Scalable, Explainable and Provably Robust Anomaly Detection with One-Step Flow Matching

TL;DR

This paper tackles scalable, interpretable, semi-supervised anomaly detection in high-dimensional tabular data by reframing flow matching as Time-Conditioned Contraction Matching (TCCM). It learns a time-conditioned velocity field that contracts normal samples toward the origin, enabling a fast one-step anomaly score in input space and intrinsic feature-level explanations. Theoretical results establish Lipschitz-based robustness and discriminative behavior under distributional shift, while extensive experiments on 47 ADBench datasets show state-of-the-art AUROC/AUPRC and superior inference efficiency compared with diffusion- and graph-based baselines. The approach avoids adversarial training and trajectory simulation, offering a stable, reproducible, and scalable solution with practical applicability to real-time anomaly detection. These properties position TCCM as a principled, interpretable, and robust alternative for large-scale anomaly detection in business-critical domains.

Abstract

We introduce Time-Conditioned Contraction Matching (TCCM), a novel method for semi-supervised anomaly detection in tabular data. TCCM is inspired by flow matching, a recent generative modeling framework that learns velocity fields between probability distributions and has shown strong performance compared to diffusion models and generative adversarial networks. Instead of directly applying flow matching as originally formulated, TCCM builds on its core idea -- learning velocity fields between distributions -- but simplifies the framework by predicting a time-conditioned contraction vector toward a fixed target (the origin) at each sampled time step. This design offers three key advantages: (1) a lightweight and scalable training objective that removes the need for solving ordinary differential equations during training and inference; (2) an efficient scoring strategy called one time-step deviation, which quantifies deviation from expected contraction behavior in a single forward pass, addressing the inference bottleneck of existing continuous-time models such as DTE (a diffusion-based model with leading anomaly detection accuracy but heavy inference cost); and (3) explainability and provable robustness, as the learned velocity field operates directly in input space, making the anomaly score inherently feature-wise attributable; moreover, the score function is Lipschitz-continuous with respect to the input, providing theoretical guarantees under small perturbations. Extensive experiments on the ADBench benchmark show that TCCM strikes a favorable balance between detection accuracy and inference cost, outperforming state-of-the-art methods -- especially on high-dimensional and large-scale datasets. The source code is available at our GitHub repository.

Figures (23)

• Figure 1: Core idea of TCCM: TCCM learns a time-conditioned velocity (vector) field that contracts normal data points, sampled from a source distribution $\rho_{\text{source}}$, towards a degenerate target distribution $\rho_{\text{target}}$, defined as a Dirac delta at the origin. At test time, anomalies are detected by measuring inconsistency with this learned contraction field. Illustrative examples: We visualize TCCM behavior on synthetic 2D datasets with varying normal (circles) and anomalous (squares) distributions. Left: Normal data form a ring; anomalies are sampled from a central Gaussian. Middle: Normals follow an upper moon; anomalies form a sparse lower moon. Right: Normals are clustered bottom-left; anomalies are drawn from a distinct Gaussian in the top-right. In all cases, TCCM successfully distinguishes anomalies based on their deviation from the expected contraction vector.
• Figure 2: Box plots of detector rankings based on AUPRC and AUROC scores across 47 datasets. Medians are marked by horizontal lines; means are shown as numbers.
• Figure 3: Mean run time (in seconds) across large-scale datasets for TCCM and other top-performing baselines in detection accuracy.
• Figure 4: Illustrative examples of anomalous images and their explanations, where digit '1' is treated as the normal class and digit '7' as the anomaly. The highlighted regions correspond to structural differences between '7' and '1', which the model identifies as key contributors to the anomaly score.
• Figure 5: Sensitivity of TCCM to the number of training epochs. For each dataset, we evaluate AUROC and AUPRC across a wide range of epoch values. Results show a stable plateau on most datasets (e.g., Pima, Ionosphere, Musk, InternetAds), where performance converges early and further training offers minimal gain but adds runtime cost. A similar plateau also appears on magic.gamma and mammography, albeit with minor fluctuations. On some datasets (e.g., satimage), excessive training leads to overfitting, while others (e.g., Wilt) exhibit stronger fluctuations, reflecting less stable convergence. These findings highlight that: for most datasets, TCCM does not rely on finely tuned epoch numbers and remains robust once a reasonable training horizon is reached.

Theorems & Definitions (9)

• Proposition 1: Lipschitz Continuity and Robustness
• proof
• Proposition 2: Discriminative Power under GMM-to-GMM Shift
• Proposition 3: Discriminative Power under Gaussian-to-Gaussian Shift
• proof
• Proposition 4: Discriminative Power under GMM-to-Gaussian Shift
• proof
• Proposition 5: Namely Proposition \ref{['prop:gmm_shift_main']}, Discriminative Power under GMM-to-GMM Shift
• proof