Training-Free Human-in-the-Loop Anomaly Detection via Memory Bank Correction

PREPRINT

1

Training-Free Human-in-the-Loop Anomaly Detection via Memory Bank Correction

arXiv:2608.17775v1 [cs.LG] 18 Aug 2026

Ayusha Abbas, Saram Abbas, and Kabita Adhikari

Abstract—Anomaly detectors are hardest to deploy exactly where training data is scarcest: a newly commissioned production line has a handful of verified “golden” samples and no machinelearning engineer on the factory floor. We present a trainingfree human-in-the-loop framework in which a domain expert corrects a PatchCore detector by direct memory bank editing: no retraining, no gradients, no original training data. A false-positive correction inserts the reviewed image’s normal patches through a self-calibrating novelty gate admitting only those beyond the median pool-normal nearest-neighbour distance. From a bank built on only ten golden samples, operator corrections close a median 66% of the gap to an uncorrected fully trained bank (mean 80%, raised by three categories that overshoot parity), significantly improving 12 of 15 MVTec AD categories and harming none: ten samples plus corrections outperform hundreds of samples without them. On already-trained banks the headroom is smaller and concentrated where the bank undersamples normal appearance (gated: toothbrush +0.10, metal nut +0.09, zipper +0.05, screw +0.05), and no category except grid is significantly harmed. Evaluation uses a held-out protocol (20 splits per category, Holmcorrected Wilcoxon), because corrected images entering the bank inflate naive evaluation toward AUROC 1.0 by memorisation. Passive and active querying are statistically indistinguishable; a matched-label-budget control attributes gains to deploymenttime label production at 43% of exhaustive-review cost; a defectmemory extension fails decisively. Feedback is simulated from ground truth; live expert trials, where mislabelling is costliest on small banks, remain future work. Index Terms—Active learning, anomaly detection, human-inthe-loop, industrial inspection, memory bank correction, MVTec AD, PatchCore

I. I NTRODUCTION Deep anomaly detection now achieves near-perfect discrimination on industrial inspection benchmarks [1], [2], but deployed models do not stay accurate. Normal product appearance drifts (new component variants, changed illumination, camera recalibration) and errors accumulate. The standard remedy, periodic retraining, requires new labelled data, training infrastructure, and machine learning (ML) expertise that is rarely present on the factory floor. The people who can retrain the model (ML engineers) are not the people who see its errors every day (quality engineers), so in regulated manufacturing environments a model correction can take weeks to months of escalation, retraining, and revalidation. A second, sharper version of the same problem is cold start: a newly commissioned production line has almost no training data at all. In both situations the quality engineer already A. Abbas, S. Abbas, and K. Adhikari are with the School of Engineering, Newcastle University, Newcastle upon Tyne, UK (e-mail: ayusha.abbas24@gmail.com; s.abbas11@newcastle.ac.uk; kabita.adhikari@newcastle.ac.uk).

knows what the model does not: which flagged images are genuine defects and which are false alarms. Existing systems give them no way to put that knowledge into the model. Detection failures carry industrial-scale costs: automotive original equipment manufacturers (OEMs) paid USD 51 billion in warranty claims in 2023 [3], a single end-of-line contamination excursion in semiconductor fabrication can exceed USD 21 million [4], and a defective-medicine prosecution carries six-figure penalties [5]. All three are downstream costs of defects that escaped inspection, and a defect grows more expensive at every stage it survives. A detector that degrades silently therefore does not just lose accuracy; it feeds escaped defects into the most expensive end of this cost structure. Benchmark ceilings do not close this gap. PatchCore’s headline 99.6% area under the receiver operating characteristic (ROC) curve (AUROC) on MVTec AD requires an ensemble of three large backbones at high resolution [1]; the leaner configurations that fit factory edge hardware give up several points of accuracy (our single-backbone deployment configuration averages 93.4%), and even the 99.6% ensemble, classifying 50,000 images a day, hands the quality team 200 misclassifications every day. PatchCore’s authors themselves list deployment-time adaptation as an open problem [1]. This paper closes that gap with a training-free human-inthe-loop (HITL) framework: the quality engineer reviews a flagged error, makes the single binary judgment they already make daily (“normal” or “defect”), and the framework applies that judgment as a direct edit to the model’s knowledge store, effective immediately. It needs no retraining, no ML engineer, and no access to the original training data. Figure 1 previews the outcome: one short review session clears a false alarm on images the loop never saw, while genuine defects remain flagged. PatchCore [1] is uniquely suited to this because its knowledge is not buried in network weights: it stores normal appearance as an explicit memory bank of patch features. Adding patches from a falsely flagged normal image extends what the model accepts as normal; removing patches near a missed defect raises future scores for similar defects. Each correction is an interpretable edit to a data structure. Prior work modifies PatchCore banks automatically, via continual learning [6] or loss-driven optimisation [7], but still requires ML infrastructure; to our knowledge, ours is the first framework in which a domain expert corrects specific deploymenttime misclassifications by direct memory bank surgery.

PREPRINT

2

HITL Correction Generalises: Held-Out Images Before and After One Review Session (seed 10, passive) before: score 99.4 (false alarm) after: score 72.8 (cleared)

held-out defect

after: score 124.5 (still flagged)

held-out normal

before: score 98.1 (false alarm) after: score 78.5 (cleared)

held-out defect

after: score 109.0 (still flagged)

Metal Nut

Toothbrush

held-out normal

Fig. 1. What training-free correction looks like on images the loop never touches. For toothbrush and metal nut, a held-out normal image is falsely flagged before correction (anomaly heatmap hot everywhere) and cleared after a single simulated review session (16–25 single-decision reviews for the seeds shown; the category means are ∼13 and ∼20), while a held-out defect remains confidently flagged, with the anomaly map concentrated on the defect itself (contaminated bristles; flipped part). Heatmaps share a colour scale within each row; scores are the image-level anomaly scores.

A. Contributions We evaluate the framework on all 15 MVTec AD categories [2], 20 independent splits each, under Holm-corrected Wilcoxon tests. Our contributions: • Cold-start recovery from ten samples. From a bank built on only 10 golden samples, operator corrections close a median 66% of the gap to an uncorrected fully trained bank (mean 80%, raised by three categories that overshoot parity), significantly improving 12 of 15 categories and harming none. Ten samples plus corrections outperform hundreds of samples without them. We do not claim curation dominates data: a corrected full-training bank still finishes higher (toothbrush 0.927 vs. 0.904, metal nut 0.989 vs. 0.927). The claim is about what is achievable on day one of a deployment, and this is the one setting in which every category either improves or is left untouched. • A training-free correction mechanism. False positives (FPs) and false negatives (FNs) are resolved by direct memory bank edits, with no retraining, gradients, or training data. An FP/FN ablation shows FP insertion reproduces the entire gain while FN removal is a measured near no-op: the mechanism works by teaching normality, not by memorising defects. • A self-calibrating novelty gate. A patch is inserted only if its nearest-neighbour distance to the bank exceeds the median pool-normal distance. On already-trained banks the gate eliminates the held-out degradation the raw loop causes on five of six well-covered categories, preserves every category that benefits, and is robust across a quan-

tile sensitivity sweep, leaving grid as the single category still significantly harmed. • A held-out evaluation protocol (plus AUCC, the areaunder-the-correction-curve efficiency metric): corrected images enter the bank, so naive evaluation on reviewed images inflates toward AUROC 1.0 by memorisation. Correcting a review pool while scoring a disjoint heldout set separates generalisation from memorisation, and reveals six categories where the ungated loop is flat-tonegative on mature banks, a boundary invisible to poolonly evaluation that we report as an explicit negative result. A matched-label-budget control shows the gains equal what the same labels would achieve at training time: the loop’s value is producing those labels at deployment, at 43% of the cost of exhaustive review. • A strategy equivalence result. Passive (random) and active (uncertainty) querying are statistically indistinguishable on every category, because bank edits act globally and the review budget exhausts the error pool under either ordering. No acquisition function is needed. In summary: from ten golden samples a domain expert with no ML knowledge closes most of the gap to a fully trained detector, improving 12 of 15 categories and harming none, in tens of single-decision reviews. On mature banks the same loop raises held-out AUROC on the four categories whose banks undersample normal appearance, from 0.826 to 0.972 (toothbrush) and 0.900 to 0.998 (metal nut) in mean sessions of ∼13 and ∼20 reviews; those figures are for the ungated loop, and under the novelty-gated configuration we recommend for deployment the same categories reach 0.927 and 0.989, with

PREPRINT

3

no category except grid significantly harmed, so the loop is safe to leave on. II. R ELATED W ORK Our work sits at the intersection of unsupervised anomaly detection, human-in-the-loop machine learning, and active learning query strategies. A. Unsupervised Anomaly Detection Deep learning-based anomaly detection spans a broad taxonomy of reconstruction-based, density-based, and discriminative approaches [8]. Early anomaly detection approaches relied on reconstruction-based methods, such as convolutional autoencoders and generative adversarial networks (GANs) like AnoGAN [9], which detect anomalies by their high reconstruction error or latent space distance. These suffer from mode collapse, blurry reconstructions of high-frequency textures, and high computational overhead. A second family exploits pretrained convolutional neural network (CNN) features [10], showing that ImageNet representations transfer to industrial inspection without domain-specific training. Student-teacher frameworks [11] extend this by detecting anomalies through student-teacher feature discrepancy. The state of the art is dominated by memory bank methods. SPADE [12] showed that nearest-neighbour comparison against a bank of pretrained features achieves strong localisation with no training; PatchCore [1] refines this with a greedy coreset of locally-aware patch features, reaching 99.6% mean AUROC on MVTec AD with a three-backbone ensemble at 320×320 resolution. That figure is a static benchmark result, and PatchCore’s authors explicitly leave deploymenttime adaptation as future work. Our framework builds on PatchCore’s architecture and answers that gap. PaDiM [13] and SimpleNet [14] are related feature-based alternatives. B. Human-in-the-Loop Machine Learning Human-in-the-loop machine learning [15] incorporates human feedback into the learning process, classically via active learning [16]. In visual inspection, Rožanec et al. [17] combine active learning with explainable artificial intelligence (XAI) heat maps to reduce annotation burden for supervised retraining; HILAD [18] proposes bidirectional HITL for timeseries anomaly detection. Within anomaly detection, Das et al. [19], [20] and Bodor et al. [21] use expert feedback to reweight or re-optimise detectors, so the feedback still flows through retraining. Closest to our setting, Vishwakarma et al. [22] use human feedback on flagged samples to adapt the decision threshold with false-positive-rate guarantees, but never modify the representation; a follow-up additionally adapts a learned scoring network, but through periodic gradient optimisation [23]. We differ on all three axes: no retraining at all, corrections that edit the representation of normality itself, and responsibility shifted from ML engineers to the quality engineers who already review the errors. To our knowledge, ours is the first framework enabling human-driven, trainingfree correction of specific misclassified samples through direct memory bank surgery at deployment time.

