Normality Distribution Shift (NDS)

• NDS is a concept describing how the reference for 'normal' data evolves, impacting anomaly detection, Gaussian testing, and distribution shift scenarios.
• It spans multiple domains including statistical transformations, random binary sequence analysis, and covariate shift, adapting to dynamic changes in data behavior.
• Practical implications include challenges in model adaptation and support coverage, emphasizing the need for tailored preprocessing and adjustment strategies.

Searching arXiv for the cited papers and related uses of “Normality Distribution Shift” to ground the article. Normality Distribution Shift (NDS) denotes a family of problems in which “normality” is itself distributionally unstable, but the phrase is not used uniformly across the literature. In anomaly detection and distribution-shift research, NDS usually refers to a change in the distribution of normal data between training and deployment or across time; in statistical preprocessing it can describe transformations that move empirical marginals toward Gaussianity; in normality testing it names the detection of departures from Gaussian models; and in the theory of binary pseudorandom sequences it has been used informally for the way the distribution of a normality measure changes with sequence length before stabilization under $\sqrt{N}$ normalization (Xu et al., 22 Sep 2025, Kim et al., 2 Apr 2026, Yu et al., 12 Apr 2025, Friedman et al., 2024, Feng et al., 2016, Aistleitner, 2013).

1. Terminological scope and formal objects

The literature suggests that NDS is best understood as a domain-dependent umbrella rather than a single standardized definition. In the anomaly-detection papers, the central object is the distribution of normal observations, normal edge embeddings, or normal time-series windows, and NDS means that this distribution changes while the detector continues to treat older normality as the reference. In statistical papers, the object is instead a univariate or multivariate Gaussian family, so “normality” means approximate Gaussianity and the relevant question is whether data can be shifted toward that family or tested against it. In Aistleitner’s work on binary sequences, the relevant object is the normality measure $\mathcal{N}(E_N)$, whose raw distribution shifts with $N$ and whose normalized law converges (Xu et al., 22 Sep 2025, Kim et al., 2 Apr 2026, Friedman et al., 2024, Feng et al., 2016, Simić, 2020, Tokdar et al., 2011, Aistleitner, 2013).

Usage domain	Formal object	Representative papers
Dynamic anomaly detection	Distribution of normal data changes across time or environment	(Xu et al., 22 Sep 2025, Kim et al., 2 Apr 2026, Yu et al., 12 Apr 2025, Chen et al., 2024)
Controllable covariate shift	Shift from baseline “normal” covariate distribution	(Friedman et al., 2024)
Gaussianization and testing	Distance to a Gaussian family	(Feng et al., 2016, Simić, 2020, Tokdar et al., 2011)
Binary sequence normality	Law of $\mathcal{N}(E_N)/\sqrt{N}$	(Aistleitner, 2013)

A common thread is that NDS is not primarily about isolated outliers. It concerns how the reference notion of normality is parameterized, approximated, or transported. A plausible implication is that the term becomes useful precisely when “normal” is not fixed by definition but must be inferred from data, estimated from a training regime, or approximated asymptotically.

2. NDS in the normality measure of random binary sequences

In the combinatorial number-theoretic setting, the normality measure of a binary sequence $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$ is

$$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$

where $T(E_N,M,X)$ counts occurrences of a pattern $X$ among the first $M+k$ digits. It measures the worst-case discrepancy between observed and expected frequencies of all short patterns over all prefixes. Earlier work of Alon, Kohayakawa, Mauduit, Moreira, and Rödl showed that for random unbiased sequences the typical scale is $\Theta(\sqrt{N})$, making $\mathcal{N}(E_N)$0 the natural normalized quantity (Aistleitner, 2013).

Aistleitner proved the existence of a continuous limit distribution for $\mathcal{N}(E_N)$1 as $\mathcal{N}(E_N)$2, confirming the conjecture of Alon–Kohayakawa–Mauduit–Moreira–Rödl. The proof introduces a restricted normality measure $\mathcal{N}(E_N)$3 based on block decompositions, controls block-crossing and long-pattern errors via concentration inequalities, encodes blocks as i.i.d. bounded mean-zero vectors in $\mathcal{N}(E_N)$4, and then applies Donsker’s invariance principle. For fixed block length $\mathcal{N}(E_N)$5, the event that the restricted measure stays below threshold $\mathcal{N}(E_N)$6 becomes the event that a multidimensional Wiener process remains inside a polytope

$\mathcal{N}(E_N)$7

so the limiting law is described through Wiener exit probabilities from $\mathcal{N}(E_N)$8 (Aistleitner, 2013).

In this usage, NDS is an informal interpretive label rather than the paper’s formal terminology. The raw distributions of $\mathcal{N}(E_N)$9 shift to larger values as $N$0 grows, but the normalized laws stabilize. This is not train–test distribution shift; it is a scale-driven distributional evolution of a pseudorandomness functional.

