How Far Can Untrained Neural Networks Go in Anomaly Detection? From Tables to Pixels

Hyojun Yi; Geunyoung Kim; Hogeon Seo; Seunghyoung Ryu

cs.LGNov 5, 2026

How Far Can Untrained Neural Networks Go in Anomaly Detection? From Tables to Pixels

Authors: Hyojun Yi, Geunyoung Kim, Hogeon Seo, Seunghyoung Ryu

Organizations: Department of Artificial Intelligence and Robotics, Sejong University, Seoul, Republic of Korea · Applied AI Section, Korea Atomic Energy Research Institute, Daejeon, Republic of Korea

Abstract

Anomaly detection (AD) is often framed as a representation-learning problem, where strong performance is expected to require learned features or AD-specific optimization. However, this view can overlook the intrinsic separability of anomalies from normal references, even in the absence of learned representations. We therefore investigate how far untrained neural networks can go in anomaly detection. To this end, we propose PRISM, a framework combining fixed random nonlinear features with normal-reference Mahalanobis scoring for tabular detection and dense visual localization. Across 47 tabular datasets in ADBench, PRISM-T achieves the highest mean AUROC (86.4%) and the second-highest mean AUPRC (65.9%) among the compared methods. On MVTec AD and VisA, covering 27 visual categories, PRISM-V achieves mean image-level and pixel-level AUROCs of 90.4% and 96.4%, respectively. Notably, both models achieve these results without neural weight optimization or pretrained representations. A theoretical analysis further characterizes how nonlinear transformations affect the mean and covariance contributions to the Mahalanobis score gap, while empirical analyses examine the resulting score separability. These findings establish PRISM as both a competitive anomaly detector and a prior-to-learning baseline for assessing the added value of learned representations in anomaly detection.

Figures & tables

Fig. 1: PRISM framework. (a) Each PRISM block (PB) is randomly initialized once and kept fixed. (b) PRISM-T uses a single PB, and scores global Mahalanobis deviation from the closed-form reference statistics. (c) PRISM-V interleaves five PBs with BlurPool downsampling, aligns and concatenates PBs 2–5, and produces a dense anomaly map.

Setting	PRISM-T	PRISM-V
Linear operator	Fully connected	Convolution
Number of PBs	1	5
Feature dimension	512	512
Kernel size	-	[3,3,3,1,1]
Initialization	Uniform	He normal
Normalization	Instance + Batch	Instance

TABLE I: Architecture and configuration of PRISM-T and PRISM-V .

Method	Description	NN	Tr.	Sc.
Tabular baselines
KDE	Kernel density estimation of normal data.	–	–	LIK
AE	Autoencoder trained on normal data.	$\checkmark$	T	REC
OCSVM	Maximum-margin one-class decision boundary.	–	–	DIST
IForest	Random isolation trees with path-length scoring.	–	–	ISO
DSVDD	Distance to a learned hypersphere center.	$\checkmark$	T	DIST

TABLE II: Summary of the compared anomaly detection methods, neural network requirements, and scoring mechanisms.

	AUROC				AUPRC
Method	Mean	Std	$p_{\mathrm{H}}$	Top-2	Mean	Std	$p_{\mathrm{H}}$	Top-2
PRISM-T	86.4	$\pm$ 0.9	–	17	65.9	$\pm$ 2.5	–	12
KDE †	84.2	$\pm$ 0.7	.315	10	62.3	$\pm$ 2.5	1	9
AE	82.9	$\pm$ 1.2	$<$ .001	6	59.4	$\pm$ 3.5	.004	4
OCSVM †	79.6	$\pm$ 0.7	.002	6	55.0	$\pm$ 2.2	.003	3
IForest	79.8	$\pm$ 1.6	$<$ .001	5	49.3	$\pm$ 3.4	$<$ .001	4

TABLE III: Tabular AD results on ADBench datasets in AUROC and AUPRC (%).

Fig. 2: Per-dataset AUROC on ADBench. Cell values show AUROC (%), and colors indicate the gap from the best-performing method.

Fig. 3: Per-dataset AUPRC on ADBench. Cell values show AUPRC (%), and colors indicate the gap from the best-performing method.

