Weakly Supervised Anomaly Detection via Dual-Tailed Kernel

Detecting anomalies with limited supervision is challenging due to the scarcity of labeled anomalies, which often fail to capture the diversity of abnormal behaviors. We propose Weakly Supervised Anomaly Detection via Dual-Tailed Kernel (WSAD-DT), a novel framework that learns robust latent representations to distinctly separate anomalies from normal samples under weak supervision. WSAD-DT introduces two centroids—one for normal samples and one for anomalies—and leverages a dual-tailed kernel scheme: a light-tailed kernel to compactly model in-class points and a heavy-tailed kernel to main- tain a wider margin against out-of-class instances. To preserve intra-class diversity, WSAD-DT in- corporates kernel-based regularization, encouraging richer representations within each class. Furthermore, we devise an ensemble strategy that partition unlabeled data into diverse subsets, while sharing the limited labeled anomalies among these partitions to maximize their impact. Empirically, WSAD-DT achieves state-of-the-art performance on several challenging anomaly detection benchmarks, outperforming leading ensemble-based methods such as XGBOD.

Anomaly detection is hard when only a few examples of unusual behavior are labeled—like a handful of fraudulent transactions in a sea of normal ones. We tackle this challenge by designing a system that learns from just a few labeled anomalies and a large amount of mostly normal, unlabeled data.Our method, called WSAD-DT, gives the data two “home bases” in its internal map—one for normal and one for abnormal points. Two mathematical lenses—a fast-shrinking “light” tail and a slower-shrinking “heavy” tail—help pull each point toward the right base and push it away from the wrong one, keeping everyday patterns compact and anomalies distinct. To prevent everything from collapsing into a single spot, we add a diversity check. We also train a small ensemble of models to boost robustness.WSAD-DT detects anomalies more accurately than existing methods, even with very limited labels, and has the potential to improve fraud detection, fault diagnosis, and medical screening.