Less Is More: Principled Diversity in Heterogeneous Anomaly Detection Ensembles

Abstract

Heterogeneous anomaly detection ensembles improve robustness by combining complementary detectors, yet existing approaches often rely on heuristic detector selection, fixed contamination assumptions, and equal weighting. We investigate whether compact ensembles of complementary detectors can outperform substantially larger heterogeneous configurations through diversity-aware weighting and adaptive contamination estimation. Experiments on 22 benchmark datasets show that a compact ensemble of four complementary classical detectors outperforms an eleven-detector ensemble containing deep learning components, while requiring only 13.8% of the computational cost. Across the benchmark, the proposed ensemble variants achieve strong rankings while remaining competitive with the strongest individual detectors (Friedman ${\chi }^2=71.58$, $p<0.001$). These findings suggest that detector diversity, rather than ensemble size or architectural complexity, is the primary driver of robust unsupervised anomaly detection performance in resource-constrained environments.

1. Introduction

Anomaly detection in tabular data is a fundamental problem in domains including fraud detection [1], industrial monitoring [2], and medical screening [3]. In these settings, anomalies are rare, labels are unavailable, and the characteristics of anomalous samples vary substantially across datasets, making unsupervised detection the only practical option.

Ensemble methods that combine multiple detectors have consistently demonstrated superior robustness over individual algorithms [4,5], as no single detector achieves universal superiority across the heterogeneous anomaly types encountered in practice [6]. However, existing heterogeneous ensembles face three unresolved challenges. First, detector selection is often heuristic and does not explicitly account for redundancy between detectors [4]. Second, many methods rely on fixed contamination assumptions despite large variation in anomaly rates across datasets [7]. Third, unsupervised weighting schemes either treat detectors equally or adapt weights through mechanisms that reward conformity to the majority, progressively homogenising the ensemble [8].

We investigate how explicit diversity-aware weighting and adaptive contamination estimation affect heterogeneous anomaly detection ensembles. The framework combines eleven detectors spanning multiple anomaly detection paradigms, estimates contamination adaptively using a Gaussian Mixture Model (GMM) [9], and applies a Negative Correlation Learning (NCL)-inspired [10] weighting scheme that penalises correlated detectors. We evaluate the full framework across 22 ODDS benchmark datasets [11] with Friedman and Nemenyi statistical testing [12]. The experiments show that compact ensembles can outperform substantially larger configurations at a fraction of the computational cost, challenging the assumption that larger heterogeneous ensembles are necessarily better.

The scientific contributions of this paper are as follows:

• An NCL-inspired unsupervised weighting scheme that explicitly penalises correlated detectors based on inter-detector score correlation, extending the diversity-penalisation principle of Negative Correlation Learning to the unsupervised anomaly detection setting.
• A GMM-based adaptive contamination estimator enabling automatic threshold calibration across datasets with anomaly rates ranging from 1.2% to 35.9%, replacing the fixed assumptions used by existing ensemble methods.
• A combinatorial search across all 2036 detector combinations (${\sum }_{n=2}^{11}\left({\displaystyle \genfrac{}{}{0pt}{}{11}{n}}\right)$) identifying that compact ensembles of three to five complementary detectors match or exceed the full eleven-detector ensemble at as little as 8.7% of computational cost.
• Rigorous statistical evaluation across 22 benchmark datasets using Friedman and Nemenyi testing, confirming significant improvements over six individual detectors (${\chi }^2=71.58$, $p<0.001$).

2. Related Work

Classical anomaly detection includes a broad range of statistical, distance-based, density-based, and isolation-based approaches. Distance-based methods such as k-Nearest Neighbour (KNN) [13] and Local Outlier Factor (LOF) [14] identify anomalies through neighbour distance and local density deviation, respectively. Isolation Forest [15] instead exploits the relative ease of isolating anomalies through random recursive partitioning at $\mathcal{O}(nlogn)$ complexity. Statistical approaches include Histogram-Based Outlier Score (HBOS) [16], Minimum Covariance Determinant (MCD) [17], and Copula-Based Outlier Detector (COPOD) [18], which model anomaly structure through density estimation, robust covariance estimation, and empirical copulas. Isolation-Based Nearest-Neighbour Ensembles (INNEs) [19] combine neighbourhood structure with isolation principles to measure local anomalousness. Deep learning approaches such as Variational Autoencoders (VAEs) [20], Deep Support Vector Data Description (Deep SVDD) [21], and Locally Unified Neighbourhood Anomaly Ranking (LUNAR) [22] learn latent representations or graph-aware neighbourhood structure for anomaly scoring. These methods differ substantially in their inductive biases, motivating heterogeneous ensembles that combine complementary anomaly assumptions. Comprehensive benchmarks [6] further demonstrate that no single detector consistently dominates across heterogeneous tabular datasets.