Fig. 4: Critical-difference diagrams of average ranks on ADBench: (a) AUROC and (b) AUPRC. Numbers indicate average rank and mean score (%) of each method. Horizontal bars connect methods with no significant difference (Wilcoxon signed-rank test with Holm correction).

Fig. 5: Construction–inference efficiency on ADBench. Diamonds denote means and dots denote per-dataset runtimes; labels show average AUROC and parameter count. All deep learning baselines ran on GPU, and

p

denotes the average number of neural network parameters.

		MVTec AD									VisA
		Image-level				Pixel-level					Image-level				Pixel-level
Method	Parameters	AUROC		AUPRC		AUROC		AUPRO		PRR	AUROC		AUPRC		AUROC		AUPRO		PRR
PRISM-V	0.33 M	92.9	$\pm 0.2$	97.2	$\pm 0.1$	96.2	$\pm 0.1$	85.9	$\pm 0.2$	94.1	87.3	$\pm 0.1$	89.1	$\pm 0.1$	96.7	$\pm 0.0$	73.1	$\pm 0.3$	87.8
VAE	11.1 M	69.1	$\pm 0.6$	86.1	$\pm 0.4$	76.8	$\pm 0.6$	54.3	$\pm 0.5$	72.3	78.0	$\pm 2.1$	81.2	$\pm 1.6$	84.4	$\pm 0.4$	59.1	$\pm 0.8$	76.8
GANomaly	9.06 M	57.9	$\pm 3.3$	81.2	$\pm 1.5$	–		–		69.7	61.7	$\pm 4.2$	69.3	$\pm 3.3$	–		–		66.3
SPADE †	68.9 M	79.9		90.4		96.8		92.4		91.0	79.7		82.6		97.5		85.9		87.7

TABLE IV: Image-level AD and pixel-level anomaly localization on MVTec AD and VisA benchmarks.

Fig. 6: Per-category image-level detection performance on MVTec AD and VisA. Cell values show image AUROC (AUC) and AUPRC (AUP) (%), and colors indicate the gap from the best-performing method.

Fig. 7: Per-category pixel-level localization performance on MVTec AD and VisA. Cell values show pixel AUROC (AUC) and AUPRO (PRO) (%), and colors indicate the gap from the best-performing method.

Fig. 8: Critical-difference diagrams of average ranks across the 27 categories (MVTec AD and VisA combined) for each metric: (a) image-level AUROC, (b) image-level AUPRC, (c) pixel-level AUROC, and (d) AUPRO. Numbers indicate average rank and mean score (%) of each method. Horizontal bars connect methods with no significant difference (Wilcoxon signed-rank test with Holm correction).

Variant	AUC	AUP	$G$	I-AUC	P-AUC	PRO	$G_{img}/G_{pix}$
	Tabular			Visual
Raw	82.4	56.8	0.78	77.7	84.1	62.4	0.47/0.50
w/o Act.	83.2	59.3	0.77	87.9	95.0	75.4	0.58/0.71
PRISM	86.4	65.9	0.80	90.4	96.4	80.2	0.74 / 0.78

TABLE V: Effect of random transformation and nonlinear activation in PRISM .

(a) Feature map			(b) Scoring rule
Map	AUROC	AUPRC	Scorer	AUROC	AUPRC
Fourier	$85.9\pm 0.7$	$63.8\pm 2.5$	Euclidean	$78.6\pm 1.5$	$52.6\pm 3.0$
Maclaurin	$84.4\pm 0.7$	$61.1\pm 2.5$	IForest	$81.1\pm 2.3$	$52.4\pm 4.8$
ReLU	$\underline{86.0}\pm 0.7$	$\underline{64.5}\pm 2.4$	$k$ NN	$\underline{85.4}\pm 0.9$	$\underline{63.9}\pm 2.7$
PRISM	$\mathbf{86.4}\pm 0.9$	$\mathbf{65.9}\pm 2.5$	Mahal.	$\mathbf{86.4}\pm 0.9$	$\mathbf{65.9}\pm 2.5$

TABLE VI: Comparison of feature maps and scoring rules on ADBench datasets.

