无监督学习何时成功或失败？从PoS视角看基于重建的异常检测

# When Does Unsupervised Learning Succeed or Fail? A PoS Perspective on Reconstruction-Based Anomaly Detection
Source: [https://arxiv.org/html/2609.28832](https://arxiv.org/html/2609.28832)
Yagmur MustuAffiliation:Tampere University, Tampere, FinlandMuhammad Numan YousafAffiliation:Tampere University, Tampere, FinlandLei XuAffiliation:Tampere University, Tampere, FinlandMarcel van GervenAffiliation:Radboud University, Nijmegen, The Netherlands

###### Abstract

Reconstruction\-based unsupervised learning can fail in two opposing ways: a model may reconstruct anomalies too accurately or discard valid nominal variation\. Using the Pursuit of Subspaces hypothesis, we characterize these failures through the meet, union, and join geometries induced by the nominal components\. Excess learned range produces join blindness, while insufficient capacity produces meet preference and loss of nominal fidelity\. We show that the compact nominal union is optimal among nominal faithful ranges and generally requires a nonlinear reconstruction map\. Based on this geometry, we introduce Dynamic Push and Pull, which learns from controlled perturbations without anomaly labels, and nested manifold carving, which applies the same principle recursively in latent space\. Experiments confirm the predicted changes in latent geometry across every tested Push and Pull configuration\. The proposed methods improve reconstruction\-based anomaly detection across standard benchmarks and unseen image degradations, while also improving pretrained ECG representations for downstream classification\. These results connect reconstruction failures to identifiable geometric conditions and provide practical mechanisms for learning compact representations\.

## 1Introduction

The recently proposed Pursuit of Subspaces \(PoS\) hypothesis provides a postulate\-based geometric foundation for representation learning\([Yamac et al\., 2026](https://arxiv.org/html/2609.28832#bib.bib3)\)\. It formalizes recurring properties of successful networks through four idealized and falsifiable postulates\.P1: Geometric compactionstates that ideal learning refines anmm\-dimensional candidate data manifoldℳD⊂ℝn\\mathcal\{M\}\_\{D\}\\subset\\mathbb\{R\}^\{n\}into a structured targetℳ:=⋃i=1MℳDi⊆ℳD\\mathcal\{M\}:=\\bigcup\_\{i=1\}^\{M\}\\mathcal\{M\}\_\{D\_\{i\}\}\\subseteq\\mathcal\{M\}\_\{D\}, wheredim\(ℳDi\)=ki<m\\dim\(\\mathcal\{M\}\_\{D\_\{i\}\}\)=k\_\{i\}<m\.P2: Nonlinear orthogonal projectionspecifies the ideal learned operation: within an encoder\-decoder encapsulation, the network acts asPℳ:=fD∘fE:ℝn→ℳP\_\{\\mathcal\{M\}\}:=f\_\{D\}\\circ f\_\{E\}:\\mathbb\{R\}^\{n\}\\rightarrow\\mathcal\{M\}, producings^=Pℳ​\(s\)∈ℳ\\hat\{s\}=P\_\{\\mathcal\{M\}\}\(s\)\\in\\mathcal\{M\}and satisfyingPℳ2=PℳP\_\{\\mathcal\{M\}\}^\{2\}=P\_\{\\mathcal\{M\}\}; hencePℳ​\(s^\)=s^P\_\{\\mathcal\{M\}\}\(\\hat\{s\}\)=\\hat\{s\}\.P3: Normal\-space removalrealizes this projection ass^=Pℳ​\(s\)=s−Pℳ⟂​\(s\)\\hat\{s\}=P\_\{\\mathcal\{M\}\}\(s\)=s\-P\_\{\\mathcal\{M\}\}^\{\\perp\}\(s\), wherePℳ⟂​\(s\)∈Ns^​ℳDiP\_\{\\mathcal\{M\}\}^\{\\perp\}\(s\)\\in N\_\{\\hat\{s\}\}\\mathcal\{M\}\_\{D\_\{i\}\}andPℳ=I−Pℳ⟂P\_\{\\mathcal\{M\}\}=I\-P\_\{\\mathcal\{M\}\}^\{\\perp\}\. Thus, the identity path preservesss, while the learned branch estimates the normal\-space component to be removed;*normal space*denotes the geometric object and*residual branch*its architectural realization\.P4: Nested projections through depthreapplies P1\-P3 at every level: the representation at levelℓ−1\\ell\-1becomes the input toP\(ℓ\):=fD\(ℓ\)∘fE\(ℓ\):ℝnℓ−1→ℳ\(ℓ\)P^\{\(\\ell\)\}:=f\_\{D\}^\{\(\\ell\)\}\\circ f\_\{E\}^\{\(\\ell\)\}:\\mathbb\{R\}^\{n\_\{\\ell\-1\}\}\\rightarrow\\mathcal\{M\}^\{\(\\ell\)\}, whereℳ\(ℓ\):=⋃i=1MℓℳDi\(ℓ\)\\mathcal\{M\}^\{\(\\ell\)\}:=\\bigcup\_\{i=1\}^\{M\_\{\\ell\}\}\\mathcal\{M\}\_\{D\_\{i\}\}^\{\(\\ell\)\}\. Depth therefore realizes a hierarchy of nested, progressively refined nonlinear projections\.

Remarks 1–3 of PoS[Yamac et al\. \(2026\)](https://arxiv.org/html/2609.28832#bib.bib3)show that, once the network has learnedPℳP\_\{\\mathcal\{M\}\}as a nonlinear orthogonal projector onto a union of submanifolds, it can be extended while preserving this property\. Provided that the added transformationΦ\\Phiis learned as an isometry,Φ∘Pℳ∘Φ−1\\Phi\\circ P\_\{\\mathcal\{M\}\}\\circ\\Phi^\{\-1\}remains a nonlinear orthogonal projector ontoΦ⁡\(ℳ\)\\Phi\(\\mathcal\{M\}\)\. These results explain how an established PoS projection can be preserved during network growth, but not how the network can be encouraged to learnPℳP\_\{\\mathcal\{M\}\}as such a projection in the first place\. This paper addresses precisely that open problem:

> Which learning mechanisms encourage neural modules to approximate nonlinear orthogonal projection onto compact unions of submanifolds?

The PoS postulates enable a falsifiable predict\-then\-measure approach: they specify both the target representation geometry and how representations should evolve as compactness increases\. We derive two failure predictions and two corresponding remedies, then test the predicted dynamics at the level of individual samples and across configurations\. We distinguish properties enforced directly by the proposed objectives from geometric conclusions that additionally assume the ideal projection in P2\. LetℳD\\mathcal\{M\}\_\{D\}contain the component submanifolds\{ℳDi\}i=1M\\\{\\mathcal\{M\}\_\{D\_\{i\}\}\\\}\_\{i=1\}^\{M\}, and locally represent them in common coordinates by tangent subspacesSiS\_\{i\}\. Define their*meet*𝒲:=⋂iSi\\mathcal\{W\}:=\\bigcap\_\{i\}S\_\{i\}, local nominal*union*𝒰:=⋃iSi\\mathcal\{U\}:=\\bigcup\_\{i\}S\_\{i\}, and*join*𝒱:=∑iSi=span⁡\(⋃iSi\)\\mathcal\{V\}:=\\sum\_\{i\}S\_\{i\}=\\operatorname\{span\}\(\\bigcup\_\{i\}S\_\{i\}\), the smallest linear subspace containing everySiS\_\{i\}\. Since𝒲⊆𝒰⊆𝒱\\mathcal\{W\}\\subseteq\\mathcal\{U\}\\subseteq\\mathcal\{V\}, set inclusion reverses distance:

dist⁡\(s,𝒱\)≤dist⁡\(s,𝒰\)≤dist⁡\(s,𝒲\)\.\\operatorname\{dist\}\(s,\\mathcal\{V\}\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{U\}\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{W\}\)\.\(1\)This relation predicts two limiting failures: a learned range approaching the join can reduce anomaly scores and cause false negatives, whereas one approaching the meet assigns positive scores to nominal points in𝒰∖𝒲\\mathcal\{U\}\\setminus\\mathcal\{W\}, causing false positives\. These distances coincide with reconstruction errors only under the nearest\-point projection prescribed by P2; we do not assume that an arbitrary learned range lies between𝒲\\mathcal\{W\}and𝒱\\mathcal\{V\}\. Formal definitions and proofs are given in Appendix[A](https://arxiv.org/html/2609.28832#A1)\.

\(a\)\(b\)\(c\)\(d\)
Figure 1:Toy geometry of successful and failed anomaly detection\.The shaded plane denotes the join𝒱\\mathcal\{V\}of the two nominal subspaces; dark blue and ochre denote nominal and anomalous inputs, light blue and yellow their reconstructions, and dashed segments reconstruction errors\.\(a\)A linear network with range𝒱\\mathcal\{V\}detects anomalies outside the join through their nonzero reconstruction errors\.\(b\)The same range is blind to anomalies in𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}, which can be reconstructed as accurately as nominal data\.\(c\)A nonlinear network learns the compact union𝒰\\mathcal\{U\}, preserving the nominal components while producing nonzero errors for anomalies both inside and outside𝒱\\mathcal\{V\}\.\(d\)Rank deficient learning produces a low dimensional compromise rangeTunder⊂𝒱T\_\{\\mathrm\{under\}\}\\subset\\mathcal\{V\}that poorly represents both nominal and anomalous data, inflating both scores and reducing their fidelity to nominal union membership\.PoS Prediction I \(join blindness\):A reconstruction objective constrains the model on nominal samples but does not bound its learned range outside them\. The range may therefore expand toward the join𝒱\\mathcal\{V\}, violating the compaction required by P1\. As Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(a\) illustrates, anomalies outside𝒱\\mathcal\{V\}remain detectable through reconstruction error\. Under P2, however, an anomalysa∈𝒱∖𝒰s\_\{a\}\\in\\mathcal\{V\}\\setminus\\mathcal\{U\}receives zero reconstruction error \(Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(b\)\), while even an approximate join can substantially reduce its score\. Join blindness is therefore a loss of*selectivity*: the model retains directions that should have been excluded\.

PoS Prediction II \(meet preference\):Let𝒲:=⋂iSi\\mathcal\{W\}:=\\bigcap\_\{i\}S\_\{i\}denote the directions shared by all nominal component tangent spaces\. Limited capacity may preferentially retain𝒲\\mathcal\{W\}while discarding component specific directions; we call the limiting caseT=𝒲T=\\mathcal\{W\}*meet collapse*\. Proposition[10](https://arxiv.org/html/2609.28832#Thmtheorem10)establishes sufficient conditions under which a rank constrained MSE optimal linear autoencoder exhibits this preference\. Through local tangent approximations, the same mechanism applies to nonlinear geometry\. Under P2, meet collapse assigns positive errors to nominal points in𝒰∖𝒲\\mathcal\{U\}\\setminus\\mathcal\{W\}, causing a loss of*fidelity*\. Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(d\) visualizes this consequence through rank deficient underlearning; its meet is trivial, so it illustrates the fidelity failure rather than exact meet collapse\.

Why the compact union requires nonlinearity:P1 identifies the desired learned range as the compact nominal union𝒰\\mathcal\{U\}\. Lemma[7](https://arxiv.org/html/2609.28832#Thmtheorem7)shows that𝒰\\mathcal\{U\}is optimal among nominal\-faithful ranges, while Proposition[4](https://arxiv.org/html/2609.28832#Thmtheorem4)shows that a linear reconstruction map preserving𝒰\\mathcal\{U\}must also contain its join𝒱\\mathcal\{V\}\. Reconstruction alone does not constrain the learned range toward𝒰\\mathcal\{U\}: excess capacity can produce join blindness, whereas restricted capacity can discard component\-specific directions and produce meet preference\. Learning the compact union therefore requires both nonlinearity and an explicit separation signal\. Dynamic Push and Pull supplies this missing signal\. Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(c\) illustrates the desired case: a nonlinear network learns the compact union, preserving nominal reconstruction while detecting anomalies both inside and outside the join\. Moreover, any geometrically nominal faithful rangeT⊇𝒰T\\supseteq\\mathcal\{U\}satisfiesdist⁡\(s,T\)≤dist⁡\(s,𝒰\),\\operatorname\{dist\}\(s,T\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{U\}\),where𝒰\\mathcal\{U\}maximizes ideal pointwise separation and, under nominal support on𝒰\\mathcal\{U\}, expected geometric score gap among such ranges\. Formal statements and proofs are given in Appendices[A\.5](https://arxiv.org/html/2609.28832#A1.SS5),[A\.2\.1](https://arxiv.org/html/2609.28832#A1.SS2.SSS1), and[A\.3](https://arxiv.org/html/2609.28832#A1.SS3)\.

Remedy I \(dynamic Push and Pull learning\):P1 to P3 motivate a training objective based on controlled perturbations of nominal samples, without requiring anomaly examples or class labels\. Reconstructions are pulled toward the corresponding clean samples and pushed away from their perturbed versions, with a margin adapted to perturbation severity\. This discourages the excess range responsible for join blindness, as detailed in \(Section[3\.1](https://arxiv.org/html/2609.28832#S3.SS1)\)\.

Remedy II \(nested manifold carving\):P4 motivates applying this compaction recursively in latent space\. Each nested stage is trained to preserve nominal information while removing perturbation directions, while sufficient latent capacity reduces premature contraction toward shared directions \(Section[3\.2](https://arxiv.org/html/2609.28832#S3.SS2)\)\.

Although anomaly detection exposes these failure geometries particularly clearly, the remedies target unsupervised representation learning more generally\. They learn data structure without semantic labels\. Reconstruction error uses this structure to detect departures from the learned data, while downstream classifiers can reuse the same representation for label efficient prediction\. Anomaly detection is therefore one application of the learned geometry, not the scope of the method\.

We evaluate this progression in three stages\. First, we compare our strategies with state of the art unsupervised anomaly detection methods on standard benchmarks\. Second, we introduce a real world nominal only task: learning from high quality images and detecting unseen degradations without low quality training examples\. Third, we move beyond anomaly detection by pretraining on unlabelled ECG signals, freezing the encoder, and training a small classifier with limited labelled data\. We additionally test two PoS predictions for representation dynamics: relative disentanglement of nominal components and projection of samples outside the union toward the nominal union\.

Our contributions are threefold\. First, we derive two opposing failure predictions, join blindness and meet preference, and establish their consequences for anomaly scores, the need for nonlinearity, and the optimality of the compact nominal union\. Second, we introduce Dynamic Push and Pull and nested manifold carving as complementary PoS\-derived strategies for learning compact representations without anomaly examples or class labels\. Third, we validate the framework through benchmark anomaly detection, real\-world detection of unseen image degradations from high\-quality nominal data, and unsupervised ECG pretraining for downstream classification, while testing two predicted dynamics of the learned geometry\.

## 2Related Work

Autoencoders are widely used for unsupervised anomaly detection, where reconstruction error serves as an anomaly score under the assumption that models trained on nominal data reconstruct anomalous inputs less accurately\([Sakurada and Yairi, 2014](https://arxiv.org/html/2609.28832#bib.bib5);[Zhai et al\., 2016](https://arxiv.org/html/2609.28832#bib.bib61);[Zhou and Paffenroth, 2017](https://arxiv.org/html/2609.28832#bib.bib6);[Zhao et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib7)\)\. However, this assumption is not generally reliable, since autoencoders may also reconstruct unseen anomalies with small error\([Zong et al\., 2018](https://arxiv.org/html/2609.28832#bib.bib62);[Gong et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib59);[Zaheer et al\., 2020](https://arxiv.org/html/2609.28832#bib.bib22)\)\. Existing approaches regularize the learned representation through latent compactness\([Cao et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib9)\), sparse autoencoders\([Nanaumi et al\., 2026](https://arxiv.org/html/2609.28832#bib.bib8)\), denoising objectives\([Marchi et al\., 2015](https://arxiv.org/html/2609.28832#bib.bib10)\), or masked reconstruction\([Huang et al\., 2023](https://arxiv.org/html/2609.28832#bib.bib11);[Georgescu, 2023](https://arxiv.org/html/2609.28832#bib.bib12);[Elrashid et al\., 2026](https://arxiv.org/html/2609.28832#bib.bib13)\), thereby encouraging the model to capture stable structure in nominal data rather than learning an unrestricted identity mapping\. Architectural approaches instead constrain the reconstruction process using memory banks of nominal prototypes\([Gong et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib59);[Gao et al\., 2023](https://arxiv.org/html/2609.28832#bib.bib14)\), latent density models\([Zong et al\., 2018](https://arxiv.org/html/2609.28832#bib.bib62)\), or adversarial and one class components\([Perera et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib66)\)\.

Despite this broad effort, the mechanisms that cause autoencoder based anomaly detection to fail, and the conditions under which it can be reliable, remain insufficiently understood\.[Bouman and Heskes \(2025\)](https://arxiv.org/html/2609.28832#bib.bib23)show that autoencoders can accurately reconstruct anomalies through interpolation between nominal groups and extrapolation beyond the observed nominal data\. We interpret both behaviors as manifestations of an excessively broad learned range and characterize the limiting case as join blindness; we further identify the opposite failure of meet preference, in which nominal directions specific to individual components are lost\. Self supervised methods such as CutPaste, DRAEM, NSA, and CSI learn discriminative anomaly criteria from synthetic anomalies or distribution shifted views\([Li et al\., 2021](https://arxiv.org/html/2609.28832#bib.bib18);[Zavrtanik et al\., 2021](https://arxiv.org/html/2609.28832#bib.bib19);[Schlüter et al\., 2022](https://arxiv.org/html/2609.28832#bib.bib20);[Tack et al\., 2020](https://arxiv.org/html/2609.28832#bib.bib21)\)\. Reconstruction based perturbation based methods train autoencoders using noisy, synthetic, or adversarially perturbed nominal samples\([Marchi et al\., 2015](https://arxiv.org/html/2609.28832#bib.bib10);[Astrid et al\., 2021](https://arxiv.org/html/2609.28832#bib.bib15);[Astrid et al\., 2024](https://arxiv.org/html/2609.28832#bib.bib16);[Salehi et al\., 2021](https://arxiv.org/html/2609.28832#bib.bib17)\)\. Methods that reconstruct the clean sample from its perturbation correspond to the Pull component of our formulation, whereas Dynamic Push and Pull additionally imposes an explicit separation margin from the perturbed input to target join blindness\. Nested Manifold Carving complements this objective by recursively targeting off union directions retained in latent representations\.

## 3PoS\-Guided Learning Strategies

### 3\.1Dynamic push\-pull learning

Letddbe a distance function chosen for the signal modality\. For a nominal observationsns\_\{n\}, we generate a perturbed observation by adding a controlled perturbationee\. Using\[z\]\+:=max⁡\{z,0\}\[z\]\_\{\+\}:=\\max\\\{z,0\\\}, define

s~n:=sn\+e,s^n:=Pθ\(s~n\),δe:=d\(s~n,sn\),ℒPP\(θ;sn,e\):=d\(s^n,sn\)\+\[αδe−d\(s^n,s~n\)\]\+,α\>0\.\\begin\{gathered\}\\widetilde\{s\}\_\{n\}:=s\_\{n\}\+e,\\qquad\\widehat\{s\}\_\{n\}:=P\_\{\\theta\}\(\\widetilde\{s\}\_\{n\}\),\\qquad\\delta\_\{e\}:=d\(\\widetilde\{s\}\_\{n\},s\_\{n\}\),\\\\ \\mathcal\{L\}\_\{\\mathrm\{PP\}\}\(\\theta;s\_\{n\},e\):=d\(\\widehat\{s\}\_\{n\},s\_\{n\}\)\+\\left\[\\alpha\\delta\_\{e\}\-d\(\\widehat\{s\}\_\{n\},\\widetilde\{s\}\_\{n\}\)\\right\]\_\{\+\},\\qquad\\alpha\>0\.\\end\{gathered\}\(2\)The first term pulls the reconstruction toward the nominal observation, while the hinge term pushes it away from the perturbed input by the adaptive marginα​δe\\alpha\\delta\_\{e\}\. In the general noisy setting,sns\_\{n\}need only be concentrated near the nominal union\. Exact membership is imposed only in the ideal result below\. The experiments do not optimize the push–pull loss in isolation\. They retain the ordinary reconstruction objective on unperturbed nominal observations, defined by

ℒAE​\(θ\):=𝔼sn​\[d⁡\(Pθ​\(sn\),sn\)\]\.\\mathcal\{L\}\_\{\\mathrm\{AE\}\}\(\\theta\):=\\mathbb\{E\}\_\{s\_\{n\}\}\\left\[d\\\!\\left\(P\_\{\\theta\}\(s\_\{n\}\),s\_\{n\}\\right\)\\right\]\.\(3\)and optimize the complete objective

ℒtrain​\(θ\)\\displaystyle\\mathcal\{L\}\_\{\\mathrm\{train\}\}\(\\theta\):=ℒAE​\(θ\)\+λPP​𝔼sn,e​\[ℒPP​\(θ,sn,e\)\]\\displaystyle:=\\mathcal\{L\}\_\{\\mathrm\{AE\}\}\(\\theta\)\+\\lambda\_\{\\mathrm\{PP\}\}\\,\\mathbb\{E\}\_\{s\_\{n\},e\}\\left\[\\mathcal\{L\}\_\{\\mathrm\{PP\}\}\(\\theta;s\_\{n\},e\)\\right\]\(4\)\+λsp​Ωsp​\(θ\),λPP\>0,λsp≥0,\\displaystyle\+\\lambda\_\{\\mathrm\{sp\}\}\\,\\Omega\_\{\\mathrm\{sp\}\}\(\\theta\),\\qquad\\lambda\_\{\\mathrm\{PP\}\}\>0,\\qquad\\lambda\_\{\\mathrm\{sp\}\}\\geq 0,where,Ωsp\\Omega\_\{\\mathrm\{sp\}\}is an optional sparsity penalty, withλsp=0\\lambda\_\{\\mathrm\{sp\}\}=0when sparsity is not used\. Thus,ℒAE\\mathcal\{L\}\_\{\\mathrm\{AE\}\}anchors the reconstruction of unperturbed nominal observations, while the push–pull term governs the response to their perturbed counterparts\. The pairwise results below characterize the push\-pull component; the operating point of the shared network is also shaped by the nominal reconstruction and optional sparsity terms in Eq\. \([4](https://arxiv.org/html/2609.28832#S3.E4)\)\.

Figure 2:Ideal and realizable regimes of Lemma[1](https://arxiv.org/html/2609.28832#Thmtheorem1)\. \(a\) Ifsn∈𝒰s\_\{n\}\\in\\mathcal\{U\}andeeis normal to𝒰\\mathcal\{U\}, exact Pull givess^n=sn\\widehat\{s\}\_\{n\}=s\_\{n\}\. Forα≤1\\alpha\\leq 1, Push is inactive at this optimum but supplies a gradient whenever its margin is violated\. \(b\) Ifdistd⁡\(sn,𝒰\)=η⁡\(sn\)\>0\\operatorname\{dist\}\_\{d\}\(s\_\{n\},\\mathcal\{U\}\)=\\eta\(s\_\{n\}\)\>0, marginsα\>1\\alpha\>1become admissible and impose a constraint unavailable to Pull alone\. The triangle inequality givesα​δe≤δe\+η⁡\(sn\)\\alpha\\delta\_\{e\}\\leq\\delta\_\{e\}\+\\eta\(s\_\{n\}\), recovering the zero\-push\-error case of Eq\. \([6](https://arxiv.org/html/2609.28832#S3.E6)\)\.###### Lemma 1\(Push and pull guarantees\)\.

Letddbe a metric\. Write Eq\. \([2](https://arxiv.org/html/2609.28832#S3.E2)\) asℒPP=ℒpull\+ℒpush\\mathcal\{L\}\_\{\\mathrm\{PP\}\}=\\mathcal\{L\}\_\{\\mathrm\{pull\}\}\+\\mathcal\{L\}\_\{\\mathrm\{push\}\}, and defineT:=range⁡\(Pθ\)T:=\\operatorname\{range\}\(P\_\{\\theta\}\),ρθ,d​\(x\):=d⁡\(x,Pθ​\(x\)\)\\rho\_\{\\theta,d\}\(x\):=d\(x,P\_\{\\theta\}\(x\)\), anddistd⁡\(x,T\):=inft∈Td⁡\(x,t\)\\operatorname\{dist\}\_\{d\}\(x,T\):=\\inf\_\{t\\in T\}d\(x,t\)\. Supposeη⁡\(sn\):=distd⁡\(sn,𝒰\)≤ε\\eta\(s\_\{n\}\):=\\operatorname\{dist\}\_\{d\}\(s\_\{n\},\\mathcal\{U\}\)\\leq\\varepsilon, whereη⁡\(sn\)=0\\eta\(s\_\{n\}\)=0whensn∈𝒰s\_\{n\}\\in\\mathcal\{U\}\. Ifℒpull≤εpull\\mathcal\{L\}\_\{\\mathrm\{pull\}\}\\leq\\varepsilon\_\{\\mathrm\{pull\}\}andℒpush≤εpush\\mathcal\{L\}\_\{\\mathrm\{push\}\}\\leq\\varepsilon\_\{\\mathrm\{push\}\}, thendistd⁡\(sn,T\)≤εpull\\operatorname\{dist\}\_\{d\}\(s\_\{n\},T\)\\leq\\varepsilon\_\{\\mathrm\{pull\}\}andρθ,d​\(s~n\)≥α​δe−εpush\\rho\_\{\\theta,d\}\(\\widetilde\{s\}\_\{n\}\)\\geq\\alpha\\delta\_\{e\}\-\\varepsilon\_\{\\mathrm\{push\}\}\. Under P2, these bounds jointly give

distd⁡\(s~n,T\)≥max⁡\{δe−εpull,α​δe−εpush,0\}\.\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\\geq\\max\\\!\\left\\\{\\delta\_\{e\}\-\\varepsilon\_\{\\mathrm\{pull\}\},\\alpha\\delta\_\{e\}\-\\varepsilon\_\{\\mathrm\{push\}\},0\\right\\\}\.\(5\)If, in addition,TTprovides exact nominal coverage𝒰⊆T\\mathcal\{U\}\\subseteq T, the triangle inequality givesdistd⁡\(s~n,T\)≤δe\+η⁡\(sn\)\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\\leq\\delta\_\{e\}\+\\eta\(s\_\{n\}\)\. Consequently, forδe\>0\\delta\_\{e\}\>0,

α≤1\+η⁡\(sn\)\+εpushδe\.\\alpha\\leq 1\+\\frac\{\\eta\(s\_\{n\}\)\+\\varepsilon\_\{\\mathrm\{push\}\}\}\{\\delta\_\{e\}\}\.\(6\)At zero push error, this bound permitsα\>1\\alpha\>1precisely whenη⁡\(sn\)\>0\\eta\(s\_\{n\}\)\>0\.

The proof is given in Appendix[A\.6](https://arxiv.org/html/2609.28832#A1.SS6)\. The guarantee is local to the sampled perturbations\. Suppressing join blindness throughout𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}therefore requires the perturbation sampler to probe this region sufficiently; otherwise, only the sampled neighborhoods are certifiably carved\. Perturbations with components inSi⟂∩𝒱S\_\{i\}^\{\\perp\}\\cap\\mathcal\{V\}directly probe directions inside the join but outside the active nominal component\.