Ensemble methods improve robustness by aggregating complementary detectors. Existing approaches include Feature Bagging [23], which constructs diverse detectors from random feature subspaces, LSCP [24], which dynamically selects 3–5 locally competent detectors per test instance from a larger candidate pool, and SUOD [25], which accelerates large-scale ensemble training through approximation and parallelisation but reports diminishing returns beyond 6–8 detectors on most tabular datasets. However, unsupervised ensembles remain challenging because detector outputs are heterogeneous and diversity is difficult to enforce explicitly [4]. More recent work reflects the same tension between ensemble size and practical cost. SEAD-PL [26] draws from a large candidate pool but applies clustering-based pruning to retain only the most accurate and diverse subset, and RHAD [27] constructs a six-detector heterogeneous ensemble for industrial control systems yet finds that its RL-based scheduler concentrates influence on 3–4 detectors per detection window. ADBench [6] benchmarks 14 standalone detectors across 57 datasets but does not directly examine ensemble size effects. A consistent pattern across this body of work is that ensembles of 3–8 paradigmatically distinct detectors capture the bulk of achievable performance gains, with larger configurations offering marginal improvement at substantially increased computational cost. Diversity-aware ensemble principles have also found application in related domains such as fault diagnosis [28]. More recently, agentic and LLM-based frameworks have been explored for tabular anomaly detection [29], though their computational requirements remain prohibitive for resource-constrained deployments.

Adaptive weighting has received comparatively less attention in unsupervised anomaly detection. Cabrera-Bean et al. [8] proposed an Expectation–Maximisation (EM) framework that jointly infers pseudo-labels and detector weights from agreement patterns among correlated detectors. Negative Correlation Learning (NCL) [10] instead promotes ensemble diversity by penalising correlated learners, establishing that effective ensembles should balance individual detector quality against inter-detector redundancy. Although originally developed for supervised learning, the same principle is relevant in unsupervised anomaly detection, where detector diversity is often assumed rather than explicitly enforced.

Most anomaly detectors additionally require a contamination parameter specifying the expected anomaly fraction. Because anomaly prevalence varies substantially across datasets, ranging from 1.2% to 35.9% in the ODDS benchmark [7], fixed contamination assumptions are frequently unreliable. Prior work has therefore explored score distribution-based approaches [30] that estimate the boundary between normal and anomalous score populations directly from detector outputs, including probabilistic mixture-based formulations such as Gaussian Mixture Models (GMMs) [9].

3. Materials and Methods

3.1. Ensemble Framework

Let $\mathcal{X}={\left\{{\mathbf{x}}_i\right\}}_{i=1}^n\subset {\mathbb{R}}^d$ denote an unlabelled dataset. The goal of unsupervised anomaly detection is to assign each sample ${\mathbf{x}}_i$ an anomaly score $s_i$ and binary prediction ${\widehat{y}}_i\in \{0,1\}$ without access to ground-truth labels.

The proposed heterogeneous ensemble comprises eleven detectors spanning seven anomaly detection methods: isolation-based (Isolation Forest, INNE), density/distance-based (LOF, KNN), statistical (HBOS, MCD), probabilistic (COPOD), subspace (PCA), deep learning (VAE, DeepSVDD), and graph-based (LUNAR). Detector scores are min-max normalised to ${\tilde{s}}_{mi}\in [0,1]$.

To estimate the contamination rate adaptively, we fit a two-component Gaussian Mixture Model (GMM) to the mean ensemble score

$${\overline{s}}_i={\displaystyle \frac{1}{M}}{\displaystyle \sum _{m=1}^M}{\tilde{s}}_{mi},$$

(1)

using

$$p\left(\overline{s}\right)={\pi }_0\mathcal{N}({\mu }_0,{\sigma }_0^2)+{\pi }_1\mathcal{N}({\mu }_1,{\sigma }_1^2),$$

(2)

where ${\mu }_1>{\mu }_0$ identifies the anomaly component. The contamination estimate is

$$\widehat{\rho }=\mathrm{clip}({\pi }_1,0.01,0.40).$$

(3)

Each detector thresholds its scores at the $(1-\widehat{\rho })$ quantile.

