Anomaly detection

Overview

The task is to find where an input, or a step of a process, looks unlike the normal case. Most methods here learn what "normal" is from normal examples only, or from known classes only, so they never see the failure they are meant to catch. The detector therefore has to define "normal" from what it sees during training 2103.04257 §1 2103.04257 §3.2 2011.02578 §1 1904.07595 §3.2.

Three properties shape the design space:

• Output granularity. A method can output an image-level score (is anything wrong?), a pixel-level map (where?), or a per-step alarm for a running policy (is the robot failing now?). The defect paper reports both an image and a pixel score 2103.04257 tab. 2 2103.04257 tab. 1. The self-supervised method reports image-level scores on semantic benchmarks and localisation on MVTec AD 2011.02578 tab. 2 2011.02578 tab. 4. The resynthesis method outputs a per-pixel score for road scenes 1904.07595 §3. The robot-failure method outputs one score per environment step and an alarm 2606.21386 §3.3. The two sensor-stream methods score each timestamp; the graph method flags a tick from its largest per-sensor deviation 2106.06947 §3.6, and the transformer method thresholds each dimension for diagnosis 2201.07284 §3.1. The autoencoder method scores a whole sample by its summed loss, not each timestamp 2107.12626 §3.6. The flow method outputs one likelihood per feature location, turned into a pixel map 2107.12571 §4.2. The clinical method outputs one probability per decision, with a threshold for the alarm 2605.04664 p. 2. The isolation method averages a score over its trees, one per point 2206.06602 §5.2.2. The node method gives one score per node, averaged over sampled rounds 2103.00113 §4.3. The classifier method gives one score per input image 2203.10807 §4.
• What "normal" is measured against. Reconstruction and density methods judge an input by how well they model it. Feature-matching methods judge it by how much a second network disagrees with a fixed reference network 2103.04257 §2.2. The two-stage method fits a kernel density estimator or a one-class SVM on features learned from normal images 2011.02578 §3.2. The resynthesis method repaints the scene from its own label map and checks where the repaint disagrees with the photo 1904.07595 §3. The robot-failure method uses a Mahalanobis distance on last-layer features, plus the disagreement between overlapping action chunks 2606.21386 §3.1 2606.21386 §3.2. The graph method forecasts each sensor's next value and scores the error 2106.06947 §3.5 2106.06947 §3.6. The transformer method rebuilds a window and scores the rebuild error 2201.07284 §3.5. The autoencoder method rebuilds each window and predicts it from earlier windows, then sums the reconstruction and prediction errors 2107.12626 §3.4 2107.12626 §3.6. The flow method scores a location by its log-likelihood under a density learned from normal features 2107.12571 §4.2. The clinical method fits a probability model on the k most similar past patients, and scores a decision by its predictive probability under that model 2605.04664 p. 2 2605.04664 p. 3.
• Which failure is meant. Industrial defects, unexpected road objects, corner cases in driving, and policy failures are different targets. Each paper picks one, and the others need their own evidence.

The word covers more than industrial defects. The autonomous-driving survey uses it for corner cases: unusual objects, scenes or behaviour on the road 2204.07974 §1. Its scope leaves out sensor-layer anomalies, pixel-level anomalies and adversarial attacks 2204.07974 §1. A position paper on the same driving setting asks for a machine-readable description of corner cases, rather than a detector. Its corner-case layers include a sensor layer, and its first example is glare 2109.09607 §1 2109.09607 §4.1. It reports no experiments 2109.09607 §3. A third setting is one-class classification of whole images, where the outliers are the other object categories 2011.02578 §4. A fourth is novelty rejection in a classifier that may abstain: the inputs are rare or absent in training 2107.11277 §2.2.2, and the survey lists anomaly detection as a related area 2107.11277 §9.2. A fifth is failure detection for a robot policy, which the authors separate from novelty: out-of-distribution states do not always cause failures, and some failures have no visual anomaly 2606.21386 §1. A sixth is multivariate sensor data, where the anomaly is a break in the expected relations between sensors or in the temporal pattern. The graph and transformer papers evaluate on public benchmarks with labelled anomalies, and they use labels only for testing 2106.06947 §4.1 2201.07284 §3.1. The autoencoder paper also uses public sensor data, but its anomalies are activity or sleep-disorder labels, and it adds a private fatigue set 2107.12626 §4.1. A seventh is a conditional question: is this decision unusual, given the patient's other attributes? The clinical paper defines the target that way, with its own labels from a physician panel 2605.04664 p. 1 2605.04664 p. 3. An eighth is an anomalous node in an attributed network, where the node's links or its own attributes disagree with its neighbourhood 2103.00113 §1. A ninth is out-of-distribution input to a trained image classifier. It overlaps with the novelty setting above, but the detector reads one fixed network's features and logits 2203.10807 §1. A tenth is a streaming benchmark, which scores how early a detector flags a labelled window rather than a new detector 1510.03336 §I 1510.03336 §II.B. An eleventh is an off-road robot that must decide, while it drives, which unfamiliar terrain and which user-named objects are lethal. SALON marks a cell lethal when its distance to every k-means cluster centre exceeds a threshold, and a clicked feature gets high roughness, which raises the cost of similar features [arxiv:2412.07826 §3.5] 2412.07826 §3.5.1. It is evaluated on navigation outcomes on one course, not on labelled anomalies 2412.07826 tab. 4. The attack paper PTA runs the other way: it uses four outlier detectors as a defence that a poisoned embedding must pass, and it proposes an attack, not a detector 2509.19994 §3.3. The papers therefore define the problem differently, and results from one setting do not carry over to another without checking.

