ZEDD: Dual Roles in DfD & LLM Security

• ZEDD is an acronym used in contemporary research to denote both a high-fidelity DfD benchmark and a lightweight LLM prompt-injection detector.
• In depth-from-defocus research, the ZEDD benchmark comprises 100 real-world scenes with dense LiDAR supervision and focus stacks for zero-shot metric depth estimation using the FOSSA model.
• In LLM safety, ZEDD implements semantic drift measurement via cosine similarity and Gaussian mixture thresholding to robustly detect adversarial prompt injections.

Searching arXiv for the papers and acronym usage to ground the article in current literature. ZEDD denotes two different entities in recent arXiv literature: a real-world benchmark for zero-shot Depth from Defocus (DfD) introduced in "Zero-Shot Depth from Defocus" (Zuo et al., 27 Mar 2026), and Zero-Shot Embedding Drift Detection, a framework for detecting prompt-injection attacks in LLMs introduced in "Zero-Shot Embedding Drift Detection: A Lightweight Defense Against Prompt Injections in LLMs" (Sekar et al., 18 Jan 2026). In the former usage, ZEDD is a dataset centered on dense metric depth estimation from focus stacks under real defocus and dense LiDAR supervision; in the latter, ZEDD is a model-agnostic security layer that measures semantic drift in embedding space between benign and suspect prompts. The shared acronym therefore spans two technically unrelated research programs: computational photography and depth estimation on one side, and LLM security on the other.

1. ZEDD as an acronym in contemporary research

In DfD research, ZEDD is a benchmark designed for zero-shot generalization. The underlying task is estimating a dense metric depth map from a focus stack, and the benchmark is paired with a Transformer-based architecture named FOSSA that is explicitly tailored to focus-stack reasoning (Zuo et al., 27 Mar 2026). The benchmark is released at https://zedd.cs.princeton.edu, and the associated code and checkpoints are released at https://github.com/princeton-vl/FOSSA.

In LLM security, ZEDD expands to Zero-Shot Embedding Drift Detection. It is defined as a lightweight, model-agnostic framework for detecting both direct and indirect prompt-injection attacks without requiring access to model internals, task-specific fine-tuning of the target LLM, or prior knowledge of attack patterns (Sekar et al., 18 Jan 2026). Its core abstraction is semantic drift: adversarial prompts induce measurable displacement in embedding space relative to benign prompts.

This dual usage makes the acronym context-dependent. In vision papers, ZEDD refers to a benchmark; in LLM-safety papers, it refers to a detector. A plausible implication is that citations and system descriptions need explicit disambiguation whenever the acronym appears outside its home subfield.

2. ZEDD in zero-shot Depth from Defocus

The DfD benchmark ZEDD consists of 100 unique real-world scenes, which is 8.3× more than DDFF’s 12 scenes (Zuo et al., 27 Mar 2026). Each scene contains 6 apertures and 9 focus distances, yielding 54 images per scene and approximately 5,400 images overall. Capture resolution is 4104×2736 px, while depth ground-truth resolution is 1824×1216 px.

The dataset uses an Ouster OS0-128 LiDAR with range up to 100 m, sub-centimeter accuracy, and dense coverage via 600-frame accumulation. The depth range in the dataset spans 0.3 m to approximately 15 m, while the focus distances are 0.82, 1.17, 1.69, 2.31, 3.08, 3.81, 4.75, 6.03, and 8.10 m. Final ground-truth depth maps have no missing pixels after z-buffer projection following ICP registration.

Scene diversity is an explicit design target. The 100 scenes span indoor environments such as classrooms, offices, labs, kitchens, and hallways, as well as outdoor environments including gardens and courtyards, with multiple textures and lighting conditions. Compared with prior DfD benchmarks, the benchmark emphasizes real defocus from a large-aperture DSLR rather than the weak blur characteristic of light-field-derived stacks, and dense LiDAR supervision rather than sparse or noisy depth.

The benchmark is positioned against MobileDepth and DDFF. MobileDepth contains 11 scenes, 10-image focus stacks, and 640×360 px images but no ground truth. DDFF contains 12 scenes and 10-image synthesized focus stacks from 4D light fields, with tiny defocus, equivalent $F \approx 15$, RGB resolution 552×383 px, and structured-light depth limited to $\le 3.5$ m with low density. ZEDD therefore enlarges scale, increases image fidelity, extends depth range, and strengthens supervision quality.

