RADF: Reasoning Based Anomaly Detection

• The paper presents RADF as a unified framework that couples anomaly scoring with automated model selection, evidence retrieval, and root-cause analysis.
• RADF is an architectural pattern that combines an evidence layer, reasoning layer, and decision layer to enhance detection accuracy in diverse domains.
• Practical implementations of RADF demonstrate state-of-the-art performance metrics, including high AUROC and precision in industrial, video, and time-series contexts.

Reasoning Based Anomaly Detection Framework (RADF) is a term used for anomaly-detection systems in which anomaly scoring is coupled to explicit reasoning, explanation, model selection, or post-detection decision support. In the literature, the name appears both as the title of a real-time, large-scale time-series framework with automated algorithm selection and root-cause analysis, and as a broader label for architectures that ground anomaly decisions in retrieval, latent reasoning, chain-of-thought supervision, rule induction, or structured spatio-temporal inference across industrial inspection, surveillance video, urban sensing, and analyst-in-the-loop settings (Panwar et al., 3 Oct 2025, Zhang et al., 30 Jan 2026, Chen et al., 10 Feb 2026, Ding et al., 2023, Zaheer et al., 2020, Lin et al., 2 Nov 2025, Luo et al., 2020, Zhang et al., 5 Aug 2025, Li et al., 7 Aug 2025, Li et al., 17 Apr 2025).

1. Definition and conceptual scope

In its narrowest formalization, RADF denotes a unified framework for large, distributed, high-throughput time-series systems. That framework defines anomaly detection through an anomaly indicator

$$A(x) = \begin{cases} 1, & \text{if } S(x) > \tau, \ 0, & \text{otherwise,} \end{cases}$$

where $S(x)$ is an anomaly score and $\tau$ is a threshold, and it augments scoring with automated model selection and post-detection root-cause analysis (Panwar et al., 3 Oct 2025). In parallel, multiple papers explicitly describe other systems as concrete examples, templates, or abstractions of a RADF: retrieval-based industrial anomaly detection, knowledge-guided multimodal reasoning, self-reasoning weakly supervised video anomaly detection, analyst-in-the-loop anomaly management, and regional spatio-temporal anomaly detection (Zhang et al., 30 Jan 2026, Chen et al., 10 Feb 2026, Zaheer et al., 2020, Ding et al., 2023, Luo et al., 2020).

This broader usage suggests that RADF is best understood as an architectural pattern rather than a single algorithm. A RADF does not stop at producing an outlier score. Instead, it attempts to answer adjacent questions such as which normal evidence supports the decision, where the anomaly is located, what type of deviation is present, which series or dimensions likely caused it, or how a detected pattern should be operationalized as a rule. The resulting systems span training-free retrieval, inference-time latent optimization, reinforcement learning over structured outputs, unsupervised model selection, and interactive explanation-to-action loops.

2. Recurring architectural principles

Across the cited literature, several components recur. First is an evidence layer: a memory of normal features in Retrieval-based Anomaly Detection (RAD), a category-oriented knowledge repository in Reason-IAD, a visual document knowledge base in ADSeeker, explanation vectors in ALARM, or dynamic regions and regional densities in ReAD (Zhang et al., 30 Jan 2026, Chen et al., 10 Feb 2026, Zhang et al., 5 Aug 2025, Ding et al., 2023, Luo et al., 2020). Second is a reasoning layer: nearest-neighbor retrieval over structured memories, latent think tokens optimized by entropy-driven updates, pseudo-label induction through clustering, chained prompts across subtasks, or rule mining over verified anomaly groups (Chen et al., 10 Feb 2026, Zaheer et al., 2020, Lin et al., 2 Nov 2025). Third is a decision layer: image-level and pixel-level anomaly maps, QA answers, bounding boxes, anomaly explanations, root-cause rankings, or production rules (Zhang et al., 30 Jan 2026, Lin et al., 2 Nov 2025, Ding et al., 2023, Panwar et al., 3 Oct 2025).

A plausible abstraction is that RADF separates anomaly evidence from anomaly interpretation. In RAD, the evidence is explicit distance to the empirical normal set. In Reason-IAD and ADSeeker, the evidence is a combination of retrieved knowledge and selected visual patches. In IAD-R1 and LAD-Reasoner, the evidence is transformed into structured outputs such as >, <location>, <type>, and <answer>, which are then optimized for internal consistency and correctness. In ALARM and the time-series RADF, evidence is further connected to downstream action through root-cause analysis, coverage–purity tradeoffs, and rule creation (Zhang et al., 30 Jan 2026, Li et al., 7 Aug 2025, Li et al., 17 Apr 2025, Ding et al., 2023, Panwar et al., 3 Oct 2025).