The variants that compare a model with a reference share one structure: fit a model on normal data, then compare the model's output with a reference at test time and turn the disagreement into a map or a score. The two-stage method gives a score but no map in its main experiments. The robot-failure method gives a score and an alarm, with no map. The two time-series methods also compare a prediction with the observed value, one sensor or dimension at a time, and give a score per timestamp rather than a map. The autoencoder method compares its rebuild and predictions with the observed window, and gives one score per sample 2107.12626 §3.6. The flow method and the clinical test do not compare against a reference network or a reference case set at test time; each scores a sample by its likelihood under a model fitted on normal data. The flow method turns those likelihoods into a map. The isolation method has no reference model: it measures how few random cuts isolate a point, and how far the point lies from those cuts 2206.06602 §5.2.2. The node method contrasts each node with the sampled subgraph of a random other node 2103.00113 §4.1. The classifier method takes the norm of a feature outside a principal subspace of training features, and adds it as one virtual logit 2203.10807 §4. The SALON test compares a cell's feature with k-means centres fitted on training features, and it has no density model of its own 2412.07826 §3.1.2 2412.07826 §3.5.1.

Variants

Two methods are documented in full, each with a sketch below. A convolutional autoencoder with a prediction memory for multi-sensor signals is documented in full, without a sketch, because its card has its own pseudocode 2107.12626 §3. Six more have cards and are described here without a sketch: the flow-based localisation method, the clinical conditional test, the resynthesis method, the robot-failure method, and two methods for multivariate sensor streams, graph forecasting and transformer reconstruction. Their cards have their own pseudocode. Four more cover the new papers: a node method for attributed networks, an isolation method for tabular, graph and time-series data, a post-hoc OOD score, and the streaming benchmark. A position paper on corner-case description comes next, with no method to sketch. SALON is an online navigation method whose distance test is one part of a larger pipeline, and its card has its own pseudocode 2412.07826 §3. The attack paper and the GNN survey close this section. The survey adds a classification of driving methods, which cite other papers that have no card here, so they are named only.

Student-teacher feature matching

A frozen teacher pretrained on ImageNet and a student with the same architecture both produce feature pyramids. The student is trained on anomaly-free images to match the teacher's unit-normalised features at three levels (conv2_x to conv4_x of ResNet-18) with equal weights 2103.04257 §3.1 2103.04257 §3.2. At test time the per-level distance maps are upsampled and multiplied, and the image score is the maximum of the product 2103.04257 §3.3 2103.04257 eq. 4. Card: Student-Teacher Feature Pyramid Matching for Anomaly Detection.

The paper compares itself with the student-teacher method of Bergmann et al. (cited as STAD), which it argues uses two-step, single-scale transfer and loses information 2103.04257 §4.3. That earlier method has no card yet, so its numbers are only what appear in this paper's tables 2103.04257 tab. 1.

Two-stage self-supervised one-class detector

Stage one trains a ResNet-18 on normal images only, with a self-supervised proxy task: rotation prediction, contrastive learning, or contrastive learning with distribution augmentation 2011.02578 §3.1. Distribution augmentation treats the 90, 180 and 270 degree rotations of each training image as separate distributions, which quadruples the training set 2011.02578 §3.1.3. Stage two fits an RBF one-class SVM or a kernel density estimator on the L2-normalised features, and the test score is the kernel's log-sum-exp value 2011.02578 §3.2 2011.02578 app. A.1. Card: Learning and Evaluating Representations for Deep One-class Classification.

Author-reported, on five single-class benchmarks with no test-time augmentation, the mean AUC is 89.9 with the one-class SVM and 89.8 with the kernel density estimator. The same paper's rotation-prediction variant with a kernel density estimator averages 88.2, an ImageNet ResNet-50 with a one-class SVM averages 84.0, and the earlier end-to-end rotation classifier averages 83.1 2011.02578 tab. 2. The main experiments use CIFAR-10, CIFAR-100, Fashion-MNIST, cat-vs-dog and CelebA 2011.02578 §4. The hyperparameters were tuned on 500 inlier and 500 outlier CIFAR-10 images, which the paper says may violate the one-class assumption 2011.02578 app. A.4.

On MVTec AD the same paper reports 86.5 detection and 90.4 localisation AUC for the distribution-augmented variant. Rotation prediction with a kernel density estimator localises better in its table, at 92.6 2011.02578 tab. 4. These MVTec rows use the paper's own variants, not the student-teacher method, and they are not a replication of it.

