Foundation Visual Encoders Are Secretly Few-Shot Anomaly Detectors
Authors: Guangyao Zhai
Yue Zhou
Xinyan Deng
Lars Heckler-Kram
Nassir Navab
Benjamin Busam
Venue: ICLR 2026 Poster (2026)
Keywords: Representation Learning
Few-Shot Anomaly Detection
Applications of Foundation Models
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We introduce a few-shot anomaly detection method using foundation visual encoders and a nonlinear projection onto the natural image manifold. It detects structural anomalies efficiently, supports multi-class cases, and delivers strong performance.

Abstract: Few-shot anomaly detection streamlines and simplifies industrial safety inspection. However, limited samples make accurate differentiation between normal and abnormal features challenging, and even more so under category-agnostic conditions. Large-scale pre-training of foundation visual encoders has advanced many fields, as the enormous quantity of data helps to learn the general distribution of normal images.
We observe that the anomaly amount in an image directly correlates with the difference in the learnt embeddings and utilize this to design a few-shot anomaly detector termed FoundAD.
This is done by learning a nonlinear projection operator onto the natural image manifold.
The simple operator acts as an effective tool for anomaly detection to characterize and identify out-of-distribution regions in an image.
Extensive experiments show that our approach supports multi-class detection and achieves competitive performance compared to other approaches, while surpassing them in model size and inference efficiency.
Backed up by evaluations with multiple foundation encoders, including fresh DINOv3, we believe this idea broadens the perspective on foundation features and advances the field of few-shot anomaly detection.  Our code is at https://github.com/ymxlzgy/FoundAD.

Published as a conference paper at ICLR 2026
FOUNDATION VISUAL ENCODERS ARE SECRETLY FEW-SHOT ANOMALY DETECTORS
Guangyao Zhai
Yue Zhou 122
Xinyan Deng'
Lars Heckler-Kram 1.3
Nassir Navab 1.2
Benjamin Busam
'Technical University of Munich
Mumich Center for Machine Learning
MM Software GmbH
Equal Contribution
[firstname: lastname, b. busamu smmmuma de
lars waassheckler@nttee.ccom
ABSTRACT
Few-shot anomaly detection streamlines and simplifies industrial safety inspec- tion. However, limited samples make accurate differentiation between normal and abnormal features challenging, and even more so under category-agnon condi- tions. Large-scale pre-training of foundation visual encoders has advanced many fields, as the enormous quantity of data helps to learn the general distribution of normal images. We observe that the anomaly amount in an image directly cor- relates with the difference in the learnt embeddings and utilize this to design a few-shot anomaly detector termed FOUNDAD. This is done by learning a non- linear projection operator onto the natural image manifold. The simple operator acts as an effective tool for anomaly detection to characterize and identify out-of- distribution regions in image. Extensive experiments show that our approach supports multi-class detection and achieves competitive performance while us- ing substantially fewer parameters than prior methods. Backed up by evaluations with multiple foundation encoders, including fresh DINOv3, we believe this idea broadens the perspective foundation features and advances the field of few-shot anomaly detection. Our code is at https: : ////g thub. com/ ymx agy wtgggg///uuuaaao FoundAD.
INTRODUCTION
The variability of images is large. Under- standing general concepts from pixel data is therefore by design very complex problem. Foundation models (Zagoruyko & Komodakis, 2016; Caron al., 2021; Zhai et al., 2023b) have provided a significant leap forward to image understanding in generalized contexts across many tasks. The design of training paradigms and the advances in computational resources enabled the computer vision commu- nity to learn powerful visual encoders whose feature embeddings are adjustable to many downstream tasks (Oquab et al., 2024). These foundation visual encoders are trained en- code samples from the core distribution of nor- mal natural images as illustrated by the natu- ral image manifold in Figure 1. For some vi- sion tasks, specifically the tail end of this dis- tribution away from the heavy core is impor- tant (Bergmann et al., 2019; Zou et al., 2022). Industrial inspection, for instance, demands ro- bust anomaly detection techniques that can op- erate effectively even when limited annotated
1
DV2.
f(f
Pre-trineed Natural Image Manifold
Figure 1: Manifold Projection. Large training sets enable foundation models learn the manifold of nat- images (illustrated schematically as 2D surface), which lies in a higher-dimensional feature space. Nor- mal images such as I, are embedded onto this mani- fold. Images with anomalies (1), 13) lie further away from this manifold. The distance D (ft, fr) correlates with the pixel amount learn non-linear projection operator & that projects the embedding fa of an anomalous image L. onto its cor- responding normal feature f. Feature comparison ables few-shot anomaly detection It..
anomaly the image.

---

Published as a conference paper at ICLR 2026
SigLIP
112 Fosture Dicance
Real Normality
Synthetic Anomaly
Reai-nuumaly
T2" 20 23
Synthetic Anomaly Area (pixels)
Reak Normality
Synthetic Anomaly
Reomaay
Figure 2: Correlation of Anomaly Area with Feature Distance. Two foundation encoders under different paradigms are shown. Upper left/right: Real images with corresponding synthetic and real anomalics. Lower left/right: Coloured PCA visualizations of their embedded features using SigLIP (Zhai al., 2023b) (left) and DINOy2 (Oquab et al., 2024) (right). Center: L.2feeaure distance of embeddings for synthetic anomalies of increasing pixel amount on a real image. clear correlation visible for both foundation models.
data is available, collecting large datasets in production is not only costly, but also impractical. This applies especially to defective samples, where the types of defects that might potentially occur are unknown prior to the launch of production. For these setups, unsupervised few-shot anomaly detection is highly attractive approach, since it only requires a small amount of defect-free samples for training. However, the scarcity of anomalous samples generally hampers the possibility to learn comprehensive representations (Chen et al., 2020), such that traditional methods face the challenge of distinguishing subtle differences between normal and abnormal features.
Studying the embedding structure of foundation models in light of this task reveals an interesting property: The amount of anomalous area in image directly corresponds to the feature distance in the embedding space as shown in Figure 2. This shows that foundation encoders distinguish anomaly from normality, i.e., they "secretly detect" the defective regions. We attribute this to the learning signal from natural images that stipulates the creation of a natural image manifold in the embedding space of foundation model. Moving away from this structure correlates to shifting towards the tail end or outside the general distribution of normal images.
We leverage this observation in our work to design FOUNDAD, a few-shot anomaly detector that utilizes the image embeddings of a foundation visual encoder. We utilize foundational models to encode both anomalous and normal features, where structural anomalies are primitively synthesized by CutPaste (Li et al., 2021). The encoder is frozen to bootstrap the learning process by reusing the strong semantic and geometric understanding. Then, we employ a nonlinear projector to learn the necessary feature mapping with only minimal few-shot demonstrations, such as a single sam- ple. We validate FOUNDAD on multiple foundation visual encoders, including DINO series (Caron et al., 2021; Oquab et al., 2024; Siméoni et al., 2025), vision branches of vision-language models (VLMs) (Zhai et al., 2023b; Radford et al., 2021), and pre-trained convolutional neural network (CNN) (Zagoruyko & Komodakis, 2016). The experiments show that FOUNDAD with DINOv3 achieves the best performance, and even it is trained on multiple classes with compact parameters, it is superior methods that particularly focus each class Li et al. (2024), and it performs com- petitively among large-scale few-shot anomaly detectors Lv et al. (2025); Zhang et al. (2025b).
Conceptually, FOUNDAD is inspired by predictive embedding approaches such as JEPA (LeCun, 2022; Assran et al., 2023) and SimSiam (Chen & He, 2021), which capture representation depen- dencies between paired inputs by operating purely in latent space, eschewing the need for pixel-level observation reconstruction. In contrast to these methods actively training encoders, we keep the foundation encoders frozen to enjoy the natural image manifold, and instead solely train a simple network to adapt and project the pretrained embeddings exclusively and effectively for the few-shot anomaly detection (cf. Figure 1). The entire pipeline is fast, lightweight, and easy to train. More importantly, our findings suggest that rethinking the use of foundational visual encoders can extend their applicability to complex anomaly detection tasks without additional design complexity, such conventional textual prompts for assistance (Li et al., 2024; Lv et al., 2025; Zhang al., 2025b).
In summary, the contributions of our work are threefold: (i) We reveal the correlation of embedding distance and anomaly amount in images for foundation visual encoders. (ii) Based on point (i), introduce a feature projection method to efficiently discriminate between anomaly and normality in the embedding space. The nonlinear projector lightweight and can be trained with minimal
2

---

Published as a conference paper at ICLR 2026
eetu ROR
Encoder
Projector
Encoder &
I
Up Upsampling
f.
Grudient
ft
fal
Synthesis
D(f..f))
Top-K Scores
0.98
Anoemaly
Encoder 0
Projector A
Normality
I
688
0.96
fr
fa
A. Training
B. Inference
Figure 3: A. Training pipeline. Normal training images I, are first processed by the anomaly synthesis module to generate augmented samples I,. Feature embeddings of the augmented image and the original image extracted by the Anomaly-Awas Aware Encoder 9a and the Reference Encoder 0s. respectively (0, = 0, 6). The Manifold Projector & trained to map the feature embeddings f. towards normal feature fr. The training ohjective
synthesized anomalous image to minimize the distance D (ft: f-) between projected feature f. and the reference feature fr- B. Inference pipeline. During inference, an input image processed by AE extract feature embeddings fa. which are then projected by the Projector to f" The anomaly D (fa fo) for each patch computed. We aggregate the Top-K highest patch-level anomaly scores and generate an anomaly heatmap It. by upsampling to the original image resolution.
demonstrations. (iii) Comprehensive experiments demonstrate that the performance of our pipeline surpasses state-of-the-an multi-class methods. More importantly, it reveals that foundation visual features without textual assistance suffice for few-shot anomaly detection.
METHODOLOGY
The overall architecture is illustrated in Figure 3. The network designed project the latent representation of either abnormal image normal image the natural image manifold learned by foundation model. The projected representation is compared to the original representation, where large differences indicate the occurrence of anomalies. The key components of the framework include an anomaly synthesis module, two identical encoders, and a projector.
2.1 ANOMALY SYNTHESIS
To train the framework in an unsupervised setting, we utilize a structural anomaly synthesis module inspired by CutPaste (Li et al., 2021). As shown in Figure 2, synthesized anomalies exhibit notice- able differences from real anomalies at the pixel level, but these differences become less pronounced in the latent space. This suggests that simple synthesis strategy is sufficient to drive anomalous features away from the natural image manifold, aligning with our projector's 's training objective. To enhance the reality of synthetic anomaly, constrain anomalies to foreground regions using adaptive fireshold-based binarization (Zhang et al., 2024; Yang et al., 2023).
2.2 VISUAL MANIFOLD PROJECTION
Our framework starts with two foundation visual encoders to extract latent representations from input images, shown in Figure 3: the Anomaly-Aware Encoder (AE), which processes synthesized abnormal images La and the Reference Encoder (RE), which processes original normal images I,- Both encoders share the same parameters f, ensuring consistency in feature extraction and aligning embeddings within the same latent space. This design keeps normal patches in synthesized images close to their counterparts in normal images, while highlighting discrepancies in anomalous regions.
On top of these representations, we introduce the Manifold Projector, nonlinear module ap- plied after AE that maps the anomaly-aware features toward the natural image manifold with
3

