MaskDiff-AD: Masked Diffusion for Anomaly Detection

• The paper introduces MaskDiff-AD, a framework leveraging masked diffusion to convert unconditional generation into targeted inpainting and reconstruction for effective anomaly detection.
• It uses various masking strategies—including predefined, random, and latent masking—to isolate anomalous regions and generate reconstruction difference maps or posterior discrepancy scores.
• Empirical evaluations in domains like medical imaging, industrial inspection, and time series show that MaskDiff-AD achieves robust performance with theoretical error guarantees in forward-only formulations.

Masked diffusion for anomaly detection, often abbreviated as MaskDiff-AD, denotes a family of unsupervised anomaly detection methods in which a diffusion model is trained on nominal data and a mask is used to decide which parts of an input are preserved, corrupted, reconstructed, or scored. In this family, the mask may be predefined, randomly sampled, inferred from residuals, predicted by the model, derived from latent flip probabilities, or realized as an absorbing mask token. The resulting anomaly signal is typically a reconstruction difference map, a posterior discrepancy map, a mask-derived scalar score, or a masked-coordinate surprisal score. The paradigm has been instantiated in medical imaging, industrial inspection, multivariate time series, and discrete tabular and text settings, with both reverse-sampling and forward-only variants reported in the literature (Wolleb et al., 2024, Wu et al., 2024, Yang et al., 2023, Zhang et al., 28 May 2026).

1. Conceptual scope and taxonomy

Within the diffusion-models-for-anomaly-detection literature, masked diffusion fits most naturally into the reconstruction-based and hybrid categories. The underlying pattern is consistent: learn a normal-data prior with diffusion, then use masking to convert unconditional generation into selective restoration, inpainting, denoising, or conditional completion. In image settings, this often means reconstructing only masked or suspected-anomalous regions while preserving healthy context; in time-series settings, it means denoising only selected coordinates or time steps; in discrete settings, it means masking coordinates and scoring how difficult they are to reconstruct under the nominal conditional distribution (Liu et al., 20 Jan 2025).

The phrase also names a specific forward-only method introduced for categorical, mixed-type, and discrete sequence data. In that formulation, a masked diffusion model is trained only on nominal samples, and anomaly scores are constructed from the difficulty of reconstructing randomly masked coordinates, with no reverse-time sampling at test time. That formulation operates directly on discrete state spaces and includes both a parametric and a non-parametric variant, together with Type-I and Type-II error guarantees under a fixed threshold (Zhang et al., 28 May 2026).

A common structural feature across the broader literature is the use of masking to break shortcut reconstruction. In reconstruction-only systems, the model may preserve anomalous content because the input-output map is too direct. Masking alters that geometry: the model must infer masked content from context, from a learned normal prior, or from masked-coordinate conditionals. This role is explicit in masked inpainting systems such as AutoDDPM and DRDC, in latent-space systems such as masked Bernoulli diffusion and MAD-AD, and in time-series systems such as DDMT and AnomalyFilter (Bercea et al., 2023, Zhan et al., 2024, Wolleb et al., 2024, Beizaee et al., 24 Feb 2025, Yang et al., 2023, Obata et al., 27 Feb 2026).

2. Masking operators and diffusion mechanics

One major design line uses masks to partition an observation into trusted context and reconstructed content. AutoDDPM derives an initial anomaly likelihood map from a pseudo-healthy DDPM reconstruction, binarizes it, stitches the original image and the pseudo-healthy image under that mask, and then performs joint noised distribution re-sampling. The key reverse-step composition is

$$x_{t-1} = (1 - \hat{m}) \odot x_{t-1}^{\text{context}} + \hat{m} \odot x_{t-1}^{\text{ph}},$$

so original content is reinserted where the mask is zero and diffusion-based inpainting is used where the mask is one. This formulation was introduced to address the “noise paradox,” namely that higher noising improves lesion removal while degrading healthy-tissue reconstruction (Bercea et al., 2023).

A second line uses Bayesian posterior sampling with an explicit masked observation model. MDPS assumes

$$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$

so normal pixels are treated as exact observations and anomalous pixels as noisy observations of an unobserved normal image. The reverse denoiser is then split into an analytic normal-region term and a DPS-like anomaly-region term, and multiple posterior samples are drawn from $p(\boldsymbol x_0 \mid \boldsymbol y)$. Pixel-level and perceptual-level difference maps are averaged across samples to obtain anomaly maps (Wu et al., 2024).

