{"id":"658ad169-be76-4d82-8077-fb82516d68db","arxiv_id":"2411.14509","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"An end-to-end convolutional autoencoder plus a convolutional alarm network, trained jointly on reconstruction and classification losses, achieves near-state-of-the-art anomaly detection AUC on MNIST, Fashion-MNIST, CIFAR-10, and several tabular datasets.","lead":"This paper combines two anomaly-detection ideas: reading the internal activations of an autoencoder to spot unusual patterns, and using the autoencoder's reconstruction error, all in one trained network. It reports high accuracy on image and tabular benchmarks, though the strongest comparisons use an advantage that the earlier methods did not have.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 3.3's masked reconstruction does not keep the encoder trained only on normal data: BCE gradients flow into the encoder via the alarm network, so reported image gains may reflect supervised leakage rather than an activation-anomaly signal.","rationale":"The paper's central claim requires that jointly training a convolutional target autoencoder and alarm network with Eq. 2 yields superior anomaly detection. For that claim to hold, the target network must retain the A3 property that its activations separate anomalies, and this property must survive the joint training described in Section 3.3. The manuscript itself undermines this premise: it says the reconstruction loss is zeroed for anomalies 'to align with the assumptions of A3,' but then explicitly gives the encoder the power to readjust its weights for the classification task. Since BCE gradients flow back through the alarm network into the encoder, anomalous labels directly influence target weights on anomalous inputs. That is not merely a comparison-fairness issue; it changes what the encodings represent. The near-perfect image results are consistent with standard supervised feature learning, where the encoder is trained to make anomalous inputs discriminable, rather than with activation anomaly analysis of a normal-only target model. An ablation that detaches the BCE gradient at the alarm input would separate these mechanisms: if the detached variant performs similarly, the concern is resolved; if not, the paper's claim must be reframed as a supervised method and re-evaluated against supervised baselines. The reader's weakest assumption identified the same spot, so my reading agrees; the CONDITIONAL verdict remains appropriate pending this ablation, and I do not move the verdict.","tokens_in":8903,"tokens_out":5168,"duration_ms":49776,"concrete_test":"Implement a detached variant: compute alarm-network inputs from encoder activations but apply stop-gradient (e.g., .detach()) to those activations before computing the BCE loss, while keeping the reconstruction masking, hyperparameters, and data splits identical to the paper. Run the one-vs-all protocol on CIFAR-10 and MNIST and compare AUC with the paper's end-to-end numbers and with an A3-style two-phase baseline. If the detached variant loses most of the reported margin (e.g., CIFAR-10 mean falls from ~0.92 toward the ~0.65 unsupervised level), the BCE-to-encoder gradient path is the source of the gains; if it remains close, the end-to-end gradient flow is not load-bearing.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on the A3 premise that the target encoder is trained only on normal data, so its activations expose anomalies. Section 3.3 (Eq. 2) states: 'To make sure we align with the assumptions of the A3 framework by not feeding the autoencoder with anomalous samples, we put the reconstruction loss as 0 for these observations.' The next sentence, however, says: 'This way we give the encoder the power to readjust its weights with regard to the classification task.' Because the alarm network consumes encoder activations, zeroing the reconstruction term on anomalies does not prevent BCE gradients from reaching the encoder; anomalous examples still pass through the encoder and update its weights. The target model is therefore not trained only on normal data, and the A3 activation-anomaly assumption is violated during end-to-end training. On image benchmarks, where the baselines are unsupervised, the near-perfect AUC (e.g., 0.99 on MNIST, 0.92 on CIFAR-10) may be driven by supervised label information flowing into the encoder rather than by preserved activation patterns. The paper does not isolate this gradient path experimentally, so the central superiority claim is unsupported as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes E2E-ConvA3, an end-to-end convolutional