Composite Anomaly Score

• Composite anomaly score is a unified metric that fuses diverse anomaly detection criteria from statistical measures and learned cues to reduce false positives and negatives.
• It combines multiple fusion methods—multiplicative, geometric mean, logical, and supervised nonlinear rules—to extract complementary strengths from isolated detectors.
• Empirical studies demonstrate enhanced AUROC, F1 scores, and discovery significance across domains like high-energy physics, industrial quality control, and network monitoring.

A composite anomaly score is a unified metric that integrates multiple, distinct anomaly detection criteria—originating from heterogeneous models, statistical measures, or learned cues—into a single scalar value, typically to improve robustness, detection power, and interpretability across complex, high-dimensional or noisy data. Composite scores are prevalent in modern unsupervised, self-supervised, and semi-supervised anomaly detection frameworks, both for time-series and visual data, as well as in high-energy physics, industrial quality control, and network monitoring.

1. Theoretical Foundations and Motivation

The rationale for composite anomaly scoring arises from the limitations of single-criterion detectors. Isolated metrics such as reconstruction error, density estimates, or out-of-distribution classifiers often exhibit complementary strengths and weaknesses. For instance, a reconstruction model may underperform when anomalies are "easy to reconstruct," while density estimates can misclassify rare but not necessarily abnormal samples. By fusing diverse metrics, composite scores can reduce both false negatives and false positives, enhancing discriminative power in domains where high accuracy or strict constraints (e.g., zero-false-negative industrial QC) are required (Lim et al., 2023, Bougaham et al., 2022).

2. Canonical Composite Score Constructions

Several representative composite score formulations have been introduced:

• Multiplicative fusion: MadSGM combines reconstruction, density, and gradient-based scores multiplicatively:

$$S_{\rm comp}(x_t) = S_{\rm rec}(x_t) \cdot S_{\rm den}(x_t) \cdot S_{\rm grad}(x_t)$$

where each component is explicitly computed using a conditional diffusion-based generative model and its score network (Lim et al., 2023).

• Geometric mean: Multi-cue visual methods fuse normalized cue scores (statistical deviation, entropy-based uncertainty, segmentation-based spatial anomaly) by a weighted geometric mean:

$$s(x) = \left( \hat s_{\rm dev}(x)^{w_d} \hat s_{\rm ent}(x)^{w_e} \hat s_{\rm seg}(x)^{w_s} \right)^{1/(w_d + w_e + w_s)}$$

The weights are tuned on holdout data (Das et al., 30 Jan 2026).

• Logical operations (min, max): In high-energy physics, multiple algorithmic scores (e.g., Isolation Forest, Gaussian Mixture, Autoencoder, VAE) are combined via logical AND (min), OR (max), or arithmetic mean/product in a uniform-normalized score space:

$$x^{\rm AND}(x) = \min_i\, x_i(x);\;\; x^{\rm OR}(x) = \max_i\, x_i(x)$$

(Beekveld et al., 2020). The AND combination is often most conservative and effective under low-FPR/strict discovery scenarios.

• Supervised/nonlinear fusion: Learned classifiers, such as SVMs with RBF kernels (Lüer et al., 2023) or gradient-boosted trees (Bougaham et al., 2022), are trained on the vector of per-sample anomaly sub-scores to yield a nonlinear composite anomaly probability or margin.
• Hybrid density modeling: Feature augmentation and hybrid density estimation (e.g., autoencoder latent + reconstruction stats, scored via noise-contrastive estimation) enable joint modeling of normality in the feature-reconstruction space (2502.01920).

3. Representative Methods and Domains

Method/Domain	Components	Fusion Rule
MadSGM, time-series (Lim et al., 2023)	Reconstruction, density, grad	Product of three scores
Rare & Different, physics (Caron et al., 2021)	SVDD ensemble, flow (likelihood)	Min/max/prod/avg fusion (pre-normalized)
Composite VQGAN (industrial) (Bougaham et al., 2022)	Global, pixel, patch metrics	Learned classifier over extracted metrics
Multi-Cue Vision (Das et al., 30 Jan 2026)	Deviation, entropy, segmentation	Weighted geometric mean
β-VAEGAN SVM (Lüer et al., 2023)	Rec. error, disc. error, latent dev.	RBF-kernel SVM margin
Composite NCE (2502.01920)	AE latent, rec. error, similarity	Hybrid NCE density, composite feature
Composite KS (Hwang et al., 2023)	Local complexity, vulnerability	2D KS statistc, or ratio at image level

Fusions are domain-specific; product and min (AND) combinations emphasize joint anomaly evidence, while learned fusions exploit nonlinear subspace relationships.