Image resynthesis for road scenes

A segmenter labels the image. A pix2pixHD generator repaints a photo from that label map alone, and a discrepancy network compares the original, the repaint and the labels, outputting a per-pixel probability of "discrepancy" 1904.07595 §3 1904.07595 §3.1. The network is trained on repaintings in which randomly chosen known object instances carry a wrong label, so it never needs unknown classes 1904.07595 §3.2. Card: Detecting the Unexpected via Image Resynthesis.

Author-reported AUROC over pixels is 0.82 for all pixels except the ego vehicle on Lost and Found with Bayesian SegNet, and 0.93 for the road-only region with PSP Net. On Road Anomaly, the 60-image set, it is 0.79 and 0.83 1904.07595 fig. 5. In the same figure, the Bayesian or ensemble uncertainty baselines score 0.57 to 0.70 and the RBM road-reconstruction baseline 0.59 to 0.86 1904.07595 fig. 5. The authors name false positives as the main remaining problem 1904.07595 §5. The same resynthesis is reused for adversarial-input detection, with HOG distance and logistic regression. In the paper's table it matches or beats spatial consistency in most cells on Cityscapes and BDD100K, and is below it in two cells 1904.07595 §4.3 1904.07595 tab. 1.

Runtime failure detection for VLA policies

The robot-failure method does not look for novel images. It targets failures of a finetuned vision-language-action policy, and it needs no failure rollouts. It combines two scores, and the alarm fires when either passes its threshold 2606.21386 §3.3.

The first score, LLMD, takes the last-layer features of the policy at a fixed prior noise sample, one feature token per position. Each token is compared with a mean and covariance fitted once on the finetuning data, and the score is the largest squared Mahalanobis distance over the tokens 2606.21386 §3.1. The second, ACC, compares the unexecuted part of the previous action chunk with the start of the new chunk, normalises the gap by the robot's velocity in each dimension, and smooths the result with an exponential moving average 2606.21386 §3.2. Thresholds are calibrated per detector on successful rollouts, using a conformal band 2606.21386 §3.3 2606.21386 app. D. Card: VLA-FAIL.

Author-reported, on six real-world tasks with two VLAs and on the Libero-Plus suites, the detector is in the top three on nearly all tasks by the paper's threshold-independent metrics 2606.21386 §5. On the Libero-Plus average, its precision area is 0.94 for X-VLA and 0.72 for pi0.5, while ACC alone reaches 0.75 on pi0.5 2606.21386 tab. 2. Overhead on an RTX 5090 is 2.2% latency for X-VLA and 1.3% for pi0.5 2606.21386 tab. 3. The paper states that the method gives no formal safety guarantee 2606.21386 §6.

Graph forecasting of sensor dependencies

The graph method takes no graph as input. It learns one. Each sensor gets an embedding, and the top k most cosine-similar sensors become its neighbours, giving a directed graph 2106.06947 §3.3 2106.06947 §3.4. A graph-attention layer then predicts every sensor's next value from its own window and its neighbours' windows. Each sensor's features are gated by its embedding before a fully connected output layer 2106.06947 §3.5. It is trained on normal data with a squared forecast error 2106.06947 §3.1 2106.06947 §3.5. At test time each sensor's absolute error is normalised by its median and interquartile range, the tick's score is the largest of these, and a moving average smooths the result 2106.06947 §3.6. The most deviating sensor and its strongest attention neighbours give an explanation 2106.06947 §3.6 2106.06947 §4.8. Card: Graph Neural Network-Based Anomaly Detection in Multivariate Time Series.

Author-reported F1 is 0.81 on SWaT and 0.57 on WADI 2106.06947 tab. 2. Replacing the learned top-k graph with a complete graph gives 0.78 and 0.51. Removing the embedding from attention gives 0.76 and 0.49 2106.06947 tab. 3. The paper sets the threshold to the validation maximum 2106.06947 §4.3, but it does not say which threshold mode produced the table (see Contradictions).

Transformer reconstruction with two-phase inference

A transformer encoder reads a short window of recent readings, and two decoders try to rebuild it. Inference runs in two passes. The first pass uses a zero focus score. The second pass is conditioned on the first pass's deviation, which the paper calls self-conditioning 2201.07284 §3.4 2201.07284 alg. 1. The score is half the L2 norm of each pass's error 2201.07284 §3.5 2201.07284 eq. 13. Training uses a two-decoder adversarial loss with an evolving weight, plus a MAML meta-learning step 2201.07284 §3.4. Thresholds per dimension come from Peak-Over-Threshold 2201.07284 §3.5. Card: TranAD.

Author-reported average F1 across datasets is 0.8802 with full training data 2201.07284 §4.3. Its table gives 0.8151 on SWaT and 0.4951 on WADI 2201.07284 tab. 2. Training time per epoch is 0.87 s on SWaT and 115.91 s on WADI, against 59.40 s and 4063.05 s for the graph method, on one workstation 2201.07284 tab. 5. The paper's MAML ablation changes average F1 by about 1% and average F1* by about 12% 2201.07284 §5.1. The released repository does not implement the adversarial sign or the MAML step, and its scoring uses the second pass's error only, so it does not test the full method models.py models.py.

