled evaluation set𝒯=\{\(xi,yi\)\}i=1m\\mathcal\{T\}=\\\{\(x\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{m\}withyi∈\{1,…,K\}y\_\{i\}\\in\\\{1,\\dots,K\\\}used*only*for analysis, let𝒩k​\(i\)\\mathcal\{N\}\_\{k\}\(i\)denote the indices of thekknearest neighbors ofr​\(xi\)r\(x\_\{i\}\)among\{r​\(xj\)\}j≠i\\\{r\(x\_\{j\}\)\\\}\_\{j\\neq i\}under Euclidean distance\.111Other metrics can be used; we fix Euclidean distance for concreteness\.We define the*kkNN class leakage*of a sampleiias the fraction of its neighbors whose label differs from its own:

ℓk​\(i\)=1k​∑j∈𝒩k​\(i\)𝕀​\[yj≠yi\]\.\\ell\_\{k\}\(i\)\\;=\\;\\frac\{1\}\{k\}\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\(i\)\}\\mathbb\{I\}\\\!\\left\[y\_\{j\}\\neq y\_\{i\}\\right\]\.\(1\)Intuitively,ℓk​\(i\)\\ell\_\{k\}\(i\)measures the extent to which local geometry in the representation space aligns with semantic class structure:ℓk​\(i\)≈0\\ell\_\{k\}\(i\)\\approx 0indicates that the neighborhood ofxix\_\{i\}is class\-pure, whereasℓk​\(i\)≈1\\ell\_\{k\}\(i\)\\approx 1indicates heavy mixing with other classes\.

### Dataset\-level ill\-posedness index\.

We aggregate pointwise leakage into a dataset\-level diagnostic by averaging:

Lk​\(𝒯;r\)=1m​∑i=1mℓk​\(i\)\.L\_\{k\}\(\\mathcal\{T\};r\)\\;=\\;\\frac\{1\}\{m\}\\sum\_\{i=1\}^\{m\}\\ell\_\{k\}\(i\)\.\(2\)We refer toLkL\_\{k\}as an*ill\-posedness index*for class\-split benchmarking in representation spacerr\. High values ofLkL\_\{k\}indicate strong overlap of class\-conditional manifolds and suggest that holding out a semantic class as “anomalous” may not induce a clean normal–anomaly separation\.

### Why leakage predicts instability\.

Most classical unconditional\-OOD AD scores in a representation spacer​\(x\)r\(x\)are monotone in either \(i\) distance to the empirical support of the normal training set, or \(ii\) local density relative to a neighborhood estimate\. If the designated anomalous class occupies regions of the representation space that are densely populated by normal samples \(high local mixing\), then many anomalous points will receive low anomaly scores, while some normal tail points may receive higher scores\. As a consequence, the ranking induced bys​\(x\)s\(x\)becomes sensitive to the choice of held\-out class and can flip direction for certain anomaly classes\. The leakage index in Eq\. \([2](https://arxiv.org/html/2606.02601#S3.E2)\) provides a direct, training\-free proxy for this overlap and thus for benchmark ill\-posedness\.

## 4Instability and directionality metrics for class\-split AD

We now define summary statistics that quantify when within\-dataset class\-split evaluation is unreliable as a proxy for fully unconditional\-OOD anomaly detection\. Throughout, fix a dataset withKKsemantic classes and consider the “K−1K\\\!\-\\\!1vs\.11” protocol where the anomalous class is a single held\-out classc∈\{1,…,K\}c\\in\\\{1,\\dots,K\\\}\. For a fixed representationrrand scoring functionss, letAUC​\(c\)∈\[0,1\]\\mathrm\{AUC\}\(c\)\\in\[0,1\]denote the AUROC obtained when classccis treated as anomalous and the remainingK−1K\-1classes form the \(unlabeled\) normal training set\.

### AUROC dispersion\.

We report the mean, variance, and interquartile range ofAUC​\(c\)\\mathrm\{AUC\}\(c\)across held\-out anomaly classes\. High dispersion indicates that the benchmark is sensitive to the arbitrary choice of anomalous class\.

### Near\-random rate\.

To measure how often the protocol yields effectively chance\-level rankings, we define the near\-random rate at toleranceϵ\>0\\epsilon\>0as

ρrnd​\(ϵ\)=1K​∑c=1K𝕀​\[\|AUC​\(c\)−12\|≤ϵ\]\.\\rho\_\{\\mathrm\{rnd\}\}\(\\epsilon\)\\;=\\;\\frac\{1\}\{K\}\\sum\_\{c=1\}^\{K\}\\mathbb\{I\}\\\!\\left\[\\left\|\\mathrm\{AUC\}\(c\)\-\\tfrac\{1\}\{2\}\\right\|\\leq\\epsilon\\right\]\.\(3\)In experiments we use a small fixed tolerance \(e\.g\.,ϵ=0\.05\\epsilon=0\.05\) to quantify the prevalence of ambiguous rankings\.