This separation matters because the reasoning module is not always a symbolic engine. In some systems it is non-parametric retrieval; in others it is a latent optimization loop, a policy-optimized chain of thought, a score-gated prompt chain, or a human reasoning interface. The literature therefore treats “reasoning” operationally: as any explicit intermediate process that constrains, explains, or refines anomaly decisions.

3. Retrieval-grounded RADF in multi-class unsupervised anomaly detection

The clearest training-free formulation of a RADF appears in “Is Training Necessary for Anomaly Detection?” (Zhang et al., 30 Jan 2026). The paper studies multi-class unsupervised anomaly detection (MUAD), where a single detector is configured on a pool of anomaly-free images from all categories without using class labels, and the same detector is applied to all categories at test time. It first analyzes reconstruction-based MUAD methods through a fidelity–stability dilemma: to preserve benign variations through an information-losing bottleneck, the decoder must amplify perturbations, which makes residual scores unstable; if the decoder is overly smoothed, small anomalies are reconstructed and detection sensitivity drops. RAD abandons the reconstruction paradigm and replaces it with frozen DINOv3 ViT-B/16 features, a multi-layer memory bank, global [CLS]-token retrieval, spatially conditioned patch retrieval, and multi-level score fusion. At patch level, the score is

$$S_\ell(x,t)=1-\max_{z\in\mathcal{M}_\ell(x,t)}\langle z_t^{(\ell)}(x),z\rangle,$$

and the generic retrieval score is

$S_{\text{ret}}(z)=\min_{u\in\gamma}\|z-u\|.$

The paper proves that $S_{\text{ret}}$ is non-expansive and pointwise maximal among 1-Lipschitz scores that vanish on the empirical normal set, and argues that retrieval-based scores upper-bound what a stable reconstruction-residual score can achieve. Empirically, RAD achieves state-of-the-art performance across MVTec-AD, VisA, Real-IAD, and 3D-ADAM; on MVTec-AD it reports 98.5% Pixel AUROC with full data and 96.7% Pixel AUROC with a single anomaly-free image, only about 1.8 points below full-data performance.

Within the same paper, RAD is explicitly presented as the bottom layer of a potential RADF. The proposed extensions are structured memory, multi-hop retrieval, graph- or database-like organization of neighbors, concept-level abstraction, rule-based or probabilistic reasoning over retrieved neighbors, and explanatory outputs such as “texture anomaly; shape is normal” or “strong anomaly with no normal analog.” The significance is twofold. First, it shows that a reasoning-oriented anomaly framework need not be task-specifically trained if strong foundation features and structured retrieval are available. Second, it provides a principled evidence substrate: anomaly evidence is the distance to the empirical normal set rather than the residual of an approximate inverse through a lossy bottleneck.

4. Multimodal reasoning frameworks for industrial anomaly analysis

Industrial RADFs increasingly couple multimodal LLMs or vision-LLMs with external knowledge and explicit reasoning control. Reason-IAD introduces Retrieval-Augmented Knowledge Integration, Entropy-Driven Latent Reasoning, and Dynamic Visual Injection for QA-style industrial anomaly detection on MMAD; ADSeeker combines a visual document knowledge base, Q2K RAG, Hierarchical Sparse Prompt, and type-level features; IAD-R1 applies Perception Activation Supervised Fine-Tuning and Structured Control Group Relative Policy Optimization; LAD-Reasoner uses a compact Qwen2.5-VL 3B backbone trained with SFT and GRPO under structure and accuracy rewards (Chen et al., 10 Feb 2026, Zhang et al., 5 Aug 2025, Li et al., 7 Aug 2025, Li et al., 17 Apr 2025).

System	Core reasoning mechanism	Reported result
Reason-IAD	RAKI + EDLR + Dynamic Visual Injection	79.43% one-shot average accuracy
ADSeeker	Q2K RAG + SEEK-M&V + HSP + type-level features	94.0 average AUROC; 69.90% MMAD
IAD-R1	PA-SFT + SC-GRPO + Expert-AD	86.1 average accuracy
LAD-Reasoner	SFT + GRPO with <think> / <answer> structure	60.4 accuracy; 63.5 F1

Reason-IAD formulates industrial anomaly analysis as multimodal QA rather than pixel masking. Its retrieval module injects category-specific textual descriptions, its latent think tokens are iteratively optimized with an entropy-based reward,

$R(Z^{(n)})=1-\frac{1}{m}\sum_{i=1}^m H(P_i^{(n)}),$

and its patch-selection loop repeatedly injects the most informative image regions. On MMAD, built from MVTec-AD, VisA, MVTec-LOCO, and GoodsAD, it reports 39,672 QA pairs over 8,366 images and seven QA subtasks, and reaches 79.43% average accuracy in the one-shot setting with Qwen3-VL-8B, compared with 74.51% for the base model; in zero-shot it reports 76.71% versus 72.18% (Chen et al., 10 Feb 2026).