Convolutional autoencoder with a prediction memory

A convolutional autoencoder compresses each time window of all sensor channels into a short code and rebuilds the window. The code and the reconstruction error form one feature per window 2107.12626 §3.3.1 2107.12626 §3.4. A penalty pulls the codes toward a Gaussian through an MMD term 2107.12626 §3.3.2 2107.12626 eq. 4. A memory network predicts each window from earlier ones with two branches: a BiLSTM with attention, and a linear autoregressive model 2107.12626 §3.4.1 2107.12626 §3.4.2. The three parts are trained jointly, on normal samples only, with the weights λ1 to λ3 2107.12626 §3.5 2107.12626 eq. 20. A sample's score is its summed loss, and the threshold is the training mean plus one standard deviation 2107.12626 §3.6 2107.12626 eq. 21. Card: Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals.

Author-reported mean F1 is 0.9639 on PAMAP2, 0.9961 on CAP and 0.9960 on a private fatigue set, above all ten baselines in its table 2107.12626 tab. 2. Removing both prediction branches lowers PAMAP2 F1 to 0.8063 2107.12626 tab. 6. Removing the MMD term lowers it less, to 0.9493 2107.12626 tab. 6. No code is public, and the paper does not state the learning rate or the MMD kernel bandwidth 2107.12626 §4.3 2107.12626 §3.3.2.

Conditional normalizing flow per feature scale

A frozen ImageNet-pretrained encoder gives feature maps at three depths. For each depth, a small conditional normalizing flow is trained on normal images only; the condition is a fixed 2D sin/cos code of the location 2107.12571 §4.1 2107.12571 §4.2. A location's log-likelihood is turned into a probability, upsampled, summed over the three depths, and the anomaly score is the maximum of the summed map minus the map 2107.12571 §4.2 2107.12571 eq. 8. Card: CFLOW-AD.

Author-reported on MVTec AD, with a Wide-ResNet-50 encoder, the average is 98.26 detection AUROC, 98.62 localisation AUROC and 94.60 AUPRO 2107.12571 tab. 4. On the STC video benchmark the paper reports 72.63 detection and 94.48 localisation AUROC 2107.12571 tab. 5. The paper argues for speed against SPADE and PaDiM, but its speed numbers come from different hardware for each model 2107.12571 tab. 6 2107.12571 §5.5.

Conditional anomaly test on similar cases

For one clinical decision, the method picks the k most similar past cases by a weighted Mahalanobis distance over the other attributes, with k = 40 in the experiments 2605.04664 p. 3 2605.04664 p. 4. It fits a Bayesian network or a Naive Bayes model on those cases only, and flags the decision when its predictive probability falls below a fixed threshold 2605.04664 p. 2. Card: Evidence-based anomaly detection in clinical domains.

The test set is 100 PORT pneumonia admission decisions, with labels from a three-physician panel: 23 are labelled anomalous 2605.04664 p. 3. Author-reported best AUC-ROC is 0.81 for the Bayesian network on all cases, and 0.80 for it with weighted selection 2605.04664 tab. 2. The paper links no repository, and a search for an official one found none, so any implementation is written from the text.

Contrastive node scoring on attributed networks

CoLA trains a one-layer GCN with a bilinear discriminator. For each node it sees a positive pair (the node with a sampled subgraph seeded at the node) and a negative pair (the same node with a subgraph seeded at another node), and it learns to separate them without labels 2103.00113 §4.1 §4.2. A node's score is the mean, over 256 sampled rounds, of its negative score minus its positive score 2103.00113 §4.3 eq. 12 §5.2.3. Author-reported ROC-AUC runs from 0.7513 to 0.9512 on seven benchmarks, best in every column 2103.00113 tab. 3. These benchmarks inject anomalies, so the numbers measure recovery of injected anomalies 2103.00113 §5.1. Several baselines run out of memory on ogbn-arxiv in the paper's table, and CoLA's result there is not reproducible from the released repository 2103.00113 tab. 3 run.py. The released code draws negatives from within each batch of 300 nodes rather than from the whole graph model.py. Scoring costs 256 passes per node, which dominates run time on large graphs 2103.00113 §4.5.

Isolation over random representations

Deep Isolation Forest maps the data through 50 random networks that are never trained, and grows 6 isolation trees on each representation, using random axis-parallel cuts 2206.06602 §5.1. A point's score multiplies a depth term by the mean deviation of the point from the split thresholds on its path 2206.06602 §5.2.2 eq. 8. Author-reported, averaged over ten tabular sets, AUC-ROC is 0.925 and AUC-PR is 0.351, against 0.888 and 0.219 for the Extended Isolation Forest 2206.06602 tab. 3. Against deep ensembles, the AUC-ROC average is 0.925 against 0.889 for eRDP 2206.06602 tab. 4. Without the deviation term, AUC-PR falls to 0.318 2206.06602 tab. 6. The released scorer aggregates per representation rather than over all trees, and it standardises each representation over the rows it is given, so one point's score can depend on its batch dif.py dif.py.

