Paper deep dive

RangeAD: Fast On-Model Anomaly Detection

Luca Hinkamp, Simon Klüttermann, Emmanuel Müller

Year: 2026Venue: arXiv preprintArea: cs.LGType: PreprintEmbeddings: 46

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%

Last extracted: 3/22/2026, 5:57:56 AM

Summary

RangeAD is a novel anomaly detection framework that operates 'on-model' by leveraging internal neuron activation ranges of a pre-trained primary machine learning model. By calculating normal activation intervals during a forward pass, it achieves high-performance anomaly detection with negligible computational overhead, outperforming traditional standalone AD methods in both accuracy and inference speed across tabular, image, and time-series datasets.

Entities (5)

Anomaly Detection · task · 100%RangeAD · algorithm · 100%Neural Network · model-architecture · 95%On-Model AD · framework · 95%OddBench · dataset · 90%

Relation Signals (3)

RangeAD → utilizes → Neuron Activation Ranges

confidence 100% · RangeAD, an algorithm that utilizes neuron-wise output ranges derived from the primary model.

RangeAD → implements → On-Model AD

confidence 95% · Our instantiation of On-Model AD, which we name RangeAD, requires the following metrics

RangeAD → performsbetterthan → Autoencoder

confidence 90% · Our method achieves the highest AUC-ROC most often on the datasets compared to the competitors.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:In practice, machine learning methods commonly require anomaly detection (AD) to filter inputs or detect distributional shifts. Typically, this is implemented by running a separate AD model alongside the primary model. However, this separation ignores the fact that the primary model already encodes substantial information about the target distribution. In this paper, we introduce On-Model AD, a setting for anomaly detection that explicitly leverages access to a related machine learning model. Within this setting, we propose RangeAD, an algorithm that utilizes neuron-wise output ranges derived from the primary model. RangeAD achieves superior performance even on high-dimensional tasks while incurring substantially lower inference costs. Our results demonstrate the potential of the On-Model AD setting as a practical framework for efficient anomaly detection.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

45,820 characters extracted from source content.

