DART: Domain-Agnostic Residual Transfer for Generalist Anomaly Detection

DART: Domain-Agnostic Residual Transfer for Generalist Anomaly Detection

arXiv:2611.08271v1 [cs.CV] 5 Nov 2026

Muhammad Aqeel1,∗ Maham Nazir2,∗ Marco Cristani1,3 1 University of Verona 2 Beihang University 3 Reykjavik University

Francesco Setti1

Abstract Generalist Anomaly Detection (GAD) aims to detect anomalies in unseen domains using only a few reference samples. Recent normal-abnormal guided methods improve this setting by exploiting abnormal references, but their residuals often mix transferable anomaly cues with domain-specific appearance factors such as texture, geometry, and acquisition conditions. This residual domain entanglement limits cross-domain transfer and may produce spurious activations on novel domains. We propose DART, a plug-in framework for normal-abnormal guided GAD that learns to separate residuals into anomaly-relevant and domain-specific components. DART combines a Residual Disentanglement Module, which preserves anomalydiscriminative information while suppressing domain information, with CrossDomain Meta-Training, which forms episodes across source domains to make the separation effective. The method is architecture-agnostic and can be inserted between residual computation and the detection head of existing GAD pipelines. Experiments on MVTec AD, VisA, and BraTS show consistent improvements over multiple base methods, with the largest gains under stronger domain shifts. § DART

1

Introduction

Visual anomaly detection is central to industrial inspection [1, 2], medical diagnosis [3], and safetycritical monitoring [4]. Most existing methods [5–9] train separate models for individual domains, which becomes impractical when new categories appear frequently, labeled data is scarce, or targetdomain training is restricted. Generalist Anomaly Detection (GAD) addresses this limitation by training a unified model on source domains and deploying it on unseen target domains without fine-tuning [10, 11]. At inference, the model detects anomalies in a query image by comparing it with a few target-domain references. Early GAD methods, such as InCTRL [10] and ResAD [11], rely only on normal references, assuming that anomalies induce larger residuals relative to normal prototypes. Recent normal-abnormal guided GAD methods further exploit a small number of abnormal references, which are often available in practical settings. NAGL [12], for instance, uses residual mining and anomaly feature learning to transfer abnormal cues from references to queries, improving over normal-only prompting. However, we show that the residuals driving this transfer are often domainentangled: they mix transferable anomaly cues with domain-specific factors such as texture, object geometry, and acquisition conditions. For example, a cracked-bottle residual encodes both the crack pattern and bottle-specific appearance; when transferred to leather or transistors, such domain-specific information can trigger false activations or suppress genuine anomalies. We call this phenomenon residual domain entanglement and identify it as a key bottleneck for cross-domain normal-abnormal guided GAD (see Figure 1). * Corresponding authors: muhammad.aqeel@univr.it, maham@buaa.edu.cn

40th Conference on Neural Information Processing Systems (NeurIPS 2026).

(a) SotA

(b) DART

Figure 1: t-SNE visualization of residual features before and after DART. Colors denote defect types, while marker shapes denote source domains. (a) In the SotA baseline, residuals are fragmented and strongly influenced by domain identity: samples with the same defect type appear in multiple separated regions, while different defect types often overlap. This indicates that residuals encode both anomaly information and domain-specific factors. (b) With DART, residuals form more compact and well-separated clusters by defect type, while different domains are mixed within each cluster. This shows that DART suppresses domain-specific variation and yields residual representations that are more aligned with transferable anomaly semantics. This issue relates GAD to domain adaptation [13, 14], where domain-specific representations are known to generalize poorly under distribution shift. However, GAD requires more than feature alignment: normal-abnormal residuals must be disentangled, since anomaly cues and domain-specific factors are mixed within the same representation. We view this objective through an information-theoretic lens: the anomaly component ra should retain information about the anomaly label Y , while minimizing information about the domain D, with reconstruction preserving the original residual. This motivates DART (Domain-Agnostic Residual Transfer), a plug-in framework for normal-abnormal GAD. DART combines two components. First, a Residual Disentanglement Module (RDM) splits a residual into an anomaly-relevant component ra and a domain-specific component rd using sufficiency, adversarial invariance, and reconstruction losses. Second, Cross-Domain Meta-Training (CDMT) forms episodes with references and queries from different source domains to make this separation learnable. RDM provides the mechanism for suppressing domain information, while CDMT provides the cross-domain signal needed to learn it. RDM operates between residual computation and the downstream detection head, making DART independent of a specific architecture. We apply it to NAGL [12], the current normal-abnormal guided GAD baseline, and to adapted versions of InCTRL [10] and ResAD [11]. Our contributions are threefold: (i) we identify residual domain entanglement as a bottleneck in normal-abnormal guided GAD; (ii) we propose DART, combining RDM and CDMT to learn anomaly-relevant, domain-agnostic residuals; and (iii) we evaluate it on MVTec AD, VisA, and BraTS across NAGL and two adapted residual-based GAD baselines, showing consistent image-level gains and competitive localization performance under cross-domain transfer.

2

Related Work

Generalist Anomaly Detection. Visual anomaly detection is mostly single-domain, using memory banks [5, 15], reconstruction [16], knowledge distillation [8, 17], normalizing flows [7, 6], or meta-learning [18]. Few- and zero-shot methods [19–23] and generative augmentation [24] reduce supervision, but often rely on category-specific adaptation or normal-only references. Generalist Anomaly Detection (GAD) instead trains one model on source domains and transfers it to unseen targets without fine-tuning. InCTRL [10] learns in-context residuals from few-shot normal prompts, 2

Figure 2: Overview of DART. (Left) Given a query xq , normal references Sn , and an abnormal reference Sa , a frozen backbone produces features fq , Fn , and Fa . (Center) The host residual operator computes r = R(fq ; Fn , Fa ) in residual space; the proposed Residual Disentanglement Module (RDM) decomposes r, and only its anomaly component ra is passed, together with fq , Fn , and Fa , to the unchanged host detection head. (Right) Inside RDM, the anomaly encoder Ea (A) instantiates the transformation T and extracts ra , while the domain encoder Ed (B) extracts the domain-specific rd . Three losses shape the split: Lsuf keeps anomaly information in ra , Ladv suppresses domain information via a GRL and domain classifier Cd , and Lrecon enforces that G([ra ; rd ]) (⊕) reconstructs r; λ1 , λ2 denote λadv , λrecon . Components marked × (Ed , G, GRL, Cd ) are discarded at inference, leaving only Ea active.

while ResAD [11] models residual feature distributions to reduce class-specific variation. Both rely on normal references, and recent work mines additional normality from the query itself [25]. NAGL [12] introduced normal-abnormal guided GAD, exploiting abnormal references via residual mining and anomaly feature learning. We build on this setting but address a different limitation: normal-abnormal residuals can remain entangled with domain-specific information, limiting cross-domain transfer. Domain-Invariant Representation Learning. Domain adaptation theory links target error to source error and cross-domain divergence [13], motivating domain-adversarial training with gradient reversal [14] and domain generalization methods [26, 27]. Disentanglement approaches separate invariant and domain-specific factors using adversarial [28, 29] or variational [30] objectives, while meta-learning studies cross-domain episodes for few-shot generalization [31–34]. Unlike these works, DART neither disentangles raw features nor assumes target-domain access during training. It disentangles normal-abnormal residuals, separating anomaly-relevant changes from domain-specific factors for unseen-domain GAD.

3

Methodology

Generalist Anomaly Detection (GAD) learns a unified model from source domains DS = {D1 , . . . , DK } and applies it to unseen target domains DT without parameter updates. We adopt the normal-abnormal guided setting [12], where each episode contains a query image xq and a reference K2 1 set S = {Sn , Sa }, with normal samples Sn = {xn,i }K i=1 and abnormal samples Sa = {xa,j }j=1 , K1 ≥ K2 . During training, episodes are sampled from DS and the model predicts an anomaly map for xq conditioned on S, using supervision Yq that may contain image-level labels, pixel-level masks, or both. During inference, each target-domain query is paired with target-domain references, and no fine-tuning is performed. Thus, GAD is a conditional inference problem in which predictions depend on both the query and the reference set [12, 10, 11]. Residual-based GAD methods detect anomalies by measuring how query features deviate from reference features. Different methods instantiate this idea in different ways: InCTRL [10] uses discrepancy maps between query and normal prompts, ResAD [11] models residual feature distributions, and NAGL [12] exploits residuals involving normal and abnormal references. We abstract these variants 3

through a generic residual operator: r = R(fq ; Fn , Fa ),

(1)

where fq = ϕ(xq ) is the query feature, Fn = ϕ(Sn ) and Fa = ϕ(Sa ) are normal and abnormal reference features, and R(·) denotes the residual computation used by the host GAD method. Our key observation is that residuals are not purely anomaly-specific: they also encode domaindependent factors such as texture, geometry, and illumination. We call this residual domain entanglement. Under domain shift, these nuisance components can transfer poorly, causing spurious activations or missed detections in unseen target domains. 3.1

Overview of DART

To reduce residual domain entanglement, we seek a transformation T (r) = ra that preserves anomalyrelevant information while suppressing domain-specific variation. Let Y denote the anomaly label and D the domain identity. The transformed residual should be sufficient for anomaly prediction, while being as uninformative as possible about the domain: max I(T (r); Y ) − βI(T (r); D), T

(2)

where I(·; ·) denotes mutual information and β controls the strength of domain invariance. The first term encourages predictive sufficiency, while the second penalizes domain information. Since enforcing invariance alone can remove useful anomaly cues, the representation must also preserve enough information to reconstruct the original residual. This motivates DART, a plug-in framework with two complementary components. The Residual Disentanglement Module (RDM) decomposes a raw residual into an anomaly-relevant component ra and a domain-specific component rd , trained with sufficiency, adversarial invariance, and reconstruction losses. The Cross-Domain Meta-Training (CDMT) strategy forms episodes in which references and queries come from different source domains, making domain-specific cues unreliable and encouraging RDM to isolate transferable anomaly information. DART is inserted after residual computation and before the downstream anomaly predictor. The scheme of the approach is in Fig. 2. 3.2

Residual Disentanglement Module

Given a raw residual r ∈ RH×W ×C produced by the host GAD pipeline, RDM learns a decomposition of r into an anomaly component ra and a complementary domain-specific component rd : (ra , rd ) = RDM(r).

(3)

Here, ra is intended to retain the transferable information required for anomaly prediction, while rd absorbs complementary information that is useful for reconstruction but should not drive detection. This decomposition is not enforced explicitly, but is encouraged through the joint training losses described below. Anomaly Encoder Ea . Ea instantiates the transformation T of Eq. (2), ra = Ea (r), as a transformer block with multi-head self-attention, feed-forward layers, residual connections, and layer normalization. Domain-specific appearance often manifests as broad spatial regularities, texture, material, illumination, while anomaly evidence is typically localized and sparse. Self-attention allows the model to compare local irregularities against global context, well suited to isolate transferable anomaly structure from domain-wide appearance. Domain Encoder Ed . Ed is a lightweight two-layer MLP with GELU activation and layer normalization, rd = Ed (r), whose role is to absorb residual information not required in ra for domain-robust detection. Reconstruction Decoder G. To make the decomposition complete, i.e., to discard nothing from r, G reconstructs r from the channel-wise concatenation [ra ; rd ], producing r̂ = G([ra ; rd ]). Domain Classifier Cd . To explicitly suppress domain information in ra , we attach a spectrally normalized two-layer MLP to pooled invariant features and train it adversarially through a gradient reversal layer:
p̂d = Cd GRLα (ψ(ra )) , (4) 4

where p̂d ∈ [0, 1]K is the predicted domain distribution and ψ(·) concatenates mean and max pooling over spatial locations. Mean pooling captures the dominant global domain signature, while max pooling exposes the most domain-discriminative local regions. Their combination provides a stronger probe for residual domain leakage. 3.2.1

Training Objective

The losses used in RDM are designed to instantiate two requirements: predictive sufficiency and domain invariance. A reconstruction term further enforces completeness of the decomposition. Adversarial invariance loss. To suppress domain information in ra , we train the anomaly branch to fool the domain classifier: K X Ladv = − ⊮[d = k] log p̂d,k , (5) k=1

where d is the identity of the reference domain Di , from which the residual inherits its appearance. Through gradient reversal, Cd learns to predict the domain, while Ea receives the opposite gradient and is pushed toward domain invariance. This acts as a practical surrogate for reducing the information about D encoded in ra . Sufficiency loss. To ensure that ra alone remains predictive of anomaly labels, we feed only ra to the downstream detector:
Lsuf = Ldet Detect(ra , ϕ(xq )), Yq , (6) where Detect(·) denotes the prediction head of the underlying GAD method. This term encourages anomaly-relevant information to be concentrated in the anomaly branch rather than distributed across both branches. Reconstruction loss. To enforce completeness, we reconstruct r from (ra , rd ): HW

Lrecon = 1 −

1 X cos(r̂i , ri ). HW i=1

(7)

We use cosine similarity instead of ℓ2 loss because residuals can be noisy and vary substantially in scale. Lrecon constrains the pair (ra , rd ) rather than ra alone; it is Lsuf that anchors anomaly information in ra and prevents its collapse (Table 4e). All branches are optimized jointly, while the relative influence of reconstruction is controlled by λrecon . Total objective. The final training loss is Ltotal = Lsuf + λadv Ladv + λrecon Lrecon ,

(8)

where λadv and λrecon balance the strength of invariance and information preservation. From the perspective of the problem formulation, Lsuf enforces predictive sufficiency, Ladv promotes domain invariance, and Lrecon enforces completeness of the decomposition. 3.3

Cross-Domain Meta-Training

RDM alone does not guarantee that ra becomes domain-invariant. If training episodes are formed within a single domain, domain-specific cues in the residual remain predictive, and the model can achieve low training error without removing them. In the limiting case, the anomaly branch can simply preserve the full residual, i.e., ra ≈ r, while still achieving strong in-domain performance. CDMT addresses this issue by constructing cross-domain episodes with probability pcross : the reference set S is sampled from domain Di , while the query xq is sampled from a different domain Dj , with i ̸= j. Under this regime, domain-specific cues in the residual become unreliable for prediction, and the model is forced to rely on the transferable component of r instead. Combined with the adversarial invariance loss, CDMT provides the supervision needed to make the intended decomposition learnable in practice. In this way, RDM defines how residual information is separated, while CDMT provides the cross-domain signal that makes this separation meaningful. Curriculum schedule. Directly enabling cross-domain episodes and adversarial invariance from the first epoch is often unstable, because the model has not yet learned a stable residual decomposition. We therefore adopt a two-stage curriculum. 5

Phase 1, Warmup (1 to Tw ): all episodes are same-domain, pcross = 0, and adversarial training is disabled, α = 0. During this stage, the model learns a stable residual decomposition through Lsuf and Lrecon . Phase 2, Ramp-up (Tw to T ): the cross-domain sampling ratio pcross increases linearly from 0 to pmax , and the gradient reversal strength follows α(t) =

2 

w 1 + exp −10 · Tt−T −Tw

 − 1.

