FrameShield: Adversarially Robust Video Anomaly Detection
Authors: Mojtaba Nafez
Mobina Poulaei
Nikan Vasei
Bardia soltani moakhar
Mohammad Sabokrou
Mohammad Hossein Rohban
Venue: NeurIPS 2025 poster ()
Keywords: Video Anomaly Detection
Adversarial Robustness
Multiple Instance Learning
Primary area: deep_learning
TL;DR: Adversarially Robust Weakly Supuervised Video Anomaly Detection

Abstract: Weakly Supervised Video Anomaly Detection (WSVAD) has achieved notable advancements, yet existing models remain vulnerable to adversarial attacks, limiting their reliability. Due to the inherent constraints of weak supervision—where only video-level labels are provided despite the need for frame-level predictions—traditional adversarial defense mechanisms, such as adversarial training, are not effective since video-level adversarial perturbations are typically weak and inadequate. To address this limitation, pseudo-labels generated directly from the model can enable frame-level adversarial training; however, these pseudo-labels are inherently noisy, significantly degrading performance. We therefore introduce a novel Pseudo-Anomaly Generation method called Spatiotemporal Region Distortion (SRD), which creates synthetic anomalies by applying severe augmentations to localized regions in normal videos while preserving temporal consistency. Integrating these precisely annotated synthetic anomalies with the noisy pseudo-labels substantially reduces label noise, enabling effective adversarial training. Extensive experiments demonstrate that our method significantly enhances the robustness of WSVAD models against adversarial attacks, outperforming state-of-the-art methods by an average of 71.0\% in overall AUROC performance across multiple benchmarks. The implementation and code are publicly available at [FrameShield (GitHub)](https://github.com/rohban-lab/FrameShield).

FrameShield: Adversarially Robust Video Anomaly Detection
Mojtaba Nafez
Mobina Poulaei
Department of Computer Engineering Sharif University of Technology mojtaba. nafez. 990gmail com
Department of Computer Engineering Sharif University of Technology
poulaei@gmaa com
Nikan Vasei
Bardia Soltani Moakhar Department of Industrial Engineering Sharif University of Technology bardisoltan@@mail. com
Department Computer Engineering Sharif University of Technology iikkavsiini@@maii com
Mohammad Sabokrou
MohammadHossein Rohban Department of Computer Engineering Sharif University of Technology rohban@sharif. edu
Machine Learning and Data Science Unit Okinawa Institute of Science and Technology mohammad, sabokrou@oist.]
Abstract
Weakly Supervised Video Anomaly Detection (WSVAD) has achieved notable ad- vancements, yet existing models remain vulnerable to adversarial attacks, limiting their reliability. Due to the inherent constraints of weak supervision-where only video-level labels are provided despite the need for frame-level predic- tions traditional adversarial defense mechanisms, such adversarial training, are not effective since video-level adversarial perturbations are typically weak and inadequate. To address this limitation, pseudo-labels generated directly from the model can enable frame-level adversarial training; however, these pseudo-labels are inherently noisy, significantly degrading performance. We therefore intro- duce novel Pscudo-Anomaly Generation method called Spatiotemporal Region Distortion (SRD), which creates synthetic anomalies by applying severe augmenta- tions to localized regions in normal videos while preserving temporal consistency. Integrating these precisely annotated synthetic anomalies with the noisy pseudo- labels substantially reduces label noise, enabling effective adversarial training. Extensive experiments demonstrate that our method significantly enhances the robustness of WSVAD models against adversarial attacks, outperforming state-of- the-art methods by an average of 7 71.0% in overall AUROC performance across multiple benchmarks. The implementation and code publicly available www.rohban Sattiiaae.aabaraaeShhthte FrameShield
Introduction
Video Anomaly Detection (VAD) is fundamental component of surveillance systems, with applica- tions spanning public safety, healthcare, and industrial monitoring, identifying rare and hazardous events such as accidents, violence, and equipment malfunctions Gopalakrishhan (2012). [uulani et al. (2018). In recent years, due to the fabor-intensee nature of frame-level labeling, research
EEqual Contribution
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Shangbal
TAD
UCP
Adversarially Perturbed
AUROC (%)
92.9
8G.B
$5.7
$3.0
19.5an.1a5.11
27.2362667
80
60
40
20
2.8
3.8
1.7
0.5
9.5
11.8
UMIL
RTFM
MGPN
Ours
Figure 1: Robustness Assessment of Video Anomaly Detection (VAD) Methods: A comparative
evaluation SOTA VAD methods on well-established benchmarks: Shanghai, TAD, and UCF Crime, under both standard conditions and adversarial attack scenarios. The results highlight the vulnerability of existing SOTA methods and demonstrate the superior robustness and reliability of our proposed method, FrameShield, in both clean and adversarial settings.
has shifted towards Weakly Supervised Video Anomaly Detection (WSVAD) Majhi al. 2021
Yang et al. [2222 Jia et al. [2023] Ensuring robustness against adversarial attacks is crucial for deploying machine learning models in critical and high-reliabillty scenarios Rony et al. 2019 These attacks introduce subtle, almost imperceptible perturbations into the input video, causing models to misclassify normal frames as anomalies and vice versa. Although SOTA VAD methods have demonstrated near-optimal performance under standard conditions, their susceptibility to adversarial perturbations results in substantial performance degradation, as illustrated in Figure raising serious concerns about their reliability and robustness in real-world applications.
Despite advances in VAD, WSVAD's adversarial robustness remains largely unexplored. Enhanc- ing its robustness presents significant challenges. First, current WSVAD methods rely heavily on pretrained feature extractors like I3D Carreira and Zisserman [2017). C3D C3D/Tran et al. [2015). Swin- Transformer Liu et al. [2021], and CLIP Radford et al. [2021], which, despite strong representational power, are highly susceptible adversarial attacks. Second, adversarial training (AT)-a widely used defense mechanism for improving model robustness through the augmentation of training data with adversarial examples- faces unique challenges in WSVAD. This mainly due to the inherent constraints of the Multiple Instance Learning (MIL) framework, where only video-level labels are available during training, while frame-level predictions are required during inference Jatarinia et al. 2024).
In WSVAD, MIL-based loss functions commonly employed, where aggregator function such as max pooling is applied to frame-level outputs to produce a video-level prediction that matches the available label, enabling cross-entropy loss for training Sultani et al. 20188. During adversarial training, perturbations are applied to the entire video. However, only the features selected by the aggregator such as the maximum-valee valued feature are adversarially influenced, since the gradient primarily flows through that specific component. This design introduces critical vulnerability. During training, perturbations are applied only the features chosen by the aggregator (c.g., the maximum). In contrast, during inference, attackers are not constrained in this way and can manipulate entire frames, producing more localized and impactful perturbations across all features. The absence of frame-level annotations in training constrains adversarial example generation to video-level supervision, leading to weaker perturbations that reduce the robustness of WSVAD models against attacks Mirzaei et al. [2024a], Chen et al. [202T] We provide theoretical analysis of this phenomenon in Section 4 demonstrating how max-based aggregation neglects perturbations on non-maximal frames, leaving them exposed to attacks during inference.
To address these limitations, we propose FrameShield, a novel end-to-end adversarial training pipeline designed to address the limitations of pretrained models by fine-tuning the feature extractor. The training process is structured into two main phases. First, we perform standard training using simple yet effective WSVAD method, generating predicted labels that serve pseudo-labels. In the second phase, we employ these frame-level pseudo-labels to perform adversarial training, crafting stronger adversarial examples to enhance model robustness. However, as shown in Table 2 the localization performance of SOTA WSVAD methods on the anomaly segments of benchmarks remains suboptimal, often barely surpassing random detection. Our method similarly struggles with anomaly localization, producing noisy pseudo-lahels that lead false positives and false negatives, particularly in anomalous videos. In contrast, all frames of normal videos are consistently labeled

---

without errors. As result, the presence of noisy pseudo-labels leaves our method vulnerable to adversarial attacks on anomaly videos Dong et al. (2023).
To address this vulnerabilityy we present Spatiotemporal Region Distortion (SRD), an innovative Pseudo-Anomaly Video Generation method designed produce synthetic anomalies with accurate frame-level annotations. SRD works by randomly selecting an intermediate frame from normal video, utilizing Grad-CAM Selvaraju et al. [2017] to identify the foreground objects, and then performing multiple harsh augmentations on the largest connected component within that region. To simulate the appearance of moving anomalies throughout the video sequence, we introduce motion irregularities Zhu and Newsam (2019), Yang et al. [202T] by defining randomly curved vector, directing the corrupted region's s displacement across consecutive frames with additional harsh augmentations. This technique enables the generation of synthetic anomaly videos with precise frame-level labeling, eliminating the need for extra supervision and enhancing adversarial training. By merging these accurately labeled synthetic anomalies with insights into real anomaly distributions derived from pseudo-labels, we introduce our adversarially robust WSVAD framework, FrameShield.
Contribution We introduce FrameShield, the first adversarial training pipeline specifically designed enhance the robustness of WSVAD models against adversarial attacks. Our method employs frame- level adversarial training within a weakly supervised setup, leveraging real anomaly distributions from pseudo-late labels and mitigating false positives and negatives error through Spatiotemporal Region Distortion (SRD) for precise frame-level annotations. We theoretically justify the superiority of supervised adversarial training over MIL-based approaches. FrameShield is evaluated against strong attack methods, including PGD- 1000 Madry et al. (2017), AA Croce and Hein [2020), and A Liu jet al.] 2022]. Experimental results, on average across well-established benchmarks, demonstrate a near 53% improvement in overall AUROC for robust performance and 68.5% in anomaly segments, while maintaining competitive performance on standard setup.
2 Related Work
VAD is vital in surveillance, public safety, and automated monitoring. Traditional fully-supervised methods demand costly frame-level annotations due to the rarity of anomalies. WSVAD addresses this by using only video-level labels, leveraging Multiple Instance Learning (MIL) to treat cach vidco as a bag of frames, assuming anomalies exist in positive samples. Early MIL-based VAD methods faced challenges with noisy labels and weak temporal modeling (Sultani et al.
SaneliingStttani followed with noise suppression, temporal modeling (e.g., MGFN et al. [2022]. ) dual memory
[2018). Improvements
units (UR-DMU Zhou et al. (2023), and unbiased training (UMIL al.
[2023) through feature
clustering and contrastive loss. Recently, Vision-Language Models (VLMs) like CLIP enhanced anomaly detection by capturing visual and semantic cues Joo al. [0023] Wu et al. [2024] Chen et al. [2023). However, WSVAD models remain vulnerable to adversarial attacks, as they rely on non-robust pre-trained backbones (c.g., 13D, C3D, Swin Transformer, CLIP) Schlarmann et al.] [2024). Chen et al. [2019), Li et al. [0021]. The lack of frame-level annotations further complicates adversarial detense, exposing models to real-world threats. For further information and detailed discussion of the related works, please refer to Appendix M
Preliminaries
Weakly Supervised Video Anomaly Detection (WSVAD): Video Anomaly Detection (VAD) is the task of identifying unusual or abnormal events within video and determining their temporal locations at the frame level. In the WSVAD setup, only vidco-level supervision is available during training, indicating whether video contains anomalies, without providing specific frame-level labels. During inference, a model Fe processes a video V containing N frames and generates an anomaly score (,Fe; V) for each frame If the score of frame surpasses predefined threshold, that frame is classified as anomalous; otherwise, it is considered normal.
Adversarial attacks, commonly studied in the context of classification tasks, involve intentionally modifying an input sample æ with its correspond- ing label y to generate a new sample x: that increases the model's prediction error by maximizing the loss function f(=";; :3) Yuan et al. (2019), Xu al. 2019). The resulting input x" is referred to as an adversarial example, and the difference x 18 called the adversarial perturbation. To ensure
Adversarial A Attakk on Video Anomaly Detectors:
3

