Zero-Shot Video Anomaly Detection

• ZS-VAD is a framework for detecting anomalies in videos without exposure to target anomalies during training, relying on normal data modeling and language-guided definitions.
• Recent methods leverage one-class classification, pseudo-anomaly synthesis, and multimodal large language models to improve detection accuracy and adaptability.
• Advances in training-free inference and language-guided approaches boost recall and customization in realistic surveillance conditions while addressing benchmark challenges.

Searching arXiv for the provided ZS-VAD papers and closely related work. Zero-Shot Video Anomaly Detection (ZS-VAD) denotes a family of video anomaly detection settings in which anomalous events must be identified without task-specific exposure to the target anomaly distribution during training. In the recent literature, the term covers several related regimes: one-class formulations trained only on normal videos, cross-domain deployment without target-domain adaptation, training-free inference with frozen foundation models, and open-world systems in which anomaly definitions are supplied at inference time through natural language (Aich et al., 2022, Liu et al., 17 Mar 2025, Huang et al., 8 May 2026). Alongside classical reconstruction-, prediction-, distance-, and skeleton-based pipelines, recent work also reframes VAD as a language-guided reasoning problem with multimodal LLMs (MLLMs), although systematic evaluation shows that zero-shot recall remains a central obstacle in realistic surveillance conditions (Yao et al., 5 Mar 2026).

1. Conceptual scope of ZS-VAD

A stable core definition across the literature is that anomaly detection must generalize beyond observed anomalous categories. In one-class classification (OCC) variants, training uses only normal videos and anomalies are identified as deviations from learned normal structure, as in learnable locality-sensitive hashing, reconstruction-based pseudo-anomaly frameworks, and future-frame prediction models (Lu et al., 2021, Rai et al., 2023, Aich et al., 2022). In cross-domain formulations, the additional constraint is that no target-domain training data are available, so deployment must be “out-of-the-box” on unseen scenes without adaptation (Aich et al., 2022, Lyu et al., 2024).

A second line of work broadens the problem from fixed anomaly definitions to user-guided or open-world detection. “Customizable video anomaly detection” treats user-defined text as the abnormal event to be detected, so the anomaly concept is specified by a query such as “bicycle” or “fighting” rather than by a fixed training taxonomy (Ahn et al., 6 Mar 2025). LaGoVAD makes this explicit by replacing the conventional mapping $\Phi: v \rightarrow y$ with $\Phi: (v, z) \rightarrow y$, where $z$ is a natural-language anomaly definition, thereby modeling anomaly definitions as dynamic stochastic variables rather than fixed labels (Liu et al., 17 Mar 2025).

A third line removes task-specific training altogether. Training-free systems such as Flashback, SphereVAD, and the unified reasoning framework rely on frozen video-text or multimodal models, using offline memory construction, geometric inference, or chained prompting instead of gradient-based optimization on target VAD data (Lee et al., 21 May 2025, Huang et al., 8 May 2026, Lin et al., 2 Nov 2025). LAVIDA occupies an intermediate position: it is zero-shot with respect to VAD because training is conducted solely on pseudo anomalies synthesized from segmentation data, without any VAD data (Dai et al., 22 Feb 2026).

This variety means that “zero-shot” is not operationally identical across papers. A plausible implication is that direct comparison of headline numbers requires careful attention to whether the setting excludes anomaly examples, target-domain data, finetuning, or all three.

2. Formalizations, supervision regimes, and benchmarks

One explicit formulation casts VAD as binary classification on short clips under weak temporal supervision. Given a video $V = \{x_1, x_2, \ldots, x_T\}$ with frame-level labels $y_t \in \{0,1\}$, clips are constructed as $c_i = \{x_{(i-1)L+1}, \ldots, x_{iL}\}$, where $L = t \cdot r$ for clip duration $t$ and frame rate $r$. A clip is labeled anomalous if any frame within it is anomalous, and the MLLM output is parsed into $\hat{Y}_i^{(m)} \in \{0,1\}$ (Yao et al., 5 Mar 2026). This setting foregrounds precision, recall, and F1-score rather than ranking-only evaluation.