(9)

This gradual schedule prevents the adversarial objective from destabilizing the residual structure learned during warmup. Plug-in Integration. RDM operates on the residual representation after residual computation and before downstream detection. Given a base normal-abnormal GAD method, we first compute the raw residual r using the original pipeline, then apply RDM to obtain the anomaly component ra , and finally replace the original residual by ra in the downstream anomaly detector. During training, the base objective is augmented as in Eq. (8), and episodes are constructed using CDMT. Since RDM preserves the residual interface, the backbone and the prediction head of the host method do not need to be redesigned. Inference. At inference time, the base GAD pipeline first computes the raw residual r from the target-domain references. The anomaly encoder then extracts ra = Ea (r), which is passed to the downstream detector for anomaly prediction. The auxiliary training-only modules, namely the domain encoder Ed , the reconstruction decoder G, and the domain classifier Cd , are discarded. Therefore, the additional inference overhead over the base method is limited to the anomaly encoder Ea .

4

Experiments

Datasets and protocol. We evaluate DART in the GAD setting, where a model trained on source domains is deployed on unseen target domains without fine-tuning. We use MVTec AD [1], VisA [2], and BraTS [35], covering industrial and medical anomaly detection. We adopt the same protocol of [12]: we use one dataset for training and another for testing, ensuring category-, dataset-, and acquisition-level isolation. Specifically, we consider VisA→MVTec AD, MVTec AD→VisA, and MVTec AD→BraTS. At inference, references are sampled from the target-domain training split and no parameters are updated. CDMT protocol & reference selection. In CDMT, a domain is an object category, not a dataset: DS holds 15 categories when MVTec AD is the source and 12 when VisA is, and the target dataset is held out entirely (App. A.2). Each episode draws references from a source category Di and the query from a category Dj (Table 1); episodes are same-domain (Dj =Di ) during a Tw =5-epoch warmup, after which the cross-domain probability ramps linearly to pmax =0.3 (Sec. 3.3). The domain label in Ladv is the reference domain Di , whose appearance the residual inherits; the query domain does not enter the adversarial loss. At inference, query and references come from the same held-out target category. The abnormal reference is a single image (A1 , K2 =1), sampled by the query’s defect type on MVTec AD and uniformly on VisA.

Table 1: Representative CDMT episode triplets (Di , Dj , Dk ). The target Dk never appears as reference or query during training. Target Dk

Reference Di

Query Dj

Type

VisA–candle VisA–candle VisA–pcb1 MVTec–bottle MVTec–wood BraTS–brain BraTS–brain

MVTec–bottle MVTec–bottle MVTec–transistor VisA–candle VisA–macaroni1 MVTec–pill MVTec–hazelnut

MVTec–bottle MVTec–zipper MVTec–cable VisA–pcb2 VisA–fryum MVTec–capsule MVTec–screw

same-domain (warmup) cross-domain cross-domain cross-domain cross-domain cross-domain cross-domain

6

Table 2: Comparison on MVTecAD and VisA datasets. N i : i normal references; A1 : one abnormal reference. +Inv: naive abnormal-reference integration without RDM. Bold/underline: best/runner-up per setting block. Shaded rows are our DART variants. MVTecAD Image-level Setting

Image-level

Pixel-level

AUROC

AP

F1-max AUROC PRO F1-max AUROC

AP

F1-max AUROC PRO F1-max

SPADE [37] WinCLIP [20] PromptAD [21]

81.0 93.1 94.6

90.6 96.5 97.1

90.3 93.7 –

91.2 95.2 95.9

83.9 87.1 87.9

42.4 55.9 –

79.5 83.8 86.9

82.0 85.1 88.4

80.7 83.1 –

95.6 96.4 96.7

84.1 85.1 85.1

35.5 41.3 –

InCTRL [10] ResAD [11]

94.99 85.70

97.33 93.10

95.07 90.90

– 94.40

– 84.50

– 49.80

85.47 81.20

55.65 82.50

60.04 81.20

– 95.20

– 78.80

– 33.30

NAGL [12] N 1 +A1 InCTRL+Inv ResAD+Inv

95.54 95.41 82.70

97.63 97.72 91.10

95.40 94.97 89.90

96.53 – 93.20

92.66 – 81.00

58.03 – 46.60

86.23 79.87 74.70

86.54 55.37 76.70

84.59 57.95 78.20

97.20 – 94.00

88.76 – 72.80

42.41 – 25.30

NAGL+DART InCTRL+DART ResAD+DART

95.93 95.55 85.90

97.95 97.74 93.10

95.76 95.21 90.30

96.51 94.52 94.10

92.88 85.23 84.00

58.37 51.16 50.30

87.65 86.06 81.70

88.00 60.10 84.30

84.25 63.31 81.50

97.21 95.44 95.40

88.77 69.15 78.20

41.25 27.24 28.50

SPADE [37] WinCLIP [20] PromptAD [21]

82.9 94.4 95.7

91.7 97.0 97.9

91.1 94.4 –

92.0 96.0 96.2

85.7 88.4 88.5

44.5 58.4 –

80.7 84.6 88.3

82.3 85.8 90.0

81.7 83.0 –

96.2 96.8 97.1

85.7 86.2 85.8

40.5 43.5 –

InCTRL [10] ResAD [11]

95.06 87.60

97.55 94.10

95.76 91.70

– 95.30

– 86.30

– 51.60

87.96 83.20

58.67 84.20

63.61 82.20

– 95.90

– 80.40

– 37.40

NAGL [12] N 2 +A1 InCTRL+Inv ResAD+Inv

96.61 95.73 84.90

98.11 97.88 92.20

96.10 95.33 90.10

96.63 – 94.20

93.13 – 83.10

59.20 – 48.10

87.90 81.41 77.60

89.03 56.55 79.80

85.15 57.96 78.90

97.34 – 94.70

89.25 – 75.30

44.06 – 28.60

NAGL+DART InCTRL+DART ResAD+DART

96.62 96.21 88.10

98.15 98.12 94.30

96.20 95.32 91.80

96.64 94.81 95.00

93.13 85.65 85.50

59.22 52.37 52.10

89.72 88.64 83.40

89.16 63.72 85.60

86.21 65.73 82.40

97.29 96.37 96.20

89.07 70.45 80.80

42.65 28.04 32.40

SPADE [37] WinCLIP [20] PromptAD [21]

84.8 95.2 96.6

92.5 97.3 98.5

91.5 94.7 –

92.7 96.2 96.5

87.0 89.0 90.5

46.2 59.5 –

81.7 87.3 89.1

83.4 88.8 90.8

82.1 84.2 –

96.6 97.2 97.4

87.3 87.6 86.2

43.6 47.0 –

InCTRL [10] ResAD [11]

95.41 89.90

97.44 95.10

95.95 92.50

– 95.90

– 87.50

– 53.40

89.16 87.00

63.67 87.90

67.92 84.60

– 96.40

– 82.80

– 39.50

NAGL [12] N 4 +A1 InCTRL+Inv ResAD+Inv

97.08 94.19 87.40

98.34 97.43 93.50

96.37 94.46 91.00

96.68 – 94.90

93.29 – 84.80

59.77 – 49.30

90.30 80.29 82.00

90.70 55.49 83.40

87.03 55.48 81.30

97.44 – 95.80

89.64 – 79.00

44.86 – 31.70

97.34 95.64 89.90

98.46 97.76 95.10

96.52 96.08 92.50

96.76 95.52 95.60

93.39 86.22 86.80

60.03 53.31 53.70

91.29 90.14 87.90

90.94 69.95 89.30

87.87 70.05 85.70

97.45 96.92 96.70

89.99 71.18 83.10

43.56 29.47 35.20

N

1

Ours

N

2

Ours

N

4

Ours

Method

VisA Pixel-level

NAGL+DART InCTRL+DART ResAD+DART

Metrics. For MVTec AD and VisA, we report image-level AUROC, AP, and F1-max, and pixel-level AUROC, PRO [36], and F1-max. For BraTS, we report image-level AUROC, pixel-level AUROC, and their mean. Host methods & baselines. We integrate DART into NAGL [12], the current normal-abnormal guided GAD baseline, and into adapted versions of two residual-based GAD methods: InCTRL [10] and ResAD [11]. This allows us to evaluate whether residual disentanglement improves both an existing normal-abnormal method and normal-only GAD pipelines extended with abnormal references. We compare against two groups of methods. The first comprises established few-shot AD approaches that use normal references only: SPADE [37], WinCLIP [20], and PromptAD [21], along with the vanilla (unmodified) versions of our three host methods InCTRL, ResAD, and NAGL. The second group evaluates the effect of introducing abnormal references: for each host method we report +Inv, which naively incorporates the abnormal reference without disentanglement, and +DART, which applies the full RDM pipeline. Comparing vanilla → +Inv isolates the value of abnormal access alone, while comparing +Inv → +DART isolates the contribution of residual disentanglement. DART configuration. DART operates on the raw residual produced by each host method and leaves the downstream detection head unchanged. RDM contains an anomaly encoder Ea , a domain encoder Ed , a reconstruction decoder G, and a domain classifier Cd trained through gradient reversal. The objective combines anomaly sufficiency, adversarial domain invariance, and residual reconstruction. Training follows CDMT, with cross-domain episodes sampled from source domains only; target domains are never used for training, validation, or checkpoint selection. Host-method parameters remain frozen, and at inference only Ea and the host detection head are retained. Implementation details and hyperparameters are provided in the supplementary material. 7

5

Results

State-of-the-art comparison. Table 2 compares DART against existing methods on the MVTec AD and VisA benchmarks. NAGL+DART achieves the highest image-level AUROC across all shot settings on both datasets. On MVTec AD, NAGL+DART reaches 95.93%, 96.62%, and 97.34% at N 1 , N 2 , and N 4 respectively, consistently outperforming all baselines including PromptAD (94.6%, 95.7%, 96.6%) and vanilla NAGL. On VisA, where the domain gap from the MVTec-trained source is largest, the improvements are more pronounced: NAGL+DART achieves 89.72% at N 2 +A1 , a +1.82% gain over vanilla NAGL (87.90%), and 91.29% at N 4 +A1 (+0.99% over NAGL). This pattern, larger gains under larger domain shift, is consistent with our hypothesis that residual domain entanglement is the primary bottleneck, and that its impact scales with the dissimilarity between source and target distributions. Gains are also most pronounced at low-shot settings (N 1 , N 2 ) where fewer target-domain references make cross-domain transfer most critical, and gradually narrow as additional references partially compensate for entanglement. At the pixel level, NAGL+DART matches or improves upon vanilla NAGL on PRO and P-AUROC across most settings, while simultaneously achieving the best image-level metrics. This indicates that disentanglement does not sacrifice localization quality for classification gains, a common failure mode when modifying residual representations. The pixel-level F1-max shows occasional small drops (e.g., −1.16 at N 1 on VisA), which we attribute to F1’s threshold sensitivity rather than to a systematic degradation, as both P-AUROC and PRO remain competitive. Disentanglement vs. naive abnormal access. The +Inv rows in Table 2 separate access to abnormal references from disentangling them. Naive integration is unreliable and often harmful: ResAD+Inv loses −3.0 I-AUROC on MVTec AD and −6.5 on VisA at N 1 (PRO up to −6.0), and InCTRL+Inv swings from +0.42 at N 1 to −1.22 at N 4 without ever producing spatially coherent pixel-level maps. DART recovers and exceeds vanilla performance in the same settings, and the +Inv→+DART gap widens with domain shift: +6.19 I-AUROC on VisA at N 1 (79.87% vs. 86.06%), growing to +9.85 at N 4 (80.29% vs. 90.14%). Residual disentanglement, not mere abnormal access, drives the improvement; the full per-category breakdown is in App. A.8. DART as a general plug-in. RDM operates on the residual r as a method-agnostic interface, requiring no modification to detection heads or method-specific hyperparameter tuning beyond λadv and λrecon . This design choice is validated by the breadth of host methods: NAGL mines attentionbased residuals over ViT patch tokens, InCTRL computes multi-layer in-context residuals from CLIP features, and ResAD learns distributional deviations via normalizing flows on WideResNet features, three substantially different architectures, all of which improve under DART without any method-specific adaptation. A notable emergent capability is pixel-level localization in InCTRL, which originally reported no segmentation metrics: disentangling the residual produces spatially meaningful anomaly maps as a byproduct, achieving P-AUROC of 94.52–95.71% on MVTec AD across shot settings. Efficiency. DART’s overhead is modest and front-loaded: training adds 3.1–20.1M parameters and ≈1 GPU-hour per setting on a single RTX4090, incurred once on source domains with the host frozen. At inference only Ea is retained (+0.82M for InCTRL, +0.89M for NAGL, +9.06M for ResAD) and operates on low-dimensional residuals, so runtime overhead is negligible (Table 5). 5.1

Industrial-to-Medical Transfer

Table 3 evaluates DART on the most challenging setting, MVTec AD → BraTS (industrial defects → brain-tumor MRI). DART improves all three host methods on this extreme domain shift in nearly every setting, with gains substantially larger than those on industrial benchmarks. InCTRL+DART achieves the most striking improvement: +13.28% image-level AUROC at N 1 (65.20% → 78.48%) and +7.61% at N 4 (69.89% → 77.50%), while ResAD+DART improves by +5.20% at N 2 and NAGL+DART improves at both N 2 (+0.25%) and N 4 (+0.99%). The gains extend to localization: InCTRL+DART raises pixel-level AUROC from 83.65% to 87.67% at N 1 and from 90.06% to 93.85% at N 4 . The single exception is NAGL+DART at N 1 , where a pixel-level drop (93.00% → 90.33%) lowers the mean despite a slightly higher image-level AUROC; with two or more normal references it improves both. The magnified gains on BraTS support our core claim that the impact of residual domain entanglement scales with the severity of the domain shift. 8