extension of the A3 activation anomaly analysis method. The architecture combines a convolutional variational autoencoder as a target network and a CNN alarm network that classifies stacked convolutional activations; the total loss in Eq. (2) sums reconstruction MSE and binary cross-entropy weighted by gamma. For tabular data, a soft-ordering linear layer creates a pseudo-structure so that 1D convolutions can be applied. Experiments on MNIST, Fashion-MNIST, CIFAR-10 and several tabular datasets report AUC-ROC values that often exceed published baselines, with very high scores on image data. The authors argue that the joint end-to-end loss improves versatility and that the lightweight CNN design yields strong and consistent anomaly detection performance.","tokens_in":9116,"tokens_out":2483,"duration_ms":25856,"significance":"If the reported results held under a fair comparison, the paper would offer a simple, lightweight supervised anomaly detection architecture that works across image and tabular data, extending the A3 line of work. The use of convolutional activations with channel-wise concatenation and soft-ordering for tabular data is a sensible engineering contribution, and the paper is clearly written in its architectural description. However, the significance is conditional on resolving a serious evaluation issue: the method uses anomaly labels during training through the BCE term, while the main image baselines are unsupervised, and the target encoder is not actually trained only on normal data despite the stated A3 assumption. Because the empirical superiority claim depends on this comparison, the present evidence does not yet support the paper's central claim.","major_comments":[{"comment":"The claim that the autoencoder is not fed anomalous samples is inaccurate as stated. Setting the reconstruction loss to zero for anomalous observations removes only the reconstruction gradient, but the BCE term depends on the alarm network's output, which is computed from encoder activations; therefore BCE gradients flow into the encoder for both normal and anomalous samples. The following sentence in Section 3.3 explicitly says the encoder can 'readjust its weights with regard to the classification task.' This means the target encoder is not trained only on normal data, so the A3 activation-anomaly assumption is violated during end-to-end training. Since Table 1 reports near-perfect image AUCs against unsupervised baselines, the gains may be driven by supervised label information reaching the encoder rather than by preserved activation patterns. The authors should isolate this path, for example by freezing the encoder after normal-only pretraining and training only the alarm network, or by blocking BCE gradients from reaching the encoder, and report both variants.","section":"Section 3.3, Eq. (2)"},{"comment":"The comparison on image datasets is not apples-to-apples. The baselines DSVDD, MKD-AD, and DASVDD are unsupervised one-class methods trained only on normal data, whereas E2E-ConvA3 uses anomaly labels during training through the BCE loss in Eq. (2). The large AUC differences, for example 0.998 vs. 0.948 mean on MNIST and 0.917 vs. 0.648 mean on CIFAR-10, may simply reflect access to labels rather than a better activation-anomaly mechanism. The paper should compare against supervised or semi-supervised anomaly detection baselines that also receive anomaly labels, or explicitly reposition the contribution as a supervised anomaly detection method and adjust the claims accordingly.","section":"Table 1 and Section 4.2.1"},{"comment":"The claim of a 'best of both worlds' improvement from combining reconstruction loss and alarm classification loss is not supported by any ablation. The experiments only report gamma = 1 and gamma = 10; there is no gamma = 0 (alarm network only), no reconstruction-only variant, and no A3-style two-phase training with the same convolutional architecture. Without these conditions, the reader cannot tell whether the joint loss, the convolutional architecture, or simply the use of labels drives the reported results. Adding ablations and reporting the gamma sensitivity would directly test the paper's central architectural claim.","section":"Section 5 and Tables 1-2"}],"minor_comments":[{"comment":"The soft-ordering split factor k and the full architectural hyperparameters (number of layers, kernel sizes, strides, latent dimension) are not specified, which makes reproduction difficult without code.","section":"Section 4.1.2 and Table 2"},{"comment":"For the tabular baselines, only point estimates are given for several methods (NN