Organizations: The authors are with the Electrical and Computer Engineering Department, The University of North Carolina at Charlotte, Charlotte, NC, 28223 USA.
Shoplifting is a growing operational and economic challenge for retailers, with incidents rising and losses increasing despite extensive video surveillance. Continuous human monitoring is infeasible, motivating automated, privacy-preserving, and resource-aware detection solutions. In this paper, we cast shoplifting detection as a pose-based, unsupervised video anomaly detection problem and introduce a periodic adaptation framework designed for on-site Internet of Things (IoT) deployment. Our approach enables edge devices in smart retail environments to adapt from streaming, unlabeled data, supporting scalable and low-latency anomaly detection across distributed camera networks. To support reproducibility, we introduce RetailS, a new large-scale real-world shoplifting dataset collected from a retail store under multi-day, multi-camera conditions, capturing unbiased shoplifting behavior in realistic IoT settings. For deployable operation, thresholds are selected using both F1 and H_PRS scores, the harmonic mean of precision, recall, and specificity, during data filtering and training. In periodic adaptation experiments, our framework consistently outperformed offline baselines on AUC-ROC and AUC-PR in 91.6% of evaluations, with each training update completing in under 30 minutes on edge-grade hardware, demonstrating the feasibility and reliability of our solution for IoT-enabled smart retail deployment.
Figures & tables
Fig. 1 : A conceptual overview of an IoT-enabled shoplifting detection system with continual unsupervised anomaly detection. Frames (F) from distributed surveillance cameras are preprocessed at the edge to produce annotations (A), including bounding boxes (BB), track IDs (ID), and human poses. The anomaly detector filters frames for real-time screening and outputs anomaly results (AR). A collector accumulates pseudo-filtered frames F[n] for continual unsupervised adaptation. After each training cycle, updated model weights (W) are pushed back to the edge for the next cycle of detection.
Fig. 2 : A conceptual overview of our IoT-oriented continual unsupervised anomaly detection pipeline with pseudo filtering, collection, and training. Model updates are designed to run incrementally on edge-grade devices, enabling scalable deployment across distributed surveillance nodes.
Fig. 3 : Bird’s-eye view of the retail store in our RetailS dataset, showing six IoT-connected camera locations and their coverage areas.
Fig. 4 : Two six-frame shoplifting sequences are illustrated, with the top row showing concealment of an item in a pocket and the bottom row showing placement of an item in a bag while standing. Anonymized pose sequences ensure privacy while enabling IoT deployment.
Dataset
Normal Frames
Shoplifting Frames
Shoplifting Samples
Camera Views
PoseLift Train Set [ 3 ]
53,353
0
0
6
PoseLift Test set [ 3 ]
2,221
1,500
43
6
RetailS Train Set ( Ours )
19,971,589
0
0
6
RetailS Real-world Test set ( Ours )
2,432
1,933
53
6
RetailS Staged Test Set ( Ours )
20,578
20,335
898
6
TABLE I: Separation of training and test sets for model benchmarking. The Poselift dataset Set [ 3 ] provides a baseline, while our dataset expands it by incorporating a much larger volume of real-world shopping behavior in the training set, extending the real-world test set, and adding a staged test branch. Each dataset reports the number of normal and shoplifting frames, shoplifting samples, and camera views, with test sets designed to contain nearly equal numbers of shoplifting and normal frames.
Fig. 5 : Distribution of shoplifting instances across six IoT-connected cameras. Real-world events cluster in specific zones, while staged scenarios ensure coverage across all views.
Fig. 6 : Distribution of shoplifting strategies in RetailS across staged and real-world subsets. Balanced staged coverage supports generalization in IoT deployments.
Dataset
Model
Staged Test Set
Real-world Test Set
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
PoseLift
STG-NF [ 21 ]
88.10
86.46
61.35
33.72
TSGAD [ 43 ]
59.37
40.83
59.08
35.94
SPARTA [ 22 ]
77.84
75.81
56.82
34.42
RetailS ( Ours )
STG-NF [ 21 ]
87.24
86.60
63.22
38.44
TSGAD [ 43 ]
51.99
51.87
62.16
38.32
TABLE II : Performance of three state-of-the-art anomaly detection models under offline training. PoseLift rows show models trained on PoseLift and tested on the RetailS, while RetailS rows use our training set, highlighting generalization and the effect of larger, more diverse data.
Fig. 7 : Model performance trends at one-day update frequency . Long dashes = offline training on RetailS, dots = offline training on PoseLift, solid lines = periodic adaptation.
Fig. 8 : Model performance trends at half-day update frequency . Long dashes = offline training on RetailS, dots = offline training on PoseLift, solid lines = periodic adaptation.
Model
avg. time (min.)
Half-day data
One-day data
STG-NF [ 21 ]
3.5
7.3
TSGAD [ 43 ]
26.8
65
SPARTA [ 22 ]
2.05
3.2
TABLE III : Average training time (in minutes) per update for continual learning with half-day and one-day data batches across three state-of-the-art pose-based models.
