FUAD: Fully Unsupervised Anomaly Detection

• FUAD is an anomaly detection framework that trains on contaminated unlabeled data, assuming a majority of normal instances.
• Key methodologies include memory-bank filtering, dataset refinement, and generative reconstruction to isolate and characterize diverse anomalies.
• Practical applications span industrial inspection, medical imaging, time series, and video where anomalies are sparse and heterogeneous.

Fully Unsupervised Anomaly Detection (FUAD) denotes anomaly detection under the strict condition that training uses only unlabeled data and that the training set itself may already contain anomalous samples, rather than a curated normal-only subset. In this sense, FUAD is a stricter setting than conventional unsupervised anomaly detection, which commonly assumes clean training data. Across industrial inspection, time series, video, telecom KPI monitoring, and medical imaging, FUAD includes image-level classification, pixel-level segmentation, segment-level video detection, and sequence or event-level scoring, but it typically remains grounded in the practical assumption that normal structure dominates the data while anomalies are sparse, heterogeneous, or both (Wang et al., 2024, Im et al., 2024, Geng et al., 25 Mar 2026).

1. Problem formulation and scope

A recurring formulation of FUAD uses an unlabeled training set that contains both normal and anomalous samples, with no image-level, pixel-level, frame-level, or event-level labels available during training. In image FUAD, this is often written as a contaminated training set with anomaly ratio $\alpha \in [0,1)$, while in video FUAD the input may be raw single-scene video containing both normal and abnormal events used directly for training and testing without labels (Zhang et al., 10 Aug 2025, Geng et al., 25 Mar 2026). In industrial anomaly detection, this setting is explicitly contrasted with mainstream unsupervised anomaly detection, which performs well on academic benchmarks but is limited by the idealized assumption of clean training data (Wang et al., 2024).

The literature uses the term in several closely related but not identical senses. In the strongest sense, FUAD means unlabeled contaminated training with no clean normal subset, as in FUN-AD, SSFilter, dataset folding, and related contaminated-training work (Im et al., 2024, Liu et al., 19 Feb 2025, McIntosh et al., 13 Feb 2026). In a broader label-free sense, some systems are called fully unsupervised because training, validation, and threshold calibration do not use anomaly labels, even if they still rely on mostly normal operational data or on healthy-only training data, as in C-MTAD-GAT and AnoBFN (Malacarne et al., 29 Apr 2026, Roy et al., 23 Jul 2025). This terminological spread is one source of ambiguity in the field.

Another important distinction is between FUAD and the standard “unsupervised” practice of training on normal-only data. Several papers explicitly argue that such normal-only training is better viewed as one-class or semi-supervised from an anomaly-detection perspective, because it assumes privileged knowledge that all training samples are normal (Ulmer et al., 2023, Ley et al., 2022). This critique has become central to FUAD as a research program: the problem is not merely label absence, but label absence under contamination.

2. Core assumptions and statistical intuition

The contaminated-training FUAD literature is largely organized around a small set of recurring assumptions. The most common is majority-normal structure: normal samples dominate the training distribution, while anomalies are comparatively rare. This appears explicitly as anomaly scarcity in fully unsupervised domain adaptation for one-class anomaly detection, as dominance of normal frames in fully unsupervised video anomaly detection, and as the practical basis for folding-based transformations of one-class classifiers into unsupervised detectors (Mejri et al., 28 Feb 2025, Geng et al., 25 Mar 2026, McIntosh et al., 13 Feb 2026).

A second assumption is anomaly heterogeneity. Several methods rely not only on rarity, but on the idea that anomalies are diverse and therefore fail to form a stable, compact mode. The learning-bias framework states that normal data exhibit high intra-class consistency while anomalies display high diversity, producing unstable model responses across independently trained sub-models (Zhang et al., 10 Aug 2025). FUN-AD makes a closely related assumption in feature space, modeling normal features as having smaller variance than anomaly features, with $\sigma_N < \sigma_A$, so that close pairs are more likely to be normal-normal than anomaly-anomaly or heterogeneous pairs (Im et al., 2024). The folding framework states the assumption in set form as $|A| \gg |N|$, meaning there are many more ways to be anomalous than nominal (McIntosh et al., 13 Feb 2026).

A third assumption is normal compactness under learned representation. In surrogate anomaly detection, the representation is intended to capture regular patterns of normal data from unlabeled inputs, though the reported benchmark protocol is still one-class in practice (Klüttermann et al., 29 Apr 2025). In information-theoretic image anomaly detection, the unsupervised lower bound is written as a trade-off between maximizing mutual information and minimizing latent entropy, encouraging normal data to be informative yet compact in latent space (Ye et al., 2020). In lossy-compression and entropy-minimization approaches for time series and video, the model is expected to allocate capacity to dominant regularities while leaving rare anomalies as residual distortion (Ley et al., 2022, Geng et al., 25 Mar 2026).

These assumptions are not merely technical conveniences; they delimit where current FUAD methods are expected to work. Multiple papers note that performance degrades when contamination becomes too high, when anomalies are homogeneous and repeated, or when normal data are themselves highly diverse (Zhang et al., 10 Aug 2025, Im et al., 2024, McIntosh et al., 13 Feb 2026). This suggests that present FUAD methods are generally robust only under structured contamination, not under arbitrary adversarial contamination.

3. Methodological families

Taken together, the literature suggests several recurring design patterns.

Family	Representative mechanism	Example papers
Memory-bank and patch filtering	Patch-level denoising before coreset or memory construction	SoftPatch / SoftPatch+ (Wang et al., 2024), FUN-AD (Im et al., 2024)
Dataset refinement and sample filtering	Rank, filter, or purify contaminated training samples before final training	USDR (Ulmer et al., 2023), SRR (Yoon et al., 2021), LLBNAD (Zhang et al., 10 Aug 2025), dataset folding (McIntosh et al., 13 Feb 2026), SSFilter (Liu et al., 19 Feb 2025)
Distillation under contamination	Modify teacher-student training so anomaly features are not distilled	CDD (Liu et al., 25 Aug 2025)
Reconstruction, compression, and generative modeling	Learn dominant normal structure so anomalies reconstruct poorly	Lossy compression (Ley et al., 2022), MLE-UVAD (Geng et al., 25 Mar 2026), AnoBFN (Roy et al., 23 Jul 2025)
Pseudo-label generation	Create coarse or fine pseudo-labels from unlabeled data, then train a discriminative detector	C2FPL (Al-lahham et al., 2023)
Domain-shifted FUAD	Recover a proxy target-normal subset before alignment	Two-fold unsupervised curse / dominant cluster (Mejri et al., 28 Feb 2025)

Memory-oriented methods attack contamination at the representation-storage stage. SoftPatch and SoftPatch+ are described as memory-based unsupervised anomaly detection methods that denoise data at the patch level; noise discriminators generate outlier scores for patch-level noise elimination before coreset construction, and the scores are stored in the memory bank to soften the anomaly detection boundary (Wang et al., 2024). FUN-AD also works in patch space, but replaces static memory with an iteratively reconstructed memory bank and complements pseudo-labeling with mutual smoothness on mutually closest pairs (Im et al., 2024).

Dataset-centric wrappers instead try to recover a cleaner proxy-normal set. USDR measures how much including a sample in training changes its later residual, arguing that anomalous samples contribute differently to model generalization than normal ones (Ulmer et al., 2023). SRR uses an ensemble of one-class classifiers trained on disjoint subsets, retains only samples that all classifiers regard as normal, and iteratively relearns self-supervised representations on the refined set (Yoon et al., 2021). LLBNAD partitions the training set, trains sub-models, averages their anomaly scores, and keeps the lowest-scoring fraction as a purified dataset (Zhang et al., 10 Aug 2025). Dataset folding similarly trains multiple instances of a one-class detector on random folds and filters training data by cross-fold voting, leaving the underlying detector unchanged (McIntosh et al., 13 Feb 2026).

Reconstruction and generative approaches work by biasing the model toward dominant regularities rather than explicitly filtering data. The lossy causal temporal convolutional autoencoder uses a rate-distortion objective and an entropy bottleneck so rare events are not worth encoding accurately, and therefore survive as distortion (Ley et al., 2022). MLE-UVAD combines reconstruction loss with a Minimal Latent Entropy loss so sparse abnormal embeddings are pulled into the dominant normal cluster, producing poor reconstruction for anomalies (Geng et al., 25 Mar 2026). AnoBFN trains on healthy FDG-PET only and generates pseudo-healthy reconstructions of abnormal inputs through Bayesian flow updates with recursive input feedback (Roy et al., 23 Jul 2025).

Finally, some methods transform FUAD into a pseudo-supervised problem. C2FPL first generates coarse video-level pseudo-labels by hierarchical divisive clustering, then refines them into segment-level pseudo-labels by statistical hypothesis testing and trains a segment-level anomaly detector in supervised fashion on those pseudo-labels (Al-lahham et al., 2023).

4. Representative mechanisms

SoftPatch and SoftPatch+ exemplify patch-level contamination handling in industrial inspection. They are described as the first methods to consider fully unsupervised industrial anomaly detection as unsupervised anomaly detection with noisy data. Their mechanism is patch-level denoising before coreset construction: noise discriminators generate outlier scores for patch-level noise elimination, and those scores are stored in the memory bank to soften the anomaly detection boundary. SoftPatch+ is described as particularly useful in industrial scenarios with high levels of noise from 10% to 40%, and both methods are reported to outperform state-of-the-art anomaly detection methods on MVTecAD, ViSA, and BTAD while remaining comparable to noise-free methods in conventional unsupervised settings (Wang et al., 2024).

FUN-AD formalizes a different geometric route. It assumes that pairwise feature distances between normal samples are on average likely to be smaller than those between anomaly samples or heterogeneous pairs, and that mutually closest pairs are likely homogeneous if normal data have smaller variance than anomaly data (Im et al., 2024). On that basis it constructs an iteratively reconstructed memory bank, pseudo-labels patches by nearest-neighbor distance to the bank, and regularizes the detector with a mutual smoothness loss over mutually closest pairs. The method is notable because it does not merely filter anomalies out; it attempts to use both confident normal and confident anomaly information to train a discriminative local detector (Im et al., 2024).

SSFilter moves the filtering problem from patches to samples. It introduces a sample-level filtering framework that combines a batch-level anomaly scoring mechanism based on mutual patch comparison with a fine-grained uncertainty score derived from regression errors in anomalous regions and prediction uncertainty. It further adds realistic anomaly synthesis and an integrity enhancement strategy that restores hidden truth by pasting mined anomaly material onto trusted normal samples and training the model to reconstruct the original clean features (Liu et al., 19 Feb 2025). In this design, filtering is both an end-to-end robust-training mechanism and a post-training dataset-cleaning tool for other anomaly detectors.

CDD extends teacher-student reverse distillation into contaminated training. Its starting point is the observation that under FUAD, a student can learn the teacher’s representation of anomalies if those anomalies recur often enough in the training set (Liu et al., 25 Aug 2025). CDD addresses this with Domain-Specific Training, which splits the training set into multiple domains with lower anomaly ratios, and Cross-Domain Knowledge Aggregation, where out-of-domain students generate pseudo-normal features that guide a global student. At inference, anomaly maps are still computed by teacher-student cosine discrepancy, but the student has been trained to reconstruct generalized normal features rather than contaminated teacher features (Liu et al., 25 Aug 2025).

Wrapper methods provide yet another mechanism. USDR trains multiple residual-based models on overlapping subsets and scores each sample by the gap between its average residual under models that trained on it and under models that did not; large gaps indicate likely anomalies (Ulmer et al., 2023). Dataset folding applies the same outer logic to arbitrary one-class classifiers: split the dataset into folds, train one model per fold, score each sample only with models that did not train on it, fit a two-component Gaussian mixture to those scores, and filter by majority voting before retraining a final detector (McIntosh et al., 13 Feb 2026). These approaches treat FUAD as a data-refinement problem rather than an architecture problem.

5. Domain-specific instantiations

FUAD is no longer confined to industrial images. In multivariate sensor time series, lossy compression has been proposed as a robust unsupervised mechanism: a causal temporal convolutional autoencoder with an entropy bottleneck and a rate-distortion loss is reported to maintain strong F1 from 0% to 10% contamination, with the best one-shot result $F_1 = 0.834906$ at 5% anomaly contamination on SKAB, before degrading at higher contamination levels (Ley et al., 2022). In single-scene video anomaly detection, MLE-UVAD trains and tests directly on raw unlabeled videos containing both normal and abnormal events, combining reconstruction loss with latent-entropy minimization so normal frames reconstruct well and anomalies reconstruct poorly (Geng et al., 25 Mar 2026).

Video FUAD has also developed a pseudo-labeling line. C2FPL treats completely unlabeled videos as the starting point, assigns coarse pseudo video labels by hierarchical divisive clustering, refines them to segment labels by Gaussian-model hypothesis testing, and then trains a segment-level anomaly detector. It reports 80.65% frame-level AUC on UCF-Crime and 80.09% on XD-Violence, outperforming all compared unsupervised and one-class baselines while approaching weakly supervised performance (Al-lahham et al., 2023).

In telecom monitoring, C-MTAD-GAT frames fully unsupervised anomaly detection as a label-free pipeline from model training through threshold calibration. It combines context embeddings, graph attention over features and timesteps, a deterministic GRU-based reconstruction head, and a multi-step forecasting head, then calibrates thresholds from validation residuals without labels (Malacarne et al., 29 Apr 2026). This is FUAD in the sense of end-to-end label absence, though the method does not explicitly model contamination and instead assumes mostly normal operational data.

In medical imaging, AnoBFN uses Bayesian flow networks for pseudo-healthy reconstruction of FDG-PET images. It is trained only on cognitively normal scans, then reconstructs healthy versions of abnormal scans using structured simplex noise, a modified accuracy schedule, and recursive Bayesian feedback from the input. On synthetically generated AD-like hypometabolism, it reports higher IoU and pixel-level average precision than $\beta$-VAE, f-AnoGAN, AnoDDPM, and the original BFN, with the full model achieving IoU $31.79 \pm 7.74$ and AP $48.17 \pm 11.31$ (Roy et al., 23 Jul 2025).

FUAD also extends to domain shift. The “two-fold unsupervised curse” formulation studies one-class source training with fully unlabeled target data containing both normal and anomalous samples. The proposed solution identifies a dominant target cluster under anomaly scarcity, treats it as proxy target normality, and aligns it with source normal features (Mejri et al., 28 Feb 2025). This suggests that contaminated unlabeled selection is not only a single-domain issue, but also a prerequisite for unsupervised domain adaptation in anomaly detection.

6. Evaluation, misconceptions, and open problems

FUAD evaluation spans a heterogeneous benchmark landscape. Industrial image studies report image-level AUROC, pixel-level AUROC, and AUPRO on MVTec AD, VisA, BTAD, Real-IAD, and MVTec Loco AD (Wang et al., 2024, Liu et al., 19 Feb 2025, McIntosh et al., 13 Feb 2026). Time-series work reports F1 or RMSE on SKAB, MIMII, and turbofan datasets (Ley et al., 2022, Ulmer et al., 2023). Video studies use frame-level AUC on UCF-Crime and XD-Violence, while telecom work reports event-level and pointwise F1 on TELCO (Al-lahham et al., 2023, Malacarne et al., 29 Apr 2026). This diversity reflects the fact that FUAD is not a single task family, but a supervision regime that cuts across modalities.

A persistent misconception is that “unsupervised” and “fully unsupervised” are interchangeable. Multiple papers explicitly dispute this. USDR argues that residual-based detectors trained on anomaly-free data are not truly fully unsupervised because they rely on privileged knowledge that training samples are normal (Ulmer et al., 2023). The lossy-compression work makes the same point, arguing that training only on normal data “partially violates the concept of unsupervised training for anomaly detection” (Ley et al., 2022). At the same time, some recent methods are fully unsupervised with respect to anomaly labels but still train exclusively on normal data, such as Dinomaly2’s full-spectrum UAD framework (Guo et al., 20 Oct 2025), or are conceptually unsupervised but empirically validated in a one-class setting, as in DEAN (Klüttermann et al., 29 Apr 2025). FUAD therefore names a stricter subset of label-free anomaly detection, not all of it.

A second controversy concerns benchmark realism. Several contaminated-training image papers inject anomalous test images into the training set to create FUAD benchmarks (Im et al., 2024, Liu et al., 19 Feb 2025, Liu et al., 25 Aug 2025). This is a practical protocol, but it is not identical to naturally occurring contamination. Medical imaging adds another layer of complexity: AnoBFN evaluates localization on synthetic AD-like abnormalities because real FDG-PET anomaly masks are unavailable (Roy et al., 23 Jul 2025). The MUED detector is unsupervised with respect to anomaly labels and thresholding, but its details also report that CAE parameters were cross-validated with a set of normal images, weakening a strict end-to-end FUAD interpretation (Fazio et al., 19 May 2025).

Current limitations recur across nearly all method families. Performance typically drops as contamination increases, as anomaly types become more repetitive, or as normal data become highly multimodal. LLBNAD reports shrinking image-level gains at $\alpha = 0.2$ and $\alpha = 0.4$ because sub-models begin to agree on anomalous patterns (Zhang et al., 10 Aug 2025). Lossy compression degrades substantially by 20–25% contamination on SKAB (Ley et al., 2022). MLE-UVAD remains strong when anomaly ratio is below about 40% but degrades sharply above 50% because the dominant cluster can become abnormal (Geng et al., 25 Mar 2026). FUN-AD explicitly notes failure when normal feature diversity is comparable to anomaly diversity or when one anomaly type dominates (Im et al., 2024). Dataset folding likewise assumes anomalies are uncommon and generally heterogeneous (McIntosh et al., 13 Feb 2026).

Taken together, these results suggest that the central open problem in FUAD is not merely label removal, but reliable recovery of normal structure under realistic contamination, domain shift, and deployment-scale constraints. The literature has converged on several operational principles—majority-normal modeling, anomaly diversity, cross-model disagreement, pseudo-normal reconstruction, and label-free thresholding—but none of them is yet contamination-agnostic. The present state of FUAD is therefore best understood as a family of robust unsupervised methods for mostly normal unlabeled data, rather than a solved theory of anomaly detection under arbitrary unlabeled contamination.