Post-hoc out-of-distribution score for image classifiers

ViM needs no retraining and no outlier data 2203.10807 §1. It shifts each feature to a bias-free origin, takes the norm of its part outside the top D principal directions of the training features, and scales that norm by a constant alpha. The scaled value is added as one extra "virtual" logit, and the score is the softmax probability of that logit 2203.10807 §4 eq. 5 eq. 7. Alpha is fixed by matching the virtual logit to the mean maximum logit over training data 2203.10807 §4 eq. 6. Author-reported average AUROC over four OOD sets is 90.91 with BiT-S-R101x1, against 86.62 for Mahalanobis, the best baseline 2203.10807 tab. 2. With ViT-B/16 it is 96.23, against 96.02 for Mahalanobis 2203.10807 tab. 2. The only in-distribution set is ImageNet-1K 2203.10807 §6. The paper ranks it third on iNaturalist with BiT and links the result to small residual norms on that set 2203.10807 §6.1.

Streaming benchmark for real-time detectors

The Numenta Anomaly Benchmark is a benchmark, not a detector. It holds 58 labelled time series, with 1,000 to 22,000 rows each, and opens a window around each labelled anomaly 1510.03336 §II.A §II.B. Only the earliest detection in a window earns credit, detections outside windows count against the detector, and the score is rescaled so that a perfect detector gets 100 and a null detector gets 0 1510.03336 §II.B §II.C eq. 4. The first 15% of each file is probationary and not scored 1510.03336 §II.B. Author- reported standard-profile scores are 64.7 for Numenta HTM, 47.1 for Twitter ADVec and 35.7 for Etsy Skyline 1510.03336 tab. I. The threshold is tuned on the full corpus, with one value for all files of a detector 1510.03336 §IV. Results should therefore be read per profile and per threshold rule.

Machine-readable corner-case description (position paper)

This paper proposes no detector. It proposes a corner-case description (CCD) for automated driving that combines a high-level categorisation of corner cases with a concrete scenario description taken from existing scenario languages 2109.09607 §3 RQ1. The categorisation follows Heidecker et al., with sensor, content and temporal layers, and a method layer 2109.09607 §1 2109.09607 §2.2. The description should be machine-readable so that algorithm outputs can be turned into a description for each frame 2109.09607 §3 RQ2. The paper gives no schema, file format, labelling procedure or severity metric, and it leaves the combination for future work 2109.09607 §5. Card: Description of Corner Cases in Automated Driving: Goals and Challenges.

Outlier detectors as a defence against poisoned embeddings

The attack paper PTA optimises an image so that its embedding is close to several text proxies for a target concept and to benign source-image proxies, weighted by a balance factor alpha 2509.19994 eq. 4 §4.1. Its undetectability is measured against kNN, LOF, Isolation Forest and PCA, with 100 reference points 2509.19994 tab. 1. Author-reported ASRD (attempts that both evade detection and succeed) under the defence is 84.17% for classification and 61.80% for retrieval, against 20.04% and 14.84% for Illusion Attack 2509.19994 tab. 2 tab. 3. The paper does not define the defence's K, ratio or iteration count, so these ASRD numbers cannot be reproduced from the text 2509.19994 §5.1. Read this as evidence against simple outlier checks as a sole guard, not as a measure of detector quality.

When to use which

The student-teacher method and the two-stage method are the two with an implementation sketch below. The driving rows compare families of methods as the survey reports them, so they cite the survey, not the original papers.

The defect rows report author-reported MVTec AD numbers, averaged over its 15 categories unless noted. The semantic rows report author-reported numbers on single-class benchmarks. The road rows report author-reported AUROC over pixels on two road sets. The flow rows report author-reported numbers on MVTec AD and STC, and the clinical rows on 100 PORT cases. The robot rows report author-reported numbers on the paper's own tasks. The sensor-stream rows report author-reported F1 on public benchmarks, with the threshold and split caveats in Contradictions. The node, isolation, OOD, streaming and attack rows use each paper's own data and protocol, with the caveats above. None of these sets is a replication, and they do not measure the same thing. The survey reports no experiments of its own, so its rows give no accuracy ranking.

Implementation sketch

Two common cores follow. Loss and scoring follow the papers' equations; the student-teacher paper gives no algorithm box, and the two-stage paper's representation step is not sketched here. The flow, clinical, resynthesis, robot-failure, graph and transformer cards have their own pseudocode, and so do the node, isolation, OOD, streaming, attack and SALON cards.

