ShiftSplit-AD: Separating Domain Shift from Defects in Foundation-Feature Visual Anomaly Detection

MUHAMATHU AMEER ALI AACAAS MUHAMATH Affiliation: Department of Electrical Engineering Affiliation: University of Moratuwa Affiliation: Moratuwa, Sri Lanka Email: muhamathmaaa.23@uom.lk

Abstract

Visual anomaly detectors based on frozen foundation-model features commonly score distances from test patches to a memory of normal features. Benign acquisition changes can also enlarge these distances, confounding domain variation with defects. We investigate whether structured decomposition of nearest-normal DINOv2 residuals can suppress shift-induced evidence while retaining unseen defects. ShiftSplit-AD decomposes the patch residual matrix into low-rank and row-sparse components and scores the sparse component, with an optional low-rank/sparse fusion. The experiments expose a central trade-off rather than a universal separation: genuine defects can contain correlated, low-dimensional structure, so filtering broad residual activity may also remove defect information. On AeBAD-S, using settings fixed after Bottle development, sparse-only scoring improves image AUROC from 0.6780 to 0.7294 and AUPRC from 0.8052 to 0.8465. Paired bootstrap 95% intervals for the improvements are [0.0238, 0.0808] and [0.0170, 0.0650], respectively. However, sparse-only scoring reduces mean clean AUROC from 0.9890 to 0.9133 on four held-out MVTec categories and degrades Bottle localization. These findings show that residual decomposition can help when domain shift strongly contaminates anomaly evidence, but preserving defect structure remains the limiting problem.

1 Introduction

Industrial visual anomaly detection is commonly posed as a one-class problem: normal images are available for training, whereas the appearance of future defects is unknown. Feature-memory methods address this setting by extracting pretrained patch representations and measuring the distance from each test patch to a bank of normal features. Such systems are simple and effective on established benchmarks such as MVTec AD [1], and memory-based designs including SPADE [5] and PatchCore [12] demonstrate the strength of local pretrained features.

Distance from normality, however, does not identify the cause of that distance. Illumination, viewpoint, background, blur, and sensor noise can move a normal image away from the training distribution. A nearest-normal detector may therefore produce a large residual for a harmless acquisition change. This ambiguity matters in deployment because the operating domain need not reproduce the conditions under which the normal memory was collected. AeBAD was introduced specifically to expose this issue for aero-engine blade inspection, with changes in illumination, view, alignment, and scale between training and testing [13].

We study this problem directly in frozen foundation-feature space. DINOv2 provides general visual features without task-specific fine-tuning [11]. For each test patch, we subtract its nearest normal-memory feature and stack the residuals into a matrix. The central question is whether the structure of that matrix can help distinguish broad domain variation from localized defect evidence.

We study ShiftSplit-AD, a lightweight post-processing step that approximates the residual matrix by low-rank and row-sparse components. Low-rank/sparse decomposition itself is classical [2], and anomaly detection under distribution shift is an established research problem [3, 4, 13]. The specific contribution examined here is the use of per-test-image nearest-normal foundation-feature residual structure to study shift suppression versus defect preservation. Sparsity acts on spatial rows rather than individual entries. The initial intuition is that correlated, spatially broad residual activity may be absorbed into the low-rank term, while concentrated activity remains in the row-sparse term.

The experiments do not support the simplistic identity “domain shift equals low rank, defects equal sparse.” Real defects also contain correlated structure, and removing it can lower detection and localization quality. Instead, the results reveal a trade-off between suppressing shift-induced residual activity and preserving defect information. Sparse-only scoring strongly improves Bottle under synthetic Gaussian noise and improves AeBAD-S overall, but it loses accuracy on held-out MVTec categories whose raw residual detector is already strong. A fusion of low-rank and sparse scores recovers much of this loss without becoming universally superior.

