---
kind: concept
slug: anomaly-detection
title: Anomaly detection
summary: >-
  Flags inputs, pixels, sensor streams, graph nodes, robot actions or clinical decisions that depart from normal data, usually with few labelled failures. Covers defect maps, flow likelihoods, isolation forests, node contrast, OOD scores, streaming benchmarks, VLA failure detection and off-road navigation. Most numbers are author-reported, and no two papers share a setting.
tags: [anomaly-detection, one-class, knowledge-distillation, normalizing-flows, industrial-inspection, autonomous-driving, image-resynthesis, failure-detection, clinical-decision-support, multivariate-time-series, graph-neural-network, transformer, survey, isolation-forest, out-of-distribution, attributed-networks, streaming-data, benchmark, adversarial-attack, corner-cases, off-road-navigation]
papers: ["1904.07595", "2011.02578", "2103.04257", "2106.06947", "2107.11277", "2107.12571", "2107.12626", "2109.09607", "2201.07284", "2204.07974", "2605.04664", "2606.21386", "1510.03336", "2103.00113", "2203.10807", "2206.06602", "2307.03759", "2509.19994", "2412.07826"]
related: [knowledge-distillation, uncertainty-estimation, semantic-segmentation, object-detection, contrastive-learning, self-supervised-learning, image-to-image-translation, adversarial-robustness, vision-language-action-model, graph-neural-network, attention-mechanism, long-short-term-memory, time-series-forecasting, meta-learning, self-attention, positional-encoding, normalizing-flows, one-class-classification, conformal-prediction, benchmark-validity, attributed-network-embedding, data-poisoning, ensemble-learning, mahalanobis-distance, dataset-curation, functional-safety, gaussian-process, foundation-model, bird-eye-view-perception]
status: draft
updated_at: 2026-11-01
---

## Overview

The task is to find where an input, or a step of a process, looks unlike the
normal case. Most methods here learn what "normal" is from normal examples
only, or from known classes only, so they never see the failure they are meant
to catch. The detector therefore has to define "normal" from what it sees
during training [arxiv:2103.04257 §1] [arxiv:2103.04257 §3.2]
[arxiv:2011.02578 §1] [arxiv:1904.07595 §3.2].

Three properties shape the design space:

- **Output granularity.** A method can output an image-level score (is anything
  wrong?), a pixel-level map (where?), or a per-step alarm for a running
  policy (is the robot failing now?). The defect paper reports both an image
  and a pixel score [arxiv:2103.04257 tab. 2] [arxiv:2103.04257 tab. 1]. The
  self-supervised method reports image-level scores on semantic benchmarks and
  localisation on MVTec AD [arxiv:2011.02578 tab. 2] [arxiv:2011.02578 tab. 4].
  The resynthesis method outputs a per-pixel score for road scenes
  [arxiv:1904.07595 §3]. The robot-failure method outputs one score per
  environment step and an alarm [arxiv:2606.21386 §3.3]. The two sensor-stream
  methods score each timestamp; the graph method flags a tick from its largest
  per-sensor deviation [arxiv:2106.06947 §3.6], and the transformer method
  thresholds each dimension for diagnosis [arxiv:2201.07284 §3.1]. The
  autoencoder method scores a whole sample by its summed loss, not each
  timestamp [arxiv:2107.12626 §3.6]. The flow method outputs one likelihood per feature location, turned into a pixel map
  [arxiv:2107.12571 §4.2]. The clinical method outputs one probability per
  decision, with a threshold for the alarm [arxiv:2605.04664 p. 2]. The
  isolation method averages a score over its trees, one per point
  [arxiv:2206.06602 §5.2.2]. The node method gives one score per node, averaged
  over sampled rounds [arxiv:2103.00113 §4.3]. The classifier method gives one
  score per input image [arxiv:2203.10807 §4].
- **What "normal" is measured against.** Reconstruction and density methods
  judge an input by how well they model it. Feature-matching methods judge it
  by how much a second network disagrees with a fixed reference network
  [arxiv:2103.04257 §2.2]. The two-stage method fits a kernel density estimator
  or a one-class SVM on features learned from normal images
  [arxiv:2011.02578 §3.2]. The resynthesis method repaints the scene from its
  own label map and checks where the repaint disagrees with the photo
  [arxiv:1904.07595 §3]. The robot-failure method uses a Mahalanobis distance
  on last-layer features, plus the disagreement between overlapping action
  chunks [arxiv:2606.21386 §3.1] [arxiv:2606.21386 §3.2]. The graph method
  forecasts each sensor's next value and scores the error
  [arxiv:2106.06947 §3.5] [arxiv:2106.06947 §3.6]. The transformer method
  rebuilds a window and scores the rebuild error [arxiv:2201.07284 §3.5].
  The autoencoder method rebuilds each window and predicts it from earlier
  windows, then sums the reconstruction and prediction errors
  [arxiv:2107.12626 §3.4] [arxiv:2107.12626 §3.6]. The flow method scores a location by its log-likelihood under a density
  learned from normal features [arxiv:2107.12571 §4.2]. The clinical method
  fits a probability model on the k most similar past patients, and scores a
  decision by its predictive probability under that model
  [arxiv:2605.04664 p. 2] [arxiv:2605.04664 p. 3].
- **Which failure is meant.** Industrial defects, unexpected road objects,
  corner cases in driving, and policy failures are different targets. Each
  paper picks one, and the others need their own evidence.

The word covers more than industrial defects. The autonomous-driving survey
uses it for corner cases: unusual objects, scenes or behaviour on the road
[arxiv:2204.07974 §1]. Its scope leaves out sensor-layer anomalies, pixel-level
anomalies and adversarial attacks [arxiv:2204.07974 §1]. A position paper on the same driving setting asks for
a machine-readable description of corner cases, rather than a detector. Its
corner-case layers include a sensor layer, and its first example is glare
[arxiv:2109.09607 §1] [arxiv:2109.09607 §4.1]. It reports no experiments
[arxiv:2109.09607 §3]. A third setting is
one-class classification of whole images, where the outliers are the other
object categories [arxiv:2011.02578 §4]. A fourth is novelty rejection in a
classifier that may abstain: the inputs are rare or absent in training
[arxiv:2107.11277 §2.2.2], and the survey lists anomaly detection as a related
area [arxiv:2107.11277 §9.2]. A fifth is failure detection for a robot
policy, which the authors separate from novelty: out-of-distribution states do
not always cause failures, and some failures have no visual anomaly
[arxiv:2606.21386 §1]. A sixth is multivariate sensor data, where the anomaly
is a break in the expected relations between sensors or in the temporal
pattern. The graph and transformer papers evaluate on public benchmarks with
labelled anomalies, and they use labels only for testing
[arxiv:2106.06947 §4.1] [arxiv:2201.07284 §3.1]. The autoencoder paper also
uses public sensor data, but its anomalies are activity or sleep-disorder
labels, and it adds a private fatigue set [arxiv:2107.12626 §4.1]. A seventh is a conditional
question: is this decision unusual, given the patient's other attributes? The
clinical paper defines the target that way, with its own labels from a
physician panel [arxiv:2605.04664 p. 1] [arxiv:2605.04664 p. 3]. An eighth is
an anomalous node in an attributed network, where the node's links or its own
attributes disagree with its neighbourhood [arxiv:2103.00113 §1]. A ninth is
out-of-distribution input to a trained image classifier. It overlaps with the
novelty setting above, but the detector reads one fixed network's features and
logits [arxiv:2203.10807 §1]. A tenth is a streaming benchmark, which scores
how early a detector flags a labelled window rather than a new detector
[arxiv:1510.03336 §I] [arxiv:1510.03336 §II.B]. An eleventh is an off-road
robot that must decide, while it drives, which unfamiliar terrain and which
user-named objects are lethal. SALON marks a cell lethal when its distance to
every k-means cluster centre exceeds a threshold, and a clicked feature gets
high roughness, which raises the cost of similar features [arxiv:2412.07826
§3.5] [arxiv:2412.07826 §3.5.1]. It is evaluated on navigation outcomes on one
course, not on labelled anomalies [arxiv:2412.07826 tab. 4]. The attack paper
PTA runs the other way: it uses four outlier detectors as a defence that a poisoned
embedding must pass, and it proposes an attack, not a detector
[arxiv:2509.19994 §3.3]. The papers therefore define the problem differently,
and results from one setting do not carry over to another without checking.

