Adversarially Robust Few-Shot Anomaly Detection with Vision Foundation Models

Akib Mohammed Khan; Bartosz Krawczyk

cs.CVOct 15, 2025

Adversarially Robust Few-Shot Anomaly Detection with Vision Foundation Models

Authors: Akib Mohammed Khan, Bartosz Krawczyk

Organizations: Rochester Institute of Technology Rochester, USA

Abstract

Vision foundation models such as DINOv2 enable strong few-shot anomaly detection (FSAD) through simple non-parametric k-nearest-neighbor (k-NN) scoring over frozen patch features. Existing robust anomaly detection methods assume large normal-class training sets and adversarial training of the feature extractor. The few-shot regime, where the detector consists of a frozen backbone and a non-parametric scorer, has remained unaddressed despite its widespread deployment. We develop a white-box attack framework adapted to k-NN memory-bank detectors and introduce an adversarially robust FSAD method which is training-free with respect to the backbone. We introduce the DistanceProbe (DP), a lightweight MLP trained by regression to predict per-patch k-NN distance directly from frozen features, providing the differentiable proxy required for gradient-based attacks against non-parametric scorers. We further propose a two-level combined defense that operates using only the normal reference support set images. At the input level, PatchShift (PS) applies random pixel shifts to exploit the misalignment of adversarial perturbations with the encoder's patch grid, aggregating scores across multiple shifted views via element-wise median pooling. At the feature level we employ the FeaturePurifier (FP), a lightweight residual MLP trained on clean and adversarially augmented support features to project perturbed representations back toward the clean feature manifold. Through comprehensive experiments under various adversarial settings, we show that our method exhibits robust detection and localization with performance gains of ~27% image-level AUROC and ~51% pixel-level PRO over the undefended attacked baseline across MVTec-AD, VisA, and MPDD at k=4 shots, while preserving clean accuracy within 3%, matching full-shot adversarially-trained baselines on pixel-level AUROC, and holding under adaptive attack.

Figures & tables

Panel of Figure 1 — Figure 1: Left. Feature space overview where a gradient-based attack pushes normal patches across the boundary into anomalous regions and drags anomalous patches toward the reference-normal cluster, inverting the $k$ -NN ranking. Right. On MVTec-AD, clean inputs separate normal (blue) and anomalous (red) scores correctly; under PGD-20 at $\epsilon=8/255$ the ordering collapses and flips; our proposed defense restores it.

Figure 2: Attack framework. Left: the frozen DINOv2 backbone $f_{\theta}$ extracts patch tokens $(p_{1},\dots,p_{N})$ from a query image $x$ ; the DP $g_{\phi}$ predicts per-patch anomaly scores $(\widehat{a}_{1},\dots,\widehat{a}_{N})$ from these tokens, and the mask-aware surrogate loss $\widehat{\mathcal{L}}(x,y;\phi)$ provides the gradient signal that PGD uses to craft the adversarial image $x^{\prime}$ . Right: the probe $g_{\phi}$ is trained beforehand by regression to predict the per-patch nearest-neighbor distance $d_{\mathrm{NN}}(p;\mathcal{M})$ between a frozen-backbone feature $p$ and its closest match in the support memory bank $\mathcal{M}$ , computed across $n_{\mathrm{tr}}$ nominal training images. Only $g_{\phi}$ is trained; $f_{\theta}$ remains frozen throughout.

Figure 3: Defense framework. Left: an adversarial image $x^{adv}$ is processed through both an undefended pipeline (top branch, feeding the frozen DINOv2 $f_{\theta}$ and NN-matching against the support bank $\mathcal{M}$ , yielding a “perturbed” anomaly map and image-level anomaly score) and the proposed robust pipeline (bottom branch). PS produces $K$ shift-then-cropped views $\{\Delta^{(1)},\dots,\Delta^{(K)}\}$ , each encoded by $f_{\theta}$ and refined by the FP $h_{\psi}$ before NN-matching. Median aggregation across the $K$ per-shift distance maps yields the recovered anomaly map and score. Right: the purifier $h_{\psi}$ is trained on the $k$ support images $x^{(\text{clean})}$ paired with two types of perturbed counterparts – Gaussian-noise augmentations $x^{(\text{noise})}$ and DP-generated adversarial samples $x^{(\text{adv})}$ – by minimizing the two-term purifier loss $\mathcal{L}_{\psi}$ .