---

that the adversarial example remains semantically similar to the original input, the perturbation is constrained such that its n,-norm does not exceed predefined threshold e. Formally, an adversarial ; One of the most commonly used and effective techniques for crafting adversarial examples the Projected Gradient Descent (PGD)
example satisfies the condition x² arg =|===>/|| {(x';
method Madry et al. [207]] which iteratively updates the input in the direction of the gradient sign of ((=";)) y) using a step size a.
In this work, we adapt the adversarial attack paradigm to the domain of Video Anomaly Detection (VAD), introducing a targeted, task-specific attack that manipulates videos based on the anomaly scores of individual frames, rather than optimizing against an overall loss function- moos existing methods in WSVAD rely on MIL-based losses. Our goal is to mislead the model by increasing the anomaly scores of normal frames and decreasing those of abnormal frames, which we experimentally demonstrate be a more effective form of attack (Table [4). The attack is formulated as follows. Starting from the original video Vor V, we iteratively update the adversarial video using the rule:
V V +Y a sign (Vv SVvS V2"),,
where (Fe; V(') denotes the anomaly scores predicted by the model Fe for each frame of the video Vi, and is the step size. The vector Y is defined such that Y, = +1 for normal frames and Y; -1 for anomalous frames, with indexing the frame position.
4 Methods
Theoretical Motivation. We hypothesize that using max as the MIL aggregator results in weak attacks on instances, or frames. Note that by denoting x (II,...,, 2k) as l vidco frames, the gradient of loss with respect to the input r becomes:
V (((maa(((1))).......)
where j is the index of the frame leading to the maximum, i.e. j argmaz; f (x;) for the specific input x. This results in the gradient-based attack be applied only on a single frame. Once such attack is used for training. the base classifier I would become robust with respect to a subset of frames, i.e only those with maximum score. On the other hand, there could be other frames j' A j. where (3xy)) is also high, though be a bit smaller than (zzz). The attack does not consider such frames, and if zy does not follow the same distribution as Iy, the model adversarially trained base classifier based this attack would fail to generalize robustness on zz'. One could use other soft versions of the max, such as Log-Sum-Exx (LSE) to mitigate this issue. However, our experiments in Table 3 indicate that although LSE outperforms the max function, it remains ineffective in reducing the performance of clean-trained models to zero under adversarial attacks. We note that such operators decrease model sensitivity to single/small number of frames.
For these reasons, we prefer training attacks that are applied on every single frame but does not alter the max operator to not compromise the model sensitivity to outliers. This could be achieved by directly attacking (xx) for all Here, the attack designed based on:
L ::= max (((xx; + (a::)) | St
Le. make the model to not change its original prediction for every frame in given input video. Here, consider (x:) as a pseudo-label and design the attack based on it. The loss in Eq. cloosely resembles what is known as the "boundary error," as opposed to "natural error" in the so-called TRADES method /Zhag al. [2019]]. Such attacks could serve regularization for robustness. Here, one could aim for optimizing the standard error added by the adversarial loss in Eq. to achieve a better trade-off between the standard and adversarial errors. This loss indeed was shown be an almost sharp upper-bound on the difference between the robust risk and optimal standard risk Zhang al. [2019a]:
Ryob Riat ( Ri) (G)+EE(L)) +EL),
where Ryoh and Ri represent the robust and optimal standard risks, respectively. Furthermore, v) is a non-decreasing function, and R₂ represents the risk with respect to the loss function I, and I. is defined in Eq. [ Therefore, this loss could be an excellent alternative in weakly supervised scenarios where the ground truth labels are missing for many instances.

---

Cheelo
Novnal Franso
"Maused" "Sord"
CE Lew
Training set
Imagg Encodeer
Text Encoder
SRD
Softmax
Adverariil Partarlation
X the Pacgpraa prakent
Absoema Teat Pesters
Figure 2: Overview of the FrameShield Framework: (1) The WSVAD training set is constructed using frame-level labels for normal data and frame-level pseudo labels for weakly labeled real anomaly data. Additionally, the Spatiotemporal Region Distortion (SRD) module generates pseudo- anomaly samples with precise frame-level annotations, further augmenting the training adversarial perturbations. (2) Two predefined prompts, "normal" and "anomaly." are used to extract text embeddings from the frozen encoder. (3) Training videos are segmented into chunks and processed by the XClip-based encoder. The dot product between each chunk's 's feature representation and the text prompt embeddings is computed obtain normality and abnormality scores, optimizing the network through chunk-level cross-entropy loss.
with
Overview. Current WSVAD methods exhibit significant vulnerability to adversarial attacks. Our experiments and analysis the MIL-based loss function in Table and Section underscores the necessity of frame-level labeling enhance adversarial robustness. To address this challenge, introduce FrameShield, a novel approach that strengthens model resilience by leveraging weakly labeled real abnormal data through pseudo-label generation and precisely labeled chunk-level pseudo- anomalies. FrameShield operates in two main stages: first, the WSVAD model undergoes standard training using MILL-based loss function, allowing it to learn anomaly patterns effectively. This learned knowledge is then utilized to generate pscudo labels for the anomaly subset of the training data. In the second stage, the adapted WSVAD model is adversarially trained with both pseudo labels and pseudo anomalies, providing more granular supervision at the frame level and improving its robustness against adversarial manipulations. The following sections provide detailed breakdown of each stage in FrameShield's 's training pipeline.
4.1 First Phase: PromptMIL. Training
Our proposed Weakly Supervised Video Anomaly Detection (WSVAD) method, PromptMIL. partitions each video into chunks, denoted u4 where i (1,2...., We employ X-Clip Ma ct al. [002] as the feature extractor, represented as Fg. Each video chunk v; is processed through Fe. generating corresponding feature vector f,
Additionally, we extract feature vectors for two specific text prompts: "Normal" and "Abnormal", using the X-Clip text encoder. For each video chunk, the dot product is computed between its feature vector f; and the feature vectors of the two text prompts. We then apply a softmax function to produce probability distribution that represents the likelihood of the chunk being normal or abnormal:
Si(Fo; V), (1 - S:(Fo; V)) = softmax(f; t,, f. t.,)
where Fe represents our FrameShield model, and t,, and t. are the text feature vectors for "Normal" and "Abnormal," respectively. Here, S, V) denotes the predicted anomaly score for the i-th chunk. After processing all chunks, we obtain the normality and abnormality probabilities for each chunk. We then aggregate the anomaly scores across all chunks using Multiple Instance Learning (MIL) max aggregator, which selects the maximum anomaly score from the chunks. This
5

---

Ortginal
Grad CAM
Frame
Framayy
Framc)
Francç-
Preudo Anomaly
Selestal
Object
Figure 3: Visualization of Spatiotemporal Region Distortion (SRD): A synthetic anomaly genera- tion method for precise frame-level labeling, applying harsh augmentations Grad-CAM CAM-identified foreground regions and simulating motion irregularities with random curved vectors across frames.
aggregation step is followed by Binary Cross-Entropy loss calculation, which is directly applied the maximum anomaly score rather than summing over all chunks:
C BCE(max((S) (Fe; V), (2(e: V)....,
where m the total number of chunks, and y is the true label of the video. This formulation ensures that the model is optimized based on the highest anomaly score across the chunks, which is particularly effective for identifying the most critical abnormal segments in the video.
Inference. During inference, the video is similarly partitioned into m chunks and processed through the feature extractor Fe. For each chunk, we perform the dot product operation with the text prompts and apply the softmax to obtain the normality and abnormality scores, Chunks with abnormality score > 0.5 are labeled abnormal; others are normal. Frame-level predictions are obtained by duplicating each chunk's 's score across its frames. An ablation on r is provided in Appendix D
Pseudo Label Generation. Once the PromptMIL model is trained, we utilize generate pseudo labels for each chunk of the anomaly videos in the training set. Notably, frames normal videos inherently labeled normal and therefore do not require pseudo labeling. At this stage, objective is to label the training data-a a task that is inherently less challenging, as the model has already been trained on it. Details regarding the alternative methods for pseudo-label generation and the performance evaluation of our PromptMIL model can be found in Appendix B
4.2 Second Phase: Adversarial Training
During this training phase, we conduct adversarial training on a constructed fully supervised VAD model by leveraging precise chunk-level labels for normal videos, alongside generated pseudo-labels for real abnormal chunks. Additionally, we incorporate exact chunk-level annotations for the pseudo- anomalies generated by our Spatiotemporal Region Distortion (SRD) method. This approach is specifically designed to mitigate label noise within the pseudo-labeles data, enhancing the model's robustness and accuracy. The following sections provide a comprehensive breakdown of our pseudo- anomaly generation process, the detailed training procedure, the employed loss functions, and the specifies of the adversarial training strategy.
Spatiotemporal Region Distortion (SRD). Based on our observations in Table and the analysis presented in Appendix F we found that solely relying adversarial training with generated pseudo-labels is ineffective due to the presence of false positives and false negatives, which hinder proper optimization. To address this issue, we propose novel yet straightforward pseudo-anomaly generation method called Spatiotemporal Region Distortion (SRD), designed to provide anomalies with precise frame-level annotations and rectify the errors in eseudo-labeles videos.
We recognize that an effective pseudo-anomaly in the video domain should meet three key criteria. First, there should be high likelihood that the distorted data appears abnormal. Second, the generated data should be near normal samples' distribution, sharing similar semantic and stylistic attributes. This aligns with existing literature adversarial robustness, which emphasizes the benefits of

---

Table 1: Frame-leved detection performance (% AUROC) of various Video Anomaly Detection (VAD) methods compared to FrameShield across multiple benchmarks, evaluated under both clean settings and adversarial attacks setup (PGD-1000, 0.5 over the entire test set (AUCo).
Method
Attack
Dataset
UCSD Ped2
Shanghai
TAD
UCF Crime
MSAD
RTFM
Clean PGD
9
97.21 8.5
89.6 6.3
85.7 7.3
86.6/ 10.0
TEVAD
Clean / PGD
98.7 5.8
98.1 / 8.4
9.6
84.9/0.0
86,82
MGFN
Clean PGD
5.0
93.9/7.1
88.3
84.3/11.8
84.9/ 12.1
Base MIL
Clean PGD
9.3
9..2/0.6
89.1/0.9
80.7
80.5/13
UMIL
Clean PGD
9.
9.
92.9/3.0
86.8
63.8/6.1
UR-DMU
Clean PGD
97.3/4.1
96.2/
-/-
86.75
86.12 10.2 -/-
VAD-CLIP
Clean PGD
9.34/6.3
/3.5
92.7/5.1
88.0/8.2
Ours
Clean PGD
97.1 81.3
89.5 87.1
85.1/77.2
80.2 78.7
78.97 76.2
Table 2: Frame-level detection performance (% AUROC) of various Video Anomaly Detection (VAD) methods compared to FrameShield across multiple benchmarks, evaluated under clean settings and adversarial attacks setup (PGD-1000, e 255
0.5 on the anomaly sections of the test set (AUCA).
Method
Attack
Dataset
UCSD Ped2
Shanghai
TAD
UCF Crime
MSAD
RTHM
Clean / PGD
98.01 5.1
64.31 / 8.5
53.08 5.0
63.86 10.2
72.35 3.6
TEVAD
Clean PGD
98.20 7.5
67.9/ 10.5
60.5 7
00.3/2.6
71.6/7.8
MGFN
Clean / PGD
96.3
66.9/7.8
51.56 11.7
64.9 13.3
74.5
Base MIL
Clean PGD
9..4/8.6
/3.5
/6.5/4.2
60.6/4.7
/
UMIL
Clean / PGD
9..3/7.2
6..1/5.9
65.8/
68.7 6.2
72.2
UR-DMU
Clean PGD
9..5/5.0
6
-/-
68.82/7.2
/
VAD-CLIP
Clean / PGD
9..9/5.7
7.92/5.9
61.9 6..9/8.3
69.3
-/-
Ours
Clean PGD
94.3 91.3
62.3 61.9
50.9
30.0
60.1/ 53.4
64.4 60.2
decision boundary samples that are near the distribution for enhancing model robustness Sintinnssssnnngggg et al. [002]] Finally, it is crucial to incorporate temporal characteristics the anomalies, reflecting unexpected variations over time, such as abrupt speed shifts, sudden motion disruptions, or irregular event sequences that disrupt the normal flow of activities.
Building on our insights into pseudo-anomaly generation in the video domain, we propose Spatiotem- poral Region Distortion (SRD). SRD begins by randomly selecting continuous sequence of frames from a normal video and extracting the initial frame. To identify object regions, Grad-CAM is applied using a pre-trained ResNet18 He al. [2016). Nafez et al. [2025) model, effectively highlighting the most salient foreground areas. The resulting saliency map is then thresholded to isolate the most prominent features, after which the largest connected component computed. A bounding rectangle is fitted around this region (with some randomness introduced for generalization), serving as the foundation for a binary mask. Finally, we apply harsh augmentations, randomly chosen from predefined set of N aggressive transformations known to disrupt semantic integrity, as supported by prior research Sinha et al. 2021], DDeerses and Taylor [2017]. Ghiasi et al. [202T] Zhang et al.) [2088) Mirzaei et al. b 2025). These augmentations are applied exclusively to the masked region, maximizing the chances of the transformed video being perceived as abnormal. For further details, please refer to Appendix A.
To introduce temporal characteristies into the anomaly, SRD defines randomly curved vector that originates from the center of the rectangle and extends in random direction. The masked region then duplicated, distorted with set of new augmentations, and positioned in the subsequent frame according to the vector's 's trajectory. This movement progresses step by step through the frame sequence, with each step covering a distance proportional to the vector's total length divided by the number of frames in the sequence. This synchronized motion effectively simulates spatiotemporal anomaly propagation throughout the video. illustrative example of SRD applied to video sequence is presented in Figure
7

