NFAD: Nuisance-Filtered Anomaly Detection Under Distribution Shift

Dat Cao; Son Nghiem; Phan Nguyen; Jun Rekimoto; Jhih-Ciang Wu

cs.CVAug 29, 2026

NFAD: Nuisance-Filtered Anomaly Detection Under Distribution Shift

Authors: Dat Cao, Son Nghiem, Phan Nguyen, Jun Rekimoto, Jhih-Ciang Wu

Organizations: Korea Advanced Institute of Science and Technology (KAIST), South Korea · Sony Computer Science Laboratories (Sony CSL), Japan · The University of Tokyo, Japan · National Taiwan Normal University (NTNU), Taiwan

Abstract

Recent advances in anomaly detection (AD) for industrial inspection have pushed performance on standard benchmarks toward saturation. However, strong benchmark performance does not necessarily translate to real-world deployment, as these benchmarks are primarily collected under controlled acquisition conditions. Changes in illumination, background, viewpoint, and other environmental factors can shift normal samples away from the learned normal distribution and cause false anomaly responses. We address AD under such distribution shifts by explicitly modeling nuisance variation from changing imaging conditions in feature space. Without anomaly labels or target-domain data, our Nuisance-Filtered Anomaly Detection (NFAD) framework estimates a nuisance subspace from matched feature displacements induced by content-preserving perturbations and suppresses its contribution to anomaly residuals at inference. The same subspace supports two complementary branches: full projection for image-level detection and selective suppression for pixel-level localization, preserving evidence of localized defects. On AeBAD-S, a benchmark specifically designed for AD under acquisition shifts, NFAD achieves 91.0% image-level AUROC, establishing a new state of the art. Notably, this robustness does not come at the expense of conventional AD performance: NFAD remains competitive on standard benchmarks that do not explicitly evaluate distribution shift, including VisA, Real-IAD, and MVTec AD. These results show that explicitly suppressing such nuisance variation improves AD under distribution shift while preserving strong performance in standard settings.

Figures & tables

Figure 1: Residual–nuisance entanglement. Normal and defect residuals exhibit similar, above-chance alignment with the label-free nuisance subspace across datasets and backbones.

(a) Reconstruction residual across datasets
Dataset	$f_{\mathrm{def.}}$	$f_{\mathrm{norm.}}$	$f_{\mathrm{disc.}}$	Chance
AeBAD-S [ 41 ]	0.420	0.421	0.581	0.042
MVTec-AD [ 3 ]	0.465	0.392	0.642	0.042
VisA [ 43 ]	0.365	0.315	0.485	0.042

Table 1: Residual alignment with the operator’s

32

-dimensional nuisance subspace

V

f_{\mathrm{def.}}

and

f_{\mathrm{norm.}}

are the mean per-patch energy fractions inside

V

for defect and normal patches, and

f_{\mathrm{disc.}}

is the overlap of the defect-vs-normal discriminative direction

\mu_{\mathrm{def}}-\mu_{\mathrm{norm}}

. Chance is the random-subspace floor

k/C

Figure 2: Overview of the proposed NFAD framework. A student reconstructs the hierarchical features of a frozen DINOv3 teacher, reconstruction residual scores anomalies patch by patch. Offline, content-preserving perturbations of normal images give a matched intervention response (MIR) whose leading directions form a label-free nuisance subspace $V$ . Detection head removes $V$ by full projection, while localization removes its globally acting directions through a participation-ratio gate, sparing the local evidence a defect map needs.

Method	Venue	Image-level			Pixel-level
Method	Venue	AUROC	AP	$F_{1}$ -max	AUROC	AP	$F_{1}$ -max	AUPRO
RD4AD [ 13 ]	CVPR’22	81.1	91.3	87.6	91.1	8.9	13.0	84.8
PatchCore [ 31 ]	CVPR’22	68.5	83.7	84.3	93.5	13.0	20.2	85.8
DeSTSeg [ 40 ]	CVPR’23	57.3	73.1	83.7	86.7	4.7	9.5	59.3
MMR [ 41 ]	Comput. Ind.’23	84.6	92.9	88.1	90.8	10.5	15.2	88.5
MambaAD [ 19 ]	NeurIPS’24	77.9	89.0	86.7	93.0	10.0	13.7	89.0

Table 2: Comparison on AeBAD-S under real-world domain shifts. Best and second-best results are bold and underlined, respectively.