Dataset	Condition	1-shot	2-shot	4-shot	8-shot
MVTec-AD	Clean	96.5 $\pm$ 0.5	96.7 $\pm$ 1.0	97.5 $\pm$ 0.1	98.0 $\pm$ 0.1
	Adversarial	20.8 $\pm$ 2.3	23.9 $\pm$ 3.2	25.8 $\pm$ 3.1	23.5 $\pm$ 3.0
	Robust	96.4 $\pm$ 0.7 / 65.1 $\pm$ 0.5	96.8 $\pm$ 1.0 / 72.9 $\pm$ 1.1	97.7 $\pm$ 0.2 / 76.2 $\pm$ 1.9	98.2 $\pm$ 0.2 / 82.6 $\pm$ 1.2
VisA	Clean	85.7 $\pm$ 1.8	88.3 $\pm$ 2.1	91.2 $\pm$ 0.9	92.5 $\pm$ 0.1
	Adversarial	21.2 $\pm$ 1.7	22.6 $\pm$ 1.3	24.9 $\pm$ 1.5	24.4 $\pm$ 0.7
	Robust	85.5 $\pm$ 1.1 / 51.6 $\pm$ 0.9	87.9 $\pm$ 1.4 / 57.4 $\pm$ 1.2	89.5 $\pm$ 1.0 / 61.8 $\pm$ 1.0	90.5 $\pm$ 0.3 / 62.0 $\pm$ 2.0

Table 1: Image-level detection AUROC (%) under clean, adversarial, clean /robust in adversarial conditions across shot counts. Adversarial attack is PGD-20 at

\epsilon=8/255

on our DistanceProbe surrogate. All values are mean

\pm

standard deviation across

3

random seeds.

Dataset	Condition	1-shot	2-shot	4-shot	8-shot
MVTec-AD	Clean	91.7 $\pm$ 0.1	92.0 $\pm$ 0.3	92.4 $\pm$ 0.2	92.7 $\pm$ 0.0
	Adversarial	7.7 $\pm$ 1.4	9.2 $\pm$ 2.1	11.3 $\pm$ 2.0	11.8 $\pm$ 1.6
	Robust	91.3 $\pm$ 0.1 / 53.4 $\pm$ 0.8	91.3 $\pm$ 0.4 / 59.4 $\pm$ 0.5	91.9 $\pm$ 0.2 / 64.4 $\pm$ 1.3	92.5 $\pm$ 0.1 / 67.9 $\pm$ 0.7
VisA	Clean	90.7 $\pm$ 0.6	91.7 $\pm$ 0.6	92.5 $\pm$ 0.2	93.2 $\pm$ 0.2
	Adversarial	17.2 $\pm$ 0.4	19.9 $\pm$ 3.7	20.7 $\pm$ 1.0	19.6 $\pm$ 0.8
	Robust	89.5 $\pm$ 0.7 / 67.2 $\pm$ 0.5	90.4 $\pm$ 0.3 / 68.8 $\pm$ 0.7	91.3 $\pm$ 0.1 / 72.1 $\pm$ 1.2	92.1 $\pm$ 0.1 / 73.3 $\pm$ 0.4

Table 2: Pixel-level localization PRO (%) under clean, adversarial, clean /robust in adversarial conditions across shot counts. Adversarial attack is PGD-20 at

\epsilon=8/255

on our DistanceProbe surrogate. All values are mean

\pm

standard deviation across

3

random seeds.