The variants that compare a model with a reference share one structure: fit a
model on normal data, then compare the model's output with a reference at test
time and turn the disagreement into a map or a score. The two-stage method
gives a score but no map in its main experiments. The robot-failure method
gives a score and an alarm, with no map. The two time-series methods also
compare a prediction with the observed value, one sensor or dimension at a
time, and give a score per timestamp rather than a map. The autoencoder
method compares its rebuild and predictions with the observed window, and
gives one score per sample [arxiv:2107.12626 §3.6]. The flow method and
the clinical test do not compare against a reference network or a reference
case set at test time; each scores a sample by its likelihood under a model
fitted on normal data. The flow method turns those likelihoods into a map. The isolation method
has no reference model: it measures how few random cuts isolate a point, and
how far the point lies from those cuts [arxiv:2206.06602 §5.2.2]. The node
method contrasts each node with the sampled subgraph of a random other node
[arxiv:2103.00113 §4.1]. The classifier method takes the norm of a feature
outside a principal subspace of training features, and adds it as one virtual
logit [arxiv:2203.10807 §4]. The SALON test compares a cell's feature with
k-means centres fitted on training features, and it has no density model of
its own [arxiv:2412.07826 §3.1.2] [arxiv:2412.07826 §3.5.1].

## Variants

Two methods are documented in full, each with a sketch below. A convolutional
autoencoder with a prediction memory for multi-sensor signals is documented
in full, without a sketch, because its card has its own pseudocode
[arxiv:2107.12626 §3]. Six more have
cards and are described here without a sketch: the flow-based localisation
method, the clinical conditional test, the resynthesis method, the robot-failure
method, and two methods for multivariate sensor streams, graph forecasting and
transformer reconstruction. Their cards have their own pseudocode. Four more
cover the new papers: a node method for attributed networks, an isolation method
for tabular, graph and time-series data, a post-hoc OOD score, and the
streaming benchmark. A position paper on corner-case description comes next,
with no method to sketch. SALON is an online navigation method whose distance
test is one part of a larger pipeline, and its card has its own pseudocode
[arxiv:2412.07826 §3]. The attack paper and the GNN survey close this
section.
The survey adds a classification of driving methods, which cite
other papers that have no card here, so they are named only.

### Student-teacher feature matching

A frozen teacher pretrained on ImageNet and a student with the same
architecture both produce feature pyramids. The student is trained on
anomaly-free images to match the teacher's unit-normalised features at three
levels (conv2_x to conv4_x of ResNet-18) with equal weights
[arxiv:2103.04257 §3.1] [arxiv:2103.04257 §3.2]. At test time the per-level
distance maps are upsampled and multiplied, and the image score is the maximum
of the product [arxiv:2103.04257 §3.3] [arxiv:2103.04257 eq. 4]. Card:
[Student-Teacher Feature Pyramid Matching for Anomaly Detection](/papers/2103.04257).

The paper compares itself with the student-teacher method of Bergmann et al.
(cited as STAD), which it argues uses two-step, single-scale transfer and
loses information [arxiv:2103.04257 §4.3]. That earlier method has no
card yet, so its numbers are only what appear in this paper's tables
[arxiv:2103.04257 tab. 1].

### Two-stage self-supervised one-class detector

Stage one trains a ResNet-18 on normal images only, with a self-supervised
proxy task: rotation prediction, contrastive learning, or contrastive learning
with distribution augmentation [arxiv:2011.02578 §3.1]. Distribution
augmentation treats the 90, 180 and 270 degree rotations of each training
image as separate distributions, which quadruples the training set
[arxiv:2011.02578 §3.1.3]. Stage two fits an RBF one-class SVM or a kernel
density estimator on the L2-normalised features, and the test score is the
kernel's log-sum-exp value [arxiv:2011.02578 §3.2] [arxiv:2011.02578 app. A.1].
Card: [Learning and Evaluating Representations for Deep One-class
Classification](/papers/2011.02578).

Author-reported, on five single-class benchmarks with no test-time augmentation,
the mean AUC is 89.9 with the one-class SVM and 89.8 with the kernel density
estimator. The same paper's rotation-prediction variant with a kernel density
estimator averages 88.2, an ImageNet ResNet-50 with a one-class SVM averages
84.0, and the earlier end-to-end rotation classifier averages 83.1
[arxiv:2011.02578 tab. 2]. The main experiments use CIFAR-10, CIFAR-100,
Fashion-MNIST, cat-vs-dog and CelebA [arxiv:2011.02578 §4]. The hyperparameters
were tuned on 500 inlier and 500 outlier CIFAR-10 images, which the paper says
may violate the one-class assumption [arxiv:2011.02578 app. A.4].

On MVTec AD the same paper reports 86.5 detection and 90.4 localisation AUC for
the distribution-augmented variant. Rotation prediction with a kernel density
estimator localises better in its table, at 92.6 [arxiv:2011.02578 tab. 4].
These MVTec rows use the paper's own variants, not the student-teacher method,
and they are not a replication of it.

### Image resynthesis for road scenes

A segmenter labels the image. A pix2pixHD generator repaints a photo from that
label map alone, and a discrepancy network compares the original, the repaint
and the labels, outputting a per-pixel probability of "discrepancy"
[arxiv:1904.07595 §3] [arxiv:1904.07595 §3.1]. The network is trained on
repaintings in which randomly chosen known object instances carry a wrong
label, so it never needs unknown classes [arxiv:1904.07595 §3.2]. Card:
[Detecting the Unexpected via Image Resynthesis](/papers/1904.07595).

Author-reported AUROC over pixels is 0.82 for all pixels except the ego
vehicle on Lost and Found with Bayesian SegNet, and 0.93 for the road-only
region with PSP Net. On Road Anomaly, the 60-image set, it is 0.79 and 0.83
[arxiv:1904.07595 fig. 5]. In the same figure, the Bayesian or ensemble uncertainty
baselines score 0.57 to 0.70 and the RBM road-reconstruction baseline 0.59 to
0.86 [arxiv:1904.07595 fig. 5]. The authors name false positives as the main
remaining problem [arxiv:1904.07595 §5]. The same resynthesis is reused for
adversarial-input detection, with HOG distance and logistic regression. In the
paper's table it matches or beats spatial consistency in most cells on
Cityscapes and BDD100K, and is below it in two cells [arxiv:1904.07595 §4.3]
[arxiv:1904.07595 tab. 1].

### Runtime failure detection for VLA policies

The robot-failure method does not look for novel images. It targets failures
of a finetuned vision-language-action policy, and it needs no failure
rollouts. It combines two scores, and the alarm fires when either passes its
threshold [arxiv:2606.21386 §3.3].