Our contributions are threefold. First, we instantiate and empirically study per-test-image low-rank/row-sparse decomposition of frozen DINO nearest-normal patch residuals, rather than claiming novelty for decomposition or shift-aware anomaly detection in general. Second, we evaluate the method using a transparent development/held-out protocol: Bottle informs the fixed decomposition, top-5 aggregation, and fusion weight; four other MVTec categories and AeBAD-S are subsequently evaluated without retuning these settings. Third, we report positive and negative evidence together, including paired bootstrap uncertainty on AeBAD-S, a defect-type failure on breakdown, and substantial localization degradation. The resulting claim is deliberately conditional: structured residual filtering can help when domain variation contaminates raw anomaly evidence, but its usefulness depends on whether removed structure is nuisance or defect signal.

2 Related Work

Industrial visual anomaly detection.

MVTec AD established a diverse benchmark with normal-only training data, anomalous test images, and pixel-level masks [1]. Many high-performing methods build on pretrained representations. SPADE retrieves similar normal images and uses deep pyramid correspondences for localization [5]. PaDiM models a multivariate Gaussian distribution of pretrained features at each spatial location [6]. PatchCore stores locally aware normal patch features and reduces memory through coreset selection [12]. Our raw baseline belongs to this broad memory-based family but uses frozen DINOv2 patch features and exact nearest-neighbor residuals. The repository also contains a PatchCore-style DINO coreset comparison; because it changes the backbone and does not reproduce all canonical PatchCore components, we do not label it as canonical PatchCore.

Foundation features for anomaly detection.

DINOv2 learns general-purpose visual representations through large-scale self-supervised training [11]. Its patch tokens provide a spatial representation suitable for correspondence and anomaly maps. Vision-language models provide another route to general anomaly recognition; for example, WinCLIP adapts CLIP to zero- and few-shot anomaly classification and segmentation through prompt ensembles and window features [9]. ShiftSplit-AD is narrower: it does not use language or learn a task-specific model. It tests whether the residual geometry of one frozen visual foundation model can be reweighted after nearest-normal retrieval.

Domain shift.

Standard anomaly benchmarks emphasize category and defect diversity, while deployment may also change the distribution of normal data. ADShift formalizes anomaly detection under distribution shift and reduces gaps between in-distribution and shifted normal features during training and inference [3]. Invariant Anomaly Detection uses causal reasoning to derive a regularizer that learns partial distribution invariance across environments [4]. AeBAD explicitly introduces real acquisition shift for aero-engine blades and attributes major changes to view and illumination, together with scale and alignment variation [13].

ShiftSplit-AD differs from these approaches in intervention point and supervision. ADShift performs distribution alignment, whereas ShiftSplit-AD leaves the frozen representation and normal memory unchanged and decomposes each test image’s nearest-normal residual matrix. Invariant Anomaly Detection learns partially invariant representations through regularization, whereas ShiftSplit-AD is post-hoc and training-free after memory construction. We use AeBAD-S as the principal real-shift evaluation rather than treating synthetic corruptions as a substitute. Controlled brightness, contrast, blur, and noise remain diagnostics of false-positive evidence, not models of the full acquisition domain.

Subspace and residual methods.

Recent training-free work makes the relationship between foundation features and subspaces especially relevant. SubspaceAD fits a PCA model to patch features from a few normal DINOv2 images and scores reconstruction residuals from that learned normal subspace [10]. By contrast, ShiftSplit-AD first performs nearest-neighbor matching to a potentially large normal memory and then decomposes the $256\times 384$ residual matrix of each individual test image; its low-rank component is test-conditioned rather than a PCA model of normal training features.

SPARC uses up to eight verified-normal images from the incoming target lot to estimate spatially indexed nuisance subspaces and projects them out before a frozen detector [8]. ShiftSplit-AD assumes no target-normal calibration images: it estimates structure independently within each test residual matrix. SPARC is therefore a few-shot deployment-calibration method, while ShiftSplit-AD studies target-free, query-specific decomposition.

Anomaly-Related Residual Fields studies residual evolution in diffusion models and combines a source-calibrated extractor with cross-domain field alignment [7]. Its residuals, dynamics, and transfer setting differ from the static DINO nearest-neighbor patch residuals used here. ShiftSplit-AD neither follows diffusion trajectories nor aligns source and target fields; it asks whether one test image’s frozen-feature residual geometry supports useful reweighting.

Low-rank and sparse decomposition.