Dataset	Method	Venue	Backbone	Shots	Image-level AUROC (%)	Pixel-level AUROC (%)
MVTec-AD	COBRA [ 39 ]	ICLR’25	ResNet-18	full	89.1 / 75.1	—
	PatchGuard [ 42 ]	CVPR’25	ViT	full	92.7 / 68.3	96.5 / 75.5
	PS+FP	Ours	DINOv2	4	97.7 / 76.2	97.3 / 81.0
VisA	COBRA [ 39 ]	ICLR’25	ResNet-18	full	75.2 / 73.8	—
	PatchGuard [ 42 ]	CVPR’25	ViT	full	90.8 / 75.8	97.2 / 85.1
	PS+FP	Ours	DINOv2	4	89.5 / 61.8	98.3 / 91.2

Table 3: Comparison against published adversarially robust anomaly detection methods. Cells show Clean / Robust AUROC under PGD-20. COBRA was originally evaluated at

\epsilon=2/255

; PatchGuard and our method use the stronger

\epsilon=8/255

budget.

Dataset	Metric	Clean	FGSM	EOT-BPDA-PGD	$\bm{\ell_{\infty}}$ -PGD
MVTec-AD	Image AUROC	97.7	78.2	67.1	76.2
MVTec-AD	PRO	91.9	72.5	64.9	64.4
VisA	Image AUROC	89.5	73.3	62.5	61.8
VisA	PRO	91.3	81.7	79.1	72.1
MPDD	Image AUROC	76.3	61.6	55.4	59.4
MPDD	PRO	84.4	57.3	52.1	59.2

Table 4: Robust AUROC and PRO (%) under three attacks at

\epsilon=8/255

: single-step FGSM,

\ell_{\infty}

-PGD-20, and EOT-BPDA-PGD [ 52 ] .

	MVTec-AD		VisA
Method	Image AUROC	PRO	Image AUROC	PRO
PS only	53.7	40.1	46.5	62.0
FP only	78.4	52.8	62.5	59.6
PS+FP (Ours)	76.2	64.4	61.8	72.1

Table 5: Defense component ablation: robust AUROC and PRO (%) under PGD-20 attack at

\epsilon=8/255

k=4

shots.

Figure 4: Robust AUROC and PRO under PGD-20 attack as the attack budget

\epsilon

varies, at

k=4

shots. Both metrics degrade gracefully on both datasets with no abrupt collapse.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Backbone	Image AUROC	PRO
ViT-S/14	76.2	64.4
ViT-B/14	68.0	51.3
ViT-L/14	69.8	46.1

Appendix

Table 1: Robust image-level AUROC and pixel-level PRO (%) on MVTec-AD across DINOv2 backbone variants.

k=4

shots, PGD-20 at

\epsilon=8/255

, averaged across

3

random seeds.

Metric	MVTec-AD	VisA	MPDD
Image-level AUROC	93.6	84.3	73.3
PRO	89.7	89.8	83.8

Appendix

Table 2: Robust image-level AUROC and pixel-level PRO (%) under

\ell_{2}

-PGD-20 attack at

k=4

shots,

\epsilon_{\ell_{2}}=64/255

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bottle	100.00 $\pm$ 0.00	89.92 $\pm$ 8.62	99.15 $\pm$ 0.04	88.79 $\pm$ 2.61	95.54 $\pm$ 0.35	68.69 $\pm$ 3.92
cable	94.08 $\pm$ 0.76	56.72 $\pm$ 6.92	94.29 $\pm$ 0.63	66.05 $\pm$ 1.54	87.48 $\pm$ 0.78	40.11 $\pm$ 1.27
capsule	87.37 $\pm$ 8.30	48.44 $\pm$ 6.10	98.49 $\pm$ 0.30	89.77 $\pm$ 1.58	94.75 $\pm$ 0.77	63.18 $\pm$ 4.47
carpet	100.00 $\pm$ 0.00	96.33 $\pm$ 2.02	99.47 $\pm$ 0.01	96.79 $\pm$ 1.06	97.87 $\pm$ 0.15	85.93 $\pm$ 5.13
grid	99.67 $\pm$ 0.17	96.69 $\pm$ 0.54	98.93 $\pm$ 0.06	95.35 $\pm$ 2.04	95.26 $\pm$ 0.34	86.69 $\pm$ 5.24