Expand or collapse full text

RangeAD: Fast On-Model Anomaly Detection Luca Hinkamp 1 () [0009−0004−1547−1590] , Simon Klüttermann 1[0000−0001−9698−4339] , and Emmanuel Müller 1,2[0000−0002−5409−6875] 1 TU Dortmund University, Dortmund, Germany luca.hinkamp, simon.kluettermann, emmanuel.mueller@cs.tu-dortmund.de 2 Research Center Trustworthy Data Science and Security, UA Ruhr, Germany Abstract. In practice, machine learning methods commonly require anomaly detection (AD) to filter inputs or detect distributional shifts. Typically, this is implemented by running a separate AD model along- side the primary model. However, this separation ignores the fact that the primary model already encodes substantial information about the tar- get distribution. In this paper, we introduce On-Model AD, a setting for anomaly detection that explicitly leverages access to a related machine learning model. Within this setting, we propose RangeAD, an algorithm that utilizes neuron-wise output ranges derived from the primary model. RangeAD achieves superior performance even on high-dimensional tasks while incurring substantially lower inference costs. Our results demon- strate the potential of the On-Model AD setting as a practical framework for efficient anomaly detection. Keywords: Anomaly Detection· Outlier Detection· On-Model ML. 1 Introduction Machine learning (ML) has become a cornerstone of modern software systems; however, the transition from controlled experimental settings to practical, real- world deployment requires robust safeguards. Anomaly Detection (AD) is critical to this transition, acting as a gatekeeper for system reliability [38,17]. The ne- cessity of AD in production environments is driven by three primary challenges. First, the principle of "garbage in, garbage out" dictates that models perform unpredictably when fed corrupted or irrelevant data; AD serves as a crucial fil- ter to reject such inputs before they degrade system performance [11]. Second, real-world environments are non-stationary. As data distributions evolve (a phe- nomenon known as concept drift), AD allows systems to detect when current inputs no longer match the training distribution, signaling the need for adapta- tion [22]. Finally, standard ML models are typically optimized for the average case and suffer from underspecification when facing "black swan" events or out- liers. AD acts as a safety mechanism to identify and handle these edge cases where model guarantees fail [8]. Despite these necessities, integrating AD into production pipelines remains challenging. Typically, AD is deployed as a secondary system running alongside arXiv:2603.17795v1 [cs.LG] 18 Mar 2026 2L. Hinkamp et al. the primary predictive model. This duality increases computational overhead and introduces a risk of misalignment, where the AD model’s definition of "normal" does not perfectly map to the primary model’s operational domain. Further- more, traditional AD methods are often hindered by the curse of dimensional- ity [2], which limits the complexity of inputs they can handle effectively. Per- haps most critically, the fundamental unknowability of future anomalies makes hyperparameter tuning and model selection a near-impossible task; optimizing for known anomalies often fails to generalize to unforeseen contingencies encoun- tered in the wild [29,19]. These limitations are compounded by the high runtime of many state-of-the-art AD algorithms, which renders them unsuitable for real- time applications such as user input verification or high-frequency time-series monitoring [9]. To address these challenges, we introduce RangeAD, a novel framework that provides highly accurate, application-specific anomaly scores with close-to-zero- shot computational overhead. Our key insight is that the predictive model al- ready contains the information needed to identify anomalies. By exploiting the activation ranges of neurons within the trained model, we can derive a robust in- dication of "anomalousness" without the need for an external detector. Because these activation ranges are intrinsic to the primary model, they naturally align with the application’s specific goals. Crucially, these statistics can be calculated during the standard forward pass of the model, resulting in negligible additional time cost. Our main contributions are as follows: – We introduce the On-Model AD setting, a framework for ML-ready anomaly detection that bridges the gap between theoretical AD and practical deploy- ment. – We propose the RangeAD algorithm, which leverages internal neural acti- vation ranges to detect anomalies in real-time. – We provide a comprehensive ablation study to validate our design choices and demonstrate the efficacy of our method against current baselines. To facilitate reproducibility and further research, our code is available at anonymous.4open.science/r/RangeAD. 2 Related Work Anomaly Detection (AD) is a long-standing and widely studied problem in ma- chine learning, with a rich body of literature spanning classical statistical meth- ods, modern machine learning approaches, and deep learning-based techniques. Its importance in practical machine learning systems has been repeatedly empha- sized in the literature [40]. Numerous surveys provide comprehensive overviews of the field and its methodological diversity [38,9,13,33]. AD plays a critical role across a wide range of application domains, including fraud detection [15,48], industrial and machine fault detection [10,31,35], and scientific data analysis such as particle physics experiments [30,7]. In many real-world systems, anomaly RangeAD: Fast On-Model Anomaly Detection3 detection operates alongside other machine learning components to ensure reli- ability, robustness, and safety. In practice, anomaly detection frequently serves as a monitoring mechanism for machine learning systems deployed in sensitive domains such as health- care [18], Internet-of-Things (IoT) infrastructures [1], and financial monitoring systems [15]. In these settings, predictive models are typically trained to per- form domain-specific tasks (e.g., diagnosis, forecasting, or classification), while anomaly detection is implemented as a separate component tasked with iden- tifying abnormal inputs or system behavior. However, these two systems are commonly developed independently, even though they operate on the same data streams and often rely on related representations. As a consequence, the anomaly detector may fail to fully exploit the information