Negative Correlation Learning (NCL) [10] decomposes the ensemble generalisation error as:

$$E_{\mathrm{ens}}={\displaystyle \sum _{m=1}^M}{E}_m-\lambda {\displaystyle \sum _{m=1}^M}\sum _{j\ne m}\mathrm{cov}(e_m,e_j),$$

(4)

where $E_m$ is the individual error of detector m and $\mathrm{cov}(e_m,e_j)$ is the covariance between the errors of detectors m and j.

In the supervised NCL framework, minimising this objective jointly promotes individual detector competence and mutual complementarity by penalising pairwise error covariance. In the unsupervised setting, ground-truth labels are unavailable, so we substitute two observable proxies. Score variance ${\sigma }_m^2=\mathrm{Var}\left({\tilde{s}}_{m·}\right)$ approximates discriminative strength: a detector that spreads normal and anomalous scores apart produces high variance across the dataset. The Pearson correlation $C_{mj}$ between detector score vectors approximates error covariance: two detectors that assign similar scores to every sample share error structure and provide redundant rather than complementary evidence, consistent with the diversity literature [31]. Let $\mathbf{S}\in {\mathbb{R}}^{M\times n}$ denote the normalised score matrix and $\mathbf{C}$ the corresponding Pearson correlation matrix. Using these unsupervised proxies, we define the following NCL-inspired weighting formulation:

$$w_m\propto {\displaystyle \frac{{\sigma }_m^2}{{\displaystyle 1+\lambda \sum _{j\ne m}{w}_j{C}_{mj}}}},$$

(5)

where $\lambda >0$ controls the strength of the diversity penalty. Equation (5) is solved iteratively, initialising from variance weights $w_m^{\left(0\right)}={\sigma }_m^2/{\sum }_j{\sigma }_j^2$ and running for a fixed five iterations with no tolerance threshold. Convergence within five iterations was confirmed empirically across all 22 benchmark datasets. Weights are clipped to a minimum of ${10}^{-3}$ before renormalisation to prevent numerical degeneracy. Performance metrics remain stable across $\lambda \in [0.1,5.0]$ (Friedman ${\chi }^2=1.245$, $p=0.871$ for F1; see Section 4.2), confirming that the ensemble is robust to this hyperparameter. At $\lambda \to 0$, Equation (5) reduces to pure variance weighting; at very large $\lambda$, the penalty term dominates and the formula converges to near-equal weighting among low-correlation detectors. The stable performance across this range reflects the fact that the recommended compact ensemble contains near-orthogonal detectors by construction (IsolationForest, INNE, HBOS, and KNN share no mathematical assumptions), so the correlation term remains small regardless of $\lambda$.

Final predictions are obtained through weighted soft voting:

$${\widehat{s}}_i={\displaystyle \sum _{m=1}^M}{w}_m{\tilde{s}}_{mi},{\widehat{y}}_i=⊮\left[{\displaystyle \sum _{m=1}^M}{w}_m{b}_{mi}\ge 0.5\right].$$

(6)

Four weighting schemes are evaluated to assess the contribution of diversity-aware weighting: Equal ($w_m=1/M$); Variance ($w_m\propto {\sigma }_m^2$); NCL defined in Equation (5); and EM, an Expectation–Maximisation agreement-lift scheme [8] that upweights detectors whose predictions align above chance with the ensemble consensus.

3.2. Experimental Setup

Experiments were conducted on 22 ODDS benchmark datasets on a server running Ubuntu 24.04 (Canonical, London, UK) with 1 TB RAM and two NVIDIA H100 NVL GPUs (96 GB VRAM each; NVIDIA, Santa Clara, CA, USA). Deep detectors were trained with fixed hyperparameters following established practice in the anomaly detection literature [20,21,22]. The VAE uses an encoder–decoder architecture with hidden layer sizes $\left[\max \right(16,2d),\max (16,d\left)\right]$ and their mirror as decoder, where d is the input dimensionality, ensuring a minimum layer width of 16 to prevent degenerate networks on low-dimensional data. DeepSVDD uses a three-layer architecture with hidden sizes $\left[\max \right(32,d),\max (16,d/2\left)\right]$. LUNAR uses its default graph-based architecture. All three deep detectors were trained for 50 epochs using PyTorch 2.10 (PyTorch Foundation, San Francisco, CA, USA) with CUDA 13.0 (NVIDIA, Santa Clara, CA, USA). This fixed-hyperparameter protocol prioritises reproducibility over per-dataset tuning, consistent with the evaluation approach adopted in ADBench [6]. It should be noted that deep detectors are generally more sensitive to hyperparameter choices than classical methods such as IsolationForest or HBOS; the weaker results observed for VAE, DeepSVDD, and LUNAR may therefore partly reflect the absence of per-dataset tuning or early stopping rather than a fundamental limitation of deep anomaly detection on tabular data. Classical detectors ran in parallel on CPU, distance-based detectors (LOF, KNN) used ball-tree indexing and were subsampled to $n\le 10,000$ for scalability [25], with all other detectors capped at $n\le 50,000$. Performance was evaluated using F1, AUROC, and AUPRC, and statistical significance was assessed using the Friedman test with Nemenyi post-hoc analysis [12].