Appendix

Table 3: Per-category results on MVTec (1-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bottle	100.00 $\pm$ 0.00	87.09 $\pm$ 15.23	99.20 $\pm$ 0.02	89.94 $\pm$ 4.35	95.53 $\pm$ 0.33	67.58 $\pm$ 11.93
cable	93.91 $\pm$ 1.21	55.94 $\pm$ 3.69	94.75 $\pm$ 0.65	66.25 $\pm$ 3.84	87.76 $\pm$ 0.74	40.28 $\pm$ 6.31
capsule	88.54 $\pm$ 7.70	59.07 $\pm$ 5.72	98.66 $\pm$ 0.23	89.57 $\pm$ 1.65	95.15 $\pm$ 1.03	61.94 $\pm$ 4.48
carpet	100.00 $\pm$ 0.00	97.11 $\pm$ 1.07	99.53 $\pm$ 0.04	97.01 $\pm$ 0.34	97.88 $\pm$ 0.10	87.21 $\pm$ 0.55
grid	99.78 $\pm$ 0.21	98.44 $\pm$ 0.97	98.94 $\pm$ 0.10	96.70 $\pm$ 1.09	95.35 $\pm$ 0.50	88.70 $\pm$ 3.09

Appendix

Table 4: Per-category results on MVTec (2-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bottle	100.00 $\pm$ 0.00	97.80 $\pm$ 0.12	99.22 $\pm$ 0.00	92.63 $\pm$ 1.54	95.33 $\pm$ 0.41	75.09 $\pm$ 1.54
cable	95.91 $\pm$ 1.39	76.21 $\pm$ 9.77	95.30 $\pm$ 0.51	76.37 $\pm$ 3.52	88.85 $\pm$ 0.72	58.54 $\pm$ 3.39
capsule	95.32 $\pm$ 1.04	70.58 $\pm$ 7.62	98.88 $\pm$ 0.03	90.48 $\pm$ 0.26	95.97 $\pm$ 0.10	67.26 $\pm$ 2.92
carpet	100.00 $\pm$ 0.00	98.45 $\pm$ 0.52	99.51 $\pm$ 0.08	97.94 $\pm$ 0.43	97.85 $\pm$ 0.16	91.61 $\pm$ 0.73
grid	99.94 $\pm$ 0.10	99.30 $\pm$ 0.41	98.97 $\pm$ 0.13	97.16 $\pm$ 0.83	95.52 $\pm$ 0.67	91.16 $\pm$ 0.99

Appendix

Table 5: Per-category results on MVTec (4-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bottle	100.00 $\pm$ 0.00	97.75 $\pm$ 1.11	99.23 $\pm$ 0.02	94.12 $\pm$ 1.69	95.14 $\pm$ 0.40	80.48 $\pm$ 3.68
cable	96.89 $\pm$ 0.39	82.23 $\pm$ 11.43	95.51 $\pm$ 0.05	79.40 $\pm$ 1.49	89.34 $\pm$ 0.11	63.13 $\pm$ 3.30
capsule	94.32 $\pm$ 2.62	73.94 $\pm$ 10.16	98.95 $\pm$ 0.03	90.14 $\pm$ 1.31	96.00 $\pm$ 0.16	66.10 $\pm$ 4.20
carpet	100.00 $\pm$ 0.00	96.50 $\pm$ 0.87	99.55 $\pm$ 0.04	96.85 $\pm$ 0.86	97.93 $\pm$ 0.03	85.76 $\pm$ 2.31
grid	100.00 $\pm$ 0.00	98.97 $\pm$ 0.79	98.97 $\pm$ 0.08	97.42 $\pm$ 0.86	95.70 $\pm$ 0.24	90.13 $\pm$ 3.04