C. Active Learning and Query Strategies Uncertainty sampling [24], the standard heuristic in active learning, selects the sample about which the model is least confident. Query-by-committee [25] and densityweighted methods [16] provide alternative strategies. A consistent finding is that uncertainty-based strategies outperform passive random sampling [16]. Our work tests this regularity for memory bank correction and finds that it does not transfer: under multi-seed held-out evaluation, uncertainty sampling fails to outperform random sampling, and we provide a geometric explanation for why. This finding has implications for both active learning theory and the design of HITL anomaly detection systems.

D. Continual Learning and Test-Time Adaptation Continual learning [26] and test-time adaptation [27] address deployment-time improvement through parameter updates, requiring careful regularisation against catastrophic forgetting. Within the PatchCore literature specifically, continual learning variants have emerged: PatchCoreCL [6] maintains per-task memory banks updated as new tasks arrive, and FRPatchCore [7] updates the memory bank during training via a negative cosine similarity loss. A growing line of continual industrial anomaly detection likewise treats the memory bank or its coreset as the unit of adaptation: Li et al. [28] adapt the detector as new normal samples arrive under distribution shift, CADIC [29] incrementally updates embeddings within a fixed-size unified coreset shared across tasks, MECAD [30] assigns per-class experts with coreset replay buffers, and orthogonal LoRA banks [31] isolate per-task adaptation in low-rank parameter subspaces to preserve learned normality. These approaches share our insight that the memory bank is the modifiable component of memory-based detectors, but differ fundamentally in the update signal: all are driven by a stream of new, assumed-clean training data arriving at task or batch boundaries, whereas our framework is driven by an operator’s dispositions of individual misclassified samples: error-targeted corrections at deployment time with no new training set, no optimisation objective, and no assumption about task structure. Mechanistically closest to our novelty gate (Section III-B2), TimeRep [32] augments a time-series memory bank at inference with representations whose nearestneighbour distance exceeds a quantile threshold, but as unsupervised drift tracking over a stream, not as gating of humanverified corrections. Few-shot anomaly detection builds the detector itself from k samples: RegAD meta-learns a registration proxy across categories [33], WinCLIP transfers language-guided features zero-/few-shot [34], and GraphCore [35] and FastRecon [36] build compact memory banks directly from the k normals. All treat the residual gap to full-training performance as fixed once deployed. Our cold-start evaluation (Section III-E5) starts in the same regime, with a bank built from ten samples, and measures how much of that gap operator corrections then close; the contribution is the recovery-by-correction protocol, not a new few-shot detector. The framework itself is orthogonal: it

PREPRINT

4

TABLE I P OSITIONING OF OUR WORK RELATIVE TO PRIOR METHODS . Method

No retraining

Human feedback

Deployment-time

Specific correction

Autoencoder AnoGAN PatchCore Few-shot AD Continual learning Test-time adapt. HITL + retraining Ours

✗ ✗ ✓ Partial ✗ Partial ✗ ✓

✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓

✗ ✗ ✗ Partial ✓ ✓ ✗ ✓

✗ ✗ ✗ ✗ ✗ ✗ Partial ✓

applies on top of any memory bank model as a deploymenttime correction layer. E. Positioning Table I summarises how our approach relates to existing paradigms across four key desiderata. III. M ETHODOLOGY We first summarise the PatchCore baseline, then present the HITL correction mechanism (including the novelty gate), the querying strategies, the AUCC metric, and the experimental protocols. A. PatchCore Baseline 1) Features and Memory Bank: PatchCore [1] represents normal appearance as an explicit memory bank of locallyaware patch features from a frozen WideResNet-50 [37] pretrained on ImageNet [38]. Feature maps are taken from backbone levels 2 (28×28, 512 channels; fine texture) and 3 (14×14, 1,024 channels; part-level structure): level 3 is bilinearly upsampled to 28×28 and concatenated channelwise with level 2, so each of the 28 × 28 = 784 spatial positions carries a 1,536-dimensional descriptor pij (x). We write P (x) for that set, |P (x)| = 784. Backbone weights are fixed throughout coreset construction and every HITL experiment; no gradient is computed at any point. The union of patch features over a category’s defect-free training images is too large to query directly (some 200,000 vectors for a typical 200–300 image category), so PatchCore compresses it by greedy k-center coreset subsampling [39], retaining the subset that minimises the maximum distance from any training patch to its nearest retained entry. We keep 1% of training patches, giving banks M ∈ RN ×1536 ranging from N = 470 (toothbrush, 60 training images) to 3,065 (hazelnut, 391). How undersampled a category’s bank is turns out to predict where correction helps (Section IV). 2) Anomaly Scoring: At inference time, for a test image x, we extract its 784 patch features P (x) and compute the anomaly score as the maximum patch-level distance to the memory bank, each patch’s distance being the mean over its k = 9 nearest bank entries: s(x) = max d9 (p), p∈P (x)

d9 (p) =

1 9

X

∥p − m∥2

m∈N9 (p,M )

(1)

where N9 (p, M ) denotes the nine nearest entries of M to p. The max identifies the single most anomalous patch, making the score sensitive to the small local defects typical of industrial inspection, and the same nine distances form the anomaly map used for localisation. Averaging over a small neighbourhood, rather than taking the 1-NN distance, makes the per-patch value less sensitive to a single unrepresentative bank entry. Retrieval uses a ball-tree index. An image is classified anomalous if s(x) ≥ τ , with τ the 90th percentile of scores on normal training images (no anomalous examples needed), recomputed after every correction round. Our implementation is a single WideResNet50 at 224×224 without score reweighting, and departs from canonical PatchCore in using the mean-of-nine patch statistic of Eq. 1 in place of the 1-NN score; this is a deliberate implementation choice, applied identically to every baseline and every corrected bank reported here. It gives 0.934 mean AUROC, deliberately below PatchCore’s 99.6% ensemble headline, because a model at 99.6% leaves no headroom for studying human-driven correction, whereas this deployable configuration has realistic error pools. B. Human-in-the-Loop Feedback Framework Our framework (Fig. 2) is a post-deployment correction layer: it never touches the backbone, the training data, or any gradient. Every correction is an edit to the memory bank M , so it applies to any nearest-neighbour detector with an explicit feature store. Correction proceeds over R rounds (Algorithm 1). In round r: (1) score all images against M (r) ; (2) form the error pool E (r) = {x : label(x) ̸= predict(x, M (r) , τ (r) )}; (3) present the expert one image from E (r) ; (4) the expert gives one binary label, “normal” or “defect”; (5) apply the corresponding correction to obtain M (r+1) . The loop stops at round R or when the error pool is exhausted. The entire human contribution per round is one label on one image. 1) False Positive Correction: Memory Bank Expansion: A false positive occurs when a normal image xFP receives an anomaly score s(xFP ) ≥ τ , indicating that its patch features are anomalously distant from the current memory bank. The geometric interpretation is that xFP lies in a region of normal appearance space that is underrepresented in M : a gap in the normal manifold that causes the nearest-neighbour distance to exceed the anomaly threshold despite the image being normal. The correction adds all 784 patch features of xFP directly to the memory bank, filling this gap: M (r+1) ← M (r) ∪ P (xFP )

(2)

This operation increases |M | by 784 entries per FP correction. Without a size constraint, repeated FP corrections would cause the memory bank to grow without bound, increasing nearest-neighbour query time quadratically. To prevent this, we enforce a maximum bank size Nmax via random subsampling after each FP correction: M (r+1) ← RandomSample M (r) ∪ P (xFP ), Nmax

(3)

PREPRINT

5

Production images

Deployed PatchCore frozen backbone + memory bank M

Prediction: normal / defect

flagged errors

Quality engineer one binary decision: “normal” or “defect”

immediate effect

one label

Direct memory bank edit: no retraining, no gradients, no training data “normal” (FP) → novelty-gated patch insertion into M (Eq. 4) “defect” (FN) → remove k nearest bank entries

Conventional remedy: collect data → label → retrain → validate → redeploy

(ML team, retraining infrastructure, days–weeks)

Fig. 2. Framework overview. A deployed PatchCore model flags errors; a quality engineer (not an ML engineer) resolves each with a single binary decision, which is applied as a direct edit to the memory bank and takes effect immediately. The conventional remedy (bottom, dashed) requires an ML team and a retraining pipeline.

Novelty Gate on a Real False Positive (toothbrush) FP patches rejected (403): bank already covers them FP patches inserted (381): genuinely novel all pool-normal patches (their median sets )

0.16 0.14 0.12

density

applied whenever the insertion would leave |M (r+1) | > Nmax . The value of Nmax is set uniformly across categories, as detailed in Section III-E3. The random subsampling preserves the global coverage properties of the coreset while bounding computational cost; a control experiment with the cap removed (Section III-E3) shows it is not a sensitive parameter. 2) Novelty-Gated Insertion: Adding all 784 patches of a corrected image is maximally effective when the bank genuinely undersamples normal appearance. On categories whose banks already cover the normal manifold well, however, most inserted patches duplicate existing coverage, and this redundant insertion can perturb previously correct decisions (Section IV-D2). The framework therefore supports gating each candidate patch on novelty: a patch p ∈ P (xFP ) is inserted only if its nearest-neighbour distance to the current bank exceeds a threshold τnov ,

0.10

= median

0.08 0.06 0.04 0.02 0.00

0

20

40

60

80

patch 1-NN distance to memory bank

100

Fig. 3. The novelty gate on a real false positive (toothbrush, seed 10). The threshold τnov is the median 1-NN distance of all pool-normal patches to the baseline bank (black outline); of the flagged image’s 784 patches, those within existing coverage (left of τ ) are rejected and only the genuinely novel ones (right of τ ) are inserted.