---

Table 3: Frame-level detection performance (% AUROC) of various aggregation methods under adversarial (PGD-100) 1000, 255
Table 4: Frame-level detection performance (% AUROC) of adversarial attacks (c 0.5 on
255
2 conditions,
our method across three datasets. AUCo and AUCA refer to overall and abnormal-only AUC, respectively.
evaluated only on abnormal test videos AAUCA)
Aggregator
UCF
MSAD
Max
45.4
51.2
48.6
Dataset
PGD-1000
AutoAttack
A²
Log-Sum-Exp
43.8
39.3
AUCb
AUCA
AUCo
AUCA
AUCo
AU/C
SmuothMax
49.7
48.7
47.1
ABMIL (Attention)
43.6
45,2
44.5
TAD
77.2
73.6
27.2
Frame-level
0.0
UCF Crime
78.7
53.4
72.1
50.3
71.5
48.7
MSAD
76.2
60.2
74.7
58.2
73.6
56.9
Training Process. In this phase, we leverage the availability of frame-level annotations for normal videos, real abnormal videos, and the pseudo-anomaly videos generated by SRD. Unlike traditional MIL-based training, which relies on video-Ievel loss functions, we shift to fully supervised learning paradigm. This enables the model to learn more granular representations by directly optimizing chunk-level predictions. As illustrated in Figure 2 each chunk, allowing for fine one-grained supervision:
the loss function is computed independently for
Lohank- wisse V, V,Y)
Σ BCE( V),
where m is the total number of chunks, and yi is its corresponding ground truth label. Additionally, Y denotes the complete of chunk-wise labels. This chunk-wise cross-entropy calculation ensures that the model is updated with finer granularity. Moreover, this supervised strategy allows us to apply strong adversarial perturbations the input video during training, effectively building a more robust VAD model against ad adveraaiial attacks.
Ad Adversarial Training of WSVAD. Given an input video sample V, an adversarial version Vidy is crafted by introducing a perturbation 8 generated through the PGD-10 attack. This perturbation is constrained by the Lo norm with
0.5 and is optimized according
chunk-wise loss function:
255
8" argmaax Lehunk-wise (V + 8, Y), Vidy V +
(5)
Sc
We have predefined chunk-wise labels for both anomalies and anoomlless, denoted as Y, which are utilized during training. The adversarial training follows min min- optimization strategy. aiming to adjust the model parameters to minimize the expected loss over adversarially perturbed data samples from the training batch B:
max Letunk wise (V ( + 5, (.Y)
min E (VYY)
(6)
[16 Sc
Analysis of the Value for Attack and Training. In video anomaly detection models, the input typically consists of high-dimensional video sequences, often containing at least 100 frames, each with resolution of 224x224 pixels. Due to the large size of these inputs, adversarial perturbations tend to be substantial, which can destabilize adversarial training Sharma and Chen (2088) To mitigate this, some approaches like (Shaeiri al. [2020] have explored gradually increasing the value of e. The performance of this strategy is detailed in Appendix E In our experiments, we adopt an e value of 255 as the default setting for training and evaluation. To validate this choice, we conducted an experiment on the Shanghai dataset, which provides frame-level annotations for the training set. Initially, we trained our framework on fully supervised data, representing the optimal scenario. In this setup, the model achieved near- pear-perfect performance across both overall and amomely-ppecific metrics. However, when we trained the model using higher e values of 2.0 and 1.0 standard detection performance, even without adversarial attacks, dropped to near-random levels. In contrast, with 0.5 the model maintained stable training and exhibited robust performance 255 against adversarial attacks. Further details of this experiment can be found in Table TO
255 the model's
255
5 Experiments
To demonstrate the effectiveness of FrameShield, we conducted extensive experiments across several well-established benchmarks in the VAD domain. We compared our approach with various SOTA
8

---

Table 5: Frame-level detection performance (%AUROC) comparing the baseline with our proposed contributions: Pseudo Anomaly, Pseudo Label, and their combination. AUCo and AUCA represent the AUC computed on the overall test set and only abnormal test videos, respectively, under clean and adversarial (PGD-1000, e
0.5 conditions.
253
Method
Attack
TAD
UCF Crime
MSAD
AUCo
AUCA
AUCo
AUCA
AUCo
AUCA
Pscudo Anomaly
Clean / PGD 75.2/70.3
53.7 /8.7
72.67
/ 39.4
67.5 62.0
62.0 49.7
Pseudo Label
Cleun PGD
88.2/73.2
52.6/7.1
/1.3
60.7 15.4
80.6/ /6.2
61.9/21.7
Pscudo Anomaly Pseudo Label
Clean /GDD
85.1/77.2
50.9/30
60.1/534
78.9/76.2
60.2
methods, reporting AUROC metrics for both standard setups and adversarial attack scenarios. The results for the complete test sets of these benchmarks, denoted as AUCo, are presented in Table [ while the performance metrics specific to the anomaly sections of the test sets, denoted as AUC representing more challenging evaluation, shortcomings of existing SOTA methods and emphasize the enhanced robustness and effectiveness of our proposed approach. A detailed comparison with recent multimodal LLM-based methods is provided in Appendix K In Appendix D we further evaluate Shield under black-box attack settings, and Appendix [N presents comparisons with adversarially trained versions baseline VAD methods to ensure fairess in evaluation. Collectively, all experiments consistently confirm the robustness and overall superiority of FrameShield.
detailed in Table [ These tables highlight the
Analyzing Results. As shown in Tables T and prior SOTA methods such as UMIL,, RTFM, and MGFN experience significant performance degradation under adversarial conditions, despite achiev- ing strong results on clean data. These shortcomings motivated the development of FrameShield, our proposed solution. On average, FrameShield improves robust detection across various datasets by up to 71.0%. As highlighted in previous research, slight reduction in clean performance is generally considered an acceptable trade-off for substantial improvements in robustness (see Appendix O for further discussion).
Implementation Details and Dataset. For training, used learning rate of 8 x 10 with chunk size of 16 frames. The model was trained for 40 epochs using the Adam optimizer, which effectively incorporates weight decay. To schedule the learning rate, we applied Cosine scheduler, which progressively reduces the learning rate following a cosine decay pattern. This approach promotes smoother convergence and improved generalization. We evaluate
method well-established benchmarks: MSAD Zhu et al. [2024). UCF-Crime Sultani et al. (2018). ShanghaiTTech Liu et al. 2018), TAD Lv provided in Appendix A In the adversarial scenario, we assess each method using the l PGD-1000 attack with perturbation magnitude of 0.5 The evaluations under the lo norm are provided in
2021]. J. and UCSD Ped2 Mahadevan et al. [2010]; additional details
255
Appendix G
6 Ablation Study
In this section, present detailed analysis method's component and evaluate their effectiveness.
Ablation on Pseudo Supervision Components. To evaluate the effectiveness of our proposed pseudo-label generator (PromptMIL) and pseudo-anomaly generator (SRD), we conduct an ablation study, as shown in Table 5 this experiment, we train and evaluate FrameShield under three configurations: using only pseudo-label supervision, using only pseudo-anomaly generation, and using our default setup that incorporates both. The results demonstrate that integrating real anomaly information with precisely generated pseudo-anomaly, labels substantially enhances the model's adversarial robustness.
Video-Level Attack vs. Frame-Level Attack In the VAD domain, most models operate at the video level, utilizing various aggregators conjunction with MIL--baeed loss functions for video-level supervision. As presented in Table we train our PromptMIL model under standard conditions, without adversarial training, employing different aggregators such as Max, LSE, Smxoth and ABMIL. Following training, we apply adversarial attacks targeting the final video-level scores of this clean model. Our experiments indicate that even the most effective gradient-flor flow--asld aggregators unable to degrade the model's performance to the point of zero AUC. In contrast, our frame-level

---

adversarial attack succeeds in entirely deceiving the model, showcasing the superior effectiveness and robustness of our proposed approach. This highlights the strategic advantage of shifting to frame-level adversarial training, enabling stronger and more impactful adversarial perturbations..
Advanced Attacks We employed the PGD attack Madry al. 2017 for both the training and evaluation phases of our model. To further demonstrate the flexibility and resilience of our proposed method under various adversarial scenarios, also assessed its effectiveness against several advance attack strategies, including AutoAtttck Croce and Hein (2020) and A (Adversarial Attack Automa- tionnLin et al. [022 in Table 4 Comprehensive details of our adaptation methods for these attack types within the VAD context are provided in Appendix || Notably, the training process remained straightforward, consistently using the standard PGD-10 10 configuration to maintain simplicity and
practicality.
Additional Ablation Studies We conducted further experiments to evaluate the impact of the SDR component, specifically analyzing the effects of Grad-CAM and Motion, as detailed in Appendix [ Additionally, we performed an ablation study on training our FrameShield model with MIL-based adversarial example generation, which is discussed in Appendix [ Furthermore, we investigated the of alternative WSVAD methods pseudo-label generators, with the results also presented in Appendix C
7
Conclusion
We introduced FrameShield, novel approach to enhance adversarial robustness in Weakly Supervised Video Anomaly Detection (WSVAD). Our method employs frame-level adversarial training with chunk-wise pseudo-labels generated from weakly labeled data and introduces Spatiotemporal Region Distortion (SRD) for precise frame-level anomaly labeling. We demonstrated the vulnerabilities of SOTA VAD models under adversarial attacks and bridged this gap with FrameShield, establishing a stronger defense mechanism for robust video anomaly detection in real-world scenarios.
10

---

References
S Gopalakrishnan, A public health perspective of road traffic accidents. Journal family medicine and primary care, 1:144-150, 03 2012. doi: 1044105/2249-488.1004999
Waqas Sultani, Chen Chen, and Mubarak Shah. Real-world anomaly detection in surveillance videos. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6479-6488, 2018, doi: N0.1109/CVPR.20188
Snehashis Majhi, Srijan Das, Francois Bremond. Ratnakar Dash, and Pankaj Kumar Sa. Weakly-supervised joint anomaly detection and classification, 2021. URL https: ///a/i////xi org/abs/2108 08996
Jianwei Yang, Chunyuan Li, Pengehuan Zhang, Bin Xiao, Ce Liu, Lu Yuan, and Jianfeng Gao. Unified contrastive learning in image-text-lahel space. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pages 19141-19151, 2022. doi: 10.1 1011000VR52688.2000 018557.
Xiaosong Jia, Penghao Wu, Li Chen, Jiangwei Xie, Conghui He, Junchi Yan, and Hongyang Li. Think twice before driving: Towards scalable decoders for end-to-end autonomous driving. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 21983-21994, 2023. doi: 10.1 109/CVPS52729. 2023.02105.
Jérôme Rony, Luiz G. Hafemann, Luiz S. Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger, Decoupling direction and norm for efficient gradient-based 12 adversarial attacks and defenses, 2019. URL sstpa://arxiv org/ abs/ 1811.09600
João Carreira and Andrew Zisserman. Quo vadis, action recognition? new model and the kinetics dataset. In
2017 JEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4724-4733, 2017, doi: 10.1109/CVPR.2017
Du Tran, Lubomir Bourdev. Rob Fergus, Lorenzo Torresani, and Manohar Paluri. Learning spatiotemporal features with 3d convolutional networks. In 2015 IEEE International Conference on Computer Vision (ICCV), pages 4489-4497, 2015. doi: 10. 10901CCC.2000.555
Ze Liu, Yutong Lin. Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang. Stephen Lin, and Baining Guo. Swin Hierarchical vision transformer using shifted windows. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 9992-10002, 2021. doi: 10.1 (w..10///CCVV48222202222 2.0966.
transformer:
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. 2021. URL (tRLhtts:://// arriiriiiiiiii org/ abs/aa/s/...a/ 00020
Hossein Jafarinia, Alireza Alipanah, Danial Hamdi, Saced Razavi, Nahal Mirzaic, and Mohammad Hossein Rohban. Snuffy: Efficient whole slide image classifier, 2024, URI.tttpp:: Rttt.tttts:///rziii http:://rxvv...rr.e aaa/a/aa///// 2408. 2408.08258
Hossein Mirzaci, Mohammad Jafari, Hamid Reza Dehbashi, Ali Ansari, Sepehr Ghobadi, Masoud Hadi, Arshia Soltani Moakhar, Mohammad Azizmalayeri, Mahdich Soleymani Baghshah, and Mohammad Hossein Rohban. RODEO: Robust outlier detection via exposing adaptive out-of- of-distributton samples. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp. editors, Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 35744-35778. PMLR, 21-27 Jul 2024a. URL mlr.
htttpa//ppooceding
hataa//25/mmiiimt www.rraaee2aaa.... htmm
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying -uitt--diittibution detection using outlier mining, 2021. URL battps://arziit
org/ abs/ / 2006. 15207
Chengyu Dong, Liyuan Liu, and Jingho Shang. Label noise in adversarial training: A novel perspective to study org/ abs/ 2110.03311
robust overfitting, 2023, httph:
Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE International Conference on Computer Vision (ICCV). Oct 2017.
Yi 7hu and Shawn Newsam. Motion-aware feature for improved video anomaly detection, 2019. URI.
httpp:/// wrxiv..vvv. www.ii.wwg/abba..eeeeooeeeeeeeee aba/ 1907. 10211
Chun-Lung Yang. Tsung Hsuan Wu, and Shang-Honp Lai. Moving-object--oe anomaly detection in surveil- lance videos. In 2021 17th IEEE International Conference on Advanced Video and Signal Based Surveillance (AVSS), pages 1 1-8, 2021. doi: 10. 109/ 202220222222 6021.66637
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 17Xiv:1706.0608 2017. URLjattps
7/arxiv. htgg abs/ 1706. 060883
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
Ye Liu, Yaya Cheng, Lianli Gao, Xianglong Liu, Qilong Zhang, and Jingkuan Song. Practical evaluation of adversarial robustness via adaptive auto attack. 2022.
Yingxian Chen, Zhengzhe Liu, Baoheng Zhang, Wilton Fok, Xiaojuan Qi, and Yik-Chunp Wu. Mgfin: Magnitude- contrastive glance lance-and-Aa and-focus network for weakly supervse video anomaly detection, 2022.
11