Appendix

Table 6: Per-category results on MVTec (8-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
candle	87.05 $\pm$ 0.06	71.90 $\pm$ 10.61	98.38 $\pm$ 0.82	85.66 $\pm$ 3.43	94.80 $\pm$ 0.10	72.31 $\pm$ 5.46
capsules	96.96 $\pm$ 0.90	64.54 $\pm$ 5.93	98.06 $\pm$ 0.20	85.72 $\pm$ 0.46	92.36 $\pm$ 0.29	68.80 $\pm$ 1.65
cashew	89.19 $\pm$ 3.52	35.95 $\pm$ 15.88	99.56 $\pm$ 0.03	90.65 $\pm$ 2.76	91.57 $\pm$ 1.70	71.15 $\pm$ 6.02
chewinggum	97.38 $\pm$ 0.34	66.14 $\pm$ 17.43	99.44 $\pm$ 0.01	95.88 $\pm$ 1.67	89.18 $\pm$ 1.39	66.46 $\pm$ 8.44
fryum	88.99 $\pm$ 1.04	54.94 $\pm$ 6.17	97.14 $\pm$ 0.21	83.38 $\pm$ 2.32	87.94 $\pm$ 0.48	71.24 $\pm$ 3.86

Appendix

Table 7: Per-category results on VisA (1-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
candle	89.19 $\pm$ 3.62	72.43 $\pm$ 3.94	98.91 $\pm$ 0.04	83.20 $\pm$ 4.71	95.13 $\pm$ 0.40	61.21 $\pm$ 7.40
capsules	97.73 $\pm$ 0.46	67.96 $\pm$ 6.14	98.08 $\pm$ 0.28	88.03 $\pm$ 1.14	91.88 $\pm$ 0.53	71.44 $\pm$ 0.65
cashew	91.03 $\pm$ 1.71	44.66 $\pm$ 8.38	99.56 $\pm$ 0.03	90.97 $\pm$ 1.83	91.73 $\pm$ 0.96	73.54 $\pm$ 1.48
chewinggum	97.94 $\pm$ 0.51	82.18 $\pm$ 4.58	99.40 $\pm$ 0.02	97.42 $\pm$ 0.62	89.87 $\pm$ 1.27	71.56 $\pm$ 6.30
fryum	93.06 $\pm$ 0.81	60.59 $\pm$ 2.79	97.47 $\pm$ 0.19	85.35 $\pm$ 1.96	90.09 $\pm$ 0.52	75.95 $\pm$ 2.42

Appendix

Table 8: Per-category results on VisA (2-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
candle	90.67 $\pm$ 3.48	73.86 $\pm$ 6.08	98.83 $\pm$ 0.37	86.72 $\pm$ 1.05	95.29 $\pm$ 0.18	75.17 $\pm$ 1.10
capsules	97.83 $\pm$ 0.18	74.00 $\pm$ 4.25	97.67 $\pm$ 1.06	90.13 $\pm$ 0.31	93.10 $\pm$ 0.66	76.14 $\pm$ 1.42
cashew	93.37 $\pm$ 0.62	43.48 $\pm$ 12.84	99.60 $\pm$ 0.01	90.42 $\pm$ 1.68	92.75 $\pm$ 0.64	72.84 $\pm$ 1.42
chewinggum	98.01 $\pm$ 0.48	88.57 $\pm$ 3.13	99.43 $\pm$ 0.01	97.88 $\pm$ 0.36	90.04 $\pm$ 0.55	69.76 $\pm$ 8.66
fryum	93.47 $\pm$ 1.32	57.68 $\pm$ 1.17	97.75 $\pm$ 0.10	85.40 $\pm$ 0.68	90.89 $\pm$ 0.32	77.05 $\pm$ 0.44