 M (r+1) ← M (r) ∪ p ∈ P (xFP ) : min ∥p − m∥2 > τnov , m∈M (r)

(4) where τnov is set once, before correction begins, as the median nearest-neighbour distance of all review-pool normal patches to the baseline bank (pool data only, never held-out images). Figure 3 shows the gate on a real toothbrush false positive: the half of its patches within existing coverage is rejected, the genuinely novel half inserted. The gate is selfcalibrating (permissive on undersampled banks, conservative on well-covered ones) and needs no tuning: outcomes change smoothly between the 0.25 and 0.75 quantiles (Section IV-B). The criterion has close relatives: it is an online, thresholdbased analogue of the greedy k-center coreset rule that built the bank [1], [39], asking of each candidate patch at insertion time the coverage question that coreset construction asks of the training set; and a quantile-thresholded 1-NN novelty filter has recently been used to keep a time-series memory bank nonredundant under unsupervised stream adaptation [32]. What is new is the role: applied to human-verified corrections, the filter is not an economy measure. Section IV-B shows it is the difference between a loop that harms well-covered categories and one that is safe to leave on. We evaluate the loop with and without the gate; gating is the recommended deployment configuration.

3) False Negative Correction: Memory Bank Surgery: A false negative occurs when an anomalous image xFN scores s(xFN ) < τ : typically one or a few defect patches sit spuriously close to normal bank entries, inside the normal manifold. The correction first identifies the anchor patch: the patch of xFN lying furthest from the current bank under the 1-NN distance, p∗ = argmax min ∥p − m∥2 p∈P (xFN ) m∈M

(5)

Note that Eq. 5 selects the anchor by 1-NN distance, whereas the image score of Eq. 1 is driven by the mean-of-nine statistic d9 . The two criteria do not in general identify the same patch, so removal is aimed at the most locally isolated patch rather than at the patch that actually set the score; Section IV-I shows this to be one of the two reasons FN correction behaves as a near no-op. Because xFN was classified normal, p∗ sits in a region of feature space that is ambiguously close to the normal manifold. The correction removes the kremove = 5 nearest memory bank entries to p∗ , creating a gap in the

PREPRINT

6

Algorithm 1 HITL Memory Bank Correction Require: M (memory bank), XT (test images + labels), R (rounds), strategy ∈ {passive, active} Ensure: M (R) (corrected bank), auroc_curve, AUCC 1: scores ← S CORE A LL(XT , M ) 2: AUROC0 ← AUROC(scores, labels(XT )) 3: corrected ← ∅; auroc_curve ← [AUROC0 ] 4: for r = 1, 2, . . . , R do 5: scores(r) ← S CORE A LL(XT , M ) 6: τ (r) ← percentile90 (scores(r) [normal]) 7: E (r) ← {x : label(x) ̸= predict(x, M, τ (r) )} \ corrected 8: if E (r) = ∅ then 9: break ▷ no errors remain 10: end if 11: x∗ ← Q UERY S TRATEGY(E (r) , strategy, τ (r) ) ▷ Eq. 8/9 12: [Human] inspects x∗ ; labels it normal or defective ▷ single binary decision 13: if x∗ is FP (human says normal, model said defective) then 14: M ← FPC ORRECT(x∗ , M , Nmax ) 15: else ▷ FN: human says defective, model said normal 16: M ← FNC ORRECT(x∗ , M , kremove = 5) 17: end if 18: corrected ← corrected ∪{x∗ } 19: AUROCr ← AUROC(S CORE A LL(XT , M ), labels) 20: auroc_curve.append(AUROCr ) 21: end for 22: gr ← max(0, AUROCr − AUROC0 ), r = 1, . . . , R P 1 gr 23: AUCC ← R(1 − AUROC0 ) r 24: return M , auroc_curve, AUCC

normal manifold at precisely the location of the anomalous patch: ∗

Iremove = kNN(p , M M

(r+1)

←M

(r)

(r)

, k = 5)

(r) \ {Mi : i ∈ Iremove }

(6) (7)

The excised gap raises future scores for patches falling in the same region, so similar defects are flagged; kremove = 5 balances gap size against over-removal. After each correction (FP or FN) the bank index is rebuilt and all images rescored. C. Querying Strategies The query strategy determines only the order in which errors are reviewed, not the correction mechanism. We evaluate two: Passive querying draws uniformly at random from the error pool, ∗

x ∼ Uniform(E

(r)

),

(8)

requiring no computation beyond the scoring pass and sampling FP and FN errors in proportion to their prevalence [16].

Active querying implements uncertainty sampling [16], [24], selecting the image whose score is closest to the decision threshold: x∗ = argmin |s(x) − τ (r) |.

(9)

x∈E (r)

Its rationale, that boundary-adjacent samples are most informative, assumes local model updates. Section IV shows empirically that this assumption fails for memory bank correction, whose updates are global (Section V). D. Evaluation Metric: Area Under the Correction Curve (AUCC) AUROC before and after correction misses the efficiency of the process: how quickly improvement arrives over the review budget. The Area Under the Correction Curve (AUCC) captures it. With AUROCr the AUROC after round r (r = 0 the baseline), define the per-round gain gr = max(0, AUROCr − AUROC0 ) and AUCC =

R X 1 gr ∈ [0, 1], R (1 − AUROC0 ) r=1

(10)

i.e. the cumulative gain normalised by the area of immediate, sustained perfect correction. AUCC is comparable across baselines and rewards early improvement: the same final AUROC scores higher if reached in fewer reviews, matching the practical preference for fewer human interventions. It is an AUROC-specific instance of the area-under-the-learningcurve (ALC) family standard in active-learning evaluation [40], adapted to correction: gains are measured against an already-deployed baseline and normalised by the remaining headroom 1 − AUROC0 , so scores are comparable across categories with different starting points. E. Experimental Setup 1) Dataset: All experiments use MVTec AD [2], the standard industrial anomaly detection benchmark: 5,354 images across 15 categories (5 textures, 10 objects) spanning 73 defect types, from fixed-pose rigid objects (bottle) to deformable configurations (cable) and random textures (leather, wood). Training sets contain only defect-free images; test sets contain both classes. 2) Category Selection: Stratified by Separation Index: We evaluate all 15 MVTec AD categories using passive and active querying strategies. The separation index σ, defined as the normalised distance between normal and anomalous score distributions, predicts correction utility and is used to interpret results across categories: σ=

µanomalous − µnormal σnormal

(11)

where µanomalous and µnormal denote the mean anomaly score for each class, and σnormal denotes the standard deviation of the normal class score distribution. Normalising by σnormal (rather than a pooled variance) reflects how many normal-distribution standard deviations separate the two class means, a natural

PREPRINT

7

TABLE II A LL 15 MVT EC AD CATEGORIES , ORDERED BY SEPARATION INDEX σ ( DESCENDING ). Category

Type

σ

Base.

Train

Test (g/a)

Bottle Leather Carpet Wood Hazelnut Tile Zipper Cable Capsule Pill Metal Nut Transistor Screw Toothbrush Grid

Object Texture Texture Texture Object Texture Object Object Object Object Object Object Object Object Texture

50.5 23.1 9.5 7.6 7.0 6.0 4.9 4.6 4.3 4.3 4.3 3.7 3.0 2.6 2.6

1.0000 1.0000 0.9932 0.9912 0.9964 0.9776 0.8787 0.9185 0.9290 0.9242 0.8803 0.9558 0.8703 0.8139 0.8839

209 245 280 247 391 230 240 224 219 267 220 213 320 60 264

20/63 32/92 28/89 19/60 40/70 33/84 32/119 58/92 23/109 26/141 22/93 60/40 41/119 12/30 21/57

Anomaly Score Distributions: Normal vs Anomalous (Four representative categories spanning the full difficulty range) Toothbrush ( =2.6, AUROC=0.814)

Metal Nut ( =4.3, AUROC=0.880)

Normal Anomalous

100

105

110

115

120

Normal Anomalous

125

95

Hazelnut ( =7.0, AUROC=0.996)

100

105

110

Normal Anomalous

90

100

110

120

115

Leather ( =23.1, AUROC=1.000)

130

Normal Anomalous

60

70

80

90

100

110

120

130

140

Fig. 4. Anomaly score distributions for four representative categories spanning the full difficulty range (blue = normal, red = anomalous). Overlap decreases as σ increases, from heavily overlapping (toothbrush) to fully separated (leather).

unit given that PatchCore’s classification threshold itself is set from the normal score distribution. A high separation index indicates well-separated score distributions (easy category); a low index indicates overlapping distributions (hard category), as illustrated in Fig. 4. Table II lists all 15 categories with their separation indices, baseline AUROCs and dataset statistics; the baselines average 0.9342 and span 0.8139 (toothbrush) to 1.0000 (bottle, leather). 3) Implementation Details and Bank Size Caps: The WideResNet-50 backbone uses ImageNet-pretrained weights loaded via the timm library (version 0.9+) and is kept frozen throughout. Input images are resized to 224×224 pixels and normalised with ImageNet mean [0.485, 0.456, 0.406] and standard deviation [0.229, 0.224, 0.225]. Features are extracted from backbone stages 2 and 3 using the features_only interface. The memory bank nearest-neighbour index uses k = 9, Euclidean distance, and a ball-tree data structure (scikit-learn NearestNeighbors with algorithm=’ball_tree’, n_jobs=-1) for efficient batch querying.