A third line moves masking into latent space. In masked Bernoulli diffusion for unsupervised anomaly detection, images are compressed into binary latent codes, a Bernoulli diffusion model predicts bit-flip probabilities, and those probabilities are turned into a monotonically growing latent mask. The stitched clean-latent estimate is

$$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$

so only masked latent entries are updated by diffusion while unmasked entries remain clamped to the original latent code. The anomaly map is then $a = \sum_c (x-\hat{x})^2$ after decoding (Wolleb et al., 2024).

MAD-AD uses a related but not identical latent masking strategy. During training, a VAE latent is partially diffused only on randomly selected patches, while the rest remains noise-free. The network has two heads, one predicting the clean latent and one predicting the mask. At inference, a masked DDIM reverse update is applied only where the predicted mask is active, and normal regions are copied forward unchanged. This makes the reverse process explicitly selective rather than globally reconstructive (Beizaee et al., 24 Feb 2025).

3. Medical-imaging lineages

Medical imaging has been the most active domain for masked diffusion anomaly detection. Early image-space masked DDPM work introduced masking-based regularization through Image Patch Masking, Frequency Patch Masking, and Frequency Patch Masking CutMix. In that framework, healthy T2-weighted MRIs from IXI were used for training, while BraTS21 tumors and MSLUB multiple-sclerosis lesions were used at test time. The best reported variant, FPM-CM, reached Dice $53.02 \pm 1.34$ and AUPRC $59.04 \pm 1.26$ on BraTS21, and Dice $10.71 \pm 0.62$ and AUPRC $10.59 \pm 0.57$ on MSLUB, outperforming plain DDPM and pDDPM variants in that study (Iqbal et al., 2023).

MAEDiff combined patch-wise masked diffusion with a masked-autoencoder mechanism in U-Net feature space. Only a local image patch is noised, the remainder is kept visible, and a ViT-style MAE reconstructs masked feature grids from visible ones before the result is fused back into the diffusion U-Net. With patch size $48$, stride $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$0, grid size $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$1, and direct $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$2-prediction at $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$3, the method reported BraTS21 Dice $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$4 and AUPRC $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$5, while also improving over a pDDPM baseline in the reported ablations (Xu et al., 2024).

Masking has also been integrated into multimodal MRI translation. MMCCD trains on healthy-looking BraTS2021 slices only, uses a masked conditional diffusion model for modality translation, and applies cyclic reconstruction $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$6. At inference, systematic stripe masks are swept across the image, masked regions are replaced with Gaussian noise, and anomaly scores are aggregated over all mask positions. With FLAIR as input and T2 as target, MMCCD reported DICE $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$7, AUC $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$8, and ASSD $$\boldsymbol y = (1 - \boldsymbol m)\odot \boldsymbol x_0 + \boldsymbol m \odot (\boldsymbol x_0 + \boldsymbol n),$$9, improving over AE, VAE, DAE, DDPM, and a cyclic UNet baseline in that proxy BraTS2021 setting (Liang et al., 2023).

More recent latent methods reported substantially stronger segmentation numbers in the same domain family. MAD-AD trains on healthy IXI slices, predicts latent clean features and masks jointly, and performs masked DDIM correction only on predicted noisy patches. In the IXI $p(\boldsymbol x_0 \mid \boldsymbol y)$0 ATLAS 2.0 setting it reported average Dice $p(\boldsymbol x_0 \mid \boldsymbol y)$1, exceeding THOR’s $p(\boldsymbol x_0 \mid \boldsymbol y)$2, and in the BraTS’21 multimodal setting it reported average Dice $p(\boldsymbol x_0 \mid \boldsymbol y)$3, above IterMask$p(\boldsymbol x_0 \mid \boldsymbol y)$4’s $p(\boldsymbol x_0 \mid \boldsymbol y)$5, although performance on FLAIR was slightly lower than IterMask$p(\boldsymbol x_0 \mid \boldsymbol y)$6 in the reported per-modality table (Beizaee et al., 24 Feb 2025).