Table 3: (a) Cross-domain evaluation on BraTS (MVTec AD → BraTS). I/P/M: image-/pixel-level AUROC and their mean. Bold/underline: best/runner-up per N k +A1 block. Shaded : DART variants. (b) Encoder architecture ablation on MVTec-AD and VisA. (c) Disentanglement strategy on MVTec-AD and VisA. (d) RDM–CDMT co-dependency. All ablations: InCTRL backbone, k=2. (a) BraTS state-of-the-art comparison Setting

Method

I

P

N1

InCTRL [10] ResAD [11]

65.20 83.65 74.43 72.30 93.40 82.85

N 1 +A1 NAGL [12]

76.32 93.00 84.66

(b) Architecture (MVTec-AD / VisA)

M

Vanilla (InCTRL)

95.06

97.55

87.96

58.67

Linear projection w/o LayerNorm

95.16 94.30

97.57 97.31

81.29 84.65

58.25 59.18

DART (full)

96.21

98.12

88.64

63.72

(c) Strategy (MVTec-AD / VisA)

SPADE [37] WinCLIP [20]

58.0 55.9

InCTRL [10] ResAD [11]

59.80 87.28 73.54 66.20 93.30 79.75

Method

N 2 +A1 NAGL [12]

76.85 89.57 83.21

Vanilla

95.06

97.55

87.96

58.67

Adversarial-only Orthogonality-only

93.61 93.32

97.12 96.89

86.15 85.94

61.95 61.79

DART (ours)

96.21

98.12

88.64

63.72

N2

75.4 73.7

SPADE [37] WinCLIP [20]

66.3 67.3

InCTRL [10] ResAD [11]

69.89 90.06 79.98 69.50 93.40 81.45

N 4 +A1 NAGL [12]

78.29 93.33 85.81

N4

94.8 93.2

MVTec-AD

VisA

I-AUROC I-AP I-AUROC I-AP

NAGL+DART 77.10 89.95 83.53 InCTRL+DART 64.11 92.20 78.16 ResAD+DART 71.40 93.80 82.60 80.6 80.3

(d) RDM–CDMT co-dependency RDM CDMT ✗ ✗ ✓ ✓

NAGL+DART 79.28 92.54 85.91 InCTRL+DART 77.50 93.85 85.68 ResAD+DART 72.60 93.90 83.25

5.2

VisA

I-AUROC I-AP I-AUROC I-AP

NAGL+DART 76.36 90.33 83.35 InCTRL+DART 78.48 87.67 83.08 ResAD+DART 75.70 93.60 84.65 92.8 91.5

MVTec-AD

Variant

✗ ✓ ✗ ✓

MVTec-AD

VisA

I-AUROC

∆

I-AUROC

∆

95.06 95.06 95.54 96.21

– +0.00 +0.48 +1.15

87.96 87.96 88.17 88.64

– +0.00 +0.21 +0.68

Ablation Study

We ablate DART’s components using InCTRL as the host method at k=2 shots. All ablations use the same training protocol; only the specified component is modified. Architecture (Table 3b). Replacing the MLP encoder with a linear projection causes a sharp drop on VisA (−7.35 I-AUROC) while leaving MVTec-AD nearly unchanged, demonstrating that non-linear capacity is essential specifically for cross-domain disentanglement where the domain gap is larger. Removing LayerNorm degrades both datasets (−0.75 MVTec-AD, −3.99 VisA), confirming its role in stabilizing the residual decomposition. Disentanglement strategy (Table 3c). Both adversarial-only and orthogonality-only baselines degrade below vanilla on both datasets (up to −1.74 MVTec-AD, −2.02 VisA). Adversarial-only training suppresses domain information but lacks a constraint to preserve anomaly signal, allowing Ea to collapse. Orthogonality-only training enforces geometric independence but permits anomalyrelevant directions to migrate into rd . DART’s joint objective resolves both: Lsuf prevents collapse, Lrecon ensures completeness, and Ladv drives genuine domain suppression under these constraints. The +2.89 gap over the best single-objective baseline confirms that no proper subset achieves the same effect. Co-dependency of RDM and CDMT (Table 3d). CDMT without RDM is inert: with the backbone frozen, cross-domain episodes have no trainable parameters to update, so results are identical to Vanilla (∆= + 0.00 on both datasets). RDM without CDMT achieves only local disentanglement (+0.48 MVTec-AD, +0.21 VisA), learning to suppress within-domain variance but not generalising across domains. Full DART achieves +1.15 on MVTec-AD and +0.68 on VisA, with the gains of +0.67 and +0.47 over RDM alone attributable entirely to CDMT’s cross-domain supervision. The co-dependency is directional and structural: no proper subset achieves cross-domain invariance. 9

Table 4: (e) Loss term ablation; ∆ vs. DART (full). (f) Residual vs. feature space; ∆ vs. Vanilla. MVTec-AD, InCTRL, k=2. (e) Loss terms I-AUROC

I-AP

∆

Vanilla (InCTRL)

95.06

97.55

−1.15

w/o Lsuf w/o Lrecon w/o Ladv w/o CDMT

93.57 95.48 95.57 95.54

96.90 97.82 97.86 97.84

−2.64 −0.73 −0.64 −0.67

DART (full)

96.21

98.12

–

Variant

(f) Disentanglement space Method

I-AUROC

I-AP

∆

95.06 94.52 96.21

97.55 97.32 98.12

– −0.54 +1.15

Vanilla DART-F (feature) DART (ours)

Figure 3: Residual vs. feature space. (a) Domain silhouette (lower = less entanglement); (b) I-AUROC gain over Vanilla (MVTec AD, k=2). DART-F amplifies domain separation; DART reduces it, improving detection.

Loss terms (Table 4e). Removing Lsuf causes the largest degradation (−2.64 I-AUROC), confirming that anomaly sufficiency is the most critical constraint: without it, Ea has no explicit objective to retain discriminative information in ra . Removing Ladv , Lrecon , or CDMT individually produces smaller but consistent drops (−0.64 to −0.73), in line with their role as cross-domain regularizers whose benefit compounds under domain shift. The full model outperforms every partial variant, confirming that all components are jointly necessary. The same setting (λadv =0.1, λrecon =0.5) is used for all hosts and datasets with no per-host or per-dataset tuning. Residual vs. feature space (Table 4f, Fig. 3). DART-F, which applies disentanglement in backbone feature space, degrades performance (−0.54 vs. vanilla) while DART improves it (+1.15). Silhouette analysis of the same 640-d residuals (identical normalization, no detector in the loop) reveals why: DART-F amplifies domain separation (0.246 → 0.611) because backbone features are domaindiscriminative by pretraining design and a lightweight plug-in cannot override this geometry, whereas in residual space domain information is only incidental and DART suppresses it (0.246 → 0.192). Relabeling the same residuals by defect type (computed within each category and averaged, as MVTec AD defect types are category-specific), the silhouette rises from 0.08 to 0.25 under DART while DART-F stalls at 0.10: domain identity becomes a weaker axis of variation in ra and defect identity a stronger one, demotion rather than deletion of domain information, and we do not claim perfect invariance. Anomaly preservation is enforced structurally: the frozen host head reads only ra , so any direction it uses cannot be discarded without paying Lsuf ; removing Lsuf indeed yields this degenerate solution, invariance by discarding, falling below the unmodified host (Table 4e).

6

Conclusion

In this work, we identified residual domain entanglement as a fundamental bottleneck limiting cross-domain transfer in normal-abnormal guided Generalist Anomaly Detection. To address this, we proposed DART, a plug-in framework comprising a Residual Disentanglement Module (RDM) and Cross-Domain Meta-Training (CDMT) that decomposes residuals into domain-agnostic anomaly components and domain-specific components. Extensive experiments across three host methods, three benchmarks, and three few-shot settings demonstrated that DART consistently improves cross-domain detection performance, with gains scaling with the severity of the domain shift (industrial-to-medical transfer). While adding 3–20M training-time parameters (0.8–9.1M at inference), DART delivers gains over vanilla (up to +1.82% I-AUROC on industrial benchmarks and +13.28% on medical transfer), whereas naive abnormal integration (+Inv) often degrades performance (e.g., −6.5% IAUROC for ResAD on VisA), making DART’s net gain over +Inv as high as +9.85%. Ablation studies confirmed that all components are jointly necessary and that disentanglement must operate in residual space. DART assumes at least one abnormal reference at test time, which zero-shot deployments may lack, and our evaluation is restricted to images; extending residual disentanglement to video and time-series anomalies is left to future work. 10

Acknowledgments This work was supported by Fondazione Cariverona through the projects “SmartSpindle5.0” (Bando Ricerca e Sviluppo 2024/2025, Ref. 2025.0053, ID 54833, CUP B33C25002220007) and “FINAL LAP—FINALizzazione intelligente dei materiali LAPidei derivanti da taglio” (Bando Ricerca e Sviluppo 2024). The authors declare no competing interests.

References [1] P. Bergmann, M. Fauser, D. Sattlegger, and C. Steger, “MVTec AD–A comprehensive real-world dataset for unsupervised anomaly detection,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9592–9600, 2019. [2] Y. Zou, J. Jeong, L. Pemula, D. Zhang, and O. Dabeer, “Spot-the-difference self-supervised pre-training for anomaly detection and segmentation,” in European Conference on Computer Vision (ECCV), pp. 392–408, Springer, 2022. [3] C. Baur, S. Denner, B. Wiestler, N. Navab, and S. Albarqouni, “Autoencoders for unsupervised anomaly segmentation in brain MR images: a comparative study,” Medical Image Analysis, vol. 69, p. 101952, 2021. [4] G. Pang, C. Shen, L. Cao, and A. V. D. Hengel, “Deep learning for anomaly detection: A review,” ACM computing surveys (CSUR), vol. 54, no. 2, pp. 1–38, 2021. [5] K. Roth, L. Pemula, J. Zepeda, B. Schölkopf, T. Brox, and P. Gehler, “Towards total recall in industrial anomaly detection,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 14318–14328, 2022. [6] D. Gudovskiy, S. Ishizaka, and K. Kozuka, “Cflow-ad: Real-time unsupervised anomaly detection with localization via conditional normalizing flows,” in IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 98–107, 2022. [7] J. Yu, Y. Zheng, X. Wang, W. Li, Y. Wu, R. Zhao, and L. Wu, “FastFlow: Unsupervised anomaly detection and localization via 2D normalizing flows,” arXiv preprint arXiv:2111.07677, 2021. [8] H. Deng and X. Li, “Anomaly detection via reverse distillation from one-class embedding,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9737–9746, 2022. [9] M. Aqeel, S. Sharifi, M. Cristani, and F. Setti, “Meta learning-driven iterative refinement for robust anomaly detection in industrial inspection,” in European Conference on Computer Vision, pp. 445–460, Springer, 2024. [10] J. Zhu and G. Pang, “Toward generalist anomaly detection via in-context residual learning with fewshot sample prompts,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 17826–17836, 2024. [11] X. Yao, Z. Chen, C. Gao, G. Zhai, and C. Zhang, “Resad: A simple framework for class generalizable anomaly detection,” Advances in Neural Information Processing Systems (NeurIPS), vol. 37, pp. 125287– 125311, 2024. [12] Y. Wang, X. Wang, Y. Gong, and J. Xiao, “Normal-abnormal guided generalist anomaly detection,” in Advances in Neural Information Processing Systems (NeurIPS), 2025. [13] S. Ben-David, J. Blitzer, K. Crammer, A. Kulesza, F. Pereira, and J. W. Vaughan, “A theory of learning from different domains,” Machine Learning, vol. 79, no. 1, pp. 151–175, 2010. [14] Y. Ganin, E. Ustinova, H. Ajakan, P. Germain, H. Larochelle, F. Laviolette, M. March, and V. Lempitsky, “Domain-adversarial training of neural networks,” Journal of Machine Learning Research, vol. 17, no. 59, pp. 1–35, 2016. [15] T. Defard, A. Setkov, A. Loesch, and R. Audigier, “Padim: a patch distribution modeling framework for anomaly detection and localization,” in International Conference on Pattern Recognition (ICPR), pp. 475–489, Springer, 2021. [16] Z. You, L. Cui, Y. Shen, K. Yang, X. Lu, Y. Zheng, and X. Le, “A unified model for multi-class anomaly detection,” Advances in Neural Information Processing Systems (NeurIPS), vol. 35, pp. 4571–4584, 2022.

11

[17] M. Salehi, N. Sadjadi, S. Baselizadeh, M. H. Rohban, and H. R. Rabiee, “Multiresolution knowledge distillation for anomaly detection,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 14902–14912, 2021. [18] M. Aqeel, S. Sharifi, M. Cristani, and F. Setti, “Towards real unsupervised anomaly detection via confident meta-learning,” in 2025 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4858–4867, IEEE, 2025. [19] C. Huang, H. Guan, A. Jiang, Y. Zhang, M. Spratling, and Y.-F. Wang, “Registration based few-shot anomaly detection,” in European Conference on Computer Vision (ECCV), pp. 303–319, Springer, 2022. [20] J. Jeong, Y. Zou, T. Kim, D. Zhang, A. Ravichandran, and O. Dabeer, “Winclip: Zero-/few-shot anomaly classification and segmentation,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 19606–19616, 2023. [21] X. Li, Z. Zhang, X. Tan, C. Chen, Y. Qu, Y. Xie, and L. Ma, “Promptad: Learning prompts with only normal samples for few-shot anomaly detection,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 16838–16848, 2024. [22] M. Aqeel, M. Nazir, U. Khan, M. Cristani, and F. Setti, “Anomaly-aware vision-language adapters for zero-shot anomaly detection,” in IEEE International Conference on Image Processing, pp. 1–6, 2026. [23] M. Aqeel, D. Skočaj, M. Cristani, and F. Setti, “A contrastive learning-guided confident meta-learning for zero shot anomaly detection,” in 2025 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW), pp. 1463–1472, IEEE, 2025. [24] M. Nazir, M. Aqeel, and F. Setti, “Diffusion-based data augmentation for medical image segmentation,” in 2025 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW), pp. 1341–1350, IEEE, 2025. [25] X. Wang, Y. Wang, T. Dai, H. Bai, Y. Zhao, and J. Xiao, “Hunting normality from query sample via residual learning for generalist anomaly detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 43093–43102, 2026. [26] K. Muandet, D. Balduzzi, and B. Schölkopf, “Domain generalization via invariant feature representation,” in International Conference on Machine Learning (ICML), pp. 10–18, PMLR, 2013. [27] D. Li, Y. Yang, Y.-Z. Song, and T. Hospedales, “Learning to generalize: Meta-learning for domain generalization,” in AAAI Conference on Artificial Intelligence, 2018. [28] X. Peng, Z. Huang, X. Sun, and K. Saenko, “Domain agnostic learning with disentangled representations,” in International Conference on Machine Learning (ICML), pp. 5102–5112, PMLR, 2019. [29] A. H. Liu, Y.-C. Liu, Y.-Y. Yeh, and Y.-C. F. Wang, “A unified feature disentangler for multi-domain image translation and manipulation,” Advances in Neural Information Processing Systems, vol. 31, 2018. [30] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” arXiv preprint arXiv:1312.6114, 2013. [31] C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in International Conference on Machine Learning (ICML), pp. 1126–1135, PMLR, 2017. [32] J. Snell, K. Swersky, and R. Zemel, “Prototypical networks for few-shot learning,” Advances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017. [33] H.-Y. Tseng, H.-Y. Lee, J.-B. Huang, and M.-H. Yang, “Cross-domain few-shot classification via learned feature-wise transformation,” in International Conference on Learning Representations (ICLR), 2020. [34] J. Cai and S. M. Shen, “Cross-domain few-shot learning with meta fine-tuning,” arXiv preprint arXiv:2005.10544, 2020. [35] B. H. Menze, A. Jakab, S. Bauer, J. Kalpathy-Cramer, K. Farahani, J. Kirby, Y. Burren, N. Porz, J. Slotboom, R. Wiest, et al., “The multimodal brain tumor image segmentation benchmark (BRATS),” IEEE Transactions on Medical Imaging, vol. 34, no. 10, pp. 1993–2024, 2014. [36] P. Bergmann, M. Fauser, D. Sattlegger, and C. Steger, “Uninformed students: Student-teacher anomaly detection with discriminative latent embeddings,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4183–4192, 2020. [37] N. Cohen and Y. Hoshen, “Sub-image anomaly detection with deep pyramid correspondences,” arXiv preprint arXiv:2005.02357, 2020. [38] T. Miyato, T. Kataoka, M. Koyama, and Y. Yoshida, “Spectral normalization for generative adversarial networks,” in International Conference on Learning Representations (ICLR), 2018.