classifier, Isolation Forest, A3), while E2E-ConvA3 is reported with standard deviations; adding variance or confidence information for all methods would make the comparisons more informative.","section":"Table 2"},{"comment":"The text says CIFAR-10 contains 50,000 training images, but the standard split is 50,000 training and 10,000 test; the notation 'CIF AR-10' also contains a typo.","section":"Section 4.1.1"},{"comment":"The description of the gamma hyperparameter as 'the amount of information allowed to flow through one of the components relative to the other' is vague; a more precise statement that gamma trades reconstruction error against classification loss would be clearer.","section":"Section 3.3"},{"comment":"There are several typographical and formatting issues, including 'auxilliary', 'T able', 'perofrmance', and inconsistent use of 'CIFAR-10' vs. 'CIF AR-10'; these should be corrected.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The core issue is the supervised-to-unsupervised comparison in Table 1 combined with the BCE gradient path into the encoder in Section 3.3. I do not see evidence of intentional misconduct, but the paper as written overstates its empirical support. The authors could address this by reframing the method as supervised anomaly detection, adding appropriate supervised baselines, and including the suggested ablations. If those experiments contradict the current claims, the conclusion may need to be weakened substantially."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What's actually new: the paper genuinely extends A3 by using a convolutional target VAE and a convolutional alarm network over stacked activation maps, with joint end-to-end training of reconstruction and classification losses, and a soft-ordering trick to make tabular data amenable to convolutions. That combination is not in the cited A3 follow-ups. The image results look excellent on the surface, and the tabular results are respectable. The authors also give a fair summary of the prior work and do not oversell the tabular gains.\n\nThe soft spot is the evaluation design, and it is load-bearing. On images, E2E-ConvA3 is trained with anomaly labels through the BCE term, while the baselines (DSVDD, MKD-AD, DASVDD) are unsupervised. The near-perfect AUC numbers on MNIST and Fashion-MNIST and the large CIFAR-10 improvements are therefore not apples-to-apples. On tabular data, where supervised baselines exist, the gains over A3 and DevNet are small or overlapping -- which suggests the method is fine but not a leap.\n\nThe stress-test note holds up on reading. Section 3.3 says the reconstruction loss is zeroed for anomalies to 'not feed the autoencoder with anomalous samples,' but the encoder is still fed those samples and BCE gradients flow through the alarm network into the encoder. So the target network is not trained only on normal data, and the A3 activation-anomaly assumption is violated. The authors even state they give the encoder power to readjust weights with regard to the classification task. The paper never isolates whether the gains come from preserved activation patterns or simply from the supervised gradient path.\n\nOther weaknesses: no architecture or training details (hidden sizes, depths, learning rates), no code, no A3 baseline on images, and no ablation of the reconstruction term or the gamma parameter. These are addressable, but they make the current claims hard to verify.\n\nThis paper is for a reader working on supervised one-class anomaly detection who wants a single architecture that handles images and tabular data. It is a plausible engineering contribution, not a field re-organizer. I would send it to peer review because the method is concrete and the issues are fixable, but a referee would need to demand stricter baselines and reproducibility details before it is publishable.","headline":"A plausible convolutional extension of A3 with strong claimed gains, but the image evaluation is supervised vs unsupervised baselines and the A3 normal-data premise is silently violated.","tokens_in":9706,"tokens_out":1226,"would_cite":false,"duration_ms":13139,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Jointly training a convolutional target autoencoder and an alarm network on a single combined loss outperforms the original A3 method and published baselines on both image and tabular anomaly-detection benchmarks.","keywords":["anomaly detection","convolutional autoencoder","activation anomaly analysis","end-to-end learning","soft-ordering","variational autoencoder","supervised anomaly detection","AUC-ROC"],"falsifier":"Reproduce the