# Training loss for one minibatch  [arxiv:2103.04257 §3.2] [eq. 1]–[eq. 3]
# Input:  normal images (B, 3, H, W); frozen teacher; student
# Output: scalar loss

def training_loss(images, teacher, student):
    # Teacher features are fixed; no gradient flows into the teacher  [§3.2]
    t_maps = teacher(images)
    s_maps = student(images)
    total = 0
    for level in range(L):
        # Unit-normalise the channel vector at each spatial position  [eq. 1]
        t_unit = normalise(t_maps[level], dim=1)
        s_unit = normalise(s_maps[level], dim=1)
        # Half squared distance per position, averaged over positions  [eq. 2]
        total = total + mean(0.5 * sum_sq(t_unit - s_unit, dim=1))
    # Level weights alpha_l are 1 in all experiments  [eq. 3] [§3.2]
    return mean_over_batch(total)

# Anomaly map and image score for one test image  [arxiv:2103.04257 §3.3] [eq. 4]
# Input:  image (1, 3, H, W)
# Output: anomaly map (H, W); image score (scalar)

def anomaly_map(image, teacher, student):
    t_maps = teacher(image)
    s_maps = student(image)
    result = 1
    for level in range(L):
        # Per-position distance as above, then upsampled to the input size  [§3.3]
        level_map = upsample_bilinear(
            half_sq_distance(t_maps[level], s_maps[level]), size=(H, W))
        # Element-wise product across levels  [eq. 4]
        result = result * level_map
    # Image score is the maximum of the combined map  [§3.3]
    return result, max(result)

# One-class score on a test feature, higher = more anomalous
# [arxiv:2011.02578 §3.2] [app. A.1] [eq. 6]
# Input:  feature f (d,); training features F (N, d); kernel width gamma
# Output: scalar score

def kde_score(f, F, gamma):
    # Unit-normalise both sides before the kernel  [§3.2]
    f = f / norm(f)
    F = F / norm(F, dim=1)
    # For unit vectors, exp(-gamma * |f - x|^2) is proportional to
    # exp(2 * gamma * cos), so cosine similarities are enough  [app. A.1]
    sims = F @ f  # (N,)
    # Negated log-sum-exp; scale and constant terms do not change the ranking
    return -logsumexp(2 * gamma * sims) / gamma

Details that the papers leave open, such as the optimiser, learning-rate schedule and input normalisation, are not specified on this page. The student-teacher paper's values are in its hyperparameter table, and the two-stage paper's are in its appendix 2011.02578 app. A.4. Check the implementation sections before reproducing the numbers. The kernel width for the two-stage method is discussed under Contradictions.