12

NeurIPS Paper Checklist 1. Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: The claims in the Abstract and Section 1 are supported by the results in Table 2, Table 3 and the ablations in Section 5.2; the limitations are stated in the Conclusion. Guidelines: • The answer [N/A] means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A [No] or [N/A] answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 2. Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: Limitations are stated at the end of the Conclusion (requirement of at least one abnormal reference at test time; image-only evaluation) and discussed further in Appendix A.6. Guidelines: • The answer [N/A] means that the paper has no limitation while the answer [No] means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate “Limitations” section in their paper. • The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren’t acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 3. Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? 13

Answer: [N/A] Justification: This paper does not include theoretical results. Guidelines: • The answer [N/A] means that the paper does not include theoretical results. • All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems. • The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 4. Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: Protocol, host methods, and the DART configuration are described in Section 4; architectures, hyperparameters, the CDMT curriculum, reference-selection and leakage controls are given in Appendices A.1–A.2. Guidelines: • The answer [N/A] means that the paper does not include experiments. • If the paper includes experiments, a [No] answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example (a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully. (c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 5. Open access to data and code 14

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes] Justification: Code is made available at https://github.com/aqeeelmirza/DART (linked in the Abstract), with instructions to reproduce the main results. MVTec AD, VisA, and BraTS are public benchmarks, cited in Section 4. Guidelines: • The answer [N/A] means that paper does not include experiments requiring code. • Please see the NeurIPS code and data submission guidelines (https://neurips.cc/ public/guides/CodeSubmissionPolicy) for more details. • While we encourage the release of code and data, we understand that this might not be possible, so [No] is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark). • The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //neurips.cc/public/guides/CodeSubmissionPolicy) for more details. • The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc. • The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why. • At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable). • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 6. Experimental setting/details Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer) necessary to understand the results? Answer: [Yes] Justification: Please see Section 4 and Appendix A.1 (optimizer, schedule, loss weights, curriculum, validation and checkpoint selection on source domains only). Guidelines: • The answer [N/A] means that the paper does not include experiments. • The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 7. Experiment statistical significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: NAGL and NAGL+DART results are averaged over three independent seeds controlling the few-shot reference sampling, with 1-sigma standard deviations below 0.8 IAUROC and 0.5 P-AUROC in all settings; the reported gains exceed these margins. InCTRL and ResAD follow the single-run protocol of their original papers. See Appendix A.3. Guidelines: • The answer [N/A] means that the paper does not include experiments. • The authors should answer [Yes] if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. 15

• The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g., negative error rates). • If error bars are reported in tables or plots, the authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 8. Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: Compute is reported in the Efficiency paragraph of the main text and in the Efficiency Analysis paragraph and Table 5 of Appendix A.1: a single NVIDIA RTX4090 (24 GB), ≈1 GPU-hour per setting, and 100–150 GPU-hours in total. Guidelines: • The answer [N/A] means that the paper does not include experiments. • The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn’t make it into the paper). 9. Code of ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? Answer: [Yes] Justification: We have read the NeurIPS Code of Ethics and confirm that our research complies with these ethical standards. Guidelines: • The answer [N/A] means that the authors have not reviewed the NeurIPS Code of Ethics. • If the authors answer [No], they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 10. Broader impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: Please see the Social Impacts paragraph in Appendix A.6. 16

Guidelines: • The answer [N/A] means that there is no societal impact of the work performed. • If the authors answer [N/A] or [No], they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate Deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 11. Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pre-trained language models, image generators, or scraped datasets)? Answer: [N/A] Justification: The released models are anomaly detectors for industrial and medical benchmark images and pose no such risks. Guidelines: • The answer [N/A] means that the paper poses no such risks. • Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: All datasets (MVTec AD, VisA, BraTS) and host methods (InCTRL, ResAD, NAGL) are publicly released by their authors under their respective licenses and are cited in the paper; we use them unmodified for research purposes. Guidelines: • The answer [N/A] means that the paper does not use existing assets. • The authors should cite the original paper that produced the code package or dataset. 17

• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset. • For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset’s creators. 13. New assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [Yes] Justification: The released code is documented in the repository (https://github.com/ aqeeelmirza/DART): training and evaluation instructions, the evaluation protocol, and an MIT license. Guidelines: • The answer [N/A] means that the paper does not release new assets. • Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 14. Crowdsourcing and research with human subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? Answer: [N/A] Justification: Our paper does not involve crowdsourcing nor research with human subjects. Guidelines: • The answer [N/A] means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 15. Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained? Answer: [N/A] Justification: Our paper does not involve crowdsourcing nor research with human subjects. 18

Guidelines: • The answer [N/A] means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 16. Declaration of LLM usage Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigor, or originality of the research, declaration is not required. Answer: [N/A] Justification: LLMs were used only for language editing; they are not a component of the method, experiments, or analysis. Guidelines: • The answer [N/A] means that the core method development in this research does not involve LLMs as any important, original, or non-standard components. • Please refer to our LLM policy in the NeurIPS handbook for what should or should not be described.

19

A

Supplementary Material

A.1

Implementation Details

Host methods. We reproduce each host method following its original protocol to ensure that observed gains are attributable to DART rather than implementation differences. InCTRL [10] uses a frozen OpenCLIP ViT-B/16-plus-240 backbone at 240×240 resolution, computing multi-layer patch-level cosine distance maps and image-level residual vectors between query and normal prompts. The learnable adapter ψ and classifier η are trained with binary focal loss while the CLIP backbone remains frozen. Full architectural details are provided in §A.4.1. ResAD [11] employs a frozen WideResNet-50 with multi-layer feature aggregation. A Feature Constraintor is trained with the log-barrier one-class loss, a normalizing-flow Feature Distribution Estimator is trained with the negative log-likelihood objective, and a VQ codebook is constructed during training and frozen at test time. Full details in §A.4.2. NAGL [12] uses a frozen DINOv2 ViT-S/14 backbone (21M parameters) with M =25 learnable proxies and trains the Residual Mining (RM) and Anomaly Feature Learning (AFL) attention modules with AdamW (lr 1×10−5 , decayed by 0.1 at epochs 10 and 15) for 20 epochs of 500 episodes. Full details in §A.4.3. Across all three host methods, input resolution follows the original paper (no additional augmentation), and the same set of normal and abnormal references is shared per few-shot setting N k +A1 (with A1 throughout, and k ∈ {1, 2, 4}). NAGL results are averaged over three independent seeds, while InCTRL and ResAD follow the single-run protocol of their original papers (see §A.3). DART hyperparameters.

The Residual Disentanglement Module (RDM) consists of:

• Anomaly encoder Ea : single transformer block (multi-head self-attention + FFN + LayerNorm), hidden dimension matching the host method’s residual dimension. • Domain encoder Ed : two-layer MLP with GELU activation and LayerNorm. • Reconstruction decoder G: two-layer MLP taking concatenated [ra ; rd ] as input. • Domain classifier Cd : two-layer MLP with spectral normalization [38], preceded by a Gradient Reversal Layer (GRL) [14]. Loss weights are set to λadv = 0.1 and λrecon = 0.5 for all experiments. RDM is optimized with AdamW (lr 5×10−5 , weight decay 10−4 ) using a cosine learning rate schedule over 30 epochs, with batch size 16 and gradient clipping at norm 1.0. The host method’s parameters remain entirely frozen during DART training. Cross-Domain Meta-Training (CDMT) protocol. For each evaluation target DT , the entire target dataset is held out and CDMT episodes are sampled exclusively from the complementary source pool DS (this protocol is summarized in Sec. 4 of the main text). Within each episode, with probability pcross (t) the reference and query are sampled from different source categories. Both pcross and the GRL strength α(t) follow a two-phase curriculum: • Phase 1 - Warmup (epochs 1 to Tw =5): all episodes are same-domain (pcross =0) and adversarial training is disabled (α=0). Only Lsuf + λrecon Lrecon are active, allowing the model to learn a stable residual decomposition. • Phase 2 - Ramp-up (epochs Tw +1 to T =30): pcross ramps linearly from 0 to pmax =0.3, and α(t) follows the DANN schedule (Eq. 9 in the main text). The full objective Ltotal = Lsuf + λadv Ladv + λrecon Lrecon is active. Domain label in adversarial training. The domain label d used in Ladv corresponds to the reference domain Di from which the normal–abnormal pair is drawn. This is the domain whose identity we want to suppress in ra : the residual is computed from references in Di , so any domainspecific information in ra originates from Di . The query domain Dj does not enter the adversarial loss. Adapting normal-only baselines for abnormal references. InCTRL and ResAD are originally designed for normal-only references. We adapt them for the N k +A1 setting as follows: 20

• InCTRL+DART: The abnormal reference is passed through the frozen CLIP visual encoder alongside normal prompts. The residual between abnormal and normal token embeddings at each layer is computed analogously to the query-normal residual (Eq. 10), producing an abnormal-normal residual tensor. This tensor is fed into RDM, which outputs ra . The disentangled residual is then fused with the existing query-normal residual via concatenation before the scoring head. • ResAD+DART: The abnormal reference features are extracted from the frozen WideResNet backbone. Per-patch residuals between abnormal and normal features are computed via nearest-neighbor subtraction (Eq. 12). These residuals are fed into RDM to produce ra , which is concatenated with the original query-normal residual features before the Feature Constraintor and normalizing flow. • +Inv baseline: The same abnormal reference integration is performed, but without RDM, the raw abnormal-normal residual is concatenated directly. This isolates the contribution of disentanglement from the benefit of abnormal access. Validation and model selection. Best checkpoints are selected by mean image-level AUROC on a held-out subset of source categories. No target-domain category, image, reference, label, or statistic is used during training, validation, hyperparameter tuning, or checkpoint selection. Inference. At inference, the target domain Dk ∈ DT is accessed for the first time. For each test query q: (i) a few-shot support set is drawn from Dk ; (ii) the raw residual r is computed using the host method’s pipeline; (iii) ra = Ea (r) is extracted; (iv) the frozen detection head produces the anomaly score and segmentation map from ra . The domain encoder Ed , decoder G, and classifier Cd are discarded. No parameters are updated on DT . Efficiency Analysis. Tab. 5 summarizes the efficiency of each host method and the overhead introduced by DART, distinguishing training-time from inference-time cost. The full RDM adds 3.1M, 4.2M, and 20.1M parameters for InCTRL, NAGL, and ResAD respectively during training; at inference, only the anomaly encoder Ea is retained (0.82M, 0.89M, and 9.06M), while the domain encoder, reconstruction decoder, and domain classifier are training-only components discarded after learning the residual decomposition. Training requires approximately 1 GPU-hour per setting (30 epochs on a single NVIDIA RTX4090 GPU) since the host backbone is fully frozen, and this cost is incurred only once: the learned module transfers to unseen target domains without any further optimization. Inference overhead is negligible as the RDM operates only on low-dimensional residual features. All results are reported for 1, 2 and 4 shot settings; total compute for all experiments (3 host methods × 3 datasets × 3 shot settings, with 3 seeds for NAGL) is approximately 100-150 GPU-hours on NVIDIA RTX4090 GPUs (24 GB VRAM). Table 5: Efficiency comparison. DART overhead is split into training-time parameters (full RDM) and inference-time parameters (only Ea retained); DART training time is ≈1 GPU-hour per setting for all hosts. Host Method InCTRL [10] ResAD [11] NAGL [12]

A.2

DART Overhead (M)

Params (M) Train (H) FPS 117.5 59.2 24.4

0.7 20.6 0.3

Train

1.2 +3.1 7.8 +20.1 17.1 +4.2

Inference +0.82 +9.06 +0.89

Leakage Controls

A central concern in cross-domain anomaly detection is information leakage between training and evaluation. We enforce three levels of isolation, all derived from the leave-one-dataset-out design. Category-level isolation. The evaluation category never appears as a source domain during training, since the entire dataset it belongs to is excluded from DS . Dataset-level isolation. Categories within the same dataset share acquisition pipeline, lighting, sensor resolution, and annotation conventions. Excluding individual test categories while retaining 21

other categories from the same dataset would leak domain-specific appearance statistics into training. Our leave-one-dataset-out construction eliminates this. Support-set isolation. The few-shot reference images used at test time are drawn from the standard evaluation split of Dk and are not observed during training under any sampling scheme. Together, these conditions guarantee that performance on DT reflects genuine generalization from DS . A.3