exact one-vs-all experiments of Table 1 with the same splits and the same $\\gamma$ values; if MNIST mean AUC does not land near the reported 0.998-0.999 and CIFAR-10 near 0.917-0.919 with comparable variance, the claimed advantage does not replicate. The sharper test is to train a second version in which anomalous samples are withheld from the encoder entirely, the literal reading of Section 3.3, and compare: if performance drops, the reported results depend on exposing the encoder to anomalies rather than on activation-pattern analysis alone.","tokens_in":8615,"feed_emoji":"🛡️","tokens_out":9136,"duration_ms":75240,"temperature":0.7,"pith_summary":"The paper proposes E2E-CA3, a convolutional extension of the A3 anomaly-detection idea: a variational autoencoder reconstructs the input while an alarm network reads a stack of its layer activations and decides whether the sample is anomalous. The two networks are trained together on a single loss that adds the reconstruction error to a weighted classification loss, and for anomalous samples the reconstruction term is set to zero so the encoder can still adapt to the classification task. The authors claim this joint architecture is lightweight yet reaches or exceeds published baselines in AUC-ROC on image benchmarks (MNIST, Fashion-MNIST, CIFAR-10) and on several tabular datasets (KDDcup99, Credit Card, CelebA, Census-Income, Bank Marketing, Thyroid). If the claim holds, one simple supervised architecture can serve anomaly detection across very different data types without problem-specific feature engineering.","feed_headline":"Joint convolutional loss outperforms prior anomaly detectors","feed_subtitle":"A CNN pair joins reconstruction error to alarm classification and beats baselines on MNIST, CIFAR-10, KDDcup99.","key_machinery":"The object that carries the argument is the activation tensor stack: the target convolutional variational autoencoder's layer activations are concatenated along the channel dimension after being pooled to the smallest spatial size, forming a $k{+}1$-dimensional tensor that the alarm CNN classifies. The second load-bearing part is the joint loss of Eq. (2), which lets classification gradients flow back into the encoder while a hyperparameter $\\gamma$ balances reconstruction fidelity against alarm accuracy. For tabular data, a learned soft-ordering linear layer (with ELU) reshapes the feature vector into a structured 2D tensor so the same 1D convolutions apply; the decoder learns the reverse transformation. These two mechanisms together let a single architecture handle images and tables and are what the experiments evaluate.","core_discovery":"On its own terms, the paper's central discovery is empirical: jointly optimizing the target-network reconstruction and the alarm-network classification, with the reconstruction loss masked for anomalies, produces anomaly-detection scores that match or beat the original A3 and published baselines (MKD-AD, DSVDD, DASVDD, DevNet, MIX) on both images and tabular data. The architecture replaces the fully connected target and alarm networks of A3 with convolutional ones: the target is a convolutional variational autoencoder, and the alarm network is a CNN whose input is the channel-wise concatenation of the target's per-layer activations, pooled to a common spatial size. The combined objective is Eq. (2), $L(x,y,\\hat{x},\\hat{y}) = \\mathrm{MSE}(x,\\hat{x}) + \\gamma \\cdot \\mathrm{BCE}(y,\\hat{y})$, with $\\gamma=1$ or $\\gamma=10$ in the reported experiments. On MNIST the mean AUC reaches 0.9982-0.9986, on CIFAR-10 it reaches 0.917-0.919, and on the tabular KDDcup99 variants it reaches 0.999; the paper takes these results to show that a straightforward, parameter-sharing CNN pair is an effective and versatile anomaly detector.","pith_inferences":["The paper's Section 3.3 text says it avoids 'feeding the autoencoder with anomalous samples,' but the actual procedure feeds anomalies through the encoder and only zeroes their reconstruction loss; this discrepancy is never isolated, so the reader cannot tell from the paper whether anomaly exposure is essential to the reported gains.","Because the alarm network is supervised, the method needs labeled anomalous examples at training time; a direct comparison with unsupervised methods on the same benchmark would clarify how much of the advantage comes from this label access rather than from activation analysis.","A quick ablation experiment - train the same architecture with reconstruction loss active on anomalies, or with anomalies fully withheld from the encoder - would settle whether the joint loss or