---

Hang Zhou. Junqing Yu, and Wei Yang. Dual memory units with uncertainty regulation for weakly supervised video anomaly detection. In Proceedings the AAAI Conference Artificial Intelligence, volume 37, pages 3769-3777, 2023.
Hui Lx, Zhongqi Yue, Qianru Sun, Bin Luo, Zhen Cui, and Hanwang Zhang. Unbiased multiple instance learning for weakly supervised video anomaly detection. CVPR, 2023.
Hyekang Kevin Joo. Khoa Vo, Kashu Yamazaki. and Ngan Le. Clip-tsa: Clip-assisted temporal self-attention for weaklly-uupervised video anomaly detection. pages 3230-3234, IEFE, IEFE International Conference on Image Processiig (ICIP), 2023. doi: 10. 10.1109/1C1449959 202..10222289 ItRl..ttt:///ieeeeee
beee..rg//ee orgg/ooument////eo 10222289
Peng Wu, Xuerong Zhou, Guansong Pang, Lingru Zhou, Qingsen Yan, Peng Wang. and Yanning Zhang. Vadclip: Adapting usion-languaae models for weakly supervised video anomaly detection. 2024.
Weiling Chen, Keng Teck Ma, Zi Jian Yew, Minhoe Hur, and David Khoo. Tevad: Improved video anomaly detection with captions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision- -aaiuug models. ICML, 2024.
Zhikai Chen, Lingxi Xie, Shanmin Pang. Yong Hc, and Qi Tian. Appending adversarial frames for universal video attack, 2019. httt/:ttt/e/arre
org. hearg//a//1999 04538
Shasha Li, Abhishek Aich, Shitong Zhu, M Salman Asif, Chengyu Song, Amit K Roy-Chowdhurr. and Srikanth Krishnamurthy. Adversarial attacks on black box video classifiers: Leveraging the power of geometric transformations. arXiv preprint 1xxi::2/00.0//
2021.
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 30(9):2805 2824, 2019.
Han Xu, Yao Ma, Haochen Liu, Debayan Deb, Hui Liu, Jiliang Tang, and Anil K. Jain. Adversarial attacks and defenses in images, graphs and text: A review, 2019. URL httpt://ppr:iiiit org/ hwwgg//bs//ae 19tp/9990990000222
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent EI Ghaoui, and Michael I. Jordan. Theoreti- cally principled trade-off between robustness and accuracy, 2019a. URL htttt://p//arr/ hwtp:///..g////b/////eeeee 1901
08573
Yiwei Ma. Guohai Xu. Xiaoshuai Sun, Ming Yan, Ji Zhang, and Rongrong Ji. X-CLIP: End-to-end multi- gulti-grained contrastive learning for video-text retrieval. arXiv preprint arXiv:2207.07288: 2022.
Yue Xing, Qifan Song, and Guang Cheng. Why do artificially generated data help adversarial ro- Koyejo, S. Mohamed, A. Agarwal. D. Belgrave, K. Cho, and A. Oh, edi- tors, Advances in Neural Information Processing Systems, volume 35. pages 954-966 Curran As- /2022/fi12/ sociates. Inc., 2022. URL httpp::/ neurss neurips ceterrisscccppppeee http:/ppprffeeee/eeeppppp pdif
bustness.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016. doi: 10.1 109/CVPR.2016..9
Mojtaba Nafez, Amirhossein Koochakian, Arad Maleki, Jafar Habibi, and Mohammad Hossein Rohban. Patch- guard: Adversarially robust anomaly detection and localization through vision transformers and pseudo anomalies. In Proceedings of the Computer Vision and Pattern Recognition Conference (CVPR), pages 20383-2000 20394,, June 2025.
Abhishek Sinha, Kumar Ayush, Jiaming Song, Burak Uzkent, Hongxia Jin, and Stefano Ermon. Negative data augmentation, 2021. httt.bttts///aatta
org/ abs/2102 05113
Terrance DeVries and Graham W. Taylor. Improved regularization of convolutional neural networks with cutout,
2017. URL https:///aaxx org/ abs/ /albs///// 1708. 170...0502000
Golnaz Ghiasi Yin Cui, Aravind Srinivas. Rui Qian. Tsung- Yi Lin, Ekin D. Cubuk. Quoe V. Le, and Barret Zoph. Simple capy-paste is strong data augmentation method for instance segmentation, 2021. URL
https://arxiv, org/ abs/2/12/ 07177
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization, 2018. URL, htttt//tttt///// //apxii . httg//b//7// 09412]
Hossein Mirzaei, Mojtaba Nafez, Mohammad Jafari, Mohammad Bagher Soltani, Mohammad Azizmalayeri.
Jafar Habibi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Universal novelty detection through adaptive contrastive learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 22914-22923, June 2024b.
Hossein Mirzaci, Mojtaba Nafez, Jafar Habibi, Mohammad Sabokrou, and Mohammad Hossein Rohban. Adversarially robust anomaly detection through spurious negative pair mitigation. In The Thirteenth Inter- national Conference on Learning Representations, 2025. URL (tRlaattta:/// dtttpaa//opperevieee
oow.reviee..eeeeoorunieee net/forummidd
t8fu5m8R5m
12

---

Yash Sharma and Pin- Yu Chen. Attacking the madry defense model with (b-baeed adversarial examples, 2018.
httphata::///xiii org/ wwg. htt///bb/177// 1710. 10733
Amirreza Shaciri, Rozhin Nobahari, and Mohammad Hossein Rohban. Towards deep learning models resistant
large perturbations, 2020. URL. https://arxiv.. wor.oorggaaa harg/aba/2003: 13370
Liyun Zhu, Lei Wang. Arjun Raj. Tom Gedeon, and Chen Chen. Advancing video anomaly detection: A concise
review and new dataset. The Tiirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2024.
W. Liu, D. Lian W. Luo, and Gao. Future frame prediction for anomaly detection new baseline. In 2018
IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018.
Hui Lv. Chuanwei Zhou, Zhen Cui, Chunyan Xu, Yong Li, and Jian Yang. Localizing anomalies from weakly- labeled videos. 2021.
Vijay Mahadevan, Weixin Li, Viral Bhalodia, and Nuno Vasconcelos. Anomaly detection in crowded scenes. In 2010 IEEE Computer Sociery Conference on Computer Vision and Pattern Recognition, pages 1975-1981, 2010. doi:
Hao Li, Zheng Xu, Gavin Taylor, Christoph Studer, and Tom Goldstein. Visualizing the loss landscape of neural nets. In Neural Information Processing Systems, 2018.
Huaxin Zhang, Xiaohao Xu, Xiang Wang. Jialong Zuo, Xiaonan Huang, Changxin Gao, Shanjun Zhang, Li Yu, and Nong Sang. Holmes- vau: Towards long-term video anomaly understanding at any granularity. arXiv
preprint arXiv:2412.061 02171,...61...... 2024.
Luca Zanella, Willi Menapace, Massimiliano Mancini, Yiming Wang, and Elisa Ricci. Harnessing large language models for training-free video anomaly detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 18527-18536, 2024.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In Proceedings of the 35th International Conference on Machine Learning, ICML 2018, July 2018. httpp:::: haapp:///aaxxiv org/ htsp///s//1.......// 1885/
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry, Adversarial examples not bugs, they are features. In H. Wallach, H. Larochelle, A. Beygelzimer, F. R.d' d'Alché- Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019. URL htttps:/prooeeedingg www.eeeeedinnnneneeneeeeeeeeeeee wttpp/ccccppppppeeeeeeeeeee fiapeerffileeppppeeee httpppapprr//1///// 2019/file/ 0tt00000228448800000020200111111
Jia- -ia- Zhong, Nannan Li, Weijie Kong, Shan Liu, Thomas H. Li, and Ge Li. Graph convolutional label noise cleaner: Train a plug-and- -lay action classifier for anomaly detection. In The IEEE Conference on Computer Vision and Pottern Recognition (CVPR), 2019,
Yu Tian, Guansong Pang. Yuanhong Chen, Rajvinder Singh, Johan W Verjans, and Gustavo Carneiro. Weakly- supervised video anomaly detection with robust temporal feature magnitude learning. arXiv preprint arXiv:2101.10030, 2021.
Dimitris Tsipras. Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representations, 2019. URL attpps//openreeiexx wtwp:evvviiinntffffooeeeee wtt.://w.eee/toroorddd//saaaaaaa Sty.:rrmmmd2SSxy...00..03
Naman D Singh, Francesco Croce, and Matthias Hein, Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. In NeurlPS, 2023.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael Jordan. The- orctically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, 2019b.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski. and Armand Joulin. Emerging properties in self-super vision transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 9650-9660, October 2021.
Yunjie Tian, Qixiang Ye, and David Doermann. Yolov Attention-centric real-time object detectors. arXiv preprint arXiv:2502. 12524, 2025.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks, 2016. URI. http.tttt:////aatt http://awwvvvr.///.//e/ orgg/ba////aaeeee 11d6..50..oo 01497
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018. URt //tttppe///oenrevieee net.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang. John Duchi, and Percy Liang. Understanding and mitigating the tradcoff' between robustness and accuracy. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference Machine Learning. volume 119 of Proceedings of Machine Learning Research, pages 7909-7919. PMLR, 13-18 Jul 2020. URL, https://pproeeeeingg mlr wwwppeeeiiiveeee v raghunathan20a. html
13

---

A Dataset Details
MSAD: The MSAD (Multi-Scenc Anomaly Detection) dataset is benchmark for video anomaly detection across a variety of real-world scenes. It contains a total of 920 videos, comprising 240 abnormal and 680 normal samples. The dataset is split into training set with 480 videos (120 abnormal / 360 normal) and a test set with 440 videos (120 abnormal / 320 normal). The videos span multiple surveillance scenarios, including indoor and outdoor environments, and feature diverse anomalies such as Assault, Explosion, Fighting, Fire, and more. MSAD is designed to support both frame-level and video-level anomaly detection tasks, making it suitable for evaluating generalization across heterogeneous scenes.
UCF-Crime is large-scale dataset for surveillance video analysis, comprising 1900 videos that span 13 categories of anomalous events, such as explosions, arrests, and road accidents. The training set includes video-level annotations with 800 normal and 810 abnormal videos, while the testing set provides frame-level labels for 140 normal and 150 abnormal videos. Due to computational constraints, we used only 50% of the dataset in our experiments. To ensure balanced representation, we randomly selected the samples uniformly from both normal and abnormal classes. The final dataset used for training included 410 normal and 410 abnormal videos, and the test set comprised 75 normal and 75 abnormal videos.
UCF Crime:
ShanghaiTech: The Shanghai dataset is medium collection of street surveillance videos captured from fixed angles, featuring 13 different background scenes and a total of 437 videos-330 normal and 107 anomalous. Originally intended for anomaly detection using only normal training data, the dataset is restructured for weakly supervised learning by incorporating 63 anomalous videos into the training set. This results in 238 training videos (63 abnormal and 175 normal) and 199 testing videos (44 abnormal and 155 normal), with both sets covering all 13 background scenes. We follow the same procedure to adapt the dataset for weak supervision.
TAD:
The TAD dataset consists of real-world traffic scene videos, totaling 25 hours in duration, with each video averaging 1,075 frames. includes over seven types of road- related anomalies. The dataset is divided into training set of 400 videos and testing set of 100 videos, which includes 60 normal and 40 abnormal instances.
The UCSD-Ped2 dataset is small-scale surveillance dataset comprising 28 videos. is traditionally used for unsupervised video anomaly detection (VAD), as its training set contains only normal samples. However, to enable fair evaluation of weakly supervised methods such as VAD-CLIP, we adopt a modified evaluation protocol inspired by recent literature Zhu al. 2024 Specifically, the dataset is restructured by randomly selecting six anomalous and four normal videos for training, while the remaining 18 videos (12 normal and 6 anomalous) are used for testing. This sampling process is repeated ten times, and the results are averaged to obtain stable and unbiased performance estimates. This setup allows weakly supervised models-which require video-level anomaly labels-to to be consistently evaluated on Ped2.
UCSD-Ped2:
B Performance Evaluation of the PromptMIL Framework
In FrameShield, we first trained PromptMILL using Multiple Instance Learning (MIl.)-based ap- proach with fixed prompts. (We chose not to apply prompt tuning. as we believe fine-tuning CLIP reduces the benefits of prompt optimization for our task.) In the second stage, the trained PromptMIL model was used to generate pseudo labels for the training set. These pseudo labels were then em- ployed for adversarial training, effectively transitioning the framework to fully supervised setting by applying a chunk-level loss function.
To assess the effectiveness of this approach, we initially evaluated PromptMIL under clean (non- adversarial) conditions. As shown T the model achieves performance comparable to existing state-of-the-ard methods. It is important to note, however, that this evaluation is conducted on the test set, whereas PromptMIL. is used exclusively to generate pseudo labels for the training set, for which ground-truth labels are not available.
14