The memory bank is capped at Nmax = 12,000 patches, uniformly across all categories: when an insertion would exceed the cap, the bank is randomly subsampled back to Nmax . The cap exists only to bound scoring cost; it is not a sensitive parameter. A 20-seed control run with the cap removed entirely changes no category’s mean held-out delta except transistor (+0.021, the only Holm-significant shift) and doubles the scoring cost. Each HITL experiment runs for R = 30 correction rounds per strategy per category. The ball-tree index is rebuilt after each correction to reflect the updated bank. 4) Held-Out Evaluation Protocol: A methodological subtlety of memory bank correction is that Eq. 2 adds the corrected image’s own patches to the bank. If the same images are used both for correction and for evaluation, AUROC trends toward 1.0 partly because corrected normal images are subsequently scored against exact copies of their own features. That is memorisation, not generalisation. All headline results in this paper therefore use a held-out protocol. For each experimental run, the category’s test images are split 70/30 (stratified by label) into a review pool and a heldout set. Only pool images may enter the error pool E (r) and receive corrections; the decision threshold τ (r) is computed from pool normals only. The held-out set is rescored against the updated bank after every correction round but never receives corrections and never influences querying or thresholding. Held-out AUROC after round r is the generalisation measure: it reflects whether corrections improve detection on images the loop has never seen. AUCC (Eq. 10) is likewise computed on the held-out curve. Pool AUROC is reported only as a secondary, self-consistency measure and is explicitly marked as inflated by memorisation wherever it appears. Every (category, strategy) condition is run at 20 independent split seeds (10–29), each seed drawing a different pool/heldout partition and, for passive querying, a different random review order. Reported values are means over the 20 seeds with standard deviations; per-seed distributions are reported in Section IV-G. Statistical significance of per-category improvement is assessed with a two-sided Wilcoxon signed-rank test on the 20 paired per-seed held-out deltas (final minus baseline), and passive-vs-active differences with the same test on paired per-seed endpoints; both are Holm-corrected across the 15 categories at α = 0.05. Seeds 0–9 were reserved for earlier exploratory work and are excluded from all reported results. A uniform bank cap Nmax = 12,000 is used for all categories under this protocol (Section III-E3). 5) Cold-Start Protocol: The protocol above corrects a fully trained bank. To evaluate the deployment scenario where little training data exists (a new production line with only 10–20 verified “golden” samples), we additionally run a cold-start protocol. For each seed, the initial bank is built from only k ∈ {10, 20} training normals drawn with a seed-coupled random number generator: their patch features are extracted with the same backbone and reduced by greedy k-center coreset selection at the main protocol’s 1% rate (78 patches at k = 10, 156 at k = 20). The HITL loop then runs unchanged, with the same 70/30 pool/held-out splits as the full-training runs on matched seeds, and the budget extended to 90 rounds

PREPRINT

8

to accommodate the larger initial error pools. Because splits are seed-matched, the full-training result on the same seed is a paired reference: we report the recovery fraction, i.e. the fraction of the cold-start-to-full-training held-out gap closed by correction, and the median number of reviews to reach parity with the full-training bank. All experiments are conducted on NVIDIA GPUs; timing details are reported in Section VI-A. IV. E XPERIMENTAL R ESULTS We present the full 15-category benchmark on fully trained banks, then the effect of the novelty gate (Section IV-B) and the cold-start setting (Section IV-C), followed by the analyses that explain the results: key categories, strategy equivalence, seed robustness, label economics, and the FP/FN asymmetry. A. Full 15-Category Results Overview Table III reports held-out results for all 15 MVTec AD categories under the protocol of Section III-E4: means over 20 pool/held-out splits (seeds 10–29), ordered by baseline AUROC; “HO” is the held-out set, which never receives corrections. The benchmark partitions into three regimes. Four categories gain +0.040 to +0.146 AUROC, on 15–20 of 20 seeds each: toothbrush (+0.146, 19/20), metal nut (+0.098, 20/20), zipper (+0.054, 20/20), screw (+0.040, 15/20). These are exactly the categories whose baseline errors are false positives from an undersampled normal manifold, which FP corrections repair. Five near-ceiling categories (baseline ≥ 0.99) are unaffected. Six categories are flat-to-negative, losing up to 0.047 AUROC (grid, transistor, pill, capsule, cable, tile): their pool AUROC still climbs (the memorisation artefact), but most inserted patches duplicate existing coverage, and this redundant insertion degrades held-out performance. A 20-seed control with the bank cap removed leaves these categories unchanged, ruling out subsampling churn as the cause; Section IV-B shows the novelty gate eliminates the degradation on five of the six. These regimes survive formal testing. Applying a two-sided Wilcoxon signed-rank test to the 20 per-seed held-out deltas of each category (Holm-corrected across the 15 categories), all four winners are significantly positive (toothbrush, metal nut, zipper: adjusted p < 10−4 ; screw: adjusted p = 0.032), and four of the six flat-to-negative categories are significantly negative (grid, pill, tile, transistor; adjusted p ≤ 0.032), which confirms that the degradation on those categories is systematic rather than noise. Cable and capsule are statistically indistinguishable from zero (adjusted p = 0.057 and 0.28). The same paired test applied to passive-vs-active per-seed differences finds no significant difference on any category (all unadjusted p ≥ 0.068; all adjusted p = 1), formalising the strategy-equivalence claim of Section IV-E. B. Novelty-Gated Insertion Eliminates the Harm The novelty gate (Section III-B2) changes the risk profile of the entire benchmark. With gating enabled (final column of

Table III), every flat-to-negative category except grid turns statistically neutral or positive: transistor −0.024 → +0.005, pill −0.023 → +0.007, cable −0.019 → +0.006, tile −0.013 → −0.001, capsule −0.009 → +0.003; the paired per-seed improvement over the ungated loop is Holm-significant on all five. All four winners remain Holm-significantly positive (toothbrush +0.101, metal nut +0.089, zipper +0.051, screw +0.048); the price of conservatism is a modest reduction on toothbrush (−0.044 vs. ungated, not Holm-significant across seeds) and metal nut (−0.009, Holm-significant but an order of magnitude smaller than the retained gain). The result is a deployment configuration in which no category except grid is significantly harmed, while every previous winner remains a winner. Figure 5(d) shows the effect directly on pill: the ungated trajectory drifts below baseline round by round, while the gated trajectory stays above it. The gate’s insertion rates show the self-calibration at work. On well-covered banks it makes corrections conservative (tile inserts a mean of only 65 of 784 candidate patches per FP correction, transistor 78) and the harm of redundant insertion vanishes; on undersampled banks it stays permissive (metal nut inserts 271, zipper 236) and the gains survive. Grid is the diagnostic exception: it inserts 230 patches per correction, more than metal nut, yet still degrades, so its errors are not a coverage problem at all; we return to it in Section IV-D2. The threshold requires no tuning: repeating the full sweep with τnov at the 0.25 and 0.75 quantiles of the same distance distribution shifts outcomes smoothly and modestly. At 0.25 the rescue of the negative categories weakens (of the four significantly negative categories, only transistor reaches non-negative); at 0.75 it strengthens (grid improves to −0.019) but a real cost appears on metal nut (−0.043 vs. ungated, Holm-significant, 0/20 seeds better). The median sits at the sweet spot, and no quantile exhibits knife-edge behaviour. C. Cold-Start Deployment: Near-Full Performance from Ten Samples Deployment-time correction delivers its largest gains where training data is scarcest. Table IV reports the cold-start protocol (Section III-E5) with k = 10 golden samples and the novelty gate enabled. Starting from banks of just 78 patches, the correction loop produces Holm-significant heldout improvements on 12 of 15 categories, with no category significantly harmed, and recovers on average 80% of the gap to the full-training bank (median 0.66 over the 11 categories with a meaningful gap). On two categories the corrected coldstart bank ends substantially above the full-training reference: metal nut (0.927 vs. 0.900) and toothbrush (0.904 vs. 0.826). Carpet and hazelnut also finish fractionally above their references (≤ 0.003), but both start within 0.01 of ceiling, where the margin carries no weight. Operator-curated insertion can therefore beat exhaustive training data on quality as well as on labelling cost. Hazelnut, bottle, zipper and carpet reach or exceed parity within a median of 4–19 reviews (medians over the seeds that reach parity; Table IV reports how many of the 20 do). Figure 5(a–c) shows the three characteristic trajectories: crossing the full-training baseline (metal nut),

PREPRINT

9

TABLE III C OMPLETE 15- CATEGORY HITL RESULTS UNDER THE HELD - OUT PROTOCOL ( MEANS OVER 20 SEEDS ). HO = HELD - OUT SET, NEVER CORRECTED . B OLD IMPROVEMENTS ARE CONSISTENT ACROSS SEEDS (≥15/20 SEEDS IMPROVED ); NEGATIVE IMPROVEMENTS ARE SHOWN AS - IS ; THE UNGATED CORRECTION LOOP IS NOT BENEFICIAL ON EVERY CATEGORY. “G ATED ∆” IS THE PASSIVE LOOP WITH NOVELTY- GATED INSERTION (S ECTION III-B2), THE RECOMMENDED DEPLOYMENT CONFIGURATION . ∗ MARKS A ∆ SIGNIFICANTLY DIFFERENT FROM ZERO ( TWO - SIDED W ILCOXON SIGNED - RANK ON PER - SEED DELTAS , H OLM - CORRECTED ACROSS 15 CATEGORIES , α = 0.05); IT IS REPORTED FOR THE PASSIVE AND GATED CONFIGURATIONS . ACTIVE DELTAS ARE NOT SEPARATELY TESTED AGAINST ZERO , BECAUSE NO CATEGORY SHOWS A SIGNIFICANT PASSIVE - VS - ACTIVE DIFFERENCE UNDER THE SAME TEST.

0.8139 0.8839 0.8703 0.9558 0.8803 0.9242 0.9290 0.9185 0.8787 0.9776 0.9964 0.9912 0.9932 1.0000 1.0000

HO Base.