Domain	Image-level			Pixel-level
Domain	AUROC	AP	$F_{1}$ -max	AUROC	AP	$F_{1}$ -max	AUPRO
Same	90.6	94.8	88.6	95.6	9.9	18.0	90.2
Background	95.6	98.0	93.3	95.4	11.4	21.5	91.9
Illumination	91.7	96.9	91.2	96.1	13.6	21.2	93.5
View	86.0	94.3	92.1	92.6	11.9	19.4	87.5
Mean	91.0	96.0	91.3	94.9	11.7	20.0	90.8

Table 3: Per-domain performance of NFAD on AeBAD-S.

Method	VisA [ 43 ]			MVTec-AD [ 3 ]			Real-IAD [ 35 ]
Method	I-AU	P-AU	PRO	I-AU	P-AU	PRO	I-AU	P-AU	PRO
RD4AD cvpr’22	96.3	98.3	91.5	98.6	97.6	93.6	89.5	98.8	91.3
PatchCore cvpr’22	94.6	98.5	92.6	99.1	98.1	93.0	90.5	n/a	94.0
DeSTSeg cvpr’23	90.5	97.5	79.4	97.7	98.2	92.4	87.2	97.8	79.3
MMR comp. ind.’23	95.1	98.4	91.3	98.4	97.2	92.3	90.6	98.9	93.9
MambaAD neurips’24	95.3	98.8	91.9	98.7	97.8	94.0	86.3	98.5	90.5

Table 4: Comparison on standard UAD benchmarks with single-class setting . Real-IAD is evaluated under the multi-view setting. Best and second-best results are bold and underlined, respectively.

Components		AeBAD-S [ 41 ]	MVTec-AD [ 3 ]	VisA [ 43 ]
Proj.	MIR-based	AeBAD-S [ 41 ]	MVTec-AD [ 3 ]	VisA [ 43 ]
		$86.7/94.2/87.7$	$98.3/99.0/97.2$	$98.2/98.4/96.1$
$\checkmark$		$90.5/95.8/90.5$	$99.0/99.2/98.0$	$98.5/98.7/96.5$
$\checkmark$	$\checkmark$	$\mathbf{91.0}/\mathbf{96.0}/\mathbf{91.3}$	$\mathbf{99.0}/\mathbf{99.6}/\mathbf{98.0}$	$\mathbf{98.9}/\mathbf{99.0}/\mathbf{96.5}$

Table 5: Detection-head ablation. Entries report I-AUROC / I-AP / I-

F_{1}

-max. Proj. projects out a variance-estimated nuisance subspace, and MIR-based replaces that basis with the matched-intervention-response estimate. Best results are shown in boldface.

Components			AeBAD-S [ 41 ]	MVTec-AD [ 3 ]	VisA [ 43 ]
Proj.	Gated $V_{g}$	MIR-based	AeBAD-S [ 41 ]	MVTec-AD [ 3 ]	VisA [ 43 ]
			$93.6/89.4$	$97.1/92.0$	$98.0/95.1$
$\checkmark$			$94.4/90.6$	$97.2/92.5$	$98.4/95.4$
$\checkmark$	$\checkmark$		$94.9/90.6$	$97.6/92.1$	$98.6/95.5$
$\checkmark$	$\checkmark$	$\checkmark$	$\mathbf{94.9}/\mathbf{90.8}$	$\mathbf{97.7}/\mathbf{92.7}$	$\mathbf{98.6}/\mathbf{95.8}$

Table 6: Localization-head ablation. Entries report P-AUROC / AUPRO. Same ablate components as Tab. 5 , and

V_{g}

denotes the incidence-selected subset. Best results are shown in boldface.

Figure 3: Image-AUROC improvement of the operator on VisA-C with varying severity of the synthetic corruptions.

Figure 4: Image-level AUROC of our operator equipped with various foundation backbones. MIM: Masked Image Modeling. CL: Contrastive Learning. VLM: Vision-Language Model.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Category	Train	Test (norm. / anom.)
AeBAD-S [ 41 ]	1	$521$	$1{,}639$ ( $490$ / $1{,}149$ )
MVTec-AD [ 3 ]	15	$3{,}629$	$1{,}725$ ( $467$ / $1{,}258$ )
VisA [ 43 ]	12	$8{,}659$	$2{,}162$ ( $962$ / $1{,}200$ )
Real-IAD [ 35 ]	30	$36{,}465$	$114{,}585$ ( $63{,}256$ / $51{,}329$ )

Appendix

Table 7: Dataset statistics, verified from the released splits. Test counts are given as total (normal / anomalous). AeBAD-S trains on the source domain only.