The first score, LLMD, takes the last-layer features of the policy at a fixed
prior noise sample, one feature token per position. Each token is compared with
a mean and covariance fitted once on the finetuning data, and the score is the
largest squared Mahalanobis distance over the tokens [arxiv:2606.21386 §3.1].
The second, ACC, compares the unexecuted part of the previous action chunk
with the start of the new chunk, normalises the gap by the robot's velocity in
each dimension, and smooths the result with an exponential moving average
[arxiv:2606.21386 §3.2]. Thresholds are calibrated per detector on successful
rollouts, using a conformal band [arxiv:2606.21386 §3.3] [arxiv:2606.21386 app. D].
Card: [VLA-FAIL](/papers/2606.21386).

Author-reported, on six real-world tasks with two VLAs and on the Libero-Plus
suites, the detector is in the top three on nearly all tasks by the paper's
threshold-independent metrics [arxiv:2606.21386 §5]. On the Libero-Plus
average, its precision area is 0.94 for X-VLA and 0.72 for pi0.5, while ACC
alone reaches 0.75 on pi0.5 [arxiv:2606.21386 tab. 2]. Overhead on an RTX 5090
is 2.2% latency for X-VLA and 1.3% for pi0.5 [arxiv:2606.21386 tab. 3]. The
paper states that the method gives no formal safety guarantee
[arxiv:2606.21386 §6].

### Graph forecasting of sensor dependencies

The graph method takes no graph as input. It learns one. Each sensor gets an
embedding, and the top k most cosine-similar sensors become its neighbours,
giving a directed graph [arxiv:2106.06947 §3.3] [arxiv:2106.06947 §3.4]. A
graph-attention layer then predicts every sensor's next value from its own
window and its neighbours' windows. Each sensor's features are gated by its
embedding before a fully connected output layer [arxiv:2106.06947 §3.5]. It is
trained on normal data with a squared forecast error [arxiv:2106.06947 §3.1]
[arxiv:2106.06947 §3.5]. At test time each sensor's absolute error is
normalised by its median and interquartile range, the tick's score is the
largest of these, and a moving average smooths the result
[arxiv:2106.06947 §3.6]. The most deviating sensor and its strongest attention
neighbours give an explanation [arxiv:2106.06947 §3.6] [arxiv:2106.06947 §4.8].
Card: [Graph Neural Network-Based Anomaly Detection in Multivariate Time
Series](/papers/2106.06947).

Author-reported F1 is 0.81 on SWaT and 0.57 on WADI [arxiv:2106.06947 tab. 2].
Replacing the learned top-k graph with a complete graph gives 0.78 and 0.51.
Removing the embedding from attention gives 0.76 and 0.49
[arxiv:2106.06947 tab. 3]. The paper sets the threshold to the validation
maximum [arxiv:2106.06947 §4.3], but it does not say which threshold mode
produced the table (see Contradictions).

### Transformer reconstruction with two-phase inference

A transformer encoder reads a short window of recent readings, and two decoders
try to rebuild it. Inference runs in two passes. The first pass uses a zero
focus score. The second pass is conditioned on the first pass's deviation,
which the paper calls self-conditioning [arxiv:2201.07284 §3.4]
[arxiv:2201.07284 alg. 1]. The score is half the L2 norm of each pass's error
[arxiv:2201.07284 §3.5] [arxiv:2201.07284 eq. 13]. Training uses a two-decoder
adversarial loss with an evolving weight, plus a MAML meta-learning step
[arxiv:2201.07284 §3.4]. Thresholds per dimension come from Peak-Over-Threshold
[arxiv:2201.07284 §3.5]. Card: [TranAD](/papers/2201.07284).

Author-reported average F1 across datasets is 0.8802 with full training data
[arxiv:2201.07284 §4.3]. Its table gives 0.8151 on SWaT and 0.4951 on WADI
[arxiv:2201.07284 tab. 2]. Training time per epoch is 0.87 s on SWaT and 115.91
s on WADI, against 59.40 s and 4063.05 s for the graph method, on one
workstation [arxiv:2201.07284 tab. 5]. The paper's MAML ablation changes
average F1 by about 1% and average F1* by about 12% [arxiv:2201.07284 §5.1].
The released repository does not implement the adversarial sign or the MAML
step, and its scoring uses the second pass's error only, so it does not test
the full method [code: src/models.py#L263-L267] [code: src/models.py#L274-L281].

### Convolutional autoencoder with a prediction memory

A convolutional autoencoder compresses each time window of all sensor
channels into a short code and rebuilds the window. The code and the
reconstruction error form one feature per window [arxiv:2107.12626 §3.3.1]
[arxiv:2107.12626 §3.4]. A penalty pulls the codes toward a Gaussian through
an MMD term [arxiv:2107.12626 §3.3.2] [arxiv:2107.12626 eq. 4]. A memory
network predicts each window from earlier ones with two branches: a BiLSTM
with attention, and a linear autoregressive model [arxiv:2107.12626 §3.4.1]
[arxiv:2107.12626 §3.4.2]. The three parts are trained jointly, on normal
samples only, with the weights λ1 to λ3 [arxiv:2107.12626 §3.5]
[arxiv:2107.12626 eq. 20]. A sample's score is its summed loss, and the
threshold is the training mean plus one standard deviation
[arxiv:2107.12626 §3.6] [arxiv:2107.12626 eq. 21]. Card:
[Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals](/papers/2107.12626).

Author-reported mean F1 is 0.9639 on PAMAP2, 0.9961 on CAP and 0.9960 on a
private fatigue set, above all ten baselines in its table
[arxiv:2107.12626 tab. 2]. Removing both prediction branches lowers PAMAP2
F1 to 0.8063 [arxiv:2107.12626 tab. 6]. Removing the MMD term lowers it less,
to 0.9493 [arxiv:2107.12626 tab. 6]. No code is public, and the paper does
not state the learning rate or the MMD kernel bandwidth
[arxiv:2107.12626 §4.3] [arxiv:2107.12626 §3.3.2].

### Conditional normalizing flow per feature scale

A frozen ImageNet-pretrained encoder gives feature maps at three depths. For
each depth, a small conditional normalizing flow is trained on normal images
only; the condition is a fixed 2D sin/cos code of the location
[arxiv:2107.12571 §4.1] [arxiv:2107.12571 §4.2]. A location's log-likelihood
is turned into a probability, upsampled, summed over the three depths, and
the anomaly score is the maximum of the summed map minus the map
[arxiv:2107.12571 §4.2] [arxiv:2107.12571 eq. 8]. Card:
[CFLOW-AD](/papers/2107.12571).

Author-reported on MVTec AD, with a Wide-ResNet-50 encoder, the average is
98.26 detection AUROC, 98.62 localisation AUROC and 94.60 AUPRO
[arxiv:2107.12571 tab. 4]. On the STC video benchmark the paper reports 72.63
detection and 94.48 localisation AUROC [arxiv:2107.12571 tab. 5]. The paper
argues for speed against SPADE and PaDiM, but its speed numbers come from
different hardware for each model [arxiv:2107.12571 tab. 6] [arxiv:2107.12571 §5.5].

### Conditional anomaly test on similar cases

For one clinical decision, the method picks the k most similar past cases by a
weighted Mahalanobis distance over the other attributes, with k = 40 in the
experiments [arxiv:2605.04664 p. 3] [arxiv:2605.04664 p. 4]. It fits a
Bayesian network or a Naive Bayes model on those cases only, and flags the
decision when its predictive probability falls below a fixed threshold
[arxiv:2605.04664 p. 2]. Card:
[Evidence-based anomaly detection in clinical domains](/papers/2605.04664).