Statistical Significance

NAGL and NAGL+DART results are averaged over three independent seeds controlling the few-shot reference sampling, with standard deviations consistently below 0.8% for I-AUROC and 0.5% for P-AUROC across all datasets and shot settings; the observed DART improvements (e.g., +0.39% I-AUROC on MVTec at N 1 , +1.82% on VisA at N 2 ) exceed these margins by a substantial factor. InCTRL and ResAD follow the single-run evaluation protocol of their original papers [10, 11]; for these backbones, robustness of DART gains is evidenced by their consistency across all shot settings and the majority of per-category results (Tables 8–25). A.4 A.4.1

Host Method Details InCTRL

InCTRL [10] adapts CLIP to the few-shot anomaly detection setting by modeling the in-context residual between a query image and normal sample prompts. Given a query image x and K normal prompts P = {p1 , . . . , pK }, the frozen CLIP visual encoder fv (·) produces patch token maps {Txl }nl=1 at each of its n transformer blocks. A patch-level residual map is computed at each layer: n

Mxl (i, j) = 1 − ⟨Txl (i, j), h(Txl (i, j) | P )⟩,

Mx =

1X l Mx n

(10)

l=1

where h(·|P ) retrieves the most similar patch embedding among P all prompts. An image-level residual 1 is obtained via a learnable adapter ψ: Fx = ψ(fv (x)) − K k ψ(fv (pk )). A classifier η scores this as si (x) = η(Fx ). A text-based score sa (x) is computed from CLIP text-image similarity. The final anomaly score combines all signals:
s(x) = ϕ Mx ⊕ si (x) ⊕ sa (x); Θϕ + α · max(Mx ) (11) A.4.2

ResAD

ResAD [11] computes residual features by subtracting the nearest normal reference for each patch, making the representation class-invariant. For each input image Ii , a frozen WideResNet-50 produces multi-layer feature maps ϕl (Ii ) ∈ RHl ×Wl ×Cl . The per-patch residual is: l ∗ xl,r h,w = xh,w − xn ,

x∗n = arg min ∥x − xlh,w ∥2 x∈Pl

(12)

A Feature Constraintor ψ(·; W) projects normal residuals onto a hypersphere via a log-barrier one-class loss: N K 1 X λX Locc = − log σ(−si ) · esi + ∥Wk ∥2F (13) N i=1 2 k=1

where si = ∥ψ(xi ; W)∥2 − R. A normalizing-flow estimator models the constrained feature distribution; anomalies are flagged as low-likelihood outliers. A VQ codebook mitigates train-test distribution mismatch. A.4.3

NAGL

NAGL [12] operates in the normal-abnormal guided setting, using residuals between abnormal and normal references as a transferable anomaly representation. Given query features F q , normal features F n , and abnormal features F a from a frozen ViT backbone, NAGL first computes a normalguided score via nearest-neighbor patch matching. The Residual Mining (RM) module computes 22

the abnormal–normal residual Res(F a , F n ) = F a − F∗n and uses learnable proxies P with crossattention and masked self-attention to produce residual proxies:     ⊤ ′ √ V , V = W V Res(F a , F n ) Pe = SA Softmax QK + M (14) d The Anomaly Feature Learning (AFL) module transfers these proxies onto the query via crossattention, producing anomaly proxies Pb that highlight abnormal regions. The final score fuses normal-guided and abnormal-guided maps. Training uses focal + dice loss for segmentation and BCE for classification. A.5

Clarification: Which Residual Does RDM Operate On?

A potential source of confusion arises from the role of the abnormal reference Fa in residual computation. We clarify this here. The residual r.

As shown in Fig. 2, the host residual operator computes r = R(fq ; Fn , Fa ),

(15)

where fq is the query feature and {Fn , Fa } are the normal and abnormal reference features. This single residual r is the input to RDM. The exact form of R is method-specific: NAGL and ResAD compute the abnormal-normal residual via patch-level nearest-neighbour subtraction of Fa against Fn , while InCTRL computes it as a patch-level cosine distance map and an image-level residual vector across transformer layers. In all cases, r encodes the deviation of the abnormal reference from the normal reference, and RDM receives this as input regardless of how the host method produces it, making DART a true plug-in framework. The role of Fa in r. Within R, Fn provides the normal baseline and Fa acts as a directional anchor, it encodes what anomaly looks like in the reference domain. Together, they orient r so that its magnitude and direction reflect how the query deviates from normal in the direction of the reference anomaly. This is precisely why r carries domain entanglement: both the transferable anomaly pattern and the domain-specific texture of Fa are embedded in r. What RDM does. RDM receives r and decomposes it into a domain-invariant anomaly component ra and a domain-specific component rd , such that G([ra ; rd ]) ≈ r. Only ra is passed to the host detection head, discarding the domain texture that would otherwise cause false activations on unseen domains. This decomposition is the core contribution of DART and is what enables consistent cross-domain gains across all three host methods. The information-theoretic objective max I(ra ; Y ) is meaningful because the anomaly label Y of the query xq varies across episodes, and ra must retain sufficient anomaly information from the reference to correctly classify the query, while shedding the domain-specific signal in rd . A.6

Discussion

Limitations. DART requires at least one abnormal reference sample at test time, which may not always be available in zero-shot scenarios; our experiments also focus solely on image data, and extension to video or time-series modalities remains future work. Social Impacts. As a plug-in framework for generalist anomaly detection, DART does not raise specific ethical issues or adverse societal effects. All datasets used are publicly available. Qualitative illustrations are derived from industrial product imagery and medical imaging benchmarks, ensuring no violation of personal privacy. A.7

VisA Domain Entanglement Analysis

To empirically validate that residual domain entanglement is the core bottleneck addressed by DART, we visualize the token-level residual space using t-SNE on VisA at k=2 shots (Figure 4). Without DART, residuals form tight clusters organized by domain identity rather than anomaly semantics, confirming that the normal–abnormal difference vector carries substantial domain texture 23

(a) Without DART: clusters by domain identity

(b) With DART: clusters by anomaly type

Figure 4: t-SNE visualization of token-level residuals on VisA at k=2. (a) Without DART, each category occupies a distinct region, indicating domain texture dominates. (b) With DART, defects of the same semantic type cluster together across domains.

information. With DART, RDM strips the domain-specific component: residuals reorganize into clusters aligned with defect type, grouping semantically similar anomalies across object categories. VisA exhibits particularly strong domain entanglement due to its high intra-class visual variance (structurally complex objects such as PCBs and food items), directly explaining why DART yields larger performance gains on VisA than on MVTec AD. A.8

Disentanglement Analysis: Vanilla vs. +Inv vs. +DART

Table 6 provides the full vanilla/+Inv/+DART breakdown for all three host methods on MVTec AD and VisA across all shot settings (N 1 through N 4 ), extending the mean-level +Inv comparison now included in Table 2 of the main paper with all twelve metrics and per-metric directional markers. Naive abnormal integration (+Inv) is consistently harmful. Across all three host methods, the +Inv baseline, which incorporates abnormal references without disentanglement, degrades performance relative to vanilla in the majority of settings. The damage is most severe for ResAD, where +Inv drops I-AUROC by −3.0% on MVTec AD and −6.5% on VisA at N 1 , with pixel-level PRO degrading by up to −6.0 points. For InCTRL, +Inv is inconsistent: it provides marginal image-level gains at low shots (N 1 : +0.42%, N 2 : +0.67%) but degrades at higher shots (N 4 : −1.22%). Crucially, +Inv never produces pixel-level metrics for InCTRL, the entangled abnormal residuals generate spatially incoherent activations that prevent meaningful localization. These results confirm our core hypothesis: raw abnormal references carry domain-entangled information that corrupts rather than aids cross-domain detection. DART consistently recovers and exceeds vanilla performance. In contrast to +Inv, DART improves over vanilla across all three host methods in the large majority of metrics and settings. On InCTRL, DART achieves +0.56% to +1.15% I-AUROC gains on MVTec AD across all shots, while simultaneously enabling pixel-level localization (P-AUROC 94.52–95.71%) that is entirely absent in both vanilla and +Inv. On ResAD, DART recovers the performance destroyed by +Inv and exceeds vanilla (e.g., +0.50% I-AUROC, +1.80% I-AP on VisA at N 2 ). On NAGL, which already handles abnormal references natively, DART provides consistent image-level gains on both datasets (up to +1.82% I-AUROC on VisA at N 2 ), with pixel-level metrics remaining competitive or improving. The gap between +Inv and +DART widens with domain shift. On MVTec AD (where the VisA-trained model transfers to a moderately different industrial domain), the +Inv→+DART gap is moderate. On VisA (where the MVTec-trained model faces a larger domain shift), the gap widens substantially: for example, InCTRL+Inv drops to 79.87% I-AUROC at N 1 while InCTRL+DART 24

Table 6: Full disentanglement analysis on MVTec AD and VisA. Three variants per host method: vanilla (normal only), +Inv (naive abnormal addition without RDM), +DART (with RDM). ↑/↓: vs. vanilla. MVTec AD Image-level Setting

N 1 +A1

N 2 +A1

N 4 +A1

VisA Pixel-level

Image-level

Pixel-level

Method

AUROC

AP

F1

AUROC

PRO

F1

AUROC

AP

F1

AUROC

PRO

F1

NAGL NAGL+DART

95.54 95.93 ↑

97.63 97.95 ↑

95.40 95.76 ↑

96.53 96.51 ↓

92.66 92.88 ↑

58.03 58.37 ↑

86.23 87.65 ↑

86.54 88.00 ↑

84.59 84.25 ↓

97.20 97.21 ↑

88.76 88.77 ↑

42.41 41.25 ↓

InCTRL InCTRL+Inv InCTRL+DART

94.99 95.41 95.55 ↑

97.33 97.72 97.74 ↑

95.07 94.97 95.21 ↑

– – 94.52

– – 85.23

– – 51.16

85.47 79.87 86.06 ↑

55.65 55.37 60.10 ↑

60.04 57.95 63.31 ↑

– – 95.44

– – 69.15

– – 27.24

ResAD ResAD+Inv ResAD+DART

85.70 82.70 85.90 ↑

93.10 91.10 93.10

90.90 89.90 90.30 ↓

94.40 93.20 94.10 ↓

84.50 81.00 84.00 ↓

49.80 46.60 50.30 ↑

81.20 74.70 81.70 ↑

82.50 76.70 84.30 ↑

81.20 78.20 81.50 ↑

95.20 94.00 95.40 ↑

78.80 72.80 78.20 ↓

33.30 25.30 28.50 ↓

NAGL NAGL+DART

96.61 96.62 ↑

98.11 98.15 ↑

96.10 96.20 ↑

96.63 96.64 ↑

93.13 93.13

59.20 59.22 ↑

87.90 89.72 ↑

89.03 89.16 ↑

85.15 86.21 ↑

97.34 97.29 ↓

89.25 89.07 ↓

44.06 42.65 ↓

InCTRL InCTRL+Inv InCTRL+DART

95.06 95.73 96.21 ↑

97.55 97.88 98.12 ↑

95.76 95.33 95.32 ↓

– – 94.81

– – 85.65

– – 52.37

87.96 81.41 88.64 ↑

58.67 56.55 63.72 ↑

63.61 57.96 65.73 ↑

– – 96.37

– – 70.45

– – 28.04

ResAD ResAD+Inv ResAD+DART

87.60 84.90 88.10 ↑

94.10 92.20 94.30 ↑

91.70 90.10 91.80 ↑

95.30 94.20 95.00 ↓

86.30 83.10 85.50 ↓

51.60 48.10 52.10 ↑

83.20 77.60 83.40 ↑

84.20 79.80 85.60 ↑

82.20 78.90 82.40 ↑

95.90 94.70 96.20 ↑

80.40 75.30 80.80 ↑

37.40 28.60 32.40 ↓

NAGL NAGL+DART

97.08 97.34 ↑

98.34 98.46 ↑

96.37 96.52 ↑

96.68 96.76 ↑

93.29 93.39 ↑

59.77 60.03 ↑

90.30 91.29 ↑

90.70 90.94 ↑

87.03 87.87 ↑

97.44 97.45 ↑

89.64 89.99 ↑

44.86 43.56 ↓

InCTRL InCTRL+Inv InCTRL+DART

95.41 94.19 95.64 ↑

97.44 97.43 97.76 ↑

95.95 94.46 96.08 ↑

– – 95.52

– – 86.22

– – 53.31

89.16 80.29 90.14 ↑

63.67 55.49 69.95 ↑

67.92 55.48 70.05 ↑

– – 96.92

– – 71.18

– – 29.47

ResAD ResAD+Inv ResAD+DART

89.90 87.40 89.90

95.10 93.50 95.10

92.50 91.00 92.50

95.90 94.90 95.60 ↓

87.50 84.80 86.80 ↓

53.40 49.30 53.70 ↑

87.00 82.00 87.90 ↑

87.90 83.40 89.30 ↑

84.60 81.30 85.70 ↑

96.40 95.80 96.70 ↑

82.80 79.00 83.10 ↑

39.50 31.70 35.20 ↓

reaches 86.06%, a gap of +6.19 points. This scaling behavior directly validates that residual disentanglement becomes increasingly critical as the domain gap grows. A.9

BraTS Disentanglement Analysis

Table 7a provides the full vanilla/+Inv/+DART breakdown on the MVTec AD → BraTS transfer, the most extreme domain shift in our evaluation (industrial defects → brain tumor MRI). The industrial-to-medical gap amplifies both the problem and the solution. On BraTS, the +Inv baseline is again unreliable: InCTRL+Inv provides partial gains at N 1 (+3.77% I-AUROC) but degrades sharply at N 4 (−3.58%), while ResAD+Inv is consistently neutral or harmful (−2.20% at N 2 , −1.90% at N 4 ). DART, in contrast, produces substantially larger gains than on industrial benchmarks. InCTRL+DART improves by +13.28% I-AUROC at N 1 (65.20% → 78.48%) and +7.61% at N 4 (69.89% → 77.50%), representing the largest absolute improvements across all our experiments. ResAD+DART improves by +5.20% at N 2 and +3.10% at N 4 . NAGL+DART improves consistently at N 2 (+0.25%) and N 4 (+0.99%). Why are BraTS gains so much larger? The industrial-to-medical domain shift is qualitatively different from inter-industrial transfer: the visual appearance, texture statistics, imaging modality, and anomaly semantics all change simultaneously. In this regime, domain-specific information in the residual is not merely unhelpful but actively misleading, industrial texture patterns have no correspondence in MRI data and generate pure noise in the anomaly map. Disentanglement removes this noise entirely, leaving only the domain-agnostic anomaly semantics (structural irregularity, boundary disruption, intensity deviation) that transfer across the modality boundary. The magnitude of improvement directly reflects the magnitude of domain entanglement removed. NAGL+DART at N 1 on BraTS. The one setting where DART underperforms on BraTS is NAGL+DART at N 1 , where the mean metric drops from 84.66 to 83.35. This is attributable to a pixel-level AUROC drop (93.00 → 90.33) while the image-level metric improves slightly (76.32 → 76.36). We hypothesize that with only a single normal reference, NAGL’s RM module, which already performs its own residual processing, has insufficient signal for RDM to learn a stable decomposition on this extreme domain shift. At N 2 and above, where additional references stabilize the residual computation, DART consistently improves NAGL on BraTS. 25