already learned by the primary model, potentially leading to inefficiencies or misalignment between the anomaly detection objective and the model’s operational domain. A central challenge in anomaly detection is the scarcity or complete absence of labeled anomaly samples. Most AD methods operate in an unsupervised or semi-supervised setting where only normal data is available during training. It is well established that even small amounts of labeled information can significantly improve detection performance by guiding the model toward the most informa- tive subspaces of the data [51,38,13]. Motivated by this observation, we propose the On-Model AD setting, which leverages the presence of a supervised model trained for a related task. Although the supervised model itself is not trained for anomaly detection, it encodes task-relevant structure that can provide valuable guidance for identifying abnormal inputs. This intuition is supported by prior work on neural network representations. Deep neural networks are known to learn hierarchical feature representations, where deeper layers capture increasingly abstract and task-relevant informa- tion [49]. Several approaches have exploited this property by applying classical anomaly detection algorithms to the learned representations of neural networks rather than the raw input space [47,41]. Such approaches can significantly im- prove the performance of traditional AD algorithms on high-dimensional and complex datasets, as the learned embeddings often provide a more structured representation of the data. However, representation-based approaches typically suffer from several limi- tations. Many methods rely on extracting a low-dimensional embedding from the supervised model, which can constrain the information available to the anomaly detector and require architectural modifications or additional training proce- dures. Furthermore, these approaches often assume strong alignment between the supervised task and the anomalies of interest, which may not hold in prac- tice. They also typically rely on accessing only a small subset of internal repre- sentations, limiting the amount of information that can be exploited from the trained model. Our work takes inspiration from a different property of neural networks: the phenomenon of dead neurons in networks with rectified linear unit (ReLU) activations [28]. During training, some neurons become permanently inactive 4L. Hinkamp et al. because their inputs never enter the positive activation regime. More broadly, the learned weights and the distribution of training data implicitly constrain the range of activation values that neurons can produce under normal operating conditions, even when using alternative activation functions. This observation suggests that each neuron implicitly defines a feasible activation range deter- mined by the training data and model parameters. Deviations from these learned ranges, therefore, provide a natural signal for detecting anomalous inputs. Building on this insight, our proposed method leverages activation ranges throughout the network to detect anomalies directly during the forward pass of a trained model. Unlike approaches that train a separate detector or rely on specialized representations, our framework integrates anomaly detection into the predictive model itself. This enables extremely efficient detection with neg- ligible computational overhead while simultaneously leveraging the task-specific knowledge already captured by the pretrained model. As a result, our approach bridges the gap between standalone anomaly detection systems and the predic- tive models they are meant to safeguard. 3 Methodology 3.1 On-Model Anomaly Detection We consider the following scenario: We assume a typical machine learning prob- lem, e.g., a classification problem that is trained by applying a neural network to a set of normal data. During deployment, in addition to normal data, anoma- lies might also appear. Our method then tries to capture these anomalies using both normal data (one-class classification [39]) and the initial neural network’s weights. We consider anomaly detection algorithms that can benefit from addi- tional information through a trained neural network as On-Model Anomaly Detection. Given a neural network classifier f with pretrained parameters θ k i ∈ Θ for every neuron n k i from the layers l k ∈ L making up the network f and a dataset of normal samples x j ∈ X train , our method outputs score s(ˆx j ,X train ,f) ∈R that capture the probability of ˆx j ∈ X test being an anomaly. By using a threshold t, these scores s(ˆx j ,X train ,f) > t can then be converted to binary decisions with the label y ano ∈+1,−1 for being an anomaly or not. The proposed methodology comprises three distinct phases: training, prepara- tion, and inference. In the training phase, the initial neural network f is trained on, e.g., a classification problem with labeled data (x,y) ∈ X train . After that, metrics based on clean data, M(X prep ,f), are extracted from the trained net- work as preparations. With these, an anomaly score can be assigned to unknown test data during the inference phase. We note that X train and X prep can but must not be the same, however they should contain only uncontaminated data, while X test may contain anomalies. RangeAD: Fast On-Model Anomaly Detection5 3.2 RangeAD Our instantiation of On-Model AD, which we name RangeAD, requires the fol- lowing metrics M(X prep ,f): We take the idea that data considered to be normal, e.g., in-distribution, usually stays in a finite, determinable range of values, and everything outside is abnormal. While such a check only finds a limited num- ber of very severe anomalies, the same is true in subspaces of the data, such as those created by the outputs of various neurons in a trained neural net- work. By considering all neurons of a related neural network, we can thus gain a more decisive anomaly score that also benefits from setting specific idiosyn- crasies from the related network. So for every neuron n k i in every observed 3 layer l k we calculate the range of normal values in the neural networks fea- ture space as the interval in which clean data produces activation outputs as I normal (n k i ) = [Q(n k i (X prep ),σ),Q(n k i (X prep ), 1−σ)] where n k i (X prep ) is the dis- tribution of observed intermediate activation output of the neuron n k i generated in the forward pass of f(X prep ) and Q(·,σ) represents the σ-Quantile. While for σ = 0 we consider the maximum observed values, partially contaminated data makes using σ > 0 preferable. After the forward pass of test samples ˆx∈ X test , we check whether the activations lie outside the previously calculated ranges for all of the neurons. The anomaly score (s(ˆx)) for a sample ˆx is then the cardinality of activations lying outside the respective intervals. s(ˆx) = L X k N k X i Θ(n k i (ˆx) /∈ I normal (n k i )) Θ(True) = 1,Θ(False) = 0 (1) where Θ(·) is a function that returns 1 if the statement is true and 0 otherwise. A higher count of out-of-range activations indicates a greater likelihood that the sample is an anomaly. Figure 1 illustrates this process. To convert continuous anomaly scores into binary decisions, the default approach selects a threshold based on the expected number of anomalies in the test set [50]. When using RangeAD, we can also select a more intuitive threshold based on the fraction of observed neurons (e.g. 10%). 