Contradictions

• Stated range vs. formula (defect paper). The paper gives an interval for the per-level loss and for the anomaly-map weights 2103.04257 §3.2 2103.04257 §3.3 that does not match the distance it defines 2103.04257 eq. 1. For unit vectors that distance can reach 2, and the product of several levels can exceed the interval. Treat the stated range as unreliable. Do not clip maps to a fixed threshold based on it.
• Wide-ResNet backbone (defect paper). The text reports 0.973 AUC-ROC with a Wide-ResNet50 backbone and does not say whether it is an image or pixel metric 2103.04257 §4.3.
• Kernel width (two-stage paper). Section 3.2 says the width is reduced ten times relative to the default 2011.02578 §3.2. Appendix A.4 says gamma is ten times larger than the default 2011.02578 app. A.4. These statements cannot both hold. Do not pick a direction without checking the paper's implementation.
• Mean column (two-stage paper). The mean column of its results table is meant to follow the weighting described in §4.1 2011.02578 §4.1. It does not reproduce exactly from the per-dataset rows under that weighting. A recomputation gives about 87.8 for the rotation KDE row, against 88.2 printed 2011.02578 tab. 2. Compare per-dataset numbers when the difference matters.
• ACC smoothing factor (robot-failure paper). The method text calls a strong smoothing factor of 0.9 necessary 2606.21386 §3.2. The ablation text and its figure caption say a fixed value of 0.1 was used in all experiments 2606.21386 app. B. The hyperparameter tables list 0.9 for both VLAs and both settings 2606.21386 app. F. The text does not resolve the conflict. Treat the factor as tunable and check it on calibration data.
• Chunk length (robot-failure paper). The finetuning table gives chunk length 20 for pi0.5 and 30 for X-VLA 2606.21386 app. F. The Libero-Plus detail table gives 5 for pi0.5 and 20 for X-VLA 2606.21386 app. G. Use the value for the setting you run.
• Scope of "anomaly". The defect paper works on industrial inspection images, benchmarked on MVTec AD 2103.04257 tab. 1. The two-stage paper works on single-class semantic benchmarks 2011.02578 §4. The resynthesis paper works on road scenes with unknown objects 1904.07595 §1. The robot-failure paper targets policy failures, not novel inputs 2606.21386 §1. The survey excludes sensor-layer and pixel-level anomalies 2204.07974 §1. The two sensor-stream papers work on multivariate time series from sensors and other systems 2106.06947 §4.1 2201.07284 §4.1. The position paper's corner cases include sensor-layer cases, which the survey leaves out 2109.09607 §1. The transformer paper reports the graph method in its own table 2201.07284 tab. 2, and some of its baselines were re-implemented by its authors 2201.07284 §4. Apart from that, no paper here evaluates another's method, so most numbers cannot be confirmed or contradicted across papers.
• MVTec numbers across papers. The two-stage paper's MVTec rows 2011.02578 tab. 4 and the defect paper's image AUC-ROC of 0.955 2103.04257 tab. 2 come from different training setups and different methods. They are not a like-for-like comparison.
• Graph method's WADI result across papers. The graph paper reports F1 0.57 on WADI for its own method 2106.06947 tab. 2. The transformer paper reports 0.4260 for the same method on WADI, and 0.4951 for its own method 2201.07284 tab. 2. On WADI the two papers therefore rank the methods differently. On SWaT both report 0.81 for the graph method 2106.06947 tab. 2 2201.07284 tab. 2. Check the source of a WADI number before quoting it.
• Dataset sizes differ between the sensor-stream papers. The graph paper lists WADI with 127 features and SWaT with 47515 training rows 2106.06947 tab. 1. The transformer paper lists WADI with 123 dimensions and SWaT with 496800 training rows 2201.07284 tab. 1. The two papers do not use the same split, so their F1 values are not from one benchmark protocol.
• Threshold mode (graph paper). The paper sets the threshold to the validation maximum 2106.06947 §4.3. The released code's default instead picks the threshold that maximises F1 on the test labels run.sh evaluate.py. The table's mode is not stated, so the table may be optimistic. Use a validation-based threshold for any deployable number.
• Method versus released code (transformer paper). The paper describes an adversarial two-decoder loss, a MAML step and an 80/20 split 2201.07284 §3.4 2201.07284 §4. The released code has no adversarial sign and no MAML step, and it trains on the full series for five epochs models.py main.py. The paper's numbers therefore describe a method that the released code does not run.
• Training objective (flow paper). The paper minimises the maximum-likelihood objective in 2107.12571 eq. 7 and its expansion in 2107.12571 app. B. The released code minimises a negative log-sigmoid of a per-dimension log-likelihood train.py utils.py. The two are different objectives, and the reported numbers come from the code's version.
• Training length and batch (flow paper). The paper states 100 epochs and 8192 vectors per decoder step 2107.12571 §5.1. The code's defaults are 25 meta-epochs of 8 sub-epochs, and it processes 256 vectors per decoder call config.py train.py.
• Epoch selection (flow paper). The paper does not say how an epoch was chosen 2107.12571 §5.1. The code keeps the epoch with the best segmentation AUROC on the test set and reports the maximum of each metric train.py. The reported numbers may therefore be optimistic for a held-out test.
• Speed (flow paper). The "10x faster and smaller" claim compares GPU timings for CFLOW-AD with timings for SPADE and PaDiM taken from another paper and measured on a CPU 2107.12571 §5.5 2107.12571 tab. 6.
• Weighting effect (clinical paper). Weighted selection raises the Naive Bayes AUC-ROC from 0.74 to 0.80 in the paper's table, but the Bayesian network gives 0.81 on all cases and 0.80 with weighting 2605.04664 tab. 2. The table therefore does not show a gain from weighting for the Bayesian network.
• Scope of "anomaly" (flow and clinical papers). The flow paper works on industrial images and on the 13-scene STC dataset 2107.12571 §5.1. The clinical paper scores decisions given patient attributes, which is a conditional question, not an input that looks unlike training data 2605.04664 p. 1.
• Aggregation rule (GNN survey). Section 5.1 consolidates channel errors by summing them, and §5.2 says GDN uses the maximum channel error 2307.03759 §5.1 2307.03759 §5.2. The graph-forecasting paper uses the maximum 2106.06947 §3.6. A sum and a maximum react differently to one large error, so state which one a number used.
• Principal-space dimension (ViM). The paper sets D to 1000 when N > 1500 and to 512 otherwise 2203.10807 §6. The released code uses 1000 from N ≥ 2048, 512 from N ≥ 768, and N // 2 below that benchmark.py. The two rules agree for the paper's models, and differ for other widths.
• NAB table vs repository. Table I gives 64.7 for Numenta HTM and 16.8 for the random detector. The repository README gives HTM 70.5 to 69.7 for NuPIC 1.0 and random 11.0 1510.03336 tab. I README.md README.md. Treat Table I as the paper's numbers.
• PTA's own tables (attack paper). The ablation gives 95.35 as the baseline Cls ASRD for ImageBind on ImageNet with the defence at (N_s, N_c) = (20, 10), while the main table gives 77.54 for the same model, dataset and defence 2509.19994 tab. 17 2509.19994 tab. 2. The paper does not say whether the configurations differ or a label is wrong.
• Scope of "anomaly" (new papers). ViM scores out-of-distribution inputs to a classifier 2203.10807 §1. CoLA's benchmarks inject anomalies 2103.00113 §5.1. NAB mixes real and synthetic streams 1510.03336 §II.A. PTA treats outlier detectors as a defence 2509.19994 §3.3. None of these tests the same thing as the defect or road papers above.
• Dimensions and improvement row (CAE-M paper). Section 4.3 gives 36 PAMAP2 dimensions, and Table 1 gives 27 2107.12626 §4.3 2107.12626 tab. 1. Its "Improvement" row reports 7.96% on PAMAP2 F1, but the table's own ratio of CAE-M to the best baseline is about 9.0%, and the paper does not say how the row is computed 2107.12626 tab. 2. Use the table values and check the dimension count against the data.
• Scope of "anomaly" (CAE-M paper). PAMAP2 treats running, stair climbing and rope jumping as anomalies, and CAP treats sleep-disordered breathing as anomalous 2107.12626 §4.1. These are activity and disorder labels, not sensor faults, so the CAE-M numbers measure a different question from the industrial and road papers above.
• Scope of "anomaly" (SALON). SALON's lethal test flags cells far from the cluster centres, and its one-click label marks an object the user names 2412.07826 §3.5 2412.07826 §3.5.1. The paper reports navigation outcomes and buffer statistics, with no AUROC or other detection metric 2412.07826 tab. 1 2412.07826 tab. 4. Its numbers cannot be placed beside the detectors above.