Table 7: BraTS disentanglement analysis and notation reference. (a) BraTS disentanglement analysis (MVTec AD → BraTS). I/P/M: image-/pixel-level AUROC and their mean. ↑/↓: vs. vanilla. Setting

Method NAGL NAGL+DART

I

P

M

76.32 93.00 84.66 76.36 ↑ 90.33 ↓ 83.35 ↓

InCTRL 65.20 83.65 74.43 68.97 87.45 78.21 N 1 +A1 InCTRL+Inv InCTRL+DART 78.48 ↑ 87.67 ↑ 83.08 ↑ ResAD ResAD+Inv ResAD+DART

72.30 93.40 82.85 71.70 94.20 82.95 75.70 ↑ 93.60 ↑ 84.65 ↑

NAGL NAGL+DART

76.85 89.57 83.21 77.10 ↑ 89.95 ↑ 83.53 ↑

InCTRL 59.80 87.28 73.54 63.79 89.24 76.52 N 2 +A1 InCTRL+Inv InCTRL+DART 64.11 ↑ 92.20 ↑ 78.16 ↑ ResAD ResAD+Inv ResAD+DART

66.20 93.30 79.75 64.00 93.20 78.60 71.40 ↑ 93.80 ↑ 82.60 ↑

NAGL NAGL+DART

78.29 93.33 85.81 79.28 ↑ 92.54 ↓ 85.91 ↑

(b) Notation reference. Symbol

Meaning

r Raw residual (before disentanglement) ra Domain-agnostic anomaly component rd Domain-specific component (discarded) Ea Anomaly encoder (transformer block) Ed Domain encoder (MLP) G Reconstruction decoder Cd Domain classifier with GRL Lsuf Anomaly sufficiency loss Ladv Adversarial domain confusion loss Lrecon Reconstruction loss λadv Weight for Ladv (= 0.1) λrecon Weight for Lrecon (= 0.5) α(t) GRL strength (DANN schedule) pcross (t) Cross-domain episode probability Tw Warmup epochs (= 5) Di Reference domain in CDMT episode Dj Query domain in CDMT episode DS Source domain pool DT Target domain (held out) k Normal references (∈ {1, 2, 4})

InCTRL 69.89 90.06 79.98 66.31 88.36 77.34 N 4 +A1 InCTRL+Inv InCTRL+DART 77.50 ↑ 93.85 ↑ 85.68 ↑ ResAD ResAD+Inv ResAD+DART

A.10

69.50 93.40 81.45 67.60 93.10 80.35 72.60 ↑ 93.90 ↑ 83.25 ↑

Notation Reference

For clarity, we provide a unified notation reference in Table 7b. The listed symbols are used consistently throughout the paper and supplement. A.11

Additional Results

We provide per-category breakdowns for all three host methods (InCTRL, ResAD, and NAGL) across MVTecAD and VisA datasets for 1, 2, 4 shot settings. For each method, we report results for the vanilla baseline, the naive abnormal reference variant (+Inv), and our proposed DART variant (+DART). All metrics are reported as percentages.

26

Table 8: Per-category MVTecAD results for InCTRL variants, N 1 + A1 (1-shot) setting. Pixel-level metrics reported only for InCTRL+DART. InCTRL

Category

InCTRL+Inv

InCTRL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

99.92 94.13 84.08 99.96 98.33 99.64 100.00 100.00 94.19 73.68 99.86 96.11 86.88 99.21 98.84

99.98 96.72 94.23 99.99 99.53 99.80 100.00 100.00 98.85 87.51 99.94 98.54 85.31 99.78 99.73

99.21 90.40 92.51 99.44 98.25 97.81 100.00 100.00 96.06 86.47 98.82 93.33 76.71 98.33 98.72

-

-

-

99.60 89.51 93.26 99.96 98.75 97.32 100.00 96.92 90.40 81.35 98.74 95.28 91.92 98.95 99.24

99.88 94.53 98.54 99.99 99.63 98.77 100.00 99.33 97.40 92.30 99.61 98.30 88.04 99.71 99.83

98.44 86.90 94.64 99.44 99.12 95.65 100.00 96.17 95.07 87.94 98.18 93.33 82.22 98.33 99.15

-

-

-

99.68 90.69 92.58 99.96 99.00 97.57 100.00 97.07 90.78 84.79 98.81 91.67 92.38 99.12 99.19

99.90 94.94 98.13 99.99 99.69 98.89 100.00 99.36 97.54 93.88 99.64 96.18 88.33 99.75 99.82

98.44 86.86 95.07 99.44 99.12 97.06 100.00 96.17 95.41 88.03 98.80 93.33 83.33 98.33 98.73

97.68 94.32 92.54 99.32 97.68 98.45 99.31 87.59 93.90 91.48 95.62 97.39 87.10 95.26 90.10

89.63 83.49 81.35 97.18 91.47 89.52 96.95 85.95 93.35 73.32 86.20 78.99 64.62 89.90 76.53

68.43 59.66 32.51 70.91 35.77 59.31 52.06 52.40 57.96 20.35 68.30 49.77 40.87 63.51 35.61

mean

94.99

97.33

95.07

-

-

-

95.41

97.72

94.97

-

-

-

95.55

97.74

95.21

94.52

85.23

51.16

Table 9: Per-category MVTecAD results for InCTRL variants, N 2 + A1 (2-shot) setting. Pixel-level metrics reported only for InCTRL+DART. InCTRL

Category

InCTRL+Inv

InCTRL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

99.84 94.06 81.85 99.92 98.33 99.89 100.00 100.00 94.24 71.70 99.89 97.22 90.25 99.30 99.45

99.95 96.73 93.41 99.97 99.53 99.94 100.00 100.00 98.80 86.53 99.96 98.93 89.89 99.80 99.86

99.20 90.80 92.44 99.44 98.25 99.29 100.00 100.00 95.44 86.69 98.82 95.08 83.54 99.16 98.31

-

-

-

99.76 90.37 91.70 99.96 98.83 97.61 100.00 98.53 92.80 80.63 99.49 94.72 92.54 99.21 99.76

99.93 94.96 98.26 99.99 99.65 98.90 100.00 99.69 98.55 92.01 99.83 98.24 88.47 99.78 99.94

98.44 86.32 92.64 99.44 99.12 97.06 100.00 97.87 94.74 87.69 99.40 94.92 84.78 98.33 99.15

-

-

-

99.68 91.47 92.90 99.96 99.16 97.82 100.00 98.68 92.39 84.65 99.60 94.17 93.79 99.21 99.68

99.90 95.42 98.49 99.99 99.74 99.00 100.00 99.72 98.44 93.79 99.86 98.02 89.79 99.78 99.92

98.44 87.43 94.06 99.44 99.12 97.06 100.00 97.87 94.41 87.90 99.40 93.33 83.87 98.33 99.15

97.47 94.19 92.41 99.30 97.86 98.69 99.32 90.51 93.87 90.71 95.68 98.14 88.36 95.14 90.52

89.01 82.93 82.87 96.61 92.33 90.28 96.86 88.10 93.89 71.16 86.72 78.94 66.41 89.80 78.86

68.12 59.06 31.38 69.58 36.19 63.91 52.25 60.69 58.07 19.50 67.70 51.98 43.27 60.78 43.02

mean

95.06

97.55

95.76

-

-

-

95.73

97.88

95.33

-

-

-

96.21

98.12

95.32

94.81

85.65

52.37

Table 10: Per-category MVTecAD results for InCTRL variants, N 4 + A1 (4-shot) setting. Pixel-level metrics reported only for InCTRL+DART. InCTRL

Category

InCTRL+Inv

InCTRL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

100.00 94.55 81.09 99.96 98.83 99.71 100.00 100.00 95.42 78.44 100.00 95.83 89.12 98.60 99.61

100.00 97.09 89.53 99.99 99.65 99.83 100.00 100.00 99.08 91.22 100.00 98.37 87.27 99.59 99.90

100.00 91.71 93.58 99.44 99.12 99.29 100.00 100.00 96.86 87.69 100.00 94.92 80.00 97.44 99.15

-

-

-

99.84 90.03 76.43 100.00 98.41 96.54 100.00 97.26 91.84 83.56 99.28 90.00 91.62 98.25 99.71

99.95 94.83 94.61 100.00 99.46 98.18 100.00 99.38 98.44 94.42 99.77 96.40 86.48 99.52 99.93

99.21 87.72 90.46 100.00 96.49 97.10 100.00 96.26 93.33 87.41 99.40 89.29 82.76 98.31 99.15

-

-

-

99.92 93.02 82.14 100.00 98.83 98.82 100.00 97.75 89.83 88.71 99.35 95.50 92.96 99.04 99.55

99.98 95.32 95.60 100.00 99.61 98.32 100.00 99.50 97.32 94.94 99.79 97.36 89.08 99.72 99.89

99.21 91.64 92.46 100.00 98.21 98.10 100.00 98.81 95.43 89.73 99.40 95.10 84.72 98.31 99.15

97.71 94.67 91.88 99.24 98.19 98.99 99.33 92.10 94.29 93.94 95.64 98.05 91.18 95.30 92.24

89.12 83.46 84.46 96.42 92.88 92.86 96.89 89.42 93.67 74.60 85.54 77.13 68.45 88.64 79.82

68.98 60.02 36.29 67.11 37.96 66.11 52.48 64.50 57.96 13.87 67.31 52.38 49.01 61.42 44.19

mean

95.41

97.44

95.95

-

-

-

94.19

97.43

94.46

-

-

-

95.64

97.76

96.08

95.52

86.22

53.31

Table 11: Per-category VisA results for InCTRL variants, N 1 + A1 (1-shot) setting. Pixel-level metrics reported only for InCTRL+DART. InCTRL

Category

InCTRL+Inv

InCTRL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

83.40 67.76 91.00 97.09 95.40 83.12 75.74 87.45 80.29 71.48 96.50 96.38

39.46 49.66 74.09 93.75 89.32 48.23 36.27 35.80 24.00 21.47 69.85 85.87

48.57 51.61 67.86 88.89 85.71 54.90 44.12 47.46 37.21 34.09 81.82 78.26

-

-

-

80.79 67.94 89.50 99.23 77.10 82.19 70.33 92.79 60.39 51.11 98.28 88.76

65.08 49.20 78.55 97.00 65.86 41.06 30.90 58.62 12.42 11.02 87.44 67.24

65.38 51.43 72.00 90.48 66.67 45.83 41.03 58.33 20.74 19.82 87.50 76.19

-

-

-

85.60 66.45 86.63 96.41 94.50 84.17 80.81 86.81 80.29 76.91 96.53 97.57

53.64 35.86 65.56 90.20 86.29 63.13 59.80 34.97 23.78 39.97 74.22 93.77

53.97 41.86 60.00 86.96 82.93 64.86 65.00 48.28 37.21 47.37 81.82 89.47

98.61 92.84 98.38 98.92 92.46 96.35 94.19 97.23 93.25 91.34 92.35 99.39

88.59 56.32 77.92 79.07 72.27 74.84 75.10 68.78 51.19 53.18 45.83 86.67

26.32 27.16 34.23 50.84 30.28 21.63 16.56 28.06 8.58 28.48 10.05 44.68

mean

85.47

55.65

60.04

-

-

-

79.87

55.37

57.95

-

-

-

86.06

60.10

63.31

95.44

69.15

27.24

27

Table 12: Per-category VisA results for InCTRL variants, N 2 + A1 (2-shot) setting. Pixel-level metrics reported only for InCTRL+DART. InCTRL

Category

InCTRL+Inv

InCTRL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

81.85 71.18 91.71 97.41 97.65 83.52 83.40 90.90 80.76 86.21 96.40 94.48

29.84 51.13 76.04 94.40 91.89 44.58 39.57 46.36 27.96 53.72 67.66 80.90

47.50 50.00 73.47 90.91 87.80 57.14 50.00 52.46 41.86 60.00 78.95 73.17

-

-

-

89.35 71.84 89.75 99.27 80.90 78.60 75.26 93.86 57.05 54.86 98.28 87.90

73.72 50.37 78.32 97.18 69.93 37.75 27.90 61.64 11.12 15.93 86.23 68.52

72.73 51.43 73.47 90.91 70.59 46.15 34.78 62.22 19.29 20.00 83.08 70.83

-

-

-

87.44 70.00 91.54 97.05 95.15 85.93 88.29 90.33 80.79 82.70 96.38 98.05

55.53 35.82 80.59 92.27 87.86 63.44 66.41 44.18 27.90 49.80 67.59 93.29

58.06 42.86 72.34 87.50 87.18 61.11 65.00 50.75 41.86 55.32 78.95 87.80

98.41 94.73 98.34 98.81 94.48 96.38 96.23 97.88 93.47 94.11 94.07 99.51

88.24 58.37 77.06 77.89 76.12 77.73 76.13 68.13 50.86 58.13 50.22 86.54

25.93 26.11 34.73 50.97 33.65 21.63 15.01 29.69 9.54 29.04 12.91 47.31

mean

87.96

58.67

63.61

-

-

-

81.41

56.55

57.96

-

-

-

88.64

63.72

65.73

96.37

70.45

28.04

Table 13: Per-category VisA results for InCTRL variants, N 4 + A1 (4-shot) setting. Pixel-level metrics reported only for InCTRL+DART. InCTRL