4 Evaluation In this section, we present a comprehensive empirical evaluation of our proposed anomaly detection framework. We benchmark our method against several base- lines across three distinct data modalities. For each experimental scenario, out- of-distribution (OOD) test sets are systematically curated by either introducing external anomalous samples or selectively filtering existing classes to ensure con- textually relevant detection challenges. In every experiment, our framework is built on a classification neural network trained on clean data (in-distribution) in 3 We do not consider every possible layer of the neural network, since e.g. ReLU or Pooling layers only represent degregated copies of previous layers. 6L. Hinkamp et al. l 1 l 2 ... l N (a) I normal (n 1 i ) I normal (n 2 i ) (b) Check intervals n 1 1 (x i )∈ I normal (n 1 1 ) n 1 2 (x i )∈ I normal (n 1 2 ) n 1 3 (x i )∈ I normal (n 1 3 ) ... (c) Fig. 1: Depiction of our proposed methodology. (a) represents the neural network, from which the sample activations per neuron are depicted in (b). From these distributions - to be considered normal - interval borders are derived. The activations produced for a new test input are then checked per neuron to see whether it falls inside the corresponding interval in (c). For every test sample x i the amount of feature-outputs lying outside of the corresponding interval indicates the anomaly grade of x i . the respective domain, and the detection performance is evaluated on a contam- inated testing dataset. Our primary experiments focus on tabular data, which remains a cornerstone of anomaly detection research. To demonstrate the versa- tility of our approach, we extend our evaluation to image and time-series classi- fication tasks. Finally, we conduct a detailed ablation study to assess the sensitivity of our method to various implementation choices and hyperparameters. For the vision and time series tasks, we took σ = 1%/0.1% quantiles to derive the interval borders from the activation distribution and the σ = 1% quantile for the tabular data, for which other variants are covered in the correspond- ing ablation study. To measure the efficiency of our algorithm, we separate the required runtime into three phases. Both the training and forward pass of the initial neural network occur whether we use it for on-model anomaly detection or not, and are thus ignored here. The training time of our method (computing M(X prep ,f)) occurs only once and is thus usually negligible in practice. Hence, we focus here on the inference time, as this represents the time required to clas- sify new samples and state the remaining times in the supplementary material. All experiments were performed using an Intel Xeon Gold 6258R CPU, 252 GB RAM, and a Nvidia Quadro RTX 6000 GPU with 24 GB VRAM. 4.1 Anomaly detection performance Tabular data The 12 tabular datasets are selected from OddBench [9] by taking all datasets with multiple normal classes and at least 30 features, for which our networks achieve at least 70% classification accuracy on the clean part of the test RangeAD: Fast On-Model Anomaly Detection7 RangeAD (100)RangeAD (500) RangeAD (1000) autoencoder icl ifor deepsvdd copod ecod hbos knn lof ocsvm sod cblof dte loda dean cof dagmm goad 0.4 0.6 0.8 1.0 AUC ROC AUC ROC Distribution over datasets per Competitor Mean Median Fig. 2: AUC-ROC of different anomaly detection methods over 12 tabular datasets. Our method is run three times with models having hidden-layer neuron counts of 100, 500, and 1000. It reaches the highest AUC-ROC on average compared to all competitors. data 4 . Thus, we take the "BaseballEvents", "CasePriority", "CreativeSchool- Certification", "FinanceJobCategories", "GamePositionAnomaly", "HousingVul- nerability", "NFLPerformanceAnomalies", "SentencingFraud", "TravelWeather- Scores", "TreeCondition", "WeatherUVIndex", and "WindowsEditionAnomaly" datasets, which each contain multiple normal classes in addition to anomalies. For our experiments, we train a simple three-layer Multilayer Perceptron (MLP) with ReLU as a non-linear activation function on the normalized, multi-class training data as a classifier. We employ hidden layers with 100, 500, and 1000 neurons to achieve diversity, roughly 2-50 times the dataset’s feature count. We take the outputs of the first two hidden dimensions (before ReLU activa- tion) for calculating the anomaly detection ranges. In the supplementary mate- rial, we compare alternative layer choices for our method. The neural networks are trained for 500 epochs with a learning rate of 0.001. While evaluating our anomaly detection method, we use the training dataset during the building phase and add the anomalous class to the test data for evaluation. We evaluate the proposed method mainly on runtime and the Area Under the Receiver Operating Characteristic Curve (AUC-ROC) and compare it with sev- eral other anomaly detection techniques from the literature on these two metrics across the same 12 tabular datasets. The competitors feature Autoencoder [42], CBLOF [14], COF [46], COPOD [23], Dagmm [52], Dean [6], DeepSVDD [39], DTE [27], ECOD [24], GOAD [3], HBos [12], ICL [44], Isolation Forest [25], k-Nearest Neighbour [36], LODA [34], LOF [5], OC-SVM [4] and SOD [20] pro- viding various angles on anomaly detection. The anomaly detection results can be seen in Figure 2. Our method achieves the highest AUC-ROC most often on the datasets compared to the competitors. Additionally, all three model sizes lead to an average AUC-ROC higher than 4 We filter for the performance of the related network, as we desire models that can be deployed in practice. 