cs.LGAug 20, 2026

Unsupervised Anomaly Detection Using Flow Matching on Tabular Data

Authors: Philip Konz, Tejaswini Medi, Margret Keuper

Organizations: University of Mannheim, Germany · MPI for Informatics, Saarland Informatics Campus, Germany

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Financial anomaly detection often relies on large unlabeled transaction logs, where anomalous samples may already be present during training. Such training-set contamination violates the clean-normal data assumption underlying many anomaly detection methods. Although flow matching has demonstrated strong performance in generative modeling, its robustness in unsupervised tabular anomaly detection remains underexplored. In this work, we study flow-matching-based anomaly detection under contaminated training data by comparing Time-Conditioned Contraction Matching (TCCM) with Forest-Flow and evaluating multiple anomaly scoring functions. Our results show that the choice of anomaly score is critical. The original single-step Decision score used by TCCM is sensitive to contamination, whereas trajectory-based Deviation and Reconstruction scores provide more stable anomaly signals. With these scores, Forest-Flow becomes competitive with, and in some cases outperforms, TCCM. These findings highlight the importance of anomaly scoring for flow-matching methods in financial anomaly detection under severe class imbalance.

Figures & tables

DatasetMethod-ScoreAUROC 0AUROC fullAUPRC 0AUPRC full
CampaignTCCM-Dec.0.778±0.0250.778\pm 0.0250.763±0.0130.763\pm 0.0130.334±0.0270.334\pm 0.0270.309±0.0120.309\pm 0.012
FF-XGB-Dec.0.767±0.0030.767\pm 0.0030.698±0.0040.698\pm 0.0040.297±0.0040.297\pm 0.0040.216±0.0030.216\pm 0.003
TCCM-Dev.0.750±0.0360.750\pm 0.0360.754±0.0310.754\pm 0.0310.323±0.0310.323\pm 0.0310.299±0.0170.299\pm 0.017
FF-XGB-Dev.0.765±0.0040.765\pm 0.0040.729±0.0020.729\pm 0.0020.327±0.0030.327\pm 0.0030.266±0.0020.266\pm 0.002
TCCM-Rec.0.764±0.0030.764\pm 0.0030.764±0.0020.764\pm 0.0020.337±0.0020.337\pm 0.0020.336±0.002\mathbf{0.336\pm 0.002}
FF-XGB-Rec.0.820±0.001\mathbf{0.820\pm 0.001}0.804±0.002\mathbf{0.804\pm 0.002}0.341±0.003\mathbf{0.341\pm 0.003}0.315±0.0020.315\pm 0.002
Table 1: Comparison of TCCM and FF-XGB on three tabular anomaly detection datasets using Decision (Dec.), Deviation (Dev.), and Reconstruction (Rec.) scores. AUROC and AUPRC are reported under zero ( 0 ) and full ( full ) training contamination as mean ±\pm std over five runs. Best results are shown in bold .
Figure 1: Hyperparameter sensitivity on the Campaign dataset under increasing training-set contamination. AUROC and AUPRC are reported for the Deviation, Reconstruction, and Decision scores. For Forest-Flow, ntn_{t} denotes the number of time steps and KK the number of Monte Carlo noise samples per data point. For TCCM, only ntn_{t} is varied because the model does not use Monte Carlo noise-sample averaging.
Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

GroupFeatures
Amountamount , amount_zscore_series , amount_ratio_to_mean
Timingday_of_month , day_of_week , month , days_since_last_in_series , day_deviation_from_usual
Mismatch flagsiban_mismatch , swift_mismatch , method_mismatch , channel_mismatch , known_name_new_iban , is_card_mobile
Noveltyis_new_series , is_new_ref_name , is_new_iban
Historyseries_tx_count_before_log , ref_name_count_before_log , iban_count_before_log , tx_count_this_month_so_far
Appendix
Table 2: Feature groups in the Synthetic Business Transaction dataset.
Figure 2: Campaign contamination curves for AUPRC and AUROC. Campaign contains 41,188 samples with 4,640 anomalies, giving an anomaly ratio ρ=0.1127\rho=0.1127 or 11.27%11.27\% . The x-axis reports the training contamination level γ\gamma as a fraction, where γ=0\gamma=0 means anomaly-free training data, γ=0.0125\gamma=0.0125 means approximately 1.25%1.25\% contamination, and γ=0.1127≈ρ\gamma=0.1127\approx\rho corresponds to full contamination. We compare TCCM with Forest-Flow using XGBoost, and plot Decision, Deviation, and Reconstruction anomaly scores using the mean values from the Campaign table.
Figure 3: Business dataset contamination curves for AUPRC and AUROC. The Business dataset contains 6,364 samples with 50 anomalies, corresponding to a dataset-level anomaly ratio of ρ=50/6364≈0.00786\rho=50/6364\approx 0.00786 or 0.786%0.786\% . The x-axis reports the training contamination level γ\gamma as a fraction, where γ=0\gamma=0 means anomaly-free training data and, for example, γ=0.0009759\gamma=0.0009759 means approximately 0.0976%0.0976\% contamination. The final plotted level, γ=0.0087829\gamma=0.0087829 , corresponds to the full-contamination setting used in this training split. We compare TCCM with Forest-Flow using XGBoost, and plot Decision, Deviation, and Reconstruction anomaly scores using the mean values from the Business table.
Figure 4: Waveform contamination curves for AUPRC and AUROC. Waveform has an anomaly ratio of approximately ρ=0.0291\rho=0.0291 or 2.90%2.90\% . The x-axis reports the training contamination level γ\gamma as a fraction, where γ=0\gamma=0 means anomaly-free training data, γ=0.0032\gamma=0.0032 means approximately 0.32%0.32\% contamination, and γ=0.0291≈ρ\gamma=0.0291\approx\rho corresponds to full contamination. We compare TCCM with Forest-Flow using XGBoost, and plot Decision, Deviation, and Reconstruction anomaly scores.
More in this topic

Unsupervised Anomaly Detection

Unsupervised anomaly detection finds unusual patterns without labeled examples of faults, attacks, defects, or other rare events.

See all 222 papers

Explore similar work

CardsList

  1. Flow Mismatching: Unsupervised Anomaly Detection via Velocity Discrepancies in Flow Matching Models

    May 21, 2026Shengzhe Chen, Mehrdad Moradi, Kamran Paynabar +1Flow MatchingIndustrial Anomaly Detection

    1Arizona State University · 2Georgia Institute of Technology

  2. Why Does Counterintuitive Likelihood Behavior Rarely Emerge in Tabular Anomaly Detection?

    Feb 10, 2026Donghwan Kim, Junghun Phee, Hyunsoo YoonAnomaly DetectionTabular Anomaly Detection

    Department of Industrial Engineering, University of Yonsei, Republic of Korea, Seoul · H. Milton Stewart School of Industrial and Systems Engineering (ISyE), Georgia Institute of Technology, USA, GA

  3. HCFM: Helmholtz Component Flow Matching for Time Series Anomaly Detection

    Oct 18, 2026Shyam Sundar Saravanan, Tie Luo, Sanjay MadriaTime-Series Anomaly DetectionUnsupervised Anomaly Detection

    Department of Computer Science, Missouri University of Science and Technology, Rolla, MO, USA · Department of ECE, University of Kentucky, Lexington, KY, USA