3. Acquisition, registration, and synthetic data generation

The capture system combines a Sony $\alpha 1$-II DSLR with a Sony FE 50 mm F1.4 GM lens and an Ouster OS0-128 LiDAR, rigidly mounted to the camera on a tripod with a detachable bar for handheld sweeps (Zuo et al., 27 Mar 2026). Apertures are F1.4, F2.0, F2.8, F4.0, F5.6 for defocused stacks, plus F16 for an all-in-focus image. Focus-stack capture is software-controlled through the focus motor by reading a proprietary hex code corresponding to focus distance.

A canonical intrinsic calibration is defined at focus $= 3.08$ m. Calibration uses Kalibr, and all images are warped into the canonical space to cancel lens breathing. This is central for DfD because focus-induced geometric variation can otherwise confound models that should learn blur cues rather than lens-state artifacts.

LiDAR aggregation proceeds by a handheld sweep of approximately 600 frames at 10 Hz, followed by registration via ICP in Open3D into a global point cloud $P_n$. Outlier removal combines density-based filtering, with adaptive radius proportional to distance, and manual region cleanup for occlusion and reflective noise. A rigid transform from camera to LiDAR is obtained via single-frame LiDAR-to-global ICP, and the global point cloud is projected into the camera view with z-buffering to produce the final dense depth map.

The paper also defines a synthetic training pipeline using Hypersim (66 k) and TartanAir (307 k). Focus stacks are rendered with a thin-lens PSF. The circle of confusion is

$c = \frac{|D - d|}{D} \frac{f^2}{N (d - f)} .$

The generalized PSF kernel is

$$\mathcal{F}(u,v; p)=\frac{1}{c^2} \exp\!\Bigl(\!-2\bigl(\tfrac{u^2+v^2}{c^2}\bigr)^{\tfrac p2}\Bigr),$$

where $p \in [2,\infty]$ randomizes between Gaussian $(p=2)$ and disk $(p \to \infty)$. The pipeline randomizes $\le 3.5$0-number $\le 3.5$1, samples $\le 3.5$2, and uses a mixture of “photographer-in-loop” and “automatic” focus-distance sampling before interpolation via a power law in disparity. This suggests an attempt to broaden defocus statistics beyond any single camera-capture protocol.

4. Evaluation protocol and the role of FOSSA

ZEDD is evaluated in a zero-shot regime with no fine-tuning on the benchmark itself (Zuo et al., 27 Mar 2026). The validation split contains 50 scenes and the test split contains 50 scenes. The input focus stack per scene uses 5 images obtained by subsampling the 9 focus distances with stride 2, specifically $\le 3.5$3 m at aperture F2.8.

The principal metrics are Absolute Relative Error,

$\le 3.5$4

and $\le 3.5$5-inlier accuracy,

$\le 3.5$6

On DDFF, the evaluation also reports MSE, RMSE, and SqRel.

FOSSA is the architecture developed alongside ZEDD. Its two stated architectural innovations are focus-distance embeddings and a stack-attention layer. The focus-distance embeddings map each $\le 3.5$7 through an MLP to a $\le 3.5$8-dimensional vector that is added to image tokens. The stack-attention layer performs cross-image self-attention over $\le 3.5$9 focus settings with cost $\alpha 1$0, thereby aggregating defocus cues across the stack efficiently. The design collapses after $\alpha 1$1 extraction layers into a global feature, followed by $\alpha 1$2 ViT refinement and a DPT head.

On the ZEDD test split, the best monocular baseline, DepthPro, attains $\alpha 1$3 and $\alpha 1$4, whereas FOSSA (ViT-B) attains $\alpha 1$5 and $\alpha 1$6, corresponding to a 55.7% reduction in error and a 37.9% increase in $\alpha 1$7 (Zuo et al., 27 Mar 2026). The paper further states that prior DfD methods such as DFV, DEReD, and HybridDepth lag behind monocular baselines or fail to generalize. Within the paper’s framing, ZEDD functions not only as a dataset but also as an empirical stress test for zero-shot transfer in DfD.