4. Mathematical and Algorithmic Details

Composite anomaly scoring typically involves the following canonical workflow:

1. Component extraction: Compute sub-scores $s_1(x),...,s_k(x)$ from base anomaly detectors, each operating on the same input $x$ but potentially using different models or feature spaces.
2. Normalization: Map component scores to a common range (e.g., [0,1]), often by empirical CDF on training/normal data to ensure comparability.
3. Combination:
   • Multiplicative/product: Enhances detection when all cues agree, suppresses spurious anomalies in any single cue (Lim et al., 2023).
   • Minimum (AND): Flags an anomaly only if all component scores are high (Beekveld et al., 2020).
   • Classifier-based: Trains a discriminative model $f_\theta(s_1(x),...,s_k(x))$—e.g., Extra-Trees, SVM, logistic regression—on labeled or validation data (Lüer et al., 2023, Bougaham et al., 2022).
   • Density estimation: Estimates the log-likelihood of the joint composite feature (latent+reconstruction stats) using NCE (2502.01920).
4. Thresholding: Threshold is chosen to achieve a desired error rate, often set on a validation set (e.g., minimum anomaly score among true anomalies for ZFN constraint (Bougaham et al., 2022), simulation-based for a fixed false alarm rate (Zhang et al., 2015)).

5. Statistical Interpretation and Empirical Behavior

Composite anomaly scores offer several advantages:

• Complementary failure modes: Empirical ablations (e.g., Table 4 in (Lim et al., 2023)) show that multiplicative or logical AND combinations outperform any single detector. For example, in MadSGM, $S_{\rm rec} \cdot S_{\rm den} \cdot S_{\rm grad}$ achieves the best or second-best AUC/F1 across five time-series datasets, with consistent dominance in precision-at-K curve analyses.
• Robustness to contamination: In multi-cue detection with contaminated data, the weighted geometric mean provides robustness, with ablation showing composites outperform all individual cues, especially at >15% contamination (Das et al., 30 Jan 2026).
• Improved significance and sensitivity: In high-energy physics, AND fusion in VAE latent space roughly doubles discovery significance over single-method baselines (Beekveld et al., 2020).

Composite scoring mechanisms directly impact interpretability—decomposing a final score into constituent evidence offers diagnostic transparency for real-world deployment.

6. Calibration, Thresholding, and Evaluation

Proper threshold selection is essential. Classical methods use asymptotic theory (e.g., Sanov/LDP in Markov Hoeffding tests), but these can misestimate required thresholds at finite sample sizes, leading to high false alarm rates. Modern composite schemes often use:

• Empirical quantiles: As in ZFN constraint, set the threshold to the minimum true-anomaly score (Bougaham et al., 2022).
• Empirical distribution modeling: E.g., CLT-based Monte Carlo simulation of the null distribution for the Hoeffding test statistic (Zhang et al., 2015).
• Cross-validation: For supervised fusions and SVM-based composites, the threshold is tuned on an independent validation split (Lüer et al., 2023, Das et al., 30 Jan 2026).

Empirical results across domains—including image, sequence, and tabular benchmarks—consistently show that composite scores yield improved AUROC, F1, or discovery significance relative to any individual metric, and enable stricter control of operational error rates.

7. Limitations, Open Problems, and Outlook

Composite anomaly scores are not universally optimal; key limitations include:

• Sensitivity to normalization and fusion: Efficacy depends on robust normalization of sub-scores and suitable fusion rules. Poorly calibrated or correlated detectors can degrade performance (Beekveld et al., 2020, Caron et al., 2021).
• Necessity of component diversity: Component failures are less likely to be addressed if sub-scores are redundant (correlation analysis supports ensemble benefit only if components are sufficiently orthogonal (Caron et al., 2021)).
• Interpretability vs. complexity trade-off: Supervised and nonlinear combinations often outperform but may obscure direct interpretability or require labeled/held-out anomalies (Bougaham et al., 2022, Lüer et al., 2023).
• Data regime dependence: The optimal fusion rule may depend on task asymmetry (e.g., ZFN in industrial QC, min-TI vs. max-TI in physics) and empirical evaluation is required.
• Transferability: Weighting and normalization strategies may not generalize across domains without re-calibration.

Ongoing research aims to further systematize composite anomaly score design, automate metric selection/normalization, and develop theoretically grounded fusion strategies adaptable to varied operational requirements and domain constraints.