Fig. 9 : Distribution of shoplifting event durations in staged and real-world subsets. Short durations reflect realistic concealment strategies observed in IoT surveillance.
Camera
Shoplifting Events
STG-NF
TS-GAD
SPARTA
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
C1
185
78.15
73.58
54.13
57.70
75.25
71.65
C2
114
76.17
75.33
53.07
52.42
79.51
77.61
C3
144
76.40
73.46
52.39
54.09
76.92
74.64
C4
161
83.46
79.26
52.06
53.43
71.99
69.90
C5
145
79.76
77.10
52.46
53.87
72.60
69.85
TABLE IV : Per-camera performance comparison under single-camera training and evaluation. Each model is trained using only normal data from one camera view and evaluated on the corresponding per-camera test split. Results highlight the impact of viewpoint, occlusion patterns, and camera placement on detection performance.
Event
STG-NF
TS-GAD
SPARTA
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
AUC-ROC
AUC-PR
Bag (floor)
86.72
86.52
51.85
54.59
74.28
74.52
Bag (standing)
86.11
86.31
52.09
53.26
74.11
75.02
Hoodie
87.99
87.43
52.52
52.99
74.83
76.58
Jacket
87.96
86.59
52.72
52.25
74.76
77.53
Pants
87.90
86.78
51.65
51.59
74.87
76.47
TABLE V : Per-shoplifting event performance comparison under all-camera training and evaluation. Each model is trained using only normal data and evaluated on the corresponding per-shoplifting event test split. Results highlight the average performace ofdifferent shoplifting event in RetailS dataset.
Retail theft costs the global economy over $100 billion annually, yet existing AI-based detection systems require expensive custom model training on proprietary datasets and charge $200-500/month per store. We present Paza, a zero-shot retail theft detection framework that achieves practical concealment detection without training any model. Our approach orchestrates multiple existing models in a layered pipeline - cheap object detection and pose estimation running continuously, with an expensive vision-language model (VLM) invoked only when behavioral pre-filters trigger. A multi-signal suspicion pre-filter (requiring dwell time plus at least one behavioral signal) reduces VLM invocations by 240x compared to per-frame analysis, bounding calls to <=10/minute and enabling a single GPU to serve 10-20 stores. The architecture is model-agnostic: the VLM component accepts any OpenAI-compatible endpoint, enabling operators to swap between models such as Gemma 4, Qwen3.5-Omni, GPT-4o, or future releases without code changes - ensuring the system improves as the VLM landscape evolves. We evaluate the VLM component on the DCSASS synthesized shoplifting dataset (169 clips, controlled environment), achieving 89.5% precision and 92.8% specificity at 59.3% recall zero-shot - where the recall gap is attributable to sparse frame sampling in offline evaluation rather than VLM reasoning failures, as precision and specificity are the operationally critical metrics determining false alarm rates. We present a detailed cost model showing viability at $50-100/month per store (3-10x cheaper than commercial alternatives), and introduce a privacy-preserving design that obfuscates faces in the detection pipeline. The source code is available at https://github.com/xHaileab/Paza-AI.
In this work, we present OCLADS, a novel communication framework with continual learning (CL) for Internet of Things (IoT) anomaly detection (AD) when operating in non-stationary environments. As the statistical properties of the observed data change with time, the on-device inference model becomes obsolete, which necessitates strategic model updating. OCLADS keeps track of data distribution shifts to timely update the on-device IoT AD model. To do so, OCLADS introduces two mechanisms during the interaction between the resource-constrained IoT device and an edge server (ES): i) an intelligent sample selection mechanism at the device for data transmission, and ii) a distribution-shift detection mechanism at the ES for model updating. Experimental results with TinyML demonstrate that our proposed framework achieves high inference accuracy while realizing a significantly smaller number of model updates compared to the baseline schemes.
Faculty of Electrical Engineering and Information Technologies, Ss. Cyril and Methodius University in Skopje, 1000 Skopje, North Macedonia · Dept. of Electronic Systems, Aalborg University, Aalborg, Denmark
We propose a lightweight two-stage framework for real-time video anomaly detection. The first stage employs YOLO v11n-pose to detect persons and extract seventeen skeletal keypoints in a single forward pass. The second stage encodes each cropped person region through CLIP ViT-B/32 and computes cosine similarity against predefined textual descriptions of anomalous behaviors. This architecture eliminates the need for optical flow, standalone pose estimators, and density-based scoring modules. Experiments on CUHK Avenue, ShanghaiTech Campus, and a custom indoor dataset collected at Chulalongkorn University demonstrate an end-to-end throughput of approximately 51 FPS on an NVIDIA Titan XP GPU, a 3.36x speedup over the multi-feature baseline, while maintaining frame-level AUROC values of 89.26%, 70.26%, and 84.13%, respectively.
Vanodhya G. Warnasooriya, Amir Hajian, Watchara Ruangsang +1
Dept. of Electrical Engineering, Faculty of Engineering, Chulalongkorn University, Bangkok 10330, Thailand · Media Technology Program, King Mongkut’s Univ. of Technology Thonburi, Bangkok 10150, Thailand