---

Table 6: Frame-level detection performance (%AUROC) of our PromptMIL model trained in the first stage under clean non-adversariia) condition. AUCo and AUCA represent the AUC computed on the overall test set and only on abnormal test videos, respectively, under clean and adversarial (PGD-1000) 255
0.5 conditions.
Method
Attack
TAD
Shanghal
MSAD
AUCh
AUCA
AUCC
AUCA
AUCo
AUCA
PromptMIL Clean PGD
90.3
3,4
55.7 2.6
96.4/ 2.0
67.1
/4.1/4.7
81.2/
0.2
/.6
Table 7: Frame-level detection performanc (% AUROC) with Pseudo Labels generated by various
methods under clean and adversarial (PGD-1000, c = 255
0.5
conditions over the entire test set (AUCo)..
Method
Attack
TAD
Shanghai
MSAD
RTFM
Clean / PGD
84.6 / 74.8
88.0 85.2
76.5 74.7
MGFN
Clean / PGD
86.2 / 78.1
89.1 / 86.8
79.5 19.5/77 77.3
UMIL
Clean / PGD
85.6 / 76.0
91.3 88.5
77.5 75.4
Ours
Clean PGD
85.1 77.2
89.57 87.1
78.9 78.2
To further evaluate the robustness of our framework, we replaced our pseudo-anomaly generation module with those from other leading techniques and assessed performance under adversarial training scenarios. For additional details, refer to Appendix C
C Alternative Pseudo-Labeling Strategies to the PromptMIL Framework
To validate the effectiveness of our PromptMIL model, replaced our pseudo-anomaly generation module with those from other leading techniques, such as MGFN, RTFM, and UMIL, while keeping the second stage of the framework unchanged. As shown Table the performance remains largely consistent across these alternatives.
worth noting that PromptMIL is not considered a state-of-the-art model for pseudo-anomaly generation. However, its results are comparable to-or in some cases better than-those achieved using more advanced models. This outcome supports the hypothesis that pseudo labels generated for the training set tend to yield strong results, even when the underlying model does not generalize well unseen test data.
D Analysis of Sensitivity to the Pseudo-Labeling Threshold 7
We conduct a comprehensive analysis of the pseudo-labeling threshold r used in our framework. As discussed in the paper, of the motivations behind the SRD module is mitigate false positives and false negatives during pscudo-labe generation. The threshold r directly governs this balance:
Lower T values (classifying more frames as normal) tend increase false positives. Higher values (classifying more frames abnormal) tend to increase false negatives.
Since our task is binary classification, setting = 0.5 serves as a natural and well-defined decision boundary. In clean evaluation settings, model predictions typically confident, so small changes in T (e.g., 0.4-0.6) have minimal effect on overall performance.
Within the adversarial training framework, particularly under strong attacks such PGD, model predictions become less confident. In these cases, false positives and false negatives during pseudo- label generation become more consequential, and the choice of 7 plays more critical role in balancing these errors. Consequently, the model's 's performance varies more noticeably across different threshold values under attack conditions.
All results in Table g correspond to the adversarially trained model. The increased sensitivity to under adversarial attacks reflects the amplified impact of pseudo-labeling errors in such challenging scenarios. Overall, r = 0.5 achieves the best balance between clean and adversarial performance, confirming it robust and principled choice within our framework.
15

---

Table 8: Sensitivity analysis of the pseudo-labeling threshold т. Results are reported as Clean / PGD for both AUCo and AUCx. Performance is stable around 5 0.5, while deviations cause more variation under adversarial attacks.
Threshold (T)
TAD
Shanghai
MSAD
AUCo
AUCA
AUCo
AUCA
AUCo
AUCA
0.3
91.3 81.2
58.7 / 11.0
95.4
/99.
65.6/214
81.2 77.1
65.9
29.3
0.4
86.2 78.3
53.6 / 23.7
92.0/ /9.0
63.5/49,
80.5
77.3
63.6/530 53.2
0.5
85.1 77.2
50.9
/0.0
89.5
87.1
61.9
78.9 76.2
64.4/ 60.2
0.6
85.8 78.1
51.1 23.6
92.3/
/8.9
53.6
80.1 75.6
59.0
54.1
0.7
90.0 80.7
49.1 12.8
93.8 / 88.5
59.6 23.4
80.6 76.0
58.9
27.2
Table Comparison of frame-level detection performance (&AUROC) between fixed and progres- sively increasing during adversarial training. Results show that gradually increasing from 0.1 to does not yield significant improvement using fixed
255
2.0
255
Method
Attack
TAD
Shanghai
MSAD
AUCo
AUCA
AUCo
AUCA
AUCo
AUCA
Gradually Increase
Clean PGD
86.2 73.0
51.3/311
88.1 86.5
61.2/59.3
79.4 75.9
65.1 59.33
Ours
Clean PGD
85.1 77.2
/3.9/30.0
89.5 87.1
62.3 61.9
78.9 76.2
60.4
E Detailed Analysis of Values During Training and Testing
In this section, analyze the effect of different values. First, explore method aimed at enhancing adversarial robustness for larger values and high-dimensional data.
Shaeiri et al. [2200] building the intuition behind weight initialization strategies in deep learn- ing com-coym effective various optimization scenarios Li al. ( propose a progressive approach to adversarial training. Specifically, they suggest starting with a small perturbation magni- tude and gradually increasing it throughout training. As shown Table we implemented this 2.0 across epochs. However, the results indicate significant improvement over training with a fixed e value.
by linearly increasing from 0.1 to
255 255
Next, we examine the impact of training with higher e values in the context of Video Anomaly Detection (VAD). We selected c = 255 for training and evaluation, as we observed that excessive perturbation magnitudes can destabilize training and severely degrade even the clean performance of the model. To validate this, we conducted an experiment on the Shanghai dataset, which includes frame-level ground truth annotations for both the training and test sets. We trained FrameShield using the real labels supervised setting. Under normal conditions (i.e., without attack), the model 2
expected to perform well. However, as shown in Table 10 training with 255 or 255 leads to unstable behavior and poor clean performance. In contrast, training with lower e values results in stable learning and satisfactory performance both under clean and adversarial conditions, thus supporting our hypothesis.
F Effect of Label Noise in Adversarial Training
Adversarial training based solely pseudo-labeled data impractical due the inherent inaccuracies introduced by pseudo-labeling methods. These inaccuracies, typically in the form of false positives (FP) and false negatives (FN), contribute what commonly referred to as label noise. To mitigate this issue, we incorporate pseudo-anomalics into our training process.
In this section, explain the effect of label noise and why we believe that label noise in the adversarial training setup can be even more detrimental.
Label cidse-especiallyy in tasks involving anomaly detection-cae can significantly degrade the learning process. False positives introduce normal instances that are incorrectly labeled as anomalous, while false negatives cause true anomalies to be mistakenly treated as normal. In standard supervised learning, such noise reduces classification accuracy and generalization. However, in adversarial training. the impact is amplified for the following reasons:
16

---

Table 10: Frame-level detection performance (% AUROC) of our model trained under different PGD attack strengths values) on the fully supervised Shanghai dataset. All test-time PGD attacks in the table (bold and black numbers) are performed with 0.5 on the entire test set and on abnormal test videos only, respectively.
255 AUCo and AUCA represent the AUC
Training-time
(Clean)
315
TM
AUCo
AUCA
AU
AUCA
AUCo
AUC
AUCo
AUCA
AU/o
AUCA
Shanghai
98.1 2.1
83.6 1.4
96.2
/2.8
75.3 60.6
95.4 90.1
71.6/ 67.2
68.1
26.1
69.7
15.4
63.4 23,9
65.3/ 12,9
Table 11: Evaluation of FrameShield's robustness when trained using PGD-10 with an &oo norm at 0.5 and tested against PGD- 1000 attacks using & norms with varying c values. The results 255
indicate that the model maintains consistent robustness across different attack types.
TAD
Shanghai
MSAD
AUCo
AUCA
AUCo
AUCA
AUCo
AUCA
Clean
85.1
50.9
89.5
62.3
78.9
64.4
16
79.6
34.2
85.7
60.0
76.4
59.9
255
32 265
78.4
31.2
84.5
59.8
75.3
58.0
64
65.8
20.5
70.4
51.7
62.9
49.3
255
First, consider case where a real anomaly is mistakenly assigned "normal" pseudo-label. Adver- sarial training will push this instance deeper into the "anomaly" region of the feature space. However, the loss function (e-g., cross-entropy) will penalize the model for predicting such an instance as normal-even though the label is incorrect- introducing contradictory signals. Conversely, if a normal sample is wrongly labeled as an anomaly, adversarial training will exaggerate its normal characteristics. The model is then simultaneously forced to treat this increasingly normal instance as "anomalous." These contradictions lead the model to overfit on noisy labels and attempt to learn complex, unstable decision boundary.
interesting phenomenon we observed occurs when applying MIL-based loss function with max max- aggregator. If a false negative (i.e., an anomalous instance labeled as normal) is present in bag (e.g., a video with many frames), adversarial training tends amplify the anomaly traits of that instance. Consequently, the model assigns it high anomaly score. Due to the max aggregation strategy, this high-scoring instance dominates the bag-level prediction. The model then applies the cross-entropy loss to force the prediction back toward "normal," despite the fact that the instance is truly anomalous.
As result, during training, false negatives are consistently selected during the aggregation step due the effect of adversarial perturbations. The loss therefore repeatedly computed on incorrectly labeled samples. This persistent misalignment between the label and the actual instance leads the MIL loss under adversarial training to fail train properly, ultimately preventing the model from converging when noisy labels are present.
G Robustness Evaluation Against PGD Attacks with l Norm
To evaluate the robustness of model, conducted experiment in which FrameShield was trained and tested using PGD attacks under the same for norm with varying c values. Specifically, the used during training matched the used during evaluation. As shown in Table the results demonstrate that FrameShield maintains strong performance across a range of e values, indicating its robustness to different levels of adversarial perturbation.
H Component-wise Ablation Study of the SRD Module
In this section, we assess the effectiveness of the individual components of our SRD module. As shown in Table [2] we first replace the Srad--CA--based foreground selection with bascline that
17

---

Table 12: Comparison between our Grad-CAM-basse foreground selection and a random region base- line. The results demonstrate that using Grad-CAM significantly improves foreground localization, validating its effectiveness within the SRD module.
Method
Atlack
TAD
Shanghai
MSAD
AU
AUC
ACCb
AUCss
AUCo
AUCA
Randon Region Distortion
Clean / PGD
81
/4..5
Ours (Grad-UAM)
Clean PGD
85.1 77.2
50.9
30.0
89.5 87.3
62.37
61.9
78.9 76.2
60.2
Table 13: Performance comparison of our curved vector-based motion approach with two alternatives: no motion and random location transfer. Our method consistently outperforms both, highlighting the importance of structured temporal transformations in anomaly modeling.
Method
Attack
TAD
Shanghal
MSAD
AUCo
AUC
AUCo
AUC,
AUCa
ADCC2
No Motion
Clean / PGD
77.9/53.2
50.3/9.7
8
60.2/288
71.6/ 58.9
39.9/31.2
Random Location Transfer
Cleas/ / PGD
82.3/644 64.1
/0.3/218
82.1 7782
61 11.4/458
70.21 62.7
61.8 /
Ours
Clean 7 PGD
8 77.2
50.97300 30.0
89.5 18.3
02.3/ 61.9
78.91 76.
64.4/ /602
selects random region in the frame and applies curved vector in random direction. The results demonstrate the clear advantage of our method in identifying foreground objects. Nonetheless, we acknowledge that Grad-CAM not an optimal solution; in future work, the foreground detection component could be enhanced using more advanced models, such as pretrained object detectors.
To further assess the contribution of temporal modeling, we conducted additional ablation studies. In these experiments, we replaced the curved vector-based motion with two alternative strategies: (I) No Motion, and (2) Random Location Transfer. In the first setting, all frames were distorted in the same region without any motion, but with newly applied harsh augmentations. In the second setting, after distorting region in the first frame of sequence, the subsequent frame and pasted the distorted region from the first frame onto it, again applying a new set of harsh augmentations. As shown in Table 13] our method outperforms both alternatives, highlighting the effectiveness of our temporal modeling strategy.
randomly selected a position in
I Detail of adaptation methods for various attack
Adversarial attacks were initially introduced for classification tasks. These attacks involve adding small, imperceptible perturbations to the input data of a neural network to increase its loss function. In classification, the input is typically a single image, and the output consists of logits corresponding to each class, representing the probability of the input being classified into a specific category. One of the most widely adopted and well-established attacks in this domain is PGD-1000, which thoroughly describe in Section 3, including its adapted version for VAD. Subsequently, researchers have proposed even more powerful attacks further challenge model robustness-among the most notable are AutoAttack and A (Adaptive AutoAttack). We also adapt these attacks to suit the VAD setting by reinterpreting their classification- based evaluation strategies. In such settings, models output class logits, and attacks typically optimize losses like cross-entropp or DLR. However, these formulations do not directly translate to Video Anomaly Detection (VAD), where models output continuous, chunk-wise anomaly scores rather than class probabilities. To adapt these attacks to VAD, we define a task-specific loss function:
M
LVAD = Σ Y, (.
Here Y; E {-1,+11) is the attack direction label: +1 for normal chunks (to increase score), - for abnormal chunks (to decrease score), and m the total number of chunks. We adapted AutoAttack by replacing the cross- and DLR losses in its APGD and FAB components with (V)D(V). The DLR loss, which assumes at least three output logits, was removed entirely due to its incompatibility with scalar outputs. The Square Attack component remained unchanged, as it operates independently of the loss formulation and inherently compatible with score-based tasks like VAD. The A framework was also adapted for the VAD setting. Unlike AutoAttack, which combines multiple attack methods, A is a standalone attack strategy that enhances robustness evaluation through two core mechanisms; Adaptive Direction Initialization (ADI) and Online maatistccs-base Discarding
18