5. ZEDD as Zero-Shot Embedding Drift Detection

Zero-Shot Embedding Drift Detection is formulated as an external defense layer for LLM systems subject to prompt injection (Sekar et al., 18 Jan 2026). The motivating observation is that jailbreaks, system-leak prompts, task overrides, encoding manipulations, and prompt-confusion attacks produce subtle but measurable shifts in embedding space. ZEDD quantifies those shifts without requiring model-internal signals, gradient access, or target-model retraining.

Let $\alpha 1$8 be the embedding of prompt $\alpha 1$9 produced by a fixed encoder. Cosine similarity is defined by

$= 3.08$0

Given a clean reference prompt $= 3.08$1 and a suspect prompt $= 3.08$2, semantic drift is

$= 3.08$3

Large $= 3.08$4 indicates substantial semantic displacement and is treated as characteristic of adversarial manipulation.

Threshold selection is handled statistically. ZEDD fits a two-component Gaussian Mixture Model to $= 3.08$5 scores from held-out clean-clean pairs and injected-clean pairs. If $= 3.08$6 and $= 3.08$7 are the Gaussian density functions and $= 3.08$8 are the mixture weights, the threshold $= 3.08$9 is set at the intersection

$P_n$0

To enforce a user-specified false-positive-rate cap such as 3%, the method performs a constrained binary search over $P_n$1 in the tail of the estimated clean distribution. If the GMM fails to converge, a KDE fallback locates density minima between the two modes. This makes the operating point explicitly configurable rather than implicitly learned.

The evaluation uses the Microsoft LLMail-Inject corpus. From 461,640 email-style prompts, deduplication and English filtering leave 172,673 prompts. Each is labeled by GPT-3.5-turbo into one of five categories: Jailbreak, System-leak, Task-override, Encoding-manipulation, and Prompt-confusion. Each adversarial prompt is paired with a rewritten clean variant, and for zero-shot evaluation the method subsamples approximately 86,000 injected-clean pairs, generates a matched 86,000 clean-clean baseline set, and reserves 51,603 aligned pairs for testing, comprising 25,801 clean and 25,802 injected prompts. Average prompt length is 1.8 K characters.

6. Empirical behavior, deployment, and terminological boundaries

Across Llama 3 8B Instruct, Mistral 7B Instruct, and Qwen 2 7B Instruct encoders, ZEDD achieves accuracy of at least 93% on the test slice: 95.32% for Llama 3, 95.55% for Mistral, and 95.46% for Qwen, with average clean false positive rate approximately 2.93%, below the 3% target (Sekar et al., 18 Jan 2026). Per-category detection rates exceed 90% for all five injection types. Embedding extraction and drift scoring are performed in batched API calls, for example 64 prompts per batch, adding only tens of milliseconds of latency per request. Fine-tuning each encoder on a single NVIDIA B200 GPU takes under 20 minutes, after which no further model training is required for deployment.

Integration consists of four components: deploying a fixed embedding service; calibrating drift scores on representative clean and optionally injected prompts; performing a runtime check by computing $P_n$2; and then either blocking or forwarding the request according to whether $P_n$3. The paper allows $P_n$4 to be derived from a clustering of prior benign embeddings or from a matched clean rewrite. This suggests that the method is intended to be inserted into existing LLM pipelines as a verification layer rather than as a substitute for alignment or policy enforcement.

A recurring source of confusion is the similarity between ZEDD and ZED. In the ambient-backscatter literature, "Neyman Pearson Detector for Multiple Ambient Backscatter Zero-Energy-Devices Beacons using Near-Perfect Code" (Yang et al., 3 Oct 2025) and "Neyman-Pearson Detector for Ambient Backscatter Zero-Energy-Devices Beacons" (Yang et al., 14 Apr 2025) use the term Zero-Energy-Device, abbreviated ZED, not ZEDD. Those papers concern ambient backscatter localization and Neyman-Pearson detection, including BC and Near-Perfect Code synchronization sequences, dual correlators, explicit $P_n$5 control, and multi-tag separability. They belong to a separate line of work and do not define the acronym ZEDD.

Taken together, the current literature assigns ZEDD to two distinct technical objects: a high-fidelity benchmark that raises the standard for real-world zero-shot DfD evaluation, and a lightweight detector that operationalizes semantic drift for prompt-injection defense in LLM applications. The acronym therefore has no single field-independent meaning; its interpretation is determined entirely by disciplinary context and citation.