4. Results

4.1. Benchmark Datasets

Experiments were conducted on 22 benchmark datasets from the ODDS repository [11], covering sample sizes $n=148$ to $49,097$, dimensionalities $d=3$ to 400, and anomaly rates from 1.2% to 35.9%, as shown in

Table 1. Benchmark dataset characteristics, ordered by sample size.

Dataset	n	d	Anomalies	Anom. Rate (%)
Wine	129	13	10	7.7
Lympho	148	18	6	4.1
Glass	214	9	9	4.2
Vertebral	240	6	30	12.5
Ionosphere	351	33	126	35.9
WBC	378	30	21	5.6
Arrhythmia	452	274	66	14.6
BreastW	683	9	239	35.0
Pima	768	8	268	34.9
Vowels	1456	12	50	3.4
Letter	1600	32	100	6.3
Cardio	1831	21	176	9.6
Musk	3062	166	97	3.2
Speech	3686	400	61	1.7
Thyroid	3772	6	93	2.5
Optdigits	5216	64	150	2.9
Satimage-2	5803	36	71	1.2
Satellite	6435	36	2036	31.6
Pendigits	6870	16	156	2.3
Annthyroid	7200	6	534	7.4
MNIST	7603	100	700	9.2
Mammography	11,183	6	260	2.3

. The diversity of anomaly rates motivates adaptive contamination estimation.

4.2. Hyperparameter Sensitivity

We evaluated the sensitivity of the NCL weighting mechanism to the diversity penalty coefficient $\lambda$. As shown in

Table 2. Sensitivity of NCL weighting to the diversity penalty coefficient $\lambda$ defined by Equation (5), averaged across 22 datasets. Mean ± standard deviation reported.

$\mathit{\lambda }$	F1	AUROC	AUPRC
$0.1$	$0.3099\pm 0.2422$	$0.8141\pm 0.1714$	$0.4495\pm 0.3297$
$0.5$	$0.3099\pm 0.2422$	$0.8137\pm 0.1717$	$0.4494\pm 0.3294$
$1.0$	$0.3062\pm 0.2398$	$0.8132\pm 0.1719$	$0.4491\pm 0.3293$
$2.0$	$0.3057\pm 0.2390$	$0.8125\pm 0.1724$	$0.4484\pm 0.3291$
$5.0$	$0.3052\pm 0.2389$	$0.8114\pm 0.1731$	$0.4473\pm 0.3298$

, the performance metrics remain remarkably stable across a wide range of values ($\lambda \in [0.1,5.0]$). A Friedman test confirmed that the differences across these settings are not statistically significant (${\chi }^2=1.245,p=0.871$ for F1), indicating that the ensemble is robust to this hyperparameter.

4.3. Overall Comparison

Table 3. Mean ± std performance across 22 benchmark datasets. Best value per metric in bold. † denotes an ensemble method. Methods are sorted by AUPRC.