Papers

• Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals: trains a convolutional autoencoder with an MMD penalty, an attention BiLSTM and an autoregressive predictor jointly on normal samples; reports mean F1 0.9639 on PAMAP2 and 0.9961 on CAP, above ten baselines in its table.
• Student-Teacher Feature Pyramid Matching for Anomaly Detection: distils an ImageNet-pretrained ResNet-18 teacher into a student on normal images and combines three feature levels into a pixel map and an image score; reports 0.955 image AUC-ROC on MVTec AD.
• Graph Neural Network-Based Anomaly Detection in Multivariate Time Series: learns a sensor graph from embedding similarity and forecasts each sensor with graph attention; scores a tick by its largest normalised sensor deviation; reports F1 0.81 on SWaT and 0.57 on WADI.
• TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data: reconstructs a window with a transformer in two phases, the second conditioned on the first, with adversarial two-decoder training and MAML; reports average F1 0.8802 and 75% to 99% lower training time.
• Detecting the Unexpected via Image Resynthesis: resynthesises a street scene from its label map and scores per-pixel discrepancies with a network trained on synthetic label swaps; reports AUROC 0.79 to 0.93 on Lost and Found and a 60-image road set.
• Learning and Evaluating Representations for Deep One-class Classification: learns self-supervised features from normal images, then fits a kernel density estimator or one-class SVM on them; adds distribution-augmented contrastive learning and reports mean AUC 89.9 on five single-class benchmarks.
• VLA-FAIL: detects failures of finetuned vision-language-action policies at runtime by combining a last-layer Mahalanobis distance with action-chunk consistency; reports threshold-independent gains on six real-world tasks and Libero-Plus, with 1.3% to 2.2% latency overhead.
• CFLOW-AD: Real-Time Unsupervised Anomaly Detection with Localization via Conditional Normalizing Flows: fits a conditional normalizing flow per scale on frozen encoder features of normal images and scores each location by likelihood; reports 98.62 localisation AUROC on MVTec AD with a WRN50 encoder.
• Evidence-based anomaly detection in clinical domains: flags a clinical decision when a Bayesian network or Naive Bayes model, fitted on the most similar past patients, gives it low probability; reports best AUC-ROC 0.81 on 100 pneumonia admission decisions.
• Machine Learning with a Reject Option: A survey: surveys models that may abstain, separating ambiguity from novelty rejection; reports no new results and links novelty rejection to anomaly detection.
• Description of Corner Cases in Automated Driving: Goals and Challenges: a position paper proposing a machine-readable description of driving corner cases that combines scenario languages with corner-case levels; gives six research questions and three conceptual examples, with no results or implementation.
• Anomaly Detection in Autonomous Driving: A Survey: classifies 49 corner-case detection methods by sensor, approach and online capability across camera, lidar, radar, multimodal and object-level data; runs no experiments of its own.
• Evaluating Real-time Anomaly Detection Algorithms - the Numenta Anomaly Benchmark: a streaming benchmark of 58 labelled series with windowed, earliest-detection scoring normalised between a perfect and a null detector; reports standard-profile scores of 64.7 for HTM and 35.7 for Skyline.
• Anomaly Detection on Attributed Networks via Contrastive Self-Supervised Learning: scores each node by how well it matches its sampled subgraph against a random other node's, using a one-layer GCN and a bilinear discriminator; reports ROC-AUC 0.7513 to 0.9512 on seven injected-anomaly benchmarks.
• ViM: Out-Of-Distribution with Virtual-logit Matching: scores a trained classifier's input by its feature residual off principal directions, added as a virtual logit; reports average AUROC 90.91 with BiT-S-R101x1 on four OOD sets.
• Deep Isolation Forest for Anomaly Detection: isolates points in 50 untrained random representations, with six trees on each, and scores depth times deviation; reports average AUC-PR 0.351 on ten tabular sets.
• A Survey on Graph Neural Networks for Time Series: Forecasting, Classification, Imputation, and Anomaly Detection: surveys graph neural networks for time series across four tasks, with anomaly detection built from reconstruction, forecasting or relational backbones; runs no experiments of its own.
• Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Models: a targeted attack on multimodal embeddings that aligns to several text proxies and benign source proxies, and is tested against four outlier detectors; reports 84.17% classification ASRD under that defence.
• SALON: Self-supervised Adaptive Learning for Off-road Navigation: learns off-road traversability online from the robot's own driving, pairing foundation-model features on a bird's-eye-view grid with bandpower roughness and a Gaussian process; reports navigation counts comparable to methods trained offline on one ATV course.