The Outlier Changes With the Detector: What Anomaly Detection Actually Flags

Anomaly detection often converts an unlabeled score into a factual-sounding label: normal or anomalous. However, that label is conditional on the reference population, representation, detector family, neighborhood or kernel scale, and the rule used to convert continuous scores into binary flags. This paper audits 120 anomaly-detection configurations fitted to 307 development vehicles from the complete-case Auto MPG data. Four representations are combined with Isolation Forest, Local Outlier Factor, One-Class SVM, and robust covariance estimators. Model years 1980–1982, containing 85 vehicles, remain reserved for temporal diagnosis. Origin is excluded from fitting and consulted only as a post-fit external audit. Sixteen prespecified primary detectors target or parameterize a nominal 5% boundary. Their development flag sets have a mean pairwise Jaccard agreement of 0.259, with a minimum of 0.000. No vehicle is flagged by all 16 primary detectors, and the largest observation-level consensus is 14 of 16. Similar flag counts therefore do not imply agreement about which observations are anomalous. Under 50 deterministic 1% feature-scale perturbations per primary detector, mean anomaly-score rank stability is 0.986. Mean binary flag-set stability is lower at 0.823 and falls to 0.538 for the least stable primary configuration. A nearly unchanged ranking can therefore produce a less stable binary decision when observations lie near the selected boundary. The primary detectors flag an average of 0.050 of the development population but 0.314 of the temporal population. Primary temporal flag rates range from 0.000 to 0.941. Across the complete candidate grid, the maximum absolute temporal flag rate is 1.000 for raw One-Class SVM with nu=0.03 and gamma=0.1. This value is an absolute temporal rate, not the temporal-to-development ratio reported separately in the paper. The largest post-fit origin normalized mutual information is 0.040. Origin does not select any representation, detector, hyperparameter, or threshold. The results distinguish score stability, binary-decision stability, cross-detector agreement, external association, and temporal transport. None alone establishes data error, fraud, causal exception, intrinsic abnormality, or a justification for deleting an observation. The deposit includes the complete paper and a reproducibility package containing source code, the complete-case data, machine-readable results for all 120 candidates, 16 primary 50-path perturbation audits, a complete 16 × 16 flag-agreement matrix, observation-level consensus records, five generated figures, frozen headline results, a SHA-256 integrity manifest, and an automated reproduction verifier.