Method	Type	F1	AUROC	AUPRC
Ensemble-EM †	Proposed	$0.311\pm 0.243$	$\mathbf{0}.\mathbf{818}\pm \mathbf{0}.\mathbf{170}$	$0.437\pm 0.322$
Ensemble-Equal †	Proposed	$0.312\pm 0.239$	$0.817\pm 0.170$	$0.432\pm 0.318$
Ensemble-NCL †	Proposed	$0.319\pm 0.240$	$0.814\pm 0.174$	$0.434\pm 0.314$
Ensemble-Var †	Proposed	$\mathbf{0}.\mathbf{315}\pm \mathbf{0}.\mathbf{240}$	$0.814\pm 0.173$	$0.435\pm 0.315$
IsolationForest	Standalone	$0.298\pm 0.236$	$0.806\pm 0.168$	$\mathbf{0}.\mathbf{439}\pm \mathbf{0}.\mathbf{332}$
MCD	Standalone	$0.294\pm 0.255$	$0.809\pm 0.186$	$0.420\pm 0.334$
LSCP †	Baseline	$0.290\pm 0.233$	$0.793\pm 0.174$	$0.415\pm 0.323$
PCA	Standalone	$0.261\pm 0.231$	$0.748\pm 0.203$	$0.397\pm 0.327$
HBOS	Standalone	$0.255\pm 0.227$	$0.761\pm 0.207$	$0.395\pm 0.322$
INNE	Standalone	$0.304\pm 0.202$	$0.793\pm 0.167$	$0.373\pm 0.252$
KNN	Standalone	$0.283\pm 0.243$	$0.784\pm 0.182$	$0.369\pm 0.275$
COPOD	Standalone	$0.277\pm 0.225$	$0.775\pm 0.189$	$0.382\pm 0.301$
VAE	Standalone	$0.282\pm 0.230$	$0.765\pm 0.180$	$0.326\pm 0.259$
LUNAR	Standalone	$0.263\pm 0.231$	$0.724\pm 0.201$	$0.314\pm 0.267$
DeepSVDD	Standalone	$0.254\pm 0.199$	$0.718\pm 0.173$	$0.300\pm 0.253$
LOF	Standalone	$0.207\pm 0.166$	$0.656\pm 0.182$	$0.247\pm 0.237$

reports mean performance across all 22 datasets for 16 methods. The Friedman test confirms significant differences between methods for both F1 (${\chi }^2=71.58$, $p<0.001$) and AUPRC (${\chi }^2=41.36$, $p<0.001$). All four ensemble variants rank in the top four for F1 and AUROC. On AUPRC, Ensemble–Expectation–Maximisation (EM) achieves 0.4371, closely matching IsolationForest (0.4391), with no significant difference under Nemenyi testing ($p=1.000$). Deep detectors underperform classical methods across all metrics, with AUPRC values of 0.300–0.326 compared to 0.420–0.439 for top classical detectors, consistent with prior findings that deep anomaly detection is not consistently superior on tabular data [6].

The Critical Difference (CD) diagram in Figure 1 further confirms these findings. At $\alpha =0.05$ (CD $=5.11$), all four ensemble variants are connected by a non-significance bar, indicating no statistically significant differences among them. The ensemble group as a whole is not connected to the INNE–MCD–IsolationForest cluster, confirming a consistent ranking advantage over the median individual detector.

Nemenyi post-hoc tests in

Table 4. Nemenyi post-hoc p-values. Significant results ($p<0.05$) in bold.

Comparison	Ensemble-Equal	Ensemble-NCL
vs. DeepSVDD	0.001	0.002
vs. LOF	0.008	0.016
vs. PCA	0.008	0.014
vs. VAE	0.019	0.024
vs. LUNAR	0.044	0.076
vs. COPOD	0.055	0.069
vs. HBOS	0.197	0.240
vs. KNN	0.477	0.598
vs. LSCP	0.503	0.549
vs. INNE	1.000	1.000
vs. IsolationForest	0.954	0.971
vs. MCD	0.992	0.998

show that ensemble variants significantly outperform weaker baselines such as LOF, DeepSVDD, VAE, PCA, and LUNAR ($p<0.05$), while no significant difference is observed against the strongest individual detectors (IsolationForest, INNE, MCD).

4.4. Ablation Studies

Table 5. Weighting scheme comparison averaged across 22 datasets. Best value per metric in bold.

Scheme	F1	AUROC	AUPRC
Equal	$0.312\pm 0.239$	$0.817\pm 0.170$	$0.432\pm 0.318$
Variance	$\mathbf{0}.\mathbf{315}\pm \mathbf{0}.\mathbf{240}$	$0.814\pm 0.173$	$0.435\pm 0.315$
NCL	$0.319\pm 0.240$	$0.814\pm 0.174$	$0.434\pm 0.314$
EM	$0.311\pm 0.243$	$\mathbf{0}.\mathbf{818}\pm \mathbf{0}.\mathbf{170}$	$\mathbf{0}.\mathbf{437}\pm \mathbf{0}.\mathbf{322}$

compares the four weighting strategies. Differences between schemes are small across all metrics (F1 range: 0.0042), suggesting that the ensemble’s performance is driven primarily by detector diversity rather than the choice of weighting. EM achieves the highest AUROC (0.8176), while variance weighting achieves the best F1 (0.3154).