3. NDS as covariate shift away from a baseline normal distribution

In the distribution-shift literature, NDS is framed as a special case of covariate shift. A standard supervised setup assumes a joint distribution $N$1 over input space $N$2 and label space $N$3. Distribution shift occurs when training and test data are drawn from different distributions. The Control+Shift formulation focuses on covariate shift,

$N$4

and maps this directly to a “normal” baseline distribution

$N$5

and an NDS deployment distribution

$N$6

Shift intensity is defined geometrically as

$N$7

with a finite-sample proxy

$N$8

This formalization makes NDS a continuous phenomenon indexed by support overlap or 1-nearest-neighbor distance rather than a binary in-distribution/out-of-distribution distinction (Friedman et al., 2024).

Control+Shift realizes such shifts with any decoder-based generative model $N$9 by restricting the latent prior to subsets $\mathcal{N}(E_N)/\sqrt{N}$0 and $\mathcal{N}(E_N)/\sqrt{N}$1. Because the mapping is assumed continuous and injective in the probability-flow diffusion formulation, overlap in latent space transfers to overlap in image space. Three concrete latent-space mechanisms are given. The truncation shift rescales latents by a truncation radius $\mathcal{N}(E_N)/\sqrt{N}$2. The extend shift uses spherical interpolation toward a fixed target code and grows the covered region of the hypersphere through an angle parameter $\mathcal{N}(E_N)/\sqrt{N}$3. The overlap shift moves the hemisphere center from one pole to another while keeping support size fixed. Empirically, the paper reports a consistent decline in performance with increasing shift intensity, approximately linear degradation with the 1-NN distance, continued degradation even with augmentations, no robustness gain from enlarging the training dataset beyond a certain point when support is unchanged, and greater robustness from stronger inductive biases (Friedman et al., 2024).

Within this formulation, NDS denotes movement away from an operationally defined normal regime. A plausible implication is that the key variable is not sample count but manifold coverage: robustness depends mainly on whether the training distribution spans the latent regions that later become prevalent.

4. Statistical normality shift: Gaussianization and testing

A different lineage uses NDS to mean movement toward or away from Gaussianity at the feature or sample level. In the automatic transformation framework of “A Note on Automatic Data Transformation,” each feature vector $\mathcal{N}(E_N)/\sqrt{N}$4 is transformed by a shifted logarithm family $\mathcal{N}(E_N)/\sqrt{N}$5 selected feature-wise to minimize the Anderson–Darling statistic. The parametrization handles both right and left skewness in a single family,

$\mathcal{N}(E_N)/\sqrt{N}$6

where $\mathcal{N}(E_N)/\sqrt{N}$7 and $\mathcal{N}(E_N)/\sqrt{N}$8 corresponds to standardization only. The procedure then standardizes, optionally winsorizes extremes using a threshold

$\mathcal{N}(E_N)/\sqrt{N}$9

derived from extreme value theory, re-standardizes, and chooses

$E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$0

where $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$1 is the Anderson–Darling statistic relative to the standard normal. The melanoma microscopy example reports improved symmetry, QQ-plot linearity, and mitigation of excessive skewness, heteroscedasticity, and influential observations (Feng et al., 2016).

Normality testing papers address the opposite direction: detection of shifts away from Gaussianity. “Testing for Normality with Neural Networks” treats

$E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$2

as binary classification. Its descriptor-based neural network uses standardized sample quantiles, sample size, mean, standard deviation, minimum, maximum, and median as a fixed-length representation of variable-sized samples. On a synthetic small-sample test set it reports AUROC $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$3, and on a mixed synthetic set AUROC $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$4; it is described as more powerful than Shapiro–Wilk, Anderson–Darling, Lilliefors, Jarque–Bera, and kernel tests across a broad range of alternatives, especially for small samples (Simić, 2020).

A Bayesian counterpart is the Dirichlet-process-mixture test of normality. There the null is a univariate or multivariate Gaussian family, while the alternative is a Dirichlet process mixture of normals constructed to satisfy embedding and predictive matching. The Bayes factor compares

$E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$5

against a DPM alternative in which a normal distribution is randomly granulated into a mixture whose components occupy a smaller volume the farther they are from the center. The scalar parameter $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$6 controls latent clustering and thus the separation between the null and the alternative. The construction yields Bayes factor $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$7 at the minimal sample size $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$8 under predictive matching, and simulations indicate that the procedure can detect heavy tails, skewness, multimodality, outliers, and non-elliptical dependence without favoring the nonparametric alternative when normality holds (Tokdar et al., 2011).

These works treat NDS as a property of statistical shape rather than deployment drift. The distinction is substantive: Gaussianization alters the data representation, whereas testing methods quantify whether the observed law remains compatible with a Gaussian model.

5. NDS as evolving normal behavior in anomaly detection

In dynamic-graph anomaly detection, NDS is defined explicitly as temporal change in the distribution of normal edges. For a dynamic graph $E_N=(e_1,\dots,e_N)\in\{-1,1\}^N$9 with normal-edge distribution $$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$0 at timestamp $$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$1, NDS occurs when

$$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$2

WhENDS models normal edge embeddings as approximately Gaussian at each time,

$$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$3

estimates time-varying normal statistics with a Normal Statistics Estimation Module, and whitens embeddings via

$$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$4

Its controlled NDS experiment injects feature drift through

$$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$5

and reports that full whitening-based alignment is more stable than baselines as $$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$6 increases (Xu et al., 22 Sep 2025).