the masking choice drives performance."],"forward_implications":["If the reported AUC-ROC values reproduce, a single convolutional architecture can replace separate pipelines for image and tabular anomaly detection, since the only data-type-specific part is the soft-ordering reshape.","Because the alarm reads pooled activations from all layers, the approach naturally extends to 3D data (video or volumetric images) by pooling 3D activation tensors, which the paper mentions as a possibility.","The $\\gamma$ hyperparameter gives a direct trade-off: setting it higher biases the encoder toward features that help the alarm network, while lower values keep the target closer to a pure reconstruction model; the paper reports both $\\gamma=1$ and $\\gamma=10$ work similarly.","The low variance across 10 runs on most datasets suggests the method is stable under random initialization, which matters for deployment where retraining is frequent."],"supporting_citations":[{"why":"Defines the original A3 activation-anomaly approach that this paper extends and compares against.","marker":"[1]"},{"why":"DevNet is a tabular anomaly-detection baseline whose published results are used for comparison in Table 2.","marker":"[25]"},{"why":"MKD-AD is an image anomaly-detection baseline whose published AUC values are the main image comparison in Table 1.","marker":"[26]"},{"why":"MIX is a tabular baseline whose published results appear in Table 2 as a comparison.","marker":"[34]"},{"why":"DSVDD is a one-class image baseline whose published results are compared in Table 1.","marker":"[35]"},{"why":"DASVDD is a deep autoencoding image baseline whose published results are compared in Table 1.","marker":"[36]"},{"why":"Supplies the soft-ordering trick used to give tabular vectors a spatial structure suitable for 1D convolutions.","marker":"[37]"}],"fun_headline_variants":["Joint conv loss tops prior anomaly detectors on MNIST, CIFAR-10, KDD","Conv autoencoder plus CNN alarm nets beat baseline detectors","Reconstruction plus classification loss in CNN pair sets new SOTA","End-to-end conv anomaly analysis achieves high AUC across datasets","Joint loss conv detector matches or beats baselines on three benchmarks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a network trained only on normal samples produces activation patterns that are reliably different for anomalous inputs, and that this difference survives end-to-end training in which anomalous samples are passed through the encoder with their reconstruction loss set to zero.","fun_headline_variants_meta":{"raw":{"variants":["Joint conv loss tops prior anomaly detectors on MNIST, CIFAR-10, KDD","Conv autoencoder plus CNN alarm nets beat baseline detectors","Reconstruction plus classification loss in CNN pair sets new SOTA","End-to-end conv anomaly analysis achieves high AUC across datasets","Joint loss conv detector matches or beats baselines on three benchmarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001261,"raw_usage":{"total_tokens":5192,"prompt_tokens":999,"completion_tokens":4193,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":615,"completion_tokens_details":{"reasoning_tokens":4103}},"tokens_in":615,"tokens_out":4193,"duration_ms":26894,"temperature":1.0,"reasoning_tokens":4103,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:38:56.578449+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Reproduce the exact one-vs-all experiments of Table 1 with the same splits and the same $\\gamma$ values; if MNIST mean AUC does not land near the reported 0.998-0.999 and CIFAR-10 near 0.917-0.919 with comparable variance, the claimed advantage does not replicate. The sharper test is to train a second version in which anomalous samples are withheld from the encoder entirely, the literal reading of Section 3.3, and compare: if performance drops, the reported results depend on exposing the encoder to anomalies rather than on activation-pattern analysis alone.","supporting_citations":[{"cited_title":"Sperl, J.P","cited_arxiv_id":null,"evidence_quote":"Defines the original A3 activation-anomaly approach that this paper extends and compares against."},{"cited_title":"Salehi, N","cited_arxiv_id":null,"evidence_quote":"MKD-AD is an image anomaly-detection baseline whose published AUC values are the main image comparison in Table 1."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"MIX is a tabular baseline whose published results appear in Table 2 as a comparison."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DSVDD is a one-class image baseline whose published results are compared in Table 1."}],"review_version":1}