Setting	$\dim(V){=}32$	$\dim(V){=}64$
Reconstruction residual, DINOv3-B/16
AeBAD-S [ 41 ]	0.420 / 0.421	0.585 / 0.568
MVTec-AD [ 3 ]	0.465 / 0.392	0.623 / 0.550
VisA [ 43 ]	0.365 / 0.315	0.530 / 0.466
Nearest-normal residual, cross-backbone
DINOv3-B/16 [ 32 ]	0.482 / 0.437	0.647 / 0.606

Appendix

Table 8: Overlap

f_{\mathrm{def.}}/f_{\mathrm{norm.}}

at two subspace ranks. Chance is

0.042

(

\dim 32

) and

0.083

(

\dim 64

) for the

768

-dimensional ViT features, and

0.048/0.096

for WideResNet-50.

MVTec-AD [ 3 ]	$f_{\mathrm{disc.}}$	VisA [ 43 ]	$f_{\mathrm{disc.}}$
bottle	0.761	candle	0.663
cable	0.549	capsules	0.375
capsule	0.638	cashew	0.468
carpet	0.643	chewinggum	0.599
grid	0.821	fryum	0.523
hazelnut	0.655	macaroni1	0.499

Appendix

Table 9: Per-category

f_{\mathrm{disc.}}

for the reconstruction residual with DINOv3-B/16. Chance

=0.042

Domain	normal RMS	energy removed	contrast	Spearman $\rho$
same	0.426 $\to$ 0.331	39.5%	2.11 $\to$ 2.01	0.925
background	0.526 $\to$ 0.364	52.2%	1.85 $\to$ 1.95	0.925
illumination	0.511 $\to$ 0.383	43.8%	1.85 $\to$ 1.81	0.887
view	0.467 $\to$ 0.363	39.4%	1.91 $\to$ 1.84	0.917

Appendix

Table 10: Per-domain projection mechanism on AeBAD-S, before

\to

after

\Pi_{V}

. RMS is the root-mean-square residual magnitude over each patch group; contrast

=

RMS def /RMS norm ; Spearman

\rho

is between the per-image scores before and after projection (pooled

\rho=0.923

	Image-level			Pixel-level
Seed	AUROC	AP	$F_{1}$	AUROC	AP	$F_{1}$	AUPRO
54 (Our reported number)	90.96	96.03	91.30	94.91	11.69	20.02	90.75
1	90.87	95.94	90.88	95.12	12.09	20.53	91.03
42	90.77	95.90	90.99	95.02	11.85	19.82	90.95
123	90.72	95.87	90.77	95.07	11.88	19.95	91.01
2025	90.58	95.85	90.85	95.01	12.10	20.39	91.05

Appendix

Table 11: Seed variance of the full model on AeBAD-S. Results over five seeds are followed by their mean and standard deviation.

Basis construction	I-AUROC	P-AUROC	AUPRO
Within-image scatter	90.5	94.9	90.6
Generalized eigen ( $S_{\mathrm{nui}}/S_{\mathrm{norm}}$ )	89.2	93.6	89.8
Ratio-selection	87.4	94.4	90.0
MIR ( $\Delta z$ , ours)	91.0	94.9	90.8

Appendix

Table 12: Nuisance-basis construction on AeBAD-S (mean over four domains), all with the shipped dual read-out and dim

16

per family. Detection I-AUROC, localization P-AUROC and AUPRO. Best in bold.

Localization variant	P-AUROC	AUPRO
Rotation-invariant incidence	89.6	84.5
Magnitude-aware gate	94.5	90.7
Ours	94.9	90.8

Appendix

Table 13: Localization design on AeBAD-S. The detection head is fixed and removes the full

V

; only the localization read-out varies. Best results are shown in bold.

$d$ per family	I-AUROC	AUPRO
$d=8$	89.8	91.1
$d=16$ (ours)	91.0	90.8
$d=32$	91.4	90.0
$d=64$	91.2	90.3

Appendix

Table 14: Sensitivity to the per-family subspace rank

d

on AeBAD-S. Detection I-AUROC and localization AUPRO. The default setting is marked ours .

Pre-train	Foundation	Method	I-AUROC	P-AUROC	AUPRO
Sup.	AugReg @ $224^{2}$ [ 33 ]	Control	55.17	82.24	70.02
		Ours	73.57	87.06	75.17
		$\Delta$	+18.40	+4.82	+5.15
	DeiT @ $224^{2}$ [ 34 ]	Control	57.82	83.60	65.79
		Ours	67.56	84.62	66.03
		$\Delta$	+9.74	+1.02	+0.24

Appendix

Table 15: Per-foundation results on AeBAD-S.

\Delta

denotes Ours

-

Control.