Pass. HO Final

Pass. ∆

Act. ∆

Gated ∆

0.9722 0.8190 0.9105 0.9379 0.9980 0.9051 0.9310 0.9069 0.9317 0.9679 0.9985 0.9940 0.9961 1.0000 0.9991

+0.146∗ −0.047∗

+0.146 −0.056 +0.043 −0.031 +0.098 −0.026 −0.012 −0.018 +0.054 −0.012 +0.002 +0.004 +0.003 0.000 −0.001

+0.101∗ −0.031∗ +0.048∗ +0.005 +0.089∗ +0.007 +0.003 +0.006 +0.051∗ −0.001 +0.003 +0.004 +0.003 0.000 −0.000

0.8264 0.8662 0.8703 0.9623 0.9000 0.9283 0.9403 0.9260 0.8772 0.9806 0.9960 0.9898 0.9930 1.0000 1.0000

converging to parity (zipper), and still climbing when the budget ends (screw). The cold-start result survives both protocol variations. Without the gate (k = 10 ungated), 11 of 15 categories are Holm-significantly positive with mean recovery 0.89 and still no significant negatives; with k = 20 (156 patches, higher cold baselines and smaller gaps), 8 of 15 remain significantly positive with mean recovery 0.85. Neither the choice of k nor the gate produces the effect. Even grid, the open failure of the full-training setting, is neutral here (+0.038, not significant), and the flat-to-negative group of Table III becomes uniformly positive: when the bank genuinely undersamples normal appearance, every correction teaches something. The honest limits: capsule recovers only 37% of its gap, screw exhausts the 90-round budget at half recovery, and pill reaches 61% after a mean of 77 reviews. On categories with large error pools the loop is label-efficient, not label-free. D. Key Category Analysis We analyse the two instructive extremes: toothbrush, the largest success, and the flat-to-negative group, the method’s boundary. 1) Toothbrush: Maximum Feedback Benefit: Toothbrush is the hardest category in our evaluation (separation index 2.6σ, baseline AUROC 0.8139) and produces the largest heldout improvement observed: 0.826 → 0.972 (+0.146) on images the correction loop never touches, improving on 19 of 20 splits (worst split −0.028) with a mean of only ∼13 corrections. Pool AUROC reaches 1.000 on every split, but per Section III-E4 that figure partly reflects memorisation of corrected images and should not be quoted as the result. Figure 6 shows held-out ROC curves before and after correction at the median seeds: the corrected curves dominate at every operating point, so the gain is not an artefact of the AUROC summary. Why do so few reviews suffice? Clearing one falsely flagged image adds its 784 patches to a bank of

+0.040∗ −0.024∗ +0.098∗ −0.023∗ −0.009 −0.019 +0.054∗ −0.013∗ +0.002 +0.004 +0.003 0.000 −0.001

Held-Out Trajectories: Cold-Start Recovery (a c) and the Effect of the Novelty Gate (d) (mean ±1 std over 20 seeds) (a) Metal Nut cold start

1.0

(b) Zipper cold start 0.9

0.9

Held-out AUROC

2.6 2.6 3.0 3.7 4.3 4.3 4.3 4.6 4.9 6.0 7.0 7.6 9.5 23.1 50.5

Full-test Base.

0.8 0.7 0.6 cold start (10 samples) + HITL full-training baseline (0.900)

0.5 0

10

20

30

40

Correction round

50

0.8 0.7 0.6 cold start (10 samples) + HITL full-training baseline (0.877)

0.5

60

0

(c) Screw cold start 0.8

0.96

0.7

0.94

0.6 0.5 0.4 0.3

cold start (10 samples) + HITL full-training baseline (0.870)

0

20

40

60

Correction round

10

20

30

40

Correction round

50

60

70

(d) Pill full training, gate on vs. off Held-out AUROC

Object Texture Object Object Object Object Object Object Object Texture Object Texture Texture Texture Object

Sep.(σ)

Held-out AUROC

Toothbrush Grid Screw Transistor Metal Nut Pill Capsule Cable Zipper Tile Hazelnut Wood Carpet Leather Bottle

Type

Held-out AUROC

Category

80

0.92 0.90 0.88

ungated novelty-gated baseline (0.928)

0.86 0

5

10

15

20

Correction round

25

30

Fig. 5. Held-out trajectories (mean ±1 std over 20 seeds). (a–c) Cold-start recovery from 10 golden samples with the novelty gate: metal nut crosses its full-training baseline around round 50 and ends above it; zipper converges to just below parity after a transient early dip (corrections on a 78-patch bank briefly disturb scores before coverage accumulates); screw is still climbing when the 90-round budget ends, far from parity (the budget-limited case). (d) Pill on a fully trained bank: the ungated loop drifts below baseline while the novelty-gated loop stays above it, showing the gate’s effect in a single panel.

only 470, which lowers nearest-neighbour distances for every image (held-out included) whose patches fall near the newly covered region. One label redefines a region of normal appearance; this transfer to held-out data is what separates correction from memorisation. The consequence is visible per round: on toothbrush and metal nut the entire gain arrives in one or two decisive FP corrections (on toothbrush a single round contributes +0.139) and most rounds contribute nothing, while screw, with a larger and noisier error pool, accumulates its gain gradually. The loop’s value lies in reaching those images, not in correction volume. The FP/FN ablation (Section IV-I)

PREPRINT

10

TABLE IV C OLD - START RESULTS : INITIAL BANK BUILT FROM ONLY k = 10 TRAINING NORMALS (78 PATCHES ), PASSIVE QUERYING WITH NOVELTY- GATED INSERTION , 90- ROUND BUDGET, MEANS OVER 20 SEEDS . “F ULL R EF.” = FULL - TRAINING - BANK HELD - OUT BASELINE ON THE SAME SEED ( PAIRED ). R ECOVERY = FRACTION OF THE COLD - TO - FULL GAP CLOSED ( SHOWN WHERE THE GAP EXCEEDS 0.02). “L ABELS TO PARITY ” = MEDIAN REVIEWS TO REACH THE FULL - TRAINING REFERENCE , WITH THE NUMBER OF SEEDS REACHING IT. ∗ = H OLM - SIGNIFICANT ∆ (W ILCOXON , α = 0.05); NO CATEGORY IS SIGNIFICANTLY NEGATIVE . Category

Cold Base

Post-HITL

Full Ref.

∆

Recovery

Reviews

Labels to Parity

Bottle Cable Capsule Carpet Grid Hazelnut Leather Metal Nut Pill Screw Tile Toothbrush Transistor Wood Zipper

0.957 0.756 0.560 0.987 0.681 0.921 1.000 0.677 0.579 0.467 0.968 0.732 0.656 0.982 0.750

0.996 0.866 0.699 0.996 0.719 0.998 1.000 0.927 0.791 0.671 0.972 0.904 0.857 0.989 0.864

1.000 0.926 0.940 0.993 0.866 0.996 1.000 0.900 0.928 0.870 0.981 0.826 0.962 0.990 0.877

+0.039∗ +0.110∗ +0.139∗ +0.008∗ +0.038 +0.077∗ +0.000 +0.250∗ +0.212∗ +0.204∗ +0.004 +0.172∗ +0.202∗ +0.007∗ +0.114∗

0.92 0.65 0.37 — 0.20 1.03 — 1.12 0.61 0.50 — 1.82 0.66 — 0.89

14 50 80 18 37 16 19 42 77 90 26 12 32 10 44

5 (7/20) 35 (1/20) — (0/20) 8 (2/20) 24 (6/20) 4 (14/20) — (0/20) 36 (15/20) 22 (1/20) — (0/20) 4 (2/20) 8 (15/20) 23 (1/20) — (0/20) 19 (9/20)

Held-Out ROC Curves Before and After HITL Correction 1.0

0.8 0.6 0.4 0.2 0.0 0.0

Before (AUROC=0.861) After passive (AUROC=1.000) After active (AUROC=1.000)

0.2

0.4

0.6

False Positive Rate

0.8

1.0

Screw (median seed 21)

1.0

0.8

True Positive Rate

Toothbrush (median seed 26) True Positive Rate

True Positive Rate

1.0

0.6 0.4 0.2 0.0 0.0

Before (AUROC=0.936) After passive (AUROC=0.983) After active (AUROC=0.994)

0.2

0.4

0.6

False Positive Rate

0.8

1.0

Metal Nut (median seed 27)

0.8 0.6 0.4 0.2 0.0 0.0

Before (AUROC=0.908) After passive (AUROC=1.000) After active (AUROC=1.000)

0.2

0.4

0.6

False Positive Rate

0.8

1.0

Fig. 6. Held-out ROC curves before (grey) and after correction under passive (blue) and active (red dashed) querying, for the three largest-improvement categories at their median-improvement seed. The corrected ROC dominates the baseline everywhere; passive and active endpoints are nearly identical.

and the matched-budget control (Section IV-H) complete the mechanism account. 2) Where Correction Fails: The Flat-to-Negative Group: The six flat-to-negative categories share a profile: their banks are comparatively large, their remaining errors genuinely ambiguous, so FP corrections add patches the bank already covers, and the redundant insertion perturbs previously correct decisions. Grid is the clearest case (−0.047, degrading on 15/20 splits). The novelty gate (Section IV-B) resolves five of the six by refusing exactly these redundant insertions. Grid alone remains significantly negative when gated (−0.031): it inserts 230 patches per correction yet still degrades, so its failure is not a coverage problem. It is the method’s one open failure in the mature-bank setting, though it is unharmed at cold start (Table IV). The practical rule: enable the gate by default and confirm per category with a held-out check. E. Strategy Comparison Passive and active querying are statistically indistinguishable: a paired Wilcoxon test on per-seed held-out end-

points finds no significant difference on any category, and mean improvements agree within ±0.01 AUROC on all 15 categories (Table III); the residual differences sit well inside seed-to-seed variance, and the per-seed distributions of the two strategies overlap heavily on every category (Section IV-G). Mean held-out trajectories with 95% confidence bands overlap at every round on 14 of 15 categories (Fig. 7). The one exception concerns speed rather than destination: on metal nut, active querying reaches the ceiling in 4 rounds versus 9 for passive (per-seed means; mean AUCC 0.88 vs. 0.71), the only stretch where the bands separate, yet both converge to the same endpoint. Note that time-to-ceiling is shorter than session length: metal nut sessions run a mean of ∼20 reviews, but the gain is complete well before the error pool is exhausted. An earlier single-seed finding that passive wins on 9 of 11 categories does not survive this evaluation, and we retract it; the mechanism (global bank updates plus a budget that exhausts the error pool under either ordering) is discussed in Section V. Held-out AUCC follows the same pattern as the AUROC