### 3\.2Nested manifold carving

Following P4, we apply push–pull recursively in latent space\. At levelℓ\\ell, the previously learned encoder–decoder pairs are frozen, their encoder stack mapssns\_\{n\}toxn\(ℓ−1\)x\_\{n\}^\{\(\\ell\-1\)\}, and a new pair\(Eℓ,Dℓ\)\(E\_\{\\ell\},D\_\{\\ell\}\)is trained on this representation using the push–pull objective\. The resulting reconstruction is then decoded through all preceding decoders\. Each level therefore carves the representation inherited from the level above, while the pull term preserves nominal information and the push term prevents the newly added pair from simply reproducing perturbed latent inputs\. The latent width is chosen sufficiently large to retain component\-specific nominal directions and avoid premature meet preference\. LetT¯\(ℓ\)\\overline\{T\}^\{\(\\ell\)\}denote the range of the complete reconstruction map through levelℓ\\ell, decoded back to the input space\. Under the compatibility, capacity, and exact\-optimization conditions stated in Appendix[B](https://arxiv.org/html/2609.28832#A2), the construction yields

T¯\(1\)⊇T¯\(2\)⊇⋯⊇T¯\(L\)⊇𝒰\.\\overline\{T\}^\{\(1\)\}\\supseteq\\overline\{T\}^\{\(2\)\}\\supseteq\\cdots\\supseteq\\overline\{T\}^\{\(L\)\}\\supseteq\\mathcal\{U\}\.\(7\)Thus, successive levels remove probed off\-union regions without sacrificing nominal coverage\. Eq\. \([7](https://arxiv.org/html/2609.28832#S3.E7)\) describes the ideal construction target; its capacity, nonlinearity, and perturbation\-coverage conditions are detailed in Appendix[B](https://arxiv.org/html/2609.28832#A2), with the linear obstruction given in Appendix[A\.2\.1](https://arxiv.org/html/2609.28832#A1.SS2.SSS1)\.

### 3\.3PoS\-predicted representation dynamics

PoS predicts how latent geometry changes as a network approaches the ideal behavior defined by P1 to P4\. Letxxandx^\\widehat\{x\}denote, respectively, less compact and more compact representations of the same samples, where compactness refers to agreement with the PoS postulates rather than merely smaller variance\. Fromxxtox^\\widehat\{x\}, P1 and P4 predict increasing relative separation of nominal components, meaning that their radii contract more than the distances between their centers\. P2 to P4 further predict that off\-union anomalies move toward nominal components\. Consequently, although nominal structure becomes more compact and separated, nominal and anomalous representations can become less distinguishable\. A more compact pretrained network can therefore provide worse features for a downstream classifier that must distinguish anomalies from nominal samples\. We test these predictions in Section[4\.2](https://arxiv.org/html/2609.28832#S4.SS2)\. The exact metrics and their computation are provided in Appendix[D](https://arxiv.org/html/2609.28832#A4)\.

## 4Experiments

Figure 3:Geometric interpretation of the two\-stage MNIST experiment\.At Stage 0, the nominal digits44,55, and77define a compact union𝒰\\mathcal\{U\}within a coarser learned range𝒱\\mathcal\{V\}\. An anomaly such as88, lying outside𝒱\\mathcal\{V\}, produces a large Stage\-0 reconstruction error\. By contrast, digit11can lie inside𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}and therefore remain undetected at Stage 0\. Stage 1 operates in the frozen Stage\-0 latent space and further carves the retained range, projecting such off\-union representations toward a nominal component\. Anomalous information already removed by Stage 0 is unavailable to Stage 1\.### 4\.1A controlled study of the predicted failure modes

We first use MNIST to examine the complete geometric picture in a controlled setting\. Following[Bouman and Heskes \(2025\)](https://arxiv.org/html/2609.28832#bib.bib23), digits44,55, and77are treated as nominal, while the remaining digits are anomalies\. This setting is particularly informative because the nominal distribution is multimodal and different anomalous digits interact differently with its learned geometry\.

Baseline and controlled modifications:We reproduce the convolutional autoencoder of[Bouman and Heskes \(2025\)](https://arxiv.org/html/2609.28832#bib.bib23)for fair comparison, including its two\-dimensional bottleneck and evaluation protocol\. We then retain the same autoencoder backbone but increase the Stage\-0 latent dimension from22to99, reducing the capacity restriction that can merge component\-specific nominal directions\. Starting from this higher\-capacity model, we evaluate the individual and combined effects of nested carving, dynamic push\-pull, masking, and sparsity\. For the nested models, a second encoder–decoder pair is trained in the frozen Stage\-0 latent space, whose dimension is expanded to6060before carving\. This controlled construction separates the effect of latent capacity from the effects of the proposed learning strategies\.

Why different levels detect different anomalies:Figure[3](https://arxiv.org/html/2609.28832#S4.F3)summarizes the mechanism investigated in this experiment\. At Stage 0, anomalies lying outside the learned coarse range produce large reconstruction errors and are directly detectable\. However, an anomalous digit such as11may lie close to the range spanning the nominal digits44,55, and77\. It can therefore be reconstructed with a small Stage\-0 error despite not belonging to any nominal component\. This is the predicted join\-blindness mechanism\. Nested carving addresses this ambiguity in the latent space\. After the Stage\-0 encoder and decoder are frozen, the second stage is trained to preserve the latent representations of nominal digits while rejecting their controlled perturbations\. It can therefore remove off\-union latent regions that Stage 0 retained and assign a larger error to anomalies such as11\. The converse situation is equally important\. Some anomalous inputs are already mapped by Stage 0 onto, or very close to, one of the nominal components\. Their anomalous information is then removed before entering the next latent stage, so Stage 1 cannot be expected to recover it\. These anomalies remain detectable through the Stage\-0 reconstruction error\. Stage 0 and Stage 1 are therefore complementary: the former detects departures removed by the first projection, whereas the latter detects off\-union structure that survives within the Stage\-0 representation\.

DAE versus AE\-PP:Settingα=0\\alpha=0eliminates the Push hinge and reduces Push and Pull to a denoising autoencoder, whileα\>0\\alpha\>0imposes the additional separation constraint characterized by Lemma 1 and Figure[2](https://arxiv.org/html/2609.28832#S3.F2)\. DAE provides only a marginal improvement over AE and gains nothing from nesting, whereas AE\-PP improves further at Stage 1, indicating that its gain cannot be explained by denoising alone; complete results are reported in Section[C](https://arxiv.org/html/2609.28832#A3)and Table[12](https://arxiv.org/html/2609.28832#A3.T12)\.

Overall ablation results:Table[1](https://arxiv.org/html/2609.28832#S4.T1)summarizes the central configurations, with complete results in Tables[10](https://arxiv.org/html/2609.28832#A3.T10)and[11](https://arxiv.org/html/2609.28832#A3.T11)\. Increasing Stage 0 capacity improves the reproduced baseline, but adding a reconstruction only nested module provides no further gain because it admits an identity solution\. Push and Pull supplies the separation signal required for latent carving, improving both the single stage and nested models, while masking and sparsity provide complementary gains in the strongest configuration\. Thus, the improvement arises from explicitly carving the learned range rather than from additional capacity, depth, or perturbation alone\.

Table 1:Controlled MNIST study with nominal digits4,5,74,5,7\.The baseline reproduces[Bouman and Heskes \(2025\)](https://arxiv.org/html/2609.28832#bib.bib23)with a two\-dimensional bottleneck\. The remaining models use the same backbone with Stage\-0 latent dimension99\. Nested configurations report the complete Stage\-1 reconstruction score\. PP denotes push–pull\. Complete results are provided in Tables[10](https://arxiv.org/html/2609.28832#A3.T10)and[11](https://arxiv.org/html/2609.28832#A3.T11)\.ConfigurationF1ROC\-AUCPR\-AUCBouman\-Heskes baseline0\.6930\.8660\.936Higher\-capacity AE0\.7800\.8930\.962AE \+ mask0\.7660\.8810\.957AE \+ PP0\.7920\.8970\.963AE \+ nested \+ PP0\.7980\.9090\.967AE \+ nested \+ PP \+ sparsity0\.8080\.9280\.972AE \+ nested \+ PP \+ mask \+ sparsity0\.8150\.9290\.973Per digit geometric analysis:The image and latent reconstruction errors provide direct evidence for the geometry predicted in Figure[3](https://arxiv.org/html/2609.28832#S4.F3)\. Digit88produces a large image error but a small Stage 1 latent error, supporting the prediction that its anomalous direction lies largely outside the coarse range𝒱\\mathcal\{V\}, is removed at Stage 0, and leaves a latent representation close to nominal digit55\. Conversely, digit11produces a small image error but a large latent error, supporting the prediction that it lies within𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}and is therefore retained by Stage 0 but differentiated through nested carving\. Its Stage 1 reconstructions also become predominantly77\-like, supporting the predicted representation dynamics that increasing compactness moves off\-union anomalies toward a nearby nominal component\. The complete analysis, flag decomposition, and reconstructed images are provided in Section[C\.1](https://arxiv.org/html/2609.28832#A3.SS1), Table[13](https://arxiv.org/html/2609.28832#A3.T13), and Figure[5](https://arxiv.org/html/2609.28832#A3.F5)\.

### 4\.2Testing the predicted representation dynamics

We compare the less compact representationxxwith the more compact representationx^\\widehat\{x\}across four normal digit sets, two masking choices, and two sparsity choices\. This gives 16 configurations for each training objective and 32 configurations in total\. As summarized in Table[2](https://arxiv.org/html/2609.28832#S4.T2), all 16 configurations trained with Push and Pull satisfy both PoS predictions\. Across all 16 Push and Pull configurations, nominal relative separation increases and all four anomaly proximity indicators decrease\. Ordinary AE training increases relative separation in only7/167/16configurations and satisfies all four proximity predictions in14/1614/16\. Thus, Push and Pull produces the predicted PoS dynamics consistently across every tested normal set, masking choice, and sparsity choice\. Complete results and metric definitions are provided in Appendix[D](https://arxiv.org/html/2609.28832#A4)\.

Table 2:Observed PoS representation dynamics\. Each objective includes 16 configurations obtained from four normal digit sets, two masking choices, and two sparsity choices\.Predicted changeAEAE \+ PPIncreased nominal relative separation,Δ​S\>0\\Delta S\>07/167/16𝟏𝟔/𝟏𝟔\\mathbf\{16/16\}All four anomaly proximity indicators decrease14/1614/16𝟏𝟔/𝟏𝟔\\mathbf\{16/16\}Table 3:One\-class anomaly detection on Arrhythmia\([Guvenir et al\., 1997](https://arxiv.org/html/2609.28832#bib.bib50)\), measured by F1 score \(%\)\. AE\-PP and AE\-PoS results are reported as mean±\\pmstandard deviation over 10 seeds\. Bold indicates the highest mean\.BaselinesOursDatasetIFOC\-SVMDSEBM\-eAnoGANDAGMMALADRCGANDSVDDGOADMEMAEMEMGANTOLLAE\-PPAE\-PoSArrhythmia53\.0345\.1846\.0142\.4249\.8351\.5254\.1434\.7952\.0051\.1355\.7260\.0067\.69±5\.7567\.69\{\\pm\}5\.7570\.77±5\.75\\mathbf\{70\.77\{\\pm\}5\.75\}

Table 4:One\-class anomaly detection on CIFAR\-10\([Krizhevsky, 2009](https://arxiv.org/html/2609.28832#bib.bib49)\), measured by AUC\-ROC \(%\)\. Values are averaged over the ten nominal\-class tasks\. Full class\-wise results, including uncertainty over 10 seeds for AE\-PP and AE\-PoS, are reported in Table[23](https://arxiv.org/html/2609.28832#A5.T23)\.BaselinesOursOCGANVAEDSVDDDSEBMDAGMMIFAnoGANALADMEMAEMEMGANTOLLAE\-PPAE\-PoSAverage65\.658\.364\.860\.454\.455\.561\.859\.358\.565\.369\.671\.3071\.73

### 4\.3Standard One\-Class Anomaly Detection

We evaluate one\-class anomaly detection on MNIST, Fashion\-MNIST, CIFAR\-10, CIFAR\-100, and Arrhythmia\. Training uses only nominal samples\. Following the validation protocol of TOLL\([Ghafourian et al\., 2025](https://arxiv.org/html/2609.28832#bib.bib46)\), checkpoints are selected on a validation set containing both nominal and anomalous samples\. For a controlled comparison, all methods share the Stage 0 autoencoder architecture and optimization settings of TOLL\. Our AE baseline is the reconstruction\-only model obtained by setting the TOLL compactness coefficient toβ=0\\beta=0; it therefore uses the same backbone but not the TOLL compactness objective\. AE\-PP augments this baseline with Dynamic Push and Pull, whereas AE\-PoS additionally applies Nested Manifold Carving to the frozen Stage 0 representation\.

Figure 4:Effect of the margin scaleα\\alphaon Stage\-0 AE\-PP\. Arrhythmia uses F1; CIFAR\-10 and CIFAR\-100 use AUC\-ROC\.As shown in Tables[3](https://arxiv.org/html/2609.28832#S4.T3)and[4](https://arxiv.org/html/2609.28832#S4.T4), AE\-PoS reaches70\.77%70\.77\\%F1 on Arrhythmia, compared with60\.00%60\.00\\%for the strongest baseline, and71\.73%71\.73\\%AUC\-ROC on CIFAR\-10, compared with69\.6%69\.6\\%\. Nested Manifold Carving improves AE\-PP from67\.69%67\.69\\%to70\.77%70\.77\\%on Arrhythmia and from71\.30%71\.30\\%to71\.73%71\.73\\%on CIFAR\-10, with gains across all ten CIFAR\-10 nominal classes\. Together with the controlled multi\-component MNIST experiment in Section[4\.1](https://arxiv.org/html/2609.28832#S4.SS1), these results suggest that Stage 1 provides further gains when the Stage\-0 representation retains residual multiple components, while largely preserving performance when Stage 0 is already compact, as in the controlled single\-component MNIST setting and Fashion\-MNIST\. Complete results for MNIST, Fashion\-MNIST, and CIFAR\-100, together with experimental details, baseline definitions, dataset\-specific training strategies, and the AE/AE\-PP/AE\-PoS ablation, are provided in Appendix[E](https://arxiv.org/html/2609.28832#A5)\. The CIFAR\-100 results further expose a limitation of the current reconstruction\-error anomaly score, which remains behind transformation\-based methods on several nominal superclasses\. Figure[4](https://arxiv.org/html/2609.28832#S4.F4)shows the predicted saturation: once the Push hinge remains active for most training pairs, its gradient no longer depends onα\\alpha, and performance plateaus atα=2\\alpha=2or33\.

### 4\.4Detecting Unseen Image Degradations

Table 5:Detection of unseen degradations in high\-quality images\. Entries are unweighted averages within each degradation family, reported as AUC\-ROC and PR\-AUC\. Parentheses give the number of evaluation settings; the overall row averages all 16 settings\. Complete results are provided in Table[26](https://arxiv.org/html/2609.28832#A5.T26)\. Bold indicates the best result in each metric\.AE \(0\.83M\)VAE \(83\.7M\)AE\-PP \(0\.83M\)AE\-PoS \(1\.67M\)FamilyROCPRROCPRROCPRROCPRAdditive noise \(1\)1\.0001\.0000\.9980\.9981\.0001\.0001\.0001\.000Blur \(7\)0\.5680\.5360\.1330\.3340\.8890\.8810\.9030\.896Rain \(5\)0\.4400\.4620\.7910\.6870\.9460\.9310\.9580\.938Underwater \(3\)0\.2950\.3780\.4490\.4390\.9670\.9620\.9850\.981Overall \(16\)0\.5040\.5120\.4520\.5060\.9290\.9190\.9410\.932Our objective is to learn a high\-fidelity autoencoder representation of clean, high\-quality images that preserves their fine\-scale residual components while remaining sensitive to diverse unseen degradations\. This contrasts with the VAE, whose probabilistic latent regularization reduces nominal\-image fidelity and can preferentially represent low\-frequency content, allowing strongly blurred images to be reconstructed more accurately than clean images and thereby reversing the desired anomaly\-score ordering\. AE\-PP and AE\-PoS are designed to preserve nominal detail while pushing degraded views away from the learned representation\. Table[5](https://arxiv.org/html/2609.28832#S4.T5)summarizes detection performance across additive noise, blur, rain, and underwater degradations, while Appendix[E\.7](https://arxiv.org/html/2609.28832#A5.SS7)provides the complete per\-setting results, dataset construction, training strategy, clean\-reference protocol, and reconstruction\-fidelity analysis\. As shown in Table[6](https://arxiv.org/html/2609.28832#S4.T6), the reconstruction PSNR, computed between each inputssand its reconstructions^\\hat\{s\}, increases for the VAE from27\.5927\.59dB on clean images to37\.0137\.01dB under the strongest blur\. Thus, blurred anomalies receive lower reconstruction errors than clean inputs, reversing the expected score ordering and explaining the VAE’s ROC\-AUC below0\.50\.5\. Complete PSNR results are reported in Table[27](https://arxiv.org/html/2609.28832#A5.T27)\. Training perturbations are limited to parametric blur kernels, sensor noise, resampling, and JPEG compression\. REDS\([Nah et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib37)\)and GoPro\([Nah et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib38)\)therefore test transfer to realistic motion blur constructed through temporal averaging of high\-frame\-rate video; rain and underwater degradations are absent from training; and Kodak24 Gaussian noise provides an in\-family control\.

Table 6:Reconstruction PSNR \(dB\) under the strongest REDS blur\. Higher PSNR indicates lower reconstruction error\. VAE is the only model whose reconstruction quality improves substantially under blur, reversing the expected anomaly\-score ordering\.AEVAEAE\-PPAE\-PoSClean63\.0427\.5943\.4243\.07Blur 1\.062\.7237\.0130\.5131\.79Δ\\Delta−0\.32\-0\.32\+9\.42\\mathbf\{\+9\.42\}−12\.91\-12\.91−11\.28\-11\.28
### 4\.5Transferable ECG Representations

Table 7:Frozen\-encoder AUROC\. Stage 0 and Stage 1 denote our depth\-controlled models\. Bold indicates the best result in each column\.PTB\-XLICBEBEncoderSuperSubFormRhythmCPSC2018ECG\-CPC0\.86300\.88600\.87300\.93800\.9020ECG\-FM0\.87300\.86600\.78200\.86500\.9060MERL0\.88700\.89500\.86400\.87700\.9140ST\-MEM0\.89540\.89350\.85480\.94630\.9559Stage 00\.89690\.89170\.85230\.94490\.9530Stage 10\.91360\.92770\.88250\.94820\.9623Beyond representation\-based anomaly detection, we evaluate nested carving as a general unsupervised representation\-learning strategy\. Clinical ECG labels require costly expert interpretation, whereas unlabeled recordings are abundant\. We therefore learn structure from unlabeled ECGs and train only a linear diagnostic classifier on the frozen representation\. Table[7](https://arxiv.org/html/2609.28832#S4.T7)shows that nested carving improves performance across all five classification tasks; experimental and implementation details are provided in Appendix[F](https://arxiv.org/html/2609.28832#A6)\.

## 5Conclusion and Limitations

We characterized join blindness and meet preference as opposing failures of reconstruction\-based unsupervised learning, and introduced Dynamic Push and Pull and Nested Manifold Carving to better approximate the compact nominal union prescribed by PoS, improving both anomaly detection and transferable representation learning\. More importantly, the results demonstrate a predict\-then\-measure approach: Figure[3](https://arxiv.org/html/2609.28832#S4.F3)predicts that anomalies outside the coarse range are removed at Stage 0, those in𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}survive and are exposed by latent carving, and carving moves them toward a nominal component; accordingly, digit 8 shows large reconstruction error but little latent change, whereas digit 1 is detected mainly by Stage 1 and becomes predominantly 7\-like\. At the population level, PoS predicts how geometry evolves as compactness increases: nominal components disentangle, with their relative distance \(inter\-centre distance normalized by component radius\) increasing, while off\-union samples move toward the nominal union\. Both changes occur in all 16 Push and Pull configurations\. PoS further predicts that increased compactness may weaken downstream discrimination between such samples and nominal data\. These representation dynamics offer new design targets for unsupervised learning\. Current limitations include metric dependence, manual depth selection, non\-unique projections of structured anomalies, and validation of the dynamics only in a controlled multi\-component setting, as discussed in Appendix[G](https://arxiv.org/html/2609.28832#A7)\.

## Statements

AI use:We used large language model based generative AI tools to review and polish the manuscript, including its grammar, clarity, organization, and consistency\. All AI\-assisted revisions were critically reviewed and edited by the authors, who take full responsibility for the final content\.

Ethics:This work uses existing benchmark datasets and involves no new data collection or interaction with human participants\. The clinical ECG datasets are used in de\-identified form under their original licenses and access conditions\. The ECG experiments evaluate representation learning and do not establish clinical diagnostic validity; clinical deployment would require independent validation and appropriate regulatory and ethical review\.

Reproducibility:The appendices provide the mathematical assumptions and proofs, architectures, training objectives, optimization settings, preprocessing steps, perturbation schemes, and evaluation protocols\. Upon acceptance of the conference version, we will release the source code, pretrained checkpoints, configuration files, test\-set selections, and scripts needed to reproduce the reported tables and figures\. Where dataset licenses prevent redistribution, we will provide file lists and scripts for reconstructing the evaluation subsets\.