The voting threshold ablation in Figure 2 shows that performance is similarly stable across values of k. Ensemble size analysis in Figure 3 shows that performance saturates after three detectors, with subsequent additions providing only marginal gains, suggesting that complementary coverage is achieved quickly. The diversity ordering in Figure 3 follows a predefined paradigm-coverage sequence, adding one detector per anomaly detection paradigm in order of estimated standalone contribution, consistent with prior work on heterogeneous anomaly detection ensembles [24,25].

Contamination sensitivity analysis shown in Figure 4 confirms that performance is stable under perturbations of $\pm 0.05$ in $\widehat{\rho }$ (F1 variation: 0.015), indicating that the GMM estimate does not need to be exact to be effective. A sensitivity analysis on the number of GMM components confirms that two components is the appropriate choice. Increasing to three components provides no improvement in AUROC or AUPRC, while a single-component model, equivalent to a fixed contamination assumption, yields lower F1 due to poor threshold calibration on high-contamination datasets. Two components is therefore the minimum parameterisation that captures the bimodal structure of normal and anomalous score populations.

To further assess GMM behaviour under challenging conditions, Figure 5 shows score distributions and fitted GMM components for the two lowest-contamination datasets in the benchmark. On Satimage-2 (1.2% anomalies), the anomalous score component remains well-separated at high scores despite the GMM overestimating contamination at $\widehat{\rho }=0.220$. On Speech (1.7%), heavy component overlap causes the estimate to reach the clip ceiling ($\widehat{\rho }=0.400$). In both cases, the contamination perturbation analysis in Figure 4 confirms that detection quality remains stable, indicating that threshold miscalibration in overlap-heavy settings does not propagate to catastrophic detection failure.

4.5. Compact Ensemble Analysis

Evaluation of compact detector subsets reveals that ensembles of three to five detectors can match or exceed the full 11-detector system at substantially lower computational cost, as shown in

Table 6. Compact ensemble performance compared to the full 11-detector ensemble, averaged across 22 datasets (mean ± std). Cost is expressed as a percentage of the full ensemble mean training time (40.87 s). Best value per metric in bold.

Ensemble	n	F1	AUROC	AUPRC	Cost (%)
Full-11-EM	11	$0.311\pm 0.237$	$0.818\pm 0.167$	$0.437\pm 0.315$	100
IF+INNE+KNN+HBOS	4	$0.293\pm 0.235$	$0.819\pm 0.165$	$\mathbf{0}.\mathbf{450}\pm \mathbf{0}.\mathbf{327}$	13.8
IF+INNE+KNN+HBOS+LUNAR	5	$0.307\pm 0.242$	$\mathbf{0}.\mathbf{823}\pm \mathbf{0}.\mathbf{165}$	$0.447\pm 0.325$	23.4
IF+KNN+HBOS	3	$0.319\pm 0.234$	$0.815\pm 0.168$	$\mathbf{0}.\mathbf{446}\pm \mathbf{0}.\mathbf{330}$	8.7
IF+KNN+MCD	3	$\mathbf{0}.\mathbf{347}\pm \mathbf{0}.\mathbf{272}$	$0.827\pm 0.169$	$0.432\pm 0.321$	17.7

. The four-detector configuration (IsolationForest, INNE, KNN, HBOS) achieves AUPRC $=0.450$, exceeding the full ensemble ($0.434$, $+3.7\%$) at only 13.8% of its training time. These four detectors cover complementary anomaly signals: axis-aligned tree partitioning (IsolationForest), nearest-neighbour isolation (INNE), marginal histogram density (HBOS), and global distance to the k-th neighbour (KNN), with no two sharing a mathematical assumption, minimising redundant error covariance. Adding LUNAR as a fifth detector further improves AUROC to 0.823 at 23.4% of training cost, while the three-detector configuration (IF, KNN, MCD) achieves the highest F1 (0.347) at 17.7% cost, confirming that optimal configuration depends on the target metric. A Friedman test across the five configurations in Table 6 confirms statistically significant differences in F1 (${\chi }^2=11.31$, $p=0.023$), driven primarily by the binary threshold interaction between detector combination and the GMM contamination estimate. Differences in AUPRC are not statistically significant (${\chi }^2=2.98$, $p=0.562$), indicating that all compact configurations produce equivalent score quality to the full ensemble. Compact ensemble selection should therefore be guided by the target metric: IF+INNE+KNN+HBOS for score-based ranking (AUPRC), and IF+KNN+MCD for binary classification (F1).