---

Published as a conference paper at ICLR 2026
only few-shot supervision. Since the features are tokenized, we implement the projector using a self-attention Vision Transformer (ViT). Each transformer block employs residual connections, Four Att + Zin: to stabilize training and preserve input information. Given anomaly image s. the encoder yields an embedding f. = ((T,), which deviates from the normal embedding fr. The projector @ then produces corrected embedding f that aligns with the normal feature fr on the natural image manifold. Unlike reconstruction based approaches such as (Yan et al., 2024), our method operates entirely in latent space, substantially reducing computational complexity.
2.3 TRAINING
The training process follows the pipeline illustrated in Figure 3. During training, given an original normal image I, in each iteration, we independently gate anomaly synthesis with a threshold a. Let Bernoulli(1 - o), and then I, = (1 2) + = Syn(Ir), where Syn denotes the synthesis operation described Sec. 2.1. We obtain feature embeddings using 6: fz = ((I,): fr = A(I,). Then the projector maps the synthesized anomaly feature f. to the estimated normal feature: J ((²)). The training objective is to minimize the discrepancy between the projected feature and the reference normal feature via:
N N
1
C = D(G = U -
(1)
where L is the L2 loss, and N is the number of embedded patches.
2.4 INFERENCE
Given a test image La its feature embedding is extracted using AE as 0 The projector & is then applied to map the extracted feature embedding to the estimated feature on the natural image manifold f ((fa). We compute the patch-level anomaly score as the squared L2 distance between the extracted feature and its projected counterpart, turning Equation to:
1 N
Sparch D(Fā,
Σ (fa. f.
(2)
For image-level anomaly detection, we compute the average of the Top-K K patch anomaly scores:
1 K
Sumage
Σ Spatch.
(3)
Finally, to generate pixel-level anomaly maps, the patch-level scores are upsampled to the original image resolution, highlighting regions with the most significant deviations.
EXPERIMENTS
3.1 EXPERIMENTAL SETUP
Datasets Following the protocol in IPAD (Lv et al., 2025), evaluate FOUNDAD with various foundation encoders on two popular industrial anomaly detection datasets: MVTec-AD (Bergmann al., 2019) and VisA (Zou et al., 2022). MVTec-AD consists of 354 high-resolution images across five texture and ten object categories, with 725 for testing, covering various real-world defects such as contamination and structural deformations. VisA includes twelve object categories with 10, 821 images, featuring 9, 621 normal samples and 1, 200 anomalous images. It presents ad- ditional challenges due to complex structures, multi-instance objects, and diverse anomaly patterns, requiring models to generalize across varying levels of complexity. We provide additional results on two more datasets, BTAD (Mishra et al., 2021) and DTD (Cimpoi et al., 2014), where BTAD focuses body and surface defects of industrial products, and DTD specializes in textures.
Evaluation Metrics To comprchensively assess anomaly detection and localization performance, employ three standard metrics: (1) Area Under the Receiver Operating Characteristic Curve
4

---

Published as a conference paper at ICLR 2026
(AUROC), which evaluates the model's ability to distinguish normal and anomalous samples at both image and pixel levels; (2) Area Under the Precision Recall Curve (AUPR), which particularly effective for imbalanced datasets by emphasizing precision-recall trade-offs; and (e)ger-Region- Overlap (PRO), which measures region-level anomaly localization by computing the overlap be- tween predicted and ground-truth anomalous regions. Curve areas involving the false positive rate are calculated only to an FPR of 0.3 (Bergmann et al., 2019). These metrics collectively ensure robust evaluation of both detection accuracy and localization effectiveness.
Baseline We evaluate the method against state-of-the-ar anomaly detection methods across multi/one-class settings, For few-shot and multi-class scenarios, we compare with FastRecon (Fang et al., 2023), AnomalySD (Yan et al., 2024), and IIPAD (Lv et al., 2025). Additionally, we include one-class methods such as WinCLIP (Jeong al., 2023), InCTRL (Zhu & Pang. 2024), Anomaly- CLIP (Zhou et al., 2024), PromptAD (Li et al., 2024), LogSAD (Zhang et al., 2025b), and Adapt- CLIP (Gao al., 2025), as well as classical models like SPADE (Cohen & Hoshen, 2020) and PatchCore (Roth et al., 2022), referring to results reported in IIPAD.
Implementation Details FOUNDAD is compatible with various encoders, and we report the one backed by a pretrained DINOv3 ViT-B (Siméoni al., 2025) here. For details about more encoders, please refer to the Supplementary Material A. The input images are resized to 512 x 512 x 3 for consistency across experiments. The projector implemented a VIT with depth of 6 layers. For stable and efficient optimization, we utilize the Adam optimizer with a weight decay of 1 x 10-4. The learning is set 0.001, empirically chosen to ensure convergence. All experiments are conducted on single RTX 3090 GPU with batch size of 8. During training, we set the synthesis threshold 0.5. For inference, the image-level anomaly score is computed based on the Top-K highest patch anomaly scores. K is set to 10 for MVTec-AD, BTAD, and DTD, and 6 for VisA.
Table 1:
Comparison of results MVTec-AD and VisA against various methods. Metrics include image-level AUROC (%), AUPR (%), and pixel-level AUROC (%), PRO (%). We
few-shot
color the best and the second in the k-shot setting.
MVTec-D
VIsA
Shot Method
w/o Texts
FAUUOOC
AUPR
P-AUROC
PRO
F-AUROC
AUPR
P-AUROC
PRO
60.4
PatchCore
63.7
81.2
83.9
72.7
58.9
62.8
76.7
64.3
FastRecon
WinCLIP
X
92.8
96.5
92.4
83.5
83.1
85.1
94.6
80.9
PromptAD
91.8
AnomalySD
X
93.6
96.9
94.8
89.2
86.1
89.1
96.5
93.9
IPAD
96.4
FOUNDAD (Ours)
96.1
97.9
96.8
92.8
92.6
92.0
99.7
98.0
SPADE
68.4
84.2
61.2
54.7
72.0
71.3
PatchCore
72.4
86.2
89.6
74,2
60.2
64.3
82.4
68.
FastRocon
51.7
74.9
62.4
59.9
74.6
WinCT JP
X
92.7
96.3
92.4
83.9
83.7
84.9
95. 1
81.8
PromptAD
89.2
94.8
92.2
84.3
87.8
AnonalySD
X
94.8
97.0
95.8
90.4
87.4
90.1
96.8
94.1
HPAD
97.9
96.7
FOUNDAD (Ours)
96.8
98.3
97.0
93.3
93.5
93.00
99.7
98.0
SPADE
76.6
88.8
62.8
$5.6
73.0
76.6
72.1
60.9
PatchCore
74.9
88.8
92.6
80.8
62.6
69.9
85.4
70.6
FastRecon
50.8
73.1
65.0
62.8
$7.6
73.7
78.8
62.9
WinCLIP
94.0
96.9
92.9
84.4
$4.1
$6.1
95.2
82.1
PromptAD
90.6
96.5
92.4
84.6
85.7
88.8
97.2
84.7
AnomalySD
95.6
97.6
96.2
90.8
88.9
90.9
97.5
94.33
IPAD
96.1
98.1
97.0
91.2
88.3
89.6
97.4
FOUNDAD (Ours)
97.1
98.6
97.2
93.5
94.4
94.0
99.7
98.4
The multi-class and few-shot results of SPADE (Cohen & Hoshen, 2020), PatchCore (Roth al., 2022), FastRecon (Fang 2023),
WinCLIP, and PromptAD are from IPAD (Lv et al., 2025).
3.2 EXPERIMENTAL RESULTS
For each few-shot setting, we conduct three different sample combinations, each drawn under a ran- dom seed. The averaged results the MVTec-AD and VisA across different few-shot settings reported in Table 1. Some one-class-one modee full-shot methods (c.g.. SPADE, PatchCore) from IIPAD adapted the multi-class-one-mode few-shot setting for fair comparison. To further
5