## References

- Agustsson and Timofte \(2017\)E\. Agustsson and R\. TimofteNTIRE 2017 challenge on single image super\-resolution: dataset and study\.In2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops \(CVPRW\),pp\. 1122–1131\.External Links:[Document](https://dx.doi.org/10.1109/CVPRW.2017.150)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p1.1)\.
- Akcayet al\.\(2019\)S\. Akcay, A\. Atapour\-Abarghouei, and T\. P\. BreckonGANomaly: semi\-supervised anomaly detection via adversarial training\.InComputer Vision – ACCV 2018: 14th Asian Conference on Computer Vision, Perth, Australia, December 2–6, 2018, Revised Selected Papers, Part III 14,pp\. 622–637\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Al\-Masudet al\.\(2026\)M\. Al\-Masud, J\. M\. Lopez Alcaraz, and N\. StrodthoffBenchmarking ecg fms: a reality check across clinical tasks\.InInternational Conference on Learning Representations,Vol\.2026,pp\. 146689–146715\.Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p1.1)\.
- Arbeláezet al\.\(2011\)P\. Arbeláez, M\. Maire, C\. Fowlkes, and J\. MalikContour detection and hierarchical image segmentation\.IEEE Transactions on Pattern Analysis and Machine Intelligence33\(5\),pp\. 898–916\.External Links:[Document](https://dx.doi.org/10.1109/TPAMI.2010.161)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p1.1)\.
- Astridet al\.\(2024\)M\. Astrid, M\. Z\. Zaheer, D\. Aouada, and S\. LeeExploiting autoencoder’s weakness to generate pseudo anomalies\.Neural Computing and Applications36\(23\),pp\. 14075–14091\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Astridet al\.\(2021\)M\. Astrid, M\. Z\. Zaheer, J\. Lee, and S\. LeeLearning not to reconstruct anomalies\.arXiv preprint arXiv:2110\.09742\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Baldi and Hornik \(1989\)P\. Baldi and K\. HornikNeural networks and principal component analysis: learning from examples without local minima\.Neural networks2\(1\),pp\. 53–58\.Cited by:[§A\.5](https://arxiv.org/html/2609.28832#A1.SS5.p2.1.1)\.
- Bergman and Hoshen \(2020\)L\. Bergman and Y\. HoshenClassification\-based anomaly detection for general data\.InInternational Conference on Learning Representations,Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Blumensath and Davies \(2009\)T\. Blumensath and M\. E\. DaviesSampling theorems for signals from the union of finite\-dimensional linear subspaces\.IEEE Transactions on Information Theory55\(4\),pp\. 1872–1882\.Cited by:[Appendix B](https://arxiv.org/html/2609.28832#A2.p2.1)\.
- Bouman and Heskes \(2025\)R\. Bouman and T\. HeskesAutoencoders for anomaly detection are unreliable\.arXiv preprint arXiv:2501\.13864\.Cited by:[§A\.2\.1](https://arxiv.org/html/2609.28832#A1.SS2.SSS1.p1.1),[Table 11](https://arxiv.org/html/2609.28832#A3.T11),[§2](https://arxiv.org/html/2609.28832#S2.p2.1),[§4\.1](https://arxiv.org/html/2609.28832#S4.SS1.p1.1),[§4\.1](https://arxiv.org/html/2609.28832#S4.SS1.p2.1),[Table 1](https://arxiv.org/html/2609.28832#S4.T1)\.
- Caoet al\.\(2019\)V\. L\. Cao, M\. Nicolau, and J\. McDermottLearning neural representations for network anomaly detection\.IEEE Transactions on Cybernetics49\(8\),pp\. 3074–3087\.External Links:[Document](https://dx.doi.org/10.1109/TCYB.2018.2838668)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Deeckeet al\.\(2018\)L\. Deecke, R\. Vandermeulen, L\. Ruff, S\. Mandt, and M\. KloftImage anomaly detection with generative adversarial networks\.InJoint european conference on machine learning and knowledge discovery in databases,pp\. 3–17\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Deng \(2012\)L\. DengThe MNIST database of handwritten digit images for machine learning research\.IEEE Signal Processing Magazine29\(6\),pp\. 141–142\.External Links:[Document](https://dx.doi.org/10.1109/MSP.2012.2211477)Cited by:[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p1.1),[Table 21](https://arxiv.org/html/2609.28832#A5.T21)\.
- Deveciogluet al\.\(2025\)O\. C\. Devecioglu, S\. Kiranyaz, M\. Yamac, and M\. GabboujExpert operational gans: towards real\-color underwater image restoration\.In2025 IEEE International Conference on Image Processing Workshops \(ICIPW\),Vol\.,pp\. 191–196\.External Links:[Document](https://dx.doi.org/10.1109/ICIPW68931.2025.11386072)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p4.1),[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Elrashidet al\.\(2026\)M\. Elrashid, A\. Deschênes, C\. Subakan, M\. Ravanelli, R\. Georges, and M\. MorinToward faithful explanations in acoustic anomaly detection\.InICASSP 2026\-2026 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 5276–5280\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Franzen \(1999\)R\. FranzenKodak lossless true color image suite\.Note:[http://r0k\.us/graphics/kodak/](http://r0k.us/graphics/kodak/)Online accessed 24 Oct 2021Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Fuet al\.\(2017\)X\. Fu, J\. Huang, D\. Zeng, Y\. Huang, X\. Ding, and J\. PaisleyRemoving rain from single images via a deep detail network\.InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition \(CVPR\),Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Gaoet al\.\(2023\)H\. Gao, B\. Qiu, R\. J\. D\. Barroso, W\. Hussain, Y\. Xu, and X\. WangTSMAE: a novel anomaly detection approach for internet of things time series data using memory\-augmented autoencoder\.IEEE Transactions on Network Science and Engineering10\(5\),pp\. 2978–2990\.External Links:[Document](https://dx.doi.org/10.1109/TNSE.2022.3163144)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Georgescu \(2023\)M\. GeorgescuMasked autoencoders for unsupervised anomaly detection in medical images\.Procedia Computer Science225,pp\. 969–978\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Ghafourianet al\.\(2025\)A\. Ghafourian, H\. Shui, D\. Upadhyay, R\. Gupta, D\. Filev, and I\. SoltaniTargeted collapse regularized autoencoder for anomaly detection: black hole at the center\.IEEE Transactions on Neural Networks and Learning Systems36\(6\),pp\. 10348–10358\.External Links:[Document](https://dx.doi.org/10.1109/TNNLS.2024.3472456)Cited by:[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p1.1),[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p2.1),[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p3.1),[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1),[§E\.3](https://arxiv.org/html/2609.28832#A5.SS3.SSS0.Px1.p1.1),[Table 18](https://arxiv.org/html/2609.28832#A5.T18),[§4\.3](https://arxiv.org/html/2609.28832#S4.SS3.p1.1)\.
- Golan and El\-Yaniv \(2018\)I\. Golan and R\. El\-YanivDeep anomaly detection using geometric transformations\.Advances in neural information processing systems31\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Gonget al\.\(2019\)D\. Gong, L\. Liu, V\. Le, B\. Saha, M\. R\. Mansour, S\. Venkatesh, and A\. van den HengelMemorizing normality to detect anomaly: memory\-augmented deep autoencoder for unsupervised anomaly detection\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 1705–1714\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1),[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Guet al\.\(2019\)S\. Gu, A\. Lugmayr, M\. Danelljan, M\. Fritsche, J\. Lamour, and R\. TimofteDiv8k: diverse 8k resolution image dataset\.In2019 IEEE/CVF International Conference on Computer Vision Workshop \(ICCVW\),pp\. 3512–3516\.Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p6.1)\.
- Guveniret al\.\(1997\)H\. A\. Guvenir, B\. Acar, H\. Muderrisoglu, and R\. QuinlanArrhythmia\.Note:UCI Machine Learning RepositoryDOI: https://doi\.org/10\.24432/C5BS32Cited by:[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p1.1),[Table 3](https://arxiv.org/html/2609.28832#S4.T3)\.
- Huanget al\.\(2023\)C\. Huang, Q\. Xu, Y\. Wang, Y\. Wang, and Y\. ZhangSelf\-supervised masking for unsupervised anomaly detection and localization\.IEEE Transactions on Multimedia25\(\),pp\. 4426–4438\.External Links:[Document](https://dx.doi.org/10.1109/TMM.2022.3175611)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Kingma and Welling \(2013\)D\. P\. Kingma and M\. WellingAuto\-encoding variational bayes\.arXiv preprint arXiv:1312\.6114\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Krizhevsky \(2009\)A\. KrizhevskyLearning multiple layers of features from tiny images\.External Links:[Link](https://www.cs.toronto.edu/~kriz/learning-features-2009-TR.pdf)Cited by:[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p1.1),[Table 23](https://arxiv.org/html/2609.28832#A5.T23),[Table 24](https://arxiv.org/html/2609.28832#A5.T24),[Table 4](https://arxiv.org/html/2609.28832#S4.T4)\.
- Liet al\.\(2021\)C\. Li, K\. Sohn, J\. Yoon, and T\. PfisterCutPaste: self\-supervised learning for anomaly detection and localization\.In2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),Vol\.,pp\. 9659–9669\.External Links:[Document](https://dx.doi.org/10.1109/CVPR46437.2021.00954)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Limet al\.\(2017\)B\. Lim, S\. Son, H\. Kim, S\. Nah, and K\. M\. LeeEnhanced deep residual networks for single image super\-resolution\.In2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops \(CVPRW\),Vol\.,pp\. 1132–1140\.External Links:[Document](https://dx.doi.org/10.1109/CVPRW.2017.151)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p1.1)\.
- Liuet al\.\(2024\)C\. Liu, Z\. Wan, C\. Ouyang, A\. Shah, W\. Bai, and R\. ArcucciZero\-shot ECG classification with multimodal learning and test\-time clinical knowledge enhancement\.InForty\-first International Conference on Machine Learning,External Links:[Link](https://openreview.net/forum?id=ZvJ2lQQKjz)Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p1.1),[Appendix F](https://arxiv.org/html/2609.28832#A6.p5.1)\.
- Liuet al\.\(2008\)F\. T\. Liu, K\. M\. Ting, and Z\. ZhouIsolation forest\.In2008 Eighth IEEE International Conference on Data Mining,Vol\.,pp\. 413–422\.External Links:[Document](https://dx.doi.org/10.1109/ICDM.2008.17)Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Lu and Do \(2008\)Y\. M\. Lu and M\. N\. DoA theory for sampling signals from a union of subspaces\.IEEE transactions on signal processing56\(6\),pp\. 2334–2345\.Cited by:[Appendix B](https://arxiv.org/html/2609.28832#A2.p2.1)\.
- Maet al\.\(2017\)K\. Ma, Z\. Duanmu, Q\. Wu, Z\. Wang, H\. Yong, H\. Li, and L\. ZhangWaterloo exploration database: new challenges for image quality assessment models\.IEEE Transactions on Image Processing26\(2\),pp\. 1004–1016\.External Links:[Document](https://dx.doi.org/10.1109/TIP.2016.2631888)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p1.1)\.
- Makhzani and Frey \(2015\)A\. Makhzani and B\. J\. FreyWinner\-take\-all autoencoders\.Advances in neural information processing systems28\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Marchiet al\.\(2015\)E\. Marchi, F\. Vesperini, F\. Eyben, S\. Squartini, and B\. SchullerA novel approach for automatic acoustic novelty detection using a denoising autoencoder with bidirectional lstm neural networks\.In2015 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),Vol\.,pp\. 1996–2000\.External Links:[Document](https://dx.doi.org/10.1109/ICASSP.2015.7178320)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1),[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- McKeenet al\.\(2025\)K\. McKeen, S\. Masood, A\. Toma, B\. Rubin, and B\. WangECG\-fm: an open electrocardiogram foundation model\.JAMIA Open8\(5\),pp\. ooaf122\.External Links:ISSN 2574\-2531,[Document](https://dx.doi.org/10.1093/jamiaopen/ooaf122),[Link](https://doi.org/10.1093/jamiaopen/ooaf122),https://academic\.oup\.com/jamiaopen/article\-pdf/8/5/ooaf122/64719197/ooaf122\.pdfCited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p1.1)\.
- Naet al\.\(2024\)Y\. Na, M\. Park, Y\. Tae, and S\. JooGuiding masked representation learning to capture spatio\-temporal relationship of electrocardiogram\.InInternational conference on learning representations,Vol\.2024,pp\. 15012–15035\.Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p1.1)\.
- Nahet al\.\(2019\)S\. Nah, S\. Baik, S\. Hong, G\. Moon, S\. Son, R\. Timofte, and K\. M\. LeeNTIRE 2019 challenge on video deblurring and super\-resolution: dataset and study\.InThe IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\) Workshops,Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1),[§4\.4](https://arxiv.org/html/2609.28832#S4.SS4.p1.1)\.
- Nahet al\.\(2017\)S\. Nah, T\. H\. Kim, and K\. M\. LeeDeep multi\-scale convolutional neural network for dynamic scene deblurring\.InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition \(CVPR\),Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1),[§4\.4](https://arxiv.org/html/2609.28832#S4.SS4.p1.1)\.
- Nanaumiet al\.\(2026\)T\. Nanaumi, Y\. Tsuzuki, J\. Okubo, J\. Fujii, and T\. YamashitaSPG: sparse\-projected guides with sparse autoencoders for zero\-shot anomaly detection\.arXiv preprint arXiv:2604\.02871\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Parzen \(1962\)E\. ParzenOn estimation of a probability density function and mode\.The Annals of Mathematical Statistics33\(3\),pp\. 1065–1076\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Penget al\.\(2023\)L\. Peng, C\. Zhu, and L\. BianU\-shape transformer for underwater image enhancement\.IEEE transactions on image processing32,pp\. 3066–3079\.Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p4.1),[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Pereraet al\.\(2019\)P\. Perera, R\. Nallapati, and B\. XiangOCGAN: one\-class novelty detection using gans with constrained latent representations\.2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 2893–2901\.External Links:[Link](https://api.semanticscholar.org/CorpusID:84186723)Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1),[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Perez Aldayet al\.\(2022\)E\. A\. Perez Alday, A\. Gu, A\. Shah, C\. Liu, A\. Sharma, S\. Seyedi, A\. Bahrami Rad, M\. Reyna, and G\. CliffordClassification of 12\-lead ECGs: The PhysioNet/Computing in Cardiology Challenge 2020\.PhysioNet\.Note:Version 1\.0\.2External Links:[Document](https://dx.doi.org/10.13026/dvyd-kd57)Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p5.1)\.
- Pollardet al\.\(2026\)T\. Pollard, B\. E\. Moody, L\. H\. Lehman, B\. J\. Gow, C\. Fernandes, C\. Xie, A\. Johnson, R\. G\. Mark, and T\. HeldtPhysioNet as a global platform for biomedical research\.Nature Health,pp\. 1–4\.Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p3.1)\.
- Ribeiroet al\.\(2021\)A\. H\. Ribeiro, G\. M\. M\. Paixão, E\. M\. Lima, M\. H\. Ribeiro, M\. M\. P\. Filho, P\. R\. Gomes, D\. M\. de Oliveira, W\. Meira, T\. B\. Schön, and A\. L\. P\. RibeiroCODE\-15%: a large scale annotated dataset of 12\-lead ecgs\.External Links:[Link](https://api.semanticscholar.org/CorpusID:245000169)Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p3.1)\.
- Rombachet al\.\(2022\)R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. OmmerHigh\-resolution image synthesis with latent diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 10684–10695\.Cited by:[§E\.7\.2](https://arxiv.org/html/2609.28832#A5.SS7.SSS2.p3.1)\.
- Ruffet al\.\(2018\)L\. Ruff, R\. Vandermeulen, N\. Goernitz, L\. Deecke, S\. A\. Siddiqui, A\. Binder, E\. Müller, and M\. KloftDeep one\-class classification\.InInternational Conference on Machine Learning,pp\. 4393–4402\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Sakurada and Yairi \(2014\)M\. Sakurada and T\. YairiAnomaly detection using autoencoders with nonlinear dimensionality reduction\.InProceedings of the MLSDA 2014 2nd workshop on machine learning for sensory data analysis,pp\. 4–11\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Salehiet al\.\(2021\)M\. Salehi, A\. Arya, B\. Pajoum, M\. Otoofi, A\. Shaeiri, M\. H\. Rohban, and H\. R\. RabieeArae: adversarially robust training of autoencoders improves novelty detection\.Neural Networks144,pp\. 726–736\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Schleglet al\.\(2017\)T\. Schlegl, P\. Seeböck, S\. M\. Waldstein, U\. Schmidt\-Erfurth, and G\. LangsUnsupervised anomaly detection with generative adversarial networks to guide marker discovery\.InInformation Processing in Medical Imaging,Cham,pp\. 146–157\.External Links:ISBN 978\-3\-319\-59050\-9Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Schlüteret al\.\(2022\)H\. M\. Schlüter, J\. Tan, B\. Hou, and B\. KainzNatural synthetic anomalies for self\-supervised anomaly detection and localization\.InEuropean conference on computer vision,pp\. 474–489\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Schölkopfet al\.\(1999\)B\. Schölkopf, R\. C\. Williamson, A\. Smola, J\. Shawe\-Taylor, and J\. PlattSupport vector method for novelty detection\.Advances in Neural Information Processing Systems12\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Stability AI \(2022\)Stability AIsd\-vae\-ft\-mse: improved autoencoders \(fine\-tuned kl\-f8 decoder\)\.Note:[https://huggingface\.co/stabilityai/sd\-vae\-ft\-mse](https://huggingface.co/stabilityai/sd-vae-ft-mse)Hugging Face model repositoryCited by:[§E\.7\.2](https://arxiv.org/html/2609.28832#A5.SS7.SSS2.p3.1)\.
- Tacket al\.\(2020\)J\. Tack, S\. Mo, J\. Jeong, and J\. ShinCsi: novelty detection via contrastive learning on distributionally shifted instances\.Advances in neural information processing systems33,pp\. 11839–11852\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Wagneret al\.\(2020\)P\. Wagner, N\. Strodthoff, R\. Bousseljot, D\. Kreiseler, F\. I\. Lunze, W\. Samek, and T\. SchaeffterPTB\-xl, a large publicly available electrocardiography dataset\.Scientific data7\(1\),pp\. 154\.Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p5.1)\.
- Xiaoet al\.\(2017\)H\. Xiao, K\. Rasul, and R\. VollgrafFashion\-mnist: a novel image dataset for benchmarking machine learning algorithms\.arXiv preprint arXiv:1708\.07747\.Cited by:[§E\.1](https://arxiv.org/html/2609.28832#A5.SS1.p1.1),[Table 22](https://arxiv.org/html/2609.28832#A5.T22)\.
- Yamacet al\.\(2026\)M\. Yamac, M\. Duman, U\. Akpinar, F\. R\. Casadiego, S\. Kiranyaz, M\. van Gerven, and M\. GabboujAxiomatizing neural networks via pursuit of subspaces\.arXiv preprint arXiv:2605\.20534\.Cited by:[§A\.2\.1](https://arxiv.org/html/2609.28832#A1.SS2.SSS1.p1.1),[Appendix B](https://arxiv.org/html/2609.28832#A2.p2.1),[§1](https://arxiv.org/html/2609.28832#S1.p1.1),[§1](https://arxiv.org/html/2609.28832#S1.p2.1)\.
- Yanget al\.\(2017\)W\. Yang, R\. T\. Tan, J\. Feng, J\. Liu, Z\. Guo, and S\. YanDeep joint rain detection and removal from a single image\.In2017 IEEE conference on computer vision and pattern recognition \(CVPR\),pp\. 1685–1694\.Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Yanget al\.\(2020\)Z\. Yang, I\. S\. Bozchalooi, and E\. DarveRegularized cycle consistent generative adversarial network for anomaly detection\.InEuropean Conference on Artificial Intelligence \(ECAI\),Vol\.325,pp\. 1618–1625\.External Links:[Document](https://dx.doi.org/10.3233/FAIA200272),[Link](https://ebooks.iospress.nl/DOI/10.3233/FAIA200272)Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Yanget al\.\(2021\)Z\. Yang, T\. Zhang, I\. S\. Bozchalooi, and E\. DarveMemory\-augmented generative adversarial networks for anomaly detection\.IEEE Transactions on Neural Networks and Learning Systems33\(6\),pp\. 2324–2334\.External Links:[Document](https://dx.doi.org/10.1109/TNNLS.2021.3132928)Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Yeet al\.\(2022\)F\. Ye, C\. Huang, J\. Cao, M\. Li, Y\. Zhang, and C\. LuAttribute restoration framework for anomaly detection\.IEEE Transactions on Multimedia24\(\),pp\. 116–127\.External Links:[Document](https://dx.doi.org/10.1109/TMM.2020.3046884)Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Zaheeret al\.\(2020\)M\. Z\. Zaheer, J\. Lee, M\. Astrid, and S\. LeeOld is gold: redefining the adversarially learned one\-class classifier training paradigm\.In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\),pp\. 14171–14181\.External Links:[Document](https://dx.doi.org/10.1109/CVPR42600.2020.01419)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Zavrtaniket al\.\(2021\)V\. Zavrtanik, M\. Kristan, and D\. SkočajDRÆm–a discriminatively trained reconstruction embedding for surface anomaly detection\.In2021 IEEE/CVF International Conference on Computer Vision \(ICCV\),pp\. 8310–8319\.External Links:[Document](https://dx.doi.org/10.1109/ICCV48922.2021.00822)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p2.1)\.
- Zenatiet al\.\(2018\)H\. Zenati, M\. Romain, C\. Foo, B\. Lecouat, and V\. ChandrasekharAdversarially learned anomaly detection\.In2018 IEEE International Conference on Data Mining \(ICDM\),pp\. 727–736\.External Links:[Link](https://ieeexplore.ieee.org/document/8594897)Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1)\.
- Zhaiet al\.\(2016\)S\. Zhai, Y\. Cheng, W\. Lu, and Z\. ZhangDeep structured energy based models for anomaly detection\.InInternational Conference on Machine Learning,pp\. 1100–1109\.Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1),[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Zhang and Patel \(2018\)H\. Zhang and V\. M\. PatelDensity\-aware single image de\-raining using a multi\-stream dense network\.In2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition,Vol\.,pp\. 695–704\.External Links:[Document](https://dx.doi.org/10.1109/CVPR.2018.00079)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Zhanget al\.\(2020\)H\. Zhang, V\. Sindagi, and V\. M\. PatelImage de\-raining using a conditional generative adversarial network\.IEEE Transactions on Circuits and Systems for Video Technology30\(11\),pp\. 3943–3956\.External Links:[Document](https://dx.doi.org/10.1109/TCSVT.2019.2920407)Cited by:[§E\.7\.1](https://arxiv.org/html/2609.28832#A5.SS7.SSS1.p5.1)\.
- Zhaoet al\.\(2017\)Y\. Zhao, B\. Deng, C\. Shen, Y\. Liu, H\. Lu, and X\. HuaSpatio\-temporal autoencoder for video anomaly detection\.InProceedings of the 25th ACM international conference on Multimedia,pp\. 1933–1941\.External Links:[Document](https://dx.doi.org/10.1145/3123266.3123451)Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Zhenget al\.\(2020\)J\. Zheng, H\. Chu, D\. C\. Struppa, J\. Zhang, S\. M\. Yacoub, H\. M\. El\-Askary, A\. Chang, L\. Ehwerhemuepha, I\. Abudayyeh, A\. Barrett, G\. Fu, H\. Yao, D\. Li, H\. Guo, and C\. RakovskiOptimal multi\-stage arrhythmia classification approach\.Scientific Reports10\(1\),pp\. 2898\.External Links:[Document](https://dx.doi.org/10.1038/s41598-020-59821-7),[Link](https://doi.org/10.1038/s41598-020-59821-7)Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p3.1)\.
- Zhenget al\.\(2022\)J\. Zheng, H\. Guo, and H\. ChuA large scale 12\-lead electrocardiogram database for arrhythmia study \(version 1\.0\.0\)\.PhysioNet\.Note:Version 1\.0\.0External Links:[Document](https://dx.doi.org/10.13026/wgex-er52),[Link](https://doi.org/10.13026/wgex-er52)Cited by:[Appendix F](https://arxiv.org/html/2609.28832#A6.p3.1)\.
- Zhou and Paffenroth \(2017\)C\. Zhou and R\. C\. PaffenrothAnomaly detection with robust deep autoencoders\.InProceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining,pp\. 665–674\.Cited by:[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.
- Zonget al\.\(2018\)B\. Zong, Q\. Song, M\. R\. Min, W\. Cheng, C\. Lumezanu, D\. Cho, and H\. ChenDeep autoencoding Gaussian mixture model for unsupervised anomaly detection\.InInternational Conference on Learning Representations,Cited by:[§E\.2](https://arxiv.org/html/2609.28832#A5.SS2.p1.1),[§2](https://arxiv.org/html/2609.28832#S2.p1.1)\.

## Appendix

## Appendix AMeet–Union–Join Geometry: Definitions and Proofs

This appendix formalizes the tangent\-space model used in the main text\. In each local chart, the component submanifolds are represented by tangent subspaces in common ambient coordinates, where the meet, union, and join relations hold pointwise\. Applied throughout the tangent bundle, these fiberwise relations provide a global characterization of the nonlinear geometry without assuming that the manifolds or networks are globally linear\. Wheneverdist⁡\(s,T\)\\operatorname\{dist\}\(s,T\)is interpreted as a reconstruction score, we assume the ideal nearest\-point projection prescribed by P2\. For a generic autoencoder, its output need not be the nearest point in its learned range, so geometric distance and reconstruction error are kept distinct\.

### A\.1Axiomatic dependence of the results

Table 8:Dependence of the main results and constructions on the PoS postulates\. A checkmark denotes direct use, while an open circle denotes that the postulate is required only to transfer a geometric statement to its neural\-network interpretation\. Blank entries rely only on the stated hypotheses and standard geometry\.Result or constructionP1P2P3P4Score ordering, union optimality, and linear obstruction∘\\circJoin blindness and meet preference as PoS failures✓\\checkmark∘\\circDynamic Push and Pull construction✓\\checkmark✓\\checkmark✓\\checkmarkPush and Pull geometric guarantees✓\\checkmarkNested Manifold Carving and the nested\-range relation✓\\checkmark✓\\checkmark✓\\checkmark✓\\checkmarkIncreasing relative separation of nominal components✓\\checkmark✓\\checkmarkMovement of off\-union samples toward nominal components✓\\checkmark✓\\checkmark✓\\checkmarkTable[8](https://arxiv.org/html/2609.28832#A1.T8)makes the axiomatic dependence explicit\. A checkmark denotes a postulate used directly in the construction or result; an open circle denotes a postulate needed to transfer a geometric statement to the corresponding neural\-network interpretation\. Throughout the paper, every use of a PoS postulate is stated explicitly; an unmarked step uses only the displayed hypotheses and standard metric, set, or linear geometry\. All definitions and results below apply to any input or latent representation space\. We suppress the level index throughout; at levelℓ\\ell, the symbolsSiS\_\{i\},𝒲\\mathcal\{W\},𝒰\\mathcal\{U\},𝒱\\mathcal\{V\}, andTTare understood as their level specific counterparts\.

### A\.2Meet, union, and join

LetS1,…,SMS\_\{1\},\\ldots,S\_\{M\}be linear subspaces of a common finite\-dimensional Euclidean spaceℝn\\mathbb\{R\}^\{n\}\. In the manifold interpretation, they are tangent spaces expressed in a common local coordinate system\.

###### Definition 2\(Meet, union, and join\)\.

Define

𝒲:=⋂i=1MSi,𝒰:=⋃i=1MSi,𝒱:=∑i=1MSi\.\\mathcal\{W\}:=\\bigcap\_\{i=1\}^\{M\}S\_\{i\},\\qquad\\mathcal\{U\}:=\\bigcup\_\{i=1\}^\{M\}S\_\{i\},\\qquad\\mathcal\{V\}:=\\sum\_\{i=1\}^\{M\}S\_\{i\}\.\(8\)Then𝒲⊆𝒰⊆𝒱\\mathcal\{W\}\\subseteq\\mathcal\{U\}\\subseteq\\mathcal\{V\}\. The union𝒰\\mathcal\{U\}is generally not a subspace, whereas𝒲\\mathcal\{W\}and𝒱\\mathcal\{V\}are subspaces\. This chain concerns the three reference sets only and imposes no ordering on an arbitrary learned rangeTT\.

###### Definition 3\(Geometric and reconstruction scores\)\.

For a nonempty setT⊆ℝnT\\subseteq\\mathbb\{R\}^\{n\}, define the geometric score

ageo​\(s,T\):=dist⁡\(s,T\)=inft∈T∥s−t∥2\.a\_\{\\mathrm\{geo\}\}\(s;T\):=\\operatorname\{dist\}\(s,T\)=\\inf\_\{t\\in T\}\\lVert s\-t\\rVert\_\{2\}\.For an autoencoderPθP\_\{\\theta\}with learned rangeTθ:=range⁡\(Pθ\)T\_\{\\theta\}:=\\operatorname\{range\}\(P\_\{\\theta\}\), define its reconstruction score

arec​\(s,θ\):=∥s−Pθ​\(s\)∥2\.a\_\{\\mathrm\{rec\}\}\(s;\\theta\):=\\lVert s\-P\_\{\\theta\}\(s\)\\rVert\_\{2\}\.SincePθ​\(s\)∈TθP\_\{\\theta\}\(s\)\\in T\_\{\\theta\},

ageo​\(s,Tθ\)≤arec​\(s,θ\)\.a\_\{\\mathrm\{geo\}\}\(s;T\_\{\\theta\}\)\\leq a\_\{\\mathrm\{rec\}\}\(s;\\theta\)\.Equality holds if and only ifPθ​\(s\)P\_\{\\theta\}\(s\)is a nearest point tossinTθT\_\{\\theta\}\. Under P2, equality therefore holds wherever the learned nonlinear orthogonal projector selects a nearest point in its range\. Such a nearest point need not be unique; conditions ensuring uniqueness are outside the scope of this paper\.

#### A\.2\.1Linear autoencoders are non\-compact learners of subspace unions

The compact and non\-compact terminology follows the original PoS formulation\([Yamac et al\., 2026](https://arxiv.org/html/2609.28832#bib.bib3)\)\. When𝒰≠𝒱\\mathcal\{U\}\\neq\\mathcal\{V\}, a linear autoencoder whose range contains all nominal components cannot compact its learned range to their union𝒰\\mathcal\{U\}, because linearity forces the range to contain their entire join𝒱\\mathcal\{V\}\. The following proposition formalizes the contrast between linear and ReLU networks observed in the PoS toy examples and complements the off\-support reconstruction analysis of[Bouman and Heskes \(2025\)](https://arxiv.org/html/2609.28832#bib.bib23)\.

###### Proposition 4\(Linear non\-compaction\)\.

LetP=fD∘fE:ℝn→ℝnP=f\_\{D\}\\circ f\_\{E\}:\\mathbb\{R\}^\{n\}\\to\\mathbb\{R\}^\{n\}be a linear autoencoder map with learned rangeT:=range⁡\(P\)T:=\\operatorname\{range\}\(P\)\. If𝒰⊆T\\mathcal\{U\}\\subseteq T, then

𝒱=span⁡\(𝒰\)⊆T\.\\mathcal\{V\}=\\operatorname\{span\}\(\\mathcal\{U\}\)\\subseteq T\.\(9\)Consequently, ifT⊆𝒱T\\subseteq\\mathcal\{V\}, thenT=𝒱T=\\mathcal\{V\}\. Whenever𝒰≠𝒱\\mathcal\{U\}\\neq\\mathcal\{V\}, no linear autoencoder whose range contains𝒰\\mathcal\{U\}can have learned rangeT=𝒰T=\\mathcal\{U\}\.

###### Proof\.

The rangeTTof a linear map is a subspace\. SinceTTcontains𝒰\\mathcal\{U\}, it must also contain the smallest linear subspace containing𝒰\\mathcal\{U\}, namelyspan⁡\(𝒰\)=∑iSi=𝒱\\operatorname\{span\}\(\\mathcal\{U\}\)=\\sum\_\{i\}S\_\{i\}=\\mathcal\{V\}\. The remaining statements follow immediately\. ∎

Thus, a linear autoencoder whose range covers𝒰\\mathcal\{U\}necessarily also contains the off\-union directions𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}\. Under P2, these directions become zero\-score blind regions\. Exact carving of a genuine union𝒰≠𝒱\\mathcal\{U\}\\neq\\mathcal\{V\}therefore requires nonlinearity somewhere in the complete reconstruction map\.