In multivariate time-series anomaly detection, CANDI studies the case where the normal training distribution and the normal test distribution differ,

$$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$7

causing previously unseen but still normal windows to receive high reconstruction error. CANDI performs test-time adaptation with False Positive Mining and a Spatiotemporally-Aware Normality Adaptation module. It mines hard and moderate likely-normal samples using anomaly scores, latent similarity, and Mahalanobis distance, then adapts only a lightweight residual module while freezing the backbone. The paper reports AUROC improvement up to $$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$8 while using fewer adaptation samples (Kim et al., 2 Apr 2026).

In cloud log anomaly detection, CAShift treats NDS as change in the normal log distribution across realistic cloud scenarios. It introduces three shift types: application shift, version shift, and cloud architecture shift. The benchmark contains approximately $$\mathcal{N}(E_N)=\max_{1\le k\le \log_2 N}\ \max_{X\in\{-1,1\}^k}\ \max_{1\le M\le N+1-k}\left|T(E_N,M,X)-\frac{M}{2^k}\right|,$$9 normal system call traces, approximately $T(E_N,M,X)$0–$T(E_N,M,X)$1 attack traces, and $T(E_N,M,X)$2 attack scenarios. Across evaluated LAD methods, the paper reports that normality shift causes performance drops up to $T(E_N,M,X)$3, with architecture shifts the harshest, and that continual-learning adaptation can recover up to $T(E_N,M,X)$4 F1-score depending on configuration and budget (Yu et al., 12 Apr 2025).

In vision anomaly detection under distribution shift, FiCo considers training normals from $T(E_N,M,X)$5 and test data from $T(E_N,M,X)$6, where even normal $T(E_N,M,X)$7 samples can be misclassified because teacher and student networks become misaligned. FiCo addresses this through Distribution-Specific Compensation and a Distribution-Invariant Filter inside a reverse-distillation framework. The method is evaluated on MVTec, PACS, and CIFAR-10 under corruptions and domain shifts, and is reported to outperform existing state-of-the-art methods while also improving ID performance relative to other RD-based methods (Chen et al., 2024).

Across these anomaly-detection settings, NDS means that what is normal has changed, not that anomalous labels have become easier to assign. The recurrent failure mode is false positives: shifted normal samples inherit large anomaly scores because detectors remain calibrated to obsolete normal statistics or insufficiently invariant representations.

6. Recurring principles, distinctions, and misconceptions

Several technical themes recur across otherwise unrelated uses of NDS. First, many formulations preserve semantics while moving the normal distribution. Control+Shift assumes unchanged $T(E_N,M,X)$8 under covariate shift; WhENDS assumes anomalies are rare and models the drift of normal edge embeddings; CANDI adapts only to likely false positives from shifted normality; CAShift studies changes in benign cloud behavior while attacks remain anomalies; and FiCo treats style or corruption changes in normal images as nuisance variation rather than new semantics (Friedman et al., 2024, Xu et al., 22 Sep 2025, Kim et al., 2 Apr 2026, Yu et al., 12 Apr 2025, Chen et al., 2024).

Second, support coverage is repeatedly more important than sample count. Control+Shift reports that enlarging the training dataset beyond a certain point has no effect on robustness when the support does not broaden, and CAShift finds that adaptation quality depends heavily on which shifted samples are selected and how retraining is configured (Friedman et al., 2024, Yu et al., 12 Apr 2025). This suggests that NDS mitigation is primarily a support-alignment problem.

Third, detection and adaptation are separate operations. Neural and Bayesian normality tests ask whether the observed sample still belongs to a Gaussian family; the shifted-log transformation actively moves marginals toward that family; anomaly-detection methods instead attempt to realign models to a changed normal regime without relabeling that regime as anomalous (Feng et al., 2016, Simić, 2020, Tokdar et al., 2011, Kim et al., 2 Apr 2026).

A common misconception is that NDS is interchangeable with generic distribution shift. The literature here indicates a narrower emphasis: NDS usually concerns the instability of the normal reference class itself. Another misconception is that NDS always refers to Gaussianity. In statistics it often does; in anomaly detection it usually means the empirical distribution of normal data; and in the binary-sequence setting it concerns the law of a normality measure rather than Gaussian normality at all (Aistleitner, 2013, Xu et al., 22 Sep 2025, Feng et al., 2016).

Taken together, these usages define NDS as a family resemblance concept centered on unstable normal baselines. Whether the object is a pseudorandomness functional, a Gaussian model, a latent data manifold, a graph-edge embedding distribution, a multivariate time-series normal regime, or a cloud-log profile, the core issue is the same: normality is not static, and any methodology that treats it as fixed must either prove asymptotic stabilization, detect deviation, transform the data, or adapt the model.