	Mean (median)			Increase count
Quantity	Raw	w/o Act.	PRISM	vs. Raw	vs. w/o Act.
$G$	0.78 (0.39)	0.77 (0.36)	0.80 (0.45)	34	35
$G^{\mathrm{cov}}$	0.24 (0.18)	0.28 (0.20)	0.49 (0.34)	40	39
$G^{\mathrm{mean}}$	0.55 (0.15)	0.49 (0.09)	0.31 (0.11)	19	25
$\Delta$	46.88 (0.06)	114.82 (0.42)	91.50 (4.11)	41	36
$\Delta^{\mathrm{cov}}$	45.18 (0.04)	110.56 (0.21)	60.58 (3.12)	38	35

TABLE VII: Decomposition of score-level separability on ADBench datasets.

Fig. 9: Score-level separability across 47 ADBench datasets. Crosses and circles indicate w/o Act. and PRISM-T , respectively; arrows show changes induced by nonlinear activation. The dashed line denotes

G_{r}=G_{o}

Fig. 10: Changes in separability and detection performance relative to Raw on 47 datasets: (a) AUROC and (b) AUPRC. Large markers and ellipses indicate the mean and

\pm

one standard deviation across datasets, excluding http due to its outlying

\Delta G

Method	Backbone	I-AUROC	AUPRO
PRISM-V	Proposed Backbone	$\mathbf{90.4}\pm 0.1$	$\mathbf{80.2}\pm 0.1$
SPADE	WRN-50-2	$60.8\pm 0.7$	$52.0\pm 1.0$
PaDiM		$\underline{79.5}\pm 0.1$	$55.5\pm 0.5$
PatchCore		$76.6\pm 1.5$	$51.3\pm 1.2$
WinCLIP+	V: CLIP ViT-B/16+ L: CLIP Transformer	$73.0\pm 0.9$	$43.5\pm 4.5$
AnomalyDINO	DINOv2 ViT-S/14	$77.3\pm 0.4$	$\underline{60.2}\pm 0.6$

TABLE VIII: Comparison with randomly initialized baselines.

Scorer	I-AUROC	I-AUPRC	P-AUROC	AUPRO
Euclidean	$71.2\pm 0.3$	$81.0\pm 0.3$	$89.0\pm 0.1$	$59.9\pm 0.4$
IForest	$79.3\pm 0.2$	$85.9\pm 0.1$	$89.4\pm 0.2$	$58.0\pm 0.2$
$k$ NN	$\underline{81.2}\pm 0.3$	$\underline{88.0}\pm 0.2$	$\underline{94.2}\pm 0.1$	$\underline{74.5}\pm 0.2$
Mahalanobis	$\mathbf{90.4}\pm 0.1$	$\mathbf{93.6}\pm 0.0$	$\mathbf{96.4}\pm 0.0$	$\mathbf{80.2}\pm 0.1$

TABLE IX: Comparison of scoring rules for PRISM-V.

Quantity	Raw	w/o Act.	PRISM-V	vs. Raw	vs. w/o Act.
	Mean (median)			Increase count
$G_{\mathrm{img}}$	0.47 (0.44)	0.58 (0.52)	0.74 (0.63)	22	22
$G_{\mathrm{pix}}$	0.50 (0.48)	0.71 (0.69)	0.78 (0.77)	22	16
$\Delta_{\mathrm{img}}$	0.05 (0.02)	2.26 (1.44)	6.63 (3.51)	27	26
$\Delta_{\mathrm{pix}}$	0.04 (0.01)	1.79 (1.13)	4.68 (2.40)	27	25
$\sqrt{V_{\mathrm{img}}}$	0.14 (0.06)	3.70 (2.56)	8.23 (5.51)	27	24

TABLE X: Score-level separability of PRISM-V on MVTec AD and VisA.

Fig. 11: Score-level separability across 27 categories of MVTec AD and VisA. Crosses and circles indicate w/o Act. and PRISM-V , respectively; arrows show changes induced by nonlinear activation. The dashed line denotes

G_{r}=G_{o}

Fig. 12: Changes in separability and detection performance relative to Raw on the 27 categories of MVTec AD and VisA: (a) image-level AUROC versus

\Delta G_{\mathrm{img}}

and (b) AUPRO versus

\Delta G_{\mathrm{pix}}

. Large markers and ellipses indicate the mean and

\pm

one standard deviation over the 27 categories, and the arrow connects the two means.