###### Proposition 6\(Geometric score sandwich\)\.

For everys∈ℝns\\in\\mathbb\{R\}^\{n\},

dist⁡\(s,𝒱\)≤dist⁡\(s,𝒰\)=min1≤i≤M⁡dist⁡\(s,Si\)≤dist⁡\(s,𝒲\)\.\\operatorname\{dist\}\(s,\\mathcal\{V\}\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{U\}\)=\\min\_\{1\\leq i\\leq M\}\\operatorname\{dist\}\(s,S\_\{i\}\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{W\}\)\.\(10\)

###### Proof\.

For setsA⊆BA\\subseteq B, distance reverses inclusion:dist⁡\(s,B\)≤dist⁡\(s,A\)\\operatorname\{dist\}\(s,B\)\\leq\\operatorname\{dist\}\(s,A\)\. Applying this to𝒲⊆𝒰⊆𝒱\\mathcal\{W\}\\subseteq\\mathcal\{U\}\\subseteq\\mathcal\{V\}gives the two inequalities\. Since𝒰=⋃i=1MSi\\mathcal\{U\}=\\bigcup\_\{i=1\}^\{M\}S\_\{i\}is a finite union, its distance is the minimum of the component distances\. ∎

Under P2, this ordering transfers to reconstruction scores when the corresponding networks realize nearest\-point projections\. It does not hold automatically for generic autoencoders\.

### A\.3Optimality of the nominal union among geometrically faithful ranges

Assume thatpnomp\_\{\\mathrm\{nom\}\}is supported on the nominal union𝒰\\mathcal\{U\}\. Since𝒰\\mathcal\{U\}is a finite union of closed subspaces, it is closed\. Define the closed candidate ranges that geometrically preserve the complete nominal support by

𝔗\+:=\{T⊆ℝn:𝒰⊆T,Tis closed\}\.\\mathfrak\{T\}\_\{\+\}:=\\left\\\{T\\subseteq\\mathbb\{R\}^\{n\}:\\mathcal\{U\}\\subseteq T,\\;T\\ \\text\{is closed\}\\right\\\}\.\(11\)For everyT∈𝔗\+T\\in\\mathfrak\{T\}\_\{\+\},dist⁡\(sn,T\)=0\\operatorname\{dist\}\(s\_\{n\},T\)=0for allsn∈𝒰s\_\{n\}\\in\\mathcal\{U\}\. Under P2, this corresponds to perfect nominal reconstruction\.

For an anomaly distributionpap\_\{a\}for which the following expectations exist, define the expected geometric score gap

Δ⁡\(T\):=𝔼sa∼pa​\[dist⁡\(sa,T\)\]−𝔼sn∼pnom​\[dist⁡\(sn,T\)\]\.\\Delta\(T\):=\\mathbb\{E\}\_\{s\_\{a\}\\sim p\_\{a\}\}\\\!\\left\[\\operatorname\{dist\}\(s\_\{a\},T\)\\right\]\-\\mathbb\{E\}\_\{s\_\{n\}\\sim p\_\{\\mathrm\{nom\}\}\}\\\!\\left\[\\operatorname\{dist\}\(s\_\{n\},T\)\\right\]\.\(12\)The second term vanishes for everyT∈𝔗\+T\\in\\mathfrak\{T\}\_\{\+\}, soΔ⁡\(T\)\\Delta\(T\)equals the expected anomaly distance fromTT\. The question is therefore which geometrically nominal\-faithful range keeps anomalies farthest away\. This analysis transfers to reconstruction error only when the network realizes the nearest\-point projection prescribed by P2\. Moreover,Δ⁡\(T\)\\Delta\(T\)is an expected score gap and does not by itself determine AUC\.

###### Lemma 7\(Nominal union optimality\)\.

Assume that the nominal distribution is supported on𝒰\\mathcal\{U\}, that is,pnom​\(𝒰\)=1p\_\{\\mathrm\{nom\}\}\(\\mathcal\{U\}\)=1\. For everyT∈𝔗\+T\\in\\mathfrak\{T\}\_\{\+\}and everys∈ℝns\\in\\mathbb\{R\}^\{n\},

dist⁡\(s,T\)≤dist⁡\(s,𝒰\)\.\\operatorname\{dist\}\(s,T\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{U\}\)\.\(13\)Consequently,

maxT∈𝔗\+⁡Δ⁡\(T\)=Δ⁡\(𝒰\),\\max\_\{T\\in\\mathfrak\{T\}\_\{\+\}\}\\Delta\(T\)=\\Delta\(\\mathcal\{U\}\),\(14\)so the nominal union𝒰\\mathcal\{U\}is an optimal geometrically faithful range\.

###### Proof\.

Since𝒰⊆T\\mathcal\{U\}\\subseteq T, set inclusion givesdist⁡\(s,T\)≤dist⁡\(s,𝒰\)\\operatorname\{dist\}\(s,T\)\\leq\\operatorname\{dist\}\(s,\\mathcal\{U\}\)\. Moreover,pnom​\(𝒰\)=1p\_\{\\mathrm\{nom\}\}\(\\mathcal\{U\}\)=1implies that both nominal distance terms inΔ⁡\(T\)\\Delta\(T\)andΔ⁡\(𝒰\)\\Delta\(\\mathcal\{U\}\)vanish\. Taking expectations overpap\_\{a\}givesΔ⁡\(T\)≤Δ⁡\(𝒰\)\\Delta\(T\)\\leq\\Delta\(\\mathcal\{U\}\)\. Since𝒰\\mathcal\{U\}is closed,𝒰∈𝔗\+\\mathcal\{U\}\\in\\mathfrak\{T\}\_\{\+\}, so the upper bound is attained atT=𝒰T=\\mathcal\{U\}\. ∎

### A\.4Join blindness

###### Corollary 9\(Join blindness\)\.

Suppose join collapse occurs, so the learned operator has rangeTθ:=range⁡\(Pθ\)=𝒱T\_\{\\theta\}:=\\operatorname\{range\}\(P\_\{\\theta\}\)=\\mathcal\{V\}\. Under the ideal geometric score, every samples∈𝒱s\\in\\mathcal\{V\}satisfiesσ𝒱​\(s\)=0\\sigma\_\{\\mathcal\{V\}\}\(s\)=0\. Hence nominal data supported on𝒰\\mathcal\{U\}and any anomaly distribution supported on𝒱\\mathcal\{V\}receive identical constant scores\. Under the standard half\-credit convention for ties, the corresponding AUC is1/21/2\.

###### Proof\.

The distance from any member of𝒱\\mathcal\{V\}to𝒱\\mathcal\{V\}is zero\. Therefore every nominal and anomalous score is zero\. ∎

### A\.5Meet preference and fidelity loss

Recall that the meet

𝒲:=⋂i=1MSi\\mathcal\{W\}:=\\bigcap\_\{i=1\}^\{M\}S\_\{i\}is the subspace shared by all component tangent spaces\. Limited capacity need not recover exactly𝒲\\mathcal\{W\}, but may preferentially retain its shared directions while discarding component specific directions\. We call the limiting caseT=𝒲T=\\mathcal\{W\}meet collapse\. The following proposition gives a sufficient condition for this preference under rank constrained MSE learning\.

###### Proposition 10\(Shared direction preference under balanced compression\)\.

Let nominal data be sampled uniformly fromMMcomponents, with𝔼⁡\[s∣i\]=0\\mathbb\{E\}\[s\\mid i\]=0\. Supposedim𝒲\>0\\dim\\mathcal\{W\}\>0, and write

Si=𝒲⊕Ci,Ci:=Si∩𝒲⟂\.S\_\{i\}=\\mathcal\{W\}\\oplus C\_\{i\},\\qquad C\_\{i\}:=S\_\{i\}\\cap\\mathcal\{W\}^\{\\perp\}\.Assume that theCiC\_\{i\}are mutually orthogonal and that

Cov⁡\(s∣i\)=σ𝒲2​P𝒲\+σC2​PCi\.\\operatorname\{Cov\}\(s\\mid i\)=\\sigma\_\{\\mathcal\{W\}\}^\{2\}P\_\{\\mathcal\{W\}\}\+\\sigma\_\{C\}^\{2\}P\_\{C\_\{i\}\}\.\(17\)Then the pooled covariance is

Σ=σ𝒲2​P𝒲\+σC2M​∑i=1MPCi\.\\Sigma=\\sigma\_\{\\mathcal\{W\}\}^\{2\}P\_\{\\mathcal\{W\}\}\+\\frac\{\\sigma\_\{C\}^\{2\}\}\{M\}\\sum\_\{i=1\}^\{M\}P\_\{C\_\{i\}\}\.\(18\)If

σ𝒲2\>σC2M,\\sigma\_\{\\mathcal\{W\}\}^\{2\}\>\\frac\{\\sigma\_\{C\}^\{2\}\}\{M\},\(19\)every direction in𝒲\\mathcal\{W\}has strictly larger covariance eigenvalue than every component specific direction\. Consequently, a globally MSE optimal linear autoencoder constrained to rankrrretains shared directions first\. In particular, ifr=dim𝒲r=\\dim\\mathcal\{W\}, its learned range is exactly𝒲\\mathcal\{W\}\.

###### Proof\.

Averaging the conditional covariances over theMMcomponents gives Eq\. \([18](https://arxiv.org/html/2609.28832#A1.E18)\)\. Mutual orthogonality gives eigenvalueσ𝒲2\\sigma\_\{\\mathcal\{W\}\}^\{2\}on𝒲\\mathcal\{W\}andσC2/M\\sigma\_\{C\}^\{2\}/Mon eachCiC\_\{i\}\. Condition \([19](https://arxiv.org/html/2609.28832#A1.E19)\) therefore places all shared directions before all component specific directions in the covariance spectrum\. By the linear autoencoder characterization of[Baldi and Hornik \(1989\)](https://arxiv.org/html/2609.28832#bib.bib4), the global MSE optimum projects onto the leading principal subspace\. At rankr=dim𝒲r=\\dim\\mathcal\{W\}, condition \([19](https://arxiv.org/html/2609.28832#A1.E19)\) makes this subspace exactly𝒲\\mathcal\{W\}, proving the result\. ∎

###### Proposition 12\(Nominal distortion under meet collapse\)\.

Suppose meet collapse occurs, so that the learned range isT=𝒲T=\\mathcal\{W\}\. For every nominal samples∈Sis\\in S\_\{i\},

ageo​\(s,𝒲\)=dist⁡\(s,𝒲\)=‖PSi∩𝒲⟂​s‖2\.a\_\{\\mathrm\{geo\}\}\(s;\\mathcal\{W\}\)=\\operatorname\{dist\}\(s,\\mathcal\{W\}\)=\\left\\lVert P\_\{S\_\{i\}\\cap\\mathcal\{W\}^\{\\perp\}\}s\\right\\rVert\_\{2\}\.\(20\)Thus, every nominal sample with nonzero component specific tangent content outside𝒲\\mathcal\{W\}receives a positive geometric score\. Under P2, this score equals its reconstruction error\.

###### Proof\.

Since𝒲⊆Si\\mathcal\{W\}\\subseteq S\_\{i\},

s=P𝒲​s\+PSi∩𝒲⟂​s\.s=P\_\{\\mathcal\{W\}\}s\+P\_\{S\_\{i\}\\cap\\mathcal\{W\}^\{\\perp\}\}s\.The two terms are orthogonal, andP𝒲​sP\_\{\\mathcal\{W\}\}sis the nearest point tossin𝒲\\mathcal\{W\}\. Therefore,

dist⁡\(s,𝒲\)=‖s−P𝒲​s‖2=‖PSi∩𝒲⟂​s‖2,\\operatorname\{dist\}\(s,\\mathcal\{W\}\)=\\left\\lVert s\-P\_\{\\mathcal\{W\}\}s\\right\\rVert\_\{2\}=\\left\\lVert P\_\{S\_\{i\}\\cap\\mathcal\{W\}^\{\\perp\}\}s\\right\\rVert\_\{2\},proving Eq\. \([20](https://arxiv.org/html/2609.28832#A1.E20)\)\. ∎

Table 9:Toy verification of the learned geometries and their score consequences\. The linear two dimensional model learns the join, the ReLU model approximates the compact union, and the one dimensional linear model exhibits rank deficient underlearning\. The meet is trivial in this toy, so the final case illustrates nominal fidelity loss rather than exact meet collapse\. Distances report the mean and standard deviation of reconstruction scores\.Learned geometrydnom,traind\_\{\\mathrm\{nom,train\}\}dnom,testd\_\{\\mathrm\{nom,test\}\}danomd\_\{\\mathrm\{anom\}\}danomdnom,test\\frac\{d\_\{\\mathrm\{anom\}\}\}\{d\_\{\\mathrm\{nom,test\}\}\}AUROCJoin \(linear AE,2​D2\\mathrm\{D\}\)0\.134±0\.110\.134\\pm 0\.110\.143±0\.100\.143\\pm 0\.100\.136±0\.120\.136\\pm 0\.120\.950\.950\.4560\.456Compact union \(ReLU AE,2​D2\\mathrm\{D\}\)0\.226±0\.120\.226\\pm 0\.120\.244±0\.110\.244\\pm 0\.111\.624±0\.561\.624\\pm 0\.566\.646\.641\.0001\.000Rank deficient underlearning \(linear AE,1​D1\\mathrm\{D\}\)1\.364±0\.511\.364\\pm 0\.511\.386±0\.441\.386\\pm 0\.441\.435±0\.901\.435\\pm 0\.901\.041\.040\.4220\.422##### Toy data verification:

Table[9](https://arxiv.org/html/2609.28832#A1.T9)reports reconstruction scores for the toy data illustrated in Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\. The join model reconstructs nominal and anomalous samples similarly, demonstrating the loss of selectivity shown in Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(b\)\. The rank deficient model assigns large errors to both groups, demonstrating the loss of nominal fidelity shown in Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(d\)\. Because the two nominal subspaces have a trivial meet, this case is not an instantiation of Proposition[10](https://arxiv.org/html/2609.28832#Thmtheorem10)\. Only the compact union model preserves low nominal error while assigning substantially larger scores to anomalies, as shown in Figure[1](https://arxiv.org/html/2609.28832#S1.F1)\(c\)\.

### A\.6Proof of the separate pull and push guarantees

###### Proof\.

SincePθ​\(s~n\)∈TP\_\{\\theta\}\(\\widetilde\{s\}\_\{n\}\)\\in T, the pull bound implies

distd⁡\(sn,T\)≤d⁡\(Pθ​\(s~n\),sn\)≤εpull\.\\operatorname\{dist\}\_\{d\}\(s\_\{n\},T\)\\leq d\(P\_\{\\theta\}\(\\widetilde\{s\}\_\{n\}\),s\_\{n\}\)\\leq\\varepsilon\_\{\\mathrm\{pull\}\}\.Moreover,\[z\]\+≥z\[z\]\_\{\+\}\\geq zgives

ρθ,d​\(s~n\)≥α​δe−εpush\.\\rho\_\{\\theta,d\}\(\\widetilde\{s\}\_\{n\}\)\\geq\\alpha\\delta\_\{e\}\-\\varepsilon\_\{\\mathrm\{push\}\}\.Under P2,ρθ,d​\(s~n\)=distd⁡\(s~n,T\)\\rho\_\{\\theta,d\}\(\\widetilde\{s\}\_\{n\}\)=\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\. The triangle inequality also gives

δe≤distd⁡\(s~n,T\)\+d⁡\(Pθ​\(s~n\),sn\)≤distd⁡\(s~n,T\)\+εpull\.\\delta\_\{e\}\\leq\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\+d\(P\_\{\\theta\}\(\\widetilde\{s\}\_\{n\}\),s\_\{n\}\)\\leq\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\+\\varepsilon\_\{\\mathrm\{pull\}\}\.Together with nonnegativity, these inequalities prove Eq\. \([5](https://arxiv.org/html/2609.28832#S3.E5)\)\.

Finally, if𝒰⊆T\\mathcal\{U\}\\subseteq T, then

distd⁡\(s~n,T\)≤distd⁡\(s~n,𝒰\)≤δe\+η⁡\(sn\)\.\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\\leq\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},\\mathcal\{U\}\)\\leq\\delta\_\{e\}\+\\eta\(s\_\{n\}\)\.Combining this upper bound withdistd⁡\(s~n,T\)≥α​δe−εpush\\operatorname\{dist\}\_\{d\}\(\\widetilde\{s\}\_\{n\},T\)\\geq\\alpha\\delta\_\{e\}\-\\varepsilon\_\{\\mathrm\{push\}\}and dividing byδe\>0\\delta\_\{e\}\>0proves Eq\. \([6](https://arxiv.org/html/2609.28832#S3.E6)\)\. ∎

## Appendix BDetailed construction of nested manifold carving

This appendix gives the stagewise construction and capacity conditions behind Section[3\.2](https://arxiv.org/html/2609.28832#S3.SS2)\. Following P4, nested carving applies dynamic push–pull recursively in learned latent spaces\. Letx\(0\)=sx^\{\(0\)\}=s\. At stageℓ\\ell, the previously learned encoder–decoder pairs are frozen, and a new pair is trained on the current nominal representationx\(ℓ−1\)x^\{\(\\ell\-1\)\}:

x\(ℓ\)=fE\(ℓ\)​\(x\(ℓ−1\)\),x^\(ℓ−1\)=fD\(ℓ\)​\(x\(ℓ\)\)\.x^\{\(\\ell\)\}=f\_\{E\}^\{\(\\ell\)\}\(x^\{\(\\ell\-1\)\}\),\\qquad\\widehat\{x\}^\{\(\\ell\-1\)\}=f\_\{D\}^\{\(\\ell\)\}\(x^\{\(\\ell\)\}\)\.\(21\)
Before training, the new latent dimension is chosen to preserve the current nominal union\. In the local linearized model, write𝒰\(ℓ−1\)=⋃iSi\(ℓ−1\)\\mathcal\{U\}^\{\(\\ell\-1\)\}=\\bigcup\_\{i\}S\_\{i\}^\{\(\\ell\-1\)\}and letfE\(ℓ\):ℝnℓ−1→ℝnℓf\_\{E\}^\{\(\\ell\)\}:\\mathbb\{R\}^\{n\_\{\\ell\-1\}\}\\to\\mathbb\{R\}^\{n\_\{\\ell\}\}\. As reviewed in PoS[Yamac et al\. \(2026\)](https://arxiv.org/html/2609.28832#bib.bib3)and classical union\-of\-subspaces theory[Blumensath and Davies \(2009\)](https://arxiv.org/html/2609.28832#bib.bib56);[Lu and Do \(2008\)](https://arxiv.org/html/2609.28832#bib.bib57), a linear encoder is injective on𝒰\(ℓ−1\)\\mathcal\{U\}^\{\(\\ell\-1\)\}precisely when

ker⁡fE\(ℓ\)∩\(Si\(ℓ−1\)\+Sj\(ℓ−1\)\)=0for all​i,j\.\\ker f\_\{E\}^\{\(\\ell\)\}\\cap\\bigl\(S\_\{i\}^\{\(\\ell\-1\)\}\+S\_\{j\}^\{\(\\ell\-1\)\}\\bigr\)=\{0\}\\quad\\text\{for all \}i,j\.\(22\)For a finite family, this condition is generically feasible when

nℓ≥kmax\(ℓ−1\):=max⁡dimi,j⁡\(Si\(ℓ−1\)\+Sj\(ℓ−1\)\)\.n\_\{\\ell\}\\geq k\_\{\\max\}^\{\(\\ell\-1\)\}:=\\max\_\{i,j\}\\dim\\bigl\(S\_\{i\}^\{\(\\ell\-1\)\}\+S\_\{j\}^\{\(\\ell\-1\)\}\\bigr\)\.\(23\)Below this width, some pairwise difference is necessarily annihilated, so distinct nominal points become indistinguishable and exact reconstruction of the union is impossible\.

Equations \([22](https://arxiv.org/html/2609.28832#A2.E22)\)–\([23](https://arxiv.org/html/2609.28832#A2.E23)\) preserve nominal distinctions but do not themselves ensure compact\-union carving\. If the complete stage map is linear and faithful on a non\-subspace union, Proposition[A\.2\.1](https://arxiv.org/html/2609.28832#A1.SS2.SSS1)forces its range to contain the corresponding join\. Exact union carving therefore additionally requires nonlinearity and informative perturbations\.

When Eq\. \([22](https://arxiv.org/html/2609.28832#A2.E22)\) holds and

Si\(ℓ\):=fE\(ℓ\)​\(Si\(ℓ−1\)\),S\_\{i\}^\{\(\\ell\)\}:=f\_\{E\}^\{\(\\ell\)\}\(S\_\{i\}^\{\(\\ell\-1\)\}\),
the dimensions of all pairwise sums are preserved, givingkmax\(ℓ\)=kmax\(ℓ−1\)k\_\{\\max\}^\{\(\\ell\)\}=k\_\{\\max\}^\{\(\\ell\-1\)\}\. Hence the capacity floor in Eq\. \([23](https://arxiv.org/html/2609.28832#A2.E23)\) persists across faithful linearized levels\. A simple sufficient architectural choice isnℓ≥nℓ−1n\_\{\\ell\}\\geq n\_\{\\ell\-1\}, for which a generic full\-column\-rank encoder has zero kernel\. These are local linearized capacity conditions; nominal fidelity must still be learned by the pull objective\.

Finally, a perturbatione\(ℓ\)e^\{\(\\ell\)\}is applied tox\(ℓ−1\)x^\{\(\\ell\-1\)\}, and Eq\. \([2](https://arxiv.org/html/2609.28832#S3.E2)\) is used at levelℓ\\ellwith

sn=x\(ℓ−1\),e=e\(ℓ\),Pθ=Pθℓ:=fD\(ℓ\)∘fE\(ℓ\)\.s\_\{n\}=x^\{\(\\ell\-1\)\},\\qquad e=e^\{\(\\ell\)\},\\qquad P\_\{\\theta\}=P\_\{\\theta\_\{\\ell\}\}:=f\_\{D\}^\{\(\\ell\)\}\\circ f\_\{E\}^\{\(\\ell\)\}\.\(24\)Thus, the pull term preserves the nominal latent representation, while the push term discourages the new stage from reproducing its perturbed counterpart\. After optimization, the new pair is frozen and the procedure is repeated at the next latent level\. For compact notation, define the encoder and decoder stacks

Fℓ:=fE\(ℓ\)∘⋯∘fE\(1\),Gℓ:=fD\(1\)∘⋯∘fD\(ℓ\),F\_\{\\ell\}:=f\_\{E\}^\{\(\\ell\)\}\\circ\\cdots\\circ f\_\{E\}^\{\(1\)\},\\qquad G\_\{\\ell\}:=f\_\{D\}^\{\(1\)\}\\circ\\cdots\\circ f\_\{D\}^\{\(\\ell\)\},
withF0=G0=IF\_\{0\}=G\_\{0\}=I\. The complete reconstruction map through levelℓ\\ellis therefore

P¯\(ℓ\):=Gℓ−1∘Pθℓ∘Fℓ−1=Gℓ∘Fℓ,T¯\(ℓ\):=range⁡\(P¯\(ℓ\)\),\\overline\{P\}^\{\(\\ell\)\}:=G\_\{\\ell\-1\}\\circ P\_\{\\theta\_\{\\ell\}\}\\circ F\_\{\\ell\-1\}=G\_\{\\ell\}\\circ F\_\{\\ell\},\\qquad\\overline\{T\}^\{\(\\ell\)\}:=\\operatorname\{range\}\\bigl\(\\overline\{P\}^\{\(\\ell\)\}\\bigr\),\(25\)where,T¯\(ℓ\)\\overline\{T\}^\{\(\\ell\)\}is the range of the level\-ℓ\\ellreconstruction after decoding it back to the input space\.

Range nesting requires the new stage to remain compatible with the representation inherited from the preceding encoder stack:

Pθℓ​\(range⁡\(Fℓ−1\)\)⊆range⁡\(Fℓ−1\)\.P\_\{\\theta\_\{\\ell\}\}\\left\(\\operatorname\{range\}\(F\_\{\\ell\-1\}\)\\right\)\\subseteq\\operatorname\{range\}\(F\_\{\\ell\-1\}\)\.\(26\)Indeed, Eq\. \([26](https://arxiv.org/html/2609.28832#A2.E26)\) givesT¯\(ℓ\)⊆Gℓ−1​\(range⁡\(Fℓ−1\)\)=T¯\(ℓ−1\)\.\\overline\{T\}^\{\(\\ell\)\}\\subseteq G\_\{\\ell\-1\}\\left\(\\operatorname\{range\}\(F\_\{\\ell\-1\}\)\\right\)=\\overline\{T\}^\{\(\\ell\-1\)\}\.Nominal coverage is preserved if the preceding encoder–decoder stack and the new stage are faithful on𝒰\\mathcal\{U\}, namely,

Gℓ−1​\(Fℓ−1​\(u\)\)=u,Pθℓ​\(Fℓ−1​\(u\)\)=Fℓ−1​\(u\),u∈𝒰\.G\_\{\\ell\-1\}\(F\_\{\\ell\-1\}\(u\)\)=u,\\qquad P\_\{\\theta\_\{\\ell\}\}\(F\_\{\\ell\-1\}\(u\)\)=F\_\{\\ell\-1\}\(u\),\\qquad u\\in\\mathcal\{U\}\.
These conditions implyP¯\(ℓ\)​\(u\)=Gℓ−1​\(Pθℓ​\(Fℓ−1​\(u\)\)\)=u,\\overline\{P\}^\{\(\\ell\)\}\(u\)=G\_\{\\ell\-1\}\\left\(P\_\{\\theta\_\{\\ell\}\}\(F\_\{\\ell\-1\}\(u\)\)\\right\)=u,and hence𝒰⊆T¯\(ℓ\)\\mathcal\{U\}\\subseteq\\overline\{T\}^\{\(\\ell\)\}\. Applying compatibility and nominal fidelity at every level yields

T¯\(1\)⊇T¯\(2\)⊇⋯⊇T¯\(L\)⊇𝒰\.\\overline\{T\}^\{\(1\)\}\\supseteq\\overline\{T\}^\{\(2\)\}\\supseteq\\cdots\\supseteq\\overline\{T\}^\{\(L\)\}\\supseteq\\mathcal\{U\}\.\(27\)

## Appendix CDetailed MNIST ablation study

This appendix provides the complete results supporting the controlled MNIST study in Section[4\.1](https://arxiv.org/html/2609.28832#S4.SS1)\. We consider four nominal\-digit sets and treat all remaining digits as anomalies\. All models use the same ConvAE backbone, with Stage\-0 latent dimension99and Stage\-1 expanded dimension6060\. The ordinary autoencoder objective uses MSE, whereas push–pull uses the Euclidean metric\. For every stageℓ\\ell, the anomaly score is always computed in the input space as

ρ\(ℓ\)​\(s\)=‖s−s^\(ℓ\)‖2,\\rho^\{\(\\ell\)\}\(s\)=\\left\\\|s\-\\widehat\{s\}^\{\(\\ell\)\}\\right\\\|\_\{2\},
wheres^\(ℓ\)\\widehat\{s\}^\{\(\\ell\)\}is the complete reconstruction through that stage\. Stage\-0 and Stage\-1 scores are reported separately; no latent\-space or multistage score fusion is used\. Results are averaged over seeds4242–4646, and F1 uses the9595th percentile of the fit\-split nominal scores as its threshold\.

##### Per\-stage results:

Table[10](https://arxiv.org/html/2609.28832#A3.T10)reports the mean and sample standard deviation of ROC\-AUC and F1 at both stages for every nominal\-digit set and training configuration\.