Principal Component Pursuit decomposes a matrix into low-rank and entry-sparse terms under assumptions that enable exact recovery [2]. Our use is heuristic and does not inherit those guarantees. Residual rows correspond to spatial patches, so we employ an $\ell_{2,1}$ row-group penalty rather than entrywise $\ell_{1}$ sparsity. More importantly, neither component has a known semantic identity. The decomposition is used to probe and reweight residual structure, not to assert a generative law equating low rank with domain shift.

3 Method

3.1 Frozen Patch Features and Normal Memory

Let a frozen DINOv2-small encoder map an image to $P=256$ patch embeddings $\{\mathbf{z}_{i}\}_{i=1}^{P}$ , arranged on a $16\times 16$ grid. Each embedding has dimension $D=384$ . All patch embeddings from normal training images form a memory bank $\mathcal{M}\subset\mathbb{R}^{D}$ . No anomalous test image enters this memory.

For a test patch, exact Euclidean nearest-neighbor matching gives

\mathbf{m}_{i}^{*}=\arg\min_{\mathbf{m}\in\mathcal{M}}\lVert\mathbf{z}_{i}-\mathbf{m}\rVert_{2}.

(1)

The residual and raw patch anomaly score are

\mathbf{r}_{i}=\mathbf{z}_{i}-\mathbf{m}_{i}^{*},\qquad a_{i}^{R}=\lVert\mathbf{r}_{i}\rVert_{2}.

(2)

Stacking rows yields $\mathbf{R}=[\mathbf{r}_{1}^{\top};\ldots;\mathbf{r}_{P}^{\top}]\in\mathbb{R}^{P\times D}$ .

3.2 ShiftSplit Decomposition

Using a classical low-rank/sparse regularization pattern [2], we seek an approximate per-test-image decomposition $\mathbf{R}\approx\mathbf{L}+\mathbf{S}$ through

\min_{\mathbf{L},\mathbf{S}}\ \frac{1}{2}\lVert\mathbf{R}-\mathbf{L}-\mathbf{S}\rVert_{F}^{2}+\lambda_{L}\lVert\mathbf{L}\rVert_{*}+\lambda_{S}\sum_{i=1}^{P}\lVert\mathbf{S}_{i}\rVert_{2}.

(3)

The nuclear norm encourages correlated residual structure to concentrate in a low-dimensional subspace. The row-group penalty encourages only a subset of spatial patches to remain active in $\mathbf{S}$ .

Starting from zeros, the implementation alternates for a fixed number of iterations:

	$\displaystyle\mathbf{L}$	$\displaystyle\leftarrow\operatorname{SVT}_{\lambda_{L}}(\mathbf{R}-\mathbf{S}),$		(4)
	$\displaystyle\mathbf{S}_{i}$	$\displaystyle\leftarrow\left(1-\frac{\lambda_{S}}{\lVert(\mathbf{R}-\mathbf{L})_{i}\rVert_{2}}\right)_{+}(\mathbf{R}-\mathbf{L})_{i}.$		(5)

$\operatorname{SVT}$ soft-thresholds singular values. The second update is group soft thresholding. The remaining reconstruction component is $\mathbf{E}=\mathbf{R}-\mathbf{L}-\mathbf{S}$ . We use $\lambda_{L}=10$ , $\lambda_{S}=8$ , and 20 iterations throughout the locked evaluations.

3.3 Scoring and Fusion

Sparse-only patch scores are $a_{i}^{S}=\lVert\mathbf{S}_{i}\rVert_{2}$ . We also study a patch-level fusion

a_{i}(\alpha)=\alpha\lVert\mathbf{S}_{i}\rVert_{2}+(1-\alpha)\lVert\mathbf{L}_{i}\rVert_{2}.

(6)

The image score for all final experiments is the mean of the five largest patch scores. Bottle experiments motivated top-5 aggregation and selected $\alpha=0.75$ as a development choice. This weight is fixed for the four held-out MVTec categories and AeBAD-S; it is not claimed to be universally optimal.

Figure 1: ShiftSplit-AD pipeline. Frozen patch features are matched to a normal-only memory. The resulting residual matrix is decomposed and reweighted before top-5 image aggregation. The decomposition components are structural variables, not guaranteed semantic labels for shift and defect.