PREPRINT

11

Held-Out AUROC over Correction Rounds: Passive vs Active Querying (mean over 20 seeds; bands = 95% CI of the mean)

0.85

Held-out AUROC

Held-out AUROC

Passive (AUCC=0.56) Active (AUCC=0.56) Baseline (mean)

0.90

0.0

2.5

5.0

7.5

10.0

Correction round

12.5

15.0

0.84 0.82 0.80

17.5

0

Screw ( =3.0)

0.90 Passive (AUCC=0.35) Active (AUCC=0.32) Baseline (mean)

0.86 0

5

10

15

20

25

Correction round

Held-out AUROC

0.92

0.88

5

20

0.96

25

0.997 0.996 Passive (AUCC=0.43) Active (AUCC=0.42) Baseline (mean)

10

15

Correction round

20

25

Held-out AUROC

0.998

5

0.0

0.1

id

Gr

0.92 0.90 0

5

10

15

Correction round

20

t Too

h rus

hb

rew

Sc

r

sto

nsi

Tra

tal Me

t

Nu

l

Pil

le

psu

Ca

ble

Ca

r

pe

Zip

e

Til

od Wo

Ca

t

rpe

Fig. 8. Per-seed distributions of held-out AUROC improvement (20 seeds per category; blue = passive, red = active). Toothbrush, metal nut, zipper and screw improve consistently; grid, transistor, pill, capsule, cable and tile centre at or below zero. Passive and active distributions overlap heavily on every category.

25

0.96

0

0.1

Capsule ( =4.3)

0.999

0.995

0.2

30

Passive (AUCC=0.71) Active (AUCC=0.88) Baseline (mean)

0.94

0.88

30

15

Correction round

Passive Active

0.98

Hazelnut ( =7.0)

1.000

10

Metal Nut ( =4.3)

1.00

0.94

Held-out AUROC

0.86

0.78

0.80

Held-out AUROC

Passive (AUCC=0.03) Active (AUCC=0.03) Baseline (mean)

0.88

0.95

0.994

Grid ( =2.6)

0.90

Held-out AUROC improvement

Toothbrush ( =2.6)

1.00

Multi-Seed Validation: Held-Out Improvement Distributions (20 Seeds per Category) (Blue = passive, red = active; boxes span quartiles, whiskers 1.5 IQR) 0.3

0.95 0.94 0.93 0.92 0.91

Passive (AUCC=0.07) Active (AUCC=0.09) Baseline (mean)

0.90 0

5

10

15

20

Correction round

25

30

Fig. 7. Held-out AUROC over correction rounds for passive (blue) and active (red) querying, on six categories spanning the difficulty range (mean over 20 seeds; bands are the 95% confidence interval of the mean, t-based with n = 20, not the seed-to-seed spread). The bands overlap at every round except on metal nut, where active querying rises faster over the first few rounds before both strategies converge to the same endpoint: a difference in speed, not destination.

deltas: correction utility concentrates in the low-σ categories with FP-dominated error pools (Table III), and passive and active AUCC agree on every category except metal nut. F. Ablation Study: kremove Parameter Ablating kremove , the number of bank entries removed per FN correction, on toothbrush across k ∈ {1, 3, 5, 9} gives identical results in every case (AUCC 0.9984, final AUROC 1.0000), because that session drew only FP corrections and the parameter never triggered. (Single seed 42, pool-only evaluation, predating the held-out protocol; the conclusion concerns the correction mechanism, not the split.) Toothbrush sessions are not generally FN-free: under the held-out protocol they average 5.0 FN corrections (Table V), which Section IV-I shows to be near no-ops. We use k = 5 throughout, large enough to open a gap in the manifold and small enough to avoid over-removal.

seeds improved) are robust well beyond noise. Second, the flatto-negative categories are consistently flat-to-negative (grid degrades on 15/20 seeds), so their failure is systematic rather than sampling misfortune. Third, on hard categories a single seed can land anywhere within a third of the AUROC scale (toothbrush single-seed improvements range from −0.03 to +0.31), which explains why earlier single-seed comparisons of querying strategies produced unstable conclusions: individual seeds can and do flip the passive-vs-active winner. Any claim in this domain based on a single split should be treated as anecdote. H. Label Economics: Is the Gain Just Extra Training Data? Since FP corrections append correctly-labelled normal images to the bank, does the held-out gain merely reflect data volume? We test this on toothbrush with matched budgets (20 confirmation seeds): the HITL loop reaches held-out AUROC 0.972 with 12.6 labels on average; labelling the same number of randomly chosen pool images reaches only 0.901; appending all pool normals (the more-data ceiling) reaches 0.974, but costs ∼29 labels, because every pool image must be reviewed to establish which ones are normal. So yes, the gain is delivered through added labelled data, but the loop is what makes that data obtainable. At deployment, unlabelled data cannot be added safely (one mislabelled defect poisons the bank), so the reviewer is the only source; and errortriaged review reaches the more-data ceiling at 43% of its labelling cost, because random labelling wastes most labels on defects, where corrections are near no-ops. We claim not that the loop beats equivalent training data, but that it is the mechanism by which such data becomes obtainable, cheaply, after deployment.

G. Multi-Seed Validation Every result in this paper is a mean over 20 independent pool/held-out splits (seeds 10–29); multi-seed validation is therefore built into the protocol rather than performed post hoc on selected categories. Figure 8 shows the full per-seed distribution of held-out improvement for every non-ceiling category and both strategies. Three observations follow. First, the seed-consistent winners (toothbrush 19/20, metal nut 20/20, zipper 20/20, screw 15/20

I. Ablation Study: FP vs. FN Correction To isolate the contributions of FP and FN corrections, we rerun the toothbrush sessions with the reviewer restricted to a single error type (FP-only or FN-only, the skipped type excluded from review entirely) under the full held-out protocol (20 seeds, passive querying). Table V reports the result. The asymmetry is stark. FP-only correction reproduces the entire improvement: its final held-out AUROC equals the

PREPRINT

12

TABLE V FP VS . FN CORRECTION ABLATION , TOOTHBRUSH PASSIVE , HELD - OUT PROTOCOL ( MEANS OVER 20 SEEDS ). R ESTRICTED MODES EXCLUDE THE SKIPPED ERROR TYPE FROM REVIEW; ∆ IS HELD - OUT FINAL MINUS BASELINE (0.826). Mode

HO Final

∆

HO AUCC

FP/FN corr.

FP-only Both FN-only

0.9722 0.9722 0.8139

+0.146 +0.146 −0.013

0.709 0.563 0.004

7.5/0 7.6/5.0 0/8.8

FP vs FN Correction Mix by Category and Strategy (Mean over 20 Seeds)

Corrections (mean)

25

Grid 23.5

22.1

20

14 12 8

10

6

0

0

Passive

20

25 20

15

15

10

10

Passive

Active

0

Hazelnut 20

21.2

22.1

18.5

12

Passive

12.0

Active

Wood 11.5

6

10

4 5

2 Active

0

30

Passive

Active

Metal Nut 23.4

5 Passive

Active

30.0

29.6

0

17.5

Passive

17.9

Active

Zipper

20.0 17.5 15.0 12.5 10.0 7.5 5.0 2.5 0.0

17.5

15.0

20

12.5

12.5

10.0

10.0

7.5

7.5

2.5

0

0.0

16 14 12 10 8 6 4 2 0

13.9

5.0

5 Passive

Active

Carpet 15.2

Passive

15.3

Active

16.3

Passive

Active

Tile 16.9

18.6

15.0

5.0 2.5 Passive

Active

0.0

Leather (ceiling control) 20.0 17.5 15.0 12.5 10.0 7.5 5.0 2.5 0.0

20.0

20.0

25

10

8

Passive

0

Transistor 22.5

10

15

10

15

0

15

Cable 20.9

5

5 0

20

Capsule 29.5

28.8

Active

25 20

5

2 Active

30.0

29.7

25

10

4 FP FN

Passive

Screw 30

15

Pill 30

12.9

10

15

5

Toothbrush 12.6

15.5

Passive

16.6

Active

Passive

Active

Bottle (ceiling control) 16 14 12 10 8 6 4 2 0

11.7

12.5

does give FN correction a real, non-zero effect, and that effect is destructive: every non-zero removal size collapses AUROC by roughly the same amount, from a baseline of 0.811 to a final 0.54–0.56, independent both of the anchor metric and of how many points are removed per correction. The cause is the coreset itself. A false negative scores low precisely because its worst patch sits close to a legitimate normal bank entry; removing that neighbour to fix the one image also pushes away every other normal-looking patch in the same region, including patches from genuinely normal test images. On a bank that is already a minimal 1% coreset (470 patches for toothbrush) there is no safe removal size, so this is not a magnitude-tuning problem. We therefore retain the 1-NN anchor deliberately. Its mismatch with the scoring metric is what keeps FN correction close to a no-op, and on a minimal coreset a no-op is strictly preferable to a reliable means of destroying the bank. An effective FN mechanism would have to be additive rather than subtractive; the defect-memory pilot (Section V-B) tests the most obvious additive design and also fails. V. D ISCUSSION

Passive

Active

Fig. 9. FP vs. FN correction mix across all 15 categories (mean counts over 20 seeds). Blue = FP, red = FN. Bottle and leather are ceiling controls.