---

Published as a conference paper at ICLR 2026
demonstrate the competitiveness of FOUNDAD, Table and Table present results all datasets under the one-class-one cesssooe--oon model paradigm. Detailed outcomes from each run are provided in Supple- mentary Material C.I.
Quantitative Comparison with Multi-Class Baselines As shown in Table 1, FOUNDAD consis- tently achieves the best performance across both image-level classification and pixel-level segmen- tation metrics. Classical few-shot methods such SPADE, PatchCore, and FastRecon suffer from severe performance degradation when extended to the multi-class setting, highlighting the difficulty of adapting them to various categories. In contrast, FOUNDAD handles multi-class adaptation effec- tively with its simple projector architecture, even under limited training data. Notably, FOUNDAD achieves strong results without relying on text prompts, distinguishing it from recent prompt-based baselines. On MVTec-AD, FOUNDAD shows clear advantage under the low-shot regime. For instance, in the 1-shot case, surpasses the second-best method IIPAD by 1.9% in I-AUROC and 3.0% in PRO. On VisA, FOUNDAD delivers nearly perfect localization, with pixel-level AUROC reaching 99. 7% consistently across all few-shot settings, outperforming ITPAD by up to 2.8%. As the number of shots increases to 2 and 4, FOUNDAD not only maintains competitive image-level accuracy but also further strengthens its lead in localization metrics. These results highlight the robustness and strong generalization ability of FOUNDAD in the challenging multi-class few-shot anomaly detection scenario.
Table 2: Comparison of results on MVTec-AD and VisA against various one-class-one-meeee few-shot meth- ods. Ours remains the multi-class-nn--mode few-shot setting. Metrics include image-level AUROC (%), AUPR (%), pixel-level P-AUROC (%), and PRO (%). We color the best and the second in the k-shot setting.
MVTecAD
VisA
Shot
Method
Texts
I-AUROC
AUPR
P-AUROC
PRO
I-AUROC
AUPR
P-AUROC
PRO
SPADE
90.6
91.2
83.9
79.5
82.0
PatchCore
83.4
92.2
92.0
79.7
79.9
82.8
95.4
8U.5
WinCLIP
93.1
96.5
95.2
83.8
85.1
96.4
InCTRI.
91.3
95.2
94.6
87.8
83.2
84.1
89.0
66.7
AnomalyCLip
X
95.2
97.2
94.6
87.6
87.7
87.7
83.2
90.1
PromptAD
97.1
LogSAD
95.5
97.3
97.0
92.5
89.8
90,3
97.5
88.2
AdsptCLIP
94.5
97.5
94.3
89.5
90.5
92.3
96.8
90.7
FOUNDAD (Ours)
96.1
97.9
96.8
92.8
92.6
92.0
99.7
98.0
SPADE
82.9
91.7
92.0
85.7
80.7
82.3
96.2
85.7
PatchCore
93.8
82.3
84.8
96.
WinCLIP
X
94.4
97.0
96.0
88.4
84.6
85.8
96.8
86.2
InCTRL
95.5
95.2
86.3
2
AnomalyCI.Ip2
95.4
97.3
87.8
87.8
89.1
84.5
90.8
PromptAD
95.7
97.9
96.2
88.5
88.3
90.0
97.1
85.8
LogSAD
97.6
AdsptCLIP
95.7
97.9
94.5
90.3
92.2
93.6
97.
91.2
FOUNDAD (Ours)
93.3
SPADE
84.8
92.5
92.7
87.0
81.7
83.4
96.6
87.3
PatchCore
85.8
94.5
94.3
84.3
85.3
87.5
96.8
84.9
WioCLIP
X
95.2
97.3
96.2
89.0
87.3
88.8
97.2
87.6
InCTRI.
93.1
96.3
95.8
89.5
87.8
88.0
90.2
68.8
AnomalyCLip"
PromptAD
96.6
98.5
96.5
90.5
89.1
90.8
97.4
86.2
LogSAD
96.6
97.7
97.5
93.5
93,2
93.4
98.1
90.5
AdaptCLIP
96.6
98.4
94.8
90.9
93.1
94.3
97.3
91.7
FOUNDAD (Ours)
97.1
98.6
97.2
93.6
94.4
94.0
99.7
98.4
11CTRL (Zhu Pang, 2024) only targeted at the imago-lovel anomaly detection, yet report pixel-level metrics for readers' compreheusion. 2025), extend
detection. Following AdsptCLIP support detection with few shot references. "LogAA originally only provides L/P-AUROC, and we reproduce the experiment in three rounds every metric, adhering our protocols.
"AnomalCCLIP (Zhou 2024) was originally designed
and report averaged
Quantitative Comparison with One-Class Baselines As shown in Table 2, even against few-shot baselines specialized for the one-class-oo -one--m-os-----meell setting, FOUNDAD consistently achieves top per- formance on both MVTec-AD and VisA. In the 1-shot setting, our method already surpasses strong baselines PromptAD and the previous state-of-the-as LogSAD, with a particularly large margin on VisA by 2.2% in P-AUROC and 9.8% in PRO over LogSAD. In the 4-shot scenario MVTec- AD, FOUNDAD outperforms PromptAD by 0.7% in P-AUROC and 3, ..1 in PRO, while achieving slightly lower P-AUROC than LogSAD. On VisA, however, FOUNDAD surpasses LogSAD by 1.6%

---

Published as a conference paper at ICLR 2026
in P-AUROC and 7.9% in PRO, demonstrating consistent superiority in both classification and lo- calization. Moreover, FOUNDAD relies on a single visual foundation model, which makes it more efficient than LogSAD's three-model JINO-CLI-SSAN pipeline. Importantly, our improvements are achieved in the more challenging erate under the simpler one-class formulation with class-specific memory banks text prompts. This underscores the robustness and learning ability of FOUNDAD, which remains effective even under harder problem constraints. As shown in Table 3, FOUNDAD continues achieve state-of- the-art results on the BTAD and DTD datasets, consistently securing top performance across all metries against various strong few-shot baselines. For example, the 1-shot setting, our method significantly outperforms the closest competitor, AdaptCLIP, on BTAD, yielding notable 3. 3.0% improvement I-AUROC and a substantial 6. 6.8% boost in PRO. the DTD dataset, FOUNDAD similarly exceeds the strong localization baseline InCTRL by 1 1.9% in PRO.
setting, whereas other baselines op-
Table 3: Comparison of results BTAD and DTD against various one-clas-one-model few- methods. Ours remains the multi-class-on--modee few-shot setting. Metries include image-level AUROC (%), AUPR (%), pixel-level P-AUROC (%), and PRO (%). We color the best and the second in the k-shot setting.
BTAD
DTD
Shot
Method
Texts
LAUROC
AUPR
P-AUROC
PRO
T-AURCC
AUPR
P-AUROC
PRO
WinCI
84.4
80.5
95.6
66.6
97.9
99.0
96.5
89.7
InCTRL
88.5
83.4
96.6
71.0
97.9
98.9
98.6
95.6
AnomalyCI.IP
X
88.5
74.2
95.3
75.5
98.0
99.2
97.6
93.5
AdapICLIP
95.8
96.6
77.3
FOUNDAD (Ours)
96.4
96.5
98.1
84.1
99.2
99.7
98.9
97.5
WinCL
82.5
InCTRL
88.5
83.4
96.6
71.0
98.3
99.1
98.7
95.6
An.malyCL.IP
75.4
AdaptCLIP
93.4
95.9
96.7
77.8
97.4
99.2
97.6
92.9
FOUNDAD (Ours)
WinCLIP
87.8
88.1
95.9
67.0
98.2
99.2
96.8
90.4
InCTRI.
67.5
80.9
96.8
71.4
97.7
98.3
98.7
95.9
AnomalyCLIP
90.5
77.5
95.7
76.6
98.4
99.4
97.8
93.8
AdspICT.IP
93.3
96.4
96.8
78.2
98.5
99.3
97.8
93.2
FOUNDAD (Ours)
95.5
96.7
98.3
82.7
99.3
99.7
99.0
97.6
Qualitative Comparison We present qualitative comparisons in Figure 4. FOUNDAD effectively localizes anomalous regions with high precision on both datasets. It precisely localizes anomalous regions, successfully capturing both large structural defects and subtle, fine-grained anomalies. In contrast to other methods, FOUNDAD yields cleaner segmentations with substantially less noise in background areas. Additional examples are provided Supplementary Material C.2 and C.5.
GT
PromptAD WiaCLIP
IIPAD
Ours
GT
PromptAD WinCLIP
IIPAD
Ours
Bottle
Candle
Capsules
Cable
Grid
Gum
(a) MVTec-AD
(b) VisA
Figure 4: Qualitative comparison with few-shot baselines in 1-shot setting. We directly compare results with the ones cropped from IIAAD (Ly al., 2025).
7

---

Published as a conference paper at ICLR 2026
Inference Efficiency We report the infer- ence time and memory consumption follow- ing (Batzner al., 2024). Our projector consists of 11.8 M trainable parameters. With DINOv3 the backbone, FOUNDAD contains 97.8 M pa- rameters in total and achieves an average infer- ence time of 128.7 ms per image, correspond- ing to throughput of approximately 7.8 images per second, with peak memory consumption of 1, 386 MiB on single RTX 3090. To assess the inference efficiency, we analyze the trade-off be- tween performance and model size across vari- ous representative baselines. As shown in Fig- ure 5, FOUNDAD achieves overall the best accu- racy while using at least one order of magnitude fewer parameters than the large models LogSAD (~ 13.3x) and IIPAD ( 10.3x). Despite the compact size, FOUNDAD maintains desirable ef- ficiency, especially suitable in industrial usages.
LogSAD
Ours
1.3B
BM
P-AUROC
IPAD 1.0B
PromptAD 208.4M
WinCLIP
208 4M
PatchCare
9M
L-AUROC
Figure 5: Bubble chart of AUROC results across dif- ferent methods, averaged MV and VisA from Table The smaller the circle is, the fewer pa- rameters has.
3.3 ABLATION STUDY
Comparison between DINOv3 Layers We analyze the effect of selecting differ- ent layers in DINOv3 for feature extrac- tion in the 1-shot setting on MVTec-AD, shown in Figure 6. Layer 10, used in FOUNDAD, achieves the overall best performance, with the highest I-AUROC (96.1%). AUPR (97.9%), and P-AUROC (96.8%), and a competitive PRO (92.8%). While adjacent layers such as layer and 11 yield comparable results, performance declines when using shallower (c.g., layer 6) or deeper layers (e.g., layer 12), espe- cially in terms of I-AUROC and PRO. This indicates that mid-to-late layers strike a better balance between semantics and spa- tial precision, while overly abstract or low-level features are suboptimal for fine me--graiedd localization.
100
F-UROC
P-AUROC
99
96
Score
94
92
90
86
6
10 (Final)
11
12
Layer
Figure 6: Comparison of performance using different layers
of DINOv3 in I-shot setting on MVTec-AD.
Table 4: Comparison of performance with different encoders as the backbones in a 1-shot setting on MVTec- AD. We color the best and the second
DINOv3
DINOv2
DINOSigLIP
DINO
SigLIP
CLIP
WideResnet
Pre-trained w/o Texts
T-AUROC
96.1
95.2
92.5
88.3
87.8
79.0
73.1
AUPR
97.9
97.4
95.1
94.2
93.8
87.9
87.2
P-AUROC
96.8
96.4
93.1
96.2
86.0
90.9
89.4
PRO
92.8
92.5
87.2
87.8
71.1
70.9
75.6
Comparison of Different Foundation Models visual encoders on FOUNDAD, we conduct ablation study comparing several commonly used encoders in the I-shot setting on MVTec-AD, as shown Table For VLMs, we utilize only the vi- sion backbone to extract features in the latent space. Our results demonstrate that DINOv3 achieves the best overall performance. Among the alternative encoders, the DINO series remains competitive, with DINOv2 and DINOSigLIP reaching I-AUROC scores of 95.2% and 92.5%. respectively. As expected, CLIP lags markedly, achieving only 70.9% PRO, consistent with WinCLIP's s observation that CLIP lacks pixel-level information (Jeong et al., 2023). This also suggests that CLIP is less
further investigate the capability of different
8