### Inversion rate\.

A stronger failure mode occurs when the AUROC is*inverted*: anomalous samples are ranked as systematically*more normal*than normal samples, yieldingAUC​\(c\)<0\.5\\mathrm\{AUC\}\(c\)<0\.5\. We quantify this via the inversion rate

ρinv=1K​∑c=1K𝕀​\[AUC​\(c\)<12\]\.\\rho\_\{\\mathrm\{inv\}\}\\;=\\;\\frac\{1\}\{K\}\\sum\_\{c=1\}^\{K\}\\mathbb\{I\}\\\!\\left\[\\mathrm\{AUC\}\(c\)<\\tfrac\{1\}\{2\}\\right\]\.\(4\)While a single inversion can occur by chance on small test sets, persistent inversions concentrated on specific classes are indicative of substantial normal–anomaly overlap in the chosen representation\.

### Direction instability\.

A common reaction to inversion is to “flip” the score direction\. However, if the preferred direction depends on the \(unknown\) anomaly type, then the benchmark does not define a consistent notion of anomalousness\. We capture this by tracking the sign of the deviation from chance:

d​\(c\)=sign​\(AUC​\(c\)−12\)∈\{−1,0,\+1\},d\(c\)\\;=\\;\\mathrm\{sign\}\\\!\\left\(\\mathrm\{AUC\}\(c\)\-\\tfrac\{1\}\{2\}\\right\)\\in\\\{\-1,0,\+1\\\},\(5\)withd​\(c\)=0d\(c\)=0if\|AUC​\(c\)−12\|≤ϵ\\left\|\\mathrm\{AUC\}\(c\)\-\\tfrac\{1\}\{2\}\\right\|\\leq\\epsilon\. We then define a direction\-instability rate

ρdir​\(ϵ\)=1−1K​max⁡\{∑c=1K𝕀​\[d​\(c\)=\+1\],∑c=1K𝕀​\[d​\(c\)=−1\]\}\.\\rho\_\{\\mathrm\{dir\}\}\(\\epsilon\)=1\-\\frac\{1\}\{K\}\\max\\left\\\{\\sum\_\{c=1\}^\{K\}\\mathbb\{I\}\[d\(c\)=\+1\],\\sum\_\{c=1\}^\{K\}\\mathbb\{I\}\[d\(c\)=\-1\]\\right\\\}\.\(6\)This quantity is close to0when a single score direction is consistently preferred across anomaly classes and increases toward0\.50\.5when the benchmark exhibits mixed directions \(also, towards≥0\.5\\geq 0\.5if there are cases in whichd​\(c\)=0d\(c\)=0, and thus one should also see an increase inρrnd\\rho\_\{\\mathrm\{rnd\}\}\)\. This statistic operationalizes the intuition that “re\-inverting” scores does not resolve the underlying ambiguity when different anomaly classes induce different ranking directions\.

## 5Experimental setup

We evaluate three datasets of increasing visual complexity: Fashion\-MNIST\(Xiaoet al\.,[2017](https://arxiv.org/html/2606.02601#bib.bib5)\)as a low\-overlap negative control, CIFAR\-10\(Krizhevsky and Hinton,[2009](https://arxiv.org/html/2606.02601#bib.bib3)\), and Imagenette\(Howard,[2019](https://arxiv.org/html/2606.02601#bib.bib6); Russakovskyet al\.,[2015](https://arxiv.org/html/2606.02601#bib.bib7)\)\. For each dataset, we run theK−1K\-1vs\.11class\-split protocol, sweeping the held\-out anomalous classcc\. We evaluate two representation spaces: pixels and latent codesr​\(x\)=Eϕ​\(x\)r\(x\)=E\_\{\\phi\}\(x\)from a VAE\(Kingma and Welling,[2014](https://arxiv.org/html/2606.02601#bib.bib8)\)with ResNet\-like components\(Heet al\.,[2016](https://arxiv.org/html/2606.02601#bib.bib9)\), trained only on the unlabeled normal pool\. In each representation, we fit three standard unconditional AD scorers on the normal pool: kNN distance, Isolation Forest\(Liuet al\.,[2008](https://arxiv.org/html/2606.02601#bib.bib10)\), and Local Outlier Factor\(Breuniget al\.,[2000](https://arxiv.org/html/2606.02601#bib.bib11)\)\. Hyperparameters are fixed a priori and are not tuned per anomalous class\.