Table 7. Computational complexity of individual detectors averaged across 22 benchmark datasets. Mean ± std reported.

Detector	Fit Time (s)	Inference (ms/1k)	Peak Memory (MB)
IsolationForest	$0.70\pm 0.19$	$0.02\pm 0.01$	$1.4\pm 1.5$
INNE	$0.78\pm 0.26$	$0.22\pm 0.15$	$6.4\pm 5.8$
LOF	$0.55\pm 0.42$	$0.33\pm 0.20$	$6.0\pm 4.4$
KNN	$0.55\pm 0.41$	$0.33\pm 0.25$	$4.1\pm 3.5$
HBOS	$0.46\pm 1.97$	$0.06\pm 0.28$	$2.5\pm 5.3$
MCD	$8.46\pm 25.91$	$0.01\pm 0.02$	$32.8\pm 102.5$
COPOD	$0.05\pm 0.09$	$0.05\pm 0.10$	$8.5\pm 15.8$
PCA	$0.05\pm 0.13$	$0.01\pm 0.02$	$5.2\pm 11.2$
VAE	$23.99\pm 24.56$	$0.04\pm 0.01$	$3.9\pm 11.2$
DeepSVDD	$4.06\pm 3.80$	$0.02\pm 0.05$	$1.7\pm 3.0$
LUNAR	$1.60\pm 0.87$	$0.26\pm 0.38$	$5.8\pm 10.0$

reports the computational complexity of each individual detector averaged across benchmark datasets. VAE dominates training time at $23.99\pm 24.56$ s, while COPOD and PCA are the fastest classical detectors (<0.06 s fit time). Inference time is negligible for all detectors (<0.35 ms per 1000 samples), confirming that deployment cost is dominated by training rather than prediction.

The performance–cost trade-off is illustrated in Figure 6.

Table 8. Best detector combination per ensemble size across all $\left({\displaystyle \genfrac{}{}{0pt}{}{11}{n}}\right)$ combinations, ranked by mean AUPRC across 22 datasets (mean ± std). Best value per metric in bold.

n	Best Combination	F1	AUROC	AUPRC
2	IF+PCA	$0.297\pm 0.231$	$0.798\pm 0.184$	$\mathbf{0}.\mathbf{456}\pm \mathbf{0}.\mathbf{333}$
3	IF+KNN+HBOS	$\mathbf{0}.\mathbf{319}\pm \mathbf{0}.\mathbf{234}$	$0.815\pm 0.168$	$0.446\pm 0.330$
4	IF+INNE+KNN+HBOS	$0.293\pm 0.235$	$0.819\pm 0.165$	$0.450\pm 0.327$
5	IF+INNE+KNN+HBOS+LUNAR	$0.307\pm 0.242$	$\mathbf{0}.\mathbf{823}\pm \mathbf{0}.\mathbf{165}$	$0.447\pm 0.325$
6	IF+INNE+KNN+HBOS+PCA+LUNAR	$0.303\pm 0.239$	$0.819\pm 0.167$	$0.447\pm 0.329$
7	IF+INNE+KNN+HBOS+MCD+COPOD+LUNAR	$0.311\pm 0.245$	$0.823\pm 0.167$	$0.444\pm 0.326$
8	IF+INNE+KNN+HBOS+MCD+COPOD+PCA+LUNAR	$0.309\pm 0.244$	$0.818\pm 0.168$	$0.440\pm 0.326$
9	IF+INNE+LOF+KNN+HBOS+MCD+COPOD+PCA+LUNAR	$0.305\pm 0.238$	$0.820\pm 0.168$	$0.440\pm 0.323$
10	IF+INNE+KNN+HBOS+MCD+COPOD+PCA+VAE+DSVDD+LUNAR	$0.311\pm 0.245$	$0.815\pm 0.170$	$0.437\pm 0.323$
11	IF+INNE+LOF+KNN+HBOS+MCD+COPOD+PCA+VAE+DSVDD+LUNAR	$0.311\pm 0.239$	$0.817\pm 0.170$	$0.434\pm 0.318$