ADSeeker addresses zero-shot anomaly detection and reasoning through a different route. It builds SEEK-M&V, described as the first visual document knowledge base specifically for industrial anomaly detection MLLMs, introduces Q2K RAG with cosine similarity, Bayesian Gaussian mixture modeling, and KDE-Sampled retrieval, and augments the MLLM with Hierarchical Sparse Prompt and type-level features derived from the MulA dataset. The reported averages are 94.0 AUROC on zero-shot anomaly detection benchmarks and 69.90% accuracy on MMAD under the “Seek-Setting,” while also showing that heavy LoRA fine-tuning can degrade performance over longer training because of overfitting and catastrophic forgetting (Zhang et al., 5 Aug 2025).

IAD-R1 and LAD-Reasoner emphasize structured reasoning supervision and reward shaping. IAD-R1 defines explicit output fields such as <think>, <location>, <type>, and <answer>, trains on the 5.9K-example Expert-AD dataset, and uses a composite reward

$$R_{\text{SC-GRPO}}(o_i)=R_{con}+R_{acc}+\mathbb{I}\{y_i=\text{anomalous}\}(R_{loc}+R_{type}),$$

with relative group normalization. It reports 86.1% average accuracy for LLaVA-OneVision-SI-7B and 83.8% for the 0.5B model, with the 0.5B model rising from 50.0% to 93.3% on DAGM (Li et al., 7 Aug 2025). LAD-Reasoner shows that explicit reasoning need not rely on very large models or manually curated chain-of-thought labels. Using only a 3B multimodal model and a reward that combines structure, answer accuracy, and KL regularization, it matches Qwen2.5-VL-72B in accuracy and surpasses it in F1 on MVTec LOCO AD, reporting 60.4% overall accuracy and 63.5 F1 (Li et al., 17 Apr 2025). Collectively, these systems establish a technical pattern: multimodal RADFs can externalize reasoning either through retrieved knowledge or through reward-shaped structured outputs, and both strategies are compatible with small or frozen backbones.

5. Video, regional, analyst-in-the-loop, and large-scale time-series RADFs

RADF is not limited to industrial image inspection. In surveillance video, the self-reasoning framework of 2020 trains with only video-level labels by generating pseudo-labels through binary clustering of fragment representations and aligning cluster interpretations with the network’s own predictions. For anomalous videos, the pseudo-label is selected by comparing cosine similarity of the prediction vector with cluster assignments and their inversion. The framework is optimized with

$L=L_r+\lambda L_c,$

where $L_r$ is fragment-level regression against pseudo-labels and $S(x)$0 is a clustering-distance loss that shrinks clusters for normal videos and separates them for anomalous videos. It reports frame-level AUC of 79.54% on UCF-Crime, 84.16% on ShanghaiTech, and 94.47% on UCSD Ped2 (Zaheer et al., 2020). A later zero-shot video framework connects temporal detection, spatial localization, and textual explanation through chained test-time reasoning. It uses clip captioning, LLM scoring, sliding-window selection of the most suspicious interval $S(x)$1, tag extraction, score-gated second-pass reasoning, and then inter-task chaining into localization and explanation. It reports improvements from 80.3% to about 84.3% on UCF-Crime, from 85.4% to about 91.3% on XD-Violence, from about 51.1% to about 69% on UBnormal, and from about 78.7% to about 86% on MSAD (Lin et al., 2 Nov 2025).

In urban spatio-temporal data, ReAD constructs arbitrary-shaped dynamic regions by intersecting location clusters and reading clusters, estimates regional densities by KDE, and combines local and global KL divergence: $S(x)$2 It then detects anomalies with either a weighted approach or a wavy approach based on temporal behavior of divergence. On synthetic data, ReAD (wavy) reports Precision 0.71, Recall 0.68, and F1 0.69, outperforming several baselines (Luo et al., 2020). This line of work shows that RADF can also denote explicit reasoning over spatial adjacency, relative distributions, and temporal fluctuation rather than language-based explanation.

