• The presentation and clarity of this paper are not high. For example, in line 115, it is unclear whether $x_t$ is a scalar or a vector because the space it belongs is not specified. In line 140, there is no definition of $k$. In lines 191-192, $\\|$ is not necessary. In addition, the same symbol $t$ is used for the index of data and training iterations, which is confusing. Algorithms 1 and 2 are difficult to follow because many undefined words, such as $\varepsilon_N$ and validation sets, are in the main text.
• The proof of the theorem 4.2 is based on an upper bound for the norm of the loss. However, since the actual value may be smaller than the upper bound, does this argument make sense? (I can understand the argument if it uses a lower bound). In addition, did the authors investigate whether the assumptions about the gradient norm are valid in the experiments?
• There are unsupervised anomaly detection methods that can explicitly exclude anomalies in the unlabeled data in the training process, such as [a]. Since the motivations are the same, it is better to compare these methods to validate the approach's effectiveness.

[a] Qiu, Chen, et al. "Latent outlier exposure for anomaly detection with contaminated data." International conference on machine learning. PMLR, 2022.

The key insight of this paper is that when training a model for a learning task on a combination of normal and anomalous data, the model converges faster on normal data while struggling with anomalous data. However, this insight is not an original contribution of the paper. The relationship between model training loss and data was first observed in the paper [1]. It explores the performance of deep neural networks (DNNs), including loss values, when trained on normal and noisy data. Anomalies can be considered a type of noise, so both can be seen as studies of the same phenomenon. Specifically, Section 3.2 of paper [1] proposes using loss values to compare normal and noisy data. In Section 4, paper [1] concludes through extensive experiments that real data examples are easier to fit than noise, similar to the current submission.

Subsequently, many new works have built on this finding to identify noise or anomalies in data, such as [2] and [3]. Paper [2] observes that noisy samples take longer to learn. Notably, Figure 1 in the paper [2] and Figure 1 in the current submission express almost the same conclusion and have a nearly identical presentation. Paper [3] introduces the concept of gradient norm to quantitatively describe the changes in loss on normal and noisy data. Therefore, this point cannot be considered a contribution of this paper.

Moreover, using ensemble methods for anomaly detection is also a common practice and lacks originality. For example, paper [4] proposes using embedding methods for anomaly detection. In summary, this paper lacks innovation in its contributions. The current research is limited to describing and utilizing the phenomenon. It could enhance its contribution if the paper provides more theoretical explanations.

[1] A Closer Look at Memorization in Deep Networks.ICML.2017.

[2] Unsupervised Label Noise Modeling and Loss Correction.ICML.2019

[3] Gradient Harmonized Single-stage Detector.AAAI.2019.

[4] An embedding approach to anomaly detection.ICDE.2016

1. Lack of Explanation for Observed Phenomenon
   The observation that normal data leads to faster model convergence is insightful, but the paper seems to lack an explanation for why this occurs. If possible, the authors could provide some theoretical analysis or empirical investigation—such as examining properties of normal vs. anomalous data or analyzing gradient dynamics—to clarify the mechanism and help define the scope and limitations of the prior belief derived from this phenomenon.

2. Insufficient Persuasiveness in Experimental Section
   The experimental section lacks some essential details. Key information such as hyperparameter sensitivity analysis, specific settings, and the anomaly ratio in datasets is missing. These elements are crucial for validating the robustness and replicability of the proposed method, especially in an unsupervised learning context.

   • 2.1) Please provide a comprehensive list of hyperparameters used in the experiments, particularly noting whether the settings for baselines and the NARCISSUS model are identical when achieving optimal performance.
   • 2.2) Is there a hyperparameter sensitivity analysis to determine the importance of these parameters for model performance?
   • 2.3) Test whether different hyperparameter settings are needed to achieve optimal performance at varying anomaly ratios in the datasets.

• The presentation needs to be improved. I struggle to follow its notation and derivations.

• While the ensemble approach improves robustness, the theoretical analysis is independent from it (why?).

• Due to the computational demanding nature of ensemble, benchmarks on training time, memory usage, and latency would be valuable additions to gauge the practical scalability of the proposal in large deployments.

• NARCISSUS assumes that anomalies are sparse and the data is well-bounded, which may limit its applicability to domains with high anomaly densities or unbounded data ranges (e.g., streams). How about the drift behaviors of anomalies which is also common in practice?