##### When nested carving contributes:

The benefit of Stage 1 depends on which anomalous directions remain unresolved after Stage 0\. The clearest improvement occurs for the nominal set\{0,2,4,5,6,8,9\}\\\{0,2,4,5,6,8,9\\\}, for which digit11is anomalous\. Without masking or sparsity, AE\+PP increases from0\.7220\.722to0\.8160\.816ROC\-AUC and from0\.4360\.436to0\.4890\.489F1 between Stage 0 and Stage 1\. This behavior is consistent with the geometry in Figure[3](https://arxiv.org/html/2609.28832#S4.F3): digit11can remain close to the Stage\-0 join while lying outside the nominal union, and therefore benefits from additional carving in the latent space\.

When digit11is itself nominal, as in the set\{1,2,5,7,8\}\\\{1,2,5,7,8\\\}, the same configuration changes only from0\.9210\.921to0\.9220\.922ROC\-AUC and from0\.7480\.748to0\.7490\.749F1\. Here, Stage 0 already separates the remaining anomalies effectively, leaving little unresolved off\-union structure for Stage 1 to remove\. Intermediate gains appear for the other two settings in which digit11is anomalous\. With sparsity and no masking, Stage 1 raises ROC\-AUC from0\.8480\.848to0\.8750\.875for nominal digits\{2,3,6,9\}\\\{2,3,6,9\\\}, and from0\.9030\.903to0\.9280\.928for nominal digits\{4,5,7\}\\\{4,5,7\\\}\. These results indicate that nesting is most useful when the preceding stage retains anomaly directions within its learned coarse range, rather than when the first projection has already resolved them\.

##### Masked reconstruction versus push–pull:

Masking alone provides no consistent carving advantage\. For nominal digits\{4,5,7\}\\\{4,5,7\\\}, the unmasked Stage\-0 AE obtains0\.8930\.893ROC\-AUC and0\.7800\.780F1, while masked reconstruction decreases these values to0\.8810\.881and0\.7660\.766\. In contrast, the unmasked AE\+PP reaches0\.8970\.897ROC\-AUC and0\.7920\.792F1 at Stage 0, and nested push–pull further increases them to0\.9090\.909and0\.7980\.798at Stage 1\. The same general pattern appears across the other nominal\-digit sets: push–pull improves over the corresponding AE objective more consistently than masking alone, and its gain can increase when applied recursively\.

Masking can nevertheless complement push–pull when combined with an appropriate nested objective\. For nominal digits\{4,5,7\}\\\{4,5,7\\\}, masked AE\+PP with sparsity reaches0\.9290\.929ROC\-AUC and0\.8150\.815F1 at Stage 1, the best result for this setting\. Thus, the results do not show that masking is intrinsically ineffective\. Rather, masking by itself does not specify which perturbation directions should be excluded, whereas push–pull explicitly separates the reconstruction from the perturbed input while anchoring it to the nominal observation\.

##### Complete structural ablation:

Table[11](https://arxiv.org/html/2609.28832#A3.T11)reorganizes the\{4,5,7\}\\\{4,5,7\\\}results to isolate the effects of hierarchy, push–pull, masking, and sparsity\. A reconstruction\-only nested module leaves performance essentially unchanged because the expanded latent autoencoder admits the identity map and receives no explicit carving signal\. Push–pull supplies this signal, while sparsity and masking act as optional complementary regularizers\. Their effects are not uniformly additive: sparsity strengthens nested push–pull in the\{4,5,7\}\\\{4,5,7\\\}experiment but can reduce performance for other nominal sets\. The principal consistent gain therefore comes from the push–pull objective, with nesting contributing when Stage 0 retains off\-union anomaly directions\.

Table 10:Per\-stage MNIST anomaly\-detection performance\.At each stageℓ\\ell, the anomaly score is the input\-space reconstruction errord⁡\(s,s^\(ℓ\)\)d\(s,\\widehat\{s\}^\{\(\\ell\)\}\), wheres^\(ℓ\)\\widehat\{s\}^\{\(\\ell\)\}is the complete reconstruction through that stage\. No latent\-space or multistage score fusion is used\. Each entry reports the mean±\\pmsample standard deviation over seeds4242–4646\. AE denotes the nominal reconstruction objectiveℒAE\\mathcal\{L\}\_\{\\mathrm\{AE\}\}, while AE\+PP additionally includesλPP​ℒPP\\lambda\_\{\\mathrm\{PP\}\}\\mathcal\{L\}\_\{\\mathrm\{PP\}\}\. The best result within each nominal\-digit set and stage is shown inbold\.Normal digitsAug\.ObjectiveSparseStage 0Stage 1ROC\-AUCF1ROC\-AUCF10,2,4,5,6,8,9maskAE–0\.700±0\.0150\.700\\pm 0\.0150\.401±0\.0380\.401\\pm 0\.0380\.702±0\.0170\.702\\pm 0\.0170\.402±0\.0400\.402\\pm 0\.0400,2,4,5,6,8,9maskAEyes0\.685±0\.0080\.685\\pm 0\.0080\.373±0\.0450\.373\\pm 0\.0450\.688±0\.0120\.688\\pm 0\.0120\.382±0\.0380\.382\\pm 0\.0380,2,4,5,6,8,9maskAE\+PP–0\.711±0\.0110\.711\\pm 0\.0110\.427±0\.0290\.427\\pm 0\.0290\.822±0\.016\\mathbf\{0\.822\\pm 0\.016\}0\.493±0\.0280\.493\\pm 0\.0280,2,4,5,6,8,9maskAE\+PPyes0\.708±0\.0200\.708\\pm 0\.0200\.400±0\.0300\.400\\pm 0\.0300\.782±0\.0240\.782\\pm 0\.0240\.472±0\.0480\.472\\pm 0\.0480,2,4,5,6,8,9noneAE–0\.704±0\.0160\.704\\pm 0\.0160\.410±0\.0320\.410\\pm 0\.0320\.710±0\.0170\.710\\pm 0\.0170\.411±0\.0350\.411\\pm 0\.0350,2,4,5,6,8,9noneAEyes0\.698±0\.0230\.698\\pm 0\.0230\.394±0\.0430\.394\\pm 0\.0430\.704±0\.0230\.704\\pm 0\.0230\.401±0\.0420\.401\\pm 0\.0420,2,4,5,6,8,9noneAE\+PP–0\.722±0\.015\\mathbf\{0\.722\\pm 0\.015\}0\.436±0\.050\\mathbf\{0\.436\\pm 0\.050\}0\.816±0\.0170\.816\\pm 0\.0170\.489±0\.0250\.489\\pm 0\.0250,2,4,5,6,8,9noneAE\+PPyes0\.711±0\.0130\.711\\pm 0\.0130\.417±0\.0490\.417\\pm 0\.0490\.782±0\.0380\.782\\pm 0\.0380\.494±0\.058\\mathbf\{0\.494\\pm 0\.058\}1,2,5,7,8maskAE–0\.900±0\.0020\.900\\pm 0\.0020\.664±0\.0280\.664\\pm 0\.0280\.899±0\.0020\.899\\pm 0\.0020\.660±0\.0310\.660\\pm 0\.0311,2,5,7,8maskAEyes0\.894±0\.0120\.894\\pm 0\.0120\.653±0\.0490\.653\\pm 0\.0490\.895±0\.0110\.895\\pm 0\.0110\.657±0\.0480\.657\\pm 0\.0481,2,5,7,8maskAE\+PP–0\.919±0\.0020\.919\\pm 0\.0020\.731±0\.0120\.731\\pm 0\.0120\.918±0\.0040\.918\\pm 0\.0040\.724±0\.0260\.724\\pm 0\.0261,2,5,7,8maskAE\+PPyes0\.919±0\.0050\.919\\pm 0\.0050\.710±0\.0380\.710\\pm 0\.0380\.918±0\.0060\.918\\pm 0\.0060\.714±0\.0330\.714\\pm 0\.0331,2,5,7,8noneAE–0\.910±0\.0080\.910\\pm 0\.0080\.689±0\.0360\.689\\pm 0\.0360\.911±0\.0080\.911\\pm 0\.0080\.690±0\.0360\.690\\pm 0\.0361,2,5,7,8noneAEyes0\.903±0\.0060\.903\\pm 0\.0060\.672±0\.0410\.672\\pm 0\.0410\.904±0\.0070\.904\\pm 0\.0070\.674±0\.0400\.674\\pm 0\.0401,2,5,7,8noneAE\+PP–0\.921±0\.004\\mathbf\{0\.921\\pm 0\.004\}0\.748±0\.025\\mathbf\{0\.748\\pm 0\.025\}0\.922±0\.003\\mathbf\{0\.922\\pm 0\.003\}0\.749±0\.025\\mathbf\{0\.749\\pm 0\.025\}1,2,5,7,8noneAE\+PPyes0\.919±0\.0030\.919\\pm 0\.0030\.727±0\.0210\.727\\pm 0\.0210\.919±0\.0040\.919\\pm 0\.0040\.738±0\.0260\.738\\pm 0\.0262,3,6,9maskAE–0\.814±0\.0040\.814\\pm 0\.0040\.557±0\.0230\.557\\pm 0\.0230\.815±0\.0030\.815\\pm 0\.0030\.561±0\.0170\.561\\pm 0\.0172,3,6,9maskAEyes0\.823±0\.0030\.823\\pm 0\.0030\.564±0\.0360\.564\\pm 0\.0360\.820±0\.0040\.820\\pm 0\.0040\.572±0\.0360\.572\\pm 0\.0362,3,6,9maskAE\+PP–0\.845±0\.0100\.845\\pm 0\.0100\.613±0\.0250\.613\\pm 0\.0250\.847±0\.0060\.847\\pm 0\.0060\.633±0\.0240\.633\\pm 0\.0242,3,6,9maskAE\+PPyes0\.841±0\.0060\.841\\pm 0\.0060\.600±0\.0340\.600\\pm 0\.0340\.869±0\.0080\.869\\pm 0\.0080\.646±0\.0550\.646\\pm 0\.0552,3,6,9noneAE–0\.829±0\.0090\.829\\pm 0\.0090\.601±0\.0310\.601\\pm 0\.0310\.828±0\.0100\.828\\pm 0\.0100\.603±0\.0290\.603\\pm 0\.0292,3,6,9noneAEyes0\.830±0\.0090\.830\\pm 0\.0090\.580±0\.0330\.580\\pm 0\.0330\.830±0\.0110\.830\\pm 0\.0110\.584±0\.0330\.584\\pm 0\.0332,3,6,9noneAE\+PP–0\.842±0\.0050\.842\\pm 0\.0050\.614±0\.0350\.614\\pm 0\.0350\.850±0\.0080\.850\\pm 0\.0080\.626±0\.0220\.626\\pm 0\.0222,3,6,9noneAE\+PPyes0\.848±0\.003\\mathbf\{0\.848\\pm 0\.003\}0\.626±0\.027\\mathbf\{0\.626\\pm 0\.027\}0\.875±0\.010\\mathbf\{0\.875\\pm 0\.010\}0\.665±0\.036\\mathbf\{0\.665\\pm 0\.036\}4,5,7maskAE–0\.881±0\.0050\.881\\pm 0\.0050\.766±0\.0170\.766\\pm 0\.0170\.882±0\.0030\.882\\pm 0\.0030\.766±0\.0180\.766\\pm 0\.0184,5,7maskAEyes0\.884±0\.0050\.884\\pm 0\.0050\.769±0\.0090\.769\\pm 0\.0090\.886±0\.0050\.886\\pm 0\.0050\.770±0\.0080\.770\\pm 0\.0084,5,7maskAE\+PP–0\.902±0\.0030\.902\\pm 0\.0030\.790±0\.0160\.790\\pm 0\.0160\.913±0\.0020\.913\\pm 0\.0020\.794±0\.0190\.794\\pm 0\.0194,5,7maskAE\+PPyes0\.899±0\.0060\.899\\pm 0\.0060\.788±0\.0180\.788\\pm 0\.0180\.929±0\.007\\mathbf\{0\.929\\pm 0\.007\}0\.815±0\.006\\mathbf\{0\.815\\pm 0\.006\}4,5,7noneAE–0\.893±0\.0080\.893\\pm 0\.0080\.780±0\.0120\.780\\pm 0\.0120\.893±0\.0080\.893\\pm 0\.0080\.780±0\.0110\.780\\pm 0\.0114,5,7noneAEyes0\.890±0\.0110\.890\\pm 0\.0110\.772±0\.0120\.772\\pm 0\.0120\.889±0\.0110\.889\\pm 0\.0110\.772±0\.0090\.772\\pm 0\.0094,5,7noneAE\+PP–0\.897±0\.0040\.897\\pm 0\.0040\.792±0\.0080\.792\\pm 0\.0080\.909±0\.0080\.909\\pm 0\.0080\.798±0\.0100\.798\\pm 0\.0104,5,7noneAE\+PPyes0\.903±0\.004\\mathbf\{0\.903\\pm 0\.004\}0\.793±0\.011\\mathbf\{0\.793\\pm 0\.011\}0\.928±0\.0040\.928\\pm 0\.0040\.808±0\.0290\.808\\pm 0\.029Table 11:Full factorial ablation on MNIST with nominal digits4,5,74,5,7\.The first row reproduces the two\-dimensional autoencoder baseline of[Bouman and Heskes \(2025\)](https://arxiv.org/html/2609.28832#bib.bib23)\. Rows without a hierarchy tick use the Stage\-0 reconstruction score; ticked rows use the complete Stage\-1 reconstruction decoded to the input space\. Values are means over different seeds\. Best results are shown inboldand second\-best results areunderlined\.Normal digitsHierarchyPushMaskSparsityF1ROC\-AUCPR\-AUClevelpullBaseline \(4,5,7\)0\.6930\.8660\.9364,5,70\.7800\.8930\.9624,5,7✓0\.7800\.8930\.9624,5,7✓0\.7720\.8900\.9604,5,7✓✓0\.7720\.8890\.9604,5,7✓0\.7920\.8970\.9634,5,7✓✓0\.7980\.9090\.9674,5,7✓✓0\.7930\.9030\.9654,5,7✓✓✓0\.8080\.9280\.9724,5,7✓0\.7660\.8810\.9574,5,7✓✓0\.7660\.8820\.9574,5,7✓✓0\.7690\.8840\.9584,5,7✓✓✓0\.7700\.8860\.9594,5,7✓✓0\.7900\.9020\.9654,5,7✓✓✓0\.7940\.9130\.9684,5,7✓✓✓0\.7880\.8990\.9644,5,7✓✓✓✓0\.8150\.9290\.973Table 12:Matched comparison of reconstruction, denoising, and Push and Pull on MNIST with nominal digits4,5,74,5,7\. Masking and sparsity are disabled to isolate the training objective\. Stage 1 uses the complete nested reconstruction decoded to input space, without score fusion\.ObjectiveStageF1ROC\-AUCPR\-AUCAE00\.7800\.8930\.962AE10\.7800\.8930\.962DAE00\.7830\.8950\.962DAE10\.7830\.8950\.962AE with Push and Pull00\.7920\.8970\.963AE with Push and Pull10\.7980\.9090\.967
##### Denoising versus Push and Pull:

A denoising autoencoder \(DAE\) receives a perturbed nominal samples~n=sn\+e\\widetilde\{s\}\_\{n\}=s\_\{n\}\+eand learns to reconstruct its clean counterpartsns\_\{n\}\. This corresponds to retaining only the Pull term\. Indeed, settingα=0\\alpha=0gives

ℒPP=d⁡\(s^n,sn\)\+\[−d⁡\(s^n,s~n\)\]\+=d⁡\(s^n,sn\),\\mathcal\{L\}\_\{\\mathrm\{PP\}\}=d\(\\widehat\{s\}\_\{n\},s\_\{n\}\)\+\\bigl\[\-d\(\\widehat\{s\}\_\{n\},\\widetilde\{s\}\_\{n\}\)\\bigr\]\_\{\+\}=d\(\\widehat\{s\}\_\{n\},s\_\{n\}\),which is the DAE objective, up to whether the reconstruction discrepancy is implemented as Euclidean distance or its square\. The comparison in Table[12](https://arxiv.org/html/2609.28832#A3.T12)therefore isolates the contribution of the positive Push margin from ordinary denoising\. DAE changes the Stage 0 results only marginally relative to AE, from0\.7800\.780to0\.7830\.783F1 and from0\.8930\.893to0\.8950\.895ROC\-AUC, and its Stage 1 results remain unchanged\. In contrast, Push and Pull reaches0\.7920\.792F1 and0\.8970\.897ROC\-AUC at Stage 0, followed by0\.7980\.798F1 and0\.9090\.909ROC\-AUC after nested carving\. This behavior agrees with Lemma 1 and Figure[2](https://arxiv.org/html/2609.28832#S3.F2)\. In the ideal casesn∈𝒰s\_\{n\}\\in\\mathcal\{U\}, Pull can recoversns\_\{n\}, and forα≤1\\alpha\\leq 1the Push hinge is inactive at that optimum, although it can still supply a gradient while the margin is violated during learning\. For realistic nominal data lying near rather than exactly on𝒰\\mathcal\{U\}, Pull alone only attracts the reconstruction towardsns\_\{n\}, whereas a positive Push margin additionally requires separation froms~n\\widetilde\{s\}\_\{n\}\. The table consequently indicates that exposure to perturbations through denoising is insufficient to explain the observed gain; the explicit separation constraint contributes additional carving, particularly when it is applied at the nested stage\.

### C\.1Geometric contribution of nested latent carving

Aggregate detection metrics show whether Stage 1 improves performance, but not which geometric cases produce that improvement\. We therefore examine the image and latent reconstruction errors separately for each digit\. This provides a direct empirical test of the geometry proposed in Figure[3](https://arxiv.org/html/2609.28832#S4.F3)and of the representation dynamics described in Section[4\.2](https://arxiv.org/html/2609.28832#S4.SS2)\.

LetTinT\_\{\\mathrm\{in\}\}denote the frozen Stage 0 encoder, let the nested module mapxxtox^\\widehat\{x\}, and letToutT\_\{\\mathrm\{out\}\}denote the complete decoder\. For an input imagess,

x=Tin​\(s\),x^=Tnested​\(x\),s^=Tout​\(x^\)\.x=T\_\{\\mathrm\{in\}\}\(s\),\\qquad\\widehat\{x\}=T\_\{\\mathrm\{nested\}\}\(x\),\\qquad\\widehat\{s\}=T\_\{\\mathrm\{out\}\}\(\\widehat\{x\}\)\.We measure the change made by the complete model in the image domain and the change made specifically by Stage 1 in the Stage 0 latent space:

erec​\(s\)\\displaystyle e^\{\\mathrm\{rec\}\}\(s\)=1\|s\|​‖s^−s‖22,\\displaystyle=\\frac\{1\}\{\|s\|\}\\left\\\|\\widehat\{s\}\-s\\right\\\|\_\{2\}^\{2\},image reconstruction error,\\displaystyle\\text\{image reconstruction error\},\(28\)esub​\(s\)\\displaystyle e^\{\\mathrm\{sub\}\}\(s\)=1\|x\|​‖x^−x‖22,\\displaystyle=\\frac\{1\}\{\|x\|\}\\left\\\|\\widehat\{x\}\-x\\right\\\|\_\{2\}^\{2\},latent reconstruction error\.\\displaystyle\\text\{latent reconstruction error\}\.\(29\)Each quantity is computed per image by averaging over its elements\. No averaging across images or batches is used\. The latent error is introduced only for this diagnostic analysis\. The principal results in the main paper continue to use the complete input space reconstruction score without score fusion\.

The two errors distinguish the geometric cases illustrated in Figure[3](https://arxiv.org/html/2609.28832#S4.F3)\. If the anomalous component ofsslies largely outside the coarse Stage 0 range𝒱\\mathcal\{V\}, Stage 0 removes it beforexxis formed\. The resulting latent representation can therefore already resemble a nominal representation, giving a large image error but a small Stage 1 latent error\. Digit88is the clearest example of this case: its anomalous direction lies predominantly outside the learned Stage 0 range, and its retained representation becomes close to that of nominal digit55\. By contrast, an anomaly lying inside𝒱∖𝒰\\mathcal\{V\}\\setminus\\mathcal\{U\}can be reconstructed well at Stage 0 and remain difficult to detect in the image domain\. Its retained off\-union direction is still present inxx, however, allowing Stage 1 to carve it and produce a large discrepancy betweenxxandx^\\widehat\{x\}\. Figure[3](https://arxiv.org/html/2609.28832#S4.F3)predicts digit11as the representative case\.

To quantify this complementarity, we calibrate one threshold for each score using a held out set𝒟fit\\mathcal\{D\}\_\{\\mathrm\{fit\}\}ofnfit=435n\_\{\\mathrm\{fit\}\}=435nominal images that are used neither for training nor for evaluation\. Forc∈\{rec,sub\}c\\in\\\{\\mathrm\{rec\},\\mathrm\{sub\}\\\}, lettc​\(q\)t\_\{c\}\(q\)be theqqth percentile of scoreccon𝒟fit\\mathcal\{D\}\_\{\\mathrm\{fit\}\}\. Define

A\(s\)=\[erec\(s\)\>trec\(q\)\],B\(s\)=\[esub\(s\)\>tsub\(q\)\]\.A\(s\)=\\left\[e^\{\\mathrm\{rec\}\}\(s\)\>t\_\{\\mathrm\{rec\}\}\(q\)\\right\],\\qquad B\(s\)=\\left\[e^\{\\mathrm\{sub\}\}\(s\)\>t\_\{\\mathrm\{sub\}\}\(q\)\\right\]\.For this auxiliary analysis, an image is flagged when either channel fires:

flag⁡\(s\)=A⁡\(s\)∨B⁡\(s\)\.\\operatorname\{flag\}\(s\)=A\(s\)\\lor B\(s\)\.\(30\)Because Eq\. \([30](https://arxiv.org/html/2609.28832#A3.E30)\) combines two tests, assigning the9595th percentile independently to both channels would produce a joint false positive rate above5%5\\%\. We therefore select a common percentileq⋆q^\{\\star\}on𝒟fit\\mathcal\{D\}\_\{\\mathrm\{fit\}\}such that the combined rule has an approximately5%5\\%false positive rate\. Across the evaluated runs,q⋆∈\[97\.0,97\.5\]q^\{\\star\}\\in\[97\.0,97\.5\], producing realized rates between0\.0460\.046and0\.0510\.051\.

For each digit, Table[13](https://arxiv.org/html/2609.28832#A3.T13)reports the marginal firing probabilitiesPr⁡\(A\)\\Pr\(A\)andPr⁡\(B\)\\Pr\(B\), together with the disjoint outcomes

A∧¬B,¬A∧B,¬A∧¬B\.A\\land\\neg B,\\qquad\\neg A\\land B,\\qquad\\neg A\\land\\neg B\.The unreported intersection can be recovered as

Pr⁡\(A∧B\)=Pr⁡\(A\)−Pr⁡\(A∧¬B\)=Pr⁡\(B\)−Pr⁡\(¬A∧B\)\.\\Pr\(A\\land B\)=\\Pr\(A\)\-\\Pr\(A\\land\\neg B\)=\\Pr\(B\)\-\\Pr\(\\neg A\\land B\)\.We additionally report

rlatent=Pr⁡\(¬A∧B\)Pr⁡\(A∨B\),r\_\{\\mathrm\{latent\}\}=\\frac\{\\Pr\(\\neg A\\land B\)\}\{\\Pr\(A\\lor B\)\},\(31\)which measures the fraction of detected samples that would be lost if only the image reconstruction score were retained\.

Table 13:Per\-image flag decomposition of the two\-channel or\-rule\. Entries are fractions of test images, with thresholds calibrated on held\-out nominal images to a joint5%5\\%false\-positive rate \(q≈97q\\approx 97\)\. Results are mean±\\pmstandard deviation over 12 runs\. Nominal digits are the negative class; hence, their detection share is undefined\.Channel firesDisjoint outcomesDigitRoleRecon\.Subsp\.Recon\.onlySubsp\.onlyNeitherSubsp\.\-onlyshare of det\.0anomaly0\.952±0\.0440\.952\{\\pm\}0\.0440\.325±0\.1130\.325\{\\pm\}0\.1130\.632±0\.1270\.632\{\\pm\}0\.1270\.006±0\.0080\.006\{\\pm\}0\.0080\.042±0\.0380\.042\{\\pm\}0\.0380\.6%0\.6\\%1anomaly0\.123±0\.094\\mathbf\{0\.123\{\\pm\}0\.094\}0\.576±0\.137\\mathbf\{0\.576\{\\pm\}0\.137\}0\.028±0\.0150\.028\{\\pm\}0\.0150\.481±0\.101\\mathbf\{0\.481\{\\pm\}0\.101\}0\.396±0\.1260\.396\{\\pm\}0\.12680\.8%\\mathbf\{80\.8\\%\}2anomaly0\.965±0\.0080\.965\{\\pm\}0\.0080\.444±0\.0980\.444\{\\pm\}0\.0980\.531±0\.0990\.531\{\\pm\}0\.0990\.010±0\.0050\.010\{\\pm\}0\.0050\.024±0\.0050\.024\{\\pm\}0\.0051\.1%1\.1\\%3anomaly0\.827±0\.0330\.827\{\\pm\}0\.0330\.129±0\.0770\.129\{\\pm\}0\.0770\.705±0\.0930\.705\{\\pm\}0\.0930\.008±0\.0040\.008\{\\pm\}0\.0040\.165±0\.0300\.165\{\\pm\}0\.0300\.9%0\.9\\%6anomaly0\.581±0\.0620\.581\{\\pm\}0\.0620\.388±0\.0800\.388\{\\pm\}0\.0800\.249±0\.0810\.249\{\\pm\}0\.0810\.056±0\.0310\.056\{\\pm\}0\.0310\.364±0\.0500\.364\{\\pm\}0\.0508\.8%8\.8\\%8anomaly0\.876±0\.0310\.876\{\\pm\}0\.0310\.124±0\.1050\.124\{\\pm\}0\.1050\.758±0\.1060\.758\{\\pm\}0\.1060\.006±0\.0080\.006\{\\pm\}0\.0080\.117±0\.0320\.117\{\\pm\}0\.0320\.7%0\.7\\%9anomaly0\.101±0\.0140\.101\{\\pm\}0\.0140\.049±0\.0260\.049\{\\pm\}0\.0260\.081±0\.0200\.081\{\\pm\}0\.0200\.030±0\.0170\.030\{\\pm\}0\.0170\.870±0\.0230\.870\{\\pm\}0\.02321\.6%21\.6\\%4nominal0\.017±0\.0040\.017\{\\pm\}0\.0040\.026±0\.0080\.026\{\\pm\}0\.0080\.012±0\.0030\.012\{\\pm\}0\.0030\.021±0\.0080\.021\{\\pm\}0\.0080\.962±0\.0090\.962\{\\pm\}0\.009—5nominal0\.050±0\.0110\.050\{\\pm\}0\.0110\.049±0\.0130\.049\{\\pm\}0\.0130\.034±0\.0090\.034\{\\pm\}0\.0090\.033±0\.0070\.033\{\\pm\}0\.0070\.917±0\.0150\.917\{\\pm\}0\.015—7nominal0\.023±0\.0050\.023\{\\pm\}0\.0050\.034±0\.0080\.034\{\\pm\}0\.0080\.016±0\.0020\.016\{\\pm\}0\.0020\.027±0\.0060\.027\{\\pm\}0\.0060\.950±0\.0070\.950\{\\pm\}0\.007—

The per digit decomposition closely matches the proposed geometry\. For digit88, the image channel fires for87\.6%87\.6\\%of samples, whereas the latent channel fires for only12\.4%12\.4\\%, and only0\.6%0\.6\\%of its detections depend exclusively on the latent score\. Thus, most of the anomalous information in digit88is removed before Stage 1, leaving a Stage 0 representation that the nested module changes little\. This supports the first case in Figure[3](https://arxiv.org/html/2609.28832#S4.F3): an anomaly outside the coarse range is detected through its large image reconstruction error, but its removed directions are unavailable to deeper latent processing\.