8L. Hinkamp et al. all competitors by a difference of 0.03 to the second-best approach (0.79 for our worst model compared to 0.76 for the autoencoder). In seven of the twelve datasets, the top AUC-ROCs were above 0.9, while our approach most often ranked among the top three competitors. In the remaining five datasets, our method achieved AUC-ROCs still in the better half of the methods compared. Having the highest average score across all competitors and all three model sizes shows that our approach is competitive with all the compared methods. We pro- vide a critical difference plot in the supplementary material. Figure 3 shows the results of the runtime evaluation. Our method has an average inference time of around 2 ms across all three model sizes, while the second-best competitor, an Autoencoder, is roughly 100 times slower. The fastest competitor, DeepSVDD, still needs almost double the runtime for an average in- ference pass over the test dataset, 3.7 ms. The results highlight the benefits of the on-model AD setting, as our method is the fastest and best-performing algo- rithm among those used. It outperformes the deep and slower methods detection wise and at the same time is faster than the lightweight competitors. Comparing the three hidden layer sizes, used in our method, the wider networks seem to perform better while naturally being a bit slower. This indicates a trade- off, which we will cover in more detail in the ablation study. 10 3 10 2 10 1 10 0 10 1 10 2 Time (s) 0.50 0.55 0.60 0.65 0.70 0.75 0.80 AUC ROC AUC ROC vs Inference Time for Different Models RangeAD (100) RangeAD (500) RangeAD (1000) autoencoder cblof cof copod dagmm dean deepsvdd dte ecod goad hbos icl ifor knn loda lof ocsvm sod Fig. 3: AUC-ROC and inference time of different anomaly detection methods averaged over 12 tabular datasets. Our method is run three times with models with hidden layer neuron counts of 100, 500, 1000. It achieves the highest detection performance while providing the fastest inference runtime of all competitors. We provide the same analysis on the training time in the supplementary material. RangeAD: Fast On-Model Anomaly Detection9 Vision Data While the previous section shows that our method achieves com- parable or even better performance to the competitors on relatively low-dimensional tabular data, we also aimed to evaluate on more complex scenarios. Therefore, we also conduct anomaly detection experiments on image data. Therefore, we take a modern Swin-v2-Vision Transformer [26] model pretrained on ImageNet- 1k (in-distribution) as our base network. The feature spaces from which the detection intervals are calculated are either taken after every GELU-Activation function call ("in") or after a whole Transfomer-Block ("after"). We note that all neurons could also be used at the cost of a higher memory usage, but for our experiments, the 17664/4416 neurons (GELU/Transformer-Block) were al- ready enough to perform well. We utilize the 100,000 ImageNet test images as the preparation dataset for building our anomaly detector. The test dataset to evalu- ate on consists of the whole Imagenette subset [16] (train+test) as in-distribution and two different datasets from domains that are not contained in ImageNet- 1k, as out-of-distribution, namely AstronomyImages [45] 5 and Ambivision [32], a dataset of animal-based optical illusions, to bring in multiple angles for the OOD-domain. We perform the evaluation on the two OOD-datasets, both sepa- rately and combined, and compare our method against an Autoencoder, Isolation Forest, and DeepSVDD, the top 3 competitors from the tabular experiment, ex- cluding ICL for computational reasons. Datasetin, 0.01 after, 0.01 in, 0.001 after, 0.001 IFAE DeepSVDD INet + Ambivision 0.9893 0.9923 0.9945 0.9937 0.9985 0.9472 0.8830 INet + SpaceImages 0.9625 0.9094 0.95920.909 0.4977 0.1864 0.6757 INet + both0.971 0.9355 0.9703 0.9357 0.6597 0.4266 0.6833 UrbanSound [43] 0.8804-0.9142-0.6939 0.8002 0.7927 Table 1: AUC-ROC of vision and time series tasks. "in" means in the network blocks, e.g. after GELU and Convolution-Layers; "after" means after the net- work blocks, e.g. Transformer-Block (vision-only). 0.01 and 0.001 is the quantile used. AE and DeepSVDD were trained with 10% of the INet testset for mem- ory reasons. Our method reaches the most reliable performance across high-dimensional datasets. The results from this experiment show that also in the vision anomaly detection task, our approach can compete with the baselines and even outperforms them in almost every setup. In Table 1 the AUC ROCs can be found. When taking Ambivision as the OOD-dataset, the Isolation Forest has an AUC ROC negligi- bly (0.004) higher than the best variant of our method, when taking activations after GELU output and using 0.1% quantile. Despite that, with the SpaceIm- age as OOD our using both OOD-Datasets, all variants of our method perform atleast 0.2 AUC ROC better than the competitors. Internally, the GELU-feature 5 Classes "cosmos space", "galaxies", "nebula" and "stars" were used as they provide the most similar photographs and ImageNet-1k does only contain very few space based images. 10L. Hinkamp et al. space tends to provide a better anomaly detection capability than the outputs at the end of the transformer-block. We discuss alternative layer choices in the supplementary material. The inference runtimes provide even better results of our method compared to the three competitors. Table 2 shows that our method takes roughly 0.014 seconds for performing inference. The Isolation Forest per- forms inference in roughly 0.8 seconds, over 50 times more than ours, while the two deep approaches take several minutes. Across the different variants tested for our method, there is almost no difference in runtime, whether the observed layers or the quantiles are varied, highlighting the scalability of RangeAD. Datasetin, 0.01 after, 0.01 in, 0.001 after, 0.001 IFAE DeepSVDD Inet + Ambivision 0.0151 0.0161 0.0131 0.0129 0.8197 240.9355 133.9441 Inet + SpaceImages 0.0131 0.012 0.0123 0.0129 0.8438 238.3285 138.8146 Inet + both0.0129 0.0126 0.0129 0.0136 0.8560 251.041 141.8705 UrbanSound [43] 0.0138-0.0103-0.0711 0.8833 0.5184 Table 2: Inference time in seconds of vision and time series tasks. "in" means in the network blocks, e.g. after GELU and Convolution-Layers; "after" means after the network blocks, e.g. Transformer-Block (vision-only). 