---

Published as a conference paper at ICLR 2026
effective than SigLIP in learning natural image manifold for fine-grained anomaly localization in few-shot settings. WideResNet shows the weakest performance, indicating that traditional CNNs, pretrained, struggle to generalize well under minimal supervision.
Most importantly, Table 4 reveals that foundation features pre-trained from pure visual supervi- sion, without alignment textual information, can still deliver highly competitive performance for anomaly detection in challenging few-shot settings. This finding highlights that textual features not a necessity; instead, the representational power of strong visual features alone can be fully leveraged to uncover anomalies with minimal data.
Comparison of Projector Designs initial exploration of projector archi- tectures, we compared two widely used modules, MLP layers and ViT attention blocks, under different layer configura- tions in the 1-shot setting MVTec-AD. As shown in Table 5, ViT consistently out- performs MIP with the same depth. This advantage arises from the self-attention mechanism, which enables richer patch- wise interactions and improves the detec-
Table 5: 1-shot performance comparison of different archi- tectures of the manifold projector on MVTec-AD.
Type
Depth
I-AUROC
AUPR
P-AUROC
PRO
95.5
97.2
96.6
92.6
96.1
97.9
96.8
92.8
95.8
97.3
96.8
92.5
4
93.5
96.2
95.7
91.2
MLP
6
92.1
95.4
95.2
90.7
8
87.8
91.9
91.2
82.1
tion of fine-grained anomalies. However, simply increasing the network depth does not necessarily yield further gains and instead adds computational overhead. Guided by these observations, we adopt 6-layer self-attention block in our final design, as it offers a favorable trade-off between accuracy and computational cost.
Top-K Selection The optimal K varies across datasets, as the size and distribution of abnormal regions differ among various datasets (Sträter al., 2024). We evaluate the effect different values of K in the Top-K selection mechanism indicates that increasing initially improves performance, with the best results observed at K = 10 for MVTec-AD and K 6 for VisA. Beyond these points, performance gradually declines.
MVTec-AD and VisA in 1-shot setting. Table 6
Table 6: Comparison of performance with DINOv3 backbone and different K of Top-K in 1-shot setting on MVTec-AD and VisA. We color the best
Dataset
Metric
2
16
20
I-AUROC
94.82
95.41
95.89
95.96
96.09
95.91
95.86
95.74
MVTec-A
AUPR
97.10
97.47
97.78
97.80
97.92
97.81
97.78
97.75
I-AUROC
91.64
92.26
92.63
92.64
92.44
92.28
92.17
91.96
VisA
AUPR
90.91
91.39
91.56
91.98
91.56
91.55
91.53
91.41
RELATED WORK
Multi-class Anomaly Detection Many existing methods follow one-class-one-model (Yi & Yoon, 2020; Cohen & Hoshen, 2020; Defard et al., 2021; Roth et al., 2022; Rudolph et al., 2021; Za- vrtanik al., 2021; 2022: Deng Li, 2022: Tien et al., 2023; Iqbal al., 2024; Zhang al., 2024; Li ei al., 2021; Hu et al., 2024; Zhang et al., 2023) paradigm. necessitating separate model for each unseen categories.
class, which limits generalization (Huang et al., 2022: 2024; He et al., 2024a) and multi-class-one-mnn monel approaches (You et al., 2022; Zhao, 2023; Lu al., 2023; He et al., 2024b) have been proposed. In this work, we focus primarily on multi-class settings. UniAD (You et al., 2022) presents unified framework capable of handling multiple classes simultaneously, while AVQ-Trans (Lu et al., 2023) employs vector quantization to leam structured latent space that enhances anomaly detection within each category and preserves cross-category discrimination. DiAD (Zhang et al., 2025a) introduces a diffusion based method for multi-class anomaly detection. Notably, these methods typically require large amount of training
overcome this limitation, general models

---

Published as a conference paper at ICLR 2026
data, which is impractical in real industrial scenarios since collecting and labeling samples is chal- lenging and expensive. Therefore, we aim to develop an approach for multi-class anomaly detection with minimal training effort.
Few-shot Anomaly Detection Few-shot anomaly detection aims to detect and localize anomalies using minimal training samples per category (Fang et al., 2023; Duan et al., 2023; Damm et al., 2024; Zhu & Pang. 2024; Huang et al., 2022; 2024; Jeong et al., 2023; Gu et al., 2024b; Yan et al., 2024; Lv et al., 2025). For example, RegAD (Huang al., 2022) introduces spatial transformation consis- tency to ensure robustness under few-shot conditions, while FastRecon (Fang et al., 2023) leverages an efficient feature reconstruction approach for rapid adaptation to unseen anomaly types. Another line of research exploits textual information to support few-shot anomaly detection; methods such as Ano (Gu et al., 2024b), InCTRL (Zhu & Pang, 2024), WinCLIP (Jcong et al., 2023), and PromptAD (Li et al., 2024) employ vision-language models address the few-shot detection prob- lem. Moreover, recent work on the multi-class setting, such as AnomalySD (Yan et al., 2024) and IPAAD (Lv al., 2025), has proposed unified models that handle multiple categories within a sin- gle framework while achieving competitive performance. LogSAD (Zhang et al., 2025b) leverages GPT-4V (Achiam al., 2023) generate textual reasoning rules per category and combines patch- level and set-level detections with score calibration, achieving strong performance in a training- -ree manner. However, relying on textual inputs or support images during inference remains impractical in many real-world applications.
Foundation Models for Visual Understanding Foundation models have driven major advances in visual understanding (Zhou et al., 2022; Gu et al., 2024a; Liu al., 2024). content genera- tion (Zhai et al., 2024; 2023a; Karras et al., 2023), rision-based planning (Zhou et al., 2025; Kim al., 2025), geometry estimation (Chen al., 2024; Wang al., 2025; Edstedt al., 2024), and future prediction (Karypidis et al., 2025; Baldassarre et al., 2025). Early supervised pretraining on large-scale datasets such as ImageNet (Deng et al., 2009) with convolutional networks (He et al., 2016; Zagoruyko & Komodakis, 2016) established strong transferable features, while self- supervised contrastive learning, such as SimCLR (Chen et al., 2020), MoCo (He al., 2020), further improved label-free representation learning. Vision Transformers, particularly the DINO series (Caron et al., 2021: Oquab et al., 2024; Siméoni et al., 2025), enriched semantic capture, and masked image modeling (He et al., 2022; Bao et al., 2022; Assran et al., 2023) showed that predicting masked tokens yields highly transferable embeddings. Vision-language models such as CLIP (Radford et al., 2021) and SigLIP (Zhai et al., 2023b) extend this by grounding visual fea- tures in text. These pre-trained representations form well-structured manifolds that benefit anomaly detection, where distinguishing normal from abnormal patterns hinges the underlying feature space (Heckler et al., 2023). Inspired particularly by I-JEPA (Assran et al., 2023), which predicts masked tokens directly in latent space, we build on strong embedding structures and introduce projector to map mixed anomalous and normal feature tokens back to the normal manifold.
5 CONCLUSION
In this work, we presented a novel few-shot anomaly detection approach, FOUNDAD, leveraging the pure visual embeddings from foundation encoders without text-prompt assistance. By uncovering the direct correlation between embedding distance and anomaly amount, we designed a lightweight nonlinear feature projector that efficiently maps features onto the normal image manifold. This method effectively addresses the challenge posed by limited anomaly examples, achieving robust detection with minimal training data. Extensive evaluations across multiple foundational visual encoders demonstrated that our method surpasses current few-shot anomaly detection methods. Our findings emphasize the potential of foundation visual encoders for anomaly detection, advocating broader exploration and application in industrial inspection scenarios. In future work, plan to comprehensively investigate how diverse anomaly synthesis strategies applied before visual feature extraction affect FOUNDAD'S 's overall learning performance.
10

---

Published as a conference paper at ICLR 2026
Reproducibility Statement We have made extensive efforts to ensure the reproducibility of our work. The architecture details of our framework,, including the encoders and the non-linear projector, described in section 2. Training settings, hyperparameters, and evaluation protocols provided in section 3 and Supplementary Material A. All datasets used are publicly available. We expose some typical failure cases in Supplementary Material B provide research insights. Additional qualitative and quantitative results, as well as studies about the Top-K selection on each dataset, are included in Supplementary Material C. Finally, provide our code and instructions https: //github. ccm/ ymwllgy///yyi... / FoundAD.
LLM Usage We used ChatGPT solely as a writing assistant for grammar checking and language polishing of the manuscript. All research ideas, experiments, analyses, and conclusions were con- ceived and conducted entirely by the authors. ChatGPT and other LLMs were not used for obtaining ideas, for technical content generation, for experimental design.
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Tige Akkaya, Florencia Iconi Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report, 2023. URL https: //axxiv org/ abs/ 2203. 08774. 10
Mahmoud Assran, Quentin Duval, Ishan Misra, Piotr Bojanowski, Pascal Vincent, Michael Rabbat, Yann Le- Cun, and Nicolas Ballas. Self-supervised learning from images with joint-embedding predictive architec- ture. In CVPR, 2023. 2, 10,
Federico Baldassarre, Mare Szafraniec, Basile Terver, Vasil Khalidov, Francisco Massa, Yann LeCun, Patrick Labatut, Maximilian Seitzer, and Piotr Bojanowski. Back to the features: Dino foundation for video world models, 2025. URL https: aaaaaiiivvv... org/ abss2500 19468. 10
Hangho Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre-training of image transformers. In ICLR, 2022. 10
Kilian Batzner, Lars Heckler, Rebecca König. millisecond-lewe latencics. CVPR, 2024.
Efficientad:
Accurate visual anomaly detection
Paul Bergmann, Michael Fauser, David Sattlegger. and Carsten Steger. Mvtec ad-a comprehensive real-world dataset for unsupervised anomaly detection. In CVPR, 2019. 1,4,5
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin, Emerging properties in self-supervised vision transformers. In CVPR, 2021. 1, 10
Ting Chen, Simon Korblithh Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In /CML, 2020. 2, 10
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In CVPR, 2021. 2
Yamei Chen, Yan Di, Guangyao Zhai, Fabian Manhardt, Chenyangguang Zhang, Ruida Zhang, Federico Tombari, Nassir Navab, and Benjamin Busam. Secondpose: Se (3)-consistent dual-stream feature fusion for category-level pose estimation. In CVPR, 2024. 10
Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing tex- tures in the wild. In CVPR, 2014. 4
N Cohen and Y Hoshen. Sub-image anomaly detection with deep pyramid correspondences, 2020. URL https: B 02357. 5,9
Simon Damm, Mike Laszkiewicz, Johannes Lederer, and Asja Fischer. Anomalydino: Boosting patch-based
few-shot anomaly detection with dinov2, 2024. URL https: /ttp:://///iiv.// org. abs 14529, 10
Thomas Defard, Aleksandr Setkov, Angelique Loesch, and Romaric Audigier. Padim: a patch distribution
modeling framework for anomaly detection and localization. In ICPR, 2021.
Hanqiu Deng and Xingyu Li. Anomaly detection via reverse distillation from one-class embedding. In CVPR, 2022.9 9
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009. 10
11