combined loop’s on every one of the 20 seeds (+0.146, Wilcoxon vs. zero p < 10−4 ), and it arrives in fewer reviews (7.5 vs. 12.6; AUCC 0.709 vs. 0.563), because no budget is spent on FN reviews that do not change the destination. FN-only correction achieves nothing: a mean of 8.8 removals per session leaves held-out AUROC at baseline on 13 of 20 seeds, with a residual mean that is slightly negative (−0.013, unadjusted p = 0.034). Removal is, if anything, mildly harmful here. Two causes compound. The first is the bank itself: toothbrush’s errors come from gaps in normal coverage, which FP insertion fills directly, whereas FN removal deletes entries from a bank that is already too sparse. The second is a metric mismatch: the removal anchor is selected by 1-NN distance (Eq. 5) while the image score is the mean-of-nine statistic (Eq. 1), so the excised neighbourhood is frequently not the one that set the score. Removal is therefore both intrinsically risky on a minimal coreset and often aimed at the wrong location. Figure 9 extends the picture to all categories under the multi-seed protocol: every seed-consistent winner has an FP-dominated error pool. 1) Why the Anchor Metric Is Not “Fixed”: Protocol note: like the other parameter ablations, this investigation predates the held-out protocol and was run under pool-only evaluation at a single seed (42). Section III notes that the removal anchor (Eq. 5, 1-NN) and the image score (Eq. 1, mean-of-nine) are different metrics, so removal frequently excises a neighbourhood other than the one that set the score. The obvious remedy is to re-anchor removal on the mean-of-nine patch that actually drives the score. We tested exactly that, on an FN-only correction sequence on toothbrush with kremove swept over {1, 2, 3, 5, 8}. Re-anchoring

A. Why Querying Strategy Barely Matters The strategy-equivalence result (Section IV-E) contradicts the standard active learning assumption, and the mechanism explains why. Uncertainty sampling assumes updates are local: a boundary-adjacent sample mainly improves the boundary near itself, so sample choice matters. Memory bank corrections are global: inserting a false positive’s patches changes nearestneighbour distances for every image, and the review budget exhausts the eligible error pool under any ordering. When every error is eventually corrected and every correction acts globally, order contributes nothing, so uncertainty sampling buys nothing. An earlier single-seed analysis had instead found passive querying winning on 9 of 11 categories; multi-seed validation (Section IV-G) exposed that as seed noise, and we retract it as a cautionary example for evaluation practice in this domain. We also tested a centroid-distance query rule (FP: most centroid-distant normal; FN: most centroid-proximal anomaly) in single-seed pool-protocol experiments predating the heldout protocol: it matched passive on toothbrush, underperformed on metal nut, and was severely counterproductive on cable, in each case through a strong FP-selection bias. Query strategies that measurably beat random ordering for memory bank correction remain an open problem. B. Negative Result: Defect Memory Bank Could FN corrections contribute symmetrically, by memorising operator-confirmed defect patches in a second bank and scoring images by the margin between distance-to-normal and distance-to-defect? A pre-registered pilot (pill, screw, cable; 20 seeds; passive) answers no, decisively: held-out AUROC collapses on pill (−0.226) and screw (−0.299, worse than the standard loop on 20/20 seeds; both Holm p < 10−4 ), with mid-run dips of 0.26–0.49 AUROC, while cable is indistinguishable from the standard loop. A defect bank built from

PREPRINT

∼28 rejected images over-generalises, pulling large regions of normal appearance toward “defect.” Per the pre-registered gate, no full sweep was run. Together with the FP/FN ablation (Section IV-I), where FN removal is a measured near no-op, this fixes the paper’s central mechanism claim: memory bank correction works by teaching normality, not by memorising defects. C. Bank Growth, and Why the Cap Is Not the Problem Bank growth over correction rounds is largest exactly where correction helps most: toothbrush grows ∼14× from its 470patch original bank, because nearly every inserted patch covers new manifold. For the flat-to-negative group, one hypothesis is the opposite failure: that the cap’s random subsampling churns away accumulated corrections. A 20-seed control with the cap removed refutes it: no held-out delta changes except transistor’s (+0.021). The failures come from the corrections themselves, through redundant insertion into already-covered banks, which is precisely the failure mode the novelty gate removes (Section IV-B). D. What the Loop Cannot Fix Two structural limits survive gating. First, globally-defined defects: cable’s cable_swap is locally identical to a normal cable (only the arrangement is wrong), and patch-level correction cannot encode global structure. Second, grid: it inserts 230 patches per correction yet still loses 0.031 AUROC in the mature-bank setting (Section IV-D2), so its errors are not a coverage problem; it is the method’s one open failure, though it is unharmed at cold start. A general warning follows from the held-out protocol: on every failing category the pool metric still rises, so an operator watching in-loop accuracy would believe the loop is working while generalisation worsens. Monitoring must use never-corrected images. E. Practical Deployment Guidelines Who: a quality engineer who already reviews model output. The expert contributes one binary label per reviewed image and needs no ML knowledge, Python, or training infrastructure. When: enable the novelty gate by default; with it, no MVTec category except grid is significantly harmed, so the loop is safe to leave on. Gains are largest where errors are FPdominated from an undersampled normal manifold (+0.05 to +0.10 AUROC gated), and largest of all at cold start, where they reach +0.25 (Section IV-C). Confirm per category with a held-out check; never gate on in-loop accuracy (see above). Near-ceiling categories need no correction. How: passive random querying, since active querying adds computation and configuration for no measurable benefit. Effective categories exhaust their errors in 13–20 corrections (screw, with its larger error pool, uses the full 30-round budget), i.e. roughly 13–20 minutes of review at one image per minute. Monitor a held-out sample and stop if it trends downward. Infrastructure: none beyond the deployed model. Bank edits are CPU operations; no training data, no optimisation framework, no ML team.

13

VI. C ONCLUSION We presented a training-free human-in-the-loop framework in which a quality engineer corrects a deployed anomaly detector by reviewing misclassified images: one binary decision per image, applied as a direct memory bank edit. Evaluation across all fifteen MVTec AD categories yields five findings. First, the strongest deployment case is cold start. From a bank built on ten golden samples, corrections close a median 66% of the gap to an uncorrected fully trained bank (mean 80%, raised by three categories that overshoot parity), significantly improving 12 of 15 categories and harming none. Ten samples plus corrections outperform hundreds of samples without them. We are careful not to overstate this: a corrected full-training bank still finishes higher on the same categories (toothbrush 0.927 vs. 0.904, metal nut 0.989 vs. 0.927), so the result is about what is achievable on day one of a deployment, not about curation dominating data. Second, on mature banks correction is effective where the bank undersamples normal appearance, and only there. On held-out images the loop never touches, toothbrush improves from AUROC 0.826 to 0.972 in a mean session of roughly 13 single-decision reviews and metal nut from 0.900 to 0.998 in roughly 20, consistently across 20 splits. At one image per minute, that is 13–20 minutes of review. Those endpoints are for the ungated loop; the novelty-gated configuration we recommend for deployment trades some of the gain for safety, reaching 0.927 and 0.989 respectively (third finding below). Five categories sit at ceiling and cannot move, so the mature-bank gains are confined to four of fifteen. Third, honest evaluation requires a held-out protocol, and acting on it produced the novelty gate. Corrected images enter the bank, so evaluation on reviewed images inflates toward AUROC 1.0 by memorisation. The held-out protocol reveals six categories where the raw loop is flatto-negative; diagnosing the cause (redundant insertion into already-covered banks) yielded the novelty gate, which eliminates the degradation on five of the six, preserves every winner, and leaves grid as the single open failure. Fourth, querying strategy barely matters. Passive and active querying are statistically indistinguishable on every category: bank edits act globally, and the budget exhausts the error pool under either ordering. An earlier single-seed finding that passive wins on 9 of 11 categories did not survive multiseed validation; we retract it explicitly, alongside negative results for centroid-distance querying, for re-anchoring FN removal on the scoring metric, and for a defect-memory second bank. The mechanism is teaching normality, cheaply and in any order. Fifth, the gains equal what the same labels would achieve at training time. The framework’s contribution is not outperforming training data but producing correctly-labelled data at deployment, where unlabelled data cannot be added safely, at 43% of the labelling cost of exhaustive review, and applying it without retraining. A. Limitations Our evaluation uses a research implementation on MVTec AD. With per-session feature caching, per-round compute is

PREPRINT

seconds on hard categories, rising toward a minute as the bank grows; production deployment would use approximate nearest-neighbour indexing. All headline results are means over 20 pool/held-out splits per category (Section III-E4); the centroid-querying investigation and the kremove parameter ablation predate this protocol and are marked as single-seed, poolprotocol results. Held-out sets are small on some categories (∼13 images for toothbrush), so single-split AUROCs are noisy: read means and seed win-counts (Fig. 8), not individual splits. Correction is image-level only; pixel-level correction remains future work. B. Future Work Batched correction: applying several corrections before rescoring may stabilise complex categories such as cable. • Production-speed implementation: approximate nearest-neighbour indexing (FAISS, HNSW) and incremental rescoring would cut per-round latency to seconds, leaving expert review time (∼1 minute per image) as the only bottleneck. • Pixel-level correction: letting the expert mark the anomalous region, not just the image label. • Cross-category transfer: corrections for one product variant may transfer to related variants. • Foundation model integration: applying the correction loop on top of zero-shot detectors [34], [41]. • Live human trial: replacing simulated feedback with genuine domain experts (Section VI-C) is the necessary next validation step.

•

C. Threats to Validity Simulated feedback: the expert is simulated from MVTec ground-truth labels and is always right. Real reviewers disagree with ground truth in ambiguous cases, fatigue, and drift; our results are an upper bound under perfect feedback, and a live trial is required before industrial claims. Operator error is costliest at cold start: relaxing the perfect-feedback assumption does not cost the same in every regime. A single “normal” label on a true defect inserts up to 784 defect patches into the normal bank. Against a mature bank near the 12,000-patch cap that is a few per cent contamination; against a 78-patch cold-start bank it is an order of magnitude more feature mass than the bank itself. Our strongest result is therefore also the one most exposed to imperfect feedback, and a live trial should establish an operator error rate, and the value of an escalation option that applies no correction, before the small-bank regime is deployed. Single dataset: MVTec AD spans 15 diverse categories but not the full range of factory conditions (lighting variation, camera drift, novel defect types). Findings should be revalidated on proprietary data before being treated as general. Mechanism specificity: direct bank editing applies to memory-bank detectors (PatchCore and coreset-based relatives). Reconstruction-, flow-, or classifier-based detectors expose no equivalent editable structure; we claim nothing beyond the memory-bank family.