---

Table 14: Adversarial training results of PromptMIL using video-level perturbations generated by a MILL-based attack with a Max aggregator. The results indicate no significant improvement in robustness, underscoring the weakness of this adversarial training strategy.
Method
Attack
TAD
Shanghai
MSAD
A7CC
AFFCs
AU/C
AUCAA
AUCo
AUCA
MIL--aase Loss Adv Training Ours
Clean PGD
86.2/ 26,1
52.7 5.9
87.3 37,1
59.7 152
79.1
26.6
65.0/11.3
30.0
89.5
(OSD). To apply A in the context of video anomaly detection, we retained our custom VAD- specific loss function-used also in the PGD adaptation-thal manipulates anomaly scores degrade detection performance. The ADI component accelerates convergence by learning model-specin perturbation directions from successful restarts and reusing them to generate more effective adversarial examples. Meanwhile, OSD improves efficiency by identifying and discarding hard-to-attach video segments during the attack process, thereby reallocating computational effort toward casier-to- attack samples. These two mechanisms work together within A to generate adversarial videos that effectively degrade a model's ability to distinguish between normal and abnormal chunks under a limited computational budget.
J Training FrameShield with MIL-based Loss
As shown in Table 3, video-level adversarial attacks based on the MII. framework are relatively weak and ineffective. To further investigate this limitation, train PromptMIL. model using a MILL-based loss function and adversarial examples generated through video-level perturbations, utilizing Max aggregator. As reported in Table [4] this adversarial training strategy fails to enhance model robustness, further confirming the inadequacy of using such weak adversarial examples for training.
K Comparison with Multimodal LLM-based Methods
Recent advances in video anomaly detection (VAD) have introduced multimodal large language model (LLM)) approaches such as Holmes-VAr Zhang et al. (2024) and LAVAD Zanella et al. [024], which integrate visual encoders with pretrained language models for video semantic understanding. These methods can exhibit stronger general robustness to low-level pixel perturbations than traditional MIL feature aggregation models. To investigate whether such understdddtt.. based approaches are also vulnerable to adversarial perturbations, we conducted targeted adversarial attacks on both Holmes- VAU and LAVAD under conditions consistent with our evaluation setup.
Both Holmes VAU and LAVAD employ captioning-bass based pipelines in which visual encoders produce embeddings that are then decoded into textual descriptions by LLMs. Specifically, Holmes- VAU uses
combining the Intern ViT-300M image encoder with InterLLM2-hhat-1 as the language model. LAVAD adopts BLIP-2, which integrates a pretrained CLIP image encoder, Q-former, and OPT-6.7B 7B as the text decoder.
Adversarial Attack Setup. We treated each captioning model as end-to-end system and applied PGD-1000 attacks to generate adversarial examples designed to alter the generated captions. For Holmes-VAU, we uniformly sampled 12 frames from each video and used prompt such as: "Could you specify the anomaly events present in the video?" Under adversarial perturbations, we enforced target captions to induce misclassification. For normal videos, forced the model output: "There an anomaly in the video; two cars have an accident." For anomalous vidcos, we guided the model to output: "There is abnormal event; everything goes normal."
To adapt the attack to the autoregressive decoding process of L.LMs, the target captions were injected into the context window rather than allowing the model to condition on its own previous tokens. A similar procedure was applied to LAVAD, where adversarial frames were fed to the BLIP-2 model to produce misleading captions subsequently used for downstream anomaly scoring.
We evaluated both models under PGD-1000 attacks on the UCF-Crime and ShanghaiTech datasets and compared them with FrameShield. Results are summarized in Table [5
Results and Analysis.
19

---

Table 15: Comparison with multimodal LLM-based video-understanding methods under PGD-1000 attack. Results are reported as Clean PGD AUCo (%). FrameShield maintains high robustness. while VAAU and LAVAD exhibit substantial degradation under attack.
Method
Shanghai
UCF-Crime
Holmes-VAU
95.6 16.0
88.9 / 14.2
LAVAD
91.0 21.4
80.3 / 18.7
FrameShield (Ours)
89.5 / 87.1
80.2 / 78.7
Table 16: Evaluation of FrameShield under white-box (PGD-1000) and black-box (NES, Bandit) attack settings. Results are reported as AUC AUCA (%). FrameShield maintains strong robustness across both threat models.
Attack
TAD
UCF-Crime
MSAD
Clean
85.1 50.9
80.2 60.1
78.9 64.4
PGID-1000 (White-box)
77.2/ 30.0 30.0
78.7
78.7/53.4 53.4
76.2 60.2
NES (Black-box)
84.2 44.5
/8.1
78.4/ 64.1
Bandit (Black-box)
83.5 43.9
79.3/ 57.7
77.9 63.8
Although multimodal LLM- -.-M-ddaeeddd- methods show stronger baseline robustness than traditional MIL- based approaches, both are still highly susceptible to strong, targeted adversarial perturbations. Notably, Holmes-VAU--a pru--rocesiing 12 frames jointly-was more vulnerable than LAVAD due to its higher input dimensionality. FrameShield achieved significantly higher robustness while maintaining competitive clean performance.
These results indicate that although multimodal LLM-based frameworks like Holmes-Var VAU and LAVAD possess enhanced semantic understanding and resilience to benign noise, they remain highly vulnerable to carefully crafted adversarial perturbations. FrameShield consistently outperforms both methods under attack, highlighting its effectiveness preserving robustness against adversarial manipulations targeting both visual and semantic cues.
L Evaluating FrameShield in the Black-box Setup
To further assess the robustness of FrameShield beyond the white-box setting, we evaluate its performance under black-box adversarial attacks. Unlike white-box attacks the adversary has full access to model parameters and gradients-black-bee relying only on model queries to estimate gradients. Although white-box attacks are less common in real-world applications, they provide rigorous benchmark for stress- tress-testing robustness. Importantly, models that demonstrate resilience the white-box setting often maintain robustness against weaker black-box perturbations.
attacks assume limited knowledge,
To validate this hypothesis, we conducted black-box experiments using two representative query- based attack algorithms: the Natural Evolution Strategy (NES) Ilyaas et al. (0018) and the Bandit attack [llyas al. 2019). Both methods iteratively approximate gradients through queries without direct access to model internals.
Table 16 summarizes the results on three representative benchmarks. As expected, FrameShield exhibits smaller performance degradation under black-box settings compared to white-box PGD-1000 attacks, confirming that robustness acquired through adversarial training effectively transfers to more realistic threat models. These findings demonstrate that FrameShield maintains strong resistance to both white-box and black-box adversarial perturbations.
M More Detailed Related Work
Video anomaly detection (VAD) is a critical computer vision task with real-world applications in manufacturing, healthcare, and public safety, where detecting abnormal events such as accidents, fights, or equipment failure can mitigate risks and prevent losses. However, annotating anomaly data at the frame level is extremely expensive and time-consuming due to the rare and ambiguous nature
20

---

of anomalous events. This challenge has motivated two dominant research paradigms: unsupervised methods, which learn only from normal data, and weakly-supervised methods, where only video-level anomaly labels are provided without precise temporal annotations. In recent years, the weakly supervised video anomaly detection (WSVAD) setting has gained significant traction due to its good balance between annotation burden and detection performance.
Most SOTA WSVAD methods leverage the Multiple Instance Learning (MIL) framework, treating each video as bag of instances (snippets) under the assumption that at least one snippet in an anomalous video exhibits abnormal behavior. Although recent WSVAD methods have achieved near-perfect performance on standard metrics, their vulnerability to adversarial attacks remains a critical issue that threatens their reliability in real-world deployments.
Current WSVAD models predominantly rely on frozen pretrained architectures such as 13D, C3D, Swin TrainTrraforrrr,, and CLIP, which are originally trained on large-scale datasets. These models serve to reduce dimensionality and extract meaningful embeddings for anomaly detection. However, they are inherently susceptible to adversarial manipulations, demonstrated by |Schlarmann al. (2024), J Chen et al. [2019]. Li et al. [2021]. indicating a substantial gap in adversarial robustness within the WSVAD landscape.
The introduction of WSVAD as a MIL-based problem began with Sultani et al. (2018). who proposed large-scale dataset alongside straightforward yet effective MIL-based method that relies on selecting snippets that look most suspicious. Despite its effectiveness, standard MIL approaches often suffer from label noise and limited temporal granularity, which can impair detection accuracy.
To address these issues, /Zhng et al. (2019) reformulated WSVAD as a binary classification problem with noisy labels and employed graph convolutional network (GCN) to suppress noise. While effective, this approach is computationally intensive and can produce an unconstrained feature space. To overcome these limitations, TTin et al. [2021] proposed RTFM, which learns from feature pngnitudes-eeccuuran
higher magnitudes for abnormal snippets-and introduced a Multi-scale Temporal Network (MTN) to model both short- and mangre temporal dependencies, enhancing robustness against noisy frames. Subsequently, AGGFN/Cher et al.] [2022] improved the modeling of temporal relations by employing transformer-basee
ladee-and-foous mechanism with contrastive loss to better distinguish between normal and abnormal patterns. Additionally, UR-DMU Zhou et al. 2023 introduced dual memory units and uncertainty modeling to better distinguish between normal and anomalous data. Further advancements include UMIL [Lv et al.] (0033). which addresses the bias in traditional MIL by proposing unbiased training framework that leverages both confident and ambiguous snippets. It applies feature-space clustering to identify latent pseudo-labels for uncertain snippets and incorporates them into the training using contrastive loss and end-to-end fine-tuning.
recent wave of research explores the integration of Vision-Langure Models (VLMs) like CLIP for WSVAD. These models leverage semantic richness and textual understanding to enhance anomaly detection. For instance, UMIL utilizes CLIP as a feature extracto. CLIP-TSA Joo et al. 2023 employs CLIP as visual feature extractor and models long- and short-range temporal dependencies through Temporal Self-Attention (TSA). Additionally, CLIP-VAD Wu et al. (2024) enhances anomaly detection by incorporating extra supervision for different types of anomalies in videos (e.g., abuse, arrest, assault, etc.) along with learnable prompts. It also integrates a Local-Global Temporal Adapter (LGT-Adapter) effectively capture both short-term and long-term dependencies. Furthermore, TEVADDCCeel et al. (2023) proposes the use of SWinBERT (vulnerable backbone) for video captioning to enhance semantic understanding. It then fuses these caption-based features with I3D-extracted visual features through Multi-Scale Temporal Networks (MTN).
Overall, the evolution of WSVAD methods reflects shift towards more sophisticated temporal model- ing. enhanced feature extraction, and the integration of multi-modal approaches like Dision-language models. However, despite these advancements, the reliance on vulnerable feature extractors and the lack of real frame-level labels hinder the practical application of adversarial training, leaving these models notably unrobust and vulnerable attacks.
N Adversarial Training of Baseline Methods
To ensure a fair comparison, we additionally adversarially trained several baseline methods using the same adversarial training protocol as FraleShield. While the original versions of these models were
21