---

Published as a conference paper at ICLR 2026
Yuxuan Duan, Yan Hong, Li Niu, and Liqing Zhang, Few-shot defect image generation via defect-aware feature manipulation. In AAAI, 2023, 10
Johan Edstedt, Qiyu Sun, Georg Bökman, Märten Wadenhäck, and Michael Felsherg.
Roma: Robust dense
feature matching. In CVPR, 2024. 10
Zheng Fang, Xiaoyang Wang, Haocheng Li. Jiejie Liu, Qiugui Hu, and Jimin Xiao. Fastrecon: Few-shot industrial anomaly detection via fast feature reconstruction. In ICCV, 2023. 5, 10
Bin-Bin Gao, Yue Zhou, Jiangtao Yan, Yuezhi Cai, Weixi Zhang. Meng Wang. Jun Liu,, Yong Liu, Lei Wang. and Chengjie Wang. Adaptclip: Adapting clip for universal visual anomaly detection, 2025. URL https: // //arxiv
www.wi..rg.aaaaaeeeeeeeeaa..aaee wttg//a////eeeeeeocoeeeeeeeeeee/ /2005. 0.926. 6.
Qiao Gu, Ali Kuwajerwala, Sacha Morin, Krishna Murthy Jatavallabhula, Bipasha Sen, Aditya Agarwal, Cor- ban Rivera, William Paul, Kirsty Ellis, Rama Chellappa, et al. Conceptgraphs: Open-vocabulary 3d scene graphs for perception and planning. In ICRA, 2024a.
Zhaopeng Gu, Bingke Zhu, Guibo Zhu, Yingying Chen, Ming Tang, and Jinqiao Wang. Anomalygpt: Detecting industrial anomalies using large vision-language models. In AAAI, 2024b. 10
Haoyang Hc, Yuhu Bai, Jiangning Zhang, Qingdong He, Hongxu Chen, Zhenye Gan, Chengjie Wang, Xiangtai Li, Guanzhong Tian, and Lei Xie. Mambaad: Exploring state space models for multi-clas, unsupervised anomaly detection. In NeurlPS. 2024a. 9
Haoyang He, Jiangning Zhang, Hongxu Chen, Xuhai Chen, Zhishan Li, Xu Chen, Yabiao Wang, Chengjic Wang, and Lei Xic. A diffusion-based framework for multi-class anomaly detection. In AAAI, 2024b. 9
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In CVPR, 2020. 10
Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In CVPR, 2022. 10
Lars Heckler, Rebecca König, and Paul Bergmann. Exploring the importance of pretrained feature extractors for unsupervised anomaly detection and localization. In CVPR, 2023. 10
Teng Hu, Jiangning Zhang, Ran Yi, Yuzhen Du, Xu Chen, Liang Liu, Yabiao Wang, and Chengjie Wang. Anomalydiffusio: Few-shot anomaly image generation with diffusion model. In AAAI 2024.
Chaoqin Huang, Haoyan Guan, Aofan Jiang, Ya Zhang, Michael Spratling, and Yan-Feng Wang. Registration based few-shot anomaly detection. In ECCV, 2022. 10,
Chaoqin Huang, Haoyan Guan, Aofan Jiang, Ya Zhang, Michael Spratling, Xinchao Wang. and Yanfeng Wang. Few-shot anomaly detection via category-agnostic registration learning. IEEE Transactions on Neural Net- works and Learning Systems, 2024. 9, 10
Ehtesham lqbal, Samee Ullah Khan, Sajid Javed, Brain Moyo, Yahya Zweiri, and Yusra Abdulrahman. Multi- scale feature reconstruction network for industrial anomaly detection. Knowledye-Busee Systems, 305: 112650, 2024. 9
Jongheon Jeong, Yang Zou, Taewan Kim, Dongging Zhang, Avinash Ravichandran, and Onkar Dabeer. Win- clip: Zero-/few-shot anomaly classification and segmentation. In CVPR, 2023. 5, 8, 10
Siddharth Karamcheti, Suraj Nair, Ashwin Balakrishna, Perey Liang, Thomas Kollar, and Dorsa Sadigh. Pris- matic vlms: Investigating the design space of visually-conditioned language models. ICML, 2024.
Johanna Karras, Aleksander Holynski, Ting-Chun Wang, and Ira Kemelmaehher-Shiizemmn Dreampose: Fash-
ion image-to-video synthesis via stable diffusion. In JCCV, 2023. 10
Efstathios Karypidis, loannis Kakogeorgiou, Spyros Gidaris, and Nikos Komodakis. Dino-foresight: Looking into the future with dino. In NewrlPS, 2025. 10
Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, al. Openvla: An open-source vision-language-acciion model. CoRI,, 2025. 10
12

---

Published as a conference paper at ICLR 2026
Yann LeCun. A path towards autonomous machine intelligence version 0.9. 2, 2022-06-27, 2022. URL
https: http:///eeeeeeeeeeetteee wwwp:neettppddddddneeeee
Chun-Liang Li, Kihyuk Sohn, Jinsung Yoon, and Tomas Pfister. Cutpaste: Self-supervised learning for anomaly
detection and localization. In CVPR, 2021. 3,9
Yiting Li. Adam Goodge, Fayao Liu, and Chuan Shenn Foo. Promptad: Zero-shot anomaly detection using text prompts. In CVPR. 2024. 5, 10
Shilong Liu, Zhaoyang Zeng, Tianhe Ren, Feng Li, Hao Zhang, Jie Yang, Qing Jiang, Chunyuan Li, Jian- wei Yang, Hang Su, et al. Grounding dino: Marrying dino with grounded pre-training for open-set object
detection. In ECCV, 2024. 10
Ruiying Lu, Yulic Wu, Long Tian, Dongsheng Wang, Bo Chen, Xiyang Liu, and Ruimin Hu. Hicrarchical vector quantized transformer for multi-class unsupervised anomaly detection. In NeurlPS, 2023. 9
Wenxi Lv. Qinliang Su, and Wenchao Xu. One-for-all few-shot anomaly detection via dustance-inducee prompt learning. In ICLR. 2025. 2, 4, 5, 10
Mishra, Verk, D Fornasier, C Piciarelli, GL Foresti, et al. Vi-adl: A vision transformer network for image anomaly detection and localization. In ISIE, 2021. 4
Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V. Vo, Marc Szafraniee, Vasil Khalidov, Pierre Fer- nandez, Daniel HAZIZA, Francisco Massa, Alaacldin El-Nouby, Mido Assran, Nicolas Ballas, Wojeiech Galuba, Russell Howes, Po- Yao Huang, Shang- Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Herve Jegou, Julien Mairal, Patrick Labatut, Armand Joulin, and Piotr Bojanowski. DI- NOv2: Learning robust visual features without supervision. Transactions Machine Learning Research, 2024. ISSN 2835-8856. URL https: pestps://operreeee /pwpreeeeeeeeeeeeeeeeeeeeee net./ forum? wwwporumiddaaar id-a ESSU 6zFt. Featured Certification. 2,2,10 10
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sas- try, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In JCML, 2021. 2, 10
Karsten Roth, Latha Pemula, Joaquin Zepeda, Bernhard Schölkopf, Thomas Brox, and Peter Gehler. Towards total recall in industrial anomaly detection. In CVPR, 2022. 5, 9,
Marco Rudolph, Bastian Wandt, and Bodo Rosenhahn. Same same but differnet: Semi-supervised defect detection with normalizing flows. In WACV, 2021. 9
Oriane Siméoni, Huy V Vo, Maximilian Seitzer, Federico Baldassarre, Maxime Oquab, Cijo Jose, Vasil Khalidov, Mare Szafraniec, Seungeun Michaël Ramamonjisoa, et Dinov3, 2025. URL https:
//arxiv.crg/ abs 2200 10104. 2,
Luc PJ Sträter, Mohammadreza Salehi, Efstratios Gavves, Cees GM Snoek, and Yuki M Asano. Generalad: Anomaly detection across domains by attending to distorted features. In ECCV, 2024. 9
Tran Dinh Tien, Anh Tuan Nguyen, Nguyen Hoang Tran, Ta Due Huy, Soan Duong, Chanh D Tr Nguyen, and Steven QH Truong. Revisiting reverse distillation for anomaly detection. In CVPR, 2023. 9
Jianyuan Wang, Minghao Chen, Nikita Karaev, Andrea Vedaldi, Christian Rupprecht, and David Novotny. Vggt: Visual geometry grounded transformer. In CVPR, 2025. 10
Zhenyu Yan, Qingqing Fang, Wenxi Lv, and Qinliang Su. Anomalysd: Few-shot multi-class anomaly detection with stable diffusion model, 2024. URL https:://////.c //wxiv/a/vvvv///////////aa////i org/ abs///b///////// /albs///44 2408. 01 01960. 5,5, 10
Minghui Yang, Peng Wu, and Hui Feng. Memseg: A semi-supereised method for image surface defect detection using differences and commonalities. Engineering Applications of Artificial Intelligence, 19: 105835, 2023. 3
Jihun Yi and Sungroh Yoon. Patch svdd: Patch-level svdd for anomaly detection and segmentation. In ACCV, 2020. 9
Zhiyuan You, Lei Cui, Yujun Shen, Kai Yang, Xin Lu, Yu Zheng, and Xinyi Lc. A unified model for multi-class anomaly detection. In NeurlPS, 2022. 9
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. BMVC, 2016. 2,
Vitjan Zavrtanik, Matej Kristan, and Danijel Skočaj. Draem-a discriminatively trained reconstruction embed- ding for surface anomaly detection. In ICCV, 2021. 9
13

---

Published as a conference paper at ICLR 2026
Vitjan Zavrtanik, Matej Kristan, and Danijel Skočaj. Dsr-a dual subspace re-projection network for surface anomaly detection. In ECCV, 2022. 9
Guangyao Zhai, Evin Pinar Örnek. Shun-Chean Wu, Yan Di, Federico Tombari, Nassir Navab, and Ben- jamin Busam. Commonscenes: Generating commonsense 3d indoor scenes with scene graph diffusion. In NewrlPS, 2023a.
Guangyao Zhai, Evin Punar Örnek, Dave Zhenyu Chen, Ruotong Liao, Yan Di, Nassir Navab, Federico Tombari, and Benjamin Busam. Echoscene: Indoor scene generation via information echo over scene graph diffusion. In ECCV, 2024. 10
Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lueas Beyer. Sigmoid loss for language image pre- training. In ICCV, 2023b. 1, 2, 10
Hui Zhang, Zheng Wang. Dan Zeng, Zuxuan Wu, and Yu-Gang Jiang. Diffusionad: Norm goid-guided one-step denoising diffusion for anomaly detection. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025a. 9
Jinjin Zhang, Guodong Wang. Yizhou Jin, and Di Huang. Towards training-fre free anomaly detection with vision and language foundation models. In CVPR, 2025b. 2, 5, 10,
Ximiao Zhang, Min Xu, and Xiuzhuang Zhou. Realnet: A feature selection network with realistic synthetic anomaly for anomaly detection. In CVPR, 2024. 3,9
Xuan Zhang, Shiyu Li, Xi Li, Ping Huang. Jiulong Shan, and Ting Chen. Destseg: Segmentation guided denoising student- teacher for anomaly detection. In CVPR, 2023.
Ying Zhao. Omnial: A unified cnn framework for unsupervised anomaly localization. In CVPR, 2023. 9
Chong Zhou, Chen Change Loy, and Bo Dai. Extract free dense labels from clip. In ECCV, 2022. 10
Gaoyue Zhou, Hengkai Pan, Yann LeCun, Lerrel Pinto. Dino-wm: World models on pre-trained visual features enable zero-shot planning. In JCML, 2025. 10
Qihang Zhou, Guansong Pang, Tian, Shiho Hc, and Jiming Chen. Anomalyclip: Object-agnostic prompt learning for zero-shot anomaly detection. In ICLR, 2024. 5,
Jiawen Zhu and Guansong Pang. Toward generalist anomaly detection via in-context residual learning with few-shot sample prompts. In CVPR, 2024. 5, 6, 10
Yang Zou, Jongheon Jeong, Latha Pemula, Dongqing Zhang, and Onkar Dabeer. Spot-the-differenee self- supervised pre-training for anomaly detection and segmentation. In ECCV, 2022. 1,4
14