0.01 and 0.001 are the quantiles used. AE and DeepSVDD were trained with 10% of the INet testset for memory reasons. Our method requires multiple orders of magnitude less runtime as it is not using an additional model. Time Series In addition to tabular and image data, we wanted to evaluate our method in a third domain to demonstrate its general applicability. We choose time-series data and use the UrbanSound dataset [43], which consists of 44.1kHz recordings of typical urban environments, for acoustic analysis. The dataset con- sists of ten classes representing common sounds from the urban area like children playing, dogs barking or construction site noise. Within this framework, gunshot sounds are designated as the OOD class, as they represent sparse, high-impact events that are naturally anomalous to the urban soundscape. This scenario is modeled using a temporal convolutional network (TCN) [21] coupled with an MLP classification head for classifying the sound data. We train the model for 20 Epochs on the normal classes achieving roughly 65% test accuracy. To calcu- late the anomaly detection ranges, we use the output of the convolution layers. After building our anomaly detection method, we add the anomaly class to the test data for evaluating. We compare the results to the same three competitors from the vision task, Autoencoder, Isolation Forest and DeepSVDD. Table 1 and Table 2 show the AUC ROCs and inference times respectively. While the best competitor - an Autoencoder - achieves around 0.8 AUC ROC, our method detects anomalies with an AUC ROC around 0.9. The difference be- tween using the 1% and 0.1% quantile is over 0.03, comparable to the difference in the vision tasks at around 0.01, highlighting that tuning this hyperparameter can slightly increase the performance depending on the scenario, but this is not deeply necessary. The inference runtime is with 0.013 seconds on par with the RangeAD: Fast On-Model Anomaly Detection11 102050100150200300400500750100012501500200025003000 Neurons per hidden layer 0.74 0.76 0.78 0.80 AUC ROC 0.89 0.90 0.91 0.92 0.93 Test Accuracy AUC-ROC and Test Accuracy vs. Model Size, 2 Layer-MLP, Mean/Std over 5 runs AUC ROC Test Accuracy Fig. 4: When using differently sized hidden layers in our neural networks, AUC ROC and model performance are correlated. The results represent the average of 5 runs with a standard deviation over the 12 tabular datasets. vision task, as it is only dependent on the sample count and the neurons used, not the feature size, which would be the most influential difference to the time series dataset. The three competitors, on the other hand, scale worse with higher feature dimensions, needing from 0.07 seconds to 0.88 seconds, showing that our method is also more efficient and effective for time-series anomaly detection. 4.2 Ablation Study To understand the details and alterations of our method, we investigate different aspects of the approach in an ablation study. Therefore we evaluate the behavior in different scenarios on the tabular datasets. Model Size Ablations First, we want to investigate how model size and the feature space size affect anomaly detection performance. For this, we alter the tabular setup so that the initial classifier consists of hidden layers with 10 to 3000 neurons. By taking the feature space of the first two layers of the MLP- Network, our method detects anomalies based on 20 to 6000 activation intervals. For each model size, the detection performance was captured as the AUC ROC. While the accuracy of the initial classifier increases logarithmically and interest- ingly does not observe overfitting, as shown in Figure 4, the detection perfor- mance mostly closely follows this pattern. They both exhibit sharp initial gains at smaller scales, followed by shallower increases at larger layer sizes. As test accuracy continues to improve with more than 1000 neurons per layer, the AUC ROC reaches its peak at 750 neurons and then declines slightly, indicating mod- est oversaturation. Model Training Ablations After investigating the model size, we seek to un- derstand the influence of the training of the base network. Our assumption here 12L. Hinkamp et al. is that with a better-performing / longer-trained network, the activation ranges become more meaningful, leading to a more precise anomaly separation and a superior detection performance. To achieve this comparison, we train the initial classifier and measure detection performance after every epoch. As the previous experiment showed a dependency of the performance on different model sizes and to provide more meaningful outcomes, we use 100, 500, and 1000 neurons in the MLP’s hidden layers. Going from the results in Figure 5a, we note that across the three tested model sizes, the detection performance went higher over the epochs, indicating a gener- ally better performance with better-trained models. Additionally, we note that even before training, the AUC-ROC was high. Compared with the competitors in Figure 2, our models achieve an average ROC AUC higher than almost all com- petitors, even in an untrained state. From this, we relate that the intermediate feature spaces of neural networks are intrinsically good indicators for anomalies. By training these spaces, one can further improve these capabilities, but our method also likely still works very well when the related model is unrelated to the type of anomalies we are searching for. 0100200300400500 Epochs 0.755 0.760 0.765 0.770 0.775 0.780 0.785 0.790 0.795 AUC ROC AUC ROC over train Epochs, three model sizes ms 100 ms 500 ms 1000 (a) Anomaly detection performance as AUC-ROC of our method in three different model sizes measured after every training epoch of the initial classifier. Even with minimal training our method reaches competitive performance. 