The test set is 100 PORT pneumonia admission decisions, with labels from a
three-physician panel: 23 are labelled anomalous [arxiv:2605.04664 p. 3]. Author-reported best AUC-ROC is 0.81 for the
Bayesian network on all cases, and 0.80 for it with weighted selection
[arxiv:2605.04664 tab. 2]. The paper links no repository, and a search for an
official one found none, so any implementation is written from the text.

### Contrastive node scoring on attributed networks

CoLA trains a one-layer GCN with a bilinear discriminator. For each node it
sees a positive pair (the node with a sampled subgraph seeded at the node) and
a negative pair (the same node with a subgraph seeded at another node), and it
learns to separate them without labels [arxiv:2103.00113 §4.1] [§4.2]. A node's
score is the mean, over 256 sampled rounds, of its negative score minus its
positive score [arxiv:2103.00113 §4.3] [eq. 12] [§5.2.3]. Author-reported
ROC-AUC runs from 0.7513 to 0.9512 on seven benchmarks, best in every column
[arxiv:2103.00113 tab. 3]. These benchmarks inject anomalies, so the numbers
measure recovery of injected anomalies [arxiv:2103.00113 §5.1]. Several
baselines run out of memory on ogbn-arxiv in the paper's table, and CoLA's
result there is not reproducible from the released repository
[arxiv:2103.00113 tab. 3] [code: run.py#L36-L48]. The released code draws
negatives from within each batch of 300 nodes rather than from the whole graph
[code: model.py#L94-L97]. Scoring costs 256 passes per node, which dominates
run time on large graphs [arxiv:2103.00113 §4.5].

### Isolation over random representations

Deep Isolation Forest maps the data through 50 random networks that are never
trained, and grows 6 isolation trees on each representation, using random
axis-parallel cuts [arxiv:2206.06602 §5.1]. A point's score multiplies a depth
term by the mean deviation of the point from the split thresholds on its path
[arxiv:2206.06602 §5.2.2] [eq. 8]. Author-reported, averaged over ten tabular
sets, AUC-ROC is 0.925 and AUC-PR is 0.351, against 0.888 and 0.219 for the
Extended Isolation Forest [arxiv:2206.06602 tab. 3]. Against deep ensembles,
the AUC-ROC average is 0.925 against 0.889 for eRDP [arxiv:2206.06602 tab. 4].
Without the deviation term, AUC-PR falls to 0.318 [arxiv:2206.06602 tab. 6].
The released scorer aggregates per representation rather than over all trees,
and it standardises each representation over the rows it is given, so one
point's score can depend on its batch [code: algorithms/dif.py#L454]
[code: algorithms/dif.py#L320-L323].

### Post-hoc out-of-distribution score for image classifiers

ViM needs no retraining and no outlier data [arxiv:2203.10807 §1]. It shifts
each feature to a bias-free origin, takes the norm of its part outside the top
D principal directions of the training features, and scales that norm by a
constant alpha. The scaled value is added as one extra "virtual" logit, and the
score is the softmax probability of that logit [arxiv:2203.10807 §4] [eq. 5]
[eq. 7]. Alpha is fixed by matching the virtual logit to the mean maximum logit
over training data [arxiv:2203.10807 §4] [eq. 6]. Author-reported average AUROC
over four OOD sets is 90.91 with BiT-S-R101x1, against 86.62 for Mahalanobis,
the best baseline [arxiv:2203.10807 tab. 2]. With ViT-B/16 it is 96.23, against
96.02 for Mahalanobis [arxiv:2203.10807 tab. 2]. The only in-distribution set is
ImageNet-1K [arxiv:2203.10807 §6]. The paper ranks it third on iNaturalist with
BiT and links the result to small residual norms on that set
[arxiv:2203.10807 §6.1].

### Streaming benchmark for real-time detectors

The Numenta Anomaly Benchmark is a benchmark, not a detector. It holds 58
labelled time series, with 1,000 to 22,000 rows each, and opens a window
around each labelled anomaly [arxiv:1510.03336 §II.A] [§II.B]. Only the earliest
detection in a window earns credit, detections outside windows count against
the detector, and the score is rescaled so that a perfect detector gets 100 and
a null detector gets 0 [arxiv:1510.03336 §II.B] [§II.C] [eq. 4]. The first 15%
of each file is probationary and not scored [arxiv:1510.03336 §II.B]. Author-
reported standard-profile scores are 64.7 for Numenta HTM, 47.1 for Twitter
ADVec and 35.7 for Etsy Skyline [arxiv:1510.03336 tab. I]. The threshold is
tuned on the full corpus, with one value for all files of a detector
[arxiv:1510.03336 §IV]. Results should therefore be read per profile and per
threshold rule.

### Machine-readable corner-case description (position paper)

This paper proposes no detector. It proposes a corner-case description (CCD)
for automated driving that combines a high-level categorisation of corner
cases with a concrete scenario description taken from existing scenario
languages [arxiv:2109.09607 §3 RQ1]. The categorisation follows Heidecker et
al., with sensor, content and temporal layers, and a method layer
[arxiv:2109.09607 §1] [arxiv:2109.09607 §2.2]. The description should be
machine-readable so that algorithm outputs can be turned into a description
for each frame [arxiv:2109.09607 §3 RQ2]. The paper gives no schema, file
format, labelling procedure or severity metric, and it leaves the combination
for future work [arxiv:2109.09607 §5]. Card:
[Description of Corner Cases in Automated Driving: Goals and Challenges](/papers/2109.09607).

### Outlier detectors as a defence against poisoned embeddings

The attack paper PTA optimises an image so that its embedding is close to
several text proxies for a target concept and to benign source-image proxies,
weighted by a balance factor alpha [arxiv:2509.19994 eq. 4] [§4.1]. Its
undetectability is measured against kNN, LOF, Isolation Forest and PCA, with
100 reference points [arxiv:2509.19994 tab. 1]. Author-reported ASRD (attempts
that both evade detection and succeed) under the defence is 84.17% for
classification and 61.80% for retrieval, against 20.04% and 14.84% for Illusion
Attack [arxiv:2509.19994 tab. 2] [tab. 3]. The paper does not define the
defence's K, ratio or iteration count, so these ASRD numbers cannot be
reproduced from the text [arxiv:2509.19994 §5.1]. Read this as evidence against
simple outlier checks as a sole guard, not as a measure of detector quality.