reports the best-performing combination per ensemble size across all ${\sum }_{n=2}^{11}\left({\displaystyle \genfrac{}{}{0pt}{}{11}{n}}\right)=2036$ evaluated configurations. AUPRC peaks at $n=2$ (IF+PCA, $0.456$) but this configuration achieves the lowest F1 ($0.297$) and AUROC ($0.798$) across all size classes, reflecting limited robustness of two-detector ensembles for binary classification. Performance stabilises from $n=3$ onward across all three metrics, with $n=3$–5 configurations achieving the strongest F1 and AUROC while remaining within 0.01 AUPRC of the two-detector peak. At 8.7% of full ensemble training time for $n=3$ and 13.8% for $n=4$, compact configurations offer substantial computational savings with no meaningful loss in detection quality. Friedman testing confirms statistically significant differences across sizes for both AUPRC (${\chi }^2=19.46$, $p=0.022$) and F1 (${\chi }^2=26.35$, $p=0.002$). IsolationForest appears in the best combination at every size class, confirming its role as the strongest individual detector and a reliable ensemble anchor.

5. Discussion

The main result of this study is that ensemble performance is primarily determined by detector diversity rather than ensemble size. Compact ensembles of three to five paradigmatically complementary detectors consistently outperform the full eleven-detector ensemble, consistent with Negative Correlation Learning theory [10], which links ensemble quality to error covariance rather than component count. The strongest compact configurations share a common principle: each detector captures a distinct anomaly signal with no shared mathematical assumptions, resulting in low inter-detector correlation by construction. This suggests that, on the tabular benchmarks evaluated, heterogeneity is most beneficial when it introduces genuinely complementary inductive biases rather than additional architectural complexity, though this finding may not generalise beyond the ODDS benchmark collection.

Deep learning detectors (VAE, DeepSVDD, LUNAR) consistently underperform classical methods on tabular data, aligning with recent benchmark findings [6]. Reconstruction- and hypersphere-based objectives are less effective on structured tabular distributions, and in the ensemble these detectors are automatically downweighted due to weak and correlated signals without meaningfully improving overall performance.

The GMM-based contamination estimator proves robust across the benchmark collection, with performance remaining stable under perturbations of $\pm 0.05$ in $\widehat{\rho }$. Its bimodal assumption is sufficient for the ODDS benchmarks, though heavily overlapping score distributions may warrant a more expressive model. Across weighting schemes, differences in binary performance are small. EM-based weighting yields marginally better calibrated continuous scores, while NCL weighting reduces to variance-like behaviour in low-correlation settings and is expected to be more discriminative in higher-redundancy ensembles.

The negligible differences among weighting schemes in Table 5 (F1 range: 0.004) suggest that ensemble performance on the ODDS benchmark is driven primarily by detector diversity rather than the choice of weighting strategy. This outcome is explained by the moderate and relatively uniform inter-detector correlations observed across the benchmark, which limit the diversity penalty in Equation (5) and cause NCL to converge toward variance weighting. In this regime, equal weighting is a reasonable default and is recommended for practitioners deploying compact ensembles of paradigmatically orthogonal detectors. NCL weighting is expected to provide meaningful differentiation when the ensemble contains detectors with high intra-paradigm redundancy, for example, when multiple reconstruction-based or density-based detectors are included. In such settings, equal weighting assigns equal influence to redundant detectors, diluting the ensemble signal, while NCL explicitly penalises this redundancy. The value of the NCL formulation therefore lies not in average-case performance on diverse benchmarks, but in its principled behaviour under redundancy, a condition practitioners are likely to encounter when assembling detectors from a larger heterogeneous candidate pool.

The main limitations of this work are the restriction to tabular datasets, the tractability of an exhaustive subset search only for small detector pools, and potential GMM instability under heavy inlier-outlier score overlap. Scalable subset selection and high-dimensional covariance estimation remain open problems.

6. Conclusions

We proposed a heterogeneous ensemble framework for unsupervised anomaly detection combining adaptive GMM-based contamination estimation, diversity-aware weighting, and weighted soft voting. Across 22 benchmark datasets, the proposed ensemble variants achieve consistently strong rankings, significantly outperform several weaker baselines, and remain competitive with the strongest individual detectors (${\chi }^2=71.58$, $p<0.001$). The central finding is that, across the evaluated benchmark collection, detector diversity is a stronger driver of ensemble performance than ensemble size: compact ensembles of three to five detectors match or exceed the full eleven-detector configuration at as little as 8.7% of computational cost. This conclusion is specific to unsupervised tabular anomaly detection on the ODDS benchmarks and should be interpreted with appropriate caution in other settings. Future work will extend the framework to time-series and graph-structured data and investigate scalable detector selection strategies and improved contamination estimation under multimodal score distributions.