10 3 10 2 10 1 10 0 False Positive Rate 0.66 0.68 0.70 0.72 0.74 0.76 0.78 0.80 AUC ROC t = 0.2 t = 0.001 = 0.0 = 0.1 t = 0.01 t = 0.9 Comparison of Border Retrieving Approaches Extrema + t range -Quantiles q 1 /q 3 + t IQR (b) AUC ROC and False-Positive-Rate (FPR) for different approaches of calculat- ing the interval borders. The Quantile- based approach reaches the best bal- ance between FPR and anomaly de- tection performance. Fig. 5: Ablation study results. Range Border Retrieval The final ablation study evaluates different methods for determining the borders of the normal-intervals derived from each neuron’s activation output. Our primary approach uses quantiles close to the extrema of the activation distribution. We therefore evaluate different values of σ, which control the distance of the selected quantiles from the distribution boundaries, RangeAD: Fast On-Model Anomaly Detection13 in a tabular setting using an MLP with 1000 hidden units. We additionally consider approaches that place borders further from the extrema. First, we use the quartiles (q 1 ,q 3 ) and extend them by adding a fraction t of the interquartile range (IQR), producing borders between the quartiles and the extrema. Second, we apply the same idea using the minimum and maximum together with the Min- Max range, resulting in borders outside the observed activation distribution. The scaling parameter t varies from 0.001 to 0.9, while σ ranges from 0 to 0.1. Borders placed deep within the distribution classify many samples as anomalies, whereas borders outside the distribution yield few detections. To analyze this trade-off, we compare the AUC-ROC to the resulting false-positive rate (FPR). Binary predictions for the FPR are obtained using a threshold based on 10% of the monitored neurons (200 of 2000 for two layers). Figure 5b shows the resulting AUC-ROC-FPR trade-offs. The extrema-based method yields the lowest FPR but also the lowest AUC-ROC (maximum at 0.76). The quantile- and quartile- based approaches achieve similar AUC-ROC values close to 0.8, although the quartile-based method produces substantially higher FPR. Overall, the quantile- based approach provides the most favorable trade-off in this setting. 5 Conclusion and Future Work In this paper, we introduce a novel anomaly detection setting that exploits a related machine learning model, which we call On-Model AD. We also introduce a technique that can leverage such a setting, RangeAD. Our scenario and al- gorithm are especially useful in complicated production environments, where a related neural network model often exists to solve task beyond anomaly detec- tion, e.g., classification. By leveraging the neural network’s intermediate feature space and analyzing the activation outputs of the preparation data, our method constructs a single interval of normal activations per neuron. Based on this build- ing phase, our method detects anomalies by aggregating the information wether the observed data’s activation falls inside or outside each neurons interval. We examined our method in anomaly detection scenarios across tabular, vision, and time series domains, in each of which it proved a superior performance to the competitors, doing so with regards to both detection quality and efficiency. In an ablation study, we further analyzed the approach and made multiple changes to the detection framework to highlight its variations and limitations. While this study focused on point-wise anomalies within static classification tasks, the framework’s versatility suggests high extensibility to regression and streaming time-series environments. A particularly compelling frontier lies in Natural Language Processing. Given the scalability demands and the problem of anomalous Large Language Models states (hallucinations) [37], our lightweight add-on approach could enhance the reliability in validating LLM outputs. Future research will explore architectural optimizations to further refine this on-model detection, including selective neuron pruning, automated optimal layer selection, and specialized regularization techniques designed to cultivate more discrimina- tive feature representations during training. These advancements aim to further 14L. Hinkamp et al. reduce computational overhead while maximizing the sensitivity of the anomaly detection boundary. Acknowledgments. This research was supported by the Research Center Trust- worthy Data Science and Security (https://rc-trust.ai), one of the Research Alliance centers within the University Alliance Ruhr (https://uaruhr.de). References 1. A novel machine learning pipeline to detect malicious anomalies for the internet of things. Internet of Things 20, 100603 (2022). https://doi.org/10.1016/j.iot. 2022.100603 2. Bellman, R.: Dynamic programming. Science 153(3731), 34–37 (1966) 3. Bergman, L., Hoshen, Y.: Classification-based anomaly detection for general data. In: ICLR. OpenReview.net (2020), http://dblp.uni-trier.de/db/conf/iclr/ iclr2020.html#BergmanH20 4. Bounsiar, A., Madden, M.G.: One-class support vector machines revisited. In: 2014 International Conference on Information Science Applications (ICISA). p. 1–4 (2014). https://doi.org/10.1109/ICISA.2014.6847442 5. Breunig, M., Kröger, P., Ng, R., Sander, J.: Lof: Identifying density-based local outliers. vol. 29, p. 93–104 (06 2000). https://doi.org/10.1145/342009.335388 6. Böing, B., Klüttermann, S., Müller, E.: Post-robustifying deep anomaly detection ensembles by model selection. In: ICDM (2022) 7. Craig, N., Howard, J.N., Li, H.: Exploring Optimal Transport for Event-Level Anomaly Detection at the Large Hadron Collider (1 2024) 8. D’Amour, A., et.al.: Underspecification presents challenges for credibility in mod- ern machine learning (2020), https://arxiv.org/abs/2011.03395 9. Ding, X., Klüttermann, S., Wen, H., Chen, Y., Akoglu, L.: Macrodata: New benchmarks of thousands of datasets for tabular outlier detection (2026), https: //arxiv.org/abs/2602.09329 10. Dong, L., Shulin, L., Zhang, H.: A method of anomaly detection and fault diagnosis with online adaptive learning under small training samples. Pattern Recognition 64 (2017) 11. Geiger, R.S., Cope, D., Ip, J., Lotosh, M., Shah, A., Weng, J., Tang, R.: “garbage in, garbage out” revisited: What do machine learning application papers report about human-labeled training data? (2021). https://doi.org/10.1162/qss_a_00144 12. Goldstein, M., Dengel, A.R.: Histogram-based outlier score (hbos): A fast unsu- pervised anomaly detection algorithm (2012) 13. Han, S., Hu, X., Huang, H., Jiang, M., Zhao, Y.: Adbench: Anomaly detection benchmark. In: NeurIPS (2022) 14. He, Z., Xu, X., Deng, S.: Discovering cluster-based local outliers. Pattern Recogni- tion Letters 24(9), 1641–1650 (2003). https://doi.org/10.1016/S0167-8655(03) 00003-5 15. Hilal, W., Gadsden, S.A., Yawney, J.: Financial fraud: a review of anomaly detec- tion techniques and recent advances. Expert systems With applications (2022) 16. Howard, J., Husain, H.: Imagenette: A smaller subset of 10 easily classified classes from imagenet, and a little more french. https://github.com/fastai/ imagenette, accessed: 10.03.2026 RangeAD: Fast On-Model Anomaly Detection15 17. Kamat, Pooja, Sugandhi, Rekha: Anomaly detection for predictive mainte- nance in industry 4.0- a survey 170 (2020). https://doi.org/10.1051/e3sconf/ 202017002007 18. Khan, M.M., Alkhathami, M.: Anomaly detection in iot-based healthcare: machine learning for enhanced security. Scientific Reports (2024). https://doi.org/10. 