Panel of Figure 23 — Fig. 13: Illustrative comparison of anomaly localization using PRISM-V , PaDiM, and SubspaceAD. Examples from the five highest- and lowest-performing categories ranked by PRISM-V ’s AUPRO. GT denotes ground-truth anomaly regions. For each sample, values in the upper-left and upper-right corners indicate pixel AUROC and AUPRO (%), respectively.

Tabular			Visual
	AUROC	AUPRC		I-AUROC	AUPRO
Base	$86.2_{(-)}$	$64.4_{(-)}$	Base	$82.0_{(-)}$	$69.5_{(-)}$
+IN	$80.5_{(-5.7)}$	$54.4_{(-10)}$	+IN	$83.3_{(+1.3)}$	$72.4_{(+2.9)}$
+BN	$86.1_{(-0.1)}$	$64.2_{(-0.2)}$	+BP	$83.8_{(+1.8)}$	$75.8_{(+6.3)}$
+IBN	$\textbf{86.4}_{(+0.2)}$	$\textbf{65.9}_{(+1.5)}$	+Full	$\textbf{90.4}_{(+8.4)}$	$\textbf{80.2}_{(+10.7)}$

TABLE XI: Modality-specific component ablations for PRISM .

PRISM-T
Factor	Configuration	AUROC	AUPRC
Width	$128$	85.61	62.83
	$256$	86.01	64.83
	$512^{*}$	86.40	65.90
	$1024$	86.60	66.64
Depth	$1^{*}$	86.40	65.90

TABLE XII: Ablations of feature extractor configurations in PRISM .

Anomaly Detection

Anomaly detection finds rare or unexpected patterns in data, from defective products and system faults to fraud and security threats.

See all 689 papers

Adapting prior-data fitted networks for tabular anomaly detection
Oct 5, 2026Maximilian Bershtman, Niv CohenTabular Anomaly Detection Unsupervised Anomaly Detection
Faculty of Electrical and Computer Engineering Technion – Israel Institute of Technology Haifa, Israel
Can We Predict Anomaly Detection Performance from Embedding-Space Geometry?
Sep 22, 2026Kevin Wilkinghoff, Zheng-Hua TanUnsupervised Anomaly Detection Anomaly Detection
Department of Electronic Systems, Aalborg University, Denmark · Pioneer Centre for Artificial Intelligence, Denmark
Beyond Normal References: Discriminative Few-Shot Anomaly Detection
May 22, 2026Huan Wang, Jun Shen, Jun Yan +1Few-Shot Anomaly Detection Few-Shot Learning
Singapore Management University, Singapore · University of Wollongong, Australia

Oct 5, 2026J/K move · Enter open · S save

Adapting prior-data fitted networks for tabular anomaly detection

Maximilian Bershtman, Niv Cohen

Faculty of Electrical and Computer Engineering Technion – Israel Institute of Technology Haifa, Israel

Tabular Anomaly Detection Unsupervised Anomaly Detection Tabular Representation Learning Prior-Data Fitted Networks Anomaly Detection

Open paper AskPDF arXiv

While deep features have transformed anomaly detection in images and video, their impact on tabular data has been less substantial, partly due to the limited availability of strong deep representations. Recently, prior-data fitted networks (PFNs) have emerged as a promising source of such representations for tabular data. In this work, we investigate how PFN representations can be adapted and leveraged for anomaly detection. The question is harder than it looks. No anomalies are available before deploy- ment, so model parameters cannot be tuned with supervision, and the reference set that defines normal behavior may itself contain the very anomalies it is supposed to reveal. We begin our study using frozen TabPFN features. Scoring each sam- ple by its distance to its nearest neighbors in feature space already gives strong results. We identify which layers to use and a feature-extraction procedure suited to the task. Next, to further improve performance, we use the reference set to fine- tune the model, so that the resulting features better separate normal samples from anomalies. On the ADBench benchmark, our fine-tuning free approach (ZEN) reaches a higher mean AUROC than every baseline, and our fine-tuned method (FOCUS) improves on it further. Our approach also generalizes across PFN models.

Abstract

Anomaly Detection

Explore similar work

Adapting prior-data fitted networks for tabular anomaly detection

Can We Predict Anomaly Detection Performance from Embedding-Space Geometry?

Beyond Normal References: Discriminative Few-Shot Anomaly Detection