Digit11exhibits the opposite behavior\. The image channel fires for only12\.3%12\.3\\%of its samples, consistent with digit11lying close to the coarse range𝒱\\mathcal\{V\}and therefore remaining a Stage 0 blind case\. The latent channel fires for57\.6%57\.6\\%, with48\.1%48\.1\\%of all digit11samples detected exclusively in the latent space\. Consequently,80\.8%80\.8\\%of the detected digit11samples would be missed without the Stage 1 latent score\. This result supports the second geometric case: Stage 0 retains the digit11direction inside its coarse range, while Stage 1 differentiates it from the compact nominal union\.

The reconstructions in Figure[5](https://arxiv.org/html/2609.28832#A3.F5)provide complementary visual evidence\. After nested carving, digit11no longer preserves its original structure and frequently becomes77\-like, with some reconstructions remaining visually ambiguous between77and99\. The77\-like cases are consistent with the predicted representation dynamics: as the learned range becomes more compact, an off\-union anomaly is moved toward a nearby nominal component\. The experiment therefore does more than show an aggregate benefit from nesting\. It identifies the anomalies removed before the latent stage, the anomalies exposed by latent carving, and the loss of anomalous information after projection\. This agreement between the predicted geometry, the latent discrepancies, and the reconstructed images demonstrates the explanatory value of the PoS based geometric framework\.

![Refer to caption](https://arxiv.org/html/2609.28832v1/digit_projection.png)Figure 5:Representative reconstructions at successive stages\. Anomalous directions removed at Stage 0 cannot be recovered from the Stage 0 latent representation\. Digit11, which remains inside the coarse Stage 0 range, is modified by nested carving and frequently becomes77\-like, consistent with projection toward a nearby nominal component\.

## Appendix DMetrics

The following metrics in this section are mainly introduced to provide additional quantitative information regarding the claims that have been asserted throughout the paper\. It should be noted that all introduced metrics are always taken betweenxxandx^\\hat\{x\}which are the outputs of the frozen encoder and the outputs of the subspace, namely the network in between the frozen encoder decoder pair, respectively\. Before any metric is computed, both spaces are standardised per dimension using the mean and the standard deviation of the normalxxsamples \(withε=10−8\\varepsilon=10^\{\-8\}added to the standard deviation and this value is used everywhere\), so that the same map is applied toxxandx^\\hat\{x\}\. All metrics are computed in the full latent space and since the results are a comparison of the results taken from two latent spaces having the same dimension, their difference is calculated using the relative change, for any scalar quantityQQ, as following,

ΔQ=100⋅Qx^−QxQx\+ε\[%\]\\Delta Q\\;=\\;100\\cdot\\frac\{Q\_\{\\hat\{x\}\}\-Q\_\{x\}\}\{Q\_\{x\}\+\\varepsilon\}\\quad\[\\%\]
Table 14:Do the normal classes separate from one another?Every column is a relative change fromxxtox^\\hat\{x\}\.D¯inter\\bar\{D\}\_\{\\text\{inter\}\}is how far apart the classes sit;S¯intra\\bar\{S\}\_\{\\text\{intra\}\}is how wide the classes are;S=D¯inter/S¯intraS=\\bar\{D\}\_\{\\text\{inter\}\}/\\bar\{S\}\_\{\\text\{intra\}\}combines the two into a single separation score, so it can rise either because the classes move apart or because they contract in place\. Under PushPull the rise inSSis driven byS¯intra\\bar\{S\}\_\{\\text\{intra\}\}falling by roughly88–10%10\\%whileD¯inter\\bar\{D\}\_\{\\text\{inter\}\}also falls, only more slowly\. MSE leaves all three unchanged\. The arrow marks the direction of improvement, the best value isboldand the second best isunderlined\.normal setmasklosssparsityΔ​S↑\\Delta S\\ \\uparrowΔ​D¯inter\\Delta\\bar\{D\}\_\{\\text\{inter\}\}Δ​S¯intra\\Delta\\bar\{S\}\_\{\\text\{intra\}\}\(%\)\(%\)\(%\)\{4,5,7\}\\\{4,5,7\\\}noneMSE–\+0\.1\+0\.0\-0\.0noneMSEyes\-0\.2\-0\.1\+0\.1maskMSE–\-0\.1\+0\.0\+0\.1maskMSEyes\-0\.8\-0\.9\-0\.1nonePP–\+7\.6\-3\.1\-10\.0nonePPyes\+2\.6\-0\.4\-3\.0maskPP–\+7\.7\-2\.0\-9\.0maskPPyes\+3\.5\-0\.9\-4\.3\{2,3,6,9\}\\\{2,3,6,9\\\}noneMSE–\+0\.2\+0\.0\-0\.2noneMSEyes\-0\.4\+0\.4\+0\.8maskMSE–\-0\.3\-0\.2\+0\.1maskMSEyes\-0\.8\-1\.1\-0\.3nonePP–\+5\.2\-4\.0\-8\.7nonePPyes\+1\.9\-2\.8\-4\.6maskPP–\+7\.2\-1\.9\-8\.5maskPPyes\+1\.8\-1\.2\-2\.9\{1,2,5,7,8\}\\\{1,2,5,7,8\\\}noneMSE–\-0\.1\+0\.2\+0\.3noneMSEyes\+0\.0\+0\.8\+0\.8maskMSE–\+0\.1\-0\.2\-0\.4maskMSEyes\-0\.1\-1\.6\-1\.5nonePP–\+5\.4\-2\.9\-7\.9nonePPyes\+1\.9\-0\.9\-2\.7maskPP–\+5\.3\-2\.7\-7\.6maskPPyes\+1\.4\-0\.1\-1\.5\{0,2,4,5,6,8,9\}\\\{0,2,4,5,6,8,9\\\}noneMSE–\+0\.3\-0\.0\-0\.3noneMSEyes\+0\.7\-0\.0\-0\.7maskMSE–\+0\.1\-0\.0\-0\.1maskMSEyes\+0\.1\-1\.3\-1\.5nonePP–\+6\.5\-2\.0\-8\.0nonePPyes\+1\.6\-0\.7\-2\.3maskPP–\+7\.3\-1\.7\-8\.3maskPPyes\+0\.7\-0\.4\-1\.1Table 15:Do the anomalies move into the normal clusters?All columns are relative changes fromxxtox^\\hat\{x\}, and all are built from the same quantityd⁡\(a\)d\(a\), the distance from an anomalous point to its nearest normal centroid\.Δ​dsamp\\Delta d\_\{\\text\{samp\}\}is the median ofd⁡\(a\)d\(a\)over all anomalous points, whileΔ​dpool\\Delta d\_\{\\text\{pool\}\}takes the median within each anomaly class and then the median across classes\.Δ​IC\\Delta\\mathrm\{IC\}reports whether the anomalies approached faster than the space itself contracted\.Δ​ρ\\Delta\\rhodivides instead by the radius of each point’s own nearest cluster\. The arrows mark the direction of improvement, and the best value in each column is set in bold and the second best isunderlined\.normal setmasklosssparsityΔ​dsamp↓\\Delta d\_\{\\text\{samp\}\}\\ \\downarrowΔ​dpool↓\\Delta d\_\{\\text\{pool\}\}\\ \\downarrowΔ​IC↓\\Delta\\mathrm\{IC\}\\ \\downarrowΔ​ρ↓\\Delta\\rho\\ \\downarrow\(%\)\(%\)\(%\)\(%\)\{4,5,7\}\\\{4,5,7\\\}noneMSE–\-0\.4\-0\.1\-0\.5\-0\.1noneMSEyes\-0\.5\-0\.3\-0\.4\-0\.6maskMSE–\-1\.0\-0\.8\-1\.0\-0\.6maskMSEyes\-1\.1\-1\.7\-0\.2\-1\.0nonePP–\-12\.4\-15\.3\-9\.6\-2\.2nonePPyes\-12\.1\-13\.4\-11\.8\-9\.2maskPP–\-11\.9\-12\.7\-10\.1\-3\.3maskPPyes\-15\.5\-14\.8\-14\.7\-10\.4\{2,3,6,9\}\\\{2,3,6,9\\\}noneMSE–\-0\.7\-1\.1\-0\.8\-0\.7noneMSEyes\-1\.0\-1\.4\-1\.4\-2\.3maskMSE–\-0\.8\-1\.6\-0\.5\-0\.9maskMSEyes\-2\.4\-2\.5\-1\.3\-2\.6nonePP–\-15\.3\-19\.7\-11\.8\-7\.2nonePPyes\-18\.1\-20\.6\-15\.7\-13\.0maskPP–\-12\.7\-15\.7\-11\.1\-3\.9maskPPyes\-13\.6\-14\.1\-12\.6\-8\.7\{1,2,5,7,8\}\\\{1,2,5,7,8\\\}noneMSE–\-0\.1\-0\.2\-0\.3\-0\.3noneMSEyes\-0\.3\-1\.0\-1\.1\-1\.2maskMSE–\-0\.3\-0\.4\-0\.1\-0\.3maskMSEyes\-2\.7\-2\.5\-1\.1\-2\.3nonePP–\-11\.7\-12\.0\-9\.0\-6\.3nonePPyes\-5\.2\-2\.3\-4\.3\-3\.5maskPP–\-9\.9\-11\.1\-7\.4\-3\.1maskPPyes\-2\.4\-1\.2\-2\.2\-2\.0\{0,2,4,5,6,8,9\}\\\{0,2,4,5,6,8,9\\\}noneMSE–\-0\.4\-0\.1\-0\.3\-0\.6noneMSEyes\+1\.0\+1\.9\+1\.0\+0\.8maskMSE–\-0\.9\+0\.1\-0\.8\-0\.8maskMSEyes\-2\.4\-1\.1\-1\.1\-1\.2nonePP–\-21\.0\-17\.1\-19\.4\-8\.8nonePPyes\-10\.8\-13\.2\-10\.1\-5\.7maskPP–\-20\.0\-15\.1\-18\.6\-11\.1maskPPyes\-8\.7\-9\.3\-8\.3\-6\.9Additionally, there exists some commonly used quantities in all the metrics, namely the center of the normal clusters and their radii\. Letz∈\{x,x^\}z\\in\\\{x,\\hat\{x\}\\\}index the two spaces mentioned above, and writeziz\_\{i\}for the representation of pointiiin that space\. The normal classes arec∈𝒞c\\in\\mathcal\{C\}withK=\|𝒞\|K=\|\\mathcal\{C\}\|and index setsℋc\\mathcal\{H\}\_\{c\}, which are the same in both spaces, and the anomalies area∈𝒜a\\in\\mathcal\{A\}\. The anomaly classes areb∈ℬb\\in\\mathcal\{B\}withM=\|ℬ\|M=\|\\mathcal\{B\}\|and index sets𝒜b\\mathcal\{A\}\_\{b\}, again the same in both spaces\. For each normal classc∈𝒞c\\in\\mathcal\{C\}, we, first, get the center points and the radii of the formed clusters in the latent space according to their labels\. The centers of the normal clusters, denoted asμcz\\mu\_\{c\}^\{z\}, are calculated by taking the means of these points, and the radii, denoted asRczR\_\{c\}^\{z\}, are calculated by taking the distance of each point in the class to the center and averaging over the class, i\.e\.,

μcz=1\|ℋc\|​∑i∈ℋczi,Rcz=1\|ℋc\|​∑i∈ℋc‖zi−μcz‖\\mu\_\{c\}^\{z\}=\\frac\{1\}\{\|\\mathcal\{H\}\_\{c\}\|\}\\sum\_\{i\\in\\mathcal\{H\}\_\{c\}\}z\_\{i\},\\qquad R\_\{c\}^\{z\}=\\frac\{1\}\{\|\\mathcal\{H\}\_\{c\}\|\}\\sum\_\{i\\in\\mathcal\{H\}\_\{c\}\}\\bigl\\\|z\_\{i\}\-\\mu\_\{c\}^\{z\}\\bigr\\\|\(32\)where∥⋅∥=∥⋅∥2\\\|\\cdot\\\|=\\\|\\cdot\\\|\_\{2\}for all cases\.

### D\.1Separation Ratio

To quantify the possible separation in between the normal clusters, we have used a metric we call the Separation Ratio,SzS^\{z\}\. This metric is calculated by taking the means of the inter\-distances of the normal clustersD¯interz\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}and dividing the result by the mean of the radii of all normal clustersR¯z\\bar\{R\}^\{z\}\. The relevant equations are as follows

D¯interz=\(K2\)−1​∑c,c′∈𝒞c<c′‖μcz−μc′z‖,R¯z=1K​∑c∈𝒞Rcz,Sz=D¯interzR¯z\+ε,\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}=\\binom\{K\}\{2\}^\{\-1\}\\\!\\\!\\sum\_\{\\begin\{subarray\}\{c\}c,c^\{\\prime\}\\in\\mathcal\{C\}\\\\ c<c^\{\\prime\}\\end\{subarray\}\}\\\!\\bigl\\\|\\mu\_\{c\}^\{z\}\-\\mu\_\{c^\{\\prime\}\}^\{z\}\\bigr\\\|,\\qquad\\bar\{R\}^\{z\}=\\frac\{1\}\{K\}\\sum\_\{c\\in\\mathcal\{C\}\}R\_\{c\}^\{z\},\\qquad S^\{z\}=\\frac\{\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}\}\{\\bar\{R\}^\{z\}\+\\varepsilon\},\(33\)whereε=10−8\\varepsilon=10^\{\-8\}\. The division byR¯z\\bar\{R\}^\{z\}makesSzS^\{z\}invariant to a uniform rescaling of the latent space\. What it does*not*do is isolate separation from compactness\.SzS^\{z\}rises wheneverD¯interz\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}grows relative toR¯z\\bar\{R\}^\{z\}, which happens both when the normal classes move apart and when they contract in place\. So we reportD¯interz\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}andR¯z\\bar\{R\}^\{z\}separately in the results, and readSzS^\{z\}as a statement about the relative movement of these two terms\. For observing shrinkage in normal clusters, we expect theR¯z\\bar\{R\}^\{z\}to be negative, and for normal clusters moving out, we expectD¯interz\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}to be positive, and as the combination of both of these metrics we expect absolute ofSzS^\{z\}to be a high number indicating a separation\.

### D\.2Proximity Ratio

As for showing the predicted behavior of the anomalous data approach to the normal clusters in latent space, we have used another metric called Proximity Ratio denoted asρz\\rho^\{z\}\. For an anomalous pointaa, letc∗=arg⁡minc∈𝒞​‖a−μcz‖c^\{\*\}=\\arg\\min\_\{c\\in\\mathcal\{C\}\}\\\|a\-\\mu\_\{c\}^\{z\}\\\|be its closest normal cluster anddz​\(a\)d^\{z\}\(a\)the distance to that cluster’s center\. The score is then the median, over the anomalous points, ofdz​\(a\)d^\{z\}\(a\)divided by the radius of that closest cluster:

dz​\(a\)=‖a−μc∗z‖,ρz=meda∈𝒜dz​\(a\)Rc∗z\+ε\.d^\{z\}\(a\)=\\bigl\\\|a\-\\mu\_\{c^\{\*\}\}^\{z\}\\bigr\\\|,\\qquad\\rho^\{z\}=\\operatorname\*\{med\}\_\{a\\in\\mathcal\{A\}\}\\frac\{d^\{z\}\(a\)\}\{R^\{z\}\_\{c^\{\*\}\}\+\\varepsilon\}\.\(34\)Note that the denominator here is not a single constant per space:Rc∗zR^\{z\}\_\{c^\{\*\}\}depends on which cluster is closest and therefore varies from one anomalous point to the next\. This metric basically tells us whether the anomalies move faster toward the normal clusters than the rate of shrinkage of their closest normal clusters\. This, along withΔ​d\\Delta dcolumns can tell us whether the anomaly points are actually approaching to the normal cluster, and gives the rate of the approaching behavior\.

But since this metric is susceptible to the behavior of the normal cluster as well \-a shrink in the normal cluster can be interpreted as the anomalies moving away, inaccurately\- we have devised some other ways to understand the behavior of the anomalous data\. Firstly, we report the relative change of the median ofdzd^\{z\}itself, taken over all anomalous points at once, indicated asΔ​dsamp\\Delta d\_\{\\text\{samp\}\}\. Since the anomaly classes are not equally sized, we then take the median within each anomaly class and the median across those class values, indicated asΔ​dpool\\Delta d\_\{\\text\{pool\}\}, so that no single class dominates the number,

dsampz=meda∈𝒜dz​\(a\),dpoolz=medb∈ℬ\(meda∈𝒜bdz​\(a\)\)\.d^\{z\}\_\{\\text\{samp\}\}=\\operatorname\*\{med\}\_\{a\\in\\mathcal\{A\}\}d^\{z\}\(a\),\\qquad d^\{z\}\_\{\\text\{pool\}\}=\\operatorname\*\{med\}\_\{b\\in\\mathcal\{B\}\}\\;\\Bigl\(\\operatorname\*\{med\}\_\{a\\in\\mathcal\{A\}\_\{b\}\}d^\{z\}\(a\)\\Bigr\)\.\(35\)What the pair of them diagnoses is the effect of the class sizes:dsampzd^\{z\}\_\{\\text\{samp\}\}lets the larger anomaly classes weigh more, whiledpoolzd^\{z\}\_\{\\text\{pool\}\}does not\. It should be noted that withMMsmall and odd the outer median selects one class value rather than combining them, sodpoolzd^\{z\}\_\{\\text\{pool\}\}can coincide with a single anomaly class throughout\.

And lastly, we report a second normalised score, in whichdz​\(a\)d^\{z\}\(a\)is divided by the mean inter\-normal\-centroid distanceD¯interz\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}rather than by a cluster radius\. Unlike the denominator ofρz\\rho^\{z\}, this one is a single constant per space and is independent of which cluster is closest, so it acts as a scale reference:ICz\\mathrm\{IC\}^\{z\}is unchanged under a uniform rescaling of the latent space and asks whether the anomalies approached the normal classes faster than the space as a whole contracted\.

ICz=meda∈𝒜dz​\(a\)D¯interz\+ε\.\\mathrm\{IC\}^\{z\}=\\operatorname\*\{med\}\_\{a\\in\\mathcal\{A\}\}\\frac\{d^\{z\}\(a\)\}\{\\bar\{D\}\_\{\\text\{inter\}\}^\{z\}\+\\varepsilon\}\.\(36\)
The expectation fromρz\\rho^\{z\}andICz\\mathrm\{IC\}^\{z\}is for them to drop to show an approaching behavior of the anomalous data to their closest overall normal cluster, and thus theΔ​ρ\\Delta\\rhoandΔ​IC\\Delta\\mathrm\{IC\}results are expected to be negative\.

## Appendix EStandard One\-Class Anomaly Detection

This section gives the protocol, competing methods, implementation details, and ablations for the experiments in Section[4\.3](https://arxiv.org/html/2609.28832#S4.SS3)\. It also reports the class\-wise results omitted from the main paper\.

### E\.1Benchmarks and protocol

We use MNIST\([Deng, 2012](https://arxiv.org/html/2609.28832#bib.bib47)\), Fashion\-MNIST\([Xiao et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib48)\), CIFAR\-10 and CIFAR\-100\([Krizhevsky, 2009](https://arxiv.org/html/2609.28832#bib.bib49)\), and Arrhythmia\([Guvenir et al\., 1997](https://arxiv.org/html/2609.28832#bib.bib50)\)\. MNIST, Fashion\-MNIST, and CIFAR\-10 define ten one\-class problems, one for each nominal class\. CIFAR\-100 defines twenty problems using its coarse superclasses\. Arrhythmia defines one problem; following[Ghafourian et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib46), classes 3, 4, 5, 7, 8, 9, 14, and 15 are anomalous and the remaining classes are nominal\.

For each image problem, the training split is restricted to the nominal class\. The validation and test splits retain all classes and are relabelled as nominal or anomalous\. We use ten seeds for each nominal class\. A seed controls model initialisation and stochastic operations but does not change the data split\. Validation is performed every 20 iterations, and the reported value is the test score at the checkpoint selected on the corresponding validation metric\. We use AUC\-ROC for the image datasets\. For Arrhythmia, the 15% of test samples with the highest anomaly scores are labelled anomalous before computingF1F\_\{1\}, as in[Ghafourian et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib46)\. Class\-wise results are means and standard deviations over seeds; dataset averages are unweighted means over nominal classes\.

MNIST and Fashion\-MNIST inputs are standardised to zero mean and unit variance\. CIFAR\-10 and CIFAR\-100 use global contrast normalisation with theℓ1\\ell\_\{1\}norm, followed by min–max scaling to\[0,1\]\[0,1\], as in[Ghafourian et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib46)\. No anomalous sample is used for training\. Table[16](https://arxiv.org/html/2609.28832#A5.T16)summarises the data used before restricting the training pool to a nominal class\.

Table 16:One\-class benchmark statistics\. For the image datasets, the training count denotes the full pool before restriction to the nominal class\. All our variants and seeds use the same fixed splits\.DatasetTrainingpoolValidationTestInputshapeProblemsMNIST50 00010 00010 0001×28×281\{\\times\}28\{\\times\}2810Fashion\-MNIST50 00010 00010 0001×28×281\{\\times\}28\{\\times\}2810CIFAR\-1040 00010 00010 0003×32×323\{\\times\}32\{\\times\}3210CIFAR\-10040 00010 00010 0003×32×323\{\\times\}32\{\\times\}3220Arrhythmia452 records \(fixed stratified split\)274 features1
### E\.2Competing methods

We compare against the following competing methods: OC\-SVM\([Schölkopf et al\., 1999](https://arxiv.org/html/2609.28832#bib.bib51)\), KDE\([Parzen, 1962](https://arxiv.org/html/2609.28832#bib.bib52)\), Isolation Forest\([Liu et al\., 2008](https://arxiv.org/html/2609.28832#bib.bib53)\), Deep SVDD\([Ruff et al\., 2018](https://arxiv.org/html/2609.28832#bib.bib54)\), the winner\-take\-all autoencoder \(DCAE\)\([Makhzani and Frey, 2015](https://arxiv.org/html/2609.28832#bib.bib55)\), VAE\([Kingma and Welling, 2013](https://arxiv.org/html/2609.28832#bib.bib58)\), MemAE\([Gong et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib59)\), MemGAN\([Yang et al\., 2021](https://arxiv.org/html/2609.28832#bib.bib60)\), deep structured energy\-based models \(DSEBM and DSEBM\-e\)\([Zhai et al\., 2016](https://arxiv.org/html/2609.28832#bib.bib61)\), DAGMM\([Zong et al\., 2018](https://arxiv.org/html/2609.28832#bib.bib62)\), AnoGAN\([Schlegl et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib63)\), ALAD\([Zenati et al\., 2018](https://arxiv.org/html/2609.28832#bib.bib64)\), ADGAN\([Deecke et al\., 2018](https://arxiv.org/html/2609.28832#bib.bib65)\), OCGAN\([Perera et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib66)\), GANomaly\([Akcay et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib67)\), RCGAN\([Yang et al\., 2020](https://arxiv.org/html/2609.28832#bib.bib68)\), GOAD\([Bergman and Hoshen, 2020](https://arxiv.org/html/2609.28832#bib.bib69)\), geometric\-transformation classification \(GeoTrans\)\([Golan and El\-Yaniv, 2018](https://arxiv.org/html/2609.28832#bib.bib70)\), the attribute\-restoration framework \(ARNet\)\([Ye et al\., 2022](https://arxiv.org/html/2609.28832#bib.bib71)\), and targeted collapse \(TOLL\)\([Ghafourian et al\., 2025](https://arxiv.org/html/2609.28832#bib.bib46)\)\.

TOLL adds a latent\-norm compactness term to this autoencoder family; its training loss and anomaly score includeβ​∥x∥2\\beta\\lVert x\\rVert\_\{2\}\. The TOLL column denotes that regularised method, whereas AE denotes theβ=0\\beta=0reconstruction\-only baseline\. AE\-PP and AE\-PoS also setβ=0\\beta=0: AE\-PP adds Dynamic Push and Pull to the common backbone, and AE\-PoS further applies Nested Manifold Carving to the frozen Stage\-0 representation\. Thus, the methods share TOLL’s architecture and optimisation settings, but not its compactness objective\.

### E\.3Models and training

##### Common backbone:

AE, AE\-PP, and the Stage\-0 component of AE\-PoS use the autoencoder architecture, latent width, optimiser, learning rate, and batch size specified by[Ghafourian et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib46)\. This holds model capacity and the basic optimisation budget fixed while changing the objective\. Stage 0 trains for 2,000 iterations with Adam and no weight decay\. Stage 1 freezes the Stage\-0 encoder and decoder from the same nominal class and seed, then trains a nested MLP encoder–decoder for 6,000 iterations\. The nested MLP uses ReLU, with LayerNorm on MNIST and Fashion\-MNIST and BatchNorm on Arrhythmia, CIFAR\-10, and CIFAR\-100\. Its dimensions and dataset\-specific settings are given in Tables[18](https://arxiv.org/html/2609.28832#A5.T18)and[19](https://arxiv.org/html/2609.28832#A5.T19)\.

##### Objectives and score:

AE minimises clean reconstruction error\. AE\-PP retains that term and adds the Dynamic Push and Pull loss using the negative views in Table[20](https://arxiv.org/html/2609.28832#A5.T20)\. AE\-PoS trains Stage 1 inside the frozen Stage\-0 model\. All reconstruction and push\-pull distances use theℓ2\\ell\_\{2\}norm\. At test time, AE, AE\-PP, and AE\-PoS use reconstruction error as the anomaly score\.