4 Experimental Setup

4.1 Development and Evaluation Protocol

Protocol transparency is essential because several design choices arose during exploration. MVTec Bottle is the development and diagnostic category. The thresholds $\lambda_{L}=10$ and $\lambda_{S}=8$ arose from a Bottle residual study; top-5 image aggregation was motivated by a Bottle scoring ablation; and fusion weight $\alpha=0.75$ was selected on Bottle. Bottle test labels therefore informed development, and Bottle results are not presented as untouched generalization.

After these choices, Cable, Hazelnut, Metal Nut, and Wood are treated as held-out MVTec categories for the fusion experiment. AeBAD-S is subsequently evaluated with the same decomposition, aggregation, and fusion settings and without AeBAD-specific retuning. This sequence supports transfer-oriented evidence, but it is not equivalent to a preregistered benchmark evaluation.

4.2 Datasets

MVTec AD [1] provides normal-only training images and test images with pixel masks for 15 object and texture categories. The completed multi-category experiments use Bottle, Cable, Hazelnut, Metal Nut, and Wood. For the controlled shift protocol, only normal test images are transformed while defects remain clean, isolating false-positive pressure. The symmetric protocol transforms both classes.

AeBAD-S [13] is the real-domain-shift benchmark. The executed protocol uses 521 normal training images to build a $133{,}376\times 384$ patch memory. The test set contains 1,639 images: 490 normal and 1,149 anomalous, divided into ablation (169), breakdown (329), fracture (389), and groove (262). These counts are verified from the saved per-image prediction file.

4.3 Shifts, Baselines, and Metrics

Synthetic diagnostics apply brightness and contrast factors, Gaussian blur, and pixelwise Gaussian noise. The main Bottle comparison uses noise standard deviation 20. A severity sweep and eight noise seeds probe stability. The raw baseline is exact DINOv2-small nearest-normal patch matching. The S-only method uses $\lVert\mathbf{S}_{i}\rVert_{2}$ , and fusion combines $\mathbf{L}$ and $\mathbf{S}$ with $\alpha=0.75$ . A PatchCore-style DINO coreset baseline is included only as a diagnostic implementation; it should not be interpreted as a canonical reproduction of PatchCore [12].

Image-level performance is measured by AUROC and, for AeBAD-S, AUPRC. Localization uses pixel AUROC and AUPRC after bilinear upsampling from the $16\times 16$ patch grid. AeBAD marginal confidence intervals use 2,000 nonparametric bootstrap resamples. Direct comparisons use 5,000 paired bootstrap resamples, with the same resampled image indices applied to both methods. We report the empirical distribution of paired differences and avoid interpreting an empirical zero tail count as a literal probability of zero.

5 Results

5.1 Real Domain Shift on AeBAD-S

Table 1: AeBAD-S image-level results. Confidence intervals are percentile bootstrap intervals over 2,000 valid resamples.

Method	AUROC	AUPRC
Raw residual	0.6780	0.8052
Fusion ( $\alpha=0.75$ )	0.7084	0.8253
S-only ShiftSplit-AD	0.7294	0.8465

Table 1 gives the principal real-shift result. S-only ShiftSplit-AD raises AUROC by 0.0514 and AUPRC by 0.0412 over raw residual scoring. Its marginal 95% bootstrap intervals are [0.7034, 0.7556] for AUROC and [0.8240, 0.8686] for AUPRC, compared with [0.6493, 0.7064] and [0.7792, 0.8328] for raw scoring.

The paired bootstrap is more directly relevant to improvement. For S-only minus raw, the AUROC difference is 0.0514 with a 95% interval of [0.0238, 0.0808]; the AUPRC difference is 0.0412 with [0.0170, 0.0650]. Every one of 5,000 saved AUROC resamples had a positive difference, while 99.94% of AUPRC resamples were positive. These are empirical bootstrap frequencies, not proof that the population probability of non-improvement is zero.

Figure 2: AeBAD-S image AUROC with marginal 95% bootstrap intervals. Both decomposition scores improve over raw residual ranking, with S-only highest.

Table 2: AeBAD-S defect-type results. Each defect type is ranked against the same 490 normal test images. S-only helps three types but harms breakdown.