Corruption	Method	$s{=}1$	$s{=}2$	$s{=}3$
In-family (photometric)
Brightness	Control	97.70	92.78	86.22
	Ours	97.72	93.65	87.58
Contrast	Control	91.86	85.12	70.96
	Ours	95.49	90.97	75.63
Out-of-family (held out)

Appendix

Table 16: Controlled corruption on VisA (

448

pixels), measured by image AUROC. Control denotes the base detector, while Ours adds the proposed operator. Severities range from 1 to 3 for four ImageNet-C corruptions. The better result is shown in bold.

		Image-level			Pixel-level
Detector	$d$	I-AUROC	I-AP	I- $F_{1}$	P-AUROC	P-AP	P- $F_{1}$	AUPRO
RD4AD [ 13 ]	0	81.08	91.27	87.60	91.13	8.94	13.04	84.76
	8	81.97	91.51	87.85	90.79	8.62	13.30	82.38
	16	82.52	91.80	88.09	91.29	9.04	13.43	84.01
	32	82.67	91.91	87.67	91.47	9.36	13.50	84.77
	64	82.84	92.04	87.65	91.66	9.41	13.48	85.14

Appendix

Table 17: Operator as a plug-in on five base detectors on AeBAD-S (mean over four domains). The operator projects out a

d

-per-family nuisance subspace from each detector, with

d{=}0

denoting the unmodified detector.

F_{1}

denotes

F_{1}

-max. The best value for each detector and metric is shown in bold.

	Image-level			Pixel-level
Category	AUROC	AP	$F_{1}$	AUROC	AP	$F_{1}$	AUPRO
bottle	100.00	100.00	100.00	98.50	80.88	76.44	95.72
cable	97.86	98.81	94.51	96.42	53.29	60.37	87.91
capsule	97.17	99.44	96.33	98.44	43.66	47.15	95.01
carpet	100.00	100.00	100.00	99.28	69.66	66.88	97.46
grid	99.84	99.94	99.12	98.59	33.31	38.52	94.41

Appendix

Table 18: Per-category results on MVTec-AD. Mean in bold.

	Image-level			Pixel-level
Category	AUROC	AP	$F_{1}$	AUROC	AP	$F_{1}$	AUPRO
candle	98.73	98.96	94.63	99.45	33.97	43.99	97.08
capsules	99.27	99.51	98.10	98.43	43.55	49.47	96.67
cashew	98.20	99.15	96.32	97.56	47.64	50.38	97.06
chewinggum	99.20	99.63	97.26	99.54	64.06	64.90	95.63
fryum	99.72	99.88	99.50	95.56	39.61	47.01	94.65

Appendix

Table 19: Per-category results on VisA. Mean in bold.

	Image-level			Pixel-level
Category	AUROC	AP	$F_{1}$	AUROC	AP	$F_{1}$	AUPRO
audiojack	88.73	84.96	73.82	99.39	50.77	53.37	94.39
bottle_cap	90.82	88.62	81.14	99.84	38.22	41.64	98.87
button_battery	85.65	88.84	80.57	99.14	51.08	53.11	94.28
end_cap	85.22	86.81	82.34	98.77	20.56	27.94	95.39
eraser	94.08	92.64	83.72	99.82	47.18	49.41	98.68

Appendix

Table 20: Per-category results on Real-IAD. Mean in bold.

Figure 5: Qualitative results on AeBAD-S under real illumination (left three) and background shifts (right three). Defective (top) and normal (bottom) examples are separated by the dotted line. Each triplet shows the input, control map without projection, and our map after full- $V$ projection. Maps are overlaid using the jet colormap; green contours mark ground-truth defects, and annotations report per-example metrics from control to ours. On defective images, our operator suppresses shift-induced responses and concentrates activation on the true defect, improving PRO and pixel AUROC. On normal images, where any activation is a false positive, it produces cooler maps and moves the image-level $z$ -score back toward the normal population, preventing false alarms.

Figure 6: Anomaly maps on corrupted VisA (VisA-C) under four ImageNet-C corruptions at severity 3, using the defects-over-normals layout of Fig. 5 . On defects (top, green contour), the corruptions make the control respond across the object and collapse localization, whereas our operator recovers the defect and improves per-image PRO and pixel AUROC. On normals (bottom), the control fires without defects, while the annotated image-level $z$ -score shows our operator returning each false alarm toward normal. Gains on in-family brightness and contrast and held-out defocus blur and Gaussian noise confirm generalization beyond the modeled shifts.