Appendix

Table 9: Per-category results on VisA (4-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
candle	92.78 $\pm$ 2.17	73.17 $\pm$ 3.12	98.41 $\pm$ 0.43	86.52 $\pm$ 1.80	95.73 $\pm$ 0.23	76.72 $\pm$ 1.49
capsules	97.68 $\pm$ 0.23	75.18 $\pm$ 1.49	96.78 $\pm$ 0.19	90.25 $\pm$ 1.19	93.10 $\pm$ 0.59	79.51 $\pm$ 2.59
cashew	94.07 $\pm$ 0.90	48.36 $\pm$ 15.87	99.59 $\pm$ 0.02	91.49 $\pm$ 0.43	92.36 $\pm$ 0.59	72.44 $\pm$ 1.90
chewinggum	98.25 $\pm$ 0.51	88.63 $\pm$ 2.78	99.42 $\pm$ 0.02	98.19 $\pm$ 0.50	90.23 $\pm$ 0.35	73.16 $\pm$ 3.53
fryum	94.71 $\pm$ 0.54	68.05 $\pm$ 9.03	97.82 $\pm$ 0.09	86.15 $\pm$ 1.56	90.95 $\pm$ 0.16	78.28 $\pm$ 2.28

Appendix

Table 10: Per-category results on VisA (8-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bracket_black	42.71 $\pm$ 1.91	35.20 $\pm$ 3.16	86.98 $\pm$ 3.17	78.74 $\pm$ 4.55	78.43 $\pm$ 2.81	65.76 $\pm$ 6.13
bracket_brown	50.43 $\pm$ 6.60	44.07 $\pm$ 7.69	90.85 $\pm$ 3.05	55.71 $\pm$ 3.94	77.17 $\pm$ 3.41	29.53 $\pm$ 4.62
bracket_white	79.19 $\pm$ 4.90	47.26 $\pm$ 9.92	92.28 $\pm$ 0.25	43.29 $\pm$ 5.39	90.40 $\pm$ 0.61	15.68 $\pm$ 5.32
connector	69.13 $\pm$ 1.45	36.67 $\pm$ 1.67	96.75 $\pm$ 0.23	79.36 $\pm$ 3.34	88.78 $\pm$ 0.77	31.95 $\pm$ 9.90
metal_plate	100.00 $\pm$ 0.00	78.08 $\pm$ 4.58	98.59 $\pm$ 0.15	87.94 $\pm$ 0.60	93.17 $\pm$ 0.15	66.17 $\pm$ 1.42

Appendix

Table 11: Per-category results on MPDD (1-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bracket_black	48.32 $\pm$ 12.97	33.20 $\pm$ 14.49	88.64 $\pm$ 1.93	76.66 $\pm$ 6.89	81.13 $\pm$ 2.56	63.11 $\pm$ 5.67
bracket_brown	53.95 $\pm$ 4.64	39.47 $\pm$ 10.21	93.48 $\pm$ 1.25	35.74 $\pm$ 11.10	80.78 $\pm$ 3.29	15.69 $\pm$ 9.04
bracket_white	78.15 $\pm$ 6.86	58.96 $\pm$ 7.51	93.04 $\pm$ 2.99	71.99 $\pm$ 23.08	82.09 $\pm$ 9.83	55.40 $\pm$ 33.97
connector	73.97 $\pm$ 6.35	41.83 $\pm$ 12.59	97.35 $\pm$ 0.63	83.86 $\pm$ 5.17	90.77 $\pm$ 2.11	45.37 $\pm$ 16.24
metal_plate	100.00 $\pm$ 0.00	74.68 $\pm$ 2.63	98.72 $\pm$ 0.03	88.62 $\pm$ 0.76	93.47 $\pm$ 0.02	66.93 $\pm$ 1.77