## When to use which

The student-teacher method and the two-stage method are the two with an
implementation sketch below. The driving rows compare families of methods as
the survey reports them, so they cite the survey, not the original papers.

| Situation | Use | Why |
|---|---|---|
| Need pixel-level localisation and a single model | Multi-level student-teacher matching, levels conv2_x to conv4_x | Best mean pixel and image AUC-ROC among the paper's level ablations; adding conv5_x lowers image AUC-ROC [arxiv:2103.04257 tab. 3] |
| Need a fast single-layer baseline | One mid-level block (conv3_x or conv4_x) | Still usable, but image AUC-ROC drops to 0.917 and 0.934 respectively [arxiv:2103.04257 tab. 3] |
| No ImageNet-pretrained teacher available | Expect large losses; the paper's own ablation is the only evidence | Teachers pretrained on MNIST, CIFAR-10, CIFAR-100 or SVHN gave lower image AUC-ROC (0.619 to 0.835) than ImageNet (0.955) [arxiv:2103.04257 tab. 4] |
| Few labelled-normal images | Still viable at 5% or 10% of the training images | At 5% and 10% of the data the paper reports image AUC-ROC of 0.871 and 0.907, above its SPADE comparison at the same shares [arxiv:2103.04257 tab. 5] |
| Categories with fine, low-contrast defects or texture-like parts | Check per category before committing | Transistor is weaker than the paper's baselines on both pixel AUC-ROC (0.825) and PRO (0.695) [arxiv:2103.04257 tab. 1] |
| Latency or memory matters at test time | Budget for two backbone passes per image and full-resolution upsampling | Each test image needs one teacher and one student forward pass, then upsampling of every level's map [arxiv:2103.04257 §3.3] |
| Whole-image categories, no defect masks needed | Two-stage self-supervised features with a one-class SVM or kernel density estimator | Mean AUC 89.9 (SVM) and 89.8 (KDE) on five semantic benchmarks, against 84.0 for an ImageNet ResNet-50 [arxiv:2011.02578 tab. 2]; author-reported |
| Only about 100 normal training images | Distribution-augmented contrastive representation | The paper reports it matches the ImageNet ResNet-50 baseline on CIFAR-10 with 100 images, where rotation prediction needs about 250 and plain contrastive about 1000 [arxiv:2011.02578 app. A.2.3] |
| Test-time cost of the kernel score is a concern | Single Gaussian density on the same features | The paper calls it cheaper at test time and competitive with the kernel estimator [arxiv:2011.02578 app. A.2.1] [arxiv:2011.02578 tab. 5] |
| Training budget is tight | Expect the distribution-augmented run to be costly | The rotated copies quadruple the training set, and the schedule is 2048 epochs [arxiv:2011.02578 §3.1.3] [arxiv:2011.02578 app. A.4] |
| Need pixel localisation with a feature-based one-class method | Rotation prediction with a kernel density estimator | In the paper's MVTec run it localises at 92.6, above the distribution-augmented variant at 90.4 [arxiv:2011.02578 tab. 4] |
| Road scenes with unlabelled objects, and a pixel map is needed | Image resynthesis with a discrepancy network | Author-reported AUROC 0.79 to 0.93 across the reported settings, above uncertainty and RBM baselines in every row of the figure [arxiv:1904.07595 fig. 5]; needs a segmenter and a generator trained on the target domain [arxiv:1904.07595 §3.2] |
| Same road setting, but the segmenter is weak or the generator does not match the images | Expect false positives; check on the target set first | The authors name false positives as the main remaining issue and give no measurement of generator mismatch [arxiv:1904.07595 §5] |
| A deployed policy needs a runtime alarm without failure rollouts | Last-layer distance plus action-chunk consistency (VLA-FAIL) | Author-reported gains on six real-world tasks and Libero-Plus, with 1.3% to 2.2% latency overhead [arxiv:2606.21386 tab. 3] [arxiv:2606.21386 §5] |
| The finetuning data is not available | Do not use the distance score | The distance needs statistics computed over the finetuning data, and that is impossible without it [arxiv:2606.21386 §6] |
| Open-loop action chunks, no overlap between chunks | Do not use the consistency score | The consistency score needs receding-horizon control with overlap between chunks [arxiv:2606.21386 §6] [arxiv:2606.21386 app. B] |
| Classifier may abstain instead of flagging an input | Novelty rejection, scored with coverage and accuracy together | Accuracy on answered inputs alone favours low coverage, so report both [arxiv:2107.11277 §3.1] |
| Camera images, no retraining allowed | Confidence-score methods on a pretrained network, such as Bayesian SegNet or standardized max logits | Confidence-score methods usually sit on top of a network without changing its training [arxiv:2204.07974 §1]; the survey calls them a baseline for camera data [arxiv:2204.07974 §2] |
| Camera images, tight frame budget | Pick a method the survey lists as online, such as NFlowJS (18.4 FPS) or standardized max logits (13.3 FPS) | The FPS figures are the survey's table values, taken from the original papers, so hardware differs [arxiv:2204.07974 tab. 1] |
| Lidar or radar as the main sensor | Expect fewer methods; choose by corner-case type | Lidar work on object-level anomalies is only just gaining momentum; radar work mostly targets ghost targets from multipath reflections [arxiv:2204.07974 §3] [arxiv:2204.07974 §4] |
| Several sensors available | Fuse per-modality features | Every multimodal method the survey reviews compares or fuses features from each modality [arxiv:2204.07974 §5] |
| The anomaly is unusual behaviour of tracked objects | Prediction or reconstruction over scenarios | Object-level methods forecast or reconstruct scenarios over time [arxiv:2204.07974 §6] |
| Need a machine-readable description of driving corner cases, for dataset coverage or test specification | Treat the CCD as a research direction and design the schema and severity metric yourself | The paper defines no schema, file format or severity metric, and it reports no experiments [arxiv:2109.09607 §3 RQ2] [arxiv:2109.09607 §5] |
| Many sensors, and the operator needs to know which relation broke | Graph forecasting with learned neighbours | The paper's case study points to the deviating sensor and its strongest attention neighbour [arxiv:2106.06947 §4.8]; replacing the learned graph with a complete graph lowers SWaT F1 from 0.81 to 0.78 [arxiv:2106.06947 tab. 3] |
| Per-epoch training cost is the constraint | Transformer reconstruction with window K = 10 | Author-reported epoch time is 0.87 s on SWaT and 115.91 s on WADI, against 59.40 s and 4063.05 s for the graph method, on one workstation [arxiv:2201.07284 tab. 5]; K = 10 was chosen for the F1 and training-time balance [arxiv:2201.07284 §5.3] |
| Training data is limited and a meta-learning step is wanted | Transformer with MAML, expecting a small gain | The paper's MAML ablation changes average F1 by about 1% and F1* by about 12% [arxiv:2201.07284 §5.1]; the released code has no MAML step [code: src/models.py#L263-L267] |
| Multi-sensor data with no labels, where the relations between sensors and their temporal pattern both matter | Convolutional autoencoder with an MMD penalty and a prediction memory (CAE-M) | Author-reported mean F1 0.9639 on PAMAP2, against 0.8843 for the best baseline in its table, ConvLSTM-COMP [arxiv:2107.12626 tab. 2]; the training set may contain some anomalies, which the paper assumes [arxiv:2107.12626 §3.1] |
| Need a reference implementation to run | Expect to write the code yourself | No official code exists, and the paper leaves out values an implementer needs, such as the learning rate and the MMD bandwidth [arxiv:2107.12626 §4.3] [arxiv:2107.12626 §3.3.2] |
| A fixed, deployable threshold is needed | Choose the threshold on validation data and report that mode | The graph paper states a validation-maximum rule but not the mode behind its table [arxiv:2106.06947 §4.3]; the transformer paper uses POT [arxiv:2201.07284 §3.5] (see Contradictions) |
| Pixel localisation with no defect labels and a speed budget | Conditional flow per scale on frozen features (CFLOW-AD) | Author-reported 98.62 localisation AUROC on MVTec AD [arxiv:2107.12571 tab. 4]; the paper reports 27 fps for its WRN50 model at 256 input on a GPU, against 0.1 fps for SPADE on a CPU from another paper [arxiv:2107.12571 tab. 6] |
| Smaller encoder or memory limit | MobileNetV3-L or ResNet-18 encoder, with the input size chosen per model | In the paper's ablation, MobileNetV3-L at 512 input averages 98.16 AUROC against 97.36 for WRN50 at the same size, and ResNet-18 is lower [arxiv:2107.12571 tab. 2]; the paper reports 947 MB for the WRN50 model [arxiv:2107.12571 tab. 6] |
| Decisions should be judged against local practice, not all patients | Conditional test on k = 40 similar cases (clinical) | A population-wide model can flag a routine decision for a small subpopulation, and the paper's local model is meant to avoid that [arxiv:2605.04664 p. 2]; author-reported AUC-ROC 0.80 to 0.81 on 100 cases [arxiv:2605.04664 tab. 2] |
| Clinical alerts must be set to a precision target | Calibrate the threshold on held-out cases before use | The paper gives 0.5 precision at 0.53 recall without the threshold that produced it, and its prevalence-corrected estimate is not shown [arxiv:2605.04664 p. 5] |
| Attributed graph, nodes need scores, and no anomaly labels | Contrastive node scoring over sampled subgraphs (CoLA) | Author-reported ROC-AUC 0.7513 to 0.9512 on seven injected-anomaly benchmarks, best in every column [arxiv:2103.00113 tab. 3]; scoring costs 256 rounds per node [arxiv:2103.00113 §4.5] |
| Tabular data, and no deep training loop is wanted | Random-representation isolation forest (DIF) | Author-reported AUC-PR 0.351 against 0.219 for the Extended Isolation Forest, over ten tabular sets [arxiv:2206.06602 tab. 3]; the released scorer differs from eq. 8, so fix the aggregation first [code: algorithms/dif.py#L454] |
| Image classifier must flag out-of-distribution inputs, with no retraining and no outlier data | Virtual-logit score on pretrained features (ViM) | Author-reported average AUROC 90.91 with BiT against 86.62 for Mahalanobis, and 96.23 against 96.02 with ViT [arxiv:2203.10807 tab. 2]; needs 200,000 training images for its subspace and alpha [arxiv:2203.10807 §6] |
| Judging a streaming detector on how early it flags, not only on a fixed file | Windowed, earliest-detection scoring reported per profile (NAB) | Credit falls with the position of the first in-window detection and false positives count against the detector [arxiv:1510.03336 §II.C]; the score is normalised between a perfect and a null detector [arxiv:1510.03336 eq. 4] |
| Off-road robot must adapt to new terrain online from its own driving, with one user label for a lethal object | Online Gaussian-process traversability over foundation-model features, with a cluster-distance test (SALON) | Author-reported on one ATV figure-8 course of five laps: 3 interventions at R_max 0.2, against 4 for Velociraptor and 23 for a geometric baseline; at R_max 0.4 it ties Velociraptor on 4 [arxiv:2412.07826 tab. 4]. One course, one driver, no variance. The body does not show the dataset sizes behind the headline comparison with methods trained on 100 to 1000 times more data [arxiv:2412.07826 §1] |
| Outlier checks as the only guard on a shared embedding index | Expect evasion; the attack paper reports success under four outlier detectors | Author-reported ASRD of 84.17% (classification) and 61.80% (retrieval) under the defence, against 20.04% and 14.84% for Illusion Attack [arxiv:2509.19994 tab. 2] [tab. 3] |