Language-guided formulations add an anomaly-definition variable. LaGoVAD optimizes

$\Phi: (v, z) \rightarrow y$0

so anomaly score prediction is conditioned jointly on video and text definition (Liu et al., 17 Mar 2025). AnyAnomaly uses a related query-conditioned setup in which a video segment $\Phi: (v, z) \rightarrow y$1 is paired with user text $\Phi: (v, z) \rightarrow y$2, then key-frame selection, position context, and temporal context are passed to an LVLM to produce an anomaly score in $\Phi: (v, z) \rightarrow y$3 without finetuning (Ahn et al., 6 Mar 2025).

The evaluation landscape is correspondingly heterogeneous. Reported metrics include F1-score, precision, and recall for clip-level binary decisions (Yao et al., 5 Mar 2026); Micro-AUC and Macro-AUC for distance-based OCC detection (Lu et al., 2021); frame-level micro-AUROC for customizable anomaly detection (Ahn et al., 6 Mar 2025); AUC and AP for open-world detection and violence/crime benchmarks (Liu et al., 17 Mar 2025, Huang et al., 8 May 2026); and pixel-level AUC for spatial anomaly localization (Dai et al., 22 Feb 2026). Benchmarks span ShanghaiTech, CHAD, Avenue, Corridor, UBnormal, UCSD Ped2, UCF-Crime, XD-Violence, MSAD, DoTA, TAD, LAD, NWPU, and others (Yao et al., 5 Mar 2026, Lu et al., 2021, Dai et al., 22 Feb 2026, Liu et al., 17 Mar 2025, Tang et al., 14 Sep 2025).

Dataset construction has also become a research topic. AnyAnomaly introduces Customizable-ShanghaiTech and Customizable-Avenue by relabeling test videos with respect to the presence or absence of each anomaly event under user queries (Ahn et al., 6 Mar 2025). LaGoVAD introduces PreVAD, described as the largest and most diverse video anomaly dataset to date, with 35,279 annotated videos, 7 first-level categories, 35 subcategories, and natural-language descriptions averaging 22.9 words (Liu et al., 17 Mar 2025).

3. Principal methodological families

ZS-VAD methods can be grouped by the source of normality priors, the role of synthetic anomalies, and whether inference is learned, retrieved, or reasoned.

Paradigm	Representative methods	Central mechanism
Normality modeling from normal-only data	LLSH (Lu et al., 2021)	Learnable LSH with contrastive learning and near-neighbor anomaly scoring
Pseudo-anomaly sharpening of OCC boundaries	Unified PA generation (Rai et al., 2023), zxvad (Aich et al., 2022), blur-driven AE (Lyu et al., 2024)	Synthesize pseudo-abnormal inputs to increase the normality gap
Language-guided customizable detection	AnyAnomaly (Ahn et al., 6 Mar 2025), LaGoVAD (Liu et al., 17 Mar 2025)	Condition anomaly score on user-provided text definitions
MLLM-enabled semantic reasoning	LAVIDA (Dai et al., 22 Feb 2026), MLLM reality check (Yao et al., 5 Mar 2026)	Use multimodal reasoning for clip-level anomaly decisions
Training-free retrieval or geometric inference	Flashback (Lee et al., 21 May 2025), SphereVAD (Huang et al., 8 May 2026)	Memory retrieval or hyperspherical likelihood-ratio inference
Holistic zero-shot anomaly analysis	Unified reasoning framework (Lin et al., 2 Nov 2025)	Chain temporal detection, spatial localization, and textual explanation
Skeleton-centric generalization	Action Hints (Tang et al., 14 Sep 2025)	Combine semantic typicality with context uniqueness

The first family treats anomaly detection as a problem of modeling the support of normal data. LLSH learns hash functions end-to-end so that semantically similar normal snippets fall into the same buckets, and anomalies are samples that fail to sufficiently resemble any known normal event (Lu et al., 2021). The second family sharpens OCC decision boundaries by constructing pseudo anomalies from normal data or unrelated data. Spatial inpainting, optical-flow perturbation, foreign-object insertion, and Gaussian blur all serve this role, but the inductive biases differ across methods (Rai et al., 2023, Aich et al., 2022, Lyu et al., 2024).