Appendix

Table 12: Per-category results on MPDD (2-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bracket_black	56.65 $\pm$ 7.95	47.89 $\pm$ 16.16	90.35 $\pm$ 4.82	81.36 $\pm$ 4.46	83.39 $\pm$ 4.18	69.82 $\pm$ 10.60
bracket_brown	59.35 $\pm$ 1.92	54.00 $\pm$ 6.52	92.96 $\pm$ 0.22	37.55 $\pm$ 9.93	80.66 $\pm$ 2.01	17.81 $\pm$ 6.93
bracket_white	66.15 $\pm$ 17.93	41.78 $\pm$ 8.06	84.57 $\pm$ 8.02	68.22 $\pm$ 20.28	61.36 $\pm$ 15.15	46.59 $\pm$ 23.29
connector	82.14 $\pm$ 7.08	52.86 $\pm$ 12.84	97.76 $\pm$ 0.88	89.78 $\pm$ 4.38	92.16 $\pm$ 2.97	64.66 $\pm$ 14.20
metal_plate	100.00 $\pm$ 0.00	84.13 $\pm$ 3.98	98.78 $\pm$ 0.10	89.96 $\pm$ 1.62	93.54 $\pm$ 0.24	71.38 $\pm$ 2.98

Appendix

Table 13: Per-category results on MPDD (4-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

	Image AUROC		Pixel AUROC		PRO
Object	Clean	Robust	Clean	Robust	Clean	Robust
bracket_black	60.86 $\pm$ 0.50	46.94 $\pm$ 12.73	93.60 $\pm$ 2.01	86.97 $\pm$ 5.87	86.29 $\pm$ 2.47	75.63 $\pm$ 7.07
bracket_brown	61.36 $\pm$ 1.93	53.65 $\pm$ 5.92	94.08 $\pm$ 0.40	44.62 $\pm$ 12.91	81.95 $\pm$ 1.60	24.75 $\pm$ 12.80
bracket_white	72.63 $\pm$ 11.30	52.37 $\pm$ 17.42	89.17 $\pm$ 8.30	59.95 $\pm$ 24.82	68.20 $\pm$ 14.15	49.02 $\pm$ 37.55
connector	85.00 $\pm$ 3.11	53.41 $\pm$ 4.29	98.07 $\pm$ 0.25	91.31 $\pm$ 0.38	93.20 $\pm$ 0.89	70.03 $\pm$ 1.46
metal_plate	100.00 $\pm$ 0.00	87.92 $\pm$ 10.08	98.85 $\pm$ 0.08	91.23 $\pm$ 2.54	93.78 $\pm$ 0.21	74.36 $\pm$ 6.71

Appendix

Table 14: Per-category results on MPDD (8-shot). Each cell reports mean

\pm

std across 3 seeds for clean-defended and PGD-20 (

\epsilon=8/255

) robust evaluation. All values are percentages.

Figure A: Latency–robustness Pareto on MVTec-AD,

k{=}4

, PGD-20 at

\epsilon{=}8/255

Few-Shot Anomaly Detection

Few-shot anomaly detection uses a small set of examples to identify and localize unusual patterns in new data or domains.

See all 40 papers

Feb 26, 2026

SubspaceAD: Training-Free Few-Shot Anomaly Detection via Subspace Modeling

Detecting visual anomalies in industrial inspection often requires training with only a few normal images per category. Recent few-shot methods achieve strong results employing foundation-model features, but typically rely on memory banks, auxiliary datasets, or multi-modal tuning of vision-language models. We therefore question whether such complexity is necessary given the feature representations of vision foundation models. To answer this question, we introduce SubspaceAD, a training-free method, that operates in two simple stages. First, patch-level features are extracted from a small set of normal images by a frozen DINOv2 backbone. Second, a Principal Component Analysis (PCA) model is fit to these features to estimate the low-dimensional subspace of normal variations. At inference, anomalies are detected via the reconstruction residual with respect to this subspace, producing interpretable and statistically grounded anomaly scores. Despite its simplicity, SubspaceAD achieves state-of-the-art performance across one-shot and few-shot settings without training, prompt tuning, or memory banks. In the one-shot anomaly detection setting, SubspaceAD achieves image-level and pixel-level AUROC of 97.1% and 97.5% on the MVTec-AD dataset, and 93.2% and 98.2% on the VisA dataset, respectively, surpassing prior state-of-the-art results. Code and demo are available at https://github.com/CLendering/SubspaceAD.