The defect rows report author-reported MVTec AD numbers, averaged over its 15
categories unless noted. The semantic rows report author-reported numbers on
single-class benchmarks. The road rows report author-reported AUROC over pixels
on two road sets. The flow rows report author-reported numbers on MVTec AD and
STC, and the clinical rows on 100 PORT cases. The robot rows report author-reported numbers on the
paper's own tasks. The sensor-stream rows report author-reported F1 on public
benchmarks, with the threshold and split caveats in Contradictions. The node,
isolation, OOD, streaming and attack rows use each paper's own data and
protocol, with the caveats above. None of these sets is a replication, and they
do not measure the same thing. The survey reports no experiments of its own, so
its rows give no accuracy ranking.

## Implementation sketch

Two common cores follow. Loss and scoring follow the papers' equations; the
student-teacher paper gives no algorithm box, and the two-stage paper's
representation step is not sketched here. The flow, clinical, resynthesis,
robot-failure, graph and transformer cards have their own pseudocode, and so do
the node, isolation, OOD, streaming, attack and SALON cards.

```pseudocode
# Training loss for one minibatch  [arxiv:2103.04257 §3.2] [eq. 1]–[eq. 3]
# Input:  normal images (B, 3, H, W); frozen teacher; student
# Output: scalar loss

def training_loss(images, teacher, student):
    # Teacher features are fixed; no gradient flows into the teacher  [§3.2]
    t_maps = teacher(images)
    s_maps = student(images)
    total = 0
    for level in range(L):
        # Unit-normalise the channel vector at each spatial position  [eq. 1]
        t_unit = normalise(t_maps[level], dim=1)
        s_unit = normalise(s_maps[level], dim=1)
        # Half squared distance per position, averaged over positions  [eq. 2]
        total = total + mean(0.5 * sum_sq(t_unit - s_unit, dim=1))
    # Level weights alpha_l are 1 in all experiments  [eq. 3] [§3.2]
    return mean_over_batch(total)
```

```pseudocode
# Anomaly map and image score for one test image  [arxiv:2103.04257 §3.3] [eq. 4]
# Input:  image (1, 3, H, W)
# Output: anomaly map (H, W); image score (scalar)

def anomaly_map(image, teacher, student):
    t_maps = teacher(image)
    s_maps = student(image)
    result = 1
    for level in range(L):
        # Per-position distance as above, then upsampled to the input size  [§3.3]
        level_map = upsample_bilinear(
            half_sq_distance(t_maps[level], s_maps[level]), size=(H, W))
        # Element-wise product across levels  [eq. 4]
        result = result * level_map
    # Image score is the maximum of the combined map  [§3.3]
    return result, max(result)
```

```pseudocode
# One-class score on a test feature, higher = more anomalous
# [arxiv:2011.02578 §3.2] [app. A.1] [eq. 6]
# Input:  feature f (d,); training features F (N, d); kernel width gamma
# Output: scalar score

def kde_score(f, F, gamma):
    # Unit-normalise both sides before the kernel  [§3.2]
    f = f / norm(f)
    F = F / norm(F, dim=1)
    # For unit vectors, exp(-gamma * |f - x|^2) is proportional to
    # exp(2 * gamma * cos), so cosine similarities are enough  [app. A.1]
    sims = F @ f  # (N,)
    # Negated log-sum-exp; scale and constant terms do not change the ranking
    return -logsumexp(2 * gamma * sims) / gamma
```

Details that the papers leave open, such as the optimiser, learning-rate
schedule and input normalisation, are not specified on this page. The
student-teacher paper's values are in its hyperparameter table, and the
two-stage paper's are in its appendix [arxiv:2011.02578 app. A.4]. Check the
implementation sections before reproducing the numbers. The kernel width for
the two-stage method is discussed under Contradictions.