The language-guided family shifts the anomaly definition itself from a fixed label space to a runtime input. This is explicit in customizable VAD and open-world VAD, where the same video can be evaluated under different anomaly definitions without retraining (Ahn et al., 6 Mar 2025, Liu et al., 17 Mar 2025). The training-free family takes a stronger stance: it assumes pretrained multimodal features already encode anomaly semantics, so deployment should be reducible to retrieval, prompt chaining, or manifold-based discrimination without additional parameter updates (Lee et al., 21 May 2025, Huang et al., 8 May 2026, Lin et al., 2 Nov 2025).

4. Language-guided and MLLM-based ZS-VAD

The strongest recent shift is the reinterpretation of anomaly detection as multimodal reasoning. A systematic evaluation of state-of-the-art MLLMs on ShanghaiTech and CHAD reformulates VAD as binary classification under weak temporal supervision and studies prompt specificity and 1s–3s temporal windows. The central empirical finding is a pronounced conservative bias in zero-shot settings: models heavily favor the “normal” class, sometimes achieving 100% precision but often with recall below 5%. On ShanghaiTech with the “Human” prompt and a 1s window, one example reports Precision = 100%, Recall = 1.85%, and F1 = 0.04. Adding class-specific instructions is described as the single most effective method for increasing recall; on ShanghaiTech, “GPT instant medium + class” at 1s improves F1 from 0.06 to 0.49 and recall from 3.23% to 36.05%, while the best reported F1-scores are 0.64 on ShanghaiTech and 0.48 on CHAD (Yao et al., 5 Mar 2026).

AnyAnomaly extends language guidance from generic anomaly reasoning to user-customizable detection. It uses a context-aware visual question answering pipeline with key-frame selection, position context from WinCLIP-based multi-scale attention, and temporal context from grid images, all processed by off-the-shelf LVLMs without finetuning. On the customizable datasets, the proposed “+All Context” model improves AUROC from 78.01% to 85.72% on C-ShT and from 79.43% to 90.27% on C-Ave. On standard VAD benchmarks it reports 87.3 on Avenue, 79.7 on ShanghaiTech, and 74.5 on UBnormal, with the UBnormal result exceeding the cited supervised score of 72.8 (Ahn et al., 6 Mar 2025).

LaGoVAD formalizes open-world VAD as detection conditioned on natural-language anomaly definitions and introduces two regularizers: dynamic video synthesis to diversify anomaly durations and contrastive learning with hard negative mining to improve multimodal robustness. It is trained on PreVAD, whose scale and language-rich annotations are intended to support zero-shot generalization across seven datasets. Reported results state that LaGoVAD surpasses existing methods, including open-vocabulary and LLM-based baselines; on XD-Violence it achieves 74.25 AP, described as a +20% improvement over the prior best, with average improvements of 7% in detection and up to 68% in classification relative to competitive baselines (Liu et al., 17 Mar 2025).

LAVIDA removes dependence on real VAD data entirely by synthesizing pseudo anomalies from segmentation datasets through an Anomaly Exposure Sampler, extracting semantic features with an MLLM, and compressing tokens using reverse attention for spatio-temporally sparse anomaly cues. It reports frame-level zero-shot scores of 76.45% AUC on UBnormal, 85.28% AUC on ShanghaiTech, 82.18% AUC on UCF-Crime, and 90.62% AP on XD-Violence, together with 87.68% AUC for pixel-level detection on UCSD Ped2 (Dai et al., 22 Feb 2026).

Taken together, these results indicate that language guidance can substantially improve adaptability and semantic specificity, but the MLLM reality-check literature also shows that prompt design, class context, and calibration remain decisive.