	AUROC		AUPRC
Defect	Raw	S-only	Raw	S-only
Ablation	0.5356	0.6610	0.2497	0.3776
Breakdown	0.8894	0.7796	0.7931	0.6803
Fracture	0.5914	0.7110	0.4695	0.6385
Groove	0.6329	0.7379	0.4088	0.5838

The aggregate gain is heterogeneous (Table 2). S-only improves both metrics for ablation, fracture, and groove, but breakdown AUROC falls from 0.8894 to 0.7796 and AUPRC from 0.7931 to 0.6803. Fusion is also below raw on breakdown. Thus, the overall improvement does not justify a universal claim across defect morphologies.

Figure 3: AeBAD-S image AUROC by defect type. Breakdown is the central negative case: residual structure useful to the raw detector is suppressed by decomposition.

5.2 Held-Out MVTec Categories

Table 3: Mean image AUROC over four held-out MVTec categories after choosing

\alpha=0.75

on Bottle. Noise uses Gaussian standard deviation 20.

Method	Clean	Noise
Raw residual	0.9890	0.9877
S-only ShiftSplit-AD	0.9133	0.8931
Fusion ( $\alpha=0.75$ )	0.9740	0.9626

The held-out MVTec results reverse the AeBAD ordering (Table 3). Raw DINO residuals are already near ceiling under clean and noise-20 conditions. S-only filtering removes useful evidence, reducing the four-category mean by 0.0757 clean and 0.0946 under noise. Fusion recovers much of this loss, reaching 0.9740 and 0.9626, but remains below raw on average. Wood clean is the only category/condition in which fusion exceeds raw (0.9939 versus 0.9833).

Figure 4: Held-out MVTec image AUROC after Bottle selection of

\alpha=0.75

. Left: clean. Right: Gaussian noise with standard deviation 20. Fusion consistently retains more defect evidence than S-only, but raw scoring remains strongest in seven of eight category/condition comparisons.

Across all five evaluated MVTec categories, including Bottle, mean clean AUROC is 0.9912 raw versus 0.9272 S-only. Mean noise AUROC is 0.9386 raw versus 0.9118 S-only. Bottle is the exception driving the apparent synthetic-shift benefit: under top-5 noise-20 scoring, it improves from 0.7421 to 0.9865.

5.3 Bottle Diagnostics and Ablations

Table 4: Bottle development ablations using top-5 scoring. Localization values are means of the 63 per-image metrics saved in the result CSV.

Experiment / method	Raw	S-only
Clean image AUROC	1.0000	0.9825
Noise-20 image AUROC	0.7421	0.9865
Pixel AUROC (mean)	0.9815	0.8964
Pixel AUPRC (mean)	0.7357	0.3951

Component ablation supports the trade-off interpretation. On Bottle, raw $\mathbf{R}$ and low-rank $\mathbf{L}$ both achieve 1.0000 clean AUROC, while $\mathbf{S}$ reaches 0.9825 and the remainder $\mathbf{E}$ 0.5325. Under noise-20, $\mathbf{S}$ reaches 0.9865, compared with 0.7421 for $\mathbf{R}$ , 0.6325 for $\mathbf{L}$ , and 0.5079 for $\mathbf{E}$ . The useful defect signal is therefore not confined to $\mathbf{S}$ , even though $\mathbf{S}$ is most robust in this corruption.

Noise-seed results show that Bottle improvement is not attributable to one draw. Across eight seeds, at standard deviations 10, 20, and 30, raw mean AUROC is 0.5862, 0.6452, and 0.5875, whereas S-only reaches 0.9522, 0.9576, and 0.9472. In the symmetric noise-20 protocol, which shifts both normal and defective images, raw/S-only AUROC is 0.7262/0.9198. Under controlled noise-20, a threshold calibrated to 5% clean-normal false-positive rate produces a raw false-positive rate of 1.00 and S-only rate of 0.05. These Bottle diagnostics explain why sparse filtering helps: noise broadly elevates raw evidence on normal images.

The same filtering harms localization. The per-image CSV averages over 63 Bottle defects give pixel AUROC 0.9815 raw versus 0.8964 S-only, and pixel AUPRC 0.7357 versus 0.3951. The result is consistent with defect residuals being partly assigned to $\mathbf{L}$ .