Table 17:Plain AE, AE\-PP and AE\-PoS on the one\-class benchmarks\.DatasetAEAE\-PPAE\-PoSMNIST94\.74±\\pm4\.6599\.38±\\pm0\.4299\.35±\\pm0\.51Fashion\-MNIST91\.60±\\pm5\.3494\.83±\\pm3\.9594\.87±\\pm4\.04CIFAR\-1068\.96±\\pm7\.2971\.30±\\pm6\.7071\.73±\\pm6\.60CIFAR\-10065\.42±\\pm9\.0968\.56±\\pm8\.8968\.87±\\pm8\.97Arrhythmia \(F1\)60\.77±\\pm7\.2667\.69±\\pm5\.7570\.77±\\pm5\.75Table 18:Stage\-0 AE\-PP settings\. Latent width, learning rate, and batch size follow[Ghafourian et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib46); scale and weight specify Dynamic Push and Pull\. All runs use Adam without weight decay for 2,000 iterations and validate every 20 iterations\.Push\-pullDatasetLatentLRBatchScaleWeightArrhythmia1610−310^\{\-3\}1003\.001\.00MNIST12810−410^\{\-4\}10003\.001\.00Fashion\-MNIST25610−410^\{\-4\}5003\.001\.00CIFAR\-106410−210^\{\-2\}502\.001\.00CIFAR\-1006410−310^\{\-3\}1002\.001\.00Table 19:Stage\-1 AE\-PoS settings\. Stage 1 is trained within the frozen Stage 0 model for each nominal class and seed\. The decoder mirrors the listed MLP encoder path\.Push\-pullDatasetEncoder pathLRBatchSpaceScaleWeightArrhythmia→→216\\\!\\to\\\!8\\\!\\to\\\!210−310^\{\-3\}100latent1\.001\.00MNIST→→256128\\\!\\to\\\!256\\\!\\to\\\!25610−410^\{\-4\}1000pixel2\.001\.00Fashion\-MNIST→→384256\\\!\\to\\\!384\\\!\\to\\\!38410−410^\{\-4\}500pixel2\.004\.00CIFAR\-10→→3264\\\!\\to\\\!32\\\!\\to\\\!3210−210^\{\-2\}50latent2\.001\.00CIFAR\-100→→9664\\\!\\to\\\!96\\\!\\to\\\!9610−310^\{\-3\}100latent2\.001\.00

### E\.4Push\-pull negative views

The negative view is generated from a nominal training sample and is used only to construct the push\-pull objective; it is not labelled anomaly data\. At Stage 1, MNIST, Fashion\-MNIST, and Arrhythmia reuse their Stage\-0 transformation, and the CIFAR models perturb the frozen Stage\-0 latent rather than an image\. Table[20](https://arxiv.org/html/2609.28832#A5.T20)gives the complete configuration\.

Table 20:Negative views used by Dynamic Push and Pull\.*OneOf*samples one transformation per input with weights3:1:1:13\{:\}1\{:\}1\{:\}1in the listed order\.DatasetStage 0Stage 1MNISTCutPaste with three rotated patchesSame CutPaste configurationFashion\-MNIST*OneOf*: CutPaste \(area0\.150\.15–0\.40\.4, two patches\), patch shuffle \(grid 2\),90∘90^\{\\circ\}rotation, and phase scramble \(0\.30\.3\)Same*OneOf*configurationCIFAR\-10*OneOf*: phase scramble \(0\.30\.3\), patch shuffle \(grid 2\), CutPaste, and channel shuffleGaussian noise on the Stage\-0 latent, with relativeσ=0\.03\\sigma=0\.03andp=0\.8p=0\.8CIFAR\-100*OneOf*: phase scramble \(0\.30\.3\), patch shuffle \(grid 2\), CutPaste, and channel shuffleGaussian noise on the Stage\-0 latent, with relativeσ=0\.03\\sigma=0\.03andp=0\.8p=0\.8ArrhythmiaFeature shuffle with fraction0\.20\.2Same feature\-shuffle configuration
### E\.5Ablation and complete results

The controlled ablation uses the same backbone, data splits, and training budget for AE, AE\-PP, and AE\-PoS\. AE isolates reconstruction, AE\-PP adds Dynamic Push and Pull, and AE\-PoS further adds Stage 1\.

Tables[21](https://arxiv.org/html/2609.28832#A5.T21),[22](https://arxiv.org/html/2609.28832#A5.T22),[23](https://arxiv.org/html/2609.28832#A5.T23), and[24](https://arxiv.org/html/2609.28832#A5.T24)report the complete class\-wise results for the image datasets\. In particular, Table[23](https://arxiv.org/html/2609.28832#A5.T23)expands the average CIFAR\-10 comparison reported in Table[4](https://arxiv.org/html/2609.28832#S4.T4)of the main paper\. Arrhythmia, which comprises a single one\-class task, is reported directly in Table[3](https://arxiv.org/html/2609.28832#S4.T3)of the main paper\.

Table 21:Mean and standard deviation of AUC\-ROC in % on MNIST\([Deng, 2012](https://arxiv.org/html/2609.28832#bib.bib47)\)classes over 10 seeds\. The highest value in each row is in bold\.NormalOC\-SVMOCGANVAEDCAEIFAnoGANKDEDSVDDMEMAEMEMGANTollAE\-PPAE\-PoS098\.6±\\pm0\.099\.899\.797\.6±\\pm0\.798\.0±\\pm0\.396\.6±\\pm1\.397\.1±\\pm0\.098\.0±\\pm0\.799\.3±\\pm0\.199\.3±\\pm0\.199\.8±\\pm0\.199\.91±\\pm0\.0299\.90±\\pm0\.02199\.5±\\pm0\.099\.999\.998\.3±\\pm0\.697\.3±\\pm0\.499\.2±\\pm0\.698\.9±\\pm0\.099\.7±\\pm0\.199\.8±\\pm0\.099\.9±\\pm0\.099\.9±\\pm0\.099\.94±\\pm0\.0199\.95±\\pm0\.01282\.5±\\pm0\.194\.293\.685\.4±\\pm2\.488\.6±\\pm0\.585\.0±\\pm2\.979\.0±\\pm0\.091\.7±\\pm0\.890\.6±\\pm0\.894\.5±\\pm0\.196\.2±\\pm1\.699\.24±\\pm0\.0599\.28±\\pm0\.05388\.1±\\pm0\.096\.395\.986\.7±\\pm0\.989\.9±\\pm0\.488\.7±\\pm2\.186\.2±\\pm0\.091\.9±\\pm1\.594\.7±\\pm0\.695\.7±\\pm0\.497\.9±\\pm0\.699\.14±\\pm0\.1199\.15±\\pm0\.12494\.9±\\pm0\.097\.597\.386\.5±\\pm2\.092\.7±\\pm0\.689\.4±\\pm1\.387\.9±\\pm0\.094\.9±\\pm0\.894\.5±\\pm0\.496\.1±\\pm0\.497\.8±\\pm0\.499\.06±\\pm0\.0399\.03±\\pm0\.05577\.1±\\pm0\.098\.096\.478\.2±\\pm2\.785\.5±\\pm0\.888\.3±\\pm2\.973\.8±\\pm0\.088\.5±\\pm0\.995\.1±\\pm0\.193\.6±\\pm0\.398\.1±\\pm0\.699\.33±\\pm0\.0399\.34±\\pm0\.04696\.5±\\pm0\.099\.199\.394\.6±\\pm0\.595\.6±\\pm0\.394\.7±\\pm2\.787\.6±\\pm0\.098\.3±\\pm0\.598\.4±\\pm0\.598\.6±\\pm0\.199\.5±\\pm0\.199\.84±\\pm0\.0199\.84±\\pm0\.02793\.7±\\pm0\.098\.197\.692\.3±\\pm1\.092\.0±\\pm0\.493\.5±\\pm1\.891\.4±\\pm0\.094\.6±\\pm0\.995\.4±\\pm0\.296\.2±\\pm0\.298\.7±\\pm0\.299\.28±\\pm0\.0699\.28±\\pm0\.07888\.9±\\pm0\.093\.992\.386\.5±\\pm1\.689\.9±\\pm0\.484\.9±\\pm2\.179\.2±\\pm0\.093\.9±\\pm1\.686\.9±\\pm0\.593\.5±\\pm0\.197\.3±\\pm0\.598\.54±\\pm0\.2398\.17±\\pm0\.21993\.1±\\pm0\.098\.197\.690\.4±\\pm1\.893\.5±\\pm0\.392\.4±\\pm1\.188\.2±\\pm0\.096\.5±\\pm0\.397\.3±\\pm0\.295\.9±\\pm0\.198\.5±\\pm0\.399\.49±\\pm0\.0499\.56±\\pm0\.03Average91\.397\.597\.089\.792\.391\.487\.094\.895\.296\.598\.499\.3899\.35

Table 22:One\-class anomaly detection on Fashion\-MNIST\([Xiao et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib48)\), measured by AUC\-ROC \(%\)\. Values with uncertainty are reported as mean±\\pmstandard deviation over 10 seeds\. Bold indicates the highest mean in each row\.BaselinesOursNominalDAGMMDSEBMADGANGANomalyGeoTransARNetTOLLAE\-PPAE\-PoST\-shirt/top42\.191\.689\.980\.399\.492\.791\.9±0\.291\.9\{\\pm\}0\.295\.12±0\.0995\.12\{\\pm\}0\.0994\.92±0\.1094\.92\{\\pm\}0\.10Trouser55\.171\.881\.983\.097\.699\.398\.7±0\.098\.7\{\\pm\}0\.098\.91±0\.0698\.91\{\\pm\}0\.0699\.24±0\.0899\.24\{\\pm\}0\.08Pullover50\.488\.387\.675\.991\.189\.191\.3±0\.291\.3\{\\pm\}0\.292\.47±0\.20\\mathbf\{92\.47\{\\pm\}0\.20\}92\.14±0\.1292\.14\{\\pm\}0\.12Dress57\.087\.391\.287\.289\.993\.692\.4±0\.292\.4\{\\pm\}0\.295\.24±0\.1995\.24\{\\pm\}0\.1995\.40±0\.11\\mathbf\{95\.40\{\\pm\}0\.11\}Coat26\.985\.286\.571\.492\.190\.891\.5±0\.191\.5\{\\pm\}0\.192\.92±0\.2292\.92\{\\pm\}0\.2293\.25±0\.27\\mathbf\{93\.25\{\\pm\}0\.27\}Sandal70\.587\.189\.692\.793\.493\.193\.1±0\.293\.1\{\\pm\}0\.294\.28±0\.39\\mathbf\{94\.28\{\\pm\}0\.39\}93\.07±0\.4693\.07\{\\pm\}0\.46Shirt48\.373\.474\.381\.083\.385\.084\.6±0\.384\.6\{\\pm\}0\.385\.13±0\.2085\.13\{\\pm\}0\.2085\.37±0\.14\\mathbf\{85\.37\{\\pm\}0\.14\}Sneaker83\.598\.197\.288\.398\.998\.499\.0±0\.099\.0\{\\pm\}0\.099\.15±0\.09\\mathbf\{99\.15\{\\pm\}0\.09\}99\.13±0\.0399\.13\{\\pm\}0\.03Bag49\.986\.089\.069\.390\.897\.890\.8±0\.690\.8\{\\pm\}0\.696\.56±0\.4896\.56\{\\pm\}0\.4897\.46±0\.1397\.46\{\\pm\}0\.13Ankle boot34\.097\.197\.180\.399\.298\.498\.9±0\.198\.9\{\\pm\}0\.198\.51±0\.1298\.51\{\\pm\}0\.1298\.71±0\.0898\.71\{\\pm\}0\.08Average51\.886\.688\.480\.993\.593\.993\.294\.8394\.87

Table 23:One\-class anomaly detection on CIFAR\-10\([Krizhevsky, 2009](https://arxiv.org/html/2609.28832#bib.bib49)\), measured by AUC\-ROC \(%\)\. AE\-PP and AE\-PoS results are reported as mean±\\pmstandard deviation over 10 seeds\. Bold indicates the highest mean in each row\.BaselinesOursNominalOCGANVAEDSVDDDSEBMDAGMMIFAnoGANALADMEMAEMEMGANTOLLAE\-PPAE\-PoSAirplane75\.770\.061\.7±4\.161\.7\{\\pm\}4\.141\.4±2\.341\.4\{\\pm\}2\.356\.0±6\.956\.0\{\\pm\}6\.960\.1±0\.760\.1\{\\pm\}0\.767\.1±2\.567\.1\{\\pm\}2\.564\.7±2\.664\.7\{\\pm\}2\.666\.5±0\.966\.5\{\\pm\}0\.973\.0±0\.873\.0\{\\pm\}0\.875\.0±4\.375\.0\{\\pm\}4\.375\.53±2\.1875\.53\{\\pm\}2\.1875\.99±1\.94\\mathbf\{75\.99\{\\pm\}1\.94\}Automobile53\.138\.665\.9±2\.165\.9\{\\pm\}2\.157\.1±2\.057\.1\{\\pm\}2\.048\.3±1\.848\.3\{\\pm\}1\.850\.8±0\.650\.8\{\\pm\}0\.654\.7±3\.454\.7\{\\pm\}3\.438\.7±0\.838\.7\{\\pm\}0\.846\.4±0\.146\.4\{\\pm\}0\.152\.5±0\.752\.5\{\\pm\}0\.767\.6±3\.267\.6\{\\pm\}3\.268\.65±1\.4668\.65\{\\pm\}1\.4669\.10±1\.32\\mathbf\{69\.10\{\\pm\}1\.32\}Bird64\.067\.950\.8±0\.850\.8\{\\pm\}0\.861\.9±0\.161\.9\{\\pm\}0\.153\.8±4\.053\.8\{\\pm\}4\.049\.2±0\.449\.2\{\\pm\}0\.452\.9±3\.052\.9\{\\pm\}3\.067\.0±0\.767\.0\{\\pm\}0\.766\.0±0\.166\.0\{\\pm\}0\.167\.2±0\.167\.2\{\\pm\}0\.156\.2±2\.856\.2\{\\pm\}2\.859\.47±1\.9559\.47\{\\pm\}1\.9559\.99±1\.9459\.99\{\\pm\}1\.94Cat62\.053\.559\.1±1\.459\.1\{\\pm\}1\.450\.1±0\.450\.1\{\\pm\}0\.451\.2±0\.851\.2\{\\pm\}0\.855\.1±0\.455\.1\{\\pm\}0\.454\.5±1\.954\.5\{\\pm\}1\.959\.2±0\.359\.2\{\\pm\}0\.352\.9±0\.152\.9\{\\pm\}0\.157\.3±0\.257\.3\{\\pm\}0\.264\.6±1\.6\\mathbf\{64\.6\{\\pm\}1\.6\}63\.41±0\.4763\.41\{\\pm\}0\.4763\.91±0\.5863\.91\{\\pm\}0\.58Deer72\.374\.860\.9±1\.160\.9\{\\pm\}1\.173\.3±0\.273\.3\{\\pm\}0\.252\.2±7\.352\.2\{\\pm\}7\.349\.8±0\.449\.8\{\\pm\}0\.465\.1±3\.265\.1\{\\pm\}3\.272\.7±0\.672\.7\{\\pm\}0\.672\.8±0\.172\.8\{\\pm\}0\.173\.9±0\.973\.9\{\\pm\}0\.967\.7±1\.467\.7\{\\pm\}1\.469\.47±0\.8169\.47\{\\pm\}0\.8170\.01±0\.9970\.01\{\\pm\}0\.99Dog62\.052\.365\.7±0\.865\.7\{\\pm\}0\.860\.5±0\.360\.5\{\\pm\}0\.349\.3±3\.649\.3\{\\pm\}3\.658\.5±0\.458\.5\{\\pm\}0\.460\.3±2\.660\.3\{\\pm\}2\.652\.8±1\.252\.8\{\\pm\}1\.252\.9±0\.252\.9\{\\pm\}0\.265\.0±0\.265\.0\{\\pm\}0\.268\.1±1\.668\.1\{\\pm\}1\.668\.85±0\.7168\.85\{\\pm\}0\.7169\.36±0\.43\\mathbf\{69\.36\{\\pm\}0\.43\}Frog72\.368\.767\.7±2\.667\.7\{\\pm\}2\.668\.4±0\.368\.4\{\\pm\}0\.364\.9±1\.764\.9\{\\pm\}1\.742\.9±0\.642\.9\{\\pm\}0\.658\.5±1\.458\.5\{\\pm\}1\.469\.5±1\.169\.5\{\\pm\}1\.163\.7±0\.463\.7\{\\pm\}0\.472\.8±0\.772\.8\{\\pm\}0\.774\.7±2\.574\.7\{\\pm\}2\.576\.77±0\.5176\.77\{\\pm\}0\.5177\.20±0\.75\\mathbf\{77\.20\{\\pm\}0\.75\}Horse57\.549\.367\.3±0\.967\.3\{\\pm\}0\.953\.3±0\.753\.3\{\\pm\}0\.755\.3±0\.855\.3\{\\pm\}0\.855\.1±0\.755\.1\{\\pm\}0\.762\.5±0\.862\.5\{\\pm\}0\.844\.8±0\.444\.8\{\\pm\}0\.445\.9±0\.145\.9\{\\pm\}0\.152\.5±0\.552\.5\{\\pm\}0\.565\.8±1\.365\.8\{\\pm\}1\.371\.24±1\.4771\.24\{\\pm\}1\.4771\.71±1\.42\\mathbf\{71\.71\{\\pm\}1\.42\}Ship82\.069\.675\.9±1\.275\.9\{\\pm\}1\.273\.9±0\.373\.9\{\\pm\}0\.351\.9±2\.451\.9\{\\pm\}2\.474\.2±0\.674\.2\{\\pm\}0\.675\.8±4\.175\.8\{\\pm\}4\.173\.4±0\.473\.4\{\\pm\}0\.470\.1±0\.170\.1\{\\pm\}0\.174\.4±0\.374\.4\{\\pm\}0\.380\.0±1\.180\.0\{\\pm\}1\.183\.12±0\.6383\.12\{\\pm\}0\.6383\.33±0\.62\\mathbf\{83\.33\{\\pm\}0\.62\}Truck55\.438\.673\.1±1\.273\.1\{\\pm\}1\.263\.6±3\.163\.6\{\\pm\}3\.154\.2±5\.854\.2\{\\pm\}5\.858\.9±0\.758\.9\{\\pm\}0\.766\.5±2\.866\.5\{\\pm\}2\.839\.2±1\.339\.2\{\\pm\}1\.348\.2±0\.248\.2\{\\pm\}0\.265\.6±1\.665\.6\{\\pm\}1\.676\.2±0\.576\.2\{\\pm\}0\.576\.53±0\.5176\.53\{\\pm\}0\.5176\.69±0\.60\\mathbf\{76\.69\{\\pm\}0\.60\}Average65\.658\.364\.860\.454\.455\.561\.859\.358\.565\.369\.671\.3071\.73

Table 24:One\-class anomaly detection on the CIFAR\-100 coarse superclasses\([Krizhevsky, 2009](https://arxiv.org/html/2609.28832#bib.bib49)\), measured by AUC\-ROC \(%\)\. Values with uncertainty are reported as mean±\\pmstandard deviation over 10 seeds\. Bold indicates the highest mean in each row\.BaselinesOursNominalDAGMMDSEBMADGANGANomalyGeoTransARNetTOLLAE\-PPAE\-PoSAquatic mammals43\.464\.063\.157\.974\.777\.570\.3±3\.470\.3\{\\pm\}3\.469\.30±1\.5569\.30\{\\pm\}1\.5569\.62±1\.0769\.62\{\\pm\}1\.07Fish49\.547\.954\.951\.968\.570\.066\.2±1\.166\.2\{\\pm\}1\.169\.99±1\.4969\.99\{\\pm\}1\.4970\.38±1\.41\\mathbf\{70\.38\{\\pm\}1\.41\}Flowers66\.153\.741\.336\.074\.062\.480\.3±0\.780\.3\{\\pm\}0\.780\.13±1\.0680\.13\{\\pm\}1\.0680\.85±1\.06\\mathbf\{80\.85\{\\pm\}1\.06\}Food containers52\.648\.450\.046\.581\.076\.258\.2±1\.558\.2\{\\pm\}1\.566\.80±3\.9166\.80\{\\pm\}3\.9167\.27±3\.9567\.27\{\\pm\}3\.95Fruit and vegetables56\.959\.740\.646\.678\.477\.780\.1±1\.380\.1\{\\pm\}1\.379\.78±0\.7279\.78\{\\pm\}0\.7280\.36±0\.62\\mathbf\{80\.36\{\\pm\}0\.62\}Household electrical devices52\.446\.642\.842\.959\.164\.061\.4±2\.661\.4\{\\pm\}2\.661\.56±1\.9261\.56\{\\pm\}1\.9261\.56±1\.8961\.56\{\\pm\}1\.89Household furniture55\.051\.751\.153\.781\.886\.964\.8±3\.064\.8\{\\pm\}3\.069\.64±1\.5169\.64\{\\pm\}1\.5169\.78±1\.4469\.78\{\\pm\}1\.44Insects52\.854\.855\.459\.465\.065\.670\.5±1\.370\.5\{\\pm\}1\.372\.51±0\.9372\.51\{\\pm\}0\.9373\.16±1\.37\\mathbf\{73\.16\{\\pm\}1\.37\}Large carnivores53\.266\.759\.263\.785\.582\.762\.1±2\.162\.1\{\\pm\}2\.159\.37±1\.9859\.37\{\\pm\}1\.9859\.59±1\.9759\.59\{\\pm\}1\.97Large man\-made outdoor things42\.571\.262\.768\.090\.690\.279\.6±1\.479\.6\{\\pm\}1\.481\.53±1\.1981\.53\{\\pm\}1\.1981\.99±0\.9881\.99\{\\pm\}0\.98Large natural outdoor scenes52\.778\.379\.875\.687\.685\.981\.6±1\.181\.6\{\\pm\}1\.183\.89±1\.0283\.89\{\\pm\}1\.0284\.15±0\.9884\.15\{\\pm\}0\.98Large omnivores and herbivores46\.462\.753\.757\.683\.983\.562\.6±1\.262\.6\{\\pm\}1\.261\.04±0\.8461\.04\{\\pm\}0\.8461\.19±0\.7761\.19\{\\pm\}0\.77Medium\-sized mammals42\.766\.858\.958\.783\.284\.661\.2±1\.961\.2\{\\pm\}1\.961\.21±1\.0661\.21\{\\pm\}1\.0661\.40±1\.3361\.40\{\\pm\}1\.33Non\-insect invertebrates45\.452\.657\.459\.958\.067\.658\.6±2\.058\.6\{\\pm\}2\.055\.65±2\.0355\.65\{\\pm\}2\.0355\.95±2\.1855\.95\{\\pm\}2\.18People57\.244\.039\.443\.992\.184\.265\.4±4\.565\.4\{\\pm\}4\.565\.01±1\.7465\.01\{\\pm\}1\.7465\.11±1\.7565\.11\{\\pm\}1\.75Reptiles48\.856\.855\.659\.968\.374\.156\.1±1\.556\.1\{\\pm\}1\.553\.48±1\.6853\.48\{\\pm\}1\.6853\.77±1\.6753\.77\{\\pm\}1\.67Small mammals54\.463\.163\.364\.473\.580\.362\.3±1\.162\.3\{\\pm\}1\.163\.58±1\.2063\.58\{\\pm\}1\.2063\.94±1\.2763\.94\{\\pm\}1\.27Trees36\.473\.066\.771\.893\.891\.080\.9±1\.880\.9\{\\pm\}1\.881\.19±0\.8281\.19\{\\pm\}0\.8281\.31±0\.6981\.31\{\\pm\}0\.69Vehicles 152\.457\.744\.354\.990\.785\.365\.2±1\.465\.2\{\\pm\}1\.465\.77±1\.1965\.77\{\\pm\}1\.1966\.20±1\.4566\.20\{\\pm\}1\.45Vehicles 250\.355\.553\.056\.885\.085\.463\.6±1\.663\.6\{\\pm\}1\.669\.82±1\.0369\.82\{\\pm\}1\.0369\.85±1\.0469\.85\{\\pm\}1\.04Average50\.558\.854\.756\.578\.778\.867\.668\.5668\.87

### E\.6Push–Pull Sensitivity

Table[25](https://arxiv.org/html/2609.28832#A5.T25)evaluates the sensitivity of AE\-PP to the margin scaleα\\alpha, with the Push–Pull weight fixed atw=1w=1\. The AE column is the reconstruction\-only baseline obtained using the common TOLL backbone with its compactness coefficient set toβ=0\\beta=0, and is therefore distinct from the AE\-PP configurations\. Whenα=0\\alpha=0, the Push term vanishes, leaving only the Pull objective, which maps a perturbed nominal view to its clean counterpart\. This is exactly a denoising autoencoder when the perturbation is additive Gaussian noise, as in our controlled multi\-component MNIST experiment, and more generally subsumes perturbation\-to\-clean autoencoders based on CutPaste, shuffling, rotations, and related transformations used in the other settings\. Forα\>0\\alpha\>0, the same dataset\-specific perturbations additionally activate Push and impose an explicit separation margin\. The consistent improvement fromα=0\\alpha=0toα\>0\\alpha\>0isolates the benefit of the proposed Push term beyond denoising and supports its intended role in separating overlapping nominal submanifolds\. Most gains are obtained byα=2\\alpha=2or33, after which performance remains broadly stable\. Validation selectsα=3\\alpha=3for Arrhythmia, MNIST, and Fashion\-MNIST, andα=2\\alpha=2for CIFAR\-10 and CIFAR\-100, indicating limited sensitivity once a sufficient Push margin is imposed\. Arrhythmia is evaluated using F1, while all other datasets use AUC\-ROC\.

Table 25:Effect of the Push–Pull margin scaleα\\alpha\. AE is the reconstruction\-only baseline obtained using the common TOLL backbone with its compactness coefficient set toβ=0\\beta=0\. All AE\-PP configurations usew=1w=1;α=0\\alpha=0retains Pull while disabling Push\. Results are reported as mean±\\pmstandard deviation\. Bold indicates the highest mean in each row, and the dagger marks the value ofα\\alphaselected on the validation set\.BaselineAE\-PP \(w=1w=1\)DatasetAE \(β=0\\beta=0\)α=0\\alpha=0α=1\\alpha=1α=2\\alpha=2α=3\\alpha=3α=4\\alpha=4α=5\\alpha=5α=6\\alpha=6Arrhythmia \(F1\)60\.77±7\.2660\.77\{\\pm\}7\.2663\.08±3\.2463\.08\{\\pm\}3\.2463\.08±3\.2463\.08\{\\pm\}3\.2465\.38±4\.0565\.38\{\\pm\}4\.0567\.69±6\.07†\\mathbf\{67\.69\{\\pm\}6\.07\}^\{\\dagger\}67\.69±6\.07\\mathbf\{67\.69\{\\pm\}6\.07\}67\.69±6\.07\\mathbf\{67\.69\{\\pm\}6\.07\}67\.69±6\.07\\mathbf\{67\.69\{\\pm\}6\.07\}MNIST94\.74±4\.6594\.74\{\\pm\}4\.6598\.54±1\.3898\.54\{\\pm\}1\.3899\.04±0\.7799\.04\{\\pm\}0\.7799\.37±0\.4499\.37\{\\pm\}0\.4499\.38±0\.42†\\mathbf\{99\.38\{\\pm\}0\.42\}^\{\\dagger\}99\.32±0\.4599\.32\{\\pm\}0\.4599\.28±0\.4899\.28\{\\pm\}0\.4899\.26±0\.5099\.26\{\\pm\}0\.50Fashion\-MNIST91\.60±5\.3491\.60\{\\pm\}5\.3493\.75±4\.6093\.75\{\\pm\}4\.6094\.12±4\.4394\.12\{\\pm\}4\.4394\.74±4\.0294\.74\{\\pm\}4\.0294\.83±3\.97†\\mathbf\{94\.83\{\\pm\}3\.97\}^\{\\dagger\}94\.74±3\.9994\.74\{\\pm\}3\.9994\.67±3\.9494\.67\{\\pm\}3\.9494\.69±3\.9594\.69\{\\pm\}3\.95CIFAR\-1068\.96±7\.2968\.96\{\\pm\}7\.2969\.32±7\.3669\.32\{\\pm\}7\.3669\.48±7\.1369\.48\{\\pm\}7\.1371\.30±6\.73†\\mathbf\{71\.30\{\\pm\}6\.73\}^\{\\dagger\}71\.16±6\.8171\.16\{\\pm\}6\.8171\.05±6\.7871\.05\{\\pm\}6\.7871\.23±6\.9771\.23\{\\pm\}6\.9771\.29±7\.0671\.29\{\\pm\}7\.06CIFAR\-10065\.42±9\.0965\.42\{\\pm\}9\.0966\.78±9\.2666\.78\{\\pm\}9\.2667\.18±9\.1767\.18\{\\pm\}9\.1768\.56±8\.91†68\.56\{\\pm\}8\.91^\{\\dagger\}68\.45±8\.9868\.45\{\\pm\}8\.9868\.59±8\.6968\.59\{\\pm\}8\.6968\.69±8\.53\\mathbf\{68\.69\{\\pm\}8\.53\}68\.57±8\.7268\.57\{\\pm\}8\.72

Under the conditions of Lemma[1](https://arxiv.org/html/2609.28832#Thmtheorem1), Eq\. \([6](https://arxiv.org/html/2609.28832#S3.E6)\) also predicts saturation with respect toα\\alpha\. Onceα\\alphaexceeds the zero\-Push\-error bound1\+η⁡\(sn\)/δe1\+\\eta\(s\_\{n\}\)/\\delta\_\{e\}for most training pairs, the hinge remains active, and its gradient,−∇θd​\(s^n,s~n\)\-\\nabla\_\{\\theta\}d\(\\hat\{s\}\_\{n\},\\tilde\{s\}\_\{n\}\), no longer depends onα\\alpha\. Consistent with this prediction, performance plateaus atα=2\\alpha=2or33; on Arrhythmia, all settingsα∈\{3,4,5,6\}\\alpha\\in\\\{3,4,5,6\\\}produce identical results\.