5. Normality modeling, pseudo-anomalies, and cross-domain transfer

Distance-based normality modeling remains a major zero-shot strategy. LLSH embeds locality-sensitive hashing into a neural network and optimizes the hash functions with contrastive learning so that semantically similar snippets hash together. The anomaly score is computed from the minimum or average distance between a test code and training codes in the same buckets; if no similar bucket exists, a high anomaly score is assigned. Reported results include Macro-AUC 85.9% on ShanghaiTech, 74.2% on Corridor, and 88.6% on Avenue, together with a computation cost of only 0.26% of the multiply operations of naive KNN (Lu et al., 2021).

Pseudo-anomaly generation offers a different route to zero-shot generalization. The unified spatio-temporal pseudo-anomaly framework generates spatial pseudo anomalies with latent diffusion inpainting and temporal pseudo anomalies with optical-flow mixup, then learns three anomaly indicators: reconstruction quality, temporal irregularity, and semantic inconsistency. On standard OCC evaluation it reports Micro-AUC 93.53% on Ped2, 86.61% on Avenue, 71.65% on ShanghaiTech, and 57.98% on UBnormal, and in cross-dataset transfer from UBnormal to other datasets it reports 85.37% on Ped2, 83.50% on Avenue, and 70.07% on ShanghaiTech without finetuning (Rai et al., 2023).

zxvad tackles zero-shot cross-domain VAD without any target-domain adaptation by combining a future-frame prediction generator, a Normalcy Classifier trained with relative normalcy losses, and an untrained CNN-based anomaly synthesis module that inserts foreign objects. Using ShanghaiTech plus task-irrelevant data as source, it reports 75.9 on Ped1, 95.8 on Ped2, and 82.5 on Avenue. Even with task-irrelevant data only, reported scores include 76.7 on Ped1, 91.5 on Ped2, and 81.9 on Avenue for HMDB. The framework also reports 8.73M parameters, 43.10 GMACs, 34.92 MB storage, 6.81 J GPU energy, and 208.5 FPS (Aich et al., 2022).

The blur-driven autoencoder and motion-guided memory module pursue cross-dataset zero-shot detection by blurring normal appearance images during training, deblurring only normal patterns through multi-scale residual channel attention, and reconstructing motion through a memory of normal motion features. Reported source-domain scores include 99.0% on UCSD Ped2 and 75.6% on ShanghaiTech, while cross-dataset testing from ShanghaiTech to Ped2 and Avenue yields 97.53% and 87.47%, respectively; adding VGG16-based motion denoising is reported to improve Avenue from 85.6% to 89.6% (Lyu et al., 2024).

Other non-LLM routes combine predictive and semantic modeling. A context-aware hybrid architecture using TimeSformer, DPC-RNN, and CLIP reports, on UCF-Crime in the pure zero-shot setting, ROC-AUC 84.5%, PR-AUC 72.3%, mAP 62.5%, detection delay 0.45 s, and F1-score 0.74 (Khan et al., 25 Aug 2025). In the skeleton domain, Action Hints learns language-guided semantic typicality and test-time context uniqueness, reporting frame-level AUC 84.1 on ShanghaiTech, 74.5 on UBnormal, 62.1 on NWPU, and 62.7 on UCF-Crime without using target-domain training samples (Tang et al., 14 Sep 2025).

These approaches share the premise that generalization depends on modeling normal structure, relative foreignness, or context-adaptive rarity rather than memorizing fixed abnormal classes.

6. Training-free inference, real-time deployment, and holistic analysis

Training-free ZS-VAD treats anomaly analysis as inference over frozen multimodal representations. Flashback is organized into an offline “Recall” stage and an online “Respond” stage. In the offline stage, an LLM generates a pseudo-scene memory of more than 1M normal and anomalous captions; in the online stage, each incoming video segment is embedded and matched against this memory with scaled anomaly penalization, so no LLM calls are made at inference time. Reported performance is 87.29 AUC on UCF-Crime, 75.13 AP and 90.54 AUC on XD-Violence, with 42.06 FPS and 0.713 s processing time per segment. An ablation reports that repulsive prompting increases centroid angle from 8.12° to 33.29° (Lee et al., 21 May 2025).