Camile Lendering, Erkut Akdag, Egor Bondarev

AIMS Group, Department of Electrical Engineering, Eindhoven University of Technology

Few-Shot Anomaly Detection Anomaly Detection Industrial Anomaly Detection Reconstruction-Based Anomaly Detection

Ask PDF

Jul 27, 2026

DuoAD: Leveraging [CLS] Dual Characteristics for Training-Free Few-Shot Anomaly Detection

Vision foundation models have enabled strong training-free anomaly detection (AD). However, most existing approaches rely primarily on independent local patch features, leaving the global contextual information encoded by Vision Transformers (ViTs) underexploited. In this work, we identify the dual characteristics of the ViT [CLS] token: its embedding provides anomaly-invariant global semantic representation, while its attention maps implicitly highlight spatially abnormal regions. Building on this observation, we propose a fully automated AD framework leveraging global context to remove manual tunings. Our framework introduces (1) an automatic augmentation selection strategy driven by [CLS]-level semantic consistency, and (2) an attention-guided feature reweighting mechanism that dynamically adjusts patch contributions according to [CLS] attention saliency. By integrating these components over multi-level features, our method achieves stable anomaly scoring and precise localization without training or parameter tuning. Under the one-shot setting, it achieves Image-AUC scores of 97.7%, 93.2%, and 84.5% on MVTec-AD, VisA, and Real-IAD. Using a single fixed configuration across categories, backbones, and datasets, the method establishes a new state-of-the-art for plug-and-play, training-free anomaly detection while maintaining strong robustness and practical scalability.

Jyun-Ze Tang, Po-Han Huang, Ming-Ching Chang +2

Inventec Corporation, Taipei, Taiwan · University at Albany, State University of New York, NY, USA

Few-Shot Anomaly Detection Anomaly Localization Anomaly Detection

Ask PDF

Aug 27, 2026

ShiftSplit-AD: Separating Domain Shift from Defects in Foundation-Feature Visual Anomaly Detection

Visual anomaly detectors based on frozen foundation-model features commonly score distances from test patches to a memory of normal features. Benign acquisition changes can also enlarge these distances, confounding domain variation with defects. We investigate whether structured decomposition of nearest-normal DINOv2 residuals can suppress shift-induced evidence while retaining unseen defects. ShiftSplit-AD decomposes the patch residual matrix into low-rank and row-sparse components and scores the sparse component, with an optional low-rank/sparse fusion. The experiments expose a central trade-off rather than a universal separation: genuine defects can contain correlated, low-dimensional structure, so filtering broad residual activity may also remove defect information. On AeBAD-S, using settings fixed after Bottle development, sparse-only scoring improves image AUROC from 0.6780 to 0.7294 and AUPRC from 0.8052 to 0.8465. Paired bootstrap 95% intervals for the improvements are [0.0238, 0.0808] and [0.0170, 0.0650], respectively. However, sparse-only scoring reduces mean clean AUROC from 0.9890 to 0.9133 on four held-out MVTec categories and degrades Bottle localization. These findings show that residual decomposition can help when domain shift strongly contaminates anomaly evidence, but preserving defect structure remains the limiting problem.

Muhamathu Ameer Ali Aacaas Muhamath

Department of Electrical Engineering University of Moratuwa Moratuwa, Sri Lanka

Anomaly Detection Anomaly Localization

Ask PDF

Abstract

Few-Shot Anomaly Detection

Explore similar work

SubspaceAD: Training-Free Few-Shot Anomaly Detection via Subspace Modeling

DuoAD: Leveraging [CLS] Dual Characteristics for Training-Free Few-Shot Anomaly Detection

ShiftSplit-AD: Separating Domain Shift from Defects in Foundation-Feature Visual Anomaly Detection