---

Published as a conference paper at ICLR 2026
Foundation Visual Encoders Are Secretly Few-Shot Anomaly Detectors Supplementary Material
In this material, we provide more details about the ablation of foundation encoders, illustrations of some typical failure cases, and additional quantitative and qualitative results.
A EXPERIMENTAL DETAIL FOR ENCODER ABLATION
We performed experiments with various encoders under a I-shot setting on MVTec-AD. To main- tain consistency with the default encoder DINOv3 of FOUNDAD, use the same sampled training instances across different encoders. The projector was uniformly maintained a depth of 6, and the learning rate was consistently set to 0.001 for all cases.
To ensure a fair comparison, we use ViT-Base for DINOv3, DINOv2, DINO, SigLIP, and CLIP, all in the third-to-last layer. We conducted the experiment for DINOSigLIP using ViT-L due to availability. However, since different encoders require varying default image input sizes and patch sizes, the input patch numbers for the projector was adjusted accordingly: (1) For DINOv2 and
DINO VIT-B, the input images were resized to 518, with patch size 14. (2) For DINOv3 and SigLIP VIT-B, the input images were resized to 512, with patch size of 16. (3) For CLIP VIT-B, the default image size was 224 with patch size of 16. (4) For DINOSigLIP, we employed the implementation from Prismatic VLMs (Karamcheti al., 2024) ', which combines DINOv2 ViT- and SigLIP ViT-SO embeddings with linear projection at an input resolution of 384. (5) For WideResNet, adopted the methodology identical PatchCore (Roth et al., 2022).
B FAILURE CASES
While FOUNDAD achieves generally strong performance in both image classification and anomaly localization, can still be challenged under certain conditions. Typical failure cases are shown in Figure 7. In Figure (a), the test screw appears in a different orientation from the training sam- plcs. Without a spatial transformation mechanism to align features as adopted in RegAD (Huang al,, 2022), FOUNDAD fails to recognize the anomaly. Similarly, transistor with missing pins can be localized, but precise segmentation is unsuccessful. We attribute this to two factors: (i) the pro- jector is trained solely on normal data and therefore lacks priors about the morphology of potential anomalies; and (ii) the projector, inspired by I-JEPA (Assran et al., 2023), is non non-generative, limiting its ability to complete anomaly masks. In Figure (b), the candle exhibits severe appearance vari- ations caused by exposure. The anomaly becomes nearly indistinguishable from the background, hindering representation learning and degrading detection quality. Moreover, FOUNDAD occasion- ally misclassifies background artifacts anomalies. For example, previously unseen stains the platform of Pch2 are incorrectly highlighted during inference.
Abnormal
Ground Truth
FOUNDAD
Abnormal
Ground Truth
FOUNDAD
Candlc
Screw
Transistor
Peb2
(a) AV
(b) VisA
Figure Typical failure cases of FOUNDAD.
http:::///itthbo.cmmmmmmiii thub. htppiiimmmmpppiii smat civvls

---

Published as a conference paper at ICLR 2026
C
ADDITIONAL RESULTS
Table 7: Results on MVTec-AD and VisA under multiple seeds.
MVTec-AD
VisA
Setting
Seed
LAUROC
AUPR
P-AUROC
PRO
L-UROOC
AUPR
P-AURO:
PRO
1
96.0
97.8
96.9
93.1
92.5
91.5
99.7
97.8
2
96.0
97.6
96.9
92.8
91.9
91.9
99.7
98.2
1-shot
3
96.4
98.2
96.5
92.6
93.4
92.7
99.7
98.1
Avg
96.1
97.9
96.8
92.8
92.6
92.0
99.7
98.0
1
96.8
98.3
97.0
93.3
93.9
93.2
99.7
98.1
2
98.2
97.2
93.7
93.5
93.3
99.7
98.3
2-shot
3
96.6
98.3
96.9
92.9
94.0
93.3
98.2
Avg
96.8
98.3
97.0
93.3
93.8
93.3
98.2
1
97.2
97.2
93.5
93.4
2
97.2
98.6
97.3
93.7
94.5
94.6
99.7
98.4
4-shot
3
97.0
98.5
97.1
93.4
94.6
93.9
99.7
98.6
Avg.
97.1
98.6
97.2
93.5
94.4
94.0
99.7
98.4
C.I MULTIPLE RUN RESULTS
To demonstrate the robustness and reliability of FOUNDAD, we repeated the experiments in three random seeds on the MVTec-AD dataset. The detailed experimental results are summarized in Ta- ble 7. These results indicate that FOUNDAD consistently maintains strong generalization capability and stable anomaly detection performance even under limited data conditions.
All four metries consistently improve the number of shots increases, particularly MVTec-AD, indicating that our method can effectively leverage additional supervision to enhance anomaly de- tection performance. As shown in Figure 8, the standard deviations are generally small across runs, demonstrating strong stability and robustness. On VisA, interestingly, the P-AUROC remains nearly saturated 99.7 across all settings, showing that the method performs highly reliably at the pixel level. T-AUROC and AUPR exhibit steeper gains on MVTec-AD, likely due to its more diverse visual patterns, where additional examples provide more substantial benefit, whereas VisA benefits from more homogeneous object categories. Although the PRO metric shows slight fluctuations, it consis- tently stays high, underscoring the method's effectiveness in localizing anomalies with pixel-Ievel precision. Overall, the results demonstrate our method's 's robustness, consistency, and scalability in few-shot settings, making it well-suited for real-world industrial scenarios with limited annotations.
(a) MV
(b) VisA
100
98
97
Score
90
94
93
03
92
Shot
Shot
Figure 8: Mean and standard deviation of four evaluation metrics across 1-, 2-, and 4-shot settings MVTec-
AD VisA.
C.2 ADDITIONAL QUALITATIVE COMPARISONS
We provide several visual comparisons against LogSAD (Zhang et al., 2025b) in Figure 9. It clearly shows that FOUNDAD localizes anomaly precisely, while producing significantly less noise.
2

---

Published as a conference paper at ICLR 2026
Abnormal
Ground Truth
LogSAD
FOUNDAD
Pill
Capsule
500
Capsules
Cashew
Fryum
Peb1
Peb2
Figure 9: Visual comparisons with LogSAD (Zhang al., 2025b).
C.3 CLASS-WISE QUANTITATIVE RESULTS
We report the class-wise quantitative results of FOUNDAD with DINOv3 under 1, 2, and 4 shot settings on MVTec-AD and VisA detail in Table Table

---

Published as a conference paper at ICLR 2026
Table 8: Results on MV for I-shot, 2-shot, 4-shot. Metrics include I-AUROC (%), AUPR (%), and pixel-level P-AUROC (9)), PRO (96).
I-shot
2-hhot
4-shot
FAUROO
Bottle
100.0
100.0
98.6
96.2
100.0
100.0
98.6
95.3
100.0
100.0
98.6
Cable
89.6
94.]
91.77
89.2
92.3
96.3
95.0
89.9
92.4
96.1
91.7
$9.6
Capsule
89.5
97.5
98.6
94.3
89.5
97.6
98.8
94.9
90.1
92.7
98.8
94.3
Carpet
100.0
1000
99.5
98.3
100.0
100.0
99.4
98.3
1000
100.0
Hazeinut
99.3
99.7
99.5
93.0
99.9
99.9
99.5
93.2
99.8
99.8
Leuther
180.0
100.
99.4
98.7
100,0
100.0
99.4
98.7
100.0
100.0
99
98.4
Metal not
99.8
100.0
92.5
91.8
99.9
100.0
94.3
93.3
100.0
100.0
96.3
95.3
Pill
97.7
9:1.5
97.0
97.8
99.6
91.6
97.1
98.1
99.7
95.0
96.7
Tile
180.0
97.2
95A
TOULO
97.3
100.0
Toothhruhh
99.8
99.9
99.2
94,1
99.2
99.7
99.2
95.2
100.0
100.0
9944
95.6
Transistoe
86.3
$5.0
85.0
63.3
89.2
86.6
86.6
63.8
92.5
90.0
87.4
66.7
Wood
95.4
97.9
16.2
96.0
96.9
98.7
96.2
95.9
95.2
98.6
96.2
96.1
Zipper
Average
96.1
96.8
92.8
96.8
98.6
Table 9: Results of FOUNDAD on VisA for 1-shot, 2-shot, and 4-shot. Metrics include I L-AUROC (%), AUPR (%) and pixel-level P P-ARROC (%)) PRO (%)
Class
1-shot
2-4hot
4-thot
LAUROC
AUPR
P-AUROC
PRO
F-AUROC
AUPR
PAUROOC
PRO
F-UROOC
AUPR
P-AROOC
PRO
Cardlee
94.4
93.2
19.5
95.4
94.7
93.3
99.5
98.7
94.3
94.1
99.5
98.4
Capsules
98.9
99.3
99.8
99.0
99.4
99.8
99.0
99.1
99.1
99.8
99.0
Chewinggum
098.0
98.5
99.3
99.9
08.5
99.8
Fryum
96.8
98.5
99.8
93.0
96.8
98.5
99.8
98.1
97.2
98.6
99.7
98.1
Macaromil
93.1
92.2
99.5
98.0
93.8
92.9
99.5
98. 3
91.0
93.0
99.5
98.1
Macaroni2
12.3
64.9
99.9
99.8
75.2
68.0
99.9
99.8
71.2
71.1
99.9
99.9
Pcb1
94.1
90.8
95.3
99.5
98.5
Pah2
02.6
90.5
99.9
Pebd
96.6
94.8
99.7
93.2
97.2
96.6
99.7
94.7
91.5
96.5
99.7
95.2
Prye.fryum
05.0
97.5
09.7
96.9
96.1
98.0
99.7
97.0
96.9
98.5
99.7
96.8
Average
92.6
92.0
99.7
98.0
93.8
93.3
99.7
98.2
94.4
94.0
99.7
98.4
C.4 CLASS- WISE COMPARISON TO OTHER METHODS
The class-wise comparisons presented with I-AUROC in Table 10-Table 11, AUPR in Table 12- Table 13, P-AUROC in Table 14-Table 15, and PRO Table 16-Table 17.
4