SphereVAD also avoids training, but replaces retrieval with geometric discrimination on the unit hypersphere. It extracts intermediate-layer features from frozen MLLMs, applies unified Fréchet mean centering to reduce domain bias, reinforces consistency with Holistic Scene Attention, and refines ambiguous segments with vMF-guided Spherical Geodesic Pulling. Anomaly scoring is cast as a von Mises-Fisher likelihood-ratio over geodesic distances. With only minimal synthetic images for calibration, it reports 86.38% AUC on UCF-Crime, 76.46% AUC on UBnormal, and 86.99% AP on XD-Violence (Huang et al., 8 May 2026).

A further extension is holistic zero-shot anomaly analysis. The unified reasoning framework chains temporal detection, spatial localization, and textual explanation through test-time reasoning, using intra-task refinement only for ambiguous cases and passing anomaly tags between tasks as prompt context. It reports gains of 4–6% AUC over previous zero-shot methods on UCF-Crime, XD-Violence, UBnormal, and strong results on MSAD, while also improving BLEU, CIDEr, METEOR, and GPT-based explanation scores (Lin et al., 2 Nov 2025).

This training-free branch changes the deployment profile of ZS-VAD. Instead of learning scene-specific decision boundaries, it exploits frozen multimodal priors, offline memory construction, or closed-form geometric operations. A plausible implication is that such systems are especially attractive when annotation, finetuning, or online LLM latency is operationally unacceptable.

7. Evaluation issues, misconceptions, and unresolved directions

A recurring misconception is that stronger general visual reasoning automatically yields effective anomaly detection. The MLLM reality check directly contradicts this by showing high-confidence but conservative predictions, high precision, and recall collapse in noisy surveillance environments (Yao et al., 5 Mar 2026). The same study also shows that longer prompts do not consistently improve performance and that medium prompts often outperform short or long variants. Likewise, longer temporal windows can help in some cases but are not a panacea; on CHAD, additional context may even reduce performance because of redundancy or semantic dilution (Yao et al., 5 Mar 2026).

Another misconception is that higher visual fidelity necessarily solves zero-shot reasoning. The same evaluation reports no significant performance jump from ShanghaiTech to the higher-resolution CHAD benchmark, despite improved video fidelity (Yao et al., 5 Mar 2026). This aligns with work arguing that semantic alignment, contextual reasoning, or scene-adaptive boundaries are at least as important as raw pixel quality (Ahn et al., 6 Mar 2025, Tang et al., 14 Sep 2025).

The literature also documents a shift from fixed anomaly taxonomies toward dynamic or context-dependent definitions. AnyAnomaly treats anomaly as a user-defined text query, and LaGoVAD explicitly frames changing anomaly definitions as an open-world requirement associated with concept drift (Ahn et al., 6 Mar 2025, Liu et al., 17 Mar 2025). This suggests that future evaluation will increasingly need to test whether methods can respond to updated operational policies rather than merely detect deviations from a static training distribution.

Finally, several papers identify calibration and benchmark design as open problems. The MLLM reality-check study argues for actionable, calibration-aware, binary decision benchmarks over ranking metrics such as AUC, especially for deployment settings where missed anomalies are operationally costly (Yao et al., 5 Mar 2026). At the same time, large language-rich resources such as PreVAD and class-specific relabelings such as C-VAD datasets point toward broader, semantically explicit evaluation protocols (Liu et al., 17 Mar 2025, Ahn et al., 6 Mar 2025). The current record therefore presents ZS-VAD not as a single solved task but as a set of partially overlapping problem formulations whose practical success depends on how anomaly is defined, how recall is controlled, and how zero-shot generalization is measured.