Refer to caption — Figure 5: Bottle development visualization for a clean normal, noisy normal, and real defect. Noise creates broad raw activity that is largely absorbed outside $\mathbf{S}$ . The defect also has substantial low-rank structure, illustrating why S-only scoring can lose detection and localization information. This figure is diagnostic rather than evidence of a universal component semantics.

6 Discussion

Low rank is not a domain label.

Dataset diagnostics show that 90% of residual spectral energy requires on average 67.55 singular components for clean Bottle normals, 48.10 for noisy normals, and 42.92 for real defects. Defects are at least as spectrally concentrated as the synthetic shift under this diagnostic. Consequently, singular-value concentration alone cannot distinguish shift from defect, and the components should not be assigned fixed semantics.

Spatial breadth is useful but conditional.

The number of patches required for 80% of residual energy averages 158.5 for clean normals, 173.9 for noisy normals, and 142.4 for defects. Noise is spatially broader in this development setting. Row shrinkage exploits that distinction and explains the large Bottle noise gain. But this is a tendency, not an invariant: large defects can be broad, and local glare or reflection can be spatially sparse.

Suppression versus preservation.

The method’s behavior is best understood as reweighting. S-only scoring suppresses broad correlated evidence aggressively. This helps on AeBAD-S overall and on three defect groups, suggesting that domain-induced residual structure interferes with ranking there. It hurts held-out MVTec and AeBAD breakdown, where the raw representation already separates classes or where the removed component contains useful defect information. Fusion moves toward a compromise: it consistently improves over S-only on held-out MVTec averages, yet retains less shift suppression than S-only on AeBAD-S.

What the bootstrap establishes.

The paired intervals indicate that the observed AeBAD-S aggregate improvement is stable to resampling this test set. They do not establish universality across future domains, defect mixtures, or alternative development choices. Defect-type decomposition is particularly important because a positive aggregate difference coexists with a large negative difference for breakdown.

Practical implication.

Residual decomposition may be most useful as a robustness control when normal validation data reveals domain-induced false positives. Deploying S-only scoring by default is not supported. A safer future system could adapt the mixture of raw, low-rank, and sparse evidence using normal calibration data or an explicit estimate of shift severity, without consulting anomalous evaluation labels.

7 Limitations

The study uses one frozen backbone, DINOv2-small, so the findings may depend on its representation and preprocessing. The five MVTec categories do not cover the full benchmark, and Bottle was heavily used during development. The held-out labels were not used to choose $\alpha$ , but the overall research process is exploratory rather than preregistered.

The decomposition parameters are fixed and manually motivated. They do not adapt to category, domain, defect scale, or memory quality. The alternating proximal procedure also leaves nonzero reconstruction error, and no theoretical recovery guarantee applies to these feature residuals.

AeBAD-S supplies real domain variation, but it represents one component family and one data collection setting. More real-shift datasets are needed. The AeBAD analysis is image-level; a corresponding real-shift localization study is not reported.

Localization on Bottle degrades substantially under S-only scoring. The $16\times 16$ patch grid and bilinear upsampling already limit boundary precision, while the decomposition removes correlated defect structure. Large/global defects, sparse reflections, dense sensor noise, and viewpoint changes may violate the working spatial intuition in different ways.

The normal memory uses exact patch retrieval and can be expensive. Chunked distance computation controls peak memory but not asymptotic work. Global nearest-neighbor patch retrieval does not enforce spatial correspondence, so a test patch may match a normal patch from a different object location; this may increase tolerance to pose variation but can also suppress spatially meaningful anomalies.

The study focuses on mechanism analysis rather than broad state-of-the-art comparison; several recent distribution-shift and subspace-based methods are discussed but not reproduced under the same protocol. Finally, the PatchCore-style DINO coreset baseline in the repository is useful diagnostically but is not a canonical PatchCore reproduction and is therefore not used to make broad comparative claims.