---

Published as a conference paper at ICLR 2026
Table 10: I-AUROC (%) results of MVTec-AD for 1-shot, 2-shot, and 4-shot.
Class
WinCLIP
PromptAD
HIPAD
Ours
WinCLIP
PromptAD
HPAD
Ours
WinCLIP
PromptAD
HPAD
Ours
Bortle
98.9
98.6
99.7
100.0
99.2
100.0
99.8
100.0
99.2
99.0
99.1
99.1
Cable
75.0
83.6
92.8
89.6
83.9
87.2
92.1
92.3
82.3
55.7
95.4
92.4
Capsule
75.5
64.2
80.5
89.5
65.5
65.3
91.8
89.6
80.1
93.4
94.5
90.1
100.0
100.0
100.0
100.0
Hazelnut
98.4
99.3
95.2
98.8
98.5
99.0
98.5
Leuther
100.0
100.0
180.0
100.0
100.0
100.0
100.0
180.0
100.0
100.0
180.0
100.0
Meral nut
98.0
97.6
99.4
99.8
97.8
96.2
99.7
99,9
98.9
100.0
99.9
100.0
Pill
88.9
$7.9
97.7
88,
96.0
97.8
91.1
90.4
96.6
98.1
Screw
74.0
84.8
$4.2
82.1
100.0
95.1
980.
92.5
Transistor
85.5
73.7
91.4
86.3
85.4
81.2
90.4
89.2
85.6
94.4
91.2
92.5
Wood
98.7
98.6
99.4
95.4
98.9
98.9
99.2
96.9
98.9
99.2
99.5
95.2
Zipper
94.9
95.3
89.4
99.8
97.2
93.5
95.5
99.8
97.0
955.8
96.0
99.9
Meun
92.8
86.3
96.2
96.1
89.2
95.6
90.6
96.1
97.1
Table 11: I-AUROC (%) results of VisA for I-shot, 2-shot, and 4-shot.
WirCLIP
PrompthD
PromptAD
PromptAD
94.4
95.5
94.7
Capoales
73.3
$3.2
88.9
98.9
81.6
78.7
90..1
99.0
81.0
81.7
90.3
99.1
Cadhew
93.9
$8.9
85.6
97.4
92.6
89.6
86.7
97.0
92.6
83.0
91.2
97.6
Chewinggum
97.9
97.3
97.7
98.0
98.1
97.1
97.8
98.3
98.4
98.1
98.0
98.5
Fryum
92.8
$8.0
89.9
96.8
85.7
92.7
95.8
91.6
90.6
93.3
Macaronil
84.7
88.4
76.1
83.5
Pch2
53.4
77.9
72.5
91.6
75.2
93.9
59.4
81.1
75.5
Peb3
64.9
79.9
71.8
$2.0
67.7
71.7
70.7
$7.8
65
87.1
74.7
90.3
Pehd
72.1
96.5
82.9
96.6
73.6
96.0
84.4
97.2
70.7
85.3
88.7
97.5
Pspeltyum
982
98.9
99.8
95.0
99,9
96.1
98.4
99.3
99.8
Mean
83.1
85.4
92.6
86.7
85.7
88.3
Table 12: AUPR (%) results of MVTee-AD for 1-shot, 2-shot, and 4-shot.
PromptAD
Ours
PromptAD
PromptAD
Botll
99.7
99.6
99.9
100.0
99.8
100.0
100.0
100.0
99.3
99.7
99.7
100.0
Cable
87.1
91.2
96.1
94.1
90.5
92.8
95.8
96.3
90.0
93.6
97.5
96.4
Capsule
93.9
85.7
95.4
97.3
88.3
85.5
98.3
97.6
94.8
98.3
98.9
91.7
Carpet
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Grid
98.6
Leather
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Meral juu
99.6
99.1
99.9
100.1)
99.5
98.3
99.9
100.0
99.8
100.0
100.0
100.0
Pill
97.5
96.8
99.4
99.6
98.3
97.1
99.3
99.6
98.2
97.7
99.4
99.7
Screw
95.1
91.19
87.0
94.3
93.3
93.5
92.6
95.2
94.0
93.7
92.0
95.7
Tile
100.0
99.9
Toothbruch
Transistor
80.8
62.2
85.0
81.0
77.2
88.3
86.6
82.6
92.2
89.2
Wood
99.5
99.5
99.8
97.9
99.7
99.6
99.8
98.7
99.7
99.7
99.9
98.6
Zipper
98.5
98.8
95.6
99.9
99.2
98.2
98.7
99.9
99.2
98.9
98.8
100.0
Menn
96.5
93.4
97.2
97.9
96.3
94.8
97.9
98.3
97.0
96.5
98.1
98.6
Table 13: AUPR (%) results of VisA for 1-shot, 2-shot, and 4-shot.
1-4hot
2-shot PromptAD
4-chot
WinCLIP
PromptAD
I1PAD
WinCLIIP
IIPAD
WinCLIPP
PrompAA
H1PAD
Capsules
87.0
90.0
91.7
99.3
$6.7
81,9
99.1
90.0
89.0
96,0
Cashew
97.4
95.0
95.7
98.6
96.7
95.1
95.2
985.5
96.3
94.7
96.00
98.1
Chowinggom
99.1
95.9
90.1
90.1
99.3
95.8
99.2
90.3
99
99.3
99.3
90.3
Fryum
96.9
94.6
96.3
98.5
95.4
93.9
96.8
98.5
96
95.0
97.3
98.6
Macaronil
82.8
89.7
89.3
92.2
57.2
90.7
92.9
87.4
91.1
91.2
93.0
Macaroni2
77.4
70.2
73.6
92.1
Pchs
66.2
$1.6
75.2
84.7
67.3
73.5
74.5
90.0
64.6
$3.0
74.6
91.6
Publ
73.8
96.1
80.9
94.8
70.2
94.8
81.7
96.6
73.5
83.6
84.5
96.5
Pipefryum
99.2
99.6
99.9
97.5
99.3
99.7
100
98.0
99.3
99.7
99.9
98.5
Mean
85.1
R3.2
87.5
92.0
84.9
87.8
88.6
93.3
86
88.8
89.6
94.0
5

---

Published as conference paper at ICLR 2026
Table 14: P-AUROC (%) results of MVTec-AD for I-shot, 2-shot, and 4-shot.
1-shot
2-shot
4-shot
Class
WinCLIP
PromptAD
WinCLIP
PromptAD
WinCLIP
PromptAD
Bottle
95.1
94.5
98.4
98.6
95.5
95.9
98.6
98.6
95.2
96.9
98.5
98.6
Cable
74.6
76.8
94,9
94.7
76.4
$0.7
95.3
95.0
77.1
83.7
96.4
94.7
Capsule
95.6
94.6
97.2
98.6
94.7
94.8
97.5
98.8
96.3
97.7
97.2
98.8
Carpet
99.1
99.5
99.5
99.1
99.2
99.5
99.4
99.1
99.2
99.5
99.5
Grid
95.1
96.8
96.6
99.2
96.3
96.0
96.3
99.1
96.0
96.8
98.1
99.3
Hazclnut
98.6
96.9
98.4
99.5
98.7
98.0
98.7
99.5
95.7
98.1
98.8
99.5
Leather
Motal mut
77.9
94.2
91.1
92.5
76.1
91.8
95.1
91,3
79.5
93.2
91.8
96.3
Pill
93.9
92.3
96.6
94.5
94,1
94,3
97.0
94.6
94.4
95.1
96.9
95.0
Screw
96.7
95.7
96.0
98.4
97.0
96.5
98.7
96.5
97.2
96.9
98.7
96.9
97.4
Toothbrush
95.1
99.0
97.4
99.2
84.5
99.2
97.4
99.2
96.8
99.2
97.9
99.4
Trancistor
85.1
75.5
86.6
85.0
95.3
84.4
88.4
86.6
84.4
87.5
89.6
87.4
Wood
Zapper
92.9
97.6
96.0
99.0
92.4
97.3
96.7
99.0
92.9
96.9
96.7
Mean
92.4
91.8
96.4
96.8
92.4
92.2
96.7
97.0
92.9
92.9
97.0
97.2
Table 15: P-AUROC (%) results of VisA for 1-shot, 2-shot, and 4-shot
Class
I-shot
2-hhot
4-shol
WinCLIP
PromptAD
HPAD
Ours
WinCLIP
PromplAD
IPAD
Ours
WinCLIP
PrompIAD
IPAD
Ours
Candle
93.8
98.5
99.5
94.7
97.7
98.5
99.6
95.0
97.7
98.6
99.5
Capsules
V1.2
97.1
99.8
97.2
97.3
99.8
97.4
99.8
Cashew
94.6
97.9
97.6
99.5
95.3
97.8
97.1
99.6
94.7
97.9
97.5
99.6
Chewinggum
98.9
99.2
99.6
99.9
98.9
99.0
99.5
99.9
98.9
99.1
99.5
99.8
Fryum
95.1
95.6
96.2
95.6
95.8
96.1
99.3
95.4
96.0
95.8
99.7
Macaronil
Macaroni2
94.0
95.6
96.6
99.9
96.1
96.9
99.9
93.8
98.1
96.9
99.9
Pebl
94.1
96.9
98.5
99.5
94.6
98.1
96.5
99.5
94.7
98.8
98.7
99.6
Peb2
92.4
91.0
91.6
93.1
95.1
96.8
99.6
93.3
95.6
96.5
99.7
144.2
V5.2
99
96.8
96.6
99.7
95.6
96.9
97.2
99.7
Pipefryum
97.9
98.6
98.3
99.7
97.8
98.8
98.5
99.7
97.8
98.9
98.5
99.7
Mean
94.6
96.3
96.9
99.7
95.1
96.9
97.2
99.7
95.2
97.2
97.4
99.7
Table 16: PRO (%) results of MVTec-AD for 1-shot, 2-shot, and 4-shot.
Class
1-shot
2-shot
4-shot
WinCLIP
PromptAD
IIPAD
Ours
WinCLIPP
PromptAD
IPPAD
Ours
WinCLIP
PromptAD
IPPD
Ours
Cable
55.9
70.4
86.7
89.2
62.1
71.2
89.5
89.9
61.5
75.8
91.2
89.6
Capsule
89.0
81.2
91.3
94.3
84.2
$2.0
92.6
94.9
$8.9
90.7
83.9
94.8
96.4
98.1
98.2
85.3
91.9
88.
96.
88,
89.2
87.7
96.6
36.8
91,9
91.3
96.8
Hazelnut
92.5
90.9
93.8
93.01
93.1
93.6
94.6
93.2
92.4
95.3
95.8
93.4
Leather
98.2
98.3
98.7
98.7
98.8
98.5
98.7
95.2
97.8
98.6
98.1
77.0
Pill
88.9
90.1
94.8
97.0
89.6
93.3
94,1
97.1
39.9
94,6
95.6
96.7
Screw
87.0
83.9
85.3
92.6
S8.1
84.5
85.8
92.8
86.6
89.1
87.5
93.3
Boothbuush
86.5
94..1
93.1
95.2
92.3
Transistor
63.5
59.4
67.4
63.3
62.8
66.0
68.6
63.8
62.6
69.4
71.2
65.7
Wood
86.9
92.8
94.2
96.0
87.8
93.4
94,6
95.9
88.3
93.1
94.7
96.1
Zipper
Moan
83.5
83.6
89.8
92.8
83.9
84.3
90.3
93.3
84.4
84.7
91.2
93.5
Table 17: PRO (9) results of VisA for 1-shot, 2-shot, and 4-shot.
Class
I-shot
WinCLIPP
PromptAD
HPAD)
Ours
WinCLIP
PromptAI)
HIPAD
Ours
WinCLIP
PromplAD
HPAD
Ours
Candle
89.6
V2.3
95.0
95.4
91.22
92.3
95.3
98.
90.5
92.6
95.4
98.4
Capsales
62.1
82.7
83.6
82.1
83.9
77.0
85.2
99.0
Cashow
87.6
89.9
92.9
95.8
86.7
88.1
93.0
98.5
83.3
92.8
98.5
Chewinggum
N2.7
84.9
92.5
99.0)
K5.01
84.1
93.4
99
82.7
83.2
93.7
98.9
Fryum
87.5
81.9
87.7
98.0
$7.8
80.8
S5.1
98.2
88.7
$1.9
89.2
98.1
Macaronil
85.6
Macaroni2
83.7
86.6
85.2
86.3
79%
91.2
37.1
99.9
Pebl
68.8
87.9
$1.3
98.1
70.2
86.5
85.1
98.2
70.5
$7.1
85.6
98.5
Peb2
73.6
73.4
77.3
97.6
74,0
76.8
77.8
97.6
74.1
77.9
77.4
98.0
79.5
Pebl
79.9
76.7
83.7
93.2
82.4
83.7
84.3
94.7
83.8
$2.0
87.3
95.2
Prye.fryum
95.7
96.2
97.2
96.9
95.7
96.9
97.1
97.0
95.8
96.7
97.1
96.8
Mean
80.9
82.2
87.3
98.0
81.8
85.2
87.9
98.2
82.1
84.7
88.3
98.4