ALARM extends the notion further into human-centered anomaly reasoning and management. It combines unsupervised detection with xStream, model-specific explanations via feature importance on projected and original features, clustering of anomalies in explanation space, candidate-rule generation with x-PACS, and an interactive rule design interface measured by coverage $S(x)$3 and purity $S(x)$4. In case studies with three professional fraud analysts, ALARM supported rule creation and refinement across detection, explanation, visual exploration, and action-taking (Ding et al., 2023). The time-series framework explicitly titled RADF generalizes this operational orientation to large-scale monitoring. Its Core Library contains 19 anomaly detectors, 2 change-point detectors, 3 smoothing algorithms, 3 decomposers, 4 RCA algorithms, and 2 model selectors; its Orchestrator deploys pipelines as PySpark or PyFlink jobs; its mSelect module classifies each series as stable, unstable, or trend through rolling-median smoothing, linear regression, and the ADF test, then assigns a model ensemble and parameters. On 205 internal time series, mSelect reports Precision 0.978, Recall 0.971, and F1 0.972 overall. On public benchmarks, RADF surpasses state-of-the-art models in AUC for 5 of 9 datasets and achieves AUC over 0.85 for 7 of 9 datasets (Panwar et al., 3 Oct 2025). In this operational sense, RADF becomes a production architecture for reasoning about model choice and probable causes, not merely a detector.

6. Evaluation, misconceptions, limitations, and open directions

Evaluation protocols vary with the task formalization. In MUAD, the standard metrics are image-level AUROC, AP, $S(x)$5-max, and pixel-level Pixel AUROC, Pixel AP, Pixel $S(x)$6-max, and AUPRO (Zhang et al., 30 Jan 2026). In industrial QA-style reasoning, MMAD evaluates accuracy over anomaly discrimination, defect classification, localization, description, analysis, and object-level tasks (Chen et al., 10 Feb 2026). Video anomaly reasoning adds frame-level ROC-AUC and AP for temporal detection, TIoU for localization, and BLEU, CIDEr, METEOR, ROUGE, plus GPT-based reasonability, detail, and consistency for explanation (Lin et al., 2 Nov 2025). The large-scale time-series RADF emphasizes AUC, F1, VUS-ROC, and VUS-PR (Panwar et al., 3 Oct 2025). These differences are substantive: some RADFs optimize ranking and localization, others optimize structured QA, narrative explanation, rule utility, or root-cause usefulness.

Several misconceptions are explicitly challenged in the literature. One is that state-of-the-art anomaly detection necessarily requires task-specific training; RAD argues the opposite by showing training-free retrieval-based MUAD can be state of the art (Zhang et al., 30 Jan 2026). A second is that reasoning-based anomaly detection requires very large models or manually authored chain-of-thought corpora; LAD-Reasoner and IAD-R1 show that structured outputs, fine-grained rewards, and modest backbones can be competitive, while IAD-R1 reports that a 0.5B model can surpass commercial models in zero-shot settings (Li et al., 17 Apr 2025, Li et al., 7 Aug 2025). A third is that adding more reasoning is always beneficial; the unified zero-shot video framework reports that blindly adding more reasoning steps can worsen performance because of overthinking, and therefore gates second-pass reasoning by confidence (Lin et al., 2 Nov 2025).

The main limitations are also recurring. RAD notes memory and latency costs, sensitivity to domain shift, and background false positives, especially when memory coverage is poor or only RGB is used (Zhang et al., 30 Jan 2026). ALARM observes that different explanation methods disagree frequently and that no single explanation method can be treated as ground truth, which places a practical ceiling on fully automated explanation faithfulness (Ding et al., 2023). The time-series RADF reports lower mSelect recall on trend series and notes that mixed-trend series may still require manual tuning (Panwar et al., 3 Oct 2025). IAD-R1 identifies dependence on high-quality chain-of-thought data and the computational cost of RL-based post-training (Li et al., 7 Aug 2025). LAD-Reasoner notes that SFT can reduce exploration and that reasoning remains emergent rather than formally constrained (Li et al., 17 Apr 2025).

Taken together, these works suggest that future RADFs will likely combine three lines of development already present in the literature: non-parametric evidence layers grounded in normal-memory retrieval, multimodal knowledge retrieval and structured reasoning over anomaly evidence, and post-detection operational modules such as root-cause analysis or rule synthesis. A plausible implication is that the most robust future systems will not treat reasoning as an optional explanation head, but as the mechanism that connects anomaly evidence to localization, semantics, uncertainty, and action.