8 Conclusion

We investigated whether structured decomposition of frozen nearest-normal patch residuals can reduce domain-shift-induced anomaly evidence. ShiftSplit-AD separates a residual matrix into low-rank and row-sparse components and scores the sparse component or a low-rank/sparse fusion. The results reject a simple semantic split between shift and defect. Instead, they expose a trade-off: aggressive sparse scoring can suppress broad nuisance activity, but it can also discard correlated defect information.

With Bottle-derived settings fixed, S-only scoring improves AeBAD-S AUROC from 0.6780 to 0.7294 and AUPRC from 0.8052 to 0.8465, with positive paired bootstrap intervals. At the same time, it underperforms raw scoring on held-out MVTec averages, hurts AeBAD breakdown, and degrades Bottle localization. The appropriate conclusion is therefore conditional rather than universal. Structured residual filtering is promising when domain variation strongly contaminates raw residuals; reliable deployment will require a principled mechanism for balancing shift suppression against defect preservation.

References

[1] P. Bergmann, M. Fauser, D. Sattlegger, and C. Steger (2019) MVTec AD—a comprehensive real-world dataset for unsupervised anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9592–9600. Cited by: §1, §2, §4.2.
[2] E. J. Candès, X. Li, Y. Ma, and J. Wright (2011) Robust principal component analysis?. Journal of the ACM 58 (3), pp. 11:1–11:37. External Links: Document Cited by: §1, §2, §3.2.
[3] T. Cao, J. Zhu, and G. Pang (2023) Anomaly detection under distribution shift. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 6511–6523. Cited by: §1, §2.
[4] J. B. S. Carvalho, M. Zhang, R. Geyer, C. Cotrini, and J. M. Buhmann (2023) Invariant anomaly detection under distribution shifts: a causal perspective. In Advances in Neural Information Processing Systems, Vol. 36. External Links: Link Cited by: §1, §2.
[5] N. Cohen and Y. Hoshen (2020) Sub-image anomaly detection with deep pyramid correspondences. External Links: 2005.02357 Cited by: §1, §2.
[6] T. Defard, A. Setkov, A. Loesch, and R. Audigier (2020) PaDiM: a patch distribution modeling framework for anomaly detection and localization. In Pattern Recognition. ICPR International Workshops and Challenges, pp. 475–489. External Links: Document Cited by: §2.
[7] K. Gao, J. Xie, Z. Shen, W. Qin, L. Jia, K. Chen, Z. Feng, and Y. Bei (2026) Anomaly-related residual fields for cross-domain anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 35617–35627. Cited by: §2.
[8] S. Han, S. Chu, M. Nowak, and P. Chin (2026) SPARC: subspace position-aware robust few-shot calibration for distribution-shifted industrial anomaly detection. External Links: 2608.18585 Cited by: §2.
[9] J. Jeong, Y. Zou, T. Kim, D. Zhang, A. Ravichandran, and O. Dabeer (2023) WinCLIP: zero-/few-shot anomaly classification and segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 19606–19616. Cited by: §2.
[10] C. Lendering, E. Akdag, and E. Bondarev (2026) SubspaceAD: training-free few-shot anomaly detection via subspace modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 28557–28566. Cited by: §2.
[11] M. Oquab, T. Darcet, T. Moutakanni, H. V. Vo, M. Szafraniec, V. Khalidov, P. Fernandez, D. Haziza, F. Massa, A. El-Nouby, M. Assran, N. Ballas, W. Galuba, R. Howes, P. Huang, S. Li, I. Misra, M. Rabbat, V. Sharma, G. Synnaeve, H. Xu, H. Jégou, J. Mairal, P. Labatut, A. Joulin, and P. Bojanowski (2024) DINOv2: learning robust visual features without supervision. Transactions on Machine Learning Research. Cited by: §1, §2.
[12] K. Roth, L. Pemula, J. Zepeda, B. Schölkopf, T. Brox, and P. Gehler (2022) Towards total recall in industrial anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14318–14328. Cited by: §1, §2, §4.3.
[13] Z. Zhang, Z. Zhao, X. Zhang, C. Sun, and X. Chen (2023) Industrial anomaly detection with domain shift: a real-world dataset and masked multi-scale reconstruction. Computers in Industry 151, pp. 103990. External Links: Document Cited by: §1, §1, §2, §4.2.