---

Published as a conference paper at ICLR 2026
C.5 CLASS- WISE QUALITATIVE RESULTS
The class-wise qualitative results of our method in 1-shot setting on MVTec-AD and VisA are shown in Figure 10, Figure 11, Figure 12, and Figure 13. We show each training sample in the first column.
Normal (Training)
Abnormal (Testing)
Ground Truth
FOUNDAD
Bottle
Cahle
Capsule
500
500
Carpet
Grid
Hazelmut
Leather
Figure 10: More Qualitative 1-shot Results on MVTec-AD (i).

---

Published as a conference paper at ICLR 2026
Normal (Training) Abnormal (Testing)
Ground Truth
FOUNDAD
Metal Nut
Pill
Screw
Tile
Toothbrush
Transistor
Wood
Zipper
Figure More Qualitative I-shot Results on MV (ii).
8

---

Published as a conference paper at ICLR 2026
Normal (Training)
Abnormal (Testing)
Ground Truth
FOUNDAD
Candle
Capsules
Cashew
Chewinggum
Fryum
Macaronil
'
Figure 12: More Qualitative 1-shot Results on VisA (i).
9

---

Published as a conference paper at ICLR 2026
Normal (Training)
Abnormal (Testing)
Ground Truth
FOUNDAD
Macaroni2
Peb1
1921
X
Peb2
Peb3
Peb4
Pipe Fryum
Figure 13: More Qualitative 1-shot Results on VisA (ii).
10


Reviews:
[{"review_id": "6SFgkZLeyX", "reviewer": "Reviewer_BLKp", "summary": "This paper proposes FOUNDAD, a lightweight few-shot anomaly detection method leveraging pre-trained foundation visual encoders like DINOv3 without text prompts. It introduces a nonlinear manifold projector that maps image embeddings onto a natural image manifold, enabling anomaly localization using only few normal samples. Experiments on MVTec-AD and VisA datasets show FOUNDAD achieves state-of-the-art performance with fewer parameters than competing methods.", "questions": "I encourage the authors to address the following issues in the rebuttal and I would adjust the rating based on the results.\n\n- Please provide more details of training procedure and evaluate how the training procedure may affect the results.\n\n- Additional datasets beyond MVTec and VisA are necessary to demonstrate the effectiveness.\n\n- Please compare with original CutPaste with the same foundation model as backbone.\n\n- More evaluations under single-class setting is necessary.", "limitations": "", "rating": 4, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The proposed nonlinear manifold projector is simple yet effective, requiring minimal parameters and training, while achieving state-of-the-art few-shot anomaly detection performance.\n\n- Evaluations across few-shot settings (1, 2, 4) demonstrate efficacy of the method.", "weaknesses": "- The idea of using latent feature distances for anomaly detection resembles prior projection or reconstruction-based methods. In particular, projecting anomaly feature back into normal manifold is a long established idea for anomaly detection, e.g. GAN or AutoEncoder based methods.\n\n- The details of projector training is missing. For example, the number of training epochs, how to generate training data, etc. These are very important information because it remains elusive how the projector can be trained with a single image (1-shot). Moreover, the number of training epochs/iterations also reveal some key insights into the reason why the model is effective.\n\n- The reliance on CutPaste-like synthesis might limit realism and generalization to complex industrial defects not represented by structural cut-paste anomalies. Although the performance on MVTec and VisA demonstrate the effectiveness, evaluation on more challenging datasets may better reveal the effectiveness.\n\n- CutPaste augmentation is a very important component for this method. The original CutPaste work directly trained a classification model differentiating good from cut paste augmented pseudo defects. Therefore, a comparison with the original CutPaste method is essential to demonstrate the effectiveness. Importantly, the original CutPaste should enjoy the same foundation model as backbone.\n\n- The proposed method benefits from the multi-class setting due to more data available for training the projector. It will further improve the significance if single-class setting is evaluated.\n\n- Only two industrial datasets (MVTec-AD, VisA) are used, thus limiting the significance of conclusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CSXedLyJSA", "reviewer": "Reviewer_vtuY", "summary": "FOUNDAD introduces a simple yet effective few-shot anomaly detection framework using frozen foundation encoders and a lightweight projector trained in latent space. The approach achieves strong results on standard industrial benchmarks with minimal supervision, outperforming more complex baselines. Its simplicity, efficiency, and robustness in multi-class settings make it attractive for practical deployment. While some limitations remain in generalization and synthetic anomaly reliance, the contribution is clear.", "questions": "1. Have you considered stronger augmentation strategies or geometric alignment (e.g., from RegAD) to improve generalization to rotated or appearance-shifted anomalies?\n2. Can you clarify the few-shot protocol? Are normal samples provided per class, or pooled globally?\n3. Did you experiment with partially fine-tuning the encoder instead of freezing it entirely?\n4. How sensitive is performance to the CutPaste threshold or other synthesis hyperparameters?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper proposes FOUNDAD, a simple yet effective framework for few-shot anomaly detection using frozen foundation encoders and a lightweight projector trained in latent space. The core idea is that pre-trained encoders already capture a natural image manifold, and deviations from it can indicate anomalies. This intuition is clearly demonstrated both conceptually and empirically.\n\nThe method is efficient,requiring significantly fewer parameters than recent baselines, yet achieves competitive or superior results across multiple benchmarks (MVTec-AD, VisA), especially in the low-shot regime. FOUNDAD also operates without text prompts or heavy multi-model setups, which makes it more practical for real-world industrial applications. Presentation is mostly clear, and the supplemental material is thorough, including failure cases and ablations.", "weaknesses": "The reliance on synthetically generated anomalies (via CutPaste-like methods) introduces a potential domain gap. While the authors argue that the projector generalizes well, the method struggles with unseen anomaly types like rotated objects or subtle defects. This raises concerns about robustness.\nAdditionally, the approach heavily depends on the choice of encoder—DINOv3 works well, but others perform worse. It remains unclear how well this method would transfer to domains less similar to natural images (e.g., medical or satellite imagery).\nThe few-shot setup could be explained more clearly. It’s not immediately obvious how support images are selected and used, especially in the multi-class setting.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Kz47dOuEY1", "reviewer": "Reviewer_Bnw6", "summary": "This paper observes that in foundation visual encoders, the embedding distance naturally correlates with the amount of anomaly within an image, indicating that these pretrained models implicitly capture the structure of the normal image manifold. Building on this observation, the authors propose a few-shot anomaly detection framework that leverages this intrinsic property without retraining the encoder.", "questions": "See above weaknesses. The method is conceptually simple and technically lightweight. Although the empirical results are strong, I would be more interested in a deeper discussion of the experimental setting and underlying factors.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper is well written and easy to follow. The motivation, method design, and experimental setup are clearly articulated, making the overall contribution easy to understand.\n2. The proposed method achieves impressive performance across multiple benchmarks, including the multi-class few-shot setting, the improvements over prior methods are consistent and substantial.\n3. The proposed method introduces only a small projection network with minimal trainable parameters and fast inference. Also not relied on text prompts.", "weaknesses": "1. The method trains the projector using synthetic anomalies generated by CutPaste, which differ significantly from real-world defects in texture and scale. The paper does not provide a clear empirical justification for why this training signal generalizes well to real anomalies. The paper should include a more explicit discussion of this transferability. \n2. Whether using more realistic synthetic data, e.g., anomalies generated by modern diffusion-based methods, would further improve or alter performance? An ablation in this direction would better explain the role of synthesis process in this framework.\n3. The method uses features from a single mid-level layer of the foundation encoder. Have the authors considered aggregating multi-layer embeddings to capture both fine-grained and semantic anomalies?\n4. The paper should include a baseline using the raw frozen encoder features without fine-tuning to see how much performance comes from the inherent foundation encoder.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)