---

Table 17: Comparison of adversarially trained basclines under clean and PGD-1000 attack settings. Results are reported as Clean PGD AUC (%). FrameShield maintains superior robustness while preserving competitive clean performance.
Method
Attack
Shanghai
TAD
MSAD
AUCo
AUCC
AUCo
AUCA
AUCo
AUCA
RIFM
Clean / PGD
88.7
17.3
63.1
83.4 33.4/16.0 16.0
51.0/ 8.0
80.1
67.9 3.2
VAD-CLIP
Clean / PGD
93.1/ 15.4
61.5/9.7
88.4/ 14.2
53.9/10.3 10.3
-1-
Base MIL
Cleun PGD
89.0/ 17.2
61.2/4.9
82.9/14
4..3/3.3
77.6 19.8
60.5/22 2.1
UMIL
Clean / PGD
91.4/
18.3
63.3/9.0
87.8 19.7
4
7 /
66.7 4.5
FrameShield (Ours)
Clean PGD
89.57
62.37
85.1 77.2
50.9 30.0
76.9
64.4/
trained only under standard conditions, this extension allows a direct evaluation of how well existing approaches adapt to adversarial optimization. The cesults- both clean and adversarial (PGD) performance-are summarized in Table
Across all datasets, the adversarially trained baselines exhibit substantial degradation in clean accuracy and limited improvement in robustness. In contrast, FrameShield maintains strong performance under both clean and adversarial conditions. This discrepancy can be attributed to several key limitations in prior works. Methods such as RTFM and VAD-CLIP employ frozen feature extractors (e.g., I3D or CLIP), preventing the backbone from adapting adversarial perturbations during training. MIL-based models like Base MIL and UMIL rely on hard MAX temporal aggregation, which restricts gradient propagation and undermines the effectiveness of adversarial optimization. Moreover, approaches such as UMIL are highly sensitive to noise in pseudo-labels, and this issue is further amplified under adversarial perturbations.
FrameShield addresses these limitations through three main design strategies, First, the model is trained in a fully end-to-end manner, allowing the backbone adapt adversarially perturbed data. Second, frame-level binary pseudo labels replace unstable MAX aggregation, resulting in smoother gradient flow and more stable optimization. Finally, the synthetic region disturbance (SRD) module introduces controlled perturbations that reduce the impact of false positives and false negatives, improving robustness against label noise. Together, these design choices enable FrameShield to achieve both high clean accuracy and strong adversarial robustness, significantly outperforming other methods even when they are adversarially trained.
O Discussion on Clean vs. Adversarial Trade-off
A common concern in adversarial robustness research is the trade-off between clean and adversarial performance. We provide additional clarification and empirical evidence here. While FrameShield shows reduction in clean accuracy under adversarial training, this outcome is consistent with well-established phenomenon: improving adversarial robustness often comes at the cost of reduced clean performance. This trade-off not a limitation unique our approach but is intrinsic robust optimization in general. As noted in the limitations section, the tension between clean accuracy and robustness has been extensively studied in prior work Tsipras et al. [2019]. For instance, on ImageNet, the robust variant of ResNet-50 has been reported to drop from 75.8% to 65.8% % in clean IaaditionsSSngglee et 2023 J. emphasizing that such declines are expected and not indicative of design flaws. Importantly, when FrameShield is trained without adversarial perturbations, it demonstrates competitive clean accuracy, validating its effectiveness under standard training conditions. This outcome underscores that the observed trade-off is an inherent characteristic of adversarial training methodologies rather than limitation of the Fhimedhield technique. The results are summarized in Table 18 Overall, we emphasize that this trade-off is natural and widely recognized consequence of ad adversarial training, not a sign of underperformance.
Experiments with TRADES Loss. We also explored alternative adversarial training objectives to better balance clean and robust performance. particular, we incorporated the TRADES loss Zhang
et al. 2019b into FrameShield. TRADES explicitly separates natural and boundary losses, encour- aging the model to align predictions on adversarially perturbed frames with those on original frames via cross-entropy consistency term.
22

---

Table 18: AUCo scores (%) under clean and PGD adversarial settings. Results are reported as Clean / PGD. FrameShield (ours) demonstrates strong robustness while maintaining competitive clean performance.
Method
Attack
UCSD Ped2
Shanghai
TAD
UCF Crime
MSAD
RTTM
Clean PGD
98.6/ 2.4
97.2/ 8.5
89.6 6.3
8
86,6 / 10.0 83.8/6,1 -/-
UMIL
Clean / PGD
94.2 6.9
/2.8
92.9/3.0 3.0
86.8 4.7
VAD-CLIP
Clean / PGD
98.4/ 6.3
97.5 3.6
92.7
88.0/ 8.2
Ours (Adv. trained)
Clean / PGD Clean PGD
97.1 81.3
89.5 87.1
85.1 77.2
80.2 78.7
78.9 76.2
Ours (Clean trained)
98.6 8.0
97.47
93.477.4
87.87 9.3
86.3 /
Table 19: Comparison between FrameShield trained with the standard adversarial loss and the TRADES loss. Results are reported as Clean / PGD. While TRADES improves clean accuracy slightly, it reduces robustness under PGD attack.
Metlod
Attack
Shanghai
TAD
UCF Crime
MSAD
AVCC
AUCG
AFCC
AU/C
AVC.
AUCGs
AFCC,
TRADES
95.2 788
64.7/32.7
90.1 Y6.5
55.1
824/67.1
60.8/ 25.6
80.5
67.//44 (4.7
Ours (Default Lawa)
Clizn PGD
89.5 87.1
60.1/619
88 19933
50.9 30.
80./ P6.7
60.1 5384
78.9/ 76.2
64.4
/60.
Table 19 summarizes the results. While the TRADES loss led to slightly improved clean accuracy compared standard adversarial training, it also caused noticeable drop in robustmess across all datasets. This aligns with observations in prior research that TRADES can provide smoother decision boundaries but sometimes reduces robustness under strong perturbations. Overall, FrameShield's de- fault loss yields a more favorable balance for video anomaly detection, maintaining higher robustness while remaining competitive in clean conditions.
P Implementation Details
We conducted adversarial training for 40 epochs using the AdamW optimizer with learning rate of 8 x 10-6, a chunk size of 16 frames and 0.5 A cosine scheduler was employed to gradually 255
2 NVIDIA GeForce RTX 4090 GPUs (24 GB), with the pipeline completing in approximately 30 hours. Additionally, to train PromptMIL with X- X-Clip Ma al. 2022 as feature extractor and get pseudo-labels, we required approximately 4 hours.
decrease the learning rate. We conducted
experiments
Q Detailed Results
Table 20 summarizes the performance of our method (Mean + STD %) under both clean and adversarial conditions across five video anomaly detection datasets: UCSD-Ped2, ShanghaiTTech TAD, UCF Crime, and MSAD. The standard deviation is computed over five runs with different random seeds. The consistently low variance observed across all datasets and evaluation scenarios demonstrates the robustness and reliability of our approach.
R Discussion on Foreground Detection in the SRD Module
common concern regarding SRD is whether Grad-CAM which we employ in the SRD module, is an optimal choice for foreground detection. Alternative methods such as object detectors attention maps (e.g., from DINOv2) might appear better suited for identifying meaningful regions. We address this concern below with additional analysis and experiments. First, we acknowledge that Grad-CAM is not a dedicated foreground detection tool. This limitation is explicitly noted in the main paper. However, its use in the SRD module motivated by its simplicity, interpretability. and compatibility with our adversarial training framework.
Experiments with Alternative Localizers. To evaluate the importance of localization, we sub- stituted Grad-CAM with more semantically grounded approaches: DINO attention maps Caron et al. 202T), YOLO Tian et al. [2025), and Fast R-CNN Ren al. [2016). All other SRD compo- nents including motion trajectory modeling, temporal coherence, and perturbation generation- -wee
23

---

Table 20: Frame-level detection performance (Mean STD %) under clean and adversarial conditions across selected datasets over the entire test videos (AUCo).
Statisties
Eval Type
UCSD-PPd2
Shanghai
TAD
UCF
MSAD
Clean
97.1 1.2
80.5 1 1.7
85.1 1 0.7
80.2 1 1.3
78.9 1 1.6
Mcan STD
Adv
81.3 + 0.9
87.1 + 2.0
77.2 1.4
78.7 + 0.8
76.2 1.8
Table 21:
Comparison of different foreground detection methods under clean and PGD settings. Values are reported as Clean PGD. Results show that while stronger localizers (YOLO, Fast R-CNN, DINO) yield comparable performance, the SRD module's temporal modeling and perturbation design play more critical role than localization precision.
Method
Attack
TAD
Shanghai
MSAD
AUCo
AUCA
AUCo
AUCA
AUCo
AUCA
YOLO
Clean / PGD
85.7/75.2
51.2/31.2
90.3 88.4
60.7 59.8
76.8
63.8 58.9
Fast R-CNN
Clean / PGD
82.6/
48.3/ 26.7
87.7
58.9
74.2/71.8
60.7
DINO Áttentinn
Clean
86.7 78.1
32.3/33.1
88.3
60.8/60.3
79.1/75.9
64.5/
Ours (Grad-CAM)
Clean PGD
85.1/77.2
50.9/30.
89.5 87.1
62.3/61.9
76.2
64.4/ 60.2
kept unchanged, allowing us to isolate the effect of localization. The results are summarized in Table Across all experiments, replacing Grad-CAM with YOLO, Fast R-CNN, or DINO attention did not yield significant improvements. This suggests that the SRD module's s strength lies more in its perturbation generation and temporal modeling than in precise foreground detection.
S Pseudo-Anomaly Examples
In this section, we present examples of pseudo-anomalous data generated by our SRD module, along with their corresponding Grad-CAM visualizations. In Figure we illustrate the distortion process across sequence of frames. The top row shows the original (normal) frame sequence and the Grad-CAM heatmap of the first frame, while the bottom displays the corresponding distorted (anomalous) frames.
T Pseudocode of FrameShield
present the pseudocode in Algorithm Saaritthm[oo for our FrameShield framework, which comprises two sequential phases: (1) weakly supervised training using the proposed PromptMIL formulation, and (2) fully supervised adversarial training using pseudo-anomalies generated by our SRD (Spatiotemporal Region Distortion) module.

---

Algorithm FrameShield: Robust Video Anomaly Detection
Require: Training set of videos D {(V,, yi)3 with video-level labels, pretrained X-Clip model, text prompts in ("Normal") and ta (" ("Abnormal")
Ensure: Robust anomaly detector
1: // Phase 1: PromptMIL Training
2: for each video V; in D do
3: Partition V; into m chunks: V; {U2, 21,, 3m
4: for each chunk b; do
5: Extract feature: f, t Fe(Uz)
6: Compute dot products: 8j + Jj las 67 + Sa ln
7:
Compute softmax: Sj c softmax (8)
8:
end for
9: Aggregate anomaly score: 5; + max, Sj
10: Compute loss: L;- +- BCE(S.,
11: end for
12: Update model Fe using total loss E, L
// Generate Pseudo-Labels
14: for each abnormal video in D do
Recompute S, for each chunk using trained Fe
16: Assign pseudo-labels; Ú, + vss, 7] (thresholded)
17: end for
18: // Phase 2: Adversarial Training with SRD
for each normal video do
20: if random() < PSRD then With probability PSRD, generate ayeudo-anomall using SRD
21:
Generate SRD pseudo-anomalies V:
Select random frame sequence; apply Grad-CAM locate salient region Apply mask and augmentations to create spatial distortions
23:
24:
Introduce motion trajectory for temporal distortion
25:
Assign label MSRD <-1
26: end if
27: end for
28: Merge real videos with pseudo-labeled and SRD-augmented data
29: for each video V with chunk-wise labels Y {vi,..., ..., Vm do
30: for each chunk vi do
31:
Compute anomaly score S, <- Fe(u,)
32:
Compute loss: Lg + (C)((),y))) end for
33:
34: Total loss IN - Lv, L.j
35:
Generate adversarial perturbation 8* + arg 6| Se (v (V + +
36:
Update Fe with (V + 8", Y) using min- max optimization
37:
end for
U Limitations
Clean Performance Video Anomaly Detection This work focuses on enhancing the robustness of video anomaly detection models against adversarial attacks. While approach shows notable gains in adversarial detection, its performance on clean aon--advrsariil) data remains below that current SOTA methods. This reflects the well-known trade-off between clean and adversarial performance,
as highlighted in prior studies Zhang et al. 2019b] Tsipras et al. 2019 Madry et al. (018 and Raghunathan et al. [2020].
Using Grad-CAM for Object Localization While Grad-CAM serves as practical tool for identify-
ing salient regions in static frames, its use within SRD brings certain inherent limitations. Grad-CAM a gradient- visualization technique developed primarily for classification models and does not explicitly model objectness spatial boundaries. As result, highlighted regions may be diffuse or
25

---

imprecise, potentially including background clutter or missing parts of coherent objects. Furthermore, since Grad-CAM relies on the internal feature activations of pre-trained network like ResNet18 He et al. 2016]. its saliency maps reflect class-discriminative attention rather than true object local- ization. This can lead to suboptimal or inconsistent masks, especially in complex low-saliency scenes. Employing dedicated object detectors in place of Grad-CAM could yield more accurate and semantically meaningful regions, improving both the realism and control of the generated anomalies.
26

---

Original
Grid-CAM
Frume;
F I
Frame
Frame
Pseudo Anomaly
Original
Grad-CAM
Frame;
Frame;+1 1
Frame 1+2
Frame
Pseudo Anomaly
Original
Grad-CAM
Frame;
Frame;
Frame 12
Frame;
Pseudo Anomaly
Figure Visualization of anomalous data generated by the SRD module. The top row shows the original (normal) sequence of frames along with the Grad-CAM heatmap of the first frame. The bottom row displays the corresponding distorted aneudo-anomalous frames created by applying the SRD distortion strategy.
27

---

Original
Grad-CAM
Frame;
Frame;+1
Frame
Frame
Psendo Anomaly
Original
Grad-CAM
Frame;
Frame;+ 1
Frame;+2
Frame;+k
Pscudo Anomaly
Figure 5: Visualization of pseudo-anomalous data generated by the SRD module. The top row shows original (normal) sequence of frames along with the Grad-CAM heatmap the first frame. The bottom row displays the corresponding distorted (pseudo-anomalous) frames created by applying the SRD distortion strategy.
28

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract effectively summarizes the paper's contribution and provides a concise overview of our approach. Additionally, the introduction accurately outlines the scope and applications of our work, while also emphasizing our key contributions.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: We specifically created a section dedicated our work's limitations in Ap- pendix U Importantly, we believe our assumptions are relevant to real-world scenarios and can be easily justified.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged
the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
29

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide the code necessary to reproduce our results and all implementation details are explained in Section 5 and Appendix B
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
30

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: All the datasets and processing pipelines for the MSAD dataset, which is private. We obtained research access to through its official website.
thoroughly detailed, except
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
htiips.cc/public//gee
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We provide detailed explanations training and test details in Appendix
A
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The mean and standard deviation of our method's performance over multiple runs, along with additional details of the main experiment, are provided in Appendix Q
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
31

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: In Appendix we present details computational resources and execution time.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't itdn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:///wwwrrrpss.cppullecce/eee wtwp:/hhhhicccciiiieeeeieeeee
Answer: [Yes]
Justification: After carefully reviewing the NeurIPS Code of Ethics, we firmly believe that our work fully adheres to its principles. We have taken care to ensure that no aspect of our research-including the code and publicly available datasets used.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the social impacts of our work in Section 1
Guidelines:
32

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles. surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [Yes]
Justification: The methods propose designed to enhance the reliability of existing models and are not intended for applications that could lead to harmful consequences. Moreover, our work builds upon established techniques, none of which have been associated with safety concerns.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging. and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All previous works which our work is built upon are mentioned and cited in sections I [nd Furthermore, all datasets used are thoroughly credited and their licenses, available, are mentioned in Appendix A
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
33

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thcode com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-pan se-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Our method does not introduce any new assets. Most of the datasets are publicly available with accompanying documentation. The MSAD dataset, while not openly accessible, can be obtained by submitting an access request via email-no payment is required.
Justification:
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details the dataset/code/mooel as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve the collection of any crowdsourced or human subjected datasets.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for rescarch with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
34

---

Answer: [NA]
Justification: Our paper does not involve crowdsourcing, and all datasets used are cited and publicly available. Therefore, IRB approvals applicable work.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
The core method development in this research does involve the of Large Language Models (LLMs) as important, original, or non-standard components, LLMs were not used in the design, implementation, or evaluation of the proposed approach.
Justification:
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should not be described.
35


Reviews:
[{"review_id": "f2YTKJjyAJ", "reviewer": "Reviewer_jHRc", "summary": "This paper addresses a critical weakness in current Weakly Supervised Video Anomaly Detection (WSVAD) models: their vulnerability to adversarial attacks. The authors argue that standard adversarial training fails because it relies on video-level labels, which are too coarse. To solve this, they propose FrameShield, a two-phase pipeline. First, it generates noisy frame-level pseudo-labels from a standard WSVAD model. The key contribution is the second phase, which introduces Spatiotemporal Region Distortion (SRD) to create synthetic anomaly videos with perfect frame-level labels. By combining these clean synthetic anomalies with the noisy real ones for adversarial training, FrameShield makes the model significantly more robust to attacks while maintaining good performance on clean data.", "questions": "1. You note a drop in clean accuracy, which is a known trade-off. Have you considered using other adversarial training losses, like the one in TRADES, to see if it helps better balance accuracy and robustness?\n2. You mention that Grad-CAM is not perfect for localization in the SRD module. Did you run any experiments using a proper object detector instead of Grad-CAM to see if it improves the quality of synthetic anomalies and the final results?\n3. How did you choose the threshold $\\tau$ for generating pseudo-labels? Is the model's final performance very sensitive to this hyperparameter?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths:\nThe paper's main strength is that it tackles a novel and very important problem: the adversarial robustness of WSVAD models, which is often ignored. The proposed FrameShield method is well-designed, particularly the clever SRD module that generates synthetic data to overcome the noisy pseudo-label issue. The experimental evaluation is another major strength; it is very thorough, using multiple strong attacks (PGD, AutoAttack, A³) and datasets, with detailed ablation studies that strongly support the authors' claims.\n\nWeaknesses:\nThe primary weakness is the common accuracy-robustness trade-off, where FrameShield shows a slight drop in performance on clean data compared to some other methods. The SRD module, while novel in its application, is built from existing components like Grad-CAM, which is known to be imprecise for object localization, a limitation the authors acknowledge. Finally, there are some minor clarity issues, such as incorrect table references in the main text, which can confuse the reader.", "was_revised": true, "final_justification": "After author feedback, i would keep my rating of accept.", "rebuttal": ""}, {"review_id": "NDiGlhmEHU", "reviewer": "Reviewer_AMcA", "summary": "This paper addresses the lack of adversarial robustness in weakly-supervised video anomaly detection (WSVAD) models by proposing a training framework called FrameShield. FrameShield consists of two stages: first, pseudo-labels are generated by a weakly-supervised model; then, adversarial training is performed using both the pseudo-labels and precise pseudo-anomalies synthesized via the proposed spatio-temporal region disturbance (SRD) method. Experiments show that this approach significantly enhances the adversarial robustness of current WSVAD models across multiple public datasets.", "questions": "Please respond to each item of the weaknesses mentioned above.\nWhile I basically acknowledge the novelty and practicality of the proposed method, several points require further clarification. If the authors can address the following concerns, I will not refuse to raise my score.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The work provides a practical solution to the vulnerability of WSVAD models to adversarial attacks, which is of real-world significance.\n2. The SRD pseudo-anomaly generation method cleverly utilizes strong local perturbations and motion simulation in normal frames, addressing the challenge of label noise in adversarial training.\n\nWeaknesses and Questions:\n\n1. Ped2 is not a weakly-supervised VAD dataset. How were the results of weakly-supervised methods like VADclip obtained on Ped2? What are the implementation details? Since the Ped2 training set contains no anomalous samples, how can weakly-supervised methods that require video-level anomaly labels be evaluated on it?\n2. Most compared methods are traditional MIL or feature aggregation models, which are naturally vulnerable to adversarial perturbations. However, recent methods like LAVAD and Holmes-VAU, which employ multimodal LLMs for video semantic understanding, are inherently more robust to pixel-level perturbations. The authors should compare these stronger baselines and analyze whether video-understanding-based approaches are also susceptible to attacks.\n3. It is evident that the proposed method underperforms without perturbations. How to explain this phenomenon?", "was_revised": true, "final_justification": "After reading the responses from the authors, I find that some of my concerns have been addressed. The detailed explanations of the Ped2 experimental setup, comparisons with recent multimodal LLM-based approaches, and analysis of performance under clean versus adversarial conditions have significantly enhanced my understanding of the method's applicability and experimental rigor. Furthermore, the supplementary results validate the method's robustness against strong baselines. Therefore, I would like to raise my rating and thank to the authors for their detailed responses.", "rebuttal": ""}, {"review_id": "21JHTcPruA", "reviewer": "Reviewer_wNBY", "summary": "The paper addresses adversarial robustness in weakly supervised video anomaly detection approaches, by proposing a pseudo anomaly generation method named SRD. The idea is to apply severe augmentations to localized regions in normal videos.", "questions": "1) Given the real-world nature of video anomaly detection, have the authors considered black-box attacks for their study?\n\n2) The idea of augmentation to eradicate label ambiguity is interesting, but quite similar to some existing literature [1]. It would be nice if the authors could discuss such existing methods, and even better if there are experimental comparisons demonstrating which of the methods is more effective in this particular application.\n\n3) Table 1 is biased in a sense that none of the compared methods are trained against adversarial attacks. It would be more interesting to experiment with a 'modified' version of some of these methods trained against adversarial attacks, then compared in terms of clean performance drop as well as adversarial robustness.\n\n4) Currently, with the limited comparisons, it seems that the proposed approach is dropping the clean accuracy significantly. While adversarial robustness is achieved by sacrificing some clean accuracy, the drop observed here is significantly higher in several cases.\n\n\n\n\n[1] A Multi-Head Approach with Shuffled Segments for Weakly-Supervised Video Anomaly Detection", "limitations": "yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "The paper is interesting in several aspects: 1) It discusses the adversarial robustness issue in VAD and demonstrates that existing approaches are not robust against adversary. 2) It proposed a pseudo anomaly detection approach that addresses this issue.\n\n\nDespite its strengths, the paper has several weaknesses: 1) The clean performance of the proposed approach is quite low. 2) The paper lacks motivation in the sense that adversarial attacks on anomaly detection approaches are only expected in black-box setting. However, the adversarial attack used in the study is white-box.", "was_revised": true, "final_justification": "While the experiments answer my questions, and I agree with most of what the authors have said, I am afraid that the paper needs significant revisions if all of these experiments are made part of the paper. This may require the paper to be significantly changed, thus reviewed again.\n\nNevertheless, as the rebuttal was significantly detailed and addressed my concerns, I am raising my rating to appreciate the authors' efforts.", "rebuttal": ""}, {"review_id": "fMPl7qGr3M", "reviewer": "Reviewer_9XDr", "summary": "This paper examines adversarial robustness in Weakly Supervised Video Anomaly Detection (WSVAD), where training uses only video-level labels, but inference requires frame-level predictions.  The paper proposes FrameShield, which is an adversarial training pipeline specifically designed to enhance robustness of WSVAD against adversarial attacks. \n\nIn the first phase, WSVAD undergoes standard Multiple Instance Learning strategy (X-ClipMIL) allowing it to identify the most critical abnormal segments and generate pseudo labels for each chunk of the video. ​​In the second phase, the WSVAD model undergoes adversarial training using a min-max optimization with pseudo-labels and pseudo-anomalies. Pseudo-anomalies are created via Spatio-temporal Region Distortion (SRD), which applies strong augmentations to Grad-CAM derived binary masks highlighting salient regions. A bounding box is fitted around these regions, and temporal perturbations are introduced by distorting the masked areas along a randomly curved vector across subsequent frames.\n\nExtensive evaluations (AUROC), including comparative, ablation, visualization studies and theoretical motivation demonstrate the effectiveness of the proposed method compared to the existing approaches.", "questions": "Please refer to the points mentioned in the weaknesses above.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength\n\n1. The paper addresses a relevant problem of vulnerability of WSVAD method to adversarial attacks due to constraint of weak supervision in the form of video-level labels. The paper further addresses this research gap by proposing a novel method FrameShield, which integrates synthetic pseudo anomalies and noisy pseudo labels enabling effective adversarial training.\n\n2. The paper is technically sound, well-motivated and backed by comprehensive experimental results, visualizations and ablation studies, and it also includes a theoretical justification for supervised adversarial training over Multiple Instance Learning approaches. The proposed FrameShield framework enhances the robustness of WSVAD against adversarial techniques such as PGD-1000 on the UCSD Ped2, Shanghai, TAD, UCF Crime, and MSAD datasets, while outperforming state-of-the-art methods using AUROC as the evaluation metric on both the entire test set and the anomaly sections of the test set.\n\nWeaknesses\n\n1. The Spatiotemporal Region Distortion (SRD) method employs Grad-CAM with a pre-trained ResNet18 to identify salient regions for pseudo-anomaly generation. Could attention maps from DINOv2 be used to estimate saliency maps for pseudo-anomaly generation, providing a fully unsupervised alternative to the Grad-CAM method used in Spatiotemporal Region Distortion (SRD)?\n2. What is the interpretation of generated Pseudo-anomalies in the latent space compared to normal scenarios?\n3. How efficient and robust is the proposed FrameShield framework for real-time deployment, considering the demands of video anomaly detection in real-world surveillance?\n4. The captions of Table 1 and Table 2 suggest that the results are from the training set and its anomaly sections, while lines 275-277 state that performance is measured on the test set. This discrepancy requires clarification.\n5. The sentence structure appears unnecessarily complex in some places, such as line 46 (\"This design…\"). Too much use of — in the paper such as Line 3, 36, 38, 41, 42, 45, 108, 125. \n6. There is no Table X in the paper, contrary to what is mentioned in line 305.", "was_revised": true, "final_justification": "Most of my concerns regarding the use of attention of DINOv2 attention maps for saliency estimation, interpretation of pseudo-anomalies in latent space and the deployment of the proposed method in real-time systems have been satisfactorily resolved. Therefore, I will raise my current score.", "rebuttal": ""}]

Author rebuttal:

Meta-review: This paper proposes a defense framework for Weakly Supervised Video Anomaly Detection (WSVAD) against adversarial attacks. The method introduces Spatiotemporal Region Distortion (SRD), which generates synthetic anomalies by augmenting localized regions in normal videos while maintaining temporal consistency. Combining these synthetic anomalies with noisy pseudo-labels enables effective adversarial training. Experiments show that the approach improves robustness, outperforming state-of-the-art methods across multiple benchmarks.

The authors’ rebuttal adequately clarified several key questions raised by the reviewers. Additional experiments were also provided, which further strengthened the paper. As a result, multiple reviewers raised their scores and all supported the acceptance of the paper. The authors are encouraged to incorporate the new discussions and experimental results into the final version.
Decision: Accept (poster)