1038/s41598-024-56126-x 19. Klüttermann, S., Gupta, S., Müller, E.: Evaluating anomaly detection algorithms: The role of hyperparameters and standardized benchmarks. In: DSAA (2025). https://doi.org/10.1109/DSAA65442.2025.11247988 20. Kriegel, H.P., Kröger, P., Schubert, E., Zimek, A.: Outlier detection in axis-parallel subspaces of high dimensional data. In: Advances in Knowledge Discovery and Data Mining (2009) 21. Lea, C., Flynn, M.D., Vidal, R., Reiter, A., Hager, G.D.: Temporal Convolutional Networks for Action Segmentation and Detection . In: CVPR (2017). https:// doi.org/10.1109/CVPR.2017.113 22. Li, B., Gupta, S., Müller, E.: State-transition-aware anomaly detection under concept drifts. Data and Knowledge Engineering 154, 102365 (2024). https://doi.org/https://doi.org/10.1016/j.datak.2024.102365, https://w.sciencedirect.com/science/article/pii/S0169023X24000892 23. Li, Z., Zhao, Y., Botta, N., Ionescu, C., Hu, X.: Copod: Copula-based outlier detection. In: 2020 IEEE International Conference on Data Mining (ICDM) (2020). https://doi.org/10.1109/ICDM50108.2020.00135 24. Li, Z., Zhao, Y., Hu, X., Botta, N., Ionescu, C., Chen, G.: Ecod: Unsupervised outlier detection using empirical cumulative distribution functions (01 2022) 25. Liu, F.T., Ting, K.M., Zhou, Z.H.: Isolation forest. In: ICDM (2008) 26. Liu, Z., Hu, H., Lin, Y., Yao, Z., Xie, Z., Wei, Y., Ning, J., Cao, Y., Zhang, Z., Dong, L., Wei, F., Guo, B.: Swin transformer v2: Scaling up capacity and resolution (2022), https://arxiv.org/abs/2111.09883 27. Livernoche, V., Jain, V., Hezaveh, Y., Ravanbakhsh, S.: On diffusion modeling for anomaly detection. In: ICLR 2024 (2024), https://openreview.net/forum?id= lR3rk7ysXz 28. Lu, L., Shin, Y., Su, Y., Karniadakis, G.E.: Dying relu and initialization: Theory and numerical examples (2020). https://doi.org/10.4208/cicp.OA-2020-0165 29. Ma, M.Q., Zhao, Y., Zhang, X., Akoglu, L.: The need for unsupervised outlier model selection: A review and evaluation of internal evaluation strategies (2023) 30. Mikuni, V., Nachman, B., Shih, D.: Online-compatible unsupervised nonresonant anomaly detection. Phys. Rev. D 105, 055006 (Mar 2022). https://doi.org/10. 1103/PhysRevD.105.055006 31. Miljković, D.: Fault detection methods: A literature survey. In: 2011 Proceedings of the 34th International Convention MIPRO. p. 750–755 (2011) 32. Newen, C., Hinkamp, L., Ntonti, M., Müller, E.: Do you see what i see? an ambiguous optical illusion dataset exposing limitations of explainable ai (2025), https://arxiv.org/abs/2505.21589 33. Olteanu, M., Rossi, F., Yger, F.: Meta-survey on outlier and anomaly detec- tion. Neurocomputing 555, 126634 (2023). https://doi.org/https://doi.org/ 10.1016/j.neucom.2023.126634 34. Pevný, T.: Loda: Lightweight on-line detector of anomalies. Mach. Learn. 102(2) (feb 2016). https://doi.org/10.1007/s10994-015-5521-0 35. Radaideh, M.I., Pappas, C., Wezensky, M., Ramuhalli, P., Cousineau, S.: Fault prognosis in particle accelerator power electronics using ensemble learning. ArXiv abs/2209.15570 (2022) 16L. Hinkamp et al. 36. Ramaswamy, S., Rastogi, R., Shim, K.: Efficient algorithms for mining outliers from large data sets. In: SIGMOD (2000). https://doi.org/10.1145/342009.335437 37. Rateike, M., Cintas, C., Wamburu, J., Akumu, T.L., Speakman, S.D.: Weakly su- pervised detection of hallucinations in llm activations. In: NeurIPS 2023 Workshop on Socially Responsible Language Modelling Research (SoLaR) (2023) 38. Ruff, L., Kauffmann, J.R., Vandermeulen, R.A., Montavon, G., Samek, W., Kloft, M., Dietterich, T.G., Muller, K.R.: A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE 109(5), 756–795 (May 2021) 39. Ruff, L., Vandermeulen, R., Goernitz, N., Deecke, L., Siddiqui, S.A., Binder, A., Müller, E., Kloft, M.: Deep one-class classification. In: ICML (2018) 40. Röchner, P., Klüttermann, S., Rothlauf, F., Schlör, D.: We need to rethink bench- marking in anomaly detection (2025), https://arxiv.org/abs/2507.15584 41. Saeedi, J., Giusti, A.: Anomaly detection for industrial inspection using convolu- tional autoencoder and deep feature-based one-class classification. p. 85–96 (01 2022). https://doi.org/10.5220/0010780200003124 42. Sakurada, M., Yairi, T.: Anomaly detection using autoencoders with nonlinear dimensionality reduction. In: PMLSDA 2014 - Machine Learning for Sensory Data Analysis. p. 4–11. MLSDA’14 (2014). https://doi.org/10.1145/2689746. 2689747 43. Salamon, J., Jacoby, C., Bello, J.P.: A dataset and taxonomy for urban sound research. In: Proceedings of the 22nd ACM international conference on Multimedia. p. 1041–1044 (2014) 44. Shenkar, T., Wolf, L.: Anomaly detection for tabular data with internal contrastive learning. In: International Conference on Learning Representations (2022), https: //openreview.net/forum?id=_hszZbt46bT 45. Srivastava, A.: Astronomy image classification dataset. https://w.kaggle.com/ datasets/abhikalpsrivastava15/space-images-category, accessed: 10.03.2026 46. Tang, J., Chen, Z., Fu, A.W.c., Cheung, D.W.: Enhancing effectiveness of outlier detections for low density patterns (2002) 47. Wang, Y., et.al.: Unsupervised anomaly detection with compact deep features for wind turbine blade images taken by a drone. International Journal of Computer Vision (2019). https://doi.org/10.1186/s41074-019-0056-0 48. Xu, W., Jang-Jaccard, J., Liu, T., Sabrina, F., Kwak, J.: Improved bidirectional gan-based approach for network intrusion detection using one-class classifier. Com- puters (2022). https://doi.org/10.3390/computers11060085 49. Zeiler, M.D., Fergus, R.: Visualizing and understanding convolutional networks. In: European Conference on Computer Vision (ECCV). p. 818–833. Springer (2014) 50. Zhao, Y., Nasrullah, Z., Li, Z.: Pyod: A python toolbox for scalable outlier detection. Journal of Machine Learning Research 20(96), 1–7 (2019), http: //jmlr.org/papers/v20/19-011.html 51. Zhong, Z., Yu, Z., Yang, K., Chen, C.L.P.: Labels matter more than mod- els: Quantifying the benefit of supervised time series anomaly detection (2025), https://arxiv.org/abs/2511.16145 52. Zong, B., et.al.: Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In: ICLR (2018)

Instant research discovery