Masked Bernoulli diffusion occupies a distinct medical-imaging niche because the mask is not externally specified. On BRATS2020, the masked Bernoulli latent model reported Dice $p(\boldsymbol x_0 \mid \boldsymbol y)$7, AUPRC $p(\boldsymbol x_0 \mid \boldsymbol y)$8, PSNR $p(\boldsymbol x_0 \mid \boldsymbol y)$9, sampling time $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$0 s, and GPU memory $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$1 GB, with the masking mechanism improving notably over the unmasked Bernoulli variant. The same study also reported qualitative effectiveness on OCT2017 drusen by reconstructing a smooth and regular RPE layer and highlighting drusen in the difference map (Wolleb et al., 2024).

4. Industrial inspection, multi-class refinement, and continual learning

In industrial anomaly detection, masked diffusion has been used both as a posterior-sampling framework and as an inpainting refiner. MDPS formulates normal-image reconstruction under a masked noisy observation model and a diffusion prior, then averages pixel-level and perceptual-level difference maps over multiple posterior samples. On MVTec AD it reported Image-AUROC $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$2 and Pixel-AUROC $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$3 with $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$4, and on BTAD it reported Image-AUROC $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$5 and Pixel-AUROC $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$6 with $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$7, while $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$8 yielded Pixel-AUROC $$\tilde{z}'_0 = \mathcal{M}_{t-1} \odot \tilde{z}_0 + (1-\mathcal{M}_{t-1}) \odot z,$$9 in the reported averages (Wu et al., 2024).

DRDC reformulates anomaly detection as image inpainting and combines a transformer-based coarse feature reconstructor with a diffusion-based high-frequency refiner. The diffusion branch uses random grid masks, model conditioning via the masked input image, test-time conditioning via reinsertion of known regions at every reverse step, and spatio-temporal fusion over timesteps, scales, and mask configurations. In the unified multi-class MVTec-AD setting it reported average image-wise AUROC $a = \sum_c (x-\hat{x})^2$0 and pixel-wise AUROC $a = \sum_c (x-\hat{x})^2$1; on BeanTechAD it reported average image-wise AUROC $a = \sum_c (x-\hat{x})^2$2 and pixel-wise AUROC $a = \sum_c (x-\hat{x})^2$3 (Zhan et al., 2024).

Continual learning introduces an additional failure mode: the model may lose faithfulness to previously learned classes. “One-for-More: Continual Diffusion Model for Anomaly Detection” identifies severe “faithfulness hallucination” and “catastrophic forgetting” in sequentially trained diffusion-based anomaly reconstruction. Its proposed continual diffusion model uses gradient projection for stable continual learning, an iterative singular value decomposition method to reduce memory costs, and an anomaly-masked network to enhance the condition mechanism of the diffusion model. In the reported experiments, it achieved first place in 17/18 settings on MVTec and VisA (Li et al., 27 Feb 2025).

A nearby but distinct line uses masked diffusion for anomaly generation rather than direct detection. AAG is a training-free mask-guided diffusion editing framework built on Stable Diffusion XL; it blends original and edited latents under a binary mask and modifies cross-attention and self-attention to localize synthetic defects. This is not itself an anomaly detector, but it is directly relevant to the MaskDiff-AD design space because it demonstrates that mask-guided diffusion can inject anomalies into specified regions while keeping the remainder nearly unchanged, and that the resulting synthetic data can improve downstream anomaly inspection models (Zuo et al., 15 Aug 2025).

5. Time-series and discrete-state formulations

For multivariate time series, masking has been used primarily to suppress weak identity mapping and to enforce selective denoising. DDMT combines an Adaptive Dynamic Neighbor Mask with a denoising diffusion Transformer. A simple autoencoder first identifies high-error nodes, then Pearson correlation is used to expand each mask to correlated neighbors before Transformer self-attention is applied. The diffusion model uses $a = \sum_c (x-\hat{x})^2$4 steps, window size $a = \sum_c (x-\hat{x})^2$5, and a Transformer denoiser instead of a U-Net. In the reported benchmarks it achieved state-of-the-art F1 on MSL, SMAP, SWaT, and PSM, while remaining weaker on SMD, and the ablation table showed that removing ADNM reduced average F1 from $a = \sum_c (x-\hat{x})^2$6 to $a = \sum_c (x-\hat{x})^2$7 (Yang et al., 2023).