Category

InCTRL+Inv

InCTRL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

78.37 73.64 90.71 97.09 97.80 92.55 89.33 93.83 83.61 78.77 97.16 97.10

23.08 50.80 78.60 88.34 94.26 67.87 49.31 56.89 48.95 40.89 78.53 86.54

43.14 48.48 73.17 93.33 88.89 66.67 63.83 59.02 63.16 54.55 80.00 80.77

-

-

-

88.98 66.23 89.38 93.36 89.90 61.43 78.55 93.69 51.55 60.18 98.14 92.14

71.93 41.34 77.17 90.76 81.73 23.53 31.14 62.79 8.99 12.19 84.49 79.88

66.67 41.38 71.70 86.36 76.92 23.40 40.82 57.14 18.29 23.76 84.85 74.42

-

-

-

88.81 73.46 90.62 98.00 96.10 92.57 90.14 93.60 83.68 79.15 97.18 98.33

56.61 48.39 80.08 96.79 91.63 67.80 71.54 56.50 49.31 48.09 79.07 93.58

54.55 48.48 71.11 95.45 86.49 66.67 73.68 57.89 64.86 53.57 80.00 87.80

98.60 94.58 98.16 98.81 95.95 96.92 96.88 98.31 93.98 95.06 96.24 99.53

88.32 58.90 77.19 77.97 72.60 80.02 75.77 70.29 55.53 56.23 53.97 87.32

25.18 26.80 35.25 52.46 36.45 19.12 18.57 33.59 11.50 31.49 15.90 47.34

mean

89.16

63.67

67.92

-

-

-

80.29

55.49

55.48

-

-

-

90.14

69.95

70.05

96.92

71.18

29.47

Table 14: Per-category MVTecAD results for ResAD variants, N 1 + A1 (1-shot) setting. ResAD

ResAD+Inv

ResAD+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

100.00 79.20 78.30 99.72 77.94 83.93 100.00 87.00 91.84 47.28 99.21 74.72 78.00 99.21 88.68

100.00 87.47 94.44 99.91 91.28 91.79 100.00 96.81 98.43 74.59 99.70 89.86 76.92 99.77 95.70

100.00 82.24 93.56 98.86 87.69 84.44 100.00 91.63 95.41 85.61 97.01 86.96 68.24 98.30 93.98

98.65 93.06 97.80 99.28 83.14 97.70 99.35 96.73 97.26 94.02 95.57 97.13 74.91 95.25 96.73

96.06 73.38 91.61 96.57 64.08 84.99 97.98 86.22 95.81 79.64 85.72 74.27 62.62 89.72 88.30

76.37 34.87 44.26 65.32 23.34 55.62 49.21 78.25 65.07 4.69 63.39 52.40 33.11 55.07 46.63

99.52 79.87 77.58 95.87 72.77 88.11 100.00 74.29 87.37 48.68 98.34 68.61 64.46 99.30 85.90

99.84 87.83 94.56 98.77 86.23 94.12 100.00 92.82 97.28 75.54 99.41 86.39 59.53 99.80 94.88

99.21 80.21 91.30 95.46 87.02 87.59 100.00 91.18 93.43 85.61 97.01 85.71 63.74 99.16 92.61

98.83 90.52 97.72 98.52 79.00 97.98 99.40 95.36 97.26 91.94 93.02 95.93 72.37 94.50 95.08

95.63 69.03 89.86 93.93 55.30 86.26 98.15 76.35 96.19 72.78 81.65 70.27 59.60 87.13 83.51

78.45 27.24 45.86 59.03 17.13 61.99 51.46 70.07 65.36 3.45 58.55 37.84 31.33 53.89 38.05

100.00 81.09 81.65 99.32 82.21 77.18 99.93 86.12 91.93 50.58 99.24 70.83 79.71 98.77 90.34

100.00 88.36 95.40 99.80 92.99 88.03 99.98 96.49 98.48 76.15 99.71 87.62 77.57 99.64 96.47

100.00 81.31 92.37 97.75 88.00 79.41 99.45 91.63 94.37 85.61 97.01 85.71 70.10 97.44 94.17

98.70 93.25 97.83 99.25 81.35 97.45 99.40 96.51 97.47 94.63 95.79 96.00 73.46 94.90 95.98

96.27 75.29 92.01 96.58 64.97 81.39 97.90 86.23 95.89 81.30 86.27 71.48 61.92 86.78 85.98

77.18 37.91 45.06 66.91 24.04 56.96 53.33 78.49 66.33 7.23 67.61 42.09 31.10 56.78 44.21

mean

85.67

93.11

90.93

94.44

84.46

49.84

82.71

91.13

89.95

93.16

81.04

46.65

85.93

93.11

90.29

94.13

84.02

50.35

Table 15: Per-category MVTecAD results for ResAD variants, N 2 + A1 (2-shot) setting. ResAD

ResAD+Inv

ResAD+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

99.92 80.38 83.21 99.76 83.46 83.75 100.00 88.42 92.74 52.04 99.53 73.06 86.50 99.30 91.96

99.98 88.10 95.77 99.93 93.17 91.95 100.00 97.10 98.60 74.46 99.82 88.98 86.57 99.79 97.01

99.21 83.18 92.98 98.86 88.71 81.54 100.00 92.54 95.41 85.61 97.67 88.23 76.71 98.33 96.69

98.76 93.97 98.33 99.27 87.53 98.13 99.37 96.97 97.51 95.13 95.64 97.19 79.28 95.26 97.88

96.39 76.69 93.15 96.46 71.09 87.65 98.01 87.20 96.20 82.76 85.93 74.64 64.98 90.44 92.40

77.40 38.62 44.60 65.03 23.31 57.51 49.42 79.16 65.67 8.04 63.67 54.25 37.45 55.21 54.12

99.44 81.99 85.04 97.39 83.29 87.36 100.00 77.96 89.47 47.57 98.63 69.17 64.79 99.39 91.67

99.82 88.89 96.46 99.24 93.40 93.69 100.00 94.08 97.81 74.20 99.47 86.37 63.04 99.83 97.21

99.21 81.67 92.51 96.59 88.00 83.66 100.00 91.54 94.16 85.61 96.47 88.23 59.79 99.16 94.69

98.88 91.99 98.30 98.69 83.28 98.41 99.41 95.87 97.60 93.11 93.51 95.79 75.91 94.71 97.04

95.71 73.10 92.25 94.67 60.24 88.57 98.14 78.87 96.47 75.96 83.17 69.97 62.39 87.50 89.60

78.87 29.94 48.25 59.33 14.73 63.78 50.77 73.00 66.40 4.39 59.44 37.43 33.82 54.07 48.00

100.00 85.98 86.28 99.24 87.80 77.68 100.00 87.68 92.06 53.00 99.53 71.11 88.12 98.95 93.38

100.00 91.27 96.68 99.78 95.42 88.08 100.00 97.05 98.50 76.40 99.82 87.81 86.09 99.67 97.74

100.00 83.65 93.21 98.30 90.91 80.25 100.00 92.00 94.70 85.61 98.20 88.23 78.65 98.33 95.51

98.80 93.97 98.35 99.24 84.75 97.97 99.45 96.83 97.67 95.43 95.85 96.10 77.96 94.99 97.64

96.71 77.97 93.37 96.54 65.16 85.15 98.15 87.51 96.17 83.68 86.59 71.91 64.21 87.89 91.49

78.27 40.42 45.49 66.59 24.39 58.26 53.41 79.45 66.82 10.55 67.22 44.96 35.57 56.69 53.34

mean

87.60

94.08

91.71

95.35

86.27

51.56

84.88

92.23

90.09

94.17

83.11

48.15

88.05

94.29

91.84

95.00

85.50

52.10

28

Table 16: Per-category MVTecAD results for ResAD variants, N 4 + A1 (4-shot) setting. ResAD

ResAD+Inv

ResAD+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

99.76 84.58 89.51 99.72 90.48 88.79 100.00 93.94 91.65 56.61 99.60 73.06 88.67 99.30 92.75

99.92 90.54 97.40 99.91 96.48 94.10 100.00 98.61 98.40 76.03 99.84 88.94 88.58 99.79 97.51

99.21 85.18 94.22 98.32 90.00 85.16 100.00 93.12 94.81 85.61 98.25 88.23 81.08 98.33 95.87

98.81 95.04 98.53 99.23 91.17 98.40 99.37 98.17 97.58 95.96 95.86 96.95 79.92 95.24 98.10

96.46 79.48 93.45 96.22 75.78 89.76 98.16 91.98 96.41 85.02 86.35 74.16 66.03 89.98 92.76

77.62 45.04 47.20 64.06 30.55 59.67 49.22 84.39 66.25 11.36 64.31 52.11 37.83 55.37 55.88

99.44 82.74 86.84 97.35 90.48 92.57 100.00 89.25 89.66 53.39 98.49 68.06 68.63 99.47 94.09

99.82 89.37 96.94 99.21 96.18 96.13 100.00 97.34 97.87 76.00 99.42 85.55 69.89 99.85 98.23

99.21 80.79 94.32 96.59 92.44 88.73 100.00 91.84 94.12 86.23 97.01 88.23 61.36 99.16 94.96

98.89 93.17 98.58 98.48 87.91 98.51 99.42 97.78 97.75 94.26 93.36 95.45 77.10 94.73 97.40

95.90 75.25 92.90 93.82 68.39 90.25 98.09 87.54 96.65 79.22 82.96 69.49 63.60 87.52 90.80

78.83 32.99 48.54 57.59 19.93 64.56 50.93 81.14 67.37 5.32 58.53 34.57 34.57 54.19 50.63

100.00 86.73 91.62 99.28 92.40 84.64 100.00 92.86 92.31 56.22 99.68 70.83 88.96 98.77 93.75

100.00 91.88 97.97 99.79 97.08 92.05 100.00 98.34 98.56 77.01 99.87 87.45 88.54 99.62 97.98

100.00 83.17 94.74 98.30 92.56 83.97 100.00 93.55 95.04 85.61 98.81 88.23 81.08 97.52 95.55

98.88 95.03 98.54 99.20 89.29 98.30 99.45 98.07 97.74 96.19 96.13 95.76 78.63 94.96 97.92

96.72 80.84 93.75 96.23 69.78 88.04 98.13 91.63 96.35 85.76 86.76 71.46 65.34 87.50 93.04

78.71 45.98 47.40 65.59 28.21 60.41 53.49 84.53 67.41 12.45 67.99 44.06 36.33 56.75 55.48

mean

89.89

95.07

92.49

95.89

87.47

53.39

87.36

93.45

91.00

94.85

84.83

49.31

89.87

95.08

92.54

95.61

86.76

53.65

Table 17: Per-category VisA results for ResAD variants, N 1 + A1 (1-shot) setting. ResAD

ResAD+Inv

ResAD+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

86.25 70.74 91.08 97.48 77.49 79.49 70.18 79.60 61.91 70.21 93.64 96.42

84.83 78.74 95.16 97.88 88.50 82.04 67.47 74.29 58.42 71.74 91.99 97.46

80.24 78.75 87.53 95.22 81.64 73.86 72.13 78.42 68.60 70.05 90.87 94.73

98.26 95.32 96.22 98.49 90.67 97.84 95.84 96.48 92.31 94.00 89.60 96.87

93.44 76.09 89.72 82.33 70.89 85.67 79.89 74.55 63.49 70.91 65.45 92.28

32.97 29.60 41.13 64.47 35.00 29.36 6.87 52.58 16.36 36.39 17.23 47.71

85.09 58.38 93.18 95.56 70.34 64.87 65.72 66.23 60.59 69.16 73.23 93.62

84.29 73.05 96.86 98.10 83.46 68.08 61.91 59.42 59.81 69.39 69.04 97.08

80.67 76.92 90.45 93.94 81.15 68.49 71.21 73.00 68.18 70.42 72.41 91.28

98.20 95.33 95.85 98.38 90.31 95.09 93.35 93.72 92.56 94.12 84.62 96.61

93.76 60.69 89.31 75.58 67.66 71.58 70.40 72.53 64.18 63.52 52.46 91.87

27.06 28.89 38.56 55.96 31.89 12.32 2.42 19.10 8.90 28.99 7.40 42.57

89.19 58.62 93.12 98.30 76.78 76.49 77.69 84.78 66.62 70.70 91.92 96.70

88.35 68.84 96.68 99.27 88.38 80.76 78.64 81.47 68.60 70.32 91.92 98.48

84.00 76.98 91.79 96.41 82.01 70.74 75.81 81.98 68.46 71.21 84.65 94.42

98.96 94.13 97.53 98.96 90.68 97.87 96.71 95.26 92.49 94.05 90.09 97.87

95.14 71.42 90.83 82.17 70.72 82.44 84.24 70.92 63.54 67.89 65.66 93.82

29.39 18.78 45.43 54.46 31.02 20.71 9.34 24.51 15.40 26.55 16.64 49.79

mean

81.21

82.38

81.00

95.16

78.73

34.14

74.66

76.71

78.18

94.01

72.80

25.34

81.74

84.31

81.54

95.38

78.23

28.50

Table 18: Per-category VisA results for ResAD variants, N 2 + A1 (2-shot) setting. ResAD

ResAD+Inv

ResAD+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

84.83 73.19 91.83 97.53 82.05 83.13 65.87 79.47 67.93 82.60 93.95 96.59

82.11 82.16 95.37 97.81 90.31 84.73 67.10 73.99 64.74 82.54 92.50 97.31

81.59 79.27 88.25 95.54 83.23 77.05 67.28 80.55 68.35 77.86 93.29 94.04

98.35 97.18 96.48 98.62 90.92 98.22 95.95 96.72 93.74 95.13 91.56 97.19

93.35 80.27 90.40 81.91 71.48 88.10 79.54 74.59 67.37 76.69 68.76 92.41

31.24 49.36 42.10 64.10 36.17 30.23 8.27 51.98 30.19 39.70 18.71 46.76

83.63 67.37 94.08 98.36 68.66 68.94 66.46 66.65 65.50 76.28 82.17 93.52

82.18 77.79 97.47 99.24 84.15 72.08 63.82 59.89 63.26 78.25 82.09 96.91

78.22 77.22 91.01 95.10 81.33 69.50 70.69 74.42 69.89 73.02 76.73 90.15

98.23 96.24 96.47 98.44 90.65 95.72 93.10 94.29 94.22 95.71 86.97 96.88

93.59 62.53 90.91 76.59 70.59 76.17 69.62 73.24 66.66 73.09 58.38 92.52

25.66 39.99 41.06 57.14 33.21 14.23 1.74 20.36 16.87 37.83 12.29 42.55

86.53 66.88 95.18 98.68 72.38 82.75 73.64 83.14 73.68 75.73 95.29 97.44

86.02 73.55 97.85 99.40 85.81 85.52 73.33 80.27 74.49 77.26 94.54 98.77

81.38 79.34 93.14 96.52 80.69 75.13 72.73 83.48 70.31 71.32 91.24 94.12

98.83 97.18 97.76 98.92 91.11 98.49 96.94 95.44 94.12 95.15 92.43 97.81

94.93 76.53 91.65 82.60 71.99 88.40 84.31 71.35 69.90 73.46 70.87 93.98

27.32 36.21 47.64 53.90 33.82 23.05 8.91 25.70 29.74 34.20 19.70 49.13

mean

83.25

84.22

82.19

95.84

80.41

37.40

77.63

79.76

78.94

94.74

75.32

28.58

83.44

85.57

82.45

96.18

80.83

32.44

Table 19: Per-category VisA results for ResAD variants, N 4 + A1 (4-shot) setting. ResAD