## Contradictions

- **Stated range vs. formula (defect paper).** The paper gives an interval for
  the per-level loss and for the anomaly-map weights [arxiv:2103.04257 §3.2]
  [arxiv:2103.04257 §3.3] that does not match the distance it defines
  [arxiv:2103.04257 eq. 1]. For unit vectors that distance can reach 2, and the
  product of several levels can exceed the interval. Treat the stated range as
  unreliable. Do not clip maps to a fixed threshold based on it.
- **Wide-ResNet backbone (defect paper).** The text reports 0.973 AUC-ROC with
  a Wide-ResNet50 backbone and does not say whether it is an image or pixel
  metric [arxiv:2103.04257 §4.3].
- **Kernel width (two-stage paper).** Section 3.2 says the width is reduced ten
  times relative to the default [arxiv:2011.02578 §3.2]. Appendix A.4 says
  gamma is ten times larger than the default [arxiv:2011.02578 app. A.4]. These
  statements cannot both hold. Do not pick a direction without checking the
  paper's implementation.
- **Mean column (two-stage paper).** The mean column of its results table is
  meant to follow the weighting described in §4.1 [arxiv:2011.02578 §4.1]. It
  does not reproduce exactly from the per-dataset rows under that weighting. A
  recomputation gives about 87.8 for the rotation KDE row, against 88.2 printed
  [arxiv:2011.02578 tab. 2]. Compare per-dataset numbers when the difference
  matters.
- **ACC smoothing factor (robot-failure paper).** The method text calls a
  strong smoothing factor of 0.9 necessary [arxiv:2606.21386 §3.2]. The
  ablation text and its figure caption say a fixed value of 0.1 was used in all
  experiments [arxiv:2606.21386 app. B]. The hyperparameter tables list 0.9 for
  both VLAs and both settings [arxiv:2606.21386 app. F]. The text does not
  resolve the conflict. Treat the factor as tunable and check it on calibration
  data.
- **Chunk length (robot-failure paper).** The finetuning table gives chunk
  length 20 for pi0.5 and 30 for X-VLA [arxiv:2606.21386 app. F]. The
  Libero-Plus detail table gives 5 for pi0.5 and 20 for X-VLA
  [arxiv:2606.21386 app. G]. Use the value for the setting you run.
- **Scope of "anomaly".** The defect paper works on industrial inspection
  images, benchmarked on MVTec AD [arxiv:2103.04257 tab. 1]. The two-stage
  paper works on single-class semantic benchmarks [arxiv:2011.02578 §4]. The
  resynthesis paper works on road scenes with unknown objects
  [arxiv:1904.07595 §1]. The robot-failure paper targets policy failures, not
  novel inputs [arxiv:2606.21386 §1]. The survey excludes sensor-layer and
  pixel-level anomalies [arxiv:2204.07974 §1]. The two sensor-stream papers
  work on multivariate time series from sensors and other systems
  [arxiv:2106.06947 §4.1] [arxiv:2201.07284 §4.1]. The position paper's
  corner cases include sensor-layer cases, which the survey leaves out
  [arxiv:2109.09607 §1]. The transformer paper reports the graph method in
  its own table [arxiv:2201.07284 tab. 2], and some of its baselines were
  re-implemented by its authors [arxiv:2201.07284 §4]. Apart from that, no
  paper here evaluates another's method, so most numbers cannot be confirmed
  or contradicted across papers.
- **MVTec numbers across papers.** The two-stage paper's MVTec rows
  [arxiv:2011.02578 tab. 4] and the defect paper's image AUC-ROC of 0.955
  [arxiv:2103.04257 tab. 2] come from different training setups and different
  methods. They are not a like-for-like comparison.
- **Graph method's WADI result across papers.** The graph paper reports F1
  0.57 on WADI for its own method [arxiv:2106.06947 tab. 2]. The transformer
  paper reports 0.4260 for the same method on WADI, and 0.4951 for its own
  method [arxiv:2201.07284 tab. 2]. On WADI the two papers therefore rank the
  methods differently. On SWaT both report 0.81 for the graph method
  [arxiv:2106.06947 tab. 2] [arxiv:2201.07284 tab. 2]. Check the source of a
  WADI number before quoting it.
- **Dataset sizes differ between the sensor-stream papers.** The graph paper
  lists WADI with 127 features and SWaT with 47515 training rows
  [arxiv:2106.06947 tab. 1]. The transformer paper lists WADI with 123
  dimensions and SWaT with 496800 training rows [arxiv:2201.07284 tab. 1]. The
  two papers do not use the same split, so their F1 values are not from one
  benchmark protocol.
- **Threshold mode (graph paper).** The paper sets the threshold to the
  validation maximum [arxiv:2106.06947 §4.3]. The released code's default
  instead picks the threshold that maximises F1 on the test labels
  [code: run.sh#L20] [code: evaluate.py#L141-L144]. The table's mode is not
  stated, so the table may be optimistic. Use a validation-based threshold for
  any deployable number.
- **Method versus released code (transformer paper).** The paper describes an
  adversarial two-decoder loss, a MAML step and an 80/20 split
  [arxiv:2201.07284 §3.4] [arxiv:2201.07284 §4]. The released code has no
  adversarial sign and no MAML step, and it trains on the full series for five
  epochs [code: src/models.py#L263-L267] [code: main.py#L302-L310]. The paper's
  numbers therefore describe a method that the released code does not run.
- **Training objective (flow paper).** The paper minimises the
  maximum-likelihood objective in [arxiv:2107.12571 eq. 7] and its expansion
  in [arxiv:2107.12571 app. B]. The released code minimises a negative
  log-sigmoid of a per-dimension log-likelihood [code: train.py#L76-L78]
  [code: utils.py#L38-L40]. The two are different objectives, and the
  reported numbers come from the code's version.
- **Training length and batch (flow paper).** The paper states 100 epochs and
  8192 vectors per decoder step [arxiv:2107.12571 §5.1]. The code's defaults
  are 25 meta-epochs of 8 sub-epochs, and it processes 256 vectors per decoder
  call [code: config.py#L33-L36] [code: train.py#L287].
- **Epoch selection (flow paper).** The paper does not say how an epoch was
  chosen [arxiv:2107.12571 §5.1]. The code keeps the epoch with the best
  segmentation AUROC on the test set and reports the maximum of each metric
  [code: train.py#L296-L338]. The reported numbers may therefore be optimistic
  for a held-out test.
- **Speed (flow paper).** The "10x faster and smaller" claim compares GPU
  timings for CFLOW-AD with timings for SPADE and PaDiM taken from another
  paper and measured on a CPU [arxiv:2107.12571 §5.5] [arxiv:2107.12571 tab. 6].
- **Weighting effect (clinical paper).** Weighted selection raises the Naive
  Bayes AUC-ROC from 0.74 to 0.80 in the paper's table, but the Bayesian
  network gives 0.81 on all cases and 0.80 with weighting [arxiv:2605.04664 tab. 2].
  The table therefore does not show a gain from weighting for the Bayesian
  network.
- **Scope of "anomaly" (flow and clinical papers).** The flow paper works on
  industrial images and on the 13-scene STC dataset
  [arxiv:2107.12571 §5.1]. The clinical paper scores decisions given patient
  attributes, which is a conditional question, not an input that looks unlike
  training data [arxiv:2605.04664 p. 1].
- **Aggregation rule (GNN survey).** Section 5.1 consolidates channel errors by
  summing them, and §5.2 says GDN uses the maximum channel error
  [arxiv:2307.03759 §5.1] [arxiv:2307.03759 §5.2]. The graph-forecasting paper
  uses the maximum [arxiv:2106.06947 §3.6]. A sum and a maximum react
  differently to one large error, so state which one a number used.
- **Principal-space dimension (ViM).** The paper sets D to 1000 when N > 1500
  and to 512 otherwise [arxiv:2203.10807 §6]. The released code uses 1000 from
  N ≥ 2048, 512 from N ≥ 768, and N // 2 below that [code: benchmark.py#L230-L236].
  The two rules agree for the paper's models, and differ for other widths.
- **NAB table vs repository.** Table I gives 64.7 for Numenta HTM and 16.8 for
  the random detector. The repository README gives HTM 70.5 to 69.7 for NuPIC
  1.0 and random 11.0 [arxiv:1510.03336 tab. I] [code: README.md#L41]
  [code: README.md#L52]. Treat Table I as the paper's numbers.
- **PTA's own tables (attack paper).** The ablation gives 95.35 as the baseline
  Cls ASRD for ImageBind on ImageNet with the defence at (N_s, N_c) = (20, 10),
  while the main table gives 77.54 for the same model, dataset and defence
  [arxiv:2509.19994 tab. 17] [arxiv:2509.19994 tab. 2]. The paper does not say
  whether the configurations differ or a label is wrong.
- **Scope of "anomaly" (new papers).** ViM scores out-of-distribution inputs
  to a classifier [arxiv:2203.10807 §1]. CoLA's benchmarks inject anomalies
  [arxiv:2103.00113 §5.1]. NAB mixes real and synthetic streams
  [arxiv:1510.03336 §II.A]. PTA treats outlier detectors as a defence
  [arxiv:2509.19994 §3.3]. None of these tests the same thing as the defect or
  road papers above.
- **Dimensions and improvement row (CAE-M paper).** Section 4.3 gives 36
  PAMAP2 dimensions, and Table 1 gives 27 [arxiv:2107.12626 §4.3]
  [arxiv:2107.12626 tab. 1]. Its "Improvement" row reports 7.96% on PAMAP2
  F1, but the table's own ratio of CAE-M to the best baseline is about 9.0%,
  and the paper does not say how the row is computed [arxiv:2107.12626 tab. 2].
  Use the table values and check the dimension count against the data.
- **Scope of "anomaly" (CAE-M paper).** PAMAP2 treats running, stair climbing
  and rope jumping as anomalies, and CAP treats sleep-disordered breathing as
  anomalous [arxiv:2107.12626 §4.1]. These are activity and disorder labels,
  not sensor faults, so the CAE-M numbers measure a different question from
  the industrial and road papers above.
- **Scope of "anomaly" (SALON).** SALON's lethal test flags cells far from the
  cluster centres, and its one-click label marks an object the user names
  [arxiv:2412.07826 §3.5] [arxiv:2412.07826 §3.5.1]. The paper reports
  navigation outcomes and buffer statistics, with no AUROC or other detection
  metric [arxiv:2412.07826 tab. 1] [arxiv:2412.07826 tab. 4]. Its numbers
  cannot be placed beside the detectors above.