14

Timing: reported wall-clock times are dominated by research-grade GPU rescoring. “Minutes of review” describes the human component and assumes the production-speed implementation above. Prior work has modified PatchCore banks automatically; what this paper establishes is different in kind: the person who already reviews the errors can now fix them immediately, without an ML team. Where a formal retraining cycle takes weeks to months, a correction session takes 13–20 minutes. That shift, in both who can correct the model and how fast, is the framework’s most useful property. DATA AND C ODE AVAILABILITY All experiments use the publicly available MVTec AD benchmark [2], obtainable from the MVTec Software GmbH website under its research licence; no proprietary or personal data were used. The correction-framework implementation and the experiment scripts that reproduce every reported result are available from the corresponding author on reasonable request. ACKNOWLEDGMENT This research received no external funding. R EFERENCES [1] K. Roth, L. Pemula, J. Zepeda, B. Schölkopf, T. Brox, and P. Gehler, “Towards total recall in industrial anomaly detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 14 318–14 328. [2] P. Bergmann, M. Fauser, D. Sattlegger, and C. Steger, “MVTec AD — a comprehensive real-world dataset for unsupervised anomaly detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 9592–9600. [3] Warranty Week, “Worldwide auto warranty report 2024,” 2024, available: https://www.warrantyweek.com/archive/ww20241003.html. [4] D. Hillier, “The most expensive defect,” Semiconductor Digest, December 2014, available: https://sst.semiconductor-digest.com/2014/12/ the-most-expensive-defect/. [5] MHRA, “Pharmaceutical company fined for manufacturing defective medicine,” 2022, UK Government Press Release, March 2022. Available: https://www.gov.uk/government/news/ pharmaceutical-company-fined-for-manufacturing-defective-medicine. [6] N. Bugarin, J. Bugaric, M. Barusco, D. Dalle Pezze, and G. A. Susto, “Unveiling the anomalies in an ever-changing world: A benchmark for pixel-level anomaly detection in continual learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2024, pp. 4065–4074. [7] Z. Jiang, Y. Zhang, Y. Wang, J. Li, and X. Gao, “FR-PatchCore: An industrial anomaly detection method for improving generalization,” Sensors, vol. 24, no. 5, p. 1368, 2024. [8] G. Pang, C. Shen, L. Cao, and A. van den Hengel, “Deep learning for anomaly detection: A review,” ACM Computing Surveys, vol. 54, no. 2, pp. 1–38, 2021. [9] T. Schlegl, P. Seeböck, S. M. Waldstein, U. Schmidt-Erfurth, and G. Langs, “Unsupervised anomaly detection with generative adversarial networks to guide marker discovery,” in International Conference on Information Processing in Medical Imaging (IPMI), ser. Lecture Notes in Computer Science, vol. 10265. Springer, 2017, pp. 146–157. [10] P. Napoletano, F. Piccoli, and R. Schettini, “Anomaly detection in nanofibrous materials by CNN-based self-similarity,” Sensors, vol. 18, no. 1, p. 209, 2018. [11] G. Wang, S. Han, E. Ding, and D. Huang, “Student-teacher feature pyramid matching for anomaly detection,” in Proceedings of the British Machine Vision Conference (BMVC), 2021. [12] N. Cohen and Y. Hoshen, “Sub-image anomaly detection with deep pyramid correspondences,” 2020, arXiv:2005.02357.

PREPRINT

[13] T. Defard, A. Setkov, A. Loesch, and R. Audigier, “PaDiM: A patch distribution modeling framework for anomaly detection and localization,” in Pattern Recognition. ICPR International Workshops and Challenges, ser. Lecture Notes in Computer Science, vol. 12664. Springer, 2021, pp. 475–489. [14] Z. Liu, Y. Zhou, Y. Xu, and Z. Wang, “SimpleNet: A simple network for image anomaly detection and localization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 20 402–20 411. [15] R. Munro Monarch, Human-in-the-Loop Machine Learning: Active Learning and Annotation for Human-Centered AI. Shelter Island, NY: Manning Publications, 2021. [16] B. Settles, “Active learning literature survey,” University of Wisconsin– Madison, Tech. Rep. 1648, 2010. [17] J. M. Rožanec, E. Montini, V. Cutrona, D. Papamartzivanos, T. Klemenčič, B. Fortuna, D. Mladenić, E. Veliou, T. Giannetsos, and C. Emmanouilidis, “Human in the AI loop via xAI and active learning for visual inspection,” in Artificial Intelligence in Manufacturing: Enabling Intelligent, Flexible and Cost-Effective Production Through AI, J. Soldatos, Ed. Springer, 2023, pp. 381–406. [18] Z. Deng, X. Xuan, K.-L. Ma, and Z. Kong, “A reliable framework for human-in-the-loop anomaly detection in time series,” ACM Transactions on Interactive Intelligent Systems, 2024, arXiv:2405.03234. [19] S. Das, M. R. Islam, N. K. Jayakodi, and J. R. Doppa, “Active anomaly detection via ensembles,” arXiv preprint arXiv:1809.06477, 2018. [20] ——, “Effectiveness of tree-based ensembles for anomaly discovery: Insights, batch and streaming active learning,” Journal of Artificial Intelligence Research, vol. 80, pp. 127–172, 2024. [21] H. Bodor, T. V. Hoang, and Z. Zhang, “Little help makes a big difference: Leveraging active learning to improve unsupervised time series anomaly detection,” in Proceedings of the AIOPS Workshop, 19th International Conference on Service-Oriented Computing (ICSOC), 2021. [22] H. Vishwakarma, H. Lin, and R. K. Vinayak, “Taming false positives in out-of-distribution detection with human feedback,” in Proceedings of the 27th International Conference on Artificial Intelligence and Statistics (AISTATS), ser. Proceedings of Machine Learning Research, vol. 238, 2024, pp. 1486–1494. [23] D. Yamada, H. Vishwakarma, and R. K. Vinayak, “Adaptive scoring and thresholding with human feedback for robust out-of-distribution detection,” arXiv preprint arXiv:2505.02299, 2025. [24] D. D. Lewis and W. A. Gale, “A sequential algorithm for training text classifiers,” in Proceedings of the 17th Annual International ACM SIGIR Conference on Research and Development in Information Retrieval, 1994, pp. 3–12. [25] H. S. Seung, M. Opper, and H. Sompolinsky, “Query by committee,” in Proceedings of the Fifth Annual Workshop on Computational Learning Theory (COLT), 1992, pp. 287–294. [26] M. De Lange, R. Aljundi, M. Masana, S. Parisot, X. Jia, A. Leonardis, G. Slabaugh, and T. Tuytelaars, “A continual learning survey: Defying forgetting in classification tasks,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 7, pp. 3366–3385, 2022. [27] D. Wang, E. Shelhamer, S. Liu, B. Olshausen, and T. Darrell, “Tent: Fully test-time adaptation by entropy minimization,” in International Conference on Learning Representations (ICLR), 2021. [28] W. Li, J. Zhan, J. Wang, B. Xia, B.-B. Gao, J. Liu, C. Wang, and F. Zheng, “Towards continual adaptation in industrial anomaly detection,” in Proceedings of the 30th ACM International Conference on Multimedia, 2022. [29] G. Yang, Z. Deng, and J. Man, “CADIC: Continual anomaly detection based on incremental coreset,” arXiv preprint arXiv:2511.08634, 2025. [30] M. Dahmardeh and F. Setti, “MECAD: A multi-expert architecture for continual anomaly detection,” in Proceedings of the International Conference on Image Analysis and Processing (ICIAP), 2025. [31] W. Fang, H. Che, F. Ren, and Q. Lao, “Normality-preserving continual industrial anomaly detection via orthogonal LoRA banks,” arXiv preprint arXiv:2606.02042, 2026. [32] C. S. Han and K. M. Lee, “Leveraging intermediate representations of time series foundation models for anomaly detection,” arXiv preprint arXiv:2509.12650, 2025. [33] C. Huang, H. Guan, A. Jiang, Y. Zhang, M. Spratling, and Y.-F. Wang, “Registration based few-shot anomaly detection,” in Proceedings of the European Conference on Computer Vision (ECCV), 2022. [34] J. Jeong, Y. Zou, T. Kim, D. Zhang, A. Ravichandran, and O. Dabeer, “WinCLIP: Zero-/few-shot anomaly classification and segmentation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 19 606–19 616.

15

[35] G. Xie, J. Wang, J. Liu, Y. Jin, and F. Zheng, “Pushing the limits of fewshot anomaly detection in industry vision: GraphCore,” in International Conference on Learning Representations (ICLR), 2023. [36] Z. Fang, X. Wang, H. Li, J. Liu, Q. Hu, and J. Xiao, “FastRecon: Fewshot industrial anomaly detection via fast feature reconstruction,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023, pp. 17 435–17 444. [37] S. Zagoruyko and N. Komodakis, “Wide residual networks,” in Proceedings of the British Machine Vision Conference (BMVC). BMVA Press, 2016, pp. 87.1–87.12. [38] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “ImageNet: A large-scale hierarchical image database,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2009, pp. 248–255. [39] O. Sener and S. Savarese, “Active learning for convolutional neural networks: A core-set approach,” in International Conference on Learning Representations (ICLR), 2018. [40] I. Guyon, G. C. Cawley, G. Dror, and V. Lemaire, “Results of the active learning challenge,” in Active Learning and Experimental Design Workshop (AISTATS 2010), ser. Proceedings of Machine Learning Research, vol. 16, 2011, pp. 19–45. [41] Z. Gu, B. Zhu, G. Zhu, Y. Chen, M. Tang, and J. Wang, “AnomalyGPT: Detecting industrial anomalies using large vision-language models,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, 2024, pp. 1932–1940.

Related documents

• Human-in-the-loop machine learning: a state of the art#335795
• LUMIN: Lightweight Universal Manufacturing Inspection Network for Anomaly Detection#971444
• Automated Batch Distillation Process Simulation for a Large Hybrid Dataset for Deep Anomaly Detection#799999
• A Framework for Loop-Free Convergence#501143
• Interpretable Human-Label-Free Deep Learning for Real-Bogus Classification with Uncertainty Quantification#343458