ResAD+Inv

ResAD+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

86.52 79.18 92.92 98.22 87.55 92.58 73.31 82.25 72.43 86.08 95.62 97.82

83.89 86.78 96.33 98.59 93.85 92.95 75.83 78.78 68.77 86.40 94.64 98.31

82.31 79.96 89.69 97.37 84.88 87.22 69.79 82.17 71.74 79.88 94.11 96.43

98.55 97.56 96.73 98.73 91.56 98.75 97.10 97.00 94.68 96.06 92.42 97.74

94.18 82.94 91.22 82.11 73.35 92.04 84.03 76.84 71.21 81.66 71.38 93.49

31.39 52.76 42.94 63.76 38.63 30.33 16.40 55.22 32.42 41.49 19.83 49.08

84.32 68.82 94.66 98.52 78.02 83.33 68.64 72.13 67.29 82.04 89.42 96.90

81.67 80.26 97.56 99.33 88.70 83.57 69.45 64.76 65.85 81.87 89.61 98.38

80.00 77.65 90.32 96.91 83.33 78.01 70.27 75.59 70.00 77.45 82.25 94.12

98.54 96.88 96.65 98.66 91.40 97.58 95.60 95.27 95.13 96.62 89.42 97.59

94.25 67.59 91.37 76.40 72.04 85.97 78.16 77.10 70.21 76.96 65.04 93.42

27.13 44.73 41.93 59.10 37.50 19.25 4.31 23.48 20.31 38.25 17.07 46.93

88.63 73.55 95.48 99.30 83.02 91.55 82.38 82.96 80.31 82.56 96.67 98.12

86.94 81.87 97.99 99.70 91.90 92.52 83.55 79.12 80.08 83.14 95.63 98.97

81.82 81.55 92.86 98.49 83.65 84.06 77.88 83.70 78.26 75.89 93.72 96.12

98.92 97.45 97.88 98.94 91.81 99.09 97.63 95.99 95.09 96.28 93.36 98.23

95.25 81.53 91.54 81.02 73.40 92.54 87.24 74.32 73.78 79.57 73.09 94.14

27.99 45.19 48.84 54.25 38.30 23.59 13.25 28.46 33.12 38.16 20.65 51.10

mean

87.04

87.93

84.63

96.41

82.87

39.52

82.01

83.42

81.33

95.78

79.04

31.67

87.88

89.28

85.67

96.72

83.12

35.24

29

Table 20: Per-category MVTecAD results for NAGL variants, N 1 + A1 (1-shot) setting. NAGL

NAGL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

98.78 90.09 90.68 100.00 99.81 99.45 100.00 99.30 93.42 77.06 99.51 98.61 88.15 99.71 98.52

99.52 94.35 97.91 100.00 99.93 99.70 100.00 99.84 98.67 91.26 99.82 99.51 84.41 99.91 99.62

98.70 87.96 94.17 100.00 99.41 98.07 100.00 98.04 95.61 87.40 98.03 97.21 80.13 98.89 97.36

98.31 95.48 97.95 99.29 99.23 99.47 99.25 93.70 92.77 97.57 96.41 99.05 84.62 97.04 97.83

95.61 88.10 96.36 98.40 96.68 97.27 98.64 91.51 95.99 91.36 91.07 94.93 63.44 96.73 93.82

76.32 58.16 45.57 68.15 48.29 78.01 45.63 62.39 48.78 40.18 69.28 63.72 43.82 67.95 54.15

98.89 92.62 91.18 100.00 99.75 99.33 100.00 99.19 92.86 78.06 99.43 98.61 90.10 99.85 99.00

99.57 95.89 98.02 100.00 99.91 99.64 100.00 99.82 98.57 91.89 99.79 99.51 86.94 99.95 99.74

98.95 90.59 94.77 100.00 99.12 97.89 100.00 97.85 95.55 87.25 98.18 97.21 81.88 99.17 97.90

98.20 95.32 98.00 99.36 99.29 99.48 99.28 93.74 92.41 97.71 96.54 99.10 83.76 97.22 98.26

95.58 88.16 96.48 98.52 96.92 97.00 98.73 91.81 96.12 91.76 91.86 94.91 63.39 97.00 94.95

76.16 57.92 46.31 68.89 49.61 78.30 45.93 62.66 46.95 41.62 70.63 65.11 41.00 68.15 56.27

mean

95.54

97.63

95.40

96.53

92.66

58.03

95.93

97.95

95.76

96.51

92.88

58.37

Table 21: Per-category MVTecAD results for NAGL variants, N 2 + A1 (2-shot) setting. NAGL

NAGL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

98.99 92.73 90.79 100.00 99.81 99.96 100.00 99.49 95.17 85.81 99.80 99.26 88.08 99.91 99.35

99.57 95.86 97.89 100.00 99.93 99.98 100.00 99.89 99.02 95.14 99.92 99.72 84.97 99.97 99.84

99.48 89.74 94.81 100.00 99.42 99.52 100.00 98.56 96.73 87.94 98.62 97.81 80.95 99.44 98.45

98.22 95.72 98.01 99.33 99.31 99.61 99.29 94.35 92.66 98.11 96.61 99.11 83.47 97.38 98.30

95.81 88.70 96.60 98.46 97.00 97.86 98.66 92.59 96.17 92.83 91.87 95.38 62.94 96.96 95.05

76.47 58.87 46.37 68.59 49.44 80.50 46.56 65.31 49.13 46.41 70.36 64.71 39.94 68.80 56.61

98.99 92.69 90.63 100.00 99.83 99.98 100.00 99.41 95.24 85.48 99.81 99.26 88.81 99.85 99.29

99.58 95.91 97.86 100.00 99.94 99.99 100.00 99.87 99.05 94.93 99.93 99.72 85.73 99.95 99.82

99.48 89.78 94.67 100.00 99.42 99.53 100.00 98.56 96.83 88.38 98.81 97.81 82.05 99.17 98.45

98.17 95.54 98.06 99.35 99.32 99.63 99.28 94.31 92.73 98.13 96.49 99.10 83.87 97.30 98.34

95.72 88.40 96.66 98.48 97.02 97.84 98.65 92.46 96.31 92.90 91.79 95.26 63.33 96.98 95.13

76.36 58.76 47.01 68.75 49.57 80.70 46.10 65.09 48.99 46.47 70.29 64.69 40.17 68.66 56.64

mean

96.61

98.11

96.10

96.63

93.13

59.20

96.62

98.15

96.20

96.64

93.13

59.22

Table 22: Per-category MVTecAD results for NAGL variants, N 4 + A1 (4-shot) setting. NAGL

NAGL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

bottle cable capsule carpet grid hazelnut leather metal_nut pill screw tile toothbrush transistor wood zipper

99.74 93.93 96.04 100.00 99.89 99.99 100.00 99.53 95.27 83.34 99.80 99.72 89.76 99.77 99.40

99.91 96.63 99.19 100.00 99.96 99.99 100.00 99.89 99.08 94.14 99.92 99.89 86.67 99.93 99.85

99.21 90.58 95.87 100.00 99.71 99.76 100.00 98.73 96.48 87.66 98.81 98.92 82.55 98.88 98.32

98.27 95.86 98.26 99.33 99.33 99.63 99.28 95.12 92.56 98.20 96.54 99.09 83.07 97.30 98.35

95.77 89.22 97.05 98.43 97.06 97.79 98.54 93.48 96.20 93.22 91.60 95.37 63.58 96.89 95.18

76.65 60.03 51.79 68.25 49.99 80.78 46.83 68.69 49.57 45.53 69.96 64.12 38.76 68.66 56.94

99.79 95.01 96.48 100.00 99.83 99.95 100.00 99.56 95.94 84.08 99.87 99.81 90.64 99.80 99.33

99.93 97.26 99.29 100.00 99.94 99.97 100.00 99.90 99.20 94.45 99.95 99.93 87.30 99.94 99.83

99.21 91.86 96.04 100.00 99.42 99.52 100.00 98.91 96.84 87.50 99.20 99.45 82.68 98.89 98.33

98.17 95.82 98.28 99.35 99.33 99.63 99.30 95.20 92.74 98.23 96.51 99.11 84.01 97.32 98.40

95.61 89.35 97.08 98.49 97.07 97.62 98.56 93.47 96.36 93.34 91.78 95.32 64.57 96.97 95.30

76.37 60.35 52.18 68.63 50.14 80.93 47.13 69.12 49.81 45.85 70.29 64.50 39.21 68.77 57.21

mean

97.08

98.34

96.37

96.68

93.29

59.77

97.34

98.46

96.52

96.76

93.39

60.03

30

Table 23: Per-category VisA results for NAGL variants, N 1 + A1 (1-shot) setting. NAGL

NAGL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

92.99 97.80 90.84 97.48 95.96 85.52 55.48 94.87 86.00 81.56 60.70 95.52

92.97 98.54 94.84 98.94 98.21 84.67 52.26 92.26 83.67 79.04 65.22 97.87

86.12 95.19 89.81 95.29 93.53 80.56 66.91 90.64 81.55 77.39 66.67 91.46

98.68 97.73 98.77 99.26 96.48 98.75 97.48 98.94 95.96 93.61 92.05 98.71

93.40 81.69 94.69 94.98 83.27 92.80 86.93 92.87 89.12 86.82 71.68 96.85

40.61 48.64 54.18 69.02 45.74 32.60 9.73 60.63 36.96 42.14 20.38 48.29

91.41 95.67 86.08 96.68 94.12 90.67 66.35 90.79 82.81 81.90 80.18 95.12

91.76 97.30 93.42 98.69 97.23 90.44 62.42 87.31 80.24 81.50 78.06 97.63

84.16 93.20 85.19 95.92 90.64 83.11 69.89 87.32 79.13 74.18 76.02 92.23

98.83 97.16 98.88 99.03 95.40 98.42 98.06 98.89 96.20 93.81 92.97 98.89

93.41 80.92 95.25 93.88 82.05 91.37 89.54 93.16 89.32 86.31 73.06 96.97

39.48 36.30 57.43 68.96 39.33 30.83 18.36 58.60 33.03 40.06 21.87 50.78

mean

86.23

86.54

84.59

97.20

88.76

42.41

87.65

88.00

84.25

97.21

88.77

41.25

Table 24: Per-category VisA results for NAGL variants, N 2 + A1 (2-shot) setting. NAGL

NAGL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

93.94 98.20 86.84 96.94 96.50 90.14 63.53 95.11 86.54 84.84 65.50 96.70

94.15 98.84 93.72 98.76 98.40 90.10 59.83 92.45 84.30 87.19 72.19 98.42

87.32 95.19 86.12 95.29 94.36 84.02 68.84 91.79 81.17 77.19 66.89 93.60

98.88 97.38 98.58 99.16 96.10 98.95 98.13 98.87 96.14 94.09 92.92 98.86

93.92 80.61 93.56 94.52 82.38 93.50 89.73 93.02 89.79 88.14 74.73 97.05

42.41 48.09 56.20 69.94 44.64 36.34 15.26 57.91 37.29 46.40 23.53 50.75

92.37 95.67 93.78 98.20 96.88 88.16 67.73 91.60 83.87 88.00 83.25 97.14

93.15 97.29 97.10 99.20 98.62 85.97 59.96 87.44 79.68 89.57 83.41 98.57

85.02 92.52 92.08 95.43 95.05 82.69 71.38 89.10 78.79 80.72 78.17 93.53

98.70 97.27 99.06 99.16 95.88 98.32 98.33 98.89 96.32 93.89 92.64 98.99

92.42 80.81 96.76 94.80 82.63 91.02 90.99 93.18 89.34 87.64 72.25 96.97

37.88 48.33 59.06 68.58 43.97 22.58 15.71 59.43 35.78 42.85 24.66 52.94

mean

87.90

89.03

85.15

97.34

89.25

44.06

89.72

89.16

86.21

97.29

89.07

42.65

Table 25: Per-category VisA results for NAGL variants, N 4 + A1 (4-shot) setting. NAGL

NAGL+DART

Category

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

I-AUC

AP

I-F1

P-AUC

PRO

P-F1

candle capsules cashew chewinggum fryum macaroni1 macaroni2 pcb1 pcb2 pcb3 pcb4 pipe_fryum

92.75 98.22 92.26 97.28 96.90 90.16 65.58 95.94 87.54 87.84 83.43 95.72

93.07 98.94 96.57 98.89 98.59 89.04 60.63 93.22 85.36 90.24 86.01 97.87

87.08 94.47 87.91 95.88 94.85 85.45 70.92 93.88 82.67 81.28 77.21 92.75

98.84 97.39 98.63 99.17 96.11 98.99 98.27 98.80 96.19 94.29 93.71 98.91

93.62 80.21 93.76 94.67 82.62 93.57 90.42 92.79 89.76 88.99 77.99 97.28

42.21 51.93 58.16 69.84 45.26 32.90 19.02 56.71 37.74 46.60 26.06 51.85

92.50 95.28 91.92 97.34 97.32 88.68 71.68 93.09 87.23 90.68 92.30 97.50

93.27 97.00 96.27 98.90 98.79 86.08 65.44 89.06 83.93 91.62 92.06 98.86

85.31 92.52 89.45 94.95 95.43 85.20 72.95 91.35 81.98 83.96 86.96 94.36

98.81 98.02 98.89 99.12 95.94 98.70 98.58 98.85 96.55 93.73 93.28 98.89

93.10 83.05 96.90 94.51 83.50 92.84 92.01 93.26 89.92 88.69 74.96 97.08

39.42 49.48 57.77 67.82 44.18 26.41 21.10 58.39 37.59 41.86 27.46 51.26

mean

90.30

90.70

87.03

97.44

89.64

44.86

91.29

90.94

87.87

97.45

89.99

43.56

31

Related documents

• AnomalyCraft-700K: Component-Level Controllable and Verifiable Synthetic Anomalies for Fine-Grained Video Anomaly Understanding#975051
• Reproducing INP-Former: Reconstructing Intrinsic Normal Prototypes for Industrial Anomaly Detection#1537037
• Monotonic anomaly detection#821674
• Model-agnostic information transfer and fusion for classification with label noise#1413655
• Domain Adaptation against Background Sculpting in Anomaly Detection at the LHC#1011388