## Papers

- [Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals](/papers/2107.12626): trains a convolutional autoencoder with an MMD penalty, an attention BiLSTM and an autoregressive predictor jointly on normal samples; reports mean F1 0.9639 on PAMAP2 and 0.9961 on CAP, above ten baselines in its table.
- [Student-Teacher Feature Pyramid Matching for Anomaly Detection](/papers/2103.04257): distils an ImageNet-pretrained ResNet-18 teacher into a student on normal images and combines three feature levels into a pixel map and an image score; reports 0.955 image AUC-ROC on MVTec AD.
- [Graph Neural Network-Based Anomaly Detection in Multivariate Time Series](/papers/2106.06947): learns a sensor graph from embedding similarity and forecasts each sensor with graph attention; scores a tick by its largest normalised sensor deviation; reports F1 0.81 on SWaT and 0.57 on WADI.
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](/papers/2201.07284): reconstructs a window with a transformer in two phases, the second conditioned on the first, with adversarial two-decoder training and MAML; reports average F1 0.8802 and 75% to 99% lower training time.
- [Detecting the Unexpected via Image Resynthesis](/papers/1904.07595): resynthesises a street scene from its label map and scores per-pixel discrepancies with a network trained on synthetic label swaps; reports AUROC 0.79 to 0.93 on Lost and Found and a 60-image road set.
- [Learning and Evaluating Representations for Deep One-class Classification](/papers/2011.02578): learns self-supervised features from normal images, then fits a kernel density estimator or one-class SVM on them; adds distribution-augmented contrastive learning and reports mean AUC 89.9 on five single-class benchmarks.
- [VLA-FAIL](/papers/2606.21386): detects failures of finetuned vision-language-action policies at runtime by combining a last-layer Mahalanobis distance with action-chunk consistency; reports threshold-independent gains on six real-world tasks and Libero-Plus, with 1.3% to 2.2% latency overhead.
- [CFLOW-AD: Real-Time Unsupervised Anomaly Detection with Localization via Conditional Normalizing Flows](/papers/2107.12571): fits a conditional normalizing flow per scale on frozen encoder features of normal images and scores each location by likelihood; reports 98.62 localisation AUROC on MVTec AD with a WRN50 encoder.
- [Evidence-based anomaly detection in clinical domains](/papers/2605.04664): flags a clinical decision when a Bayesian network or Naive Bayes model, fitted on the most similar past patients, gives it low probability; reports best AUC-ROC 0.81 on 100 pneumonia admission decisions.
- [Machine Learning with a Reject Option: A survey](/papers/2107.11277): surveys models that may abstain, separating ambiguity from novelty rejection; reports no new results and links novelty rejection to anomaly detection.
- [Description of Corner Cases in Automated Driving: Goals and Challenges](/papers/2109.09607): a position paper proposing a machine-readable description of driving corner cases that combines scenario languages with corner-case levels; gives six research questions and three conceptual examples, with no results or implementation.
- [Anomaly Detection in Autonomous Driving: A Survey](/papers/2204.07974): classifies 49 corner-case detection methods by sensor, approach and online capability across camera, lidar, radar, multimodal and object-level data; runs no experiments of its own.
- [Evaluating Real-time Anomaly Detection Algorithms - the Numenta Anomaly Benchmark](/papers/1510.03336): a streaming benchmark of 58 labelled series with windowed, earliest-detection scoring normalised between a perfect and a null detector; reports standard-profile scores of 64.7 for HTM and 35.7 for Skyline.
- [Anomaly Detection on Attributed Networks via Contrastive Self-Supervised Learning](/papers/2103.00113): scores each node by how well it matches its sampled subgraph against a random other node's, using a one-layer GCN and a bilinear discriminator; reports ROC-AUC 0.7513 to 0.9512 on seven injected-anomaly benchmarks.
- [ViM: Out-Of-Distribution with Virtual-logit Matching](/papers/2203.10807): scores a trained classifier's input by its feature residual off principal directions, added as a virtual logit; reports average AUROC 90.91 with BiT-S-R101x1 on four OOD sets.
- [Deep Isolation Forest for Anomaly Detection](/papers/2206.06602): isolates points in 50 untrained random representations, with six trees on each, and scores depth times deviation; reports average AUC-PR 0.351 on ten tabular sets.
- [A Survey on Graph Neural Networks for Time Series: Forecasting, Classification, Imputation, and Anomaly Detection](/papers/2307.03759): surveys graph neural networks for time series across four tasks, with anomaly detection built from reconstruction, forecasting or relational backbones; runs no experiments of its own.
- [Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Models](/papers/2509.19994): a targeted attack on multimodal embeddings that aligns to several text proxies and benign source proxies, and is tested against four outlier detectors; reports 84.17% classification ASRD under that defence.
- [SALON: Self-supervised Adaptive Learning for Off-road Navigation](/papers/2412.07826): learns off-road traversability online from the robot's own driving, pairing foundation-model features on a bird's-eye-view grid with bandpower roughness and a Gaussian process; reports navigation counts comparable to methods trained offline on one ATV course.