### E\.7Detecting Unseen Degradations in High\-Quality Images

Table 26:Detection of unseen image degradations\. The clean reference defines the nominal class: paired clean images \(Own GT\) are used when available; otherwise, a fixed set of clean DIV8K crops is used\. AUC\-ROC and PR\-AUC are computed using reconstruction error as the anomaly score\. Bold indicates the best result in each row and metric\.DatasetCleanreference\#ImagesAEVAEAE\-PPAE\-PoSROCPRROCPRROCPRROCPRAdditive noiseKodak24 \(σ=25\\sigma=25\)Own GT241\.00001\.00000\.99830\.99831\.00001\.00001\.00001\.0000BlurREDS blur 0\.2Own GT2000\.72680\.65890\.35520\.40240\.60830\.57250\.60020\.5766REDS blur 0\.4Own GT2000\.65810\.56830\.21680\.34840\.75970\.72390\.78080\.7574REDS blur 0\.6Own GT2000\.67260\.56990\.11110\.32450\.92110\.92220\.95540\.9567REDS blur 0\.8Own GT2000\.77030\.67130\.05280\.31510\.99200\.99300\.99720\.9975REDS blur 1\.0Own GT2000\.57240\.52150\.03460\.31190\.99850\.99860\.99960\.9996GoProOwn GT2000\.41140\.42170\.05690\.31370\.94710\.95680\.98460\.9862GoProDIV8K2000\.16210\.33780\.10180\.32310\.99830\.99820\.99970\.9997RainTest100DIV8K980\.32840\.38630\.78420\.67660\.94810\.94180\.95940\.9470Rain100LDIV8K1000\.47090\.44610\.74670\.64320\.87080\.83660\.89250\.8479Rain100HDIV8K1000\.81960\.73070\.90510\.82690\.94360\.91310\.95700\.9226Test1200DIV8K2000\.20250\.34580\.71510\.59440\.98850\.98640\.99190\.9881Test2800DIV8K2000\.38010\.40160\.80170\.69170\.97980\.97640\.98790\.9825UnderwaterUnderwater highDIV8K1440\.36730\.40100\.52540\.46840\.98460\.98480\.98910\.9888Underwater mediumDIV8K1430\.35550\.39740\.53080\.47690\.97500\.97530\.98660\.9857Underwater lowDIV8K1430\.16300\.33590\.29180\.37290\.94120\.92460\.97980\.9677Table 27:Average reconstruction PSNR \(dB\), computed between each inputssand its reconstructions^\\hat\{s\}, for clean and degraded images\. Higher PSNR indicates lower reconstruction error\. The \# Images column reports the number of images in each evaluation setting\. “Own GT” denotes the paired clean ground truth associated with each degraded image, whereas “DIV8K” denotes the fixed clean DIV8K evaluation subset\.DatasetCleanreference\#ImagesAEVAEAE\-PPAE\-PoSCleanDegr\.CleanDegr\.CleanDegr\.CleanDegr\.Additive noiseKodak24 \(σ=25\\sigma=25\)Own GT2457\.1526\.4926\.4918\.8644\.5823\.6443\.6523\.55Synthetic blurREDS blur 0\.2Own GT20063\.0462\.0627\.5929\.1143\.4242\.5543\.0742\.38REDS blur 0\.4Own GT20063\.0462\.4127\.5930\.8443\.4241\.0043\.0740\.88REDS blur 0\.6Own GT20063\.0462\.3727\.5932\.8543\.4238\.1243\.0737\.97REDS blur 0\.8Own GT20063\.0461\.9527\.5935\.2243\.4233\.2643\.0733\.60REDS blur 1\.0Own GT20063\.0462\.7227\.5937\.0143\.4230\.5143\.0731\.79Motion blurGoProOwn GT20062\.6663\.1231\.1539\.1733\.8028\.1134\.5028\.55GoProDIV8K20059\.1463\.1229\.5839\.1744\.2828\.1143\.5428\.55RainTest100DIV8K9858\.4361\.1129\.8623\.5144\.5934\.3543\.5334\.58Rain100LDIV8K10058\.7359\.8530\.5324\.5444\.8938\.6043\.7738\.30Rain100HDIV8K10058\.7354\.5030\.5320\.7544\.8937\.0843\.7736\.77Test1200DIV8K20059\.4163\.1330\.3325\.3144\.6731\.7243\.7732\.80Test2800DIV8K20059\.4460\.9330\.2223\.4744\.5832\.1243\.6932\.90UnderwaterUnderwater highDIV8K14458\.9161\.0329\.6429\.0144\.1929\.6143\.4330\.76Underwater mediumDIV8K14358\.9161\.0029\.5329\.0144\.1030\.0743\.4231\.06Underwater lowDIV8K14358\.9163\.0229\.5333\.7144\.1035\.3043\.4233\.94

#### E\.7\.1Dataset Construction

Training data:All models are trained on the same set of 8,693 clean images: 800 from DIV2K\([Agustsson and Timofte, 2017](https://arxiv.org/html/2609.28832#bib.bib32)\), 2,649 from Flickr2K\([Lim et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib33)\), 4,744 from the Waterloo Exploration Database\([Ma et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib34)\), and 500 from BSDS500\([Arbeláez et al\., 2011](https://arxiv.org/html/2609.28832#bib.bib35)\)\.

Synthetic degraded views during training:During training, each256×256256\\times 256clean crop is paired with a degraded view generated online for the Push–Pull loss\. Defocus blur \(r∈\[1,6\]r\\in\[1,6\]\), motion blur \(ℓ∈\[3,25\]\\ell\\in\[3,25\]\), and Gaussian blur \(σ∈\[0\.2,1\.0\]\\sigma\\in\[0\.2,1\.0\]\) are selected independently with probabilities0\.550\.55,0\.400\.40, and0\.300\.30, respectively\. Whennnblur types are selected, their strengths are scaled by1/n1/\\sqrt\{n\}\. Their kernels are combined with an optional, unattenuated sinc kernel \(p=0\.10p=0\.10\) and applied once in linear\-light space usingγ=2\.2\\gamma=2\.2\. Spatially varying defocus is used for20%20\\%of the defocus samples\. The blurred image is then downsampled by a random factor of at most22and resized to its original resolution with probability0\.50\.5\. Gaussian sensor noise \(σ∈\[0,6\]\\sigma\\in\[0,6\]\) is always added, followed by JPEG compression with quality7070–9595with probability0\.80\.8\.

REDS blur set:The REDS blur set contains five aligned degraded versions of each ground\-truth video frame, with blur levels0\.20\.2,0\.40\.4,0\.60\.6,0\.80\.8, and1\.01\.0\. For evaluation, we use the same provided subset of 200 frames at every level, with one frame selected from each video clip\. The degradation increases monotonically with the level: reconstruction error relative to the ground truth rises while image sharpness decreases\. The blur follows local scene motion, leaving static regions nearly unchanged while increasingly blurring moving regions, rather than applying a single spatially invariant kernel to the whole image\. Empirically, the mean squared deviation from the ground truth grows approximately quadratically with the blur level\.

Underwater degradation:We use underwater images from the LSUI dataset\([Peng et al\., 2023](https://arxiv.org/html/2609.28832#bib.bib1)\), grouped by degradation severity following[Devecioglu et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib2)\. The groups are defined using PSNR between each underwater image and its paired LSUI reference: high degradation corresponds to8\.798\.79\-16\.5716\.57dB, medium degradation to16\.5716\.57\-19\.7919\.79dB, and low degradation to19\.7919\.79\-31\.5331\.53dB\. Our evaluation contains 144, 143, and 143 images from these groups, respectively\. The paired LSUI references are used only to determine degradation severity; clean DIV8K images define the nominal class in our anomaly\-detection evaluation\.

Anomalous test data:The evaluation covers 16 settings across five degradation families\. Additive noise uses the 24 Kodak24 images\([Franzen, 1999](https://arxiv.org/html/2609.28832#bib.bib36)\)corrupted with Gaussian noise atσ=25\\sigma=25\. The REDS blur set\([Nah et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib37)\)provides five aligned severity levels from0\.20\.2to1\.01\.0, evaluated on the same 200 frames at every level\. GoPro\([Nah et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib38)\)contributes 200 motion\-blurred images and is evaluated under two nominal\-reference protocols\. Rain comprises Test100 \(98 images\)\([Zhang et al\., 2020](https://arxiv.org/html/2609.28832#bib.bib39)\), Rain100L and Rain100H \(100 each\)\([Yang et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib40)\), Test1200 \(200\)\([Zhang and Patel, 2018](https://arxiv.org/html/2609.28832#bib.bib41)\), and Test2800 \(200\)\([Fu et al\., 2017](https://arxiv.org/html/2609.28832#bib.bib42)\)\. Finally, LSUI\([Peng et al\., 2023](https://arxiv.org/html/2609.28832#bib.bib1)\)contributes high\-, medium\-, and low\-degradation underwater groups containing 144, 143, and 143 images, respectively, following the PSNR\-based partition of[Devecioglu et al\. \(2025\)](https://arxiv.org/html/2609.28832#bib.bib2)\.

Nominal test data:For Kodak24, REDS, and the paired GoPro protocol, we use the clean counterpart of each degraded image, so the two classes differ only in degradation\. For rain, underwater, and the second GoPro protocol, the nominal class is drawn from DIV8K\([Gu et al\., 2019](https://arxiv.org/html/2609.28832#bib.bib43)\)\. These nominal sets are matched to the corresponding anomalous sets in size and centre\-cropped at native resolution to the largest image dimensions in each test set\. The DIV8K protocols are therefore corpus\-level rather than scene\-paired comparisons and may also reflect differences in image content and native resolution; in particular, crops from 8K images generally contain finer per\-pixel detail than equally sized crops from lower\-resolution images\.

lowmediumhighss![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_input.jpg)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_input.jpg)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_input.jpg)s^\\hat\{s\}\|s−s^\|\|s\-\\hat\{s\}\|s^\\hat\{s\}\|s−s^\|\|s\-\\hat\{s\}\|s^\\hat\{s\}\|s−s^\|\|s\-\\hat\{s\}\|AE![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_out_ae.jpg)61\.8 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_res_ae_shared.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_out_ae.jpg)59\.8 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_res_ae_shared.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_out_ae.jpg)60\.6 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_res_ae_shared.png)VAE![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_out_vae.jpg)31\.4 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_res_vae_shared.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_out_vae.jpg)24\.7 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_res_vae_shared.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_out_vae.jpg)33\.3 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_res_vae_shared.png)AE\-PoS![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_out_aepos.jpg)29\.7 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_low_res_aepos_shared.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_out_aepos.jpg)26\.8 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_med_res_aepos_shared.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_out_aepos.jpg)24\.1 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/uw_high_res_aepos_shared.png)Figure 6:Underwater degradation at three severities \(columns\)\. Top row: the inputss; below it each network’s reconstructions^\\hat\{s\}with its PSNR and the absolute difference\|s−s^\|\|s\-\\hat\{s\}\|\. All difference panels share one intensity gain\.0\.20\.20\.40\.40\.60\.60\.80\.81\.01\.0ss![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_in_b02.jpg)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_in_b04.jpg)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_in_b06.jpg)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_in_b08.jpg)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_in_b10.jpg)s^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b02_ae.jpg)61\.8 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b04_ae.jpg)62\.3 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b06_ae.jpg)62\.4 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b08_ae.jpg)62\.0 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b10_ae.jpg)62\.8 dBAEs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b02_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b04_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b06_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b08_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b10_ae.png)s^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b02_vae.jpg)29\.2 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b04_vae.jpg)31\.1 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b06_vae.jpg)33\.2 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b08_vae.jpg)35\.7 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b10_vae.jpg)37\.3 dBVAEs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b02_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b04_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b06_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b08_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b10_vae.png)s^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b02_aepos.jpg)43\.5 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b04_aepos.jpg)41\.7 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b06_aepos.jpg)37\.8 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b08_aepos.jpg)33\.1 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_out_b10_aepos.jpg)31\.1 dBAE\-PoSs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b02_aepos.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b04_aepos.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b06_aepos.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b08_aepos.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/blur_res_b10_aepos.png)Figure 7:REDS under increasing blur\. Columns show the same scene at five blur strengths; rows show the inputss, each model’s reconstructions^\\hat\{s\}with its PSNR, and the absolute residual\|s−s^\|\\lvert s\-\\hat\{s\}\\rvert\. The VAE increasingly represents the blurred component: its reconstruction PSNR rises from29\.229\.2to37\.337\.3dB as the blur strengthens, causing the residual to decrease\. In contrast, AE\-PoS excludes the blur from its learned target set, producing increasingly visible residuals and a PSNR decrease from43\.543\.5to31\.131\.1dB\. All residual panels use the same intensity gain\. On the corresponding clean image, the reconstruction PSNRs are62\.462\.4,27\.627\.6, and43\.943\.9dB for AE, VAE, and AE\-PoS, respectively\.
#### E\.7\.2Compared Models

Autoencoder architecture \(AE, AE\-PP, AE\-PoS\):The Stage\-0 encoder maps the RGB input to 128 channels using a stride\-22patch convolution, applies four residual blocks, and projects the result to a 9\-channel latent representation at half the input resolution\. This gives a latent\-to\-input dimensionality ratio of9​\(H/2\)​\(W/2\)/\(3​H​W\)=0\.759\(H/2\)\(W/2\)/\(3HW\)=0\.75\. The decoder mirrors the encoder and restores the original resolution using pixel shuffle\. Each residual block consists of LayerNorm, a1×11\\times 1expansion to twice the channel width, a3×33\\times 3depthwise convolution, a ReLU\-gated elementwise product between the two channel halves, and a1×11\\times 1projection back to the original width\. All convolutions are bias\-free, and the network uses neither attention nor encoder–decoder skip connections\. This is the architecture used in the AE and AE\-PP baselines\. Stage 1 applies the same design to the frozen 9\-channel Stage\-0 latent, using an overcomplete9→27→99\\to 27\\to 9mapping without changing the spatial resolution\.

Optimisation:Stage 0 is trained for250​k250\\mathrm\{k\}iterations using AdamW with a learning rate of10−310^\{\-3\}, zero weight decay, a batch size of44, and gradient clipping at1\.01\.0\. We use a two\-cycle cosine schedule with periods\[150​k,100​k\]\[150\\mathrm\{k\},100\\mathrm\{k\}\]and relative weights\[1,0\.5\]\[1,0\.5\]\. Stage 1 follows the same training schedule with a learning rate of10−410^\{\-4\}\.

VAE:As a pretrained baseline, we use the frozen Stable Diffusion KL\-f​8f8autoencoder\([Rombach et al\., 2022](https://arxiv.org/html/2609.28832#bib.bib44)\)with the MSE\-fine\-tuned decoder released assd\-vae\-ft\-mse\([Stability AI, 2022](https://arxiv.org/html/2609.28832#bib.bib45)\)\. It is evaluated deterministically through its 4\-channel latent representation, without training on our data\. Because its decoder was fine\-tuned using mean squared error, the checkpoint is well matched to our reconstruction\-error score\. The VAE contains83,653,86383\{,\}653\{,\}863parameters, compared with830,720830\{,\}720for AE and AE\-PP and1,665,2801\{,\}665\{,\}280for the complete two\-stage AE\-PoS\. It is therefore approximately101×101\\timeslarger than AE and50×50\\timeslarger than AE\-PoS\.

### E\.8Results

Tables[26](https://arxiv.org/html/2609.28832#A5.T26)and[27](https://arxiv.org/html/2609.28832#A5.T27)show that AE\-PP and AE\-PoS combine reliable detection of unseen degradations with high nominal reconstruction fidelity\. The visual comparisons in Figures[7](https://arxiv.org/html/2609.28832#A5.F7),[8](https://arxiv.org/html/2609.28832#A5.F8), and[6](https://arxiv.org/html/2609.28832#A5.F6)explain the contrasting behaviours\. Plain AE preserves fine image details but also reconstructs degraded inputs, resulting in weak anomaly separation\. VAE has substantially lower fidelity on nominal images and increasingly represents the low\-frequency blurred component as blur strengthens; under strong blur, it even reconstructs the degraded input more accurately than its clean counterpart, reversing the desired anomaly\-score ordering\. AE\-PoS instead preserves nominal content while excluding unseen degradations from its learned target set, causing them to appear as strong reconstruction residuals\.

This combination is particularly useful as a lightweight pre\-detection stage in mobile imaging pipelines\. When most captured images are already of sufficient quality, only those identified as degraded need to be passed to computationally expensive restoration networks, reducing the expected latency and energy consumption\.

ss

nominal![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_s.jpg)

AEVAEAE\-PoSs^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_out_ae.jpg)58\.3 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_out_vae.jpg)23\.6 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_out_aepos.jpg)46\.0 dBs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_res_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_res_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row1_res_aepos.png)
nominal![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_s.jpg)

s^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_out_ae.jpg)63\.3 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_out_vae.jpg)31\.1 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_out_aepos.jpg)37\.8 dBs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_res_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_res_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row2_res_aepos.png)
degraded![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_s.jpg)

s^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_out_ae.jpg)63\.7 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_out_vae.jpg)40\.1 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_out_aepos.jpg)27\.5 dBs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_res_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_res_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row3_res_aepos.png)
degraded![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_s.jpg)

s^\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_out_ae.jpg)61\.7 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_out_vae.jpg)29\.0 dB![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_out_aepos.jpg)25\.1 dBs−s^s\-\\hat\{s\}![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_res_ae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_res_vae.png)![Refer to caption](https://arxiv.org/html/2609.28832v1/images/row4_res_aepos.png)

Figure 8:Nominal fidelity and degradation rejection\.For each inputss, the figure shows the reconstructions^\\hat\{s\}, its PSNR, and the absolute residual\|s−s^\|\\lvert s\-\\hat\{s\}\\rvertfor AE, VAE, and AE\-PoS\. From top to bottom, the examples are a nominal Kodak24 image, a nominal GoPro frame, its motion\-blurred counterpart, and a rainy Test2800 image\. AE reconstructs both nominal and degraded inputs almost identically, providing high fidelity but weak anomaly separation\. VAE loses substantial detail on nominal images and represents the motion\-blurred input more accurately\. AE\-PoS preserves nominal image content while excluding motion blur and rain from its learned target set, thereby exposing these degradations in the residual\. All residual panels use the same intensity gain\.

## Appendix FTransferable ECG Representations

Task and baselines:Clinical annotation of 12\-lead ECG recordings requires expert interpretation, whereas large collections of unlabelled recordings are readily available\. We therefore evaluate whether nested representation learning improves a self\-supervised ECG encoder before downstream linear probing\. We compare with the published results of ECG\-CPC\([Al\-Masud et al\., 2026](https://arxiv.org/html/2609.28832#bib.bib27)\), ECG\-FM\([McKeen et al\., 2025](https://arxiv.org/html/2609.28832#bib.bib25)\), MERL\([Liu et al\., 2024](https://arxiv.org/html/2609.28832#bib.bib26)\), and ST\-MEM\([Na et al\., 2024](https://arxiv.org/html/2609.28832#bib.bib24)\)\.

Depth\-controlled architecture:ST\-MEM learns ECG representations by reconstructing masked portions of 12\-lead recordings\. For a capacity\-controlled comparison, Stage 0 follows the ST\-MEM design but reduces its encoder from 12 to six Transformer blocks, while retaining the original four\-block decoder and standard masking ratio of75%75\\%\. After pretraining, the Stage\-0 encoder is frozen, and Stage 1 applies a second six\-block\-encoder, four\-block\-decoder network of the same form to its latent representation using masked latent reconstruction\. The resulting nested encoder therefore has a total depth of 12 blocks, matching the original ST\-MEM backbone while distributing learning across two successive stages\.

Pretraining data:Both stages use the same unlabelled pretraining pool: 34,808 recordings from Ningbo\([Zheng et al\., 2022](https://arxiv.org/html/2609.28832#bib.bib28);[Pollard et al\., 2026](https://arxiv.org/html/2609.28832#bib.bib73);[Zheng et al\., 2020](https://arxiv.org/html/2609.28832#bib.bib72)\)and 130,164 recordings from CODE\-15\([Ribeiro et al\., 2021](https://arxiv.org/html/2609.28832#bib.bib29)\), giving 164,972 recordings in total\. Each signal is high\-pass filtered at0\.67​Hz0\.67\\,\\mathrm\{Hz\}, low\-pass filtered at40​Hz40\\,\\mathrm\{Hz\}, standardized independently, resampled to250​Hz250\\,\\mathrm\{Hz\}, and cropped to 2250 samples\. Stage 1 is trained only on representations of this same pretraining pool, so no additional ECG data are introduced after Stage 0\.

Pretraining:For both stages, we use AdamW with learning rate3\.75×10−53\.75\\times 10^\{\-5\}, weight decay0\.050\.05, and\(β1,β2\)=\(0\.9,0\.95\)\(\\beta\_\{1\},\\beta\_\{2\}\)=\(0\.9,0\.95\)\. Training uses a batch size of6464, gradient clipping at norm1\.01\.0, and150,000150\{,\}000update steps\. The learning rate is warmed up linearly for15,00015\{,\}000steps and then follows cosine decay to10−610^\{\-6\}\.

Downstream protocol:We use the data splits and frozen\-encoder linear\-probe protocol of[Liu et al\. \(2024\)](https://arxiv.org/html/2609.28832#bib.bib26)\. All pretrained parameters are frozen, and only a single linear classification layer is optimized using binary cross\-entropy and Adam with learning rate10−310^\{\-3\}, weight decay10−410^\{\-4\}, batch size1616, and100100training epochs\. The learning rate is multiplied by0\.10\.1after epoch4040\. The checkpoint with the highest validation AUROC is selected, and its test AUROC is reported\. Table[7](https://arxiv.org/html/2609.28832#S4.T7)uses the complete labelled training split and reports the mean over five seeds\. The downstream tasks are the PTB\-XL superclass, subclass, form, and rhythm tasks\([Wagner et al\., 2020](https://arxiv.org/html/2609.28832#bib.bib30)\), together with ICBEB/CPSC\-2018\([Perez Alday et al\., 2022](https://arxiv.org/html/2609.28832#bib.bib31)\)\.

Results:As shown in Table[7](https://arxiv.org/html/2609.28832#S4.T7), Stage 1 improves upon Stage 0 on all five downstream tasks and obtains the highest AUROC in every column among the compared methods\. Because the two\-stage encoder has the same total depth as the original eight\-layer ST\-MEM backbone, this comparison indicates that the gain arises from successive refinement of the frozen Stage\-0 representation rather than from increasing total encoder depth alone\.

## Appendix GExpanded Limitations and Future Directions

The first limitation is that the geometry is defined relative to the reconstruction metricdd, which we fix to pixelℓ2\\ell\_\{2\}distance to isolate the representation\-learning question\. Consequently, anomalies that remain close to the nominal union under this metric can be difficult to distinguish\. Digit 9 illustrates this limitation in the\{4,5,7\}\\\{4,5,7\\\}experiment, where87%87\\%of its samples are detected by neither score, while the gap between AE\-PoS and transformation\-based methods on CIFAR\-100 indicates that this issue becomes more pronounced for semantically complex data\. Learning task\-appropriate metrics or deriving anomaly scores directly from the multilevel geometry, while preserving the metric conditions required by Lemma 1, is therefore an important direction for future work\. The second limitation is that the number of nested carving levels is currently selected manually\. The nested range relation suggests a label free stopping criterion based on the fraction of perturbed held out nominal samples whose reconstructions continue to violate the Push margin at levelℓ\\ell\. Whether this quantity can reliably determine when the current range requires further carving, without access to anomaly examples, remains the main open question for automatically constructing the nested architecture\. The present analysis characterizes representation dynamics relative to nominal data, for which nonlinear orthogonal projection onto the learned unionℳ\\mathcal\{M\}provides the ideal representation\. For anomalous inputs outside the reach ofℳ\\mathcal\{M\}, the nearest nominal point need not be unique, and direct projection ontoℳ\\mathcal\{M\}therefore does not generally define an ideal representation\. We conjecture that important families of structured anomalies, such as specific ECG abnormalities, may lie on or near isometric images\{Φγ​\(ℳ\)\}γ∈Γ\\\{\\Phi\_\{\\gamma\}\(\\mathcal\{M\}\)\\\}\_\{\\gamma\\in\\Gamma\}of the nominal union\. Future work will investigate conditions under which an identifiable inverse transformationΦγ−1\\Phi\_\{\\gamma\}^\{\-1\}maps each anomalous input back to or within the reach ofℳ\\mathcal\{M\}, so thatPℳ∘Φγ−1P\_\{\\mathcal\{M\}\}\\circ\\Phi\_\{\\gamma\}^\{\-1\}provides a unique canonical representation andΦγ∘Pℳ∘Φγ−1\\Phi\_\{\\gamma\}\\circ P\_\{\\mathcal\{M\}\}\\circ\\Phi\_\{\\gamma\}^\{\-1\}realizes nonlinear orthogonal projection onto the corresponding structured anomalous manifoldΦγ​\(ℳ\)\\Phi\_\{\\gamma\}\(\\mathcal\{M\}\)\.