Explore similar work

May 14, 2026

SuperADD: Training-free Class-agnostic Anomaly Segmentation -- CVPR 2026 VAND 4.0 Workshop Challenge Industrial Track

Visual anomaly detection (AD) for industrial inspection is a highly relevant task in modern production environments. The problem becomes particularly challenging when training and deployment data differ due to changes in acquisition conditions during production. In the VAND 4.0 Industrial Track, models must remain robust under distribution shifts such as varying illumination and their performance is assessed on the MVTec AD 2 dataset. To address this setting, we propose a training-free and class-agnostic anomaly detection pipeline based on the work of SuperAD. Our approach improves generalization through several modifications designed to enhance robustness under distribution shifts. These adaptations include using a DINOv3 backbone, overlapping patch-wise processing, intensity-based augmentations, improved memory-bank subsampling for better coverage of the data distribution, and iterative morphological closing for cleaner and more spatially consistent anomaly maps. Unlike methods that rely on class-specific architectures or per-class hyperparameter tuning, our method uses a single architecture and one shared hyperparameter configuration across all object classes. This makes the approach well suited for industrial deployment, where product variants and appearance changes must be handled with minimal adaptation effort. We achieve segmentation F1 scores of

62.61\%

57.42\%

, and

54.35\%

on test public, private, and private mixed of MVTec AD 2 respectively, thereby outperforming SuperAD and other state-of-the-art methods. Code is available at https://github.com/LukasRoom/SuperADD.

Lukas Roming, Felix Lehnerer, Jonas V. Funk +4

Fraunhofer IOSB, Fraunhoferstr. 1, 76131 Karlsruhe, Germany · Independent Research

OOD Generalization Industrial Anomaly Detection Anomaly Localization

Ask PDF

Aug 27, 2026

ShiftSplit-AD: Separating Domain Shift from Defects in Foundation-Feature Visual Anomaly Detection

Visual anomaly detectors based on frozen foundation-model features commonly score distances from test patches to a memory of normal features. Benign acquisition changes can also enlarge these distances, confounding domain variation with defects. We investigate whether structured decomposition of nearest-normal DINOv2 residuals can suppress shift-induced evidence while retaining unseen defects. ShiftSplit-AD decomposes the patch residual matrix into low-rank and row-sparse components and scores the sparse component, with an optional low-rank/sparse fusion. The experiments expose a central trade-off rather than a universal separation: genuine defects can contain correlated, low-dimensional structure, so filtering broad residual activity may also remove defect information. On AeBAD-S, using settings fixed after Bottle development, sparse-only scoring improves image AUROC from 0.6780 to 0.7294 and AUPRC from 0.8052 to 0.8465. Paired bootstrap 95% intervals for the improvements are [0.0238, 0.0808] and [0.0170, 0.0650], respectively. However, sparse-only scoring reduces mean clean AUROC from 0.9890 to 0.9133 on four held-out MVTec categories and degrades Bottle localization. These findings show that residual decomposition can help when domain shift strongly contaminates anomaly evidence, but preserving defect structure remains the limiting problem.

Muhamathu Ameer Ali Aacaas Muhamath

Department of Electrical Engineering University of Moratuwa Moratuwa, Sri Lanka

Anomaly Detection Anomaly Localization

Ask PDF

Feb 26, 2026

SubspaceAD: Training-Free Few-Shot Anomaly Detection via Subspace Modeling

Detecting visual anomalies in industrial inspection often requires training with only a few normal images per category. Recent few-shot methods achieve strong results employing foundation-model features, but typically rely on memory banks, auxiliary datasets, or multi-modal tuning of vision-language models. We therefore question whether such complexity is necessary given the feature representations of vision foundation models. To answer this question, we introduce SubspaceAD, a training-free method, that operates in two simple stages. First, patch-level features are extracted from a small set of normal images by a frozen DINOv2 backbone. Second, a Principal Component Analysis (PCA) model is fit to these features to estimate the low-dimensional subspace of normal variations. At inference, anomalies are detected via the reconstruction residual with respect to this subspace, producing interpretable and statistically grounded anomaly scores. Despite its simplicity, SubspaceAD achieves state-of-the-art performance across one-shot and few-shot settings without training, prompt tuning, or memory banks. In the one-shot anomaly detection setting, SubspaceAD achieves image-level and pixel-level AUROC of 97.1% and 97.5% on the MVTec-AD dataset, and 93.2% and 98.2% on the VisA dataset, respectively, surpassing prior state-of-the-art results. Code and demo are available at https://github.com/CLendering/SubspaceAD.

Camile Lendering, Erkut Akdag, Egor Bondarev

AIMS Group, Department of Electrical Engineering, Eindhoven University of Technology

Few-Shot Anomaly Detection Anomaly Detection Industrial Anomaly Detection Reconstruction-Based Anomaly Detection

Ask PDF