## 6Results

Table[1](https://arxiv.org/html/2606.02601#S6.T1)shows the diagnostic relationship between leakage and benchmark instability\. Fashion\-MNIST has low leakage and comparatively stable class\-split behavior, especially in pixel space\. By contrast, CIFAR\-10 and Imagenette have high leakage in both pixel and VAE latent spaces and exhibit substantial inversion and direction\-instability rates\. The pattern persists across multiple scoring families after averaging over kNN, Isolation Forest, and LOF, suggesting that the failure is not an artifact of a single detector or representation\. Figure[1](https://arxiv.org/html/2606.02601#S6.F1)shows this effect at the per\-class level for CIFAR\-10 in pixel space: several anomaly classes lie below chance while others lie substantially above it, despite using the same score convention\.

### Interpretation\.

The diagnostic should not be read as a replacement for AUROC, but as a precondition check on the benchmark itself\. Low leakage supports the interpretation that class\-split AUROC is measuring anomaly separation in the chosen representation\. High leakage, together with largeρinv\\rho\_\{\\mathrm\{inv\}\}orρdir\\rho\_\{\\mathrm\{dir\}\}, indicates that the protocol is better viewed as a geometry\-dependent stress test than as evidence of general unconditional\-OOD detection performance\.

Table 1:Diagnostic relationship between neighborhood leakage and benchmark instability\. Each row is a dataset–representation pair\. Instability summaries are averaged over kNN, Isolation Forest, and LOF\.![Refer to caption](https://arxiv.org/html/2606.02601v1/auc_by_class.jpg)Figure 1:Per\-class AUROC on CIFAR\-10 in pixel space under the99\-vs\.\-11class\-split protocol\. The dashed line marks chance performance\. Different held\-out anomaly classes induce both above\-chance and inverted rankings, illustrating score\-direction instability\.

## 7Discussion

### Why “just use a better AD method” does not resolve ill\-posed class\-split benchmarking\.

A natural counterargument is that AUROC inversion \(AUROC<0\.5<0\.5\) merely indicates that a given scoring function is “pointing in the wrong direction,” and that a sufficiently powerful anomaly detector should recover a standard ordering in which anomalies receive larger scores than normal samples\. In this view, the remedy is simply to use a stronger AD method that*re\-inverts*the ranking\. We argue that this interpretation conflates two distinct questions: \(i\) whether a particular method can be made to achieve AUROC\>0\.5\>0\.5on a*specific*class\-split instance, and \(ii\) whether the*benchmark protocol*provides a reliable basis for claims about fully unconditional\-OOD AD\. Our results address \(ii\)\.

### Inversion reflects overlap, not merely a sign convention\.

In theK−1K\\\!\-\\\!1vs\.11protocol, the “normal” distribution is itself a heterogeneous mixture overK−1K\-1semantic classes, often with substantial intra\-class variation \(backgrounds, pose, lighting, context\)\. When the held\-out anomalous class overlaps this mixture in the chosen representation space, many anomalous samples can lie in regions of high normal density, while some normal samples occupy low\-density tails\. Any score that is monotone in distance\-to\-normality or local density can then yield unstable rankings, and for certain held\-out classes the induced ranking can invert\. This is not a cosmetic issue: it indicates that the benchmark does not instantiate a clean separation between normality and the chosen anomaly class in the underlying geometry\.

### Re\-inverting can be achieved in\-sample without yielding a meaningful unconditional\-OOD notion of anomalousness\.

Even if a more complex detector yields AUROC\>0\.5\>0\.5for a given anomaly class, this does not imply that the protocol defines a consistent semantic notion of “anomaly\.” To see why, note that the anomaly class is*unknown*at deployment time\. If different held\-out classes induce different preferred score directions \(captured by direction\-instabilityρdir\\rho\_\{\\mathrm\{dir\}\}\), then the benchmark is effectively asking a method to solve multiple incompatible tasks: for some anomaly types, high scores should indicate anomalies; for others \(in inverted regimes\), low scores would indicate anomalies if one followed the empirical ordering\. A method that “fixes” AUROC on thelabeledevaluation split can do so by exploiting idiosyncratic correlations between class labels and representation geometry, without learning a class\-agnostic notion of atypicality\. In this setting, improving AUROC is not equivalent to resolving the ambiguity of what a low \(or high\) score means for an unseen anomaly type\.

Thus the issue is not merely low AUROC, but the loss of a stable score semantics under changes of the held\-out anomaly class\.

### Scope of the diagnostic\.

The proposed leakage index is not meant to certify that a benchmark is easy or hard in an absolute sense\. Rather, it identifies when the class\-split construction ceases to define a stable ordering problem for a fixed score convention\. Low leakage does not guarantee that a detector will perform well, but it supports the interpretation that AUROC is testing separation from the normal mixture\. High leakage together with large inversion or direction\-instability rates indicates that the benchmark is probing overlap geometry rather than a class\-agnostic notion of anomalousness\.

## 8Conclusion

Within\-dataset class\-split evaluation is not always invalid, but its interpretation depends on the geometry of the chosen representation\. We showed that, when a held\-out class overlaps the normal mixture, class\-split AD can exhibit AUROC collapse, inversion, and score\-direction instability across anomaly classes\. We introduced neighborhood leakage as a simple training\-free diagnostic for this failure mode and showed that it tracks instability across datasets, representations, and scorers\. These results suggest that class\-split benchmarks should report leakage and direction\-instability diagnostics before being used as evidence for fully unconditional\-OOD anomaly\-detection ability\.

## References

- M\. M\. Breunig, H\. Kriegel, R\. T\. Ng, and J\. Sander \(2000\)LOF: identifying density\-based local outliers\.InProceedings of the 2000 ACM SIGMOD International Conference on Management of Data,pp\. 93–104\.External Links:[Document](https://dx.doi.org/10.1145/342009.335388)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- R\. Chalapathy and S\. Chawla \(2019\)Deep learning for anomaly detection: a survey\.arXiv preprint arXiv:1901\.03407\.External Links:[Link](https://arxiv.org/abs/1901.03407)Cited by:[§1](https://arxiv.org/html/2606.02601#S1.p1.2)\.
- T\. Fawcett \(2006\)An introduction to ROC analysis\.Pattern Recognition Letters27\(8\),pp\. 861–874\.External Links:[Document](https://dx.doi.org/10.1016/j.patrec.2005.10.010)Cited by:[§2](https://arxiv.org/html/2606.02601#S2.p1.9)\.
- K\. He, X\. Zhang, S\. Ren, and J\. Sun \(2016\)Deep residual learning for image recognition\.InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 770–778\.External Links:[Document](https://dx.doi.org/10.1109/CVPR.2016.90)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- J\. Howard \(2019\)Imagenette\.Note:[https://github\.com/fastai/imagenette](https://github.com/fastai/imagenette)Dataset repository \(accessed 2026\-02\-28\)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- D\. P\. Kingma and M\. Welling \(2014\)Auto\-encoding variational bayes\.InInternational Conference on Learning Representations \(ICLR\),External Links:[Link](https://arxiv.org/abs/1312.6114)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- A\. Krizhevsky and G\. Hinton \(2009\)Learning multiple layers of features from tiny images\.Technical reportUniversity of Toronto\.Cited by:[§1](https://arxiv.org/html/2606.02601#S1.p1.2),[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- F\. T\. Liu, K\. M\. Ting, and Z\. Zhou \(2008\)Isolation forest\.In2008 Eighth IEEE International Conference on Data Mining,pp\. 413–422\.External Links:[Document](https://dx.doi.org/10.1109/ICDM.2008.17)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- Y\. Netzer, T\. Wang, A\. Coates, A\. Bissacco, B\. Wu, and A\. Y\. Ng \(2011\)Reading digits in natural images with unsupervised feature learning\.InNIPS Workshop on Deep Learning and Unsupervised Feature Learning,Cited by:[§1](https://arxiv.org/html/2606.02601#S1.p1.2)\.
- G\. Pang, C\. Shen, L\. Cao, and A\. van den Hengel \(2021\)Deep learning for anomaly detection: a review\.ACM Computing Surveys54\(2\)\.External Links:[Document](https://dx.doi.org/10.1145/3439950)Cited by:[§1](https://arxiv.org/html/2606.02601#S1.p1.2)\.
- O\. Russakovsky, J\. Deng, H\. Su, J\. Krause, S\. Satheesh, S\. Ma, Z\. Huang, A\. Karpathy, A\. Khosla, M\. Bernstein, A\. C\. Berg, and L\. Fei\-Fei \(2015\)ImageNet large scale visual recognition challenge\.International Journal of Computer Vision115\(3\),pp\. 211–252\.External Links:[Document](https://dx.doi.org/10.1007/s11263-015-0816-y)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.
- H\. Xiao, K\. Rasul, and R\. Vollgraf \(2017\)Fashion\-mnist: a novel image dataset for benchmarking machine learning algorithms\.arXiv preprint arXiv:1708\.07747\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.1708.07747),[Link](https://arxiv.org/abs/1708.07747)Cited by:[§5](https://arxiv.org/html/2606.02601#S5.p1.4)\.