When Should Anomaly Thresholds Adapt? A Decision Framework under Prevalence Shift

Unsupervised anomaly detectors produce continuous scores, but deployment requires thresholds that convert those scores into decisions. Reference-calibrated thresholds can become unreliable when anomaly prevalence changes, while indiscriminate batch adaptation can introduce error when the score distribution provides little evidence that adaptation is warranted. We introduce CAVET-AD (Calibrated Adaptive Value of Excess Tail for Anomaly Detection), a detector-agnostic post-hoc framework that determines whether threshold adaptation is supported by the observed score distribution. CAVET-AD calibrates scores against a frozen nominal reference, refines the upper tail using extreme-value theory, and computes an observable excess-tail response, $r_{\mathrm{tail}}$, that controls a bounded adaptation budget. When the response is near zero, the method retains its conservative base rule rather than forcing adaptation. Across four tabular benchmarks and 320 positive-prevalence conditions, CAVET-AD increases descriptive mean F1 from $0.475$ to $0.579$. Its behavior is strongly regime dependent: gains are substantial on CICIoT2023 and CreditCard2013, NSL-KDD shifts from fixed-favorable to adaptive-favorable as prevalence increases, and CICIDS2018 shows no benefit when Isolation Forest scores are nearly uninformative. At the natural CreditCard2013 prevalence of $0.173\%$, adaptation is minimal and yields no statistically significant F1 improvement after multiplicity correction. A leave-one-dataset-out policy based on $r_{\mathrm{tail}}$ retains most of the adaptive benefit on a benchmark excluded from cutoff selection, while ECOD replication and detector-transfer analyses provide additional evidence of portability. Under severe controlled covariate shift, however, $r_{\mathrm{tail}}$ can increase even when adaptation is harmful. These results position CAVET-AD as a diagnostic for when prevalence-driven threshold adaptation is warranted, rather than as a universal detector of distribution shift.