AnomalyFilter takes a different route. During training it uses masked Gaussian noise,

$a = \sum_c (x-\hat{x})^2$8

and at inference it performs noiseless deterministic reverse updates from a scaled copy of the input rather than from a corrupted observation. The paper’s central empirical point is that masked corruption alone does not improve performance, whereas masked corruption combined with noiseless inference yields substantial gains. Across five time-series benchmarks it reported an average $a = \sum_c (x-\hat{x})^2$9 improvement in VUS-PR over vanilla DDPM and much larger anomaly/normal reconstruction-error ratios than standard diffusion baselines (Obata et al., 27 Feb 2026).

The explicit MaskDiff-AD formulation for discrete and mixed data replaces Gaussian corruption with absorbing masking. On $53.02 \pm 1.34$0, each coordinate is either kept or replaced by a special mask token, and a masked diffusion model learns to reconstruct the original value of masked coordinates from visible context. At test time, the anomaly score is the average negative log-probability of the true masked coordinates over multiple probe levels and masked views,

$53.02 \pm 1.34$1

This forward-only method avoids reverse-time sampling, includes a non-parametric kernel variant, and reported the best overall average rank among twelve tabular baselines across fourteen tabular datasets, together with strong performance on short text spam detection datasets (Zhang et al., 28 May 2026).

6. Empirical behavior, misconceptions, and open problems

A recurrent empirical theme is that masking is useful chiefly when it is coupled to an appropriate reconstruction regime. AutoDDPM framed this as the “noise paradox”: stronger noising removes anomalies better but also destroys healthy tissue, so masking plus low-noise re-sampling was introduced to separate lesion replacement from context preservation. AnomalyFilter reached a related conclusion in time series: masked corruption by itself did not improve over vanilla DDPM, whereas masked corruption plus noiseless inference produced the desired selective-filter behavior (Bercea et al., 2023, Obata et al., 27 Feb 2026).

A common misconception is that MaskDiff-AD requires a hand-crafted binary region-of-interest mask. The literature shows a much broader picture. Masks may be derived from DDPM residual heatmaps and then dilated and thresholded, as in AutoDDPM; from Bernoulli bit-flip probabilities in a binary latent space, as in masked Bernoulli diffusion; from a dedicated mask-prediction head in latent diffusion, as in MAD-AD; from an all-anomaly initialization followed by thresholding of an initial discrepancy map, as in MDPS; or from random probe masks and absorbing mask tokens, as in the discrete forward-only MaskDiff-AD formulation (Bercea et al., 2023, Wolleb et al., 2024, Beizaee et al., 24 Feb 2025, Wu et al., 2024, Zhang et al., 28 May 2026).

Limitations are also consistent across domains. Several medical-image methods remain slice-wise and report difficulty with very small lesions or subtle structural changes; several methods depend strongly on the quality of an autoencoder or VAE latent representation; and many image-space methods still incur substantial inference cost because they require multiple reverse steps, multiple masks, or multiple posterior samples. Reported future directions therefore include multi-scale or hierarchical latents, 3D extensions, adaptive or learned masking, improved uncertainty handling, and faster samplers or latent-space formulations (Xu et al., 2024, Beizaee et al., 24 Feb 2025, Wu et al., 2024, Liang et al., 2023).

The discrete-state MaskDiff-AD literature adds a different limitation profile. Forward-only masked reconstruction avoids reverse-time sampling and admits theoretical Type-I and Type-II guarantees, but performance on long or highly semantic text remains less competitive than the strongest pretrained embedding baselines in the reported experiments. A plausible implication is that masked diffusion anomaly detection is no longer tied to continuous image denoising; it can instead be understood more generally as conditional completion under a nominal prior, with the mask specifying which coordinates must be explained from context and which coordinates provide that context (Zhang et al., 28 May 2026).

Across these lines, the central idea remains stable: masking turns diffusion from a global generative model into a selective normality operator. Whether the operator acts by latent bit-flip suppression, image-space inpainting, posterior sampling, adaptive time-step masking, or masked-coordinate surprisal, the goal is the same: preserve nominal structure, rewrite off-manifold content toward the learned normal distribution, and measure the discrepancy introduced by that rewrite as the anomaly signal (Wolleb et al., 2024, Wu et